March 2014 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Freeradius proxy support
by Ilavajuthy Palanisamy 15 Apr '14

15 Apr '14

Hi, I'm new to Freeradius. I would like to get some pointers and documentation details about setting up Freeradius as proxy. Our requirement is to have a Radius proxy and modify the Access Accept response based on certain criteria. Few questions regarding Freeradius proxy support. Does Freeradius proxy has support for a plugin probably in Java to snoop the Radius request calls? Does Freeradius proxy setup has option to specify which Radius server to pickup based on some attribute value in Access Request? Our requirement is to have multiple Radius Servers for certain groups. This group information will be available in one of the VSA in Access Request. Any help will be really helpful. Thanks, Ila.

4 8

Freeradius v3 + Active Directory + WPA2 Enterprise + ntlm + mschapv2
by banditfr 02 Apr '14

02 Apr '14

i need solution for freeradius v3

7 12

rlm_perl - Asymmetric attribute encoding
by Scott Ireland 01 Apr '14

01 Apr '14

I'm seeing some inconsistent handling of encoding/escaping of attributes in rlm_perl between calls to the module (i.e. when setting an attribute in one call and then reading it back in the next). I was expecting "something out, something in", but instead I'm getting "something out, something-modified in". In authorize, my script does an LDAP lookup and then sets the $RAD_CHECK{'Ldap-UserDn'} attribute for later: rlm_perl: Added pair Ldap-UserDn = CN=Ireland\, Scott,OU=[...] In authenticate, I go to read this back but find that the \ in the attribute is coming back to me escaped: rlm_perl: Added pair Ldap-UserDn = CN=Ireland\\, Scott,OU=[...] So, I end up having to strip off the escaping backslashes before using the value. I'm seeing something similar with the State attribute going out in an Access-Challenge and coming back in on the next Access-Request. In authorize, I set $RAD_REPLY{'State'} to the single byte value 0x01 that I send back in an Access-Challenge rlm_perl: Added pair State = ? Sending Access-Challenge of id 253 to [ip] port 63308 State = 0x01 When authorize next sees the follow-up request from the NAS, things look OK in the RADIUS packet: rad_recv: Access-Request packet from host [ip] port 14034, id=254, length=146 State = 0x01 rlm_perl: Added pair State = 0x01 But when I read it in Perl, $RAD_REQUEST{'State'} comes back as the string "0x01", so I have to turn around and pack() this to get back what I put in. The same thing happens for different values as well; for instance, if I were to use the literal 1 as a value, State goes out as 0x31 (the string "1") and comes back in as the string "0x31", which again needs a pack() to fix. I've been able to work around this by doing a bit of extra processing when I read any of these attributes back, but it doesn't really seem like intended behaviour.

2 5

Changing Class attribute from octets to string
by Antonio Modesto Amaral Sousa 01 Apr '14

01 Apr '14

Hello, I need to use the class attribute in order to assign the user to a service plan in a DPI box. The Class attribute is been carried in the acct packets, the problem is that Freeradius is converting it to hexadecimal, I've changed the type from octets to string and restarted the service but it continued to be converted to hex. What can I do to get this attribute to be carried in plain text format? Thanks. --

2 4