May 2014 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

ipaddr, ipv4addr ipv6addr
by Arran Cudbard-Bell 06 Mar '15

06 Mar '15

The behaviour of the ipaddr config item has changed slightly for 3.0.4. If the ipaddr value contains ':' or '[' or ']', it will be treated as an IPv6 address. If it fails to parse as an IPv6 address the server will refuse to start. If the ipaddr value does not contain any ipv6 chars the server will first check to see if it looks like an ipv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else if a AAAA record is available else the server will refuse to start. If instead of the ipaddr config item the ipv4addr config item is used the server will check if it looks like an IPv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else the server will refuse to start. If instead of the ipaddr config item the ipv6addr config item is used the server will check if it looks like an IPv6 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching AAAA record is available it will be used, else the server will refuse to start. The behaviour is similar for the client, home_server and listen sections. Though those config items in client sections may have an optional /[0-9]{1,3} suffix to map clients to ranges of IP addresses. This should also work with things like example.org/96 though i'm not entirely sure why you'd ever want to do that. 'netmask' is now deprecated but will still function as expected until 3.1.0. These changes should make it slightly easier to manage v4/v6 transitions. Wildcard clients 0.0.0.0 <ipaddr>/0 '*' are not supported. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 15

How to configure FreeRADIUS for Kerberos and LDAP
by Brendan Kearney 27 Jan '15

27 Jan '15

i have put together a doc to assist in the configuration of FreeRADIUS to use Kerberos for authentication (AuthN) and LDAP for authorization (AuthZ). I have modelled the configs after my environment, and taken into account the design and implementations choices i have made. others may have different needs, so some directives or values may need to be changed based on those needs. i make no guarantees that my configs will work in your environment. i have tried to use simple language, but be concise, precise and accurate. if points are ambiguous, lacking clarity or leave room for misinterpretation, please provide constructive feedback. if steps are sub-optimal, incorrect or contain typographical errors, please keep me honest, and indicate where the errors have occurred. i release this doc into the ether and lay no claim to its format, the data contained within it nor to the intellectual property rights of the rightful owners of any trademark, servicemark or copyright. thank you, brendan kearney

2 2

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

radutmp file not created
by Khapare Joshi 03 Jul '14

03 Jul '14

hi I am not able to do radwho since radutmp is not created, In Radius -X it tells me radutmp module is loaded and file should be /var/log/radius/radutmp Freeradius version is : freeradius-2.2.3-6.el6.x86_64 Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } And, In /var/log/radius/radacct/192.168.1.1/auth-detail-20140430, NAS seem to sending request packet to the server Wed Apr 30 10:58:41 2014 Packet-Type = Access-Request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser(a)ba.com" State = 0x882dba688924a0df1b204ef3b696b63f Calling-Station-Id = "00215c5b8ef3" Called-Station-Id = "dca5f44de9c0:eduroam-tmp" NAS-Port = 1 Cisco-AVPair = "audit-session-id=82d0a5f700000e5a535fb9e9" NAS-IP-Address = 192.168.1.1 NAS-Identifier = "mywireless1" Airespace-Wlan-Id = 310 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 In /etc/raddb/sites-enabled/default accounting section radutmp is uncommented And, still radutmp file is not created in /var/log/radius directory. When I run the freeradius in debug mode (radiusd -X) and test authenticate user I get following: Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 54636, id=127, length=139 User-Name = "testuser(a)ba.com" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Message-Authenticator = 0xee4209c0650849c1f6d60a5f94bf5a9b MS-CHAP-Challenge = 0x3feecd0086804485 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000077ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok ++[digest] = noop [suffix] Looking up realm "ba.com" for User-Name = "testuser(a)ba.com" [suffix] Found realm "ba.com" [suffix] Adding Stripped-User-Name = "testuser" [suffix] Adding Realm = "ba.com" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry DEFAULT at line 3 ++[files] = ok [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap] expand: ou=People,dc=BA,dc=com -> ou=People,dc=BA,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.ba.com:389, authentication 0 [ldap] bind as / to ldap.ba.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=BA,dc=com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +group MS-CHAP { [mschap] Client is using MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> testuser [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=testuser [mschap] mschap1: 3f [mschap] expand: %{mschap:Challenge} -> 3feecd0086804485 [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3feecd0086804485 [mschap] expand: %{mschap:NT-Response} -> 77ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=77ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 Exec output: NT_KEY: 04066C8C6B0E8CFCABBB0AB6760971F7 Exec plaintext: NT_KEY: 04066C8C6B0E8CFCABBB0AB6760971F7 [mschap] Exec: program returned: 0 [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] = ok +} # group MS-CHAP = ok # Executing section session from file /etc/raddb/sites-enabled/default +group session { [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp ++[radutmp] = ok So, even though it says radutmp = ok the file /var/log/radius/radutmp is not created. I must be doing something wrong or my configuration is not correct for radutmp. I appericiate some inputs. Thanks K

3 7

LDAP Groups to Freeradius and then Ruckus Wireless?
by Enrique Sainz Baixauli 17 Jun '14

17 Jun '14

Hello there, I'm trying to deploy a FreeRadius server with OpenLDAP. To this end, both are working properly and communicate with each other successfully. I have LDAP groups set up so users belong to a group and I can check from freeradius' users file if a user belongs to a group (and, for example, deny access to all users belonging to a certain group). I must say that, if I enable group checking in users file, I can see rlm_ldap debug info about it searching for group information; but if it's not enabled it doesn't search for groups. The issue here is that the server will be used to authenticate wifi users from a Ruckus ZoneDirector device, which defines roles and assigns roles to the users depending on the groups that the users belong to. This works flawlessly when authenticating against LDAP itself, but if freeradius stands in the middle the group info gets lost somewhere. I know that freeradius can access Ldap-Group variable and know which group the user belongs to, but I'd like it to forward that info to the ZoneDirector (who is actually performing the authentication request against freeradius), so that it can assign the role properly. The LDAP database is set up with two OUs, users and groups, and users being of objectClass inetOrgPerson and groups being groupOfNames. In freeradius, ldap config is mostly default except for server, identity, etc, but with these group-related parameters: groupname_attribute = cn groupmembership_filter = (&(objectClass=groupOfNames)(member=%{control:Ldap-UserDn})) groupmembership_attribute = member # (also tried with memberOf, radiusGroup, radiusGroupName and several others) And, about the server, it is running Debian 7.5, OpenLDAP 2.4.31 and freeradius 2.1.12 (default packages from debian). I can provide any other info that you need :) Thanks everyone in advance!

8 76

Android 2.3.5 supplicants failing after upgrade to FreeRADIUS 2.2.5 from 2.2.0
by Robert Franklin 02 Jun '14

02 Jun '14

Hello, We've suddenly started having reports of problems authenticating to our eduroam 802.1X service from users with Android 2.3.5 phones since an upgrade of FreeRADIUS on Tuesday morning this last week. As far as we're aware, no other body of users are affected, including newer Android devices: our Service Desk are just noticing this OS as a significant pattern. We were running FreeRADIUS 2.2.0, running on SLES 11 SP2, but upgraded to 2.2.5 and SLES 11 SP3, as far as we're aware, no other changes were made to the configuration, nor certificates. This is aside from a period of about 45 minutes following the upgrade where a mistake in the RPM caused the sites-available/default and inner-tunnel files to be overwritten with the default ones, before our local copies were reinstated. This obviously trashed much of our local configuration, causing authentication to fail for a period. We know at least one user affected tried to connect during this time but are unsure if all the affected users also did so, nor if other Android 2.3.5 users are successful (I'm trying to lay my hands on one which didn't). This situation may have upset the phones but we've tried removing the configuration from them, restarting them and then re-entering everything, but still they cannot connect. I have tried the same username/password on a Windows 7 laptop, also using EAP/PEAP and that connects fine. Looking at the debug (with raddebug on the Calling-Station-Id of an affected device's MAC address; a '-X' is a little busy) it seems to engage in an EAP dialogue with FreeRADIUS but then stops partway through. I've attached a gzipped copy of the raddebug -- I could send "radiusd -X" but I don't think there'll be anything pertinent in there as all the other supplicants are working, but I'm happy to, if necessary. The big lumps of hex in the EAP stuff doesn't make sense to me (I'm hoping it does to someone else!) but I have compared it with a successful device (an iPhone with a different username) to see where they differ. Everything seems OK up to request 21021170 (which finishes on line 646 of the file), where an Access-Challenge goes back to the supplicant. The following Access-Request has a very short EAP-Message compared to the successful iPhone, which makes me think EAP is aborting/restarting or broken somehow. On the iPhone, after two more packets, peap reports that TUNNEL ESTABLISHED, whereas the Android device never does. Please let me know if you need anything else. There may be something else that has broken on the server, or a bit of configuration that has been corrupted, but it's odd it's just (apparently) affecting this class of device, but we don't think we've changed certificates or anything else. The weird thing here is why just Android 2.3.5 (or possibly everything < version 3?) is failing, following the upgrade. I can't spot anything has changed in the FreeRADIUS release notes that I might need to change, nor any reports of similar problems. Thanks in advance for any help, - Bob -- Bob Franklin rcf34(a)cam.ac.uk / +44 1223 748479 Networks, University Information Services, University of Cambridge

4 5