July 2016 - Freeradius-Users - lists.freeradius.org

(no subject)
by تعلم البرمجة 13 Jul '16

13 Jul '16

hello i want allow all ipv4 home server to control coa client 0.0.0.0/0 { secret=123123 coa_server= example_coa #working fine } home_server example_coa { type=coa ipaddr= * #allow all ip Not working secret=123123 ..... } sorry for my language english

1 0

FreeRadius logs into ELK server
by Alex Sharaz 12 Jul '16

12 Jul '16

Just been looking at configuring an ELK server for various stuff and was wondering if anyone had done any work in importing freeradius logs into one A

3 5

FreeRADIUS 3.0.1 [Proxy To Another Radius if Reject Received]
by Ibrahim Almahfooz 12 Jul '16

12 Jul '16

Hi Everybody, We are an ISP and we have two radius servers. Each is connected to a different Database for a purpose. One of our requirements is to tune the primary radius to proxy requests to the secondary in case those requests got rejected by the primary. Flow is as below: Request flow need to be Primary to Secondary (One-way ONLY) Requests are sent to the Primary Radius, then if: a- Access Accept - Okay b- Access Reject - Send same request to the secondary Radius. Would you be so kind and advise on the above setup? Is it doable and what are the possible methods to implement such? Kind regards, Ibrahim --

3 8

pam_radius - Choose Authentication Type
by tirili＠web.de 11 Jul '16

11 Jul '16

Hello list, is there a possibility to force authentication type for a specific NAS? Currently - when having pam_radius configured for SSHD logins there is "User-Password" sent in clear. How could MSCHAP being forced? e.g. from radtest mschap is working, and I get an Accept. radtest -t mschap -x aduser adpassword 192.168.0.123:21812 0 testing123 Sending Access-Request Id 83 from 0.0.0.0:58815 to 192.168.0.223:21812 User-Name = 'aduser' NAS-IP-Address = 192.168.0.238 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x30fb2004f73cbc0e MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000023532ec8407591c34 d2c080afae6edb888f822115566aabb Received Access-Accept Id 83 from 192.168.0.223:21812 to 192.168.0.238:58815 length 84 MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Using PAM_RADIUS trying to Login: rad_recv: Access-Request packet from host 192.168.0.238 port 41971, id=41, length=91 User-Name = "aduser" User-Password = "adpassword" NAS-IP-Address = 192.168.0.238 NAS-Identifier = "sshd" NAS-Port = 27766 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "localhost" Mon Jul 11 11:11:50 2016 : Info: +- entering group authorize {...} Mon Jul 11 11:11:50 2016 : Info: [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.238/detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.238/detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [detail] expand: %t -> Mon Jul 11 11:11:50 2016 Mon Jul 11 11:11:50 2016 : Info: ++[detail] returns ok Mon Jul 11 11:11:50 2016 : Info: [preprocess] hints: Matched DEFAULT at 35 Mon Jul 11 11:11:50 2016 : Info: [preprocess] expand: %{User-Name}(a)test.local -> aduser(a)test.local Mon Jul 11 11:11:50 2016 : Info: ++[preprocess] returns ok Mon Jul 11 11:11:50 2016 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.238/auth-detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.238/auth-detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [auth_log] expand: %t -> Mon Jul 11 11:11:50 2016 Mon Jul 11 11:11:50 2016 : Info: ++[auth_log] returns ok Mon Jul 11 11:11:50 2016 : Info: ++[mschap] returns noop Mon Jul 11 11:11:50 2016 : Info: [suffix] Looking up realm "test.local" for User-Name = "aduser(a)test.local" Mon Jul 11 11:11:50 2016 : Info: [suffix] Found realm "test.local" Mon Jul 11 11:11:50 2016 : Info: [suffix] Adding Stripped-User-Name = "aduser" Mon Jul 11 11:11:50 2016 : Info: [suffix] Adding Realm = "test.local" Mon Jul 11 11:11:50 2016 : Info: [suffix] Authentication realm is LOCAL. Mon Jul 11 11:11:50 2016 : Info: ++[suffix] returns ok Mon Jul 11 11:11:50 2016 : Info: [eap] No EAP-Message, not doing EAP Mon Jul 11 11:11:50 2016 : Info: ++[eap] returns noop Mon Jul 11 11:11:50 2016 : Info: ++[unix] returns notfound Mon Jul 11 11:11:50 2016 : Info: ++[files] returns noop Mon Jul 11 11:11:50 2016 : Info: ++[expiration] returns noop Mon Jul 11 11:11:50 2016 : Info: ++[logintime] returns noop Mon Jul 11 11:11:50 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Jul 11 11:11:50 2016 : Info: ++[pap] returns noop Mon Jul 11 11:11:50 2016 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Mon Jul 11 11:11:50 2016 : Info: Failed to authenticate the user. Mon Jul 11 11:11:50 2016 : Auth: Login incorrect: [aduser(a)test.local] (from client bastionng port 27766 cli localhost) Mon Jul 11 11:11:50 2016 : Info: Using Post-Auth-Type Reject Mon Jul 11 11:11:50 2016 : Info: +- entering group REJECT {...} Mon Jul 11 11:11:50 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> aduser(a)test.local Mon Jul 11 11:11:50 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 11 11:11:50 2016 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 11 11:11:50 2016 : Info: Delaying reject of request 0 for 1 seconds Mon Jul 11 11:11:50 2016 : Debug: Going to the next request Mon Jul 11 11:11:50 2016 : Debug: Waking up in 0.9 seconds. Mon Jul 11 11:11:51 2016 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 41 to 192.168.0.238 port 41971 Mon Jul 11 11:11:51 2016 : Debug: Waking up in 4.9 seconds. Any help is appreciated. Thomas

3 2

Re: using SSL certs with EAP-TLS
by Wouter 11 Jul '16

11 Jul '16

>>> Again, all is working, but I'd like to get rid of the warning! Any >>> help? I also sent Matthieu an email offlist. After reading http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/iOS-quot-no… and https://discussions.apple.com/thread/5967450 I'm beginning to think: it can't be done, no warning on iOS. One will always get a certificate not verified warning upon the first connect in iOS. iOS's brother OS X is not complaining.

2 1

How to work with dynamic ips from ippool and static ips for clients?
by Diorges Rocha - Radionet Telecom 09 Jul '16

09 Jul '16

Is there a way to do this in the same datatabase? I would like to work with ippool, but some users need static ip. How to proceed in this case? Thank you -- Diorges Rocha Gerente de TI Tel.: (67) 3451-4035 Cel.: (67) 9938-1105 R. Edson Bezerra, 685 - Centro Itaporã - MS - Brasil CEP 79890-000

2 1

Re: error coovachilli , freeradius, yfi hotspot manager
by José Borges 08 Jul '16

08 Jul '16

>> redir.c: 1023: 98 (Address already in use) IP: 10.1.0.1 Port: 3990 - >> Waiting for retry. Start with that. That usually means chilli hasn't been properly configured yet. I also have this... what is the solution?

2 1

add realm based on NAS-IP
by tirili＠web.de 08 Jul '16

08 Jul '16

Hello list, I just want to add users coming from a specific NAS add a realm. This seems not to be working. Any help is appreciated. These files are modified for testing purposes. DEFAULT NAS-IP-Address == "127.0.0.1" User-Name = "%{User-Name}(a)test.local" DEFAULT NAS-IP-Address == "192.168.1.238" User-Name = "%{User-Name}(a)test.local" I have ./users to identify the user. testuser1(a)test.local Cleartext-Password := "geheim" testuser2 Cleartext-Password := "geheim" When performing a "radtest testuser1(a)test.local geheim 127.0.0.1:1812 0 testing123" this is working. Sending Access-Request Id 146 from 0.0.0.0:43466 to 127.0.0.1:1812 User-Name = 'testuser1(a)test.local' User-Password = 'geheim' NAS-IP-Address = 192.168.1.238 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 146 from 127.0.0.1:1812 to 127.0.0.1:43466 length 20 When performing a "radtest testuser2 geheim 127.0.0.1:1812 0 testing123" this is working as well (but should not, as @test.local should be appended!!) Sending Access-Request Id 25 from 0.0.0.0:45877 to 127.0.0.1:1812 User-Name = 'testuser2' User-Password = 'geheim' NAS-IP-Address = 192.168.1.238 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 25 from 127.0.0.1:1812 to 127.0.0.1:45877 length 20 When performing a "radtest testuser1 geheim 127.0.0.1:1812 0 testing123" I get a reject (but should not, as @test.local should be appended). Sending Access-Request Id 223 from 0.0.0.0:38701 to 127.0.0.1:1812 User-Name = 'testuser1' User-Password = 'geheim' NAS-IP-Address = 192.168.1.238 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Reject Id 223 from 127.0.0.1:1812 to 127.0.0.1:38701 length 20 (0) -: Expected Access-Accept got Access-Reject Attached is full debug output. Any help is appreciated. Best regards, Thomas

2 2

New EAP method: EAP-AKA.
by Alan DeKok 08 Jul '16

08 Jul '16

We' just added EAP-AKA to the v4.0.x branch. This method is similar to EAP-SIM, and is mainly used in the telco industry, especially in WiFi hand-off. This work was sponsored by a telco who wishes to remain anonymous. We have another popular EAP method coming soon, too. The new EAP methods will not be available in version 2.x or version 3.0, as those are stable versions which have no new features. They will be available in the v4.0.x branch, which has other new features which the methods need. Alan DeKok.

5 8

Contextual mapping of LDAP attributes
by Adamczak Krzysztof 07 Jul '16

07 Jul '16

Hey guys, I have another question. Again I haven't found nice solution yet. How can I map different LDAP attribute to the same RADIUS attribute depending on some access request parameters? E.g. in my LDAP I have: - adslVirtualRouterName - xdslVirtualRouterName - xxxVirtualName I'd like to map this LDAP attribute to RADIUS ERX-Virtual-Router-Name depending on e.g. NAS-IP-Address. One solution would be declare some additional variables in /etc/raddb/dictionary and just map it in ldap module update section. But is there better solution? thanks, Krzysztof

5 7