August 2016 - Freeradius-Users - lists.freeradius.org

Passwords Rotation
by Kris Armstrong 30 Aug '16

30 Aug '16

is there a way to have the password for a client to change every time perhaps increment or perhaps setup rotating passwords for a specific user? I'm running FreeRadius 3.0.10 on Fedora 23 i.e. Password 2nt Login Password1 3rd login Password2 Or something like this. The main goal is for the password to change after each login?

5 4

What are supported backends to store accounting data
by val john 30 Aug '16

30 Aug '16

Hi all In Freeradius whats are the supported backeds to store accounting data ?. Thank You John

4 6

Error when enabling the rlm_rest module
by val john 30 Aug '16

30 Aug '16

Hi All Curtly im trying to push accounting data to http end point using rlm_rest module 1. I have compiled and install the module ./configure make make install 2. Then enabled the rest module as below cd raddb/mods-enabled ln -s ../mods-available/rest 3. Then add the "rest" module to the vi site-enable/default file's accounting section accounting { rest unix exec attr_filter.accounting_response } 4. After that when i executed the *radiusd -X* i got the below error *ERROR* *=======* Creating attribute Unix-Group /usr/local/etc/raddb/mods-enabled/rest[1]: Failed to link to module 'rlm_rest': /usr/local/lib/rlm_rest.so: cannot open shared object file: No such file or directory Please advice how to fix this issue Thank You John

2 1

PEAP with LDAP as authentication source
by Ana Gallardo Gómez 30 Aug '16

30 Aug '16

Hello, I need help. I'm using: FreeRADIUS Version 3.0.11, for host x86_64-pc-linux-gnu, built on May 26 2016 at 10:07:32 I don't know if I can use PEAP with LDAP as authentication source... The problem I found is that inner-tunnel server doesn't receive User-Password attributte, so the bind in authentication is not successful: (9) eap_peap: Sending tunneled request to eduroam-inner-tunnel (9) eap_peap: EAP-Message = 0x0209004d1a0209004831678809c2e1e7af9fae454407917654e20000000000000000d365e8f3b9d860ae2fe0ee6bc7c83938c49ac777fc41713600616967616c6c6172646f40756e65782e6573 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "aigallardo(a)unex.es" (9) eap_peap: State = 0x2af2ae6c2afbb4875ef1f60eaa5df0a2 (9) eap_peap: NAS-IP-Address = 127.0.0.1 (9) eap_peap: Calling-Station-Id := "02-00-00-00-00-01" (9) eap_peap: Framed-MTU = 1400 (9) eap_peap: NAS-Port-Type = Wireless-802.11 (9) eap_peap: Connect-Info = "CONNECT 11Mbps 802.11b" (9) Virtual server eduroam-inner-tunnel received request ... (9) Found Auth-Type = LDAP (9) # Executing group from file /etc/freeradius/sites-enabled/eduroam-inner-tunnel (9) Auth-Type LDAP { (9) redundant redundant_ldap_auten_email { (9) ldap1_auten_email: WARNING: You have set "Auth-Type := LDAP" somewhere (9) ldap1_auten_email: WARNING: ********************************************* (9) ldap1_auten_email: WARNING: * THAT CONFIGURATION IS WRONG. DELETE IT. (9) ldap1_auten_email: WARNING: * YOU ARE PREVENTING THE SERVER FROM WORKING (9) ldap1_auten_email: WARNING: ********************************************* (9) ldap1_auten_email: ERROR: Attribute "User-Password" is required for authentication (9) [ldap1_auten_email] = invalid (9) } # redundant redundant_ldap_auten_email = invalid (9) } # Auth-Type LDAP = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject My configuration: peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } It is posible use PEAP with LDAP as authentication source? with TTLS-PAP or TTLS-MsCHAPv2 it works. Thank you very much and sorry for my english. -- :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

3 3

ip change randomlly
by Zubair Ayub 29 Aug '16

29 Aug '16

i have ISP company and have thousands of users and sir i want to give my user diffrent ip everytime they connect through radius. Thanks

1 0

Re: Freeradius-Users Digest, Vol 136, Issue 55
by Mohamad Yazdian 28 Aug '16

28 Aug '16

I think I have problem with sqlcounter...!!! I can't monitor periodicaly user information from radacct. My NAS send each 10 second data to my freeradius so freeradius get this data and save they on the radacct table but I can't rum the appropriate event between them. For example when total download /upload user from radacct > 1G then disconnect the user connection. I can not see any request on the Mikrotik Radius Incoming. I do much more google it but just I find this configuration for freeradius sqlcounter but it's not work fine. On Sun, Aug 28, 2016 at 1:00 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Disconnect user when hit bandwith (Alan DeKok) > 2. Re: Disconnect user when hit bandwith (Vijay S) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 27 Aug 2016 07:58:42 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Disconnect user when hit bandwith > Message-ID: <0B7ADD16-C1B8-4E76-B03F-F0AB4DA6DCD2(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Aug 26, 2016, at 2:10 PM, Mohamad Yazdian <m.programer(a)gmail.com> > wrote: > > I use the Mikrotik-Total-Limit in my sqlcounter and add this counter name > > on the radcheck table for my users so when my users hit the 1G bandwith > (1 > > week etc.) the connections are not droped...!!! > > Ask Mikrotik why their NAS doesn't work. > > Alan DeKok. > > > > ------------------------------ > > Message: 2 > Date: Sun, 28 Aug 2016 12:09:43 +0530 > From: Vijay S <vijay.hcr(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Disconnect user when hit bandwith > Message-ID: > <CAPTJ3-drCEwsDgxJC+QeXxkKrKexDOAQQg9Yw8999DERmHyo > UQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi Mohamad, > Set reply value of 1g manually for user and see if it disconnect on usage > of 1g in mikrotik nas before diving into freeradius configuration details. > Once you sure that your nas is doing what it meant to do then you can start > digging into FR config. > > Regards > Vijay A. > +91 9930804010 > > On Aug 26, 2016 11:41 PM, "Mohamad Yazdian" <m.programer(a)gmail.com> wrote: > > Hello > I use freeradius for authenticate my PPPoE users and I NAS router is > mikrotik. > every think is fine like as authentication and expiration in the monthly > date but now I like to limit my users for 1G downloadn per month but when I > make a sqlcounter and add this counter to the site-available default > (authorize{}). > > I use the Mikrotik-Total-Limit in my sqlcounter and add this counter name > on the radcheck table for my users so when my users hit the 1G bandwith (1 > week etc.) the connections are not droped...!!! > But when the users disconnect the pppoe connection and try again to connect > get the access denied message. > > I like to dissconnect the pppoe connection when hit 1G. > > Please advise me how to solve this issue. > > Thank you > > sqlcounter sample_Limit{ > counter-name = Mikrotik-Total-Limit > check-name = Mikrotik-Total-Limit > reply-name = Mikrotik-Total-Limit > sqlmod-inst = sql > key = User-Name > reset = never > query = "SELECT > ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE > UserName='%{%k}'" > } > > > sample_Limit{ > reject = 1 > } > if(reject){ > update reply { > Reply-Message := "You have reached your bandwidth limit" > } > reject > } > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 136, Issue 55 > ************************************************* >

2 1

Re: Disconnect user when hit bandwith
by Vijay S 28 Aug '16

28 Aug '16

Hi Mohamad, Set reply value of 1g manually for user and see if it disconnect on usage of 1g in mikrotik nas before diving into freeradius configuration details. Once you sure that your nas is doing what it meant to do then you can start digging into FR config. Regards Vijay A. +91 9930804010 On Aug 26, 2016 11:41 PM, "Mohamad Yazdian" <m.programer(a)gmail.com> wrote: Hello I use freeradius for authenticate my PPPoE users and I NAS router is mikrotik. every think is fine like as authentication and expiration in the monthly date but now I like to limit my users for 1G downloadn per month but when I make a sqlcounter and add this counter to the site-available default (authorize{}). I use the Mikrotik-Total-Limit in my sqlcounter and add this counter name on the radcheck table for my users so when my users hit the 1G bandwith (1 week etc.) the connections are not droped...!!! But when the users disconnect the pppoe connection and try again to connect get the access denied message. I like to dissconnect the pppoe connection when hit 1G. Please advise me how to solve this issue. Thank you sqlcounter sample_Limit{ counter-name = Mikrotik-Total-Limit check-name = Mikrotik-Total-Limit reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE UserName='%{%k}'" } sample_Limit{ reject = 1 } if(reject){ update reply { Reply-Message := "You have reached your bandwidth limit" } reject } - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

unlang tmp-integer multiply or divide
by Dinesh Bhardwaj 26 Aug '16

26 Aug '16

Hi, I need to multiply two tmp-integers but not getting it to work Here is my code Tmp-Integer-4 := "1" Tmp-Integer-5 := "%{expr:4294967296 * %{Tmp-Integer-3}}" Tmp-Integer-6 := "%{expr:%{Tmp-Integer-1} * %{Tmp-Integer-3}}" number 1 and 2 works 3 doesnt. Thanks, -- Dinesh Bhardwaj Chief Technology Officer Rural Broadband Pvt. Ltd. www.airjaldi.com Tel. (91) 985-757-0709 Skype: dineshbhardwaj

2 3

Not setting Auth-Type
by Roberto Rios 25 Aug '16

25 Aug '16

hello guys. I am configuring radius with ldap. The binding is succesfull, but when I try to radtest an existing user i get this error: (2) [logintime] = noop (2) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (2) WARNING: pap : Authentication will fail unless a "known good" password is available (2) [pap] = noop (2) } # authorize = ok (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (2) Failed to authenticate the user ..with a rejected response. The user does exists in active directory. using : FreeRADIUS Version 3.0.4 radtest line: radtest xxxxxx1 xxxxxxx1 localhost 0 testing12 I keep reading not to set Auth-type and let the system do its thing. What am I missing? Thank you

3 5

LDAP / mschap Error
by Andreas Zwinzscher 25 Aug '16

25 Aug '16

Dear freeradius-users, I have got a problem with the implementation of the freeradius and ldap-authentication. I've running a freeradius version 2.2.8 and so far, everything is working well. Connetion to the AD works well. The ntlm_auth module also works if I do the test. But now the problem: The clients are using Windows 7 , 8.1 or 10. If I do a manual login with username/password the authentication works well. But if I activate the option to use the windows login informations, the authentication fails. I got an MSCHAP error. So I tried a few things to figure out where the problem is. radtest - t mschap username password localhost 0 testing123 This works very well. Ok...but the username comes with another format, if I do an authentication via Windows. So I tried following: radtest -t mschap DOMAIN//username password localhost 0 testing123 Well...this also works. I recieve an access-accept packet. So I studied the logs more in detail and found out, that the first letter of the username is case sensitive. So I did a new test: radtest -t mschap DOMAIN//Username password localhost 0 testing123 And here I got the same mschap-error as with the (automatic) windows authentication. If I do a check with wbinfo -u I see every username written in lower case letters only. I also checked if the freerad user has permissions on winbindd_priv. Everything should be allright here. The "with-ntdomain-hack = yes" option is also enabled. So I really got no idea where to look next. I have an almost identical setup running very well, also with windows-authentication. The only difference is that I use an older freeradius version here. I think it's 2.1.18. Would be great if someone got some tipps for me. Thanks. Andreas

4 7