October 2018 - Freeradius-Users - lists.freeradius.org

FreeRADIUS with FortiClient help
by Dimitrios Panagiotaros 11 Oct '18

11 Oct '18

Hello, My name is Dimitrios and I've successfully set up a test FreeRADIUS and AD server and am able to authenticate to AD via the FreeRADIUS server. I've also been able to include the Google Authenticator and authenticate with 2FA when I SSH into a linux box with it. What I'm trying to do is see if it is possible to authenticate via a FortiClient SSL VPN with 2FA. I'm able to authenticate without 2FA but whenever I go to add 2FA, I receive errors and it's not able to. I'm reaching out because I'm trying to figure out if there is any documentation out there for this or if you know of a way to do this? I've seen in a couple forums that this is possible but no one has elaborated on how to go about doing this and figured I'd reach out to see if maybe anyone else has heard of this. Please let me know! Thanks, Dimitrios Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more visit the Mimecast website.

2 1

Freeradius 3.0.15 Fair Usage Policy doesn't work
by Görkem İnanç Korkmaz 10 Oct '18

10 Oct '18

I am running on the freeradius 3.0.15 on Ubuntu 16.04 almost over 4 month. But still I couldn't figure out how to deploy fair usage policy. I just want to reply Mikrotik-Rate-Limit to user when they hit the quota for daily. 1- nano /etc/freeradius/mods-enabled/sqlcounter I added the following counter sqlcounter dailyquota{ count_attribute = Acct-Input-Octets counter_name = My-Total-Data-Limit check_name = My-Total-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE UserName='%{User-Name}'" } 2- nano /etc/freeradius/sites-enabled/default nano /etc/freeradius/sites-available/default In authorize section added the counter name authorize { ...... dailyquota ...... } In accounting section added the counter query and reply message accounting { ...... if ( "%{sql: SELECT ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE UserName='%{User-Name}'}" > "%{sql: SELECT value from radcheck where username='%{User-Name}' and attribute='My-Total-Limit'}" ) { update disconnect { Mikrotik-Rate-Limit := "2M/2M" Reply-Message := "You have reached your transfer limit. Limited bandwidth" } } ...... } 3- Define the My-Total-Limit attribute on dictionary ATTRIBUTE My-Total-Limit 3001 integer64 4- Add the user with the attribute that 10 MB quota INSERT INTO radcheck (id ,username ,attribute ,op ,value) VALUES (NULL , 'gorkem', 'Cleartext-Password', ':=', '123'); INSERT INTO radcheck (id ,username ,attribute ,op ,value) VALUES (NULL , 'gorkem', 'My-Total-Limit', ':=', '10000000'); 5- Restart the freeradius service, try to authenticate then look your accounting data. Result is interesting, when user pass over his quota (10MB), user can still keep going to use internet. Nothing changed while user is connected. But If the user logout, He try to login again reply message deployed when he logged in. After than user can get the new speed limit for his session. I don't want to do this. I think it must be automatically. I want to send CoA reqeust to Mikrotik NAS client for change the user speed limit automatically. How can I achive that? Is there anyone figure out, that how to do ? Here is my debug output: https://drive.google.com/open?id=1ClT3D291tO6GXf9L6VPJ1h1ZTsizFUhu Also there one more question, in my debug output that i realized. When I add the dailyquota freeradius, it automatically add the reply_name=Session-Timeout to counter. So I looked on the Mikrotik router of the users session timeout is deployed My-Total-Limit value as the time 10000000 seconds (almost 116 day) How can I solve this problem, Is there anyone figure out, how it should be done? Görkem İnanç KORKMAZ Junior IT Engineer

3 5

REG: difference in debug and normal mode
by 8zero2 operations 10 Oct '18

10 Oct '18

Hi, Is there a difference in terms of the way packets are accepted when running in debugging mode versus the normal mode. I have a very strange scenario where radius crashes when put in normal mode but runs just fine in debugging mode. I suspect it may be due to sudden surge in load, but then that would only be the case when the way radius handles packets in the two cases is different. Thanks in advance for the help. Regards, Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

4 9

Re: Freeradius REST module Authentication problem -
by Görkem İnanç Korkmaz 10 Oct '18

10 Oct '18

Hi Arran, I read those documents but I didn't understant how to deploy rest module for authentication and accounting exactly Junior IT Engineer System and Network Specialist

2 3

Freeradius REST module Authentication problem - freeradius-users@lists.freeradius.org
by Görkem İnanç Korkmaz 10 Oct '18

10 Oct '18

Hello everyone, I have a problem to authentication with REST module. I enable the rest module and added the rest to sites-enabled/default file 1- enabled the rest module ln -s ../mods-available/rest /etc/freeradius/mods-enabled/rest 2- changed the url of rest connect_uri = "http://10.0.0.20/" 3- add the rest into nano /etc/freeradius/sites-enabled/default authorize { rest } authenticate { rest } accounting { rest } post-auth { rest } My basic configuration is like that, when I send the get request by Postman tool, I am getting 404 Bad Request. GET http://10.0.0.20/user/%{User-Name}/mac/%{Called-Station-ID}?action=authenti… I read the documents below, but I didn't get it https://networkradius.com/doc/3.0.10/raddb/mods-available/rest.html https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… I didn't underestand exatly how to use rest module of freeradius 3.0.15 on Ubuntu 16.04. I just need to authenticate users and record the users to database via rest API. Apache and PHP already installed on the server. Are there any other requirement ? Thanks in advance, Görkem İnanç KORKMAZ Junior System Engineer

2 1

Proxy using rlm_perl
by J E H A N Z A I B 09 Oct '18

09 Oct '18

Hi good people, I have a question in regards to proxying my Auth & Accounting logs but not for all. I can use proxy module but looks like that only works for realm but I wanted to proxy only some of the user's record. I am already using rlm_perl module for custom stuff. Is there anyway I can add the proxy thing in my perl script? Thank you. -- Regards, Jehanzaib

2 11

eap-tls on non-domain computers?!
by Elias Pereira 08 Oct '18

08 Oct '18

hello, I have an environment with samba4 ADDC and freeradius for eap-tls authentication. For computers that are in the domain, eap-tls authentication with personal certificate is already working. I would like to do EAP-TLS authentication for computers that are not in our domain, ie private computers, but that the user is part of our domain. Is there any way to do this via eap-tls? -- Elias Pereira

3 5

Antw: Re: Additional NDS error messages missing in FR3 ?
by Anja Ruckdaeschel 08 Oct '18

08 Oct '18

Hi Arran! No, I'm not running FR 2 with -X... There is no debug enabled in the LDAP-Module in FR2 (so it defaults to 0x0000 - says the documentation). """ You know there are multiple instances of Module-Failure-Message right? Are you checking all of them.""" I don't know what you exactly mean with "multiple instances of Module-Failure-Message".... But if you mean fail, userlock, reeject, ...., than it's not there.... I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message} In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669). Or [ldap] some dn bind to some ldap server failed Server is unwilling to perform in Module-Failure and NDS error: login lockout (-197) in Reply-Message... Sorry, my last post was a bit misleading, because the detailed NDS-Error wasn't in Module-Failure, but in Reply-Message..... I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)... Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669). Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1) I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message... In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm… https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm… https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm… I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm… Sorry, not much of a C programmer myself... Ciao Anja >>> Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> 29.09.2018 15:06 >>> > On Sep 27, 2018, at 4:45 PM, Anja Ruckdaeschel <Anja.Ruckdaeschel(a)rz.uni-regensburg.de> wrote: > > Hi there! > > With FR2 you could acesss the NDS error messages, e.g. > > NDS error: no additional information available (-338) > NDS error: failed authentication (-669) > NDS error: login lockout (-197) > ... > and log them. > > In FR3 I still can see them with > ldap_debug = 0xFFFF > > > > All I get e.g. with Module-Failure-Message is > > Bind was not permitted: Server was unwilling to perform > which is the LDAP Error Code 53, which is okay, but I'd really like to log the additional messages, because > it's really useful... I went through the Novell code in v2.0.x and there's no where obvious where additional messages are being printed. It's not clear exactly how you're getting logging output from the server. Are you running with -X? You know there are multiple instances of Module-Failure-Message right? Are you checking all of them. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 5

How to compile freeRadius on windows platform
by Arvind Gupta 08 Oct '18

08 Oct '18

Hi All I have requirement to compile freeRadius on windows, so want to know the compilation steps and what dependencies are required? Any help or information is highly appreciated. Thanks Arvind Kumar Gupta

3 4

allow debit group to accees only payment website
by Ali Arslan 07 Oct '18

07 Oct '18

Hi, In my freeradius-3.016 configuration the debit group authorization is rejected for now. But i want to allow users in that group to access company website to make payment, How can restrict debit group users to access only company website? Thanks. ali.arslan

3 3