November 2018 - Freeradius-Users - lists.freeradius.org

Server Radius with two Active Directory Domain
by Manuel Alejandro Nogales Soto 11 Nov '18

11 Nov '18

hi my name es Manuel Nogales, I'm from Bolivia, South America i need help with a configuration of freeradius 2.1.12 I inherited this infrastructure i have got these devices: Switch 3COM, AD DC SERVER WINDOWS 2008 and a server radius 2.1.12 in Redhat, with AAA configuration under thesse files /etc/raddb/modules/ntlm_auth -------inside----------- >exec ntlm_auth{ >wait = yes >program = "/usr/bin/ntlm_auth --request-nt-key --domain=mydomain --username=% {mschap:UserName} --password=%{User-Password}" >} /etc/raddb/modules/mschap -------inside----------- >ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-mydomain} >--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} /etc/raddb/proxy.conf -------inside----------- >realm mydomain.com{ > auth_pool = my_auth_failover >} i need to add a new domain Active Directory Zentyal with linuxmint users without lose actual configuration, please any help will be granted, thanks. Bolivia, South America i need help with a configuration of freeradius 2.1.12 I inherited this infrastructure i have got these devices: Switch 3COM, AD DC SERVER WINDOWS 2008 and a server radius 2.1.12 in Redhat, with AAA configuration under thesse files /etc/raddb/modules/ntlm_auth -------inside----------- >exec ntlm_auth{ >wait = yes >program = "/usr/bin/ntlm_auth --request-nt-key --domain=mydomain --username=% {mschap:UserName} --password=%{User-Password}" >} /etc/raddb/modules/mschap -------inside----------- >ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-mydomain} >--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} /etc/raddb/proxy.conf -------inside----------- >realm mydomain.com{ > auth_pool = my_auth_failover >} i need to add a new domain Active Directory Zentyal with linuxmint users without lose actual configuration, plea

2 1

configuration of freeradius using rest.
by Malik Najmus Siraj 11 Nov '18

11 Nov '18

Hello, I have configured freeradius v3.0.18 and successfully authenticate using pap, eap MSCHAP. Here i am using custom mysql proc calls. It is working fine. Now, i am using rlm_rest module (https://github.com/fgsants/REST-API-FreeRADIUS) and authenticate user if user name a and password is present in access request. Now once i move to eap mschapv2, now things are not working. because once auth type eap is selected (from received request) i want to call rest api (as in case of sql). Even if i disable the eap from authorize and forcefully select rest as auth type then receive error (You set 'Auth-Type = REST' for a request that does not contain a User-Password attribute!) i think this is genuine. Can any body help me. From my point of view i need to call rest api after i extract a password from mschap (dont know how to do it) Regards Siraj

2 1

Dynamic session timeout
by Sam T 10 Nov '18

10 Nov '18

Hey there I was wondering if you could help me with some logic I'm working with some pretty limited attributes on some APs. They support radius, but only these attributes: Session-timeout Idle-timeout Bandwidth-up Bandwidth-down It sadly doesn't understand WISPr-Session-Terminate-Time Our application needs to timeout a user account and all devices with activate sessions on that account at a specific time. Our Service is offered monthly and are unlimited data. Is SQL counter or some other module able to send session timeout dynamically on the fly to accounts for a session that should only be 200min vs 1440 for an session that needs to expire at a specific moment on all devices? I was thinking to make a sql query script to do a Delta calculation between now and WISPr-Session-Terminate-Time and if that number is less than session-timeout, to use that value. I feel like there may be a module in freeradius that may do this but I could not figure if SQL counter does this. Any tips in what direction to go would be great!

3 20

Sometimes passwords are coming in with junk
by Sam T 10 Nov '18

10 Nov '18

Hi! We are getting close to a workable solution with freeradius! When running freeradius in debug mode we can see that sometimes it comes in correctly, and other times in some kind of junky value. We need some help to see if this is an encrypt/decrypt issue, and where we may be able to align things to have 100% success rate with password traversing. some interesting things. When we login and get a =failed, we can generally get a success the 2nd time when trying again right away. here is some of the data pulled from debug. both times password was 000000 rad_recv: Access-Request packet from host 67.168.xxx.6 port 44529, id=58, length=173 User-Name = "freetest01" Acct-Session-Id = "1848a37b" NAS-Identifier = "712-xxxxxx" Framed-IP-Address = 10.255.10.51 NAS-Port-Id = "ssid1_1848a37b" Calling-Station-Id = "2C-6E-85-95-C1-C6" Called-Station-Id = "AC-86-74-7A-35-10" Class = 0x47726f75703d33362c5376633d3531 Event-Timestamp = "Nov 1 2018 08:37:03 UTC" Service-Type = Login-User User-Password = "`\033\244\361\310\337H" NAS-Port = 35 NAS-IP-Address = 192.168.1.128 # Executing section authorize from file /etc/freeradius/sites-enabled/xxxxxx.rad then rad_recv: Access-Request packet from host 67.168.xxx.6 port 57254, id=178, length=173 User-Name = "freetest01" Acct-Session-Id = "3b6dcf1b" NAS-Identifier = "712-xxxxxx" Framed-IP-Address = 10.255.10.51 NAS-Port-Id = "ssid1_3b6dcf1b" Calling-Station-Id = "2C-6E-85-95-C1-C6" Called-Station-Id = "AC-86-74-7A-35-10" Class = 0x47726f75703d33362c5376633d3531 Event-Timestamp = "Nov 1 2018 08:32:55 UTC" Service-Type = Login-User User-Password = "000000" NAS-Port = 35 NAS-IP-Address = 192.168.1.128

3 4

[Q] radacct table is empty ...
by Zeus Panchenko 09 Nov '18

09 Nov '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, my FR v.3.0.12 up and running, eap works as expected, users DB is in LDAP now I'm trying to get accounting data in SQL ( to have all the data written to files /usr/local/var/log/radius/radacct/X.X.X.X/auth-detail-YYYYmmddand ) but I'm failing to get it working ... all SQL tables except radpostauth are empty ... I have no idea why here are details: - ---[ `ls -al mods-enabled/' quotation start ]------------------------------------------- ... lrwxrwxr-x 1 radius radius 21 Apr 26 2016 eap -> ../mods-available/eap ... lrwxrwxr-x 1 radius radius 22 Apr 26 2016 ldap -> ../mods-available/ldap ... - ---[ `ls -al mods-enabled/' quotation end ]------------------------------------------- - ---[ sites-enabled/default quotation start ]------------------------------------------- authorize { ... eap { ok = return } ... } authenticate { eap } accounting { detail sql attr_filter.accounting_response } session { sql } post-auth { update { &reply: += &session-state: } sql } - ---[ sites-enabled/default quotation end ]------------------------------------------- /usr/local/var/log/radius/radacct/X.X.X.X/auth-detail-YYYYmmdd files are created and updated ... what can be the cause why SQL table radacct is empty then? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQQYIXL6FUmD7SUfqoOveOk+D/ejKgUCW+R15QAKCRCveOk+D/ej KoUjAJ9UUxqLHKWpUH5J16/tuWP/2d6d7gCggz9NjGYhjsRj63ZvFtxRIk8t39Q= =29MD -----END PGP SIGNATURE-----

2 1

Change Fixed IP to POOL on Fail
by Aurélio de Souza Ribeiro Neto 07 Nov '18

07 Nov '18

Hello Everyone. I'm using FreeRadius 3-3.0.17_2 and I want to pick an IP from Pool to a user who uses Fixed IP and tries to connect with wrong password. I tried to put this set in my default file and Fixed IP always overrides the pool IP. Auth-Type MS-CHAP { mschap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" } ok } } Some hint? Thanks Aurélio

1 0

Adding Filter-Id Attribute to Accounting Requests
by Alessandro Romano 05 Nov '18

05 Nov '18

Dear All, i need to add the attribute "Filter-ID" from database radusergroup to accounting-request packet. At the moment i retreive the attribute only in access-accept packet BR Alessandro Romano C.T.O. Cell: 3351402534 Positivo SRL Via San Leonardo 52 84131 Salerno ( Sa )

3 13

AIRTAME_authentificate_issue
by jean-francois_MONI 05 Nov '18

05 Nov '18

Hi, Does anyone has ever succeed to connect a computer to an airtame device ? The airtame is well connected to the wifi radius network and has an IP. The laptop is also connected to the same network. but the laptop can't connect to the AIRTAME device. A mystery to me... thanks for any feedback -- Jean-François MONI Technicien Informatique Université de Bordeaux IINS - UMR 5297 - Centre Broca Nouvelle-Aquitaine 146, Rue Léo Saignat 33076 Bordeaux Cedex Tél. 05.33.51.47.93

3 2

How its works and How to use Framed-ip-address
by One Zero Art 02 Nov '18

02 Nov '18

Hi, I successfully installed freeradius on Ubuntu 18**. I am using PPPoE server in mikrotik. I want to control PPPoE user ip address. Only match ip address, username and password can connect with network. Is this even possible? Also, I want to know about Framed-ip-address and how its works with freeradius. I searched google but not found my need. Thank you :) Sorry for Bad English.

2 3

Can I use two or more freeradius server certificates for the same virtual site?
by work vlpl 02 Nov '18

02 Nov '18

Hello. Certificates have limited lifespan. And when certificate will expire, there is a probability that new certificate will not be trusted by clients with old configuration. I am searching the way to smooth it. One of the ideas is to configure freeradius to use two server certificates. They will have different expiration date. So the old clients will be able to use old certificate and the new clients or clients with updated configuration will be able to accept new server certificate. I tried to place two different eap modules one by one like ... eap eap2 ... In hope that this will work like it works with modules with different types (chap -> mschap -> pap). If client does not accept server certificate from the first module, then try to send certificate from the second module. But eap module is not simple and is called multiply times (Challenge response) to setup eap session, thus this approach does not work. And in radius request I don't have any attributes that could help me to narrow request to the specific eap module. So, is it possible to use two or more freeradius server certificates? Or maybe somebody have ideas how to configure eap modules to do it. -- Vladimir

5 11