December 2018 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

NAS-Port / radwho
by Hans-Christian Esperer 03 Mar '19

03 Mar '19

Hi, I'm using freeradius 3.17 with unifi APs[1] to provide authentication and accounting. I'm currently using 3 APs. I've run into a problem: radwho will only ever display one user per AP at max. I've run radiusd -X and also looked into the source code that handles radutmp. It seems that the NAS-Port value needs to be unique per user. The APs, however, always supply a NAS-Port of 0. I've looked a bit into the hostapd that unifi is using, and it seems it is a (heavily) patched version, so no chance to get a standard hostapd running. I've tested with standard hostapd: This does use a unique NAS-Port value when sending accounting packets to the radius server, so all concurrently logged in users per AP are shown correctly by radwho. My question is: Is there any way to get radwho/radutmp accounting to work correctly even with the NAS-Port always set to 0? Thanks, HC [1] https://www.ubnt.com/unifi/unifi-ap/

2 3

How to Reject Anonymous Identity
by Selahattin Cilek 29 Jan '19

29 Jan '19

I use FreeRADIUS 3.0.17 to provide services on a site. Ever since I stepped into the world of RADIUS, I have been dealing with the issue of "anonymous" users. I have been abusing the *Class* attribute work around the problem, but after some deliberation, I've decided that it would be best if I could reject anonymous users right away. I already have a MySQL stored procedure named "is_login_allowed" that checks if a user is in a locked state or not and I use it like this in the *authorize* section of the *default*, *inner-tunnel-ttls*, *inner-tunnel-peap* sites: authorize{ if ("%{sql: CALL is_login_allowed('%{User-Name}')}" == "0" ) { reject } } Currently, this store procedure can check if a user with a given name exists in the database, and if not, return *0* to make FreeRADIUS to reject access to that user. What I'd like to know though is that if there is a better, more elegant FreeRADIUSy way of achieving the same goal. For example, would something like below work? authorize{ if("%{outer.request.UserName}" != "%{inner.request.UserName}"){ reject } } --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

7 16

Ms-Chap + NT-Password
by Anton Kiryushkin 08 Jan '19

08 Jan '19

Hello. I'm sorry for the odd question. I have a freeradius installation with version 3.0.15. Approximately a year ago I configured the next scheme: - all users contained in MySQL; - all users have an NTLM-hash as a password; - when the user tries to auth to a radius, radius-server was hashed the incoming password to NTLM-hash and check it. Now I can't repeat it, and I don't know why. I see the next error in my log: Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING NT-Password FROM 0 TO 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to profile processing Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Released connection (19) Thu Dec 20 01:10:08 2018 : Info: Need 1 more connections to reach min connections (5) Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Opening additional connection (30), 1 of 6 pending slots used Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Starting connect to MySQL server Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Connected to database 'my_table' on 127.0.0.1 via TCP/IP, server version 5.7.19-17-log, protocol version 10 Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from sql-wifi (rlm_sql) Thu Dec 20 01:10:08 2018 : Debug: (138) [sql-wifi] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling pap (rlm_pap) Thu Dec 20 01:10:08 2018 : WARNING: (138) pap: Auth-Type already set. Not setting to PAP Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from pap (rlm_pap) Thu Dec 20 01:10:08 2018 : Debug: (138) [pap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = updated Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate { Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for state 0x0d5314a80d540ec8, released from the list Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method EAP MSCHAPv2 (26) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_mschapv2 to process data Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: Auth-Type MS-CHAP { Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: NT-Password found but incorrect length, expected 16 bytes got 17 bytes. Authentication may fail Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password configured. Cannot create NT-Password Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password configured. Cannot create LM-Password Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Creating challenge hash with username: y.lilekov Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Client is using MS-CHAPv2 Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: MS-CHAP2-Response is incorrect For the authorize_check_query and authorize_reply_query I'm using the next queries: authorize_check_query = "\ SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" authorize_reply_query = "\ SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" The error is logical. But I can't remember how it could be work a year ago... I'll happy to read any suggestion. -- Best regards, Anton Kiryushkin

4 17

Proxy FreeRADIUS Monitoring from LB F5
by CALMELS, Thierry (SOGETI REGIONS SAS) 07 Jan '19

07 Jan '19

Hello freeradius support team, We have an infrastucture using freeRadius 3 (freeradius-3.0.13-8) on RHEL7.5. The infrastructure implements in front a layer “PROXY RADIUS” (not based on proxy.conf usage – thus we are using a custom proxy logic). The infrastructure works as expected. The architecture is as follow: Client NAS --> LB BigIP F5 --> Proxy FreeRADIUS --> LB BigIP F5 --> BackEnd FreeRADIUS However we want to improve monitoring made by F5 in front of the layer proxy Radius. For that, we have configured a Radius profile on the F5, based on username/password declared in the /etc/raddb/users files. healthcheckVIP Auth-Type:=Accept, User-Password=="my_password " Unfortunately, this configuration works only if the healthcheckVIP account is declared on the BackEnd FreeRADIUS! The account declared on Proxy is not taken in account. I didn’t find any solution/setting to block the radius request at layer proxy when the account is found and credentials confirmed. Thank a lot for your support Thierry - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [cid:image003.png@01D304A6.07AEE120] Thierry CALMELS On behalf of SOGETI France Subcontractor for ZIOI AIRBUS OPERATIONS S.A.S. France – Toulouse – Sogeti – Airbus Zone Phone: +33 (0)5 67 19 65 55 Mailto: thierry.calmels.external(a)airbus.com<mailto:thierry.calmels.external@airbus.com> Join us on the IAM community<https://communities.intra.corp/sites/CAM/Default.aspx>! P Before printing, think about the environment --o-o-Ộ-o-o-- The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

4 14

Get number of users logged in via mySQL
by Renato Sousa 07 Jan '19

07 Jan '19

Hello All, I would like to get the number of logged in users on freeradius server (3.0.12). Looking at the mySQL accounting table, the connections with the NULL value for the acctstoptime field, I see some connections with the same user and even device mac-address with the NULL acctstoptime field. How to get this precise value through mySQL tables? How to delete these open sessions? Best Regards

3 5

Freeradius MSSQL
by Bram Assendorp 03 Jan '19

03 Jan '19

Hi, I'm trying to get Freeradius to work with MSSQL. I have "driver = "rlm_sql_mssql"" but as stated in the above section: > # Configuration for the SQL module > # > # The database schemas and queries are located in subdirectories: > # > # sql/<DB>/main/schema.sql Schema > # sql/<DB>/main/queries.conf Authorisation and Accounting > queries > # > # Where "DB" is mysql, mssql, oracle, or postgresql. There should be a file within, sql/mssql/main/schema.sql but it's not there, there is no mssql folder. Also when selecting the rlm_sql_mssql driver, what should be the "dialect"? Should it just be mssql? Thank you!

3 5

RESTful API
by Daniel Kong 02 Jan '19

02 Jan '19

I know you guys are very busy helping the rest but I hope you can help me with this. I would like freeradius to authenticate with 3rd party application via REST API. I do have the configuration like below. connect_uri = "http://10.18.6.22:8081/apps/" authenticate { uri = "${..connect_uri}/user/%{User-Name}/%{User-Password}" method = "get" } Problem is that I do not know what to be included in the request and response for every authenticate, authorize, post-auth, and accounting. For the response, I just include the HTTP status is sufficient for authentication? How about the response for authorize, post-auth, and accounting? If the freeRadius is configured to use RESTful API, does other post-auth, authorize, and accounting can be use with mysql so that only authentication is using rest?

5 10

Expiration AVP Value Format
by Ali Arslan 02 Jan '19

02 Jan '19

Hi, I am using freeradius 3.x with mysql, and want to set expiraton date for some users in radcheck table as attribute = "Expiration", op = "==", value = endDate What should be the format of the "endDate" string here? Thanks.

2 2