June 2018 - Freeradius-Users - lists.freeradius.org

Can I conditionally proxy?
by Gary Algier 07 Jun '18

07 Jun '18

Hello, I have used FreeRADIUS before as a RADIUS server but I now wish to use it as a conditional proxy. We have two RADIUS servers that implement 2 factor authentications. We wish to migrate from the old system to the new system a few users at a time. I would like to setup FreeRADIUS to do something like this: if (the user is in a particular AD group) {// I can do an LDAP lookup, if necessary proxy to the new 2fa system } else { proxy to the old 2fa system } Can anyone help with examples of some sort of conditional proxying? Gary A. Algier Principal System Administrator Office: +1.856.787.2758 Mobile: +1.856.278.0724 E-mail: Gary.Algier(a)Mavenir.com www.mavenir.com ________________________________ This e-mail message may contain confidential or proprietary information of Mavenir Systems, Inc. or its affiliates and is intended solely for the use of the intended recipient(s). If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies in your control and contact us by e-mailing to security(a)mavenir.com. This message contains the views of its author and may not necessarily reflect the views of Mavenir Systems, Inc. or its affiliates, who employ systems to monitor email messages, but make no representation that such messages are authorized, secure, uncompromised, or free from computer viruses, malware, or other defects. Thank You

3 3

matching operator name case sensitive
by Peter Steadman 07 Jun '18

07 Jun '18

Hi I am totally new to freeradius and with the help of the excellent wiki ( https://wiki.freeradius.org/guide/eduroam) have a working test server with only one apparent simple niggling issue, operator name matching is case sensitive when using the expression below to match multiple domains. I understand that cannot use "/i" in the this instance but am really struggling to find another way making this case insensitive. I should really appreciate it if someone could give me a hint, point me in another direction or even better give an example. many thanks Pete if (&Stripped-User-Domain != "${operator_name1}") && (&Stripped-User-Domain != ${operator_name2}")&& (&Stripped-User-Domain != "${operator_name3}") && (&Stripped-User-Domain != "${operator_name4}") { update { control:Load-Balance-Key := &Calling-Station-ID control:Proxy-To-Realm := 'eduroam' # Operator name (RFC 5580) identifies the network the # request originated from. It's not absolutely necessary # but it helps with debugging. request:Operator-Name := "1${operator_name1}" } return } -- <https://twitter.com/warwickshirecol> <https://www.facebook.com/WarwickshireCollege> <https://www.linkedin.com/edu/warwickshire-college-group-355076> <https://www.instagram.com/warwickshirecol/> College Email Disclaimer This message and any files transmitted with it is intended for the addressee only and may contain information that is confidential or privileged. Unauthorised use is strictly prohibited and may be unlawful. If you are not the addressee, you should not read, copy, disclose or otherwise use this message, otherwise than to notify the College via postmaster(a)warkscol.ac.uk <mailto:postmaster@warkscol.ac.uk>. You should delete this message and any files transmitted with it from your computer and destroy any copies made. Warwickshire College gives no warranty or representation as to the accuracy or reliability of the message and files and does not necessarily endorse any opinions expressed within it.

2 1

Get inner tunnel attributes to outer server for logging.
by Dom Latter 07 Jun '18

07 Jun '18

Firstly: "FreeRADIUS Version 3.0.16, for host x86_64-pc-linux-gnu" We are using MsCHAPv2 over TLS. I've been trying to get the inner-tunnel username and module failure message back to the "outer" session similar to this situation: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074994… or this: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074961… I have read a lot of the archived posts but am still not sure what's the "right" way of doing it. I have got most of it working except when the user is rejected by the inner tunnel. To be clearer, we want the inner-tunnel username to be available for the linelog and to go in to the postauth table. Is there some sort of definitive howto for this? It seems to be a common situation.

3 5

Accounting logs to include session start, session end & user ID field.
by Saurabh Lahoti 07 Jun '18

07 Jun '18

Dear, Could you please help in getting accounting logs with session start time, end time & user ID for audit purpose..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

Re: Invalid packet code 1 sent to a accounting port from client : IGNORED
by Saurabh Lahoti 06 Jun '18

06 Jun '18

Dear Alan, This error received after configuring F5 loadbalancer (as a client) who monitors health status of accounting service from it's peer nodes. Could there be nay other alternative way to achieve this..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

Default Certificate Expiration Time
by Mitch Sullivan 05 Jun '18

05 Jun '18

Hi Team I created an Instance of FreeRadius a few months back for my organisation. I followed the user guide for setting up certificates. http://deployingradius.com/documents/configuration/certificates.html Deploying RADIUS: Production Certificates<http://deployingradius.com/documents/configuration/certificates.html> deployingradius.com Production Certificates. Once the initial EAP testing has been performed, it is time to create the real certificates to use in your production network. These certificates will be configured on the end hosts that will be doing PEAP, TTLS, or EAP-TLS authentication. It seems the Certificates have expired, which is fine for OS X and Linux devices, which install new certificates automatically next time you connect while connecting but not for Windows10 that require the certificates be installed manually. Is it possible for me to change the certificates so they last a year? Thanks Mitch.Sullivan mitch.sullivan(a)swarm64.com IT administrator | Swarm64 AS Swarm64 AS Zweigstelle Hive Ullsteinstr. 120 | 12109 Berlin | Germany

3 2

Invalid packet code 1 sent to a accounting port from client : IGNORED
by Saurabh Lahoti 05 Jun '18

05 Jun '18

Dear, Could you please help me with below error whilst radius running in debug mode..? Invalid packet code 1 sent to a accounting port from client port 33393 : IGNORED ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

RE: TLSMC: MozNSS compatibility interception begins message
by Chris Howley 05 Jun '18

05 Jun '18

Alan, Thank you for the link: https://wiki.freeradius.org/modules/Rlm_ldap The server is using PEAP-MSCHAPv2 and LDAP not LDAPS. The messages are generated only when the server is started. Am I correct in assuming that I can safely ignore the messages? If I want to use LDAPS in the future, is the FR message below telling me that the server has been built with the correct libraries? Tue Jun 5 07:47:57 2018 : Info: Debugger not attached Tue Jun 5 07:47:58 2018 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20444 Thank you for your time. Chris Howley

2 1

Compatible device
by rints harry 05 Jun '18

05 Jun '18

Hi Could you share compatible devices with accounting used by freeradius. I want to implement hotspot in public area. Thx again

2 1

Not able to see RADIUS access request in debug mode
by Amit Mittal 04 Jun '18

04 Jun '18

Hi, I have installed freeradius ver. 3.0.13-9.el7_5 on CentOS Linux release 7.5.1804 After setting up the Users and client.conf files (attached) and running the radius server in debug mode (radius -X), I am not able to see the radius access-request packets coming in. I am able to see the access-request packets coming on the ethernet interface using the "tcpdump" utility though. Please let me know if I am doing something wrong in here. TIA Amit Mittal ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

2 2