July 2018 - Freeradius-Users - lists.freeradius.org

eap_peap: We sent a success, but the client did not agree [FreeRadius + samba4 AD + dynamic vlans]
by Elias Pereira 23 Jul '18

23 Jul '18

Hello guys, At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I also tested with pfsense's captiveportal and it worked correctly. We have a wifi controller from the motorola and created a ssid and set the AAA profile as it showed in the extreme support itself. After trying to connect via mobile with android, the following error occurs: Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed* Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Sending EAP Failure (code 4) ID 12 length 4 Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Failed in EAP select Wed Jul 18 14:44:25 2018 : Debug: (71) modsingle[authenticate]: returned from eap (rlm_eap) Wed Jul 18 14:44:25 2018 : Debug: (71) [eap] = invalid Wed Jul 18 14:44:25 2018 : Debug: (71) } # authenticate = invalid Wed Jul 18 14:44:25 2018 : Debug: (71) Failed to authenticate the user Wed Jul 18 14:44:25 2018 : Debug: (71) Using Post-Auth-Type Reject Wed Jul 18 14:44:25 2018 : Debug: (71) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Wed Jul 18 14:44:25 2018 : Debug: (71) Post-Auth-Type REJECT { Wed Jul 18 14:44:25 2018 : Debug: (71) modsingle[post-auth]: calling ldap (rlm_ldap) https://pastebin.com/raw/Nzki0y1d (sites-enable/default and inner-tunnel Has anyone ever had this problem? -- Elias Pereira

2 6

Use Max-Daily-Session But Timeout Session every 30mins if limit not reached
by Uchenna Nebedum 22 Jul '18

22 Jul '18

Good Day All, I am using dailycounter for Max-Daily-Session but i still want to timeout user session every 30mins till Max-Daily-Session reached. A way i thought to achieve this would be to add unlang after dailycounter in the conf, something like (if reply Session-Timeout > 1800){ Session-Timeout := 1800 } I'm not sure if this method would work and not sure of the implications. Not too sure of what the unlang should look like. Please any help would be greatly appreciated. Uchenna Nebedum

2 3

Cache TTL and Cache-Status-Only
by work vlpl 21 Jul '18

21 Jul '18

Hello, judging by the rlm_cache module code, Freeradius will not update cache TTL for cache records. Am I right? Also is it possible to show current cache TTL in debug output? I tried to do this "%{control:Cache-TTL}" but it was expanded in an empty string.

3 2

ca_file and refresh mechanism
by Henti Smith 20 Jul '18

20 Jul '18

Good day. I'm trying to find information on how freeradius handles updating of the ca_file during operational use. If a revocation has taken place and the ca_file was updated, do I need to restart the daemon, or will it re-read the file for any new requests, hence not needing to restarted the daemon? Regards Henti -- --

2 2

How to set the user roles in freeradius
by Mallikarjuna 20 Jul '18

20 Jul '18

Dear All, I'm authenticating the user in freeradius from nginx webserver, Here I need to specify the user roles for particular users so that while authenticating the user I can give either readOnly option or readWrite option. I've specified username and password in *users *file of freeradius. Best Regards, Logo <http://www.igrid-td.in/> Mallikarjuna P K *+91 9535744695* mallikarjuna.peddappanavara(a)igrid-td.com <mailto:mallikarjuna.peddappanavara@igrid-td.com> iGrid India Private Limited Nagarbhavi 2nd stage, Annapoorneshwari Nagar No. 243, R.H.C.S Layout, 4th Cross 560091, Bangalore www.igrid-td.in <http://www.igrid-td.com> LEGAL NOTICE: This message and any attachments are confidential and are intended only for the addressee. If you are not the intended recipient, you are hereby notified that any use, dissemination and / or unauthorized copying is prohibited by applicable law. If you have received this email in error, please notify us immediately via email or phone, described above, and kindly delete it from your system. PERSONAL DATA PROTECTION INFO According to the General Data Protection Regulation (UE) 2016/679, regarding your personal data management, we inform you: Data Controller: IGRID, S.L., C/ MARIE CURIE, 8-14, 08042, BARCELONA (BARCELONA). Purpose: Sending info and answering your questions and inquiries as long our relationship is going on and we have your consent. Lawful basis for processing: Performance of a contract or data subject's consent. Data disclosure. Your personal data will not be disclosed unless forced by law. Rights. You have right of access, right to rectification, right to erasure and data portability, and right to restriction of processing, writing a letter accompanied by a copy of an official document evidencing your identity to the Data Controller. You have also the right to logde a complaint with a Supervisory Authority (Spanish Supervisory Authority is Agencia Española de Protección de Datos). More info. Please visit the legal notice (Aviso Legal) in our website. INFORMACION SOBRE PROTECCION Y TRATAMIENTO DE DATOS PERSONALES: Este mensaje y los archivos adjuntos son confidenciales y se dirigen exclusivamente a su destinatario. Si no es usted el destinatario indicado, queda notificado de que la utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si usted ha recibido este correo por error, por favor avísenos inmediatamente a través de correo electrónico o por teléfono, descritos en la parte superior, y tenga la amabilidad de eliminarlo de su sistema. En cumplimiento del REGLAMENTO (UE) 2016/679, y en relación al tratamiento de sus datos personales, le informamos de lo siguiente: Responsable: El responsable del tratamiento es IGRID, S.L., C/ MARIE CURIE, 8-14, 08042, BARCELONA (BARCELONA). Finalidad: Envío de información, respuesta a sus consultas y peticiones, mientras dure nuestra relación y tengamos su consentimiento. Legitimación: Ejecución de contrato o consentimiento del interesado. Destinatarios: No se cederán datos a terceros salvo obligación legal. Derechos: Puede ejercer los derechos de acceso, rectificación, supresión y portabilidad de sus datos, y la limitación u oposición al tratamiento mediante escrito acompañado de copia de documento oficial que le identifique, dirigido al Responsable del tratamiento. En caso de disconformidad con el tratamiento, también tiene derecho a presentar una reclamación ante la Agencia Española de Protección de Datos. Más información: Consulte el aviso legal de nuestra web.

2 1

Freeradius Kerberos Authentication to FreeIPA
by Guille 19 Jul '18

19 Jul '18

I got the authentication working. I enrolled the radius server in IPA and created the service. Then on the radius server I got the key tab with the ipa-getkeytab command and the ticket with kinit. Everything works fine for 24 hours, which is the time when the ticket expires, then I have to reissue the aforementioned commands to get the service working again. Any ideas on how to fix this?. Thanks.-

2 4

Re: freeradius authentication problem
by Mallikarjuna Peddappanavara Karibasappa 19 Jul '18

19 Jul '18

Dear Alan, Finally after so much of struggle I've resolved the issue with help of you. Thank you very much for your great support and for your valuable time. Thank you, Best Regards,*Mallikarjuna PK*Email: mallikarjuna.peddappanavara(a)igrid-td.com Mobile: +91-9535744695 On 18 July 2018 at 12:11, Alan Buxey <alan.buxey(a)gmail.com> wrote: > hi, > > as already said, if the raddb directory was empty, the nginx -t should > print warning - the plugin needs dictionary files. > > your issue is an incorrect shared secret - as said previously, you've > probably edited the files in a wierd way which has introduced > interesting characters. > > but as your system isnt even behaving normally I would suggest that > several random, local and unique to you factors are at play. > > > so, start from the beginning (and use standard/correct text editors for > editing configuration files) > > > alan >

1 0

Traffic accounting problems on freeradius
by Anton Sapotsko 19 Jul '18

19 Jul '18

Hello, I've got a standard configuration of FreeRadius + OpenVPN + IPsec . Everything works good except of traffic accounting for OpenVPN . Some TCP\UDP sessions has no problems with accounting but some has no any data about Acct-Input-Octets and Acct-Output-Octets Example: /var/log/radius/radacct/IP_address/detail-20180719 Thu Jul 19 12:20:08 2018 User-Name = "******(a)gmail.com" NAS-IP-Address = *********** NAS-Port = 2 Service-Type = Outbound-User Framed-Protocol = PPP Framed-IP-Address = 10.0.3.10 Calling-Station-Id = "***********" NAS-Identifier = "OpenVpn" Acct-Status-Type = Stop Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Session-Id = "40B889944DEC6DA1C2905D0CC5EE9D08" Acct-Session-Time = 32 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 NAS-Port-Type = Virtual Acct-Unique-Session-Id = "6ae1bb07105d7ebb" Timestamp = 1531995608 There are no errors in logs on OpenVPN server and FreeRadius server. Just 50/50 no traffic information come to freeradius server (looks like). Maybe someone have any suggestions what to check and how to fix this problem? I'm ready to provide any logs or configs for further proceedings . Best regards

2 4

Mikrotik User Status and Used Data
by Safiullah Tariq 18 Jul '18

18 Jul '18

Dear All, I hope you are doing great. I am new to Freeradius. I have some questions. Is it possible to see the current logged in users? i have used the command radwho but i get the following answer: radwho: No configuration information in radutmp section of radiusd.conf! And Is there a possibility that, suppose a user is authenticated and is logged in on Mikrotik and the RADIUS gets unreachable - is there any chance that the radius asks the NAS to give the user's accounting details. What I want to achieve is, I logged in and used the total limit and my reset time was 1 day. Now when the Radius was disconnected, Radius didnt receive the info of my total usage. What happens is, I am again able to login to and use the data. This is one scenario. I want to achieve complete accounting data after reconnecting. Any help on that ? Regards, Safiullah Tariq PRIVILEGED AND CONFIDENTIAL INFORMATION: This e-mail and attachments, if any, may contain confidential and/or proprietary information. Please be advised that the unauthorized use or disclosure of the information is strictly prohibited. The information herein is intended only for use by the intended recipient(s) named above. If you have received this transmission in error, please notify the sender immediately and permanently delete the e-mail and any copies, printouts or attachments thereof.

2 1

Two Quick Questions
by Adam Bishop 18 Jul '18

18 Jul '18

* Can I tell the users origin once we get into post-auth, or do I need to use a custom attribute? If a user comes from the users file, I want to apply some different policy - the only distinguishing feature the users I want to manipulate have is that they're stored in the users file rather than AD. * Can I prevent a status-server acknowledgment being sent? I want to run "wbinfo -t", and drop the status-server request if the command does not execute successfully - is that supported? Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 3