January 2019 - Freeradius-Users - lists.freeradius.org

Guest mode with different passprhases
by Hans-Christian Esperer 03 Jan '19

03 Jan '19

Hi all, I'd like to achieve the following: A wifi where both regular users and guests can log in. All users should use PEAP to establish an encrypted connection. Normal users then use a combination of username,passphrase, nothing unusual here. Guests, however, shall be able to login with username "guest" and a PIN number as passphrase. Several PIN numbers should be allowed, but each PIN number only once, or for a certain amount of time after the first usage. The idea is that each guest is assigned a PIN number to be used once, when they need access, and upon first usage of that PIN it is deleted or marked as used in a database and cannot be used a 2nd time. PINs should be randomly generated as needed. Is this at all possible? If so, how would one best implement it? Writing your own Perl module? Is there something available in the default distro to achieve this behavior? Thanks in advance, HC

3 3

Freeradius MSSQL
by Bram Assendorp 03 Jan '19

03 Jan '19

Hi, I'm trying to get Freeradius to work with MSSQL. I have "driver = "rlm_sql_mssql"" but as stated in the above section: > # Configuration for the SQL module > # > # The database schemas and queries are located in subdirectories: > # > # sql/<DB>/main/schema.sql Schema > # sql/<DB>/main/queries.conf Authorisation and Accounting > queries > # > # Where "DB" is mysql, mssql, oracle, or postgresql. There should be a file within, sql/mssql/main/schema.sql but it's not there, there is no mssql folder. Also when selecting the rlm_sql_mssql driver, what should be the "dialect"? Should it just be mssql? Thank you!

3 5

Question about SQL logs in fr3
by Andrés Gómez 03 Jan '19

03 Jan '19

Hi dear list. I have been using freeradius 2.x from many years ago, buy now I am testing v 3.0.16. Everything works great, buy I have some Logs That I didn't have in v2.x, about MySQL: Wed Jan 2 21:04:57 2019 : Info: rlm_sql (sql): Opening additional connection (115), 1 of 32 pending slots used Wed Jan 2 21:04:57 2019 : Info: rlm_sql (sql): Opening additional connection (116), 1 of 31 pending slots used Wed Jan 2 21:05:05 2019 : Info: rlm_sql (sql): Opening additional connection (117), 1 of 30 pending slots used Wed Jan 2 21:05:10 2019 : Info: rlm_sql (sql): Opening additional connection (118), 1 of 29 pending slots used Wed Jan 2 21:05:17 2019 : Info: rlm_sql (sql): Opening additional connection (119), 1 of 28 pending slots used Wed Jan 2 21:05:20 2019 : Info: rlm_sql (sql): Opening additional connection (120), 1 of 27 pending slots used Wed Jan 2 21:05:21 2019 : Info: rlm_sql (sql): Opening additional connection (121), 1 of 26 pending slots used Wed Jan 2 21:06:00 2019 : Info: rlm_sql (sql): Opening additional connection (122), 1 of 25 pending slots used Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (119): Hit idle_timeout, was idle for 113 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (115): Hit idle_timeout, was idle for 113 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (116): Hit idle_timeout, was idle for 110 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (120): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (118): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (121): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (117): Hit idle_timeout, was idle for 70 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (122): Hit idle_timeout, was idle for 70 seconds It is the nomal behavior? I want to migrate a fr v2.x with a lot o Autentication and Accounting queries (arount 600 Auth queries per minute, and much more accounting queries per minute), What would be the best coniguration of connections in sql module and sites-enabled/default file? I only use web authenticvation (PAP), I dont use EAP, MSCHAP, DIGEST, etc Best Regards -- *C. Andrés Gómez R.*

2 1

RESTful API
by Daniel Kong 02 Jan '19

02 Jan '19

I know you guys are very busy helping the rest but I hope you can help me with this. I would like freeradius to authenticate with 3rd party application via REST API. I do have the configuration like below. connect_uri = "http://10.18.6.22:8081/apps/" authenticate { uri = "${..connect_uri}/user/%{User-Name}/%{User-Password}" method = "get" } Problem is that I do not know what to be included in the request and response for every authenticate, authorize, post-auth, and accounting. For the response, I just include the HTTP status is sufficient for authentication? How about the response for authorize, post-auth, and accounting? If the freeRadius is configured to use RESTful API, does other post-auth, authorize, and accounting can be use with mysql so that only authentication is using rest?

5 10

Expiration AVP Value Format
by Ali Arslan 02 Jan '19

02 Jan '19

Hi, I am using freeradius 3.x with mysql, and want to set expiraton date for some users in radcheck table as attribute = "Expiration", op = "==", value = endDate What should be the format of the "endDate" string here? Thanks.

2 2

Trouble with FR3 users file format
by Diggins Mike 02 Jan '19

02 Jan '19

Hello and Happy New Year! I am building a new FR3 server running the latest version to replace my FR2 server. Both authenticate users using ntlm-auth only and Radtest confirms that is working for PAP and MSCHAP. However, my ported users file seems to be causing a change in behaviour. This is what the users file looks like (from FR2). userid2 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" guest002 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" userid3 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" userid4 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" DEFAULT Auth-Type = ntlm_auth Only some of my users are in this file and have reply attributes. All other users also use ntlm_auth but have no reply attributes and are not listed in the file. Again, this worked in FR2. Using the same file in FR3, authentication works correctly whether the user is in the file or not which is correct. However, I do not get the Reply-Message attributes in the reply unless the user happens to be the very first one listed in the file (userid2 in this case). guest002 gets nothing returned nor do any of the others. If I remove the DEFAULT statement at the end of the file, any user in the users file authenticates correctly and gets the proper attributes returned in the Reply-Message. However, anyone not in the users file can no longer authenticate using PAP. Only MSCHAP works. I have users using both methods but no local passwords on the FR server. It seems redundant to specify the ntlm_auth type for every user in my users file given that's the only available option for authentication. Is there a correct way to do this and restore the previous behaviour? -Mike

2 3