February 2019 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

Freeradius Accounting and Syslog server
by harshiva matcha 04 Mar '19

04 Mar '19

Hello Everyone! I am using Freeradius for Accounting and I was successful in configuring it. However, to process the logs and displaying them for further use, I would like to send them to syslog server. For me, it is easier to send to syslog if the logs are printed on STDOUT. Is there a way to print the Accounting logs on STDOUT or different way to send to syslog server? I have tried editing /etc/freeradius/modules/detail file to add follows- *detailfile = stdout* But this does not seem to be working. Please let me know, thank you

3 3

NAS-Port / radwho
by Hans-Christian Esperer 03 Mar '19

03 Mar '19

Hi, I'm using freeradius 3.17 with unifi APs[1] to provide authentication and accounting. I'm currently using 3 APs. I've run into a problem: radwho will only ever display one user per AP at max. I've run radiusd -X and also looked into the source code that handles radutmp. It seems that the NAS-Port value needs to be unique per user. The APs, however, always supply a NAS-Port of 0. I've looked a bit into the hostapd that unifi is using, and it seems it is a (heavily) patched version, so no chance to get a standard hostapd running. I've tested with standard hostapd: This does use a unique NAS-Port value when sending accounting packets to the radius server, so all concurrently logged in users per AP are shown correctly by radwho. My question is: Is there any way to get radwho/radutmp accounting to work correctly even with the NAS-Port always set to 0? Thanks, HC [1] https://www.ubnt.com/unifi/unifi-ap/

2 3

TLS section "tls" missing, trying to use legacy configuration
by Tal Nur 01 Mar '19

01 Mar '19

Dear all, I'm configuring Freeradius 3.0.15 for Eduroam.In the debug output of freeradius -X I got the error message: TLS section "tls" missing, trying to use legacy configurationI have tls section in my /mods-enabled/eap file but this tls configuration wasn't read during start of Freeradius. What I do wrong? Here is the part of the frreradius -X output: # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { } TLS section "tls" missing, trying to use legacy configuration tls { verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } }

3 3

Deploying FreeRadius against Active Directory
by Daniel Wruck 01 Mar '19

01 Mar '19

I am plodding along as I set up FreeRadius against Active Directory on a newly installed Ubuntu 18.04 LTS box. My finding is that documentation is sparse or outdated. So I am stuck in winbind somewhere. Here in https://github.com/FreeRADIUS/freeradius-server/issues/1880, at the bottom, @alendekok tell the user to "Follow the guide at http://deployingradius.com/documents/configuration/active_directory.html". Is this guide still relevant in the Ubuntu 18.04 > FreeRadius v3.0.16 > Samba 4.7.6 days? This guide talks about parameters that do not exist in Samba's out-of-the-box smb.conf anymore? Is there a more relevant guide to FreeRadius 3.0.x integration with AD LDAP? Daniel W

4 3

Mac authentication
by Luc Paulin 28 Feb '19

28 Feb '19

Hi eveyrone, I am looking at the mac authentication ( https://wiki.freeradius.org/guide/mac-auth) Base on that article look that the main behavior is to authorise or not system base on their mac address in addition the EAP. Currently my setup is working well an can dynamically assign user/system vlan base on their authentification. However there's some equipement that won't be able to use EAP/PEAP authenticate over 802.1x, (smart tv for example). Most likely there's somehing I miss, but would that be something possible to assign vlan 199 to mac address ABCDEF and vlan 201 to mac address UVWXYZ -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

4 6

Uses of Active directory User's attribute
by Luc Paulin 28 Feb '19

28 Feb '19

Hi List, I was wondering if it would be possible to use the Active Directory user's attributes. As we're standardizing our AD, all user should have the Department attribute field fill. So instead of using AD groups to dynamically assign vlan, I was thinking to use that field instead. Would that be something possible? Thanx! -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

1 1

Attribute showing in Hex or Some other format
by Nimesha Balasuriya 28 Feb '19

28 Feb '19

Dear Friends, I am having a problem in radius accounting message which showing some other format for particular attribute. Framed-Interface-Id = 0x520c0000520c00 How to convert this into following format. Framed-Interface-Id = ff0c:6192:9e9a:30fe My NAS is Juniper MX480 Please find the sample packet as bellow; Wed Nov 28 18:02:18 2018 NAS-Port-Type = Ethernet ERX-Pppoe-Description = "pppoe 90:61:0c:4b:4b:1c" Acct-Session-Id = "1328282907" ERX-Dhcp-Mac-Addr = "9061.0c4b.4b1c" Service-Type = Framed-User Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-IP-Address = 203.0.113.22 Framed-IP-Netmask = 255.255.255.255 NAS-Port-Id = "HK-AGJ_C300M_01 atm 1/1/8/7:8.35" Filter-Id = "IPV4-ingress:pbr-pp0.3221286001-in" ERX-Virtual-Router-Name = "default:sltbb.lk" Framed-Protocol = PPP User-Name = "HK2501112@SLTBB" ERX-Attr-177 = 0x506f72742073706565643a2031303030303030306b NAS-Identifier = "HK_MX480" Event-Timestamp = "Nov 28 2018 18:00:37 IST" ERX-Ingress-Policy-Name = "PBR" ADSL-Agent-Circuit-Id = "HK-AGJ_C300M_01 atm 1/1/8/7:8.35" Class = "ADSLWebFamilyPlus" Framed-IP-Address = 100.72.248.51 NAS-Port = 1342178323 Framed-Interface-Id = 0x6bd536006bd536 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "d06986707183a0ac" Stripped-User-Name = "HK2501112" Realm = "sltbb" Timestamp = 1543408338 Thank you in advanced!!

2 1

Free Radius HA
by Aditya Vijjan 27 Feb '19

27 Feb '19

Hi Team, Can we configure HA Active - Active or Active-Passive for free-radius. -- Thanks & Regards Aditya Vijjan

3 2