March 2019 - Freeradius-Users - lists.freeradius.org

radius PECL extension works well on XAMPP but unexpectedly on other Servers
by Souhel Ayoub 27 Mar '19

27 Mar '19

hello everyone, radius PECL extension works well on XAMPP but unexpectedly on other Servers(IIS windows server 2016 &OR& httpd version 2.4.6 (on centos 7-6); all 64x). I have a php login page which authenticate users through a freeradius server hosted by linux. The freeradius uses MariaDB 5.5.60 to store its database. In radcheck table, the attribute assigned to to users' password is Cleartext-Password. Freeradius Server Info: OS:centos-release-7-6.1810.2.el7.centos.x86_64 Radius server:FreeRADIUS version 3.0.13, for host x86_64-redhat- linux-gnu The login page uses PHP (Version 7.2.15) and the radius PECL extension (version 1.4.0b1); all in 64x. On XAMPP: the authentication request sends the user's password as a clear text as expected. On other webserver: the authentication request sends the user's password as an encrypted text. I do not want this module to encrypt the password. I could not figure out which encryption this is, or at which position it happens. I need help deactivating this encryption. It would also be nice if you could provide some reference that explains encryption in freeradius server. // PHP LOG IN Function function radiusLogin($username, $password){ $msg=''; $hostname='192.168.0.22'; $port='1812'; $secret='radiusPass'; $timeout='3'; $max_tries='3'; $radius_handle= radius_auth_open(); radius_add_server($radius_handle, $hostname, $port, $secret, $timeout, $max_tries); radius_create_request($radius_handle, RADIUS_ACCESS_REQUEST); radius_put_attr($radius_handle, RADIUS_USER_NAME, $username); radius_put_attr($radius_handle, RADIUS_USER_PASSWORD, $password); $result = radius_send_request($radius_handle); try { switch ($result) { case RADIUS_ACCESS_ACCEPT: $msg='ACCEPT'; break; case RADIUS_ACCESS_REJECT: $msg='REJECT'; break; case RADIUS_ACCESS_CHALLENGE: $msg='CHALLENGE'; break; default: $msg='FAILED'; } } catch(Exception $e) { $msg=$msg.'<br>'.$e->getMessage(); } return $msg; } // the debug mode shows: .. (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: ERROR: Cleartext password "???=襾W??ď?Ю?" does not match "known good" password (0) pap: Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Login incorrect (pap: Cleartext password "???=襾W??ď?Ю?" does not match "known good" password): [tom/???=襾W??ď?Ю?] (from client etageNAS port 0) (0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! ..

3 4

Working With EAP-TTLS, and LDAP
by Nate . 26 Mar '19

26 Mar '19

Good Evening, I have been working on building a new FreeRadius 3.0.16 server on Ubuntu. Our goal was to mimic our current setup, but instead of using the old server which is mashed together with some other applications that no longer function, devote one to this. I have followed the instructions on many sites on how to enable the proper modules and configure LDAP accordingly(Our LDAP is acutally ldap.google.com) and we have successfully ran a radtest authentication against the LDAP settings, and it is Accepted. Great right? Well, then we attempted to enable EAP-TTLS, nothing seemed to work properly, and we found many different ways people were doing this. While researching a solution I've already configured all of our certificates. So the last part we need to understand is the reason why we are getting "ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject" I'm new to this kind of mailing list system, so please bear with me. I'm attaching the output log of our servers startup, and the connection log of my computer attempting over our wireless controller. Thank you for your time, Nathan

5 18

Clients.conf
by Aditya Vijjan 25 Mar '19

25 Mar '19

Hi Team, I have different clients using diff IP and secret, i have allowed in clients.conf but only top 2 entries are allowed and remaining not working, as a workaround i have allowed 0.0.0.0/0 in network. -- Thanks & Regards Aditya Vijjan

3 2

Re: Freeradius-Users Digest, Vol 167, Issue 65
by Aditya Vijjan 25 Mar '19

25 Mar '19

Hi Alan, I have added 123 entries in client.conf but only top 2 entries are working remaining not. Regards Aditya Vijjan On Mon, Mar 25, 2019 at 3:01 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Clients.conf (Alan DeKok) > 2. Logging config to get certificate details (Jim Potter) > 3. Re: Logging config to get certificate details (Alan DeKok) > 4. Re: Logging config to get certificate details (Jim Potter) > 5. Re: Logging config to get certificate details (Alan DeKok) > 6. Re: Logging config to get certificate details (Jim Potter) > 7. Re: Logging config to get certificate details (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 25 Mar 2019 04:15:14 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Clients.conf > Message-ID: <87DB7382-35DD-4649-AE92-D7AF30897DFE(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Mar 25, 2019, at 3:25 AM, Aditya Vijjan <aditya.vijjan(a)gmail.com> > wrote: > > > > I have different clients using diff IP and secret, i have allowed in > > clients.conf but only top 2 entries are allowed and remaining not > working, > > That's now how the server works. > > If you add clients to clients.conf, they are added, and they work. > > Perhaps you could give a more detailed explanation. > > Alan DeKok. > > > > ------------------------------ > > Message: 2 > Date: Mon, 25 Mar 2019 08:53:31 +0000 > From: Jim Potter <j.potter(a)bathspa.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Logging config to get certificate details > Message-ID: > < > CAF_FbKP7hCijAeD4TXfiPUoTkvUGzao7pXLTztLRJyWf5U5m-A(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi all, > > We have a PEAP eduroam setup here, and I have a suspicion that not all our > users are using/validating the server certificate - I know we can set the > clients up to not use certificates and they can still connect fine. (I'm > not completely clear on the PEAP process and whether the clients are still > using the server cert but aren't validating it, or whether no cert is used > at all in this case). > > So what I'd like to find out is if I can set the server logging up to find > out about the certificates used by each client - whether a cert is being > requested, and if so, whether the certificate is being validated by the > clients. I know this is primarily a client issue, but I'm looking for signs > of this from the server so I can see how widespread this is. I've tried > auth_goodpass/auth_badpass (no luck), I'm not sure where next to look on > this - does anyone have any advice? > > thanks (again) in advance > > Jim Potter > > > ------------------------------ > > Message: 3 > Date: Mon, 25 Mar 2019 04:55:35 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Logging config to get certificate details > Message-ID: <85A9DD14-A179-4182-8912-39B94DA0FC05(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Mar 25, 2019, at 4:53 AM, Jim Potter <j.potter(a)bathspa.ac.uk> wrote: > > > > We have a PEAP eduroam setup here, and I have a suspicion that not all > our > > users are using/validating the server certificate - I know we can set the > > clients up to not use certificates and they can still connect fine. (I'm > > not completely clear on the PEAP process and whether the clients are > still > > using the server cert but aren't validating it, or whether no cert is > used > > at all in this case). > > You can't tell what the client is doing. > > The server sends the certs to the client, and the client either > validates them, or ignores them. It doesn't tell the server what it's > doing. > > > So what I'd like to find out is if I can set the server logging up to > find > > out about the certificates used by each client - whether a cert is being > > requested, and if so, whether the certificate is being validated by the > > clients. I know this is primarily a client issue, but I'm looking for > signs > > of this from the server so I can see how widespread this is. I've tried > > auth_goodpass/auth_badpass (no luck), I'm not sure where next to look on > > this - does anyone have any advice? > > This information is available only on the client. The client doesn't > tell anyone else what it's doing. > > Alan DeKok. > > > > > ------------------------------ > > Message: 4 > Date: Mon, 25 Mar 2019 09:06:39 +0000 > From: Jim Potter <j.potter(a)bathspa.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Logging config to get certificate details > Message-ID: > <CAF_FbKM2C2bb1LVdw+yuqHeEktXcnAUNA5rTHa9f+vJoaT35= > w(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Alan, > > Thanks for the quick reply! > > So doesn't the client return a PEAP request containing the MSCHAPv2 request > encrypted using the server certificate? My hope was that if a client device > wasn't using a cert at all, I could see the format of the reply or > something similar... but then if the clients are using whatever cert is > sent out, but not validating it, that wouldn't show up. > > OK, so, plan B - if I set up a rogue access point (FreeRadius WPE or > similar with a self signed certificate), I could see who connects > regardless of the dubious cert, then chase them up. Would that work? > > thanks again, > > Jim > > On Mon, 25 Mar 2019 at 08:55, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > On Mar 25, 2019, at 4:53 AM, Jim Potter <j.potter(a)bathspa.ac.uk> wrote: > > > > > > We have a PEAP eduroam setup here, and I have a suspicion that not all > > our > > > users are using/validating the server certificate - I know we can set > the > > > clients up to not use certificates and they can still connect fine. > (I'm > > > not completely clear on the PEAP process and whether the clients are > > still > > > using the server cert but aren't validating it, or whether no cert is > > used > > > at all in this case). > > > > You can't tell what the client is doing. > > > > The server sends the certs to the client, and the client either > > validates them, or ignores them. It doesn't tell the server what it's > > doing. > > > > > So what I'd like to find out is if I can set the server logging up to > > find > > > out about the certificates used by each client - whether a cert is > being > > > requested, and if so, whether the certificate is being validated by the > > > clients. I know this is primarily a client issue, but I'm looking for > > signs > > > of this from the server so I can see how widespread this is. I've tried > > > auth_goodpass/auth_badpass (no luck), I'm not sure where next to look > on > > > this - does anyone have any advice? > > > > This information is available only on the client. The client doesn't > > tell anyone else what it's doing. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > -- > thanks, > > Jim Potter > User Platform Engineer > IT Services > Bath Spa University > > T: 01225 876220 > Visit www.bathspa.ac.uk > Join us on: Facebook <http://www.facebook.com/bath.spa.university>| > Twitter > <https://twitter.com/#!/BathSpaUni>| YouTube > <http://www.youtube.com/BathSpaUniversity>| LinkedIn > <http://www.linkedin.com/company/bath-spa-university> > Newton Park, Bath, BA2 9BN > > Think before you print > > Disclaimer > If you have received this message in error, please notify us and remove it > from your system. Any views or opinions expressed in personal emails are > solely those of the author and do not necessarily represent those of Bath > Spa University. Neither Bath Spa University nor the sender accepts any > responsibility for viruses and it is your responsibility to scan this email > and any attachments for viruses. > > > ------------------------------ > > Message: 5 > Date: Mon, 25 Mar 2019 05:15:12 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Logging config to get certificate details > Message-ID: <B733798B-02B6-4901-9B5D-B4B704FB070F(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Mar 25, 2019, at 5:06 AM, Jim Potter <j.potter(a)bathspa.ac.uk> wrote: > > So doesn't the client return a PEAP request containing the MSCHAPv2 > request > > encrypted using the server certificate? > > No. > > PEAP essentially sets up a TLS connection between the two endpoints. It > then sends MS-CHAPv2 data inside of the TLS tunnel. > > The MS-CHAPv2 is protected via the TLS protocol. It is *not* "encrypted > using the server certificate". > > > My hope was that if a client device > > wasn't using a cert at all, > > The client device gets the server cert sent to it by the server, as part > of the TLS exchange. The client device is free to *ignore* this server > certificate. > > > I could see the format of the reply or > > something similar... but then if the clients are using whatever cert is > > sent out, but not validating it, that wouldn't show up. > > Yes. > > > OK, so, plan B - if I set up a rogue access point (FreeRadius WPE or > > similar with a self signed certificate), I could see who connects > > regardless of the dubious cert, then chase them up. Would that work? > > People will connect if they configure it manually. Which most won't. > > There really isn't any point in doing this. You won't get any useful > information from it. > > Alan DeKok. > > > > > ------------------------------ > > Message: 6 > Date: Mon, 25 Mar 2019 09:29:19 +0000 > From: Jim Potter <j.potter(a)bathspa.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Logging config to get certificate details > Message-ID: > <CAF_FbKOAy-m61kMhFdm+wcdh4fy_1QqC= > vx+MprzN6veYMh4iQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Alan, > > OK, thanks for the advice here. Historically, everyone has set up their > devices manually, and I have a suspicion that some have been told to ignore > the certificate, so if I do set up a rogue access point, this WILL catch > anyone with this configured, correct? > > cheers, > > Jim > > On Mon, 25 Mar 2019 at 09:15, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > On Mar 25, 2019, at 5:06 AM, Jim Potter <j.potter(a)bathspa.ac.uk> wrote: > > > So doesn't the client return a PEAP request containing the MSCHAPv2 > > request > > > encrypted using the server certificate? > > > > No. > > > > PEAP essentially sets up a TLS connection between the two endpoints. > It > > then sends MS-CHAPv2 data inside of the TLS tunnel. > > > > The MS-CHAPv2 is protected via the TLS protocol. It is *not* > "encrypted > > using the server certificate". > > > > > My hope was that if a client device > > > wasn't using a cert at all, > > > > The client device gets the server cert sent to it by the server, as > part > > of the TLS exchange. The client device is free to *ignore* this server > > certificate. > > > > > I could see the format of the reply or > > > something similar... but then if the clients are using whatever cert is > > > sent out, but not validating it, that wouldn't show up. > > > > Yes. > > > > > OK, so, plan B - if I set up a rogue access point (FreeRadius WPE or > > > similar with a self signed certificate), I could see who connects > > > regardless of the dubious cert, then chase them up. Would that work? > > > > People will connect if they configure it manually. Which most won't. > > > > There really isn't any point in doing this. You won't get any useful > > information from it. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > -- > thanks, > > Jim Potter > User Platform Engineer > IT Services > Bath Spa University > > T: 01225 876220 > Visit www.bathspa.ac.uk > Join us on: Facebook <http://www.facebook.com/bath.spa.university>| > Twitter > <https://twitter.com/#!/BathSpaUni>| YouTube > <http://www.youtube.com/BathSpaUniversity>| LinkedIn > <http://www.linkedin.com/company/bath-spa-university> > Newton Park, Bath, BA2 9BN > > Think before you print > > Disclaimer > If you have received this message in error, please notify us and remove it > from your system. Any views or opinions expressed in personal emails are > solely those of the author and do not necessarily represent those of Bath > Spa University. Neither Bath Spa University nor the sender accepts any > responsibility for viruses and it is your responsibility to scan this email > and any attachments for viruses. > > > ------------------------------ > > Message: 7 > Date: Mon, 25 Mar 2019 05:31:46 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Logging config to get certificate details > Message-ID: <E9025034-9BFF-4DD3-9F65-4AAA3BFAFEA4(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Mar 25, 2019, at 5:29 AM, Jim Potter <j.potter(a)bathspa.ac.uk> wrote: > > > > OK, thanks for the advice here. Historically, everyone has set up their > > devices manually, and I have a suspicion that some have been told to > ignore > > the certificate, so if I do set up a rogue access point, this WILL catch > > anyone with this configured, correct? > > Maybe. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 167, Issue 65 > ************************************************* > -- Thanks & Regards Aditya Vijjan

2 1

Logging config to get certificate details
by Jim Potter 25 Mar '19

25 Mar '19

Hi all, We have a PEAP eduroam setup here, and I have a suspicion that not all our users are using/validating the server certificate - I know we can set the clients up to not use certificates and they can still connect fine. (I'm not completely clear on the PEAP process and whether the clients are still using the server cert but aren't validating it, or whether no cert is used at all in this case). So what I'd like to find out is if I can set the server logging up to find out about the certificates used by each client - whether a cert is being requested, and if so, whether the certificate is being validated by the clients. I know this is primarily a client issue, but I'm looking for signs of this from the server so I can see how widespread this is. I've tried auth_goodpass/auth_badpass (no luck), I'm not sure where next to look on this - does anyone have any advice? thanks (again) in advance Jim Potter

2 6

Load Python Module correctly
by luckydog xf 25 Mar '19

25 Mar '19

Hi, list, I want to write my own python code, I added below lines. # /etc/raddb/mods-enabled/python python_path = "/usr/lib64/python2.7/" module = example --------- in /usr/lib64/python2.7/example.py, I imported required modules. # import radiusd import requests import json ... ... some other code ...... And radiusd -X raised an error: python_function_load - Module 'example' not found <type 'exceptions.ImportError'> (No module named requests) python_function_load - Failed to import python function 'example.instantiate' /etc/raddb/mods-enabled/python[9]: Instantiation failed for module "python" Acutally, * requests * and * json * are both available, see # python ...... # remove unless lines ### >>> import radiusd >>> import requests >>> import json >>> So what's the right way to implement this? Thanks.

2 2

allowing multiple Auth-Type in authorize file
by Niels Tomey 24 Mar '19

24 Mar '19

Hi, I’ve set up freeradius 3.0.17 quite some time ago to process ssh logins based on LDAP/AD accounts (with group membership in post-auth) and this works fine. I followed the guide on deployingradius.com ( http://deployingradius.com/documents/configuration/active_directory.html) but haven’t implemented the mschap section as I didn’t need it at the time. Now I am running into this need and I was trying to figure out why it wasn’t working only to discover that I left the DEFAULT Auth-Type = ntlm_auth Line in the mods-config/files/authorize file. As expected this breaks my attempts to include mschap. My problem is that this is the only non-commented line in the entire file, so rather than just delete the line I need to enter some other information here to prevent the ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject In the comments in the file it states that multiple DEFAULTs can be used with Fall-Through so I tried this: DEFAULT Auth-Type = ntlm_auth Fall-Through = Yes DEFAULT Auth-Type = mschap But this doesn’t work. What is the best approach for this? I would like to avoid having to name my users here since they are in ldap already and I don’t know if a device will only authenticate using mschap or not (e.g. it will be difficult to split this out in the clients.conf file). My google skills are letting me down on this, some pointers in the right direction would be very much appreciated. Regards, Niels

2 2

Simultaneous-Use
by Aditya Vijjan 22 Mar '19

22 Mar '19

Hi Team, How to configure Simultaneous-Use, do we required any script etc or we can use inbuild feature. -- Thanks & Regards Aditya Vijjan

1 0

WPA Enterprise with Radius assigned VLAN from LDAP (Samba Active Directory)
by Christian Uhlmann 21 Mar '19

21 Mar '19

Hello everybody, I successfully got Freeradius running for WPA Enterprise with Samba Active Diretory. OS: Debian Buster FreeRADIUS Version: 3.0.17 The /etc/freeradius/3.0/mods-available/ntlm_auth looks like this: exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=HOME --username=%{mschap:User-Name} --password=%{User-Password}" } Now I would also like to perform a VLAN assignment based on groups of the user in the AD. First my question: Is this in the post-auth over LDAP possible? For this I have setup in the LDAP config (/etc/freeradius/3.0/mods-available/ldap): ldap { server = "pdc.home.uhlmann.world" port = 389 identity = "cn=radius-auth,cn=users,DC=home,DC=uhlmann,DC=world" password = << secret password >> basedn = "CN=Users,DC=home,DC=uhlmann,DC=world" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" tls { start_tls = no } group { base_dn = "CN=Users,DC=home,DC=uhlmann,DC=world" name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberOf=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberOf' } options { chase_referrals = no rebind = yes timeout = 10 timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } } In /etc/freeradius/3.0/sites-enabled/default I configured the following in the post-auth section: ldap if (LDAP-Group == "wlan-gast") { update reply { Tunnel-type = VLAN Tunnel-medium-type = IEEE-802 Tunnel-Private-Group-Id = 851 } } elsif (LDAP-Group == "wlan-kinder") { update reply { Tunnel-type = VLAN Tunnel-medium-type = IEEE-802 Tunnel-Private-Group-Id = 999 } } else { update reply { Tunnel-type = VLAN Tunnel-medium-type = IEEE-802 Tunnel-Private-Group-Id = 999 } } Unfortunately, the assignment to the VLAN 999 always takes place, the following can be seen in the debug output: (8) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (8) post-auth { (8) update { (8) No attributes updated (8) } # update = noop (8) [ldap] = noop (8) if (LDAP-Group == "wlan-gast") { (8) Searching for user in group "wlan-gast" rlm_ldap (ldap): Reserved connection (2) (8) Performing unfiltered search in "", scope "sub" (8) Waiting for search result... (8) The specified DN wasn't found (8) Search returned no results rlm_ldap (ldap): Released connection (2) (8) if (LDAP-Group == "wlan-gast") -> FALSE (8) elsif (LDAP-Group == "wlan-kinder") { (8) Searching for user in group "wlan-kinder" rlm_ldap (ldap): Reserved connection (3) (8) Performing unfiltered search in "", scope "sub" (8) Waiting for search result... (8) The specified DN wasn't found (8) Search returned no results rlm_ldap (ldap): Released connection (3) (8) elsif (LDAP-Group == "wlan-kinder") -> FALSE (8) else { (8) update reply { (8) Tunnel-type = VLAN (8) Tunnel-medium-type = IEEE-802 (8) Tunnel-Private-Group-Id = 999 (8) } # update reply = noop (8) } # else = noop (8) [exec] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # post-auth = noop (8) Login OK: [testgast/<via Auth-Type = eap>] (from client unifi port 0 cli 48-BF-6B-47-56-EC) (8) Sent Access-Accept Id 156 from 192.168.127.37:1812 to 192.168.127.197:54036 length 0 (8) MS-MPPE-Recv-Key = 0xdb66ce7a4780f479ecba8643b5408656d13b0affd455c45cc0598fb495e3815f (8) MS-MPPE-Send-Key = 0x02dd275fc9cd169117139666b81da0fb40b3e280174c546b15de84688cb91d91 (8) EAP-Message = 0x03540004 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) User-Name = "testgast" (8) Tunnel-Type = VLAN (8) Tunnel-Medium-Type = IEEE-802 (8) Tunnel-Private-Group-Id = "999" (8) Finished request (In the appendix again the complete debug.log) As you can see, freeradius does not seem to search correctly in LDAP. Running a mnauelles with ldapsearch (as stated here https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai…) comes to the following result: ldapsearch -D cn=radius-auth,cn=users,DC=home,DC=uhlmann,DC=world -w << secret password >> -h pdc.home.uhlmann.world -b 'CN=Users,DC=home,DC=uhlmann,DC=world' '(&(objectClass=user)(sAMAccountName=testgast)(memberOf=CN=wlan-gast,CN=Users,DC=home,DC=uhlmann,DC=world))' # extended LDIF # # LDAPv3 # base <CN=Users,DC=home,DC=uhlmann,DC=world> with scope subtree # filter: (&(objectClass=user)(sAMAccountName=testgast)(memberOf=CN=wlan-gast,CN=Users,DC=home,DC=uhlmann,DC=world)) # requesting: ALL # # testgast, Users, home.uhlmann.world dn: CN=testgast,CN=Users,DC=home,DC=uhlmann,DC=world objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: testgast givenName: testgast instanceType: 4 whenCreated: 20190216205554.0Z displayName: testgast uSNCreated: 13776 name: testgast objectGUID:: bd40XvQpbkSeX5icQ6HMwQ== badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAA0HcQPtkCCXK+0rCrrgUAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: testgast sAMAccountType: 805306368 userPrincipalName: testgast(a)home.uhlmann.world objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=home,DC=uhlmann,DC=wor ld userAccountControl: 66048 memberOf: CN=wlan-gast,CN=Users,DC=home,DC=uhlmann,DC=world pwdLastSet: 131971360575227260 lockoutTime: 0 lastLogonTimestamp: 131971360685327730 whenChanged: 20190315150748.0Z uSNChanged: 14549 distinguishedName: CN=testgast,CN=Users,DC=home,DC=uhlmann,DC=world # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Can someone tell me if this is what I intend and possibly where my mistake lies? Thanks and Regards Christian

2 4

What is the current status and roadmap for FreeRadius?
by Joshua Marshall 21 Mar '19

21 Mar '19

Hello all, I don't have a problem needing solving, but I would like context about FreeRadius. What is happening with the v4 work? What changes and challenges are being faced? What does the roadmap look like? Is there going to be a formalization of unlang? What work is currently being done? -- Please be advised that this email may contain confidential information. If you are not the intended recipient, please notify us by email by replying to the sender and delete this message. The sender disclaims that the content of this email constitutes an offer to enter into, or the acceptance of, any agreement; provided that the foregoing does not invalidate the binding effect of any digital or other electronic reproduction of a manual signature that is included in any attachment. <https://twitter.com/arroyo_networks> <https://www.linkedin.com/company/arroyo-networks> <https://www.github.com/ArroyoNetworks>

10 16