September 2019 - Freeradius-Users - lists.freeradius.org

Quota limit on the time of authentication
by Jiuyu Sun 07 Sep '19

07 Sep '19

Hi, I have a FreeRadius server running with EAP-TLS. The client can authenticate with the server with the client-side certificate (which is in a Hotspot 2.0 profile). I want to avoid user misuse of certificate/profile stolen - userA copies the client-side certificate/profile and give it to userB, so that userB can authenticate to the server with the same certificate/profile. Is there something that can be configured in FreeRadius to limit the quota of authentication on one user/certificate? For example, only allow 10 times of user authentication to my FreeRadius server everyday? Thank you! Best, Holly

2 1

Not able to send a challenge
by ngoetz75 06 Sep '19

06 Sep '19

> Thank you for your response. > > You are correct, I meant to type ttls, not tls. > > The Palo Alto firewall that I am using to authenticate against FreeRadius only supports the following types: > PEAP-MSCHAPv2 > PEAP with GTC > EAP-TTLS with PAP > PAP > > Since I am trying to do two-factor (AD and OTP), I need to be able to return a challenge response back to the firewall requesting the user to enter their token. So far I have only gotten this to work properly with PAP. Since PAP is very insecure, I was hopping to use one of the other types. I was hopping that since PAP was working, I could do the same thing using PAP within a TTLS tunnel. Since I am forwarding the second factor (OTP) to another radius servers (safenet), I am assuming the freeradius servers will need the OTP password in clear text to forward to the safenet radius server. I didn't think that the PEAP options would work because they send a hash value instead of the password. > > I am fairly new at doing this, so my assumptions could be incorrect. > > Thanks > > <quote author='Alan DeKok-2'> > > >>> On Sep 6, 2019, at 12:41 PM, ngoetz75 <ngoetz24(a)gmail.com> wrote: >>> >>> I’m not sure what I am doing wrong. I am trying to use eap-tls to >>> authenticate users against active directory, > > EAP-TLS authenticates users by certificate. It doesn't need / use AD. > > The most you could do is to check the username against the user ID in AD. > If the user exists, keep going with EAP-TLS. Otherwise reject them. > >>> and if it passes, I want to prompt the user to enter their OTP. > > EAP-TLS doesn't use passwords. Therefore it doesn't use OTP. > > Maybe you mean TTLS? > >>> This is all working with PAP, but I want to use eap-tls since it is more >>> secure. Everything works fine with the windows authentication, but as >>> soon as I uncomment out the “challenge” line in the code below, I get the >>> following error: >>> >>> (6) ntlm_auth: Program executed successfully >>> (6) [ntlm_auth] = ok >>> (6) if (ok) { >>> (6) if (ok) -> TRUE >>> (6) if (ok) { >>> (6) update reply { >>> (6) Reply-Message := "Please enter OTP" >>> (6) } # update reply = noop >>> (6) policy challenge { >>> (6) update control { >>> (6) &Response-Packet-Type = Access-Challenge >>> (6) } # update control = noop >>> (6) [handled] = handled >>> (6) } # policy challenge = handled >>> (6) } # if (ok) = handled >>> (6) } # Auth-Type ntlm_auth = handled >>> (6) } # server inner-tunnel >>> (6) Virtual server sending reply >>> (6) Reply-Message := "Please enter OTP" >>> (6) eap_ttls: No tunneled reply was found for request 6 , and the request >>> was not proxied: rejecting the user. > > Yes. EAP-TTLS has a fixed packet flow. You can't just inject something > new and expect it to work. > > If you want OTP challenge / response with EAP-TTLS, you have to use > EAP-GTC in the inner tunnel. PAP won't work. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > </quote> > Quoted from: > http://freeradius.1045715.n5.nabble.com/Fwd-Not-able-to-send-a-challenge-tp… > > > _____________________________________ > Sent from http://freeradius.1045715.n5.nabble.com >

1 0

Fwd: Not able to send a challenge
by ngoetz75 06 Sep '19

06 Sep '19

> I’m not sure what I am doing wrong. I am trying to use eap-tls to authenticate users against active directory, and if it passes, I want to prompt the user to enter their OTP. This is all working with PAP, but I want to use eap-tls since it is more secure. Everything works fine with the windows authentication, but as soon as I uncomment out the “challenge” line in the code below, I get the following error: > > (6) ntlm_auth: Program executed successfully > (6) [ntlm_auth] = ok > (6) if (ok) { > (6) if (ok) -> TRUE > (6) if (ok) { > (6) update reply { > (6) Reply-Message := "Please enter OTP" > (6) } # update reply = noop > (6) policy challenge { > (6) update control { > (6) &Response-Packet-Type = Access-Challenge > (6) } # update control = noop > (6) [handled] = handled > (6) } # policy challenge = handled > (6) } # if (ok) = handled > (6) } # Auth-Type ntlm_auth = handled > (6) } # server inner-tunnel > (6) Virtual server sending reply > (6) Reply-Message := "Please enter OTP" > (6) eap_ttls: No tunneled reply was found for request 6 , and the request was not proxied: rejecting the user. > (6) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed > (6) eap: Sending EAP Failure (code 4) ID 6 length 4 > (6) eap: Failed in EAP select > (6) [eap] = invalid > (6) } # Auth-Type eap = invalid > (6) Failed to authenticate the user > (6) Using Post-Auth-Type Reject > (6) Post-Auth-Type sub-section not found. Ignoring. > > > I only get this error when I try to send out a challenge. If I comment out the challenge line, then everything works, except then user does not get promted for their OTP and are allowed to authentice using only their domain password. > > Here is a copy of my inner-tunnel config: > > > server inner-tunnel { > > > listen { > ipaddr = 127.0.0.1 > port = 18120 > type = auth > } > > > authorize { > if (!State) { > if (&User-Password) { > update control { > Auth-Type = ntlm_auth > } > } > else { > reject > } > } > else { > # If State, then proxy request: > update control { > Proxy-To-Realm := "otp" > } > } > } > > > authenticate { > > Auth-Type ntlm_auth { > ntlm_auth > if (ok) { > update reply { > # Create a random State attribute: > # State := "%{randstr:aaaaaaaaaaaaaaaa}" > Reply-Message := "Please enter OTP" > } > # Return Access-Challenge: > # challenge > } > } > > } > > session { > radutmp > } > > post-auth { > > #if (0) { > update reply { > User-Name !* ANY > Message-Authenticator !* ANY > EAP-Message !* ANY > Proxy-State !* ANY > MS-MPPE-Encryption-Types !* ANY > MS-MPPE-Encryption-Policy !* ANY > MS-MPPE-Send-Key !* ANY > MS-MPPE-Recv-Key !* ANY > } > > update { > &outer.session-state: += &reply: > } > #} > > Post-Auth-Type REJECT { > -sql > attr_filter.access_reject > update outer.session-state { > &Module-Failure-Message := &request:Module-Failure-Message > } > } > } > > pre-proxy { > } > > post-proxy { > > eap > } > > } > > > Any help that someone could give me to point me in the right direction would be greatly appreciated. > > Thanks

2 1

chap: ERROR: &control:Cleartext-Password is required for authentication
by Cesare Esposito 06 Sep '19

06 Sep '19

Dear freeradius users, I have the following error for one authorisation: "chap: ERROR: &control:Cleartext-Password is required for authentication" as you can also see in the debug text. Usually this error is related to a missing password or a wrong password. However I am using almost the same authorisation procedure on another freeradius platform And on the other platform the authorisation worked well without problems. So my question is Are there other known grounds to have the above error ? mit freundlichen Grüssen / Best Regards Cesare Esposito Manager Network Engineering Tel: +492215000254 Mobile: +491635000627 Mail: cesare.esposito(a)inquam-solutions.de<mailto:cesare.esposito@inquam-solutions.de<mailto:cesare.esposito@inquam-solutions.de%3cmailto:cesare.esposito@inquam-solutions.de>> ------------------------------------------------------------------ Inquam Solutions GmbH, Adolf-Grimme-Allee 3, D-50829 Köln, Geschäftsführer: Carsten Ullrich, Andrzej Cwik Handelsregister: Amtsgericht Köln HRB 33214 ---------------------------------------------------------------------------------------------------------------- Disclaimer: This e-mail message is for the sole use of the intended recipient(s) and may contain privileged or confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply e-mail and delete the original message including any attachments and destroy all copies thereof. Thank you for your cooperation.

2 1

Wrong account data ?
by hjan＠libero.it 05 Sep '19

05 Sep '19

Hi, I've just setup DaloRadius with Freeradius 3.0.13 on CentOS 7. Authentication and accounting works fine but I have "unreal" data under the traffic in online user page. I've tried to enable acct_counters64 in /etc/raddb/sites-available/default but data is still unreliable, i.e for a session of about less than 5 minutes with a test notebook that does normal navigation the total data reported is -- Upload: 10.82 Mb Download: 3.53 Gb Total Traffic: 3.54 Gb -- on the radacct table I see: MariaDB [radius]> select username,acctinputoctets,acctoutputoctets from radacct; +--------------+-----------------+------------------+ | username | acctinputoctets | acctoutputoctets | +--------------+-----------------+------------------+ | 2cd444b44931 | 3308575 | 3365338107 | | 2cd444b44931 | 3328012 | 3397609046 | | 2cd444b44931 | 3331570 | 3398069502 | | 2cd444b44931 | 11309639 | 3781040457 | | 38eaa785715f | 2088560876 | 3111861848 | +--------------+-----------------+------------------+ so daloradius calculation seems right assuming octets = bytes. The NAS endpoint is a Cisco 2960 switch with a pretty straightforward configuration, does anyone have some suggestion on this ? Regards, Gianlu]{a

3 3

RE: Re: Re: Re: Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users
by Levin, Vladimir 05 Sep '19

05 Sep '19

Hi Fajar, After reading your reply I've realized that, since all Synology users belong to the "users" group, I can simply use that value in the Class statement. And it worked! Now all that's left to do is to include "admin" group for router administration, but it looks like there's a syntax error in the 2nd line of the code I came up with: update reply { if (&User-Name == "cisco") { Class := "admin" } else { Class := "users" } } Could you tell me what I'm doing wrong? Thanks a lot, vl -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+vladlevin=geo-logic.com@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Wednesday, September 04, 2019 10:04 PM To: FreeRadius users mailing list Subject: Re: Re: Re: Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users On Thu, Sep 5, 2019 at 9:43 AM Levin, Vladimir <vladlevin(a)geo-logic.com> wrote: > > Hi Fajar, > > Just to be clear: the user accounts and groups already exist in Synology's local database. Does freeradius get the same information from that database? > My goal is to return the users' group as a Class attribute in the authentication reply to the RADIUS client (Cisco VPN router). Here's what I did (working config files are located in /usr/local/synoradius/): > 1. Created /usr/local/synoradius/groups file with the following content: > update reply { > Class := "%{Group}" > } Have you determined that %{Group} actually contain the correct group? > The client log reads "charon: Localdb:authorization failed as group is NULL". > > Below is the server log: > Type Date & Time Event > 2019-09-04 18:59:06 Info Ready to process requests > 2019-09-04 18:59:06 Debug (0) Cleaning up request packet ID 166 with timestamp +36671 > 2019-09-04 18:59:01 Debug Waking up in 4.9 seconds. > 2019-09-04 18:59:01 Debug (0) Finished request > 2019-09-04 18:59:01 Debug (0) Class := 0x Looking at this, it seems that %{Group} is expanded to null. Where did synology define the group? If it's part of unix group, then reading http://freeradius.1045715.n5.nabble.com/Reply-with-group-attribute-tp278105… , it does not store group membership in 'Group' attribute. You might be able to use something like https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… , but it might or might not work depending on what's in your /etc/group. If your user/group are stored in sql, then it's another different story. You might be able to get group membership using a custom SQL query. In any case, you can see what attributes you can use (for update reply) in debug mode using debug_all: https://serverfault.com/a/845161 -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 1

RE: Re: Re: Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users
by Levin, Vladimir 05 Sep '19

05 Sep '19

Hi Fajar, Just to be clear: the user accounts and groups already exist in Synology's local database. My goal is to return the users' group as a Class attribute in the authentication reply to the RADIUS client (Cisco VPN router). Here's what I did (working config files are located in /usr/local/synoradius/): 1. Created /usr/local/synoradius/groups file with the following content: update reply { Class := "%{Group}" } 2. Updated the post-auth statement of /usr/local/synoradius/rad_site_def_local file as follows: post-auth { exec $INCLUDE /usr/local/synoradius/groups Post-Auth-Type REJECT { attr_filter.access_reject } 3. Restarted the server and tested. No go. The client log reads "charon: Localdb:authorization failed as group is NULL". Below is the server log: Type Date & Time Event 2019-09-04 18:59:06 Info Ready to process requests 2019-09-04 18:59:06 Debug (0) Cleaning up request packet ID 166 with timestamp +36671 2019-09-04 18:59:01 Debug Waking up in 4.9 seconds. 2019-09-04 18:59:01 Debug (0) Finished request 2019-09-04 18:59:01 Debug (0) Class := 0x 2019-09-04 18:59:01 Debug (0) Sent Access-Accept Id 166 from 192.168.1.101:1812 to 192.168.1.100:57745 length 0 2019-09-04 18:59:01 Auth (0) Login OK: [username] (from client RV340 port 11121) 2019-09-04 18:59:01 Debug (0) } # post-auth = noop 2019-09-04 18:59:01 Debug (0) } # update reply = noop 2019-09-04 18:59:01 Debug (0) Class := 0x 2019-09-04 18:59:01 Debug (0) --> 2019-09-04 18:59:01 Debug (0) EXPAND %{Group} 2019-09-04 18:59:01 Debug (0) update reply { 2019-09-04 18:59:01 Debug (0) [exec] = noop 2019-09-04 18:59:01 Debug (0) modsingle[post-auth]: returned from exec (rlm_exec) 2019-09-04 18:59:01 Debug (0) modsingle[post-auth]: calling exec (rlm_exec) 2019-09-04 18:59:01 Debug (0) post-auth { 2019-09-04 18:59:01 Debug (0) # Executing section post-auth from file /usr/local/synoradius/rad_site_def_local 2019-09-04 18:59:01 Debug (0) } # Auth-Type PAP = ok 2019-09-04 18:59:01 Debug (0) [pap] = ok 2019-09-04 18:59:01 Debug (0) modsingle[authenticate]: returned from pap (rlm_pap) 2019-09-04 18:59:01 Debug (0) pap: User authenticated successfully 2019-09-04 18:59:01 Debug (0) pap: Comparing with "known good" Crypt-Password "$6$LFU97T6ajw2Q/a$zilaUncUFrH.XW9n4gN.kMq2osfBhcd2.D6UVa286NmOizyjxKZzpw2deyU4twmvfSgcXbfC2ABJiLM0iLVxz." 2019-09-04 18:59:01 Debug (0) pap: Login attempt with password "password" (8) 2019-09-04 18:59:01 Debug (0) modsingle[authenticate]: calling pap (rlm_pap) 2019-09-04 18:59:01 Debug (0) Auth-Type PAP { 2019-09-04 18:59:01 Debug (0) # Executing group from file /usr/local/synoradius/rad_site_def_local 2019-09-04 18:59:01 Debug (0) Found Auth-Type = PAP 2019-09-04 18:59:01 Debug (0) } # authorize = updated 2019-09-04 18:59:01 Debug (0) [pap] = updated 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from pap (rlm_pap) 2019-09-04 18:59:01 Debug (0) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes 2019-09-04 18:59:01 Debug (0) pap: Normalizing LM-Password from base64 encoding, 32 bytes -> 24 bytes 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling pap (rlm_pap) 2019-09-04 18:59:01 Debug (0) [logintime] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from logintime (rlm_logintime) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling logintime (rlm_logintime) 2019-09-04 18:59:01 Debug (0) [expiration] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from expiration (rlm_expiration) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling expiration (rlm_expiration) 2019-09-04 18:59:01 Debug (0) [smbpasswd] = ok 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from smbpasswd (rlm_passwd) 2019-09-04 18:59:01 Debug (0) smbpasswd: Added SMB-Account-CTRL-TEXT: '[U ]' to config 2019-09-04 18:59:01 Debug (0) smbpasswd: Added NT-Password: '54BC4927BD320C776E53E1B38F92496B' to config 2019-09-04 18:59:01 Debug (0) smbpasswd: Added LM-Password: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' to config 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling smbpasswd (rlm_passwd) 2019-09-04 18:59:01 Debug (0) [unix] = updated 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from unix (rlm_unix) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling unix (rlm_unix) 2019-09-04 18:59:01 Debug (0) [files] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from files (rlm_files) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling files (rlm_files) 2019-09-04 18:59:01 Debug (0) [eap] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from eap (rlm_eap) 2019-09-04 18:59:01 Debug (0) eap: No EAP-Message, not doing EAP 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling eap (rlm_eap) 2019-09-04 18:59:01 Debug (0) [synorad] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from synorad (rlm_synorad) 2019-09-04 18:59:01 Debug synorad: block list[(null)] 2019-09-04 18:59:01 Debug synorad: block list[(null)] 2019-09-04 18:59:01 Debug synorad: Full name[username] 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling synorad (rlm_synorad) 2019-09-04 18:59:01 Debug (0) [suffix] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from suffix (rlm_realm) 2019-09-04 18:59:01 Debug (0) suffix: No such realm "NULL" 2019-09-04 18:59:01 Debug (0) suffix: No '@' in User-Name = "username", looking up realm NULL 2019-09-04 18:59:01 Debug (0) suffix: Checking for suffix after "@" 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling suffix (rlm_realm) 2019-09-04 18:59:01 Debug (0) [digest] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from digest (rlm_digest) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling digest (rlm_digest) 2019-09-04 18:59:01 Debug (0) [mschap] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from mschap (rlm_mschap) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling mschap (rlm_mschap) 2019-09-04 18:59:01 Debug (0) [chap] = noop 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from chap (rlm_chap) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling chap (rlm_chap) 2019-09-04 18:59:01 Debug (0) [preprocess] = ok 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) 2019-09-04 18:59:01 Debug (0) modsingle[authorize]: calling preprocess (rlm_preprocess) 2019-09-04 18:59:01 Debug (0) authorize { 2019-09-04 18:59:01 Debug (0) # Executing section authorize from file /usr/local/synoradius/rad_site_def_local 2019-09-04 18:59:01 Debug (0) session-state: No State attribute 2019-09-04 18:59:01 Debug (0) Service-Type = Authenticate-Only 2019-09-04 18:59:01 Debug (0) NAS-Port-Type = Virtual 2019-09-04 18:59:01 Debug (0) NAS-Port = 11121 2019-09-04 18:59:01 Debug (0) NAS-Identifier = "3rdparty" 2019-09-04 18:59:01 Debug (0) NAS-IP-Address = 192.168.1.100 2019-09-04 18:59:01 Debug (0) User-Password = "password" 2019-09-04 18:59:01 Debug (0) User-Name = "username" 2019-09-04 18:59:01 Debug (0) Received Access-Request Id 166 from 192.168.1.100:57745 to 192.168.1.101:1812 length 85 What am I missing or doing wrong? Thank you, vl -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+vladlevin=geo-logic.com@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Wednesday, September 04, 2019 2:41 AM To: FreeRadius users mailing list Subject: ++++SPAM++++ Re: Re: Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users On Wed, Sep 4, 2019 at 3:02 PM Levin, Vladimir <vladlevin(a)geo-logic.com> wrote: > Is that correct?[] Yes, that is absolutely correct. You should use quoting when replying message, to make your replies easier to read. e.g: https://en.wikipedia.org/wiki/Posting_style#Quoted_line_prefix > - you have no problem with potentially breaking (or voiding warranty) > your synlogy nas[] I don't have a problem with that. > - you have access to command line[] I do. > - you are familiar with configuring software directly via command line[] To a certain degree. > - you can read (and implement) the docs[] I guess that remains to be seen. > > As for "send radius attribute", if it were a normal freeradius > installation with mysql backend, and the attribute is specific to each > user, you probably need to add entries to radreply table, e.g. > https://wiki.freeradius.org/guide/SQL-HOWTO#populating-sql You can try to follow the example then. Looking at https://github.com/FreeRADIUS/freeradius-server/blob/master/share/dictionar… , the attribute name should be just what you wrote earlier: 'Class'. Try adding it (or find the way to add it using synology gui) to radreply table for your test user. -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users
by Levin, Vladimir 05 Sep '19

05 Sep '19

Alan, 1. Every single assumption you made in your last reply about what I'm doing, or thinking, or capable of is dead wrong and, frankly, insulting. Also, I'm not a mind reader and your replies are anything but clear (or concise for that matter) and they contained no indication whatsoever that you understood the issue; quite the opposite, actually. 3. I'm doing nothing of the sort and you don't need to state the obvious. 4. I know I can and I wasn't asking for help with that. 5. I wouldn't mind making a reasonable payment to someone who could do this for me. The working files are in /usr/local/synoradius/ folder by way of $INCLUDE statements in the corresponding files located in /volume1/@appstore/RadiusServer/ folder. Also, see my last reply to Fajar. I know it's hard for you to understand, but try to look at me as a passerby who's had a misfortune to be stuck in your town for a couple of days and is trying to communicate with the locals without any prior knowledge of their dialect. Chances are that, if I can make it work this time, I won't need to mess with FreeRADIUS ever again. vl -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+vladlevin=geo-logic.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, September 04, 2019 4:02 AM To: FreeRadius users mailing list Subject: ++++SPAM++++ Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users > On Sep 4, 2019, at 5:26 AM, Levin, Vladimir <vladlevin(a)geo-logic.com> wrote: > > 1. According to Cisco tech support (and as I wrote in my original post) I need FreeRADIUS server to send RADIUS attribute class 25 with the user group name to the client (RV340). I already explained that I understand that. Yet you're still explaining it over and over. I've seen this lots. It indicates that you're stuck on the problem and not on the solution. You SHOULD read my response, realize that I understand the need to use Class, and then STOP REPEATING IT. Learning from simple email messages shows that you can read the documentation and learn from it. Being unable to learn from email messages explains why the documentation doesn't mean anything to you. > 3. There was only 1 non-rhetorical question in your previous post and I did answer it to the best of my knowledge and understanding. Also, I couldn't find any Class attribute examples you are referring to. Because you're looking in the Synology configuration. They've butchered it to do whatever it is they do. They do NOT include the default documentation or configuration in their product. You are aware that we aren't Synology, right? And that you CAN download a default FreeRADIUS configuration and read it, right? And that when I refer to the "default configuration", I mean THE SOFTWARE WE WROTE AND DISTRIBUTE. And not the Synology thing that we know nothing about? > 4. I think it's MySQL database; I don't know how FreeRADIUS queries it. If Synology ships FreeRADIUS that's configured to use MySQL, then the configuration files are on local disk. If you can get access to local disk, then you can find those files. This is Unix administration 101. > 5. Once again, I'm not a developer, but an end user of a Synology NAS and I don't have information about its inner workings. According to Synology development team, what I'm trying to achieve "is not a default option they support" and my only alternative is to try to modify the settings myself. i.e. you paid money for a product, but they won't help you. So your response is to come here, and ask *us* for help. For free. And, give a vague description of the problem. > Obviously this isn't my area of expertise and I'm clearly out of my depth here, so any help I can get is very appreciated. I'm trying to help you, and not being very successful. The issue here is simple: You've paid money for a product that doesn't do what you want. On top of that, we cannot help you configure a product we know nothing about. Sure, it's based on FreeRADIUS. But we don't know how they've configured it. We don't know where the files are on disk. And you can't give us that information. Which means we can't help you. *You* need to understand the product you bought *first*. Then, explain those technical details clearly and simply. Once that's done, we can likely help you. But if your expectation is that we can help you based on "I don't know", or "I want to do stuff", then you are severely mistaken. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

SQL Accounting... ¿Negative?
by Gabriel Trabanco Llano 04 Sep '19

04 Sep '19

Hi everyone! I do not know if it is really a problem… Because all data is ok but it is really strange. Firstly, I use Freeradius 3 with SQL and SQL Counter module under Ubuntu Server and because I need billing periods by days I made a triggers in redacct table to separate users billing information by hours to another table because as you know, we can have sessions larger than our billing period. The solution is the file I added called fix_accounting.sql. Well, In the solution I made a procedure that get the information of the session and if there is no info about the user in this new table, make an insert if not make an update with new information. This is done by the procedure call. This procedure needs the username, the timestamp that sends the NAS to calculate the billing period, the downloaded/uploaded data to add and also the session time to add. Because of this in the trigger when update the redacct we do a rest between the new value to update the data and the previous to know the difference of data to add but, sometimes the billing data in the new table is negative because of this. Finally, when I compare the data between the two tables they give me exactly the same data if there is no a session larger than a day even if there is negative values… Does anyone know what is happening? I have no clue about. Obviously the new data is lower than the old but, why? Am I doing something wrong? The unique possibility I can imagine is that Freeradius is not updating the values correctly because it isn’t updating the values, it is expecting to add the amount of data to the row but that is not a possibility because in SQL you set a value and you have to calculate previously (maybe in the same SQL but you have to calculate the new value previously). Thank you for your attention =) Regards.

2 4

RE: Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users
by Levin, Vladimir 04 Sep '19

04 Sep '19

1. According to Cisco tech support (and as I wrote in my original post) I need FreeRADIUS server to send RADIUS attribute class 25 with the user group name to the client (RV340). The http://freeradius.1045715.n5.nabble.com/Reply-with-group-attribute-td278105… thread seems to be dealing with similar issue, though it's over 10 years old. In his 2nd, 4:30 am, post Markus Wernig is asking the same question as I am, but I am not sure I fully understand what exactly he ended up doing. 2. See above. Also, I have read the documentation, but it's still unclear to me how I should proceed. 3. There was only 1 non-rhetorical question in your previous post and I did answer it to the best of my knowledge and understanding. Also, I couldn't find any Class attribute examples you are referring to. 4. I think it's MySQL database; I don't know how FreeRADIUS queries it. 5. Once again, I'm not a developer, but an end user of a Synology NAS and I don't have information about its inner workings. According to Synology development team, what I'm trying to achieve "is not a default option they support" and my only alternative is to try to modify the settings myself. Obviously this isn't my area of expertise and I'm clearly out of my depth here, so any help I can get is very appreciated. vl -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+vladlevin=geo-logic.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, September 03, 2019 7:42 PM To: FreeRadius users mailing list Subject: ++++SPAM++++ Re: Configure Freeradius Server on a Synology NAS to Authenticate Cisco RV340 Users On Sep 3, 2019, at 9:22 PM, Levin, Vladimir <vladlevin(a)geo-logic.com> wrote: > > 1. I was unable to find any vendor documention that would explain how to make it work. Both, Synology and Cisco, development level technical support couldn't help either and referred me to Freeradius or "other online sources". My point was that we can answer questions about FreeRADIUS. We *can't* answer questions about what attributes are needed by a particular NAS. Or, what values should be used for those attributes. Only the vendor documentation has that information. Once you know which attributes need to be returned, and what values they have, it's easy to configure FreeRADIUS. And we can definitely help there. > 2. I am not familiar with RADIUS server environment nor am I a programmer, so even after reading the documentation I am still not sure which file(s) to input the code into or what the correct code should be. "correct code" to do... what? Saying "I'm not familiar with RADIUS" is a *terrible* answer. We know. You MUST be willing to *learn* about it. > 3. I am not looking for a lecture (though, if that's what gets you off, I am happy to provide the opportunity) nor for other people to do my work for me (I've spent many hours trying to get it to work with nothing to show for it), but was rather hoping that someone has already solved that problem and was willing to share the solution. I was hoping you would answer my question instead of complaining or making personal insults. The point was if you want to return an attribute, there is TONS of documentation telling you what to do. Just look for "Class" in the default configuration, and you will see examples of comparing the Class attribute to something, or setting its value. And no, no one has solved your particular problem before. It's unusual, hence my reply of "what do you mean?" If it was a common problem, then it would have been documented. Yes, it's 2019. Complaints about the FreeRADIUS documentation are no longer relevant. While the documentation isn't perfect, it clearly describes the syntax of the configuration files. The default virtual servers are heavily commented and documented. All that is necessary is that you *read* it, and ask *specific questions* when you don't understand something. It's just not useful to say "I've spent many hours trying to get it to work with nothing to show for it". That's a complaint of "I did stuff and it didn't work. But I'm not going to tell you what I did!" How do you expect us to be able to help you, then? > 4. The group names are stored in the local user database of the Synology NAS; its RADIUS server, which is essentially Freeradius, is configured via GUI to use that database. That means nothing. WHAT kind of database is it? HOW does FreeRADIUS query it? > 5. If I knew what additional information is needed, I'd be glad to provide it, if I can. Give sufficient technical information so that people can help you. Your description is vague. "Database" isn't helpful. "MySQL" is helpful. "MySQL and here's a copy of the schema" is helpful. You're asking us how to configure "stuff". And when I point out that description isn't good enough, you don't respond with a clearer description. That's not productive. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1