January 2020 - Freeradius-Users - lists.freeradius.org

IPoE Access- how can I achieve this?
by Nitin sidhu 14 Jan '20

14 Jan '20

Hello We are using IPoE as user access mechanism. The BNG/BRAS uses the option82 in the DHCP discover message and creates a username from that and passes this username to the radius server. All the users are in a postgres DB. We need to wall garden any user that is not in the DB when the radius servers looks at the DB tables. We require that any user that is not in the DB, the radius server should pass these attributes in access-accept packet to the client: 1) Filter-id 2) HW-Web-URL How can we achieve this please if this is possible? and where would we need to add the necessary policies? Kind regards Nitin Sidhu

2 1

EAP stress testting
by work vlpl 13 Jan '20

13 Jan '20

Hello, I want to do a stress test of my Freeradius setup with EAP connections. radclient tool support arguments that allow to send many packets/request per second, but eapol_test tool does not support it. So to simulate may EAP connections/request per second I am starting many eapol_test processes in parallel. It kinda works, but I wonder if there is a better tool to do that. -- Vladimir

4 5

Microsoft AD group check
by Marek Smoliński 13 Jan '20

13 Jan '20

Hi, I want to implement 802.1x. The computers belonging to Microsoft domey will be authenticated. The switch port will be configured in VLAN according to the computer's group membership. Simple configuration. Works well ;) FreeRadius 3.0.19 Question: due to AD complexity, is it possible to assign the same VLAN to computers from different groups? Currently I'm doing it as follows: in post-auth if (Ldap-Group == VLAN16_SIEO1) { update reply { ... } } I want to allocate the same VLAN to groups such as VLAN16_BSTO1 and VLAN16_ADMCE1 and others starting with VLAN16_. Is it possible to check the group name so as not to create many "if" conditions? In my case these conditions will be about 800 :) if I change the „if” condition if (Ldap-Group[*] =~ /.*VLAN16_.*/) { update reply { ... } } I've got the result: Debug: (10) User is not a member of "VLAN129" Debug: (10) elsif (LDAP-Group == VLAN129) -> FALSE Debug: (10) elsif (LDAP-Group[*] =~ /.*VLAN16_.*/) { Debug: No old matches Debug: (10) elsif (LDAP-Group[*] =~ /.*VLAN16_.*/) -> FALSE Debug: (10) elsif (LDAP-Group == VLAN131) { Debug: (10) Searching for user in group "VLAN131" anyone can help me, tell me how to config can solve this problem, thanks. regards Marek Smoliński

4 15

Question on syntax in site definitions
by Coy Hile 12 Jan '20

12 Jan '20

Hi all, Quick question that I don’t see documented (at least not in the comments themselves). If one looks at sites-available/default (https://github.com/FreeRADIUS/freeradius-server/blob/release_3_0_20/raddb/s…) one sees “-sql” and “-ldap”. What’s the function of the `-‘ there? Is it a “use this if it is defined, but ignore it otherwise” bit of syntactic sugar? -- Coy Hile coy.hile(a)coyhile.com

2 1

Radius certificate issue on Win10
by uj2.hahn＠posteo.de 12 Jan '20

12 Jan '20

I know, this is not really a freeradius tool question but more a Windows issue. I created new radius certificates and installed them on server and some Android clients. Everything is working fine. These clients can login without password now. But not comes the real exercise: I tried to setup Win 10 (version 1909) clients to be used in same way (login via certificate instead of user/passwd). But something is completely wrong. I followed some guidelines I found in the web and created a WLAN profile with the necessary setting. But when I use the profile to open the WLAN connection, the only thing I see is something like: "Connection is not possible, You need a certificate to login. Please contact your admin." Is there anybody out there who can help me to resolve that issue? Thanks a lot Uwe

2 1

Is it possible to proxy a request to a second radius server if the first one rejects the request?
by ngoetz24＠gmail.com 12 Jan '20

12 Jan '20

We are in the process to migrating a large number of users from our existing OTP server to a new OTP solution. During this process it will take around a moth to assign all the users a new physical token. Because of this, we will need to support both OTP servers until all the users have their new tokens. We currently have two realms setup in the proxy.conf file. One goes to the old OTP radius server, and the other goes to the new OTP radius server. Using each of these realms individually works just fine. Is there a way to configure freeradius to proxy the request to the first realm, and if it gets a rejection to then proxy the request to the second realm? We are trying to make this transition as seamless as possible to our users. During the transition period, it would be useful if we could find a way to proxy the request to both OTP servers and as long as one of them accepts the request the user will be granted access. It would be ideal if it would proxy to the old OTP server first and only if the request is rejected to forward the request to the second OPT server. Since the OTP server is configured to lock an account after 3 failures, we want the request to try the old OTP server first. This way once the user get's their new token it won't matter if their token gets locked on the old system. Once the transition is complete and all the users have their new tokens, we will shutdown the old OTP server. If this is at all possible, I would be grateful is someone could point me in the right direction on how to do this. We are currently running on FreeRadius 3.0.20 Thank You.

2 1

PEAP-MSCHAPv2 replace snakeoil certificates
by Olivier Mahieu 11 Jan '20

11 Jan '20

Hello, I'm configuring a FreeRadius Ubuntu server to replace Windows NPS server. The Domain Controller is CA as well. The server is part of the domain and MSCHAP is configured. The "$ radtest -t mschap testuser testpassword 127.0.0.1 0 testing123" works as well. Now, I want to replace the snakeoil certificate by a generated server certificate, signed by Windows CA. I generated freeradius.cer (Signed by Win CA), freeradius.key and placed them in dir's below. ALso the Win root CA, I added in /usr/local/share/ca-certificates. [cid:6be2c43b-7b4f-4a79-8e69-5af486a693d9] Following, when I change eap like below; even with absolute path instead of ${certdir}; I get freeradius failure. [cid:a314427e-f5f0-4a90-8005-83d5d8032453] Systemctl restart freeradius: failure. radtest -t fails as well... Can someone point me the right direction? Thanks!!! Olivier

3 4

Package Repos Empty for Centos 6
by Nicolas Breuer 10 Jan '20

10 Jan '20

Hello, http://packages.networkradius.com/releases/centos/6/ Can you check why the repo directory is empty ? Thanks

2 5

Multiple radius clients from one IP
by Xander Lammertink 10 Jan '20

10 Jan '20

Hi all, I was working on setting up FreeRADIUS, however I came across the following problem: I'd like to have the clients of my access point with multiple SSIDs to authenticate using radius. The way I tried to set this up was by creating multiple clients each having their own secret and refer to a virtual server. Based on the radius client, the preferred virtual server would be chosen that would select the desired authentication mechanism. However, when I create two clients with the same "ipaddr" (which is the case for my access point), I get the following error: freeradius[1234]: Failed to add duplicate client client_name When reading the link below I see it's possible to use my approach, except the ipaddr thing is making stuff difficult. https://networkradius.com/doc/3.0.10/raddb/sites-available/home.html So is there a way to have multiple clients authenticate from the same IP address (each referring to another virtual server) without listing on multiple tcp/udp ports? Thanks for your help! Current non-working high-level configuration: listen { ... } client one { ... ipaddr = 10.0.0.2 virtual_server = server_one } client two { ... ipaddr = 10.0.0.2 virtual_server = server_two } server server_one { authorize { ... } ... } server server_two { authorize { ... } ... }

3 4

Match on undefined attribute.
by Matthew Schumacher 10 Jan '20

10 Jan '20

List, I can't seem to write a simple condition to match on a missing attribute. I just want to do this: if( ! &reply:Filter-Id ) { update reply { Vendor-Address-List := foo } } However, that always returns true, even if Filter-Id isn't returned in the Access-Accept. If I try: if( &reply:Filter-Id == "" ) { update reply { Vendor-Address-List := foo } } Then when Filter-Id isn't set, I get: ERROR: Failed retrieving values required to evaluate condition And no match. What is the correct way to match on missing reply attributes? Thanks, schu

3 3