March 2020 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Memory leak in FR 3.0.19 ?
by Arnaud LAURIOU 30 Jun '20

30 Jun '20

Hi, We are suspecting memory leak in FR 3.0.19 : process memory status show VmData always keep increasing leading to VmSwap use after a few days which also keep increasing. I have 2 questions : - What are the compile options to use valgrind ? only flag --enable-developper ?|| - In the changelog for version 3.0.20 : some memories problems seems to be solved, do you know when this version will be released ? (if the release date is close, we can wait to test this release rather than 3.0.19) Regards, Arnaud Lauriou

3 5

Vulnerability in FreeRADIUS
by HANCHATE Ravikiran (u5574292) 04 May '20

04 May '20

Dears, we received Vulnerability in FreeRADIUS , Can you please assist here, 1/ How this will impact on our radius infra ? 2/ what steps need to be taken to Apply the Linux Fedora patches regarding the FreeRADIUS vulnerability ? Please provide step by step guides or implement instructions to Apply the Linux Fedora patches ? Please let me know if you need any information on this ? Regards, Ravi *********DISCLAIMER********* This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Orange Belgium does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. Unless clearly and unambiguously stated otherwise, the content of this e-mail and its attachment is provided to you for information purposes only, and nothing herein shall be binding upon, or shall constitute or be construed as a binding offer of Orange Belgium. *****END OF DISCLAIMER*****

4 5

How to integrate Freeradius with Oracle Database XE(18c)?
by Sajib Nandi 03 Apr '20

03 Apr '20

I have installed Freeradius and Oracle Database 18c XE. FreeRADIUS Version 3.0.20 -- it's working fine locally Oracle Database XE working fine. But I can not integrate Freeradius with Oracle Database. I need help regarding this How can I integrate Freeradius with oracle database. anyone can help? Thanks Nandi

5 9

openldap-ltb conflicts with package symas-openldap-servers
by Dave Macias 02 Apr '20

02 Apr '20

Hello, Saw the new 3.0.21 release email and wanted to try instead of the centos pkgs. Used this wiki https://networkradius.com/freeradius-packages/ but get a conflict: $ yum install freeradius Updating: ... ... ... Install ( 3 Dependent packages) Upgrade 1 Package (+2 Dependent packages) Total size: 11 M Is this ok [y/d/N]: y Downloading packages: warning: /var/cache/yum/x86_64/7/networkradius/packages/freeradius-config-3.0.21-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 41382202: NOKEY Retrieving key from file:///etc/pki/rpm-gpg/packages.networkradius.com.gpg Importing GPG key 0x41382202: Userid : "Network RADIUS Support (package signing) < packages(a)networkradius.com>" Fingerprint: 86e3 c308 3f30 8400 a898 5d2a be18 fc5a 4138 2202 From : /etc/pki/rpm-gpg/packages.networkradius.com.gpg Is this ok [y/N]: y Running transaction check Running transaction test Transaction check error: * file /usr/lib/systemd/system/slapd.service from install of openldap-ltb-2.4.49-1.el7.x86_64 conflicts with file from package symas-openldap-servers-2.4.49-1.el7.x86_64* Error Summary ------------- My current environment: 3.10.0-1062.18.1.el7.x86_64 CentOS Linux release 7.7.1908 (Core) Using centos repo pkg freeradius 3.0.13 How can i resolve? Please let me know if you need more information from me. Any input is much appreciated! Thank you, Dave

3 4

ipv6 address in users file
by Marcin Romanowski 30 Mar '20

30 Mar '20

Hello, I have problem with provide IPv6 from users file. I use files as redundant when sql will broke. in file: 2001:db8:2:8000:: Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000', Cisco-Avpair += 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT', Framed-IPv6-Prefix = '2001:db8:2:8000::/56', Idle-Timeout = 10800, Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' for ipv4 I have 192.168.1.12 Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000', Cisco-Avpair += 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT', Cisco-Avpair += 'subscriber:keepalive=interval 10', Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' and it works, but for ipv6 doesn't Debug says that radius can't find user :/ (0) Received Access-Request Id 94 from 10.249.1.202:1645 to 10.249.1.203:1912 length 152 (0) User-Name = "2001:DB8:2:8000::" (0) User-Password = "cisco" (0) Framed-IPv6-Prefix = 2001:db8:2:8000::/56 (0) Calling-Station-Id = "00:00:00:00:00:00" (0) NAS-Port-Type = PPPoEoE (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/0" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 10.249.1.202 (0) Acct-Session-Id = "00001200" (0) NAS-Identifier = "ASR_1" (0) Event-Timestamp = "Mar 30 2020 09:39:28 CEST" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/ikam-isg.server (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "2001:DB8:2:8000::", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) redundant { (0) ikam-isg: EXPAND %{User-Name} (0) ikam-isg: --> 2001:DB8:2:8000:: (0) ikam-isg: SQL-User-Name set to '2001:DB8:2:8000::' rlm_sql (ikam-isg): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (ikam-isg): Opening additional connection (0), 1 of 64 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname=bcman host=localhost user=bcman password=bcman rlm_sql_postgresql: Connection failed: could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (ikam-isg): Opening connection failed (0) *(0) [ikam-isg] = fail(0) [files] = noop* (0) } # redundant = noop (0) [expiration] = noop (0) [logintime] = noop *(0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type(0) pap: WARNING: Authentication will fail unless a "known good" password is available* (0) [pap] = noop (0) } # authorize = ok *(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject(0) Failed to authenticate the user* (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/ikam-isg.server (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 2001:DB8:2:8000:: (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 94 from 10.249.1.203:1912 to 10.249.1.202:1645 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 94 with timestamp +6 FreeRADIUS Version 3.0.16 Where I'm doing mistake? Best regards Marcin

3 4

Logs ip
by Клеусов Владимир Сергеевич 27 Mar '20

27 Mar '20

Hi I have two servers. One of the logs shows the ip address, but the other does not. How to set up logs in the form Auth: (140) Login OK: [ip_10.65.150.1/j0cgtr19MCVH] ?

3 3

Version 3.0.21 has been released
by Matthew Newton 24 Mar '20

24 Mar '20

As promised a couple of weeks or so ago, version 3.0.21 has now been released. Full release notes are available on the web site: https://freeradius.org/release_notes/?br=3.0.x&re=3.0.21 This is mainly a bugfix release, however there have been some new features. Specifically this release has quite a number of database related improvements, with thanks to Terry Burton. Apart from that most other updates were bug fixes, build improvements or dictionaries. Download from the usual places: https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_21 Packages are building and will be available on the Network RADIUS web site shortly: https://packages.networkradius.com/ Docker images will also be available on Dockerhub soon: https://hub.docker.com/u/freeradius -- Matthew

1 0

pam_radius_auth with Framed-IP-Address
by António Silva 24 Mar '20

24 Mar '20

Hi, How to get the "Framed-IP-Address" attribute from the Access-Accept replay from the radius server? Is it possible? Thanks. note: not sure if this is the right mailing to ask this question, sorry if is not.. -- Saludos / Regards / Cumprimentos António Silva

2 6

Special character not showing in RADPOSTAUTH
by JAHANZAIB SYED 24 Mar '20

24 Mar '20

WE have enable radpostauth to record unsuccessful dialing attempt. Passwords with special characters are not showing properly in radpostauth table. Example username: zaib password: myp@$$^&*w0rd In radpostauth I see this zaib myp@=3D24=3D24=3D5E=3D26=3D2Aw0rd Access-Reject RADPOSTAUTH config is below: query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, reply_msg, authdate, nasipaddress, mac) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%{reply:Reply-Message}', \ '%S', \ '%{NAS-IP-Address}', \ '%{Calling-Station-Id}')" } Regards, J. <http:///>

2 1