April 2020 - Freeradius-Users - lists.freeradius.org

Home server secret mismatch
by Miloslav Hůla 06 Apr '20

06 Apr '20

Hello, I'm trying to setup proxy for one realm. I hope everything is configured well because I can see outgoing packets. I'm using current Debian 10.3 with FreeRADIUS 3.0.17+dfsg-1.1. My FreeRADIUS server is 147.32.s.s. RADIUS home server is 147.32.h.h (different oraganisation, I can't see the home server log). When I try to reach home server by radtest from my server, I get accept: # radtest milo(a)org.tld passwd123 147.32.h.h 0 homesecret Sent Access-Request Id 82 from 0.0.0.0:45346 to 147.32.h.h:1812 length 86 User-Name = "milo(a)org.tld" User-Password = "passwd123" NAS-IP-Address = 147.32.s.s NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "passwd123" Received Access-Accept Id 82 from 147.32.h.h:1812 to 147.32.s.s:45346 length 80 Chargeable-User-Identity = 0x......... User-Name = "milo(a)org.tld" When I capture these packets by tcpdump and opens them by wireshark and when I set "homesecret" in RADIUS protocol setting, I can see well decrypted password. But when I try radtest via my server, home server does not respond. # radtest milo(a)org.tld passwd123 localhost 0 homesecret Sent Access-Request Id 151 from 0.0.0.0:41144 to 127.0.0.1:1812 length 86 User-Name = "milo(a)org.tld" User-Password = "passwd123" NAS-IP-Address = 147.32.s.s NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "passwd123" Received Access-Reject Id 151 from 127.0.0.1:1812 to 127.0.0.1:41144 length 20 (0) -: Expected Access-Accept got Access-Reject When I capture this packet and open it by wireshark, I can see all AVPs, correct User-Name, correct NAS-IP-Address, plus Proxy-State and so on but User-Password is not well decrypted (contains many control characters). I think it is a reason that home server does not respond at all. The freeradius -X output contains: ERROR: Failing proxied request for user "milo(a)org.tld", due to lack of any response from home server 147.32.h.h port 1812 I'm using default configuration, only I added: - secret in clients.conf to "homesecret" - in proxy.conf home_server radius1.org { type = auth ipaddr = 147.32.h.h port = 1812 #proto = udp secret = homesecret response_window = 5 # default 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool org { type = load-balance home_server = radius1.org } realm org.tld { auth_pool = org nostrip } Thank you for any hint. Milo

2 3

How to integrate Freeradius with Oracle Database XE(18c)?
by Sajib Nandi 03 Apr '20

03 Apr '20

I have installed Freeradius and Oracle Database 18c XE. FreeRADIUS Version 3.0.20 -- it's working fine locally Oracle Database XE working fine. But I can not integrate Freeradius with Oracle Database. I need help regarding this How can I integrate Freeradius with oracle database. anyone can help? Thanks Nandi

5 9

Freeradius 3.0 and realms
by Anthony Stuckey 02 Apr '20

02 Apr '20

Is there good documentation of the changes made to realms between freeradius 2 and freeradius 3? We're trying to get windows machine login to work, and we're having the same problem as before. Once the machine is joined to the domain, Windows appends the domain to the machine name. We need to strip the domain off to find the proper identity. In freeredius 2, I was able to define a realm which did that, but that format no longer works for freeradius 3, and there seems to be no useful breadcrumb for how to create the new style realm.

2 1

openldap-ltb conflicts with package symas-openldap-servers
by Dave Macias 02 Apr '20

02 Apr '20

Hello, Saw the new 3.0.21 release email and wanted to try instead of the centos pkgs. Used this wiki https://networkradius.com/freeradius-packages/ but get a conflict: $ yum install freeradius Updating: ... ... ... Install ( 3 Dependent packages) Upgrade 1 Package (+2 Dependent packages) Total size: 11 M Is this ok [y/d/N]: y Downloading packages: warning: /var/cache/yum/x86_64/7/networkradius/packages/freeradius-config-3.0.21-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 41382202: NOKEY Retrieving key from file:///etc/pki/rpm-gpg/packages.networkradius.com.gpg Importing GPG key 0x41382202: Userid : "Network RADIUS Support (package signing) < packages(a)networkradius.com>" Fingerprint: 86e3 c308 3f30 8400 a898 5d2a be18 fc5a 4138 2202 From : /etc/pki/rpm-gpg/packages.networkradius.com.gpg Is this ok [y/N]: y Running transaction check Running transaction test Transaction check error: * file /usr/lib/systemd/system/slapd.service from install of openldap-ltb-2.4.49-1.el7.x86_64 conflicts with file from package symas-openldap-servers-2.4.49-1.el7.x86_64* Error Summary ------------- My current environment: 3.10.0-1062.18.1.el7.x86_64 CentOS Linux release 7.7.1908 (Core) Using centos repo pkg freeradius 3.0.13 How can i resolve? Please let me know if you need more information from me. Any input is much appreciated! Thank you, Dave

3 4

Debian 10 fresh install warnings
by Marcin Romanowski 02 Apr '20

02 Apr '20

Hello Fresh instal includes warnings: freeradius -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors ... reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". [...] Shoud I worry about it?

3 3