December 2021 - Freeradius-Users - lists.freeradius.org

Multiple Vlan assigment in Free radius server with Cisco Nexus Switch.
by deepak rawat 16 Dec '21

16 Dec '21

Hi, Our Cisco switch -3548X on version 9.3.2 is having a dot1x port based feature is enabled and connected to a free radius server for authentication. We are trying to give the multiple Vlan in the Free radius server user file so that Cisco can allow our two Vlan 1968 and Vlan1969. We are trying the below configuration in user file of freeradius server where we are giving the two Vlan but the cisco Auth vlan is coming as default. > > > Free radius user file config for Cisco switch > > E23D213926.XXX.com Cleartext-Password := "54321" > Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, > Tunnel-Private-Group-ID = "1968,1969" > > > Cisco Dot1x output > > Dot1x Info for Ethernet1/11 > ----------------------------------- > PAE = AUTHENTICATOR > PortControl = AUTO > HostMode = MULTI HOST > ReAuthentication = Enabled > QuietPeriod = 60 > ServerTimeout = 30 > SuppTimeout = 30 > ReAuthPeriod = 3600 (Locally configured) > ReAuthMax = 2 > MaxReq = 2 > TxPeriod = 30 > RateLimitPeriod = 0 > InactivityPeriod = 0 > Mac-Auth-Bypass = Disabled > > Dot1x Authenticator Client List > ------------------------------- > Supplicant = 58:45:4C:E7:B3:42 > Domain = DATA > Auth SM State = AUTHENTICATED > Auth BEND SM State = IDLE > Port Status = AUTHORIZED > Authentication Method = EAP > Authenticated By = Remote Server > ReAuthPeriod = 3600 > ReAuthAction = Reauthenticate > TimeToNextReauth = 2639 > Auth-Vlan = 1 > > > If we give only one Vlan1968 then our setup is working but our node which need a authentication from cisco/free radius has a two vlan 1968 and 1969 , So we are not able to reach the default GW of 1969 vlan if we put only one vlan assignment in Radius server. > > So can anyone know how to set the two vlan in free radius server and in which pattern in user file as it is quite complicated. > > Regadrs, > > Deepak Rawat > > >

5 15

Freeradius not sending traffic-shaping attributes randomly (Works when in debug mode)
by Antônio Modesto 16 Dec '21

16 Dec '21

Hello everyone, I am facing a strange problem with one radius server (FreeBSD 12.2 + FreeRADIUS 2.0.21). In a random way, Freeradius is not sending some traffic-shaping attributes in the Access-Accept to the NAS (I confirmed it with wireshark). What is puzzling me is that when I run radiusd in debug mode (-X), the problem disappears. I tried using raddebug but it uses a lot of CPU power, so it is not viable to run it in production. What do you guys suggest? -- Att, *Antônio Modesto*

3 7

Thanks with Questions
by mohamed almeshal 16 Dec '21

16 Dec '21

thanks alan this simple word for represent my appreciation . but I'm still struggle with one simple but not work for me I try to custom replay the message when user password is wrong and when I set auth-type reject for user I read all the documents but still no luck if (notfound) { update reply { Reply-Message := "%{sql: select messge_txt from replay_message where reply_id = 1 }" } reject } this work for me fine if the user is not found in the db , but for password error and auth-reject not working even it's so simple I miss the key for that , I'm using password-with-header please save me as always

2 1

About my questions
by mohamed almeshal 15 Dec '21

15 Dec '21

Dear Savers ... I'm using php just to call some accessory type functions that work with php not for authentication , I think that will not affect any thing and also I found this in docs sorry for interput. now my last dummy question is : I'm using password-with-header : so if the password is wrong what module is rejected so I can implement custom replay message I'm using pap and I try to some couples integers with no luck it's keeps on invalid username and password . also if I set auth-type = reject what is the module that reject to handle also custom replay message thanks for you all , but I'm realy realy thankful for your kind and your this lovely softwate

2 1

Configuring PAP authentication
by Network RADIUS 15 Dec '21

15 Dec '21

** Configuring PAP authentication ------------------------------------------ The first step to getting any authentication working in FreeRADIUS is to configure PAP (Password Authentication Protocol), or clear-text passwords. Even though most deployments will end up using additional authentication protocols, PAP is the simplest and easiest to configure, which makes it the perfect place to start. And as we will see, once PAP is configured, many other authentication protocols become simple, too. Read the full article... https://networkradius.com/articles/2021/09/29/configuring-PAP.html <https://networkradius.com/articles/2021/08/23/protocols-and-password-compat…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/contact/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Questions
by mohamed almeshal 15 Dec '21

15 Dec '21

Dear Savers .... First Thank you Alan .. first : I'm new at building exec script by php ... I do read some docs about exec and I found that to build my script for update some values and telegram messages I have to build modules . but the doc's always refer to raddb/modules but I have freeradius 3.0.25 and it's on etc I think the alternative is mod-enabled is that ok also in php script what is the variable should I use to represent of the %{User-Name} . Second : is the use of exec script not for auth just for some additional function will affect the speed of auth in present of unlag statments in defult config third : I use radsec for auth , what is the best way to determine the active online NAS that connected to freeradius box fourth : I read tons of doc about MAC Auth but I need the script to check that against last mac in radacct what is the best way to do that sorry for the long questions . mohammed

3 2

Sorry For missunderstand
by mohamed almeshal 14 Dec '21

14 Dec '21

dear Savers ... I think I miss the parameters (module mean for me the section like Authorize Authintcate ... etc ) what I'm asking about is I need to build custom unlag like the condition in expiration module like this : expiration { userlock = 1 } if (userlock) { update reply { Reply-Message += "Account expired" } userlock } expire_on_login sql_session_timeout sql_octets_limit What I'm need is to put custom if condition in each module that reject the user for hotspot message and I wonder if I can use the userlock in every module like the expiration . //// Also about the loop what I'm going to do is just use exec to and get it work fine with php, but please what is the best way to write exec statments .

2 1

ippool 0.0.0.0 assignment problem
by Mirko Alberio 14 Dec '21

14 Dec '21

Hi! Hope this can be useful for someone. I found the base problem of my radius ippool assignment problem! Maybe for future reference for other users, the problem was: WHITESPACE in an ip pool address row! So in some way the NAS where assuming 0.0.0.0 as framed ip address for this. This is the radiusd -X output that helped me: (1675) sqlippool: Executing query: COMMIT (1675) sqlippool: EXPAND START TRANSACTION (1675) sqlippool: --> START TRANSACTION (1675) sqlippool: Executing query: START TRANSACTION (1675) sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE SKIP LOCKED (1675) sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'pool1' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'xxxxxxxxx'), (callingstationid <> 'XX:XX:XX:75:36:B6'), expiry_time LIMIT 1 FOR UPDATE SKIP LOCKED (1675) sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'pool1' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'xxxxxxxxx'), (callingstationid <> 'XX:XX:XX:75:36:B6'), expiry_time LIMIT 1 FOR UPDATE SKIP LOCKED (1675) sqlippool: EXPAND COMMIT (1675) sqlippool: --> COMMIT (1675) sqlippool: Executing query: COMMIT *(1675) sqlippool: Invalid IP number **[12.34.56.7__] **returned from instbase query.* rlm_sql (sql): Released connection (11) (1675) sqlippool: EXPAND IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1675) sqlippool: --> IP Allocation FAILED from pool1 (did vlan102 cli XX:XX:XX:75:36:B6 port 15731656 user xxxxxxxxx) (1675) [sqlippool] = noop Mirko Alberio Amministratore di Sistemi Via Enrico Fermi, 235 - 36100 Vicenza - Italia Tel 0444 291302 - Fax 0444 566310 - www.telemar.it <http://www.telemar.it> Reg. Imp. Di Vicenza /C.F./P.I. 02508710247 Cap. Soc. € 120.000,00 I.V. R.E.A. VI-236292 <https://it-it.facebook.com/TelemarIt/> <https://www.instagram.com/telemar_it/> <https://it.linkedin.com/company/telemar-s-p-a-> Il presente messaggio non costituisce offerta e/o accettazione contrattuale. Ai sensi del Regolamento europeo per la protezione dei dati personali n. 679/2016 (GDPR) si precisa che le informazioni contenute in questo messaggio e/o nel/i file/s allegato/i sono riservate ed a uso esclusivo del destinatario. Qualora il messaggio in parola Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo e a non inoltrarlo a terzi, dandocene gentilmente comunicazione. Grazie. Pursuant to General Data Protection Regulation (GDPR), you are hereby informed that this message contains confidential information intended only for the use of the addressee. If you are not the addressee, and have received this message by mistake, please delete it and immediately notify us. You may not copy or disseminate this message to anyone. Thank you.

2 2

Users Files Match
by Nicolas Breuer 13 Dec '21

13 Dec '21

Hello, Can you check if this expected in FreeRadius 3.0.21. DEFAULT Suffix == "@REALM", NAS-IP-Address == 1.1.1.1 MS-Primary-DNS-Server = 8.8.8.8, Pool-Suffix = "BC", Fall-Through = Yes DEFAULT Suffix == "@REALM" Client-DNS-Pri = 9.9.9.9, Pool-Suffix = "BC", Fall-Through = Yes When the request is coming from NAS 1.1.1.1, this is fine and FR is sending DNS 8.8.8.8 Line 10 is a default one Line 56 is the Yellow Line 80 is an other default. (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 56 (0) auth_dsl: users: Matched entry DEFAULT at line 80 When the request is coming from an other NAS, it's expected to match the second one (line 61) but that doesn't happened. (0) [suffix] = noop (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 Is it expected?

3 14

Some Questions
by mohamed almeshal 11 Dec '21

11 Dec '21

Dear Savers ... I'm building Freeradius Web interface For Hotspot Management , I'm Stuck now with these issues . * if I want to build condition with moduls such as sql_octets_limit or pap can I use userlock statment more than one time in the file so I can set unlag condition for every module. * I need to set foreach loop to change user speed every time it's auth so I need to build forach loop , what is the best way to write COA statment for config file . * I need to send notification via telegram so I have to fire it up in post-auth by php script how I can achieve this goal . * last question is about idel timeout if it the best way to send the value from radius rather set in the router to control the stale session your's Mohammed

2 1