April 2022 - Freeradius-Users - lists.freeradius.org

Comparing attributes containing MAC addresses
by paul.moser＠bt.com 20 Apr '22

20 Apr '22

Is there a simple built in way to compare attributes that are MAC addresses for equivalence? I need to be able to compare 2 attributes in a packet to see if they are the same, unfortunately the network kit vendor does not format MAC addresses consistently across all attributes (eg User-Name = aa.bb.cc.dd.ee.ff whilst Calling-Station-Id = aabb:ccdd:eeff) so a simple string comparison does not work. Thanks, Paul

2 1

nas reboot
by mohamed almeshal 18 Apr '22

18 Apr '22

dear's I found This in Log Sat Apr 16 19:02:33 2022 : Info: Signalled to terminate Sat Apr 16 19:02:33 2022 : Info: Exiting normally Sat Apr 16 19:02:33 2022 : Error: detail (/var/log/freeradius/radacct/decoupled-accounting/detail-*:*): Reader thread exited without informing the master: Bad file descriptor Sat Apr 16 19:02:33 2022 : Info: Debug state unknown (cap_sys_ptrace capability not set) Sat Apr 16 19:02:33 2022 : Info: systemd watchdog interval is 30.00 secs Sat Apr 16 19:02:33 2022 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sat Apr 16 19:02:33 2022 : Info: rlm_sql_mysql: libmysql version: 5.7.37 Sat Apr 16 19:02:33 2022 : Info: rlm_sql (sql): Attempting to connect to database "radius" Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server <default> Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server dynamic_clients Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server decoupled_accounting Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server default Sat Apr 16 19:02:33 2022 : Info: Ready to process requests is that affect accounting or what is that indicate for ?

2 1

decoupling-Accounting
by mohamed almeshal 18 Apr '22

18 Apr '22

dear's I found This in Log Sat Apr 16 19:02:33 2022 : Info: Signalled to terminate Sat Apr 16 19:02:33 2022 : Info: Exiting normally Sat Apr 16 19:02:33 2022 : Error: detail (/var/log/freeradius/radacct/decoupled-accounting/detail-*:*): Reader thread exited without informing the master: Bad file descriptor Sat Apr 16 19:02:33 2022 : Info: Debug state unknown (cap_sys_ptrace capability not set) Sat Apr 16 19:02:33 2022 : Info: systemd watchdog interval is 30.00 secs Sat Apr 16 19:02:33 2022 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sat Apr 16 19:02:33 2022 : Info: rlm_sql_mysql: libmysql version: 5.7.37 Sat Apr 16 19:02:33 2022 : Info: rlm_sql (sql): Attempting to connect to database "radius" Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server <default> Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server dynamic_clients Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server decoupled_accounting Sat Apr 16 19:02:33 2022 : Info: Loaded virtual server default Sat Apr 16 19:02:33 2022 : Info: Ready to process requests is that affect accounting or what is that indicate for ?

2 1

EAP-GPSK Authentication Settings
by 尾滝朋彦 18 Apr '22

18 Apr '22

Hello, I'm trying EAP-GPSK authentication using FreeRADIUS version 3.0.13. The following page says that FreeRADIUS version 2.0 or later supports EAP-GPSK, but I don't know how to set up "eap.conf". https://wiki.freeradius.org/features/EAP Stable EAP Methods * EAP-GPSK Does anyone know how to set up EAP-GPSK? Best Regards, 免責事項:本メッセージに記載および添付されている情報は、秘密、法律上の秘匿特権、または別途開示の保護対象となっている場合があり、本来の受信者による使用のみを意図しています。本電子メールを受取られた方が、本来の受信者ではない場合には、お手元のメッセージのコピーすべてを削除・破棄し、本電子メールが誤って届いた旨を発信者宛てにご通知下さいますようお願いします。 Disclaimer:This E-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify us immediately. If you are not the intended recipient you are notified that disclosing and copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 2

Cast type user-name
by Bassem Mettichi 18 Apr '22

18 Apr '22

Hello , Please could any one provide the unlang syntax to check if the request:user-name is of type ipv4addr or ipv6addr Thanks Bassem

4 8

NasReboot
by mohamed almeshal 17 Apr '22

17 Apr '22

Dear Savers I got a strange problem , I use freeradius 3.0.25 with radsec the nas's are mikrotik CCR now suddenly I got NAS-reboot in all the session that been opened and suddenly all sessions are closed I searched in all things all things is fine but the active session is been closed . how I figure where is the problem up there thanks

3 2

rlm_ldap - inherit user { access_attribute } from profile entry
by Peter Payne 16 Apr '22

16 Apr '22

In the rlm_ldap module configuration file "ldap" there is a configuration parameter in the "user { }" section named "access_attribute". I have that set to "dialupAccess". I also have the configuration parameter in the "profile { }" section named "attribute" set to "radiusProfileDn". My users, in LDAP, all have "radiusProfileDn" set to point to a profile, e.g.: radiusProfileDn: cn=adsl,ou=radius profiles,o=myorg And I'd like to put the "dialupAccess" attribute in the profile rather than the user entry, e.g.: dialupAccess: 1 As far as I can tell there's no attribute value inheritance in LDAP? Short of modifying the source code of rlm_ldap.c and/or the function rlm_ldap_check_access() to explicitly search the profile LDAP entry for the access attribute are there any other strategies I might consider in order to move the access attribute out of the individual user LDAP entries? Kind regards, Peter Payne Melbourne, Australia

2 1

Using user groups to simply my config
by Jason Womack 15 Apr '22

15 Apr '22

Hello, How I can go about assigning a group value to each user definition and then post-auth (I think from reading) use that group name to define the specific attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id. I simply want to do this to avoid having to repeat all these tunnel values for each device. I am running freeradius v3.0.25 on freebsd. Pseudo Example authorize file AABBCCDDEEFFGG Group := "iot", Cleartext-Password := "AABBCCDDEEFFGG" site-enabled/default (I think it might go here) if (group == "iot) { #update reply, set Tunnel-* values } Any guidance someone could provide would be great. All the examples I have found seem to be using the mysql backend and I don't have a need for the additional complexity but will go down that route if its required.

2 3

Faild binding to auth address error
by Matthew Budrey 14 Apr '22

14 Apr '22

Hello, Got a newly built Freeradius server running on Ubuntu server that is showing the following error; radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } Failed binding to auth address * port 1812 bound to server default: Address already in use /etc/freeradius/3.0/sites-enabled/default[59]: Error binding to port for 0.0.0.0 port 1812 By stopping the service, the error goes away, but as soon as the service is restarted the error is back, see below output of the running instances. administrator@zotacradius:~$ sudo ps ax | grep radius 2366 ? Ssl 0:00 /usr/sbin/freeradius -f 2986 pts/1 S+ 0:00 grep --color=auto radius administrator@zotacradius:~$ sudo systemctl stop freeradius administrator@zotacradius:~$ sudo ps ax | grep radius 3022 pts/1 S+ 0:00 grep --color=auto radius After spending a lot of time looking for ways to resolve this issue today, they all talk about processes already using the ports, assuming I'm reading this correctly, then that's not what I'm seeing as there is only the active instance and the grep process. Has anyone got any suggestions on how to resolve this at all? Regards Matt

2 1

Problem Radius over VPN
by Luca Bertoncello 14 Apr '22

14 Apr '22

Hi list! I already reported in March my problems using Freeradius over VPN. I spent many time searching the problem, and maybe I found something, but I have no idea how to correct the problem... So, short explanation: Main office with Freeradius, connected via OpenVPN to our central VPN-Server. Second office with the AccessPoints, connected via OpenVPN to our central VPN. "Normal" pakets from second office to main office (and viceversa) go through both VPNs. Now, I sniffed the pakets on all servers (VPN server on second office, central VPN server, VPN server on main office and Freeradius), and I discovered that some pakets are blocked. Wireshark on VPN server of the second office: 12 2022-03-25 14:39:48,154608 10.0.21.10 10.6.21.10 RADIUS 979 Access-Challenge id=86 13 2022-03-25 14:39:48,476555 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=41c1) 14 2022-03-25 14:39:48,507473 10.0.21.10 10.6.21.10 RADIUS 92 Access-Challenge id=87 15 2022-03-25 14:39:48,533183 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=41c2) 16 2022-03-25 14:39:51,533406 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=42d9) Wireshark on central VPN: 12 2022-03-25 14:39:48,129787 10.0.21.10 10.6.21.10 RADIUS 979 Access-Challenge id=86 13 2022-03-25 14:39:48,488993 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=41c1) 14 2022-03-25 14:39:48,501213 10.0.21.10 10.6.21.10 RADIUS 92 Access-Challenge id=87 No other pakets after paket 14 (ID 87) reach the central VPN serve, so the problem "must be" either on the central VPN server or on the VPN server oft he second office... Now the very question: do someone have an idea why just the first fragmented paket run over all VPNs and the other one do not? Thanks a lot Luca

4 12