August 2023 - Freeradius-Users - lists.freeradius.org

Freeradius+AD - Login with EmployeeID
by Rodrigo Abrantes Antunes 07 Aug '23

07 Aug '23

Hello, I have a freeradius server authenticating users with active directory, the users login with the samaccountname. This is the ldap filter: (sAMAccountName=%{mschap_default:User-Name:-%{User-Name}}) Now I need to enable the users to login with the employeeID. This is the ldap filter I tried: (employeeID=%{mschap_default:User-Name:-%{User-Name}})" The filter works in ldapsearch but not in freeradius. # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group authorize { Mon Aug 7 10:23:44 2023 : Debug: [ad_all] performing user authorization for 1638828 Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: (employeeID=%{mschap_default:User-Name:-%{User-Name}}) -> (employeeID=1638828) Mon Aug 7 10:23:44 2023 : Debug: [ad_all] expand: DC=xx,DC=xx,DC=xx,DC=xx -> DC=xx,DC=xx,DC=xx,DC=xx Mon Aug 7 10:23:44 2023 : Debug: ++[ad_all] = fail Mon Aug 7 10:23:44 2023 : Debug: +} # group authorize = fail Mon Aug 7 10:23:44 2023 : Debug: Using Post-Auth-Type REJECT Mon Aug 7 10:23:44 2023 : Debug: # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 7 10:23:44 2023 : Debug: +group REJECT { Mon Aug 7 10:23:44 2023 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 1638828 Mon Aug 7 10:23:44 2023 : Debug: ++[attr_filter.access_reject] = updated Mon Aug 7 10:23:44 2023 : Debug: +} # group REJECT = updated Why freeradius can't filter with the employeeID attribute? Thanks.

2 5

Linelog and get rid of No Failure Reason
by TS 03 Aug '23

03 Aug '23

Hello, I am trying to consolidate logs and have only one log file with all needed data in it. This setup with Freeradius 3.2.3 with OpenLDAP 2.5.15. We are using EAP + MSCHAPv2, LDAP contains an attribute with NT Password. I am trying to get rid of "No Failure Reason" value of "reply:Reply-Message" variable in cases where: 1. user not found in LDAP 2. user's password is incorrect 3. user has Phase1 (EAP/TLS/...) or Phase2 (MSCHAPv2/GTC/...) misconfigured. I have pretty default configuration with small changes. I know I should modify Reply-Message but in which file and within which section(s)? Snippet from my custom linelog: reference = "inner_auth_log.%{%{reply:Packet-Type}:-format}" inner_auth_log { Access-Accept = "%d.%m.%Y@%H:%G|RESULT=OK |USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}" Access-Reject = "%d.%m.%Y@%H:%G|RESULT=ERR|USER=%{User-Name}|WIFI_AP_IP=%{NAS-IP-Address}|CLIENT_MAC_ADDR=%{%{Calling-Station-Id}:-Unknown Caller Id}|MSG=%{%{reply:Reply-Message}:-No Failure Reason}" }

2 1

Samba radius authentication
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi, Is it possible to login in into samba share by using freeradius and get propper group assignment? I try switch as much authorize mechanizm as I could to freeradius. Tried to find native mechanizm in samba documentation but no info there :( -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 5

status-server
by Anatoliy 02 Aug '23

02 Aug '23

Hi team , when I am try to query status server for specific client I receive global stats and stats for specific client Is this expected behavior for FR , or it should return only stats for client ? For example # echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 3" | radclient -x localhost:18121 status adminsecret Sent Status-Server Id 112 from 0.0.0.0:d5a0 to 127.0.0.1:18121 length 62 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = 35 FreeRADIUS-Stats-Client-Number = 3 Received Access-Accept Id 112 from 127.0.0.1:46c9 to 127.0.0.1:54688 length 476 FreeRADIUS-Total-Access-Requests = 430666 <<<<<<<<<< global stats for FR FreeRADIUS-Total-Access-Accepts = 679 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 679 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 1518800 FreeRADIUS-Total-Accounting-Responses = 1518800 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Stats-Client-Number = 3 FreeRADIUS-Stats-Client-IP-Address = 100.64.0.2 <<<<<<<< after this line , stats for this client. FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 2404 FreeRADIUS-Total-Accounting-Responses = 2404 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0

2 2

Freeradius 2FA
by Jarosław Kłopotek 02 Aug '23

02 Aug '23

Hi guys, go a question - Is it possible to use freeradius with some 2FA somehow? Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app, - then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in, -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

3 7