- Freeradius-Users - lists.freeradius.org

FreeRadius server 3.0.21 user name case insensitivity
by Luveh Keraph 18 May '22

18 May '22

Out of the box, when fed a user name and password for authentication, the FreeRadius server 3.0.21 processes the user name in a case-sensitive way. I would like to configure my server so that it processes user names case-insensitively. So far what I have done is to add the following line to my /etc/raddb/mods-enabled/files file, within the file { } block: key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" This converts the user names received to all-lowercase. With this, things work as expected as long as I make sure to define my RADIUS users in my server's users file with all lowercase characters. Is it, however, possible to configure the FreeRadius server so that it compares input user names against those in the server's default users database in a case-insensitive way, so that names in this database - just a plaintext file, really - can be entered in mixed case?

3 2

rlm_ldap no longer support of krb5 cache config in FreeRaDIUS 3
by Peter Lee 17 May '22

17 May '22

In FreeRADIUS 2, the rlm_ldap module has assapi_krb5 included to allow users to enable/init krb5 with ccache from ldap configuration. However this feature has been removed from rlm_ldap in 3.0.x. What is the alternative way from FreeRADIUS 3 to enable/init multiple kerberos caches? Thank you.

2 1

log message when logintime returns userlock?
by Josef Vybíhal 17 May '22

17 May '22

HI list, I just set up the 'logintime' module. It works great - no problem there. I wanted to add one last thing - log when the user tries to login outside of allowed timeframe. It seemed easy to do: If the 'logintime' module returns 'userlock', I will just call the linelog module. post-auth { ... logintime if (userlock) { log_locked_by_logintime } ... } But this does not do what I expected. After logintime returns 'userlock', nothing else following in post-auth section is called. Snippet from debug: (9) } # policy assign_vlan = noop (9) logintime: Checking Login-Time (9) [logintime] = userlock (9) } # if (1) = userlock (9) } # post-auth = userlock (9) Using Post-Auth-Type Reject Technically it's inside of the if (1) {} condition, I have tried to move it outside of it, but the behavior was the same. Is this expected? Is there some trick how I can call the linelog in case of userlock? Due to the length of it, I have put full debug log here: https://up.jvi.cz/log_logintime.log Josef

2 2

Reporting on active users using radwho
by Djerk Geurts 16 May '22

16 May '22

Over the last week, I’ve spent some time getting radsniff telemetry into Grafana via Collectd and Telegraf. Sadly radsniff direct to Telegraf doesn’t work, but that’s another story. Wanting to graph online users I then scripted a rough little bit of bash to take the output of `radwho -r -n` and output the number of active users in influx format to Telegraf. However I’ve noticed that at midnight the reported online users drop to 0 to then slowly ramp up again. This may well be normal behaviour for what I should expect from rad who output, but it’s not what I’d like to see in my graph, it’s worrying to see the number of active xDSL subscribers drop to 0. I’d rather avoid having to state such a caveat. Is there a better way to track active users using the data available from FreeRADIUS server, its tools or directly from the (MySQL) database? — Thanks, Djerk Geurts

3 5

Case insensitive username
by Simon Dankau 13 May '22

13 May '22

Hello, we use FreeRadius at a school with about 3000 users and divide them into different groups. Since support requests often come from teachers who cannot enter their login data with correct capitalization, we want to use FreeRadius "case insensitive". At school we basically have 3 different groups. username student : 1234567 (a student's unique ID) username teacher: ABCD username employee: t.surname Some of our teachers try to login with "Abcd" or "abcd". That does not work, because FreeRadius is case sensitive. So far I've been browsing the forums and trying a few possible solutions. This includes the solutions from the following thread: https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09751… 1. Changes in the server configuration authorize { update request { Stripped-User-Name := "%{tolower:%{User-Name}}" } ... everything else ... } 2. Changes in the "files" module key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}" I can only test the login over the command line on our testserver, because i do not want to disrupt our currently working FreeRadius server including the wifi. All tests performed follow the scheme below. root@bkr-app:~# radtest TEST password 10.11.100.31:1812 10 test123 Sent Access-Request Id 245 from 0.0.0.0:33130 to 10.11.100.31:1812 length 74 User-Name = "TEST" User-Password = "start12K" NAS-IP-Address = 10.11.100.31 NAS-Port = 10 Message-Authenticator = 0x00 Cleartext-Password = "start12K" Received Access-Accept Id 245 from 10.11.100.31:1812 to 0.0.0.0:0 length 55 Reply-Message = "DEBUG: Lehrer VPN" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "37" root@bkr-app:~# radtest test start12K 10.11.100.31:1812 10 test123 Sent Access-Request Id 73 from 0.0.0.0:45170 to 10.11.100.31:1812 length 74 User-Name = "test" User-Password = "start12K" NAS-IP-Address = 10.11.100.31 NAS-Port = 10 Message-Authenticator = 0x00 Cleartext-Password = "start12K" Received Access-Reject Id 73 from 10.11.100.31:1812 to 0.0.0.0:0 length 46 Reply-Message = "DEBUG: Not found, reject" (0) -: Expected Access-Accept got Access-Reject root@bkr-app:~# Is there a way to use FreeRadius case insensitive so that we can reduce the support requests? Greetings from Germany, Simon

2 5

Unix domain socket support for authentication and accounting?
by William Tang 13 May '22

13 May '22

Hi, I'm wondering if freeradius has/will support for unix domain sockets for authentication and accounting? William

6 10

802.1x/iPSK DB access delegation.
by Alex Zetaeffesse 12 May '22

12 May '22

Dear folks, I hope you are enjoying the Christmas season and my best wishes for the 2022, Sorry if this question is not strictly related to FreeRadius but rather on the tools it interacts with for a better management of the WiFi accesses. I'm looking for suggestions/ideas that can point me in the right direction I have used Freeradius with its 2.0 version for my home project few years back, Now I'm in charge of providing wireless access in an environment with a few small companies. To better organize the air-media and avoid media competition or conflicts we would like to have just one/two SSIDs and then grant access to companies' employees or devices. So far so good, because for devices that can use 802.1x we can proxy Access-requests to the RADIUS server of each company. Problems come with non smart devices that still use PSK; I know iPSK helps a lot but I don't know how to delegate the management of MAC addresses. I'm not taking into account a text file to manage them; can we use a DB for iPSK too? And related to the DB is there a way to manage iPSK devices in this way? Just one table and a value specific to each company and small web interface that will handle only fields specific to each company? Would you have any other ideas to share with the community? Thanks, Alex

2 5

Typo in current "TLS - Config - common" doc ?
by Olivier 11 May '22

11 May '22

Hello, 1. In [1], the section that relates to private_key_password has a description that seems incorrect to me. It includes this text "If Private key & Certificate are located in the same file, then private_key_file & certificate_file must contain the same file name." 2. How should you set this private_key_password parameter ? Does it need to match a value set in one file from certs directory ? [1] https://networkradius.com/doc/current/raddb/tls/tls-config_tls-common.html Best regards

2 1

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 11 May '22

11 May '22

No offense meant. I am just being thorough. I have already experienced applications that allow authentication through AD that only perceive groups for the authentication. Once you are past that, there is no access to AD group information. On 5/10/22, 09:44, "Alan DeKok" <aland(a)deployingradius.com> wrote: On May 10, 2022, at 9:16 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Thanks. > Does the AD-LDAP connection provide AD groups to allow user "filtering" ? That is what I said. I'm not sure why there's a need to double-check the answers I give. It's not productive. See also the documentation, or the mods-available/ldap file. There is *extensive* documentation on using AD groups. Alan DeKok.

2 1

Re: FreeRadius and Active Directory and SSSD
by White, Daniel E. (GSFC-770.0)[AEGIS] 10 May '22

10 May '22

Thanks. Does the AD-LDAP connection provide AD groups to allow user "filtering" ? On 5/10/22, 09:10, "Alan DeKok" <aland(a)deployingradius.com> wrote: On May 10, 2022, at 8:56 AM, White, Daniel E. (GSFC-770.0)[AEGIS] via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > I am trying to replace a Cistron RADIUS service running on a dinosaur of a Sparc Solaris 9 server before it explodes. Wow. CIstron was effectively dead 20 years ago. > This RADIUS service is only used to access network devices (switches, routers, etc.) Likely only PAP then. But you'll have to double-check the packets. Every piece of vendor equipment does something magical and special. > We are moving to a centralized credentials setup with usernames/passwords in Active Directory. > > We followed this document to connect RHEL servers. > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… > > Now we need a new RADIUS service that uses the AD credentials. Odds are that you can just use PAP, and connect to AD via LDAP. And also check admin group privileges! if (LDAP-Group != "admin") { reject } ... else check passwords, etc. Alan DeKok.

3 2