- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 82, Issue 50
by Peter Moreton 17 Feb '12

17 Feb '12

But why not simply create a simple web page, possibly even as a captive portal? It's much easier that way, plus it's real-time and you have no risk of email missing (e.g. due to spam filters, etc). >> if I build a webpage, then I also have to authenticate users who present themselves requesting self service Since I don't know Linux terribly well, I'm asking the group if my proposal is a sensible approach? Am I re-inventing any wheels? Should I consider an alternative method? It's not really linux-specific. >> I want to keep the entire radius PIN authentication system on Linux, to keep it independent of Windows, a security "island" perhaps, so in this case, it is Linux specific. Thanks ----------------------------------------------------------- My brief spec: RADIUS01 would be extended to use SENDMAIL and some Perl or similar processing to monitor a predefined email account such as <mailto:PIN@foobar.org.uk> PIN(a)foobar.org.uk<mailto:PIN@foobar.org.uk> Why? When will you want radius to send email? During a failed auth? IMHO that's a terrible design, and could easily lead to mail floods. Again, it's easier to just use webpage. You seem to have a perception that the DB can only be modified by radius. It's not. You can have whatever process you want managing the db, and have FR simply reads from it. >> Nope, I said "radius01 would be extended" that's a hostname not the radius software. Perhaps I should have made this more clear. In my implementation, RADIUS01 replaces another security island, RSA01. The Sendmail/Perl script would make calls such as: ?Mysql -u root -p That line REALLY show your newbie-ness. >> cheers. helpful. ?<MySQL Password> ?Use radsql ?INSERT INTO radcheck (username, attribute, op, value) VALUES ('janedoe','Cleartext-Password',':=','password'); ?INSERT INTO radusergroup VALUES ('janedoe','dynamic',1); ?QUIT Ever heard of sql functions in scripts? e.g. <http://www.php.net/manual/en/book.mysqli.php>http://www.php.net/manual/en/book.mysqli.php or <http://search.cpan.org/dist/DBD-mysql/lib/DBD/mysql.pm>http://search.cpan.org/dist/DBD-mysql/lib/DBD/mysql.pm ? >> of course I have. My post tries to explain what I'm trying to achieve using simple language. Implementation detail isn't required. Looking at your post, I REALLY suggest you hire an expert instead. Either that, or spend lots of time (e.g. several weeks) to learn and have some trial-and-error. >> no, radius, mysql, php - these are all just tools to be learned. I'd rather spend a couple of weeks and build a solution that I know and trust. I'm sure we are all experts in our fields, and as such its much better to expand personal horizons than give in an hire someone. >> anyhow, no one responded to say, "it exists, use the xyz-addon" so I'm guessing that I'm not reinventing anything, so I'll crack on. Thanks everyone. *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

2 1

Radius Self Service
by Peter Moreton 16 Feb '12

16 Feb '12

DISCLAIMER: We are a Windows-shop, and this is our first Linux server deployment, so I'm having to ask newbie questions, sorry about that! I have a working RADIUS server, "RADIUS01" running Centos/Freeradius. Freeradius is configured to store username and PIN-style passwords in MySQL. To go live with our RADIUS implementation, I have been tasked with making the selection of PIN's a self-service process. I'm considering an email-based approach where user(a)foobar.org.uk can email PIN(a)foobar.org.uk in order to achieve PIN maintenance. (I understand the risk of email header spoofing). Since I don't know Linux terribly well, I'm asking the group if my proposal is a sensible approach? Am I re-inventing any wheels? Should I consider an alternative method? Thanks ----------------------------------------------------------- My brief spec: RADIUS01 would be extended to use SENDMAIL and some Perl or similar processing to monitor a predefined email account such as PIN(a)foobar.org.uk Sending a blank email to PIN(a)foobar.org.uk will respond with: Reply with a Subject line of : SENDPIN - To send your current PIN to your email address NEWPIN xxxx - To set you pin to the value xxxx and confirm by email HELP - To receive an email with extensive guidance The Sendmail/Perl script would make calls such as: Mysql -u root -p <MySQL Password> Use radsql INSERT INTO radcheck (username, attribute, op, value) VALUES ('janedoe','Cleartext-Password',':=','password'); INSERT INTO radusergroup VALUES ('janedoe','dynamic',1); QUIT *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

3 2

Authenticate users only depending on the result of a perl script
by Lorenzo J. Cubero 16 Feb '12

16 Feb '12

Dear Freeradius experts, I would like to redirect all the incoming requests to a rlm_perl script. And then authenticate the user only depending on the result of the script. I already have the script, my doubt is how to configure Freeradius to treat the incoming requests only over a perl script. Thanks in advance. -- ......................................................................... __ / / Lorenzo J. Cubero C E / S / C A Unitat d'Operacions i Seguretat /_/ Centre de Serveis Científics i Acadèmics de Catalunya Gran Capità, 2-4 (Edifici Nexus) · 08034 Barcelona T. 93 551 6214 · F. 93 205 6979 · ljcubero(a)cesca.cat Facebook (http://on.fb.me/vPv3oN) · Twitter @CE5CA · Linkedin Subscriu-te al butlletí (www.cesca.cat/butlleti) .........................................................................

2 1

Re: Acct-Interim-Interval session time not working
by dulan 16 Feb '12

16 Feb '12

use like follows *Acct-Interim-Interval := 60* if you use Database you should insert this data to *radraply *table On Thu, Feb 16, 2012 at 12:59 PM, oportino [via FreeRadius] < ml-node+s1045715n5488744h83(a)n5.nabble.com> wrote: > Hello all, > > I am using freeradius 2.1.0 on Ubuntu 10.10 and using rp-pppoe server and > chillispot server for user login authentication method on same machine and > set up radius attribute for end user such as > #------------------------------------------------------------------------------------- > > *radtest abc abc123 127.0.0.1 0 SecretKey* > Sending Access-Request of id 185 to 127.0.0.1 port 1812 > User-Name = "abc" > User-Password = "abc123" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=185, > length=80 > Idle-Timeout = 600 > WISPr-Bandwidth-Max-Down = 100000000 > WISPr-Bandwidth-Max-Up = 100000000 > *Acct-Interim-Interval = 60* > Acct-Status-Type = Interim-Update > *Session-Timeout = 300* > > ( All user can login all of session is 5mins ) > #------------------------------------------------------------------------------------- > > > 1.After first use logged in ( with pppoe or chillispot) the user "abc" > use the network times 200secs (left time=100secs) and logged off later. > > 2.The user "abc" logged in again with radius message > User-Name = "abc" > User-Password = "abc123" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=185, > length=80 > Idle-Timeout = 600 > WISPr-Bandwidth-Max-Down = 100000000 > WISPr-Bandwidth-Max-Up = 100000000 > *Acct-Interim-Interval = 60* > Acct-Status-Type = Interim-Update > *Session-Timeout = 100* > > During live logged in session , In the radius database and radacct table > has 2 record insert (first record is first login and *secondary record is > now login*) > > I delete the first database record (use time= 200secs) so that the > attribute Acct-Interim-Interval it is updating all sessiontime count to 0 > and "abc" can use the network 300secs. But it is not updating session and > the user "abc" was terminate after 100 secs normally by AcctTerminateCause > is "Session-Timeout" . > > What does debug or how? > > Thanking for every thing. > > > > ------------------------------ > If you reply to this email, your message will be added to the discussion > below: > > http://freeradius.1045715.n5.nabble.com/Acct-Interim-Interval-session-time-… > To unsubscribe from FreeRadius, click here<http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsu…> > . > NAML<http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macr…> > -- Best Regards.. Achintha Udukumbura -- View this message in context: http://freeradius.1045715.n5.nabble.com/Acct-Interim-Interval-session-time-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Possibility to create a counter for "traffic volume" WITHOUT sql ?
by Nachtfalke 16 Feb '12

16 Feb '12

Hi, I am using freeradius 2.1.12 and the rlm_counter module for counting amount of time. So an user has got only 60min per day, week, month or forever. As far as I can see that this is working as it should. User cannot reconnect if he used more time than allowed. This is how my counter module looks like: ------------------------------------------- counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout cache-size = 5000 } ------------------------------------------- The corresponding "users" file looks like that. Limit is 3600 seconds. ------------------------------------------- "username" Cleartext-Password := "password", Max-Daily-Session := 3600 ------------------------------------------- Then I thought I could just simple make a traffic counter with this module and I did that: ------------------------------------------- counter maxdailydownload { filename = ${raddbdir}/db.maxdailydownload key = User-Name count-attribute = Acct-Output-Octets reset = daily counter-name = Daily-Output-Octets check-name = Max-Daily-Output reply-name = Acct-Output-Octets cache-size = 5000 } ------------------------------------------- The corresponding "users" file looks like that. Limit is 1000000000 which should be ~1GB ------------------------------------------- "username" Cleartext-Password := "password", Max-Daily-Output := 1000000000 ------------------------------------------- But as I know now this isn't working. The main problem is - as far as I understand this - that the module counts time and replies "Session-Timeout" and this makes problem when counter should reset daily. Unfortunately I didn't understand it completly. Somewhere on the mailing-list I found I thread where they discussed about that problem and that it should work when using "reset = forever". I tried that but it seems not to work. The user only can download much less than 1GB. Perhaps this could be a problem of my NAS (pfSense Captive Portal which perhaps sends wrong "Acct-Output-Octets" values). The other problem is that if the check-item value of "Max-Daily-Output" is too hight - probably 32bit limit - it doesn't work, too. Then I bought a book about freeRadius "FreeRADIUS - Beginners Guide by Dirk van der Walt" and he is describing the same problem with the rlm_counter and counting traffic. He wrote a perl script which counts traffic but the "problem" is that he is using an SQL database. The NAS I am using for this is - I mentioned it above - pfSense CaptivePortal. It sends Acct-Input-Octets, Acct-Input-Octets, Acct-Input-Gigawords, Acct-Output-Gigawords. My question is now: 1. Is it possible in general to create a data counter without using any external database but just with tools freeradius2 comes with ? 2. Has somebody coded such a module, script oder something als and could post this here ? 3. Will there be an (easier) way on freeradius3 or a module which covers this feature ? Thank you very much in advance for your help and answers! Alexander

2 1

Password-Retry attribute
by Morris, Andi 16 Feb '12

16 Feb '12

Hi all, I'm trying to configure my freeradius server to prompt the user to retype their credentials if they mistype the username or password so that they can be authenticated via dot1x. I've checked my virtual server post-auth and found: post-auth { exec packetfence Post-Auth-Type REJECT { attr_filter.access_reject } } So then looked inside attr_filter.access_reject and added the Password-Retry attribute as below: DEFAULT EAP-Message =* ANY, State =* ANY, Message-Authenticator =* ANY, Reply-Message =* ANY, MS-CHAP-Error =* ANY, Proxy-State =* ANY, Password-Retry :=3 However when I force my test Windows 7 client to fail using a bad password I'm not reprompted to enter a new password at all. When running a debug I see the Password-Retry attribute being sent in the Access-Reject section. The following results are the debug output: . rad_recv: Access-Request packet from host 10.1.1.21 port 1645, id=169, length=308 User-Name = "sm18818" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-09-E8-98-A0-02" Calling-Station-Id = "00-24-54-42-86-04" EAP-Message = 0x0208006b19001703010060f87a45874abccfef74c9674f4dcc93d9f804ecc7db489bfa2205e4a5c2f691543d9de8c31c0c84fb2da83121280190827555f2e2cb16784fabf62a775b6caca028e7a56405a8c7e64d0e3855a75615e2275ce7a40ace04929dbbf623562650c3 Message-Authenticator = 0xd7a475900d0efb6a752d8c59da3f6dc6 Cisco-AVPair = "audit-session-id=0A0101150000018BAED66314" NAS-Port-Type = Ethernet NAS-Port = 50002 NAS-Port-Id = "FastEthernet0/2" State = 0xd8956e82de9d77cd0f3a27e6f3c50521 NAS-IP-Address = 10.1.1.21 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 8 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800421a0208003d31375d05e236695687a5bd102f646c02450000000000000000ba7cffdf85864518ecc5b323c793c6a254e781a06009e9ad00736d3138383138 server packetfence { [peap] Setting User-Name to sm18818 Sending tunneled request EAP-Message = 0x020800421a0208003d31375d05e236695687a5bd102f646c02450000000000000000ba7cffdf85864518ecc5b323c793c6a254e781a06009e9ad00736d3138383138 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sm18818" State = 0x7642bbe8764aa17935847ca964c2e70f Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-09-E8-98-A0-02" Calling-Station-Id = "00-24-54-42-86-04" Cisco-AVPair = "audit-session-id=0A0101150000018BAED66314" NAS-Port-Type = Ethernet NAS-Port = 50002 NAS-Port-Id = "FastEthernet0/2" NAS-IP-Address = 10.1.1.21 server packetfence-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: sm18818 [mschap] Told to do MS-CHAPv2 for sm18818 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> sm18818 [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=sm18818 [mschap] mschap2: c7 [mschap] Creating challenge hash with username: sm18818 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=e8c9f13e6c1cd2a3 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ba7cffdf85864518ecc5b323c793c6a254e781a06009e9ad Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server packetfence-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 169 to 10.1.1.21 port 1645 EAP-Message = 0x0109002b1900170301002046a93765d835a4d9441c538ef7abcb1ef20e14d69d31cd9afbf8bd34f017fb64 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd8956e82df9c77cd0f3a27e6f3c50521 Finished request 7. Going to the next request Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 10.1.1.21 port 1645, id=170, length=244 User-Name = "sm18818" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-09-E8-98-A0-02" Calling-Station-Id = "00-24-54-42-86-04" EAP-Message = 0x0209002b19001703010020d6f77af2663bc82ac052d9afb815c2b900be28fa33360b6f6ce08326d867b3cc Message-Authenticator = 0xa004edde5ec362abceec91909403265a Cisco-AVPair = "audit-session-id=0A0101150000018BAED66314" NAS-Port-Type = Ethernet NAS-Port = 50002 NAS-Port-Id = "FastEthernet0/2" State = 0xd8956e82df9c77cd0f3a27e6f3c50521 NAS-IP-Address = 10.1.1.21 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sm18818", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server packetfence Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sm18818 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 170 to 10.1.1.21 port 1645 Password-Retry := 3 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.9 seconds. Is there somewhere else I need to enable this attribute? Does it need adding to the dictionary on the client? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

2 2

Re: Freeradius with Caller-station-id
by Alan Buxey 16 Feb '12

16 Feb '12

This can be done for plain auth...one way would be to put a check in the auth section, if the normal auth has failed then fail through to eg perl and have some perl script that checks what you want to check and send back the accept alan

5 15

duplicate radacct entries
by Ski Mountain 16 Feb '12

16 Feb '12

I am using pptp with radiusclient, and a mysql backend. The problem is that the radiusclient puts in too many entries into the database. Below is a copy of one client connecting and disconnecting. The problem appears to be that for the second entry there is never a acctstoptime entered into the databse, or is there a way to make it so only entry is entered into the database. where is just says 0000-00-00 00:00:00. mysql> select * from radacct; +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | nasportid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | LastUpdate | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ | 1 | 4F3C72A5117D00 | 4fed5006f373739c | user(a)domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 04:06:13 | 0000-00-00 00:00:00 | 0 | RADIUS | | | 0 | 0 | | 22.11.45.88 | | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | 2012-02-16 04:06:13 | | 2 | 4F3C72A5117D01 | 19f60e897a312d37 | user(a)domain.com | | | 108.59.9.35 | 0 | Async | 2012-02-16 04:06:13 | 2012-02-16 04:06:16 | 3 | RADIUS | | | 792 | 0 | | 22.11.45.88 | User-Request | Framed-User | PPP | 10.80.72.1 | 0 | 0 | | 2012-02-16 04:06:16 | +-----------+----------------+------------------+-----------------+-----------+-------+--------------+-----------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+---------------------+ 2 rows in set (0.00 sec) Thanks

2 5

Freeradius with Caller-station-id
by Richard J Palmer 16 Feb '12

16 Feb '12

Hi we have several FreeRadius servers talking in our case to SM SQL and these work fine for all our users logging in using Username & passwords. We are just getting a new L2TP link in and with sessions on this link I want to auhenticate *just* on the calling station ID - there will be a username/password BUT these are not what we need. I therefore want to be able to keep username/password for the current sessions, BUT if these fail authenticate on callingtation ID and return IP address details, etc. is there a way to do this ? I worked round it previously by hacking the code BUT I'm sure there is a better way here... Richard

2 2

ldap authentication
by Jason Sigurdur 15 Feb '12

15 Feb '12

Hi, I have an application that requires ldap authentication, but would like it to proxy the authentication to a radius/otp server given the user is part of a specific group. Is this a possibility within freeradius? Thx jason

1 0