- Freeradius-Users - lists.freeradius.org

Cast type user-name
by Bassem Mettichi 18 Apr '22

18 Apr '22

Hello , Please could any one provide the unlang syntax to check if the request:user-name is of type ipv4addr or ipv6addr Thanks Bassem

4 8

NasReboot
by mohamed almeshal 17 Apr '22

17 Apr '22

Dear Savers I got a strange problem , I use freeradius 3.0.25 with radsec the nas's are mikrotik CCR now suddenly I got NAS-reboot in all the session that been opened and suddenly all sessions are closed I searched in all things all things is fine but the active session is been closed . how I figure where is the problem up there thanks

3 2

rlm_ldap - inherit user { access_attribute } from profile entry
by Peter Payne 16 Apr '22

16 Apr '22

In the rlm_ldap module configuration file "ldap" there is a configuration parameter in the "user { }" section named "access_attribute". I have that set to "dialupAccess". I also have the configuration parameter in the "profile { }" section named "attribute" set to "radiusProfileDn". My users, in LDAP, all have "radiusProfileDn" set to point to a profile, e.g.: radiusProfileDn: cn=adsl,ou=radius profiles,o=myorg And I'd like to put the "dialupAccess" attribute in the profile rather than the user entry, e.g.: dialupAccess: 1 As far as I can tell there's no attribute value inheritance in LDAP? Short of modifying the source code of rlm_ldap.c and/or the function rlm_ldap_check_access() to explicitly search the profile LDAP entry for the access attribute are there any other strategies I might consider in order to move the access attribute out of the individual user LDAP entries? Kind regards, Peter Payne Melbourne, Australia

2 1

Using user groups to simply my config
by Jason Womack 15 Apr '22

15 Apr '22

Hello, How I can go about assigning a group value to each user definition and then post-auth (I think from reading) use that group name to define the specific attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-Id. I simply want to do this to avoid having to repeat all these tunnel values for each device. I am running freeradius v3.0.25 on freebsd. Pseudo Example authorize file AABBCCDDEEFFGG Group := "iot", Cleartext-Password := "AABBCCDDEEFFGG" site-enabled/default (I think it might go here) if (group == "iot) { #update reply, set Tunnel-* values } Any guidance someone could provide would be great. All the examples I have found seem to be using the mysql backend and I don't have a need for the additional complexity but will go down that route if its required.

2 3

Faild binding to auth address error
by Matthew Budrey 14 Apr '22

14 Apr '22

Hello, Got a newly built Freeradius server running on Ubuntu server that is showing the following error; radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } Failed binding to auth address * port 1812 bound to server default: Address already in use /etc/freeradius/3.0/sites-enabled/default[59]: Error binding to port for 0.0.0.0 port 1812 By stopping the service, the error goes away, but as soon as the service is restarted the error is back, see below output of the running instances. administrator@zotacradius:~$ sudo ps ax | grep radius 2366 ? Ssl 0:00 /usr/sbin/freeradius -f 2986 pts/1 S+ 0:00 grep --color=auto radius administrator@zotacradius:~$ sudo systemctl stop freeradius administrator@zotacradius:~$ sudo ps ax | grep radius 3022 pts/1 S+ 0:00 grep --color=auto radius After spending a lot of time looking for ways to resolve this issue today, they all talk about processes already using the ports, assuming I'm reading this correctly, then that's not what I'm seeing as there is only the active instance and the grep process. Has anyone got any suggestions on how to resolve this at all? Regards Matt

2 1

Problem Radius over VPN
by Luca Bertoncello 14 Apr '22

14 Apr '22

Hi list! I already reported in March my problems using Freeradius over VPN. I spent many time searching the problem, and maybe I found something, but I have no idea how to correct the problem... So, short explanation: Main office with Freeradius, connected via OpenVPN to our central VPN-Server. Second office with the AccessPoints, connected via OpenVPN to our central VPN. "Normal" pakets from second office to main office (and viceversa) go through both VPNs. Now, I sniffed the pakets on all servers (VPN server on second office, central VPN server, VPN server on main office and Freeradius), and I discovered that some pakets are blocked. Wireshark on VPN server of the second office: 12 2022-03-25 14:39:48,154608 10.0.21.10 10.6.21.10 RADIUS 979 Access-Challenge id=86 13 2022-03-25 14:39:48,476555 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=41c1) 14 2022-03-25 14:39:48,507473 10.0.21.10 10.6.21.10 RADIUS 92 Access-Challenge id=87 15 2022-03-25 14:39:48,533183 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=41c2) 16 2022-03-25 14:39:51,533406 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=42d9) Wireshark on central VPN: 12 2022-03-25 14:39:48,129787 10.0.21.10 10.6.21.10 RADIUS 979 Access-Challenge id=86 13 2022-03-25 14:39:48,488993 10.6.21.10 10.0.21.10 IPv4 1500 Fragmented IP protocol (proto=UDP 17, off=0, ID=41c1) 14 2022-03-25 14:39:48,501213 10.0.21.10 10.6.21.10 RADIUS 92 Access-Challenge id=87 No other pakets after paket 14 (ID 87) reach the central VPN serve, so the problem "must be" either on the central VPN server or on the VPN server oft he second office... Now the very question: do someone have an idea why just the first fragmented paket run over all VPNs and the other one do not? Thanks a lot Luca

4 12

hup support
by Peter Lee 13 Apr '22

13 Apr '22

Try to dynamically update freeradius configuration rather than restart radiusd each time config changes, is there a detailed document on what configuration is hup supported? Tried client add/delete using radmin, "add" from file seems fine but delete failed for it's only supported for dynamic client? Regards.

2 1

Re: Get client name with unlang
by Rahman DURAN 12 Apr '22

12 Apr '22

Never mind, I get it with %{client:shortname} Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi 444 5 388 - 2730 Message: 1 > Date: Tue, 12 Apr 2022 14:58:50 +0300 > From: Rahman DURAN <rahman.duran(a)erzurum.edu.tr> > To: freeradius-users(a)lists.freeradius.org > Subject: Get client name with unlang > Message-ID: > < > CAEMJzSwcB0rwi16XrDukUGxbT_sRKW8QRTQa1YA6PhiY30D0rQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi, > > https://wiki.freeradius.org/config/run_time_variables here it says I can > use the "%C" variable to get clientname (clients.conf) but it also says > "The following variables are obsolete and have been removed from version 3 > of the server. They are duplicates of the previous general cases, and were > only provided for backwards compatibility." > > So how can I get the client name? Blindly tried xlat %{client:name} but it > did not work. > > Regards > > Rahman Duran > Bilgi ??lem Daire Ba?kanl??? > Erzurum Teknik ?niversitesi > 444 5 388 - 2730 > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 204, Issue 17 > ************************************************* >

1 0

Get client name with unlang
by Rahman DURAN 12 Apr '22

12 Apr '22

Hi, https://wiki.freeradius.org/config/run_time_variables here it says I can use the "%C" variable to get clientname (clients.conf) but it also says "The following variables are obsolete and have been removed from version 3 of the server. They are duplicates of the previous general cases, and were only provided for backwards compatibility." So how can I get the client name? Blindly tried xlat %{client:name} but it did not work. Regards Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi 444 5 388 - 2730

1 0

Multi-value attributes in client section
by Rahman DURAN 08 Apr '22

08 Apr '22

Hi, Is it possible to define multi-value attributes for clients and use them with unlang if conditions? For example: client abc { ipaddr = xxxx secret = xxxx group = "123" group = "456" } Then use it in a policy: if ("%{client:group[*]}" == "123") This does not seem to work, freeradius only keeps the first assignment (group = "123"), it seems. Is there any way to make it work like this? Or can I use something else for this purpose? Any client should belong to multiple groups. Regards, Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi 444 5 388 - 2730

2 1