- Freeradius-Users - lists.freeradius.org

Easy way to see what is missing from configuration?
by Coy Hile 05 Jan '22

05 Jan '22

Hi all, I had saved older (still 3.x versions, but unknown how far downrev) versions of a configuration from a working server, and I’m reinstalling a newer version on Ubuntu 20.04. I *thought* I had configured everything appropriately, but apparently not in the least. I get, e.g. radiusd -XC [….] Ignoring "sql" (see raddb/mods-available/README.rst) […] Is there some easy way to see what is missing or otherwise objected to in mods-available/sql? -- Coy Hile coy.hile(a)coyhile.com

2 2

tls/ssl
by mohamed almeshal 04 Jan '22

04 Jan '22

happy new year for all savers ... i have issue with tls ... what i want to achieve is not to order sign request from devices and let the server accept all requests until it have vaild cert . i try some tricks but no luck . i think i have to disable require client cert but with no luck . thanks savers

2 1

Radius requests from unknow hosts
by Marko Bozinovski 04 Jan '22

04 Jan '22

Hello, First time doing this, so I am not sure if i am doing it correctly. I have configured RADIUS server and setup few juniper devices. Configuration is ok, my clients can authenticate using radius etc. I am worried about one thing. When i configure one EX switch, it keeps sending some strange request, something like this (0) User-Name = "root" (0) User-Password = "\010\n\r\177IN" (0) NAS-Identifier = "EX1" (0) Calling-Station-Id = "165.22.195.82" (0) NAS-IPv6-Address = 2600:894c0:c0:30::6 Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { NAS-IPv6-Address is the address of that EX, and NAS-Identifier is ok, but username root is strange, and calling-station-id. >From my perspective it looks like it is sending requests from that EX with username root. Sometimes it use other usernames. I have read that can be related to brute force attack's. Thank you and sorry for noob and confusing question. Marko

2 1

Self Service Kiosk / Workflow to trust untrusted devices to add them to personal VLAN dynamically
by Stefan Mueller 04 Jan '22

04 Jan '22

Hello FreeRADIUS user, I hope that someone out there is able to give me some piece of advice to my unusual idea. There are two WiFis in our multi-apartment building: 1. WPA2 EAP Auth - for trusted user (such as residents) using FreeRADIUS for authentication and dynamic VLAN assignment 2. WPA2 PSK (for guests, IoT without EAP support etc.) Currently, the admin has to assign printer, TV-Boxes etc. manually to the respective VLAN of a resident. The standard use case to make this necessary is to allow the respective resident to control the device by smartphone. Is it somehow possible to allow each resident to open an GUI and select untrusted devices (devices connected to the WPA2 PSK) and just click on a button to make them trusted, so their VLAN assignment will be change, means FreeRADIUS changes the following Mikrotik-Wireless-VLANID := 10, Mikrotik-Wireless-VLANID-Type := 0, due to this *workflow *triggered by an trusted user via the GUI? Thank you and a restful start into 2022 Stefan

2 4

How to use Virtual Servers
by Network RADIUS 04 Jan '22

04 Jan '22

** How to use FreeRADIUS virtual servers --------------------------------------------- Virtual servers provide a powerful way to define unique policies for different traffic sources. When policy rules for each traffic source are defined in their own separate configuration file, it’s a lot simpler to define them, understand them, and debug them. Virtual servers are unique to FreeRADIUS. Other RADIUS servers typically have one global policy, with sub-policies defined in a series of nested if/else statements. Unfortunately, the logic expressed in the if/else statements quickly becomes difficult to understand and maintain for all but the simplest scenarios. As the needs of the network infrastructure evolves over time, the logic statements grow in complexity and become error prone and difficult to debug. Changes to one piece may result in unexpected side effects. Read the full article… https://networkradius.com/articles/2021/09/25/virtual-servers.html <https://networkradius.com/articles/2021/09/25/virtual-servers.html> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/contact/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Finally I got it work
by mohamed almeshal 29 Dec '21

29 Dec '21

Thanks all ... I finally Got it works and got my target but the only issue now facing me is I want to put a trigger when user do logout ? how I can do that ? Thanks, Happy New Year Savers Mohamed

2 1

Setting a default group, or group based on realm
by Matthew H 27 Dec '21

27 Dec '21

Hi, I am using FreeRADIUS + Postgres and would like to be able to set a default group, and potentially set the group based on realm. Could someone point me in the right direction? I've tried things like DEFAULT Auth-Type := Accept, Group-Name := "default" but I don't then get the replies for the group defined in the radgroupreply table. Thanks Matthew

2 2

DHCP. Several dhcp attributes from the sql table
by Sergey Kodentsev 26 Dec '21

26 Dec '21

Hi, > You can run the "authorize" method of SQL by doing: Thanks, I really didn't read the documentation well.

1 0

exec error
by mohamed almeshal 25 Dec '21

25 Dec '21

dear all savers I try to run exec php after post-auth to handle telegram notifications and coa change of speed but I'm facing problem with exec , the problem is I can't let it work I found that I miss ntlm_auth = "/opt/exec/telegram.php %{User-Name} %{User-Password} -request-nt-key" which I can't know where to put , I'm sorry I'm new at that the debug . (0) telegram_messages: Executing: /opt/ajrass/egy-radius-cloud/freeradius/exec/telegram_messages.php: (0) telegram_messages: ERROR: Failed parsing output from: /opt/ajrass/egy-radius-cloud/freeradius/exec/telegram_messages.php: Expecting operator (0) telegram_messages: ERROR: Program returned code (2) and output 'Failed to execute "/opt/ajrass/egy-radius-cloud/freeradius/exec/telegram_messages.php": Exec format error' (0) [telegram_messages] = fail please help , savers

2 1

DHCP. Several dhcp attributes from the sql table
by Sergey Kodentsev 25 Dec '21

25 Dec '21

Hi, > Perhaps you should read the SQL module configuration, or the debug output to see where the queries are now located. The file which contains the queries also has complete documentation on how they work. You can edit those queries. > If you're going to ignore my suggestions and all of the documentation, then why are you asking questions here? I have read the documentation for the rlm_sql module, read the comments in the etc/raddb/mods-config/sql/main/mysql/queries.conf file. I know where to edit these sql queries I don't understand why when calling the same sql module from the authorize section, authorization queries is executed, but when calling from dhcp DHCP-Request authorization queries is not executed. (0) # Executing section authorize from file /usr/local/radius3/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) sql: EXPAND %{User-Name} (0) sql: --> sergk (0) sql: SQL-User-Name set to 'sergk' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sergk' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sergk' ORDER BY id and Trying sub-section dhcp DHCP-Request {...} (0) dhcp DHCP-Request { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND %{User-Name} (0) sql: --> (0) sql: SQL-User-Name set to '' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '', '', '0', '2021-12-25 10:40:13.292201' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '', '', '0', '2021-12-25 10:40:13.292201' ) (0) sql: SQL query returned: success There is no attempt to execute authorize_check_query

2 1