- Freeradius-Users - lists.freeradius.org

Questions
by mohamed almeshal 15 Dec '21

15 Dec '21

Dear Savers .... First Thank you Alan .. first : I'm new at building exec script by php ... I do read some docs about exec and I found that to build my script for update some values and telegram messages I have to build modules . but the doc's always refer to raddb/modules but I have freeradius 3.0.25 and it's on etc I think the alternative is mod-enabled is that ok also in php script what is the variable should I use to represent of the %{User-Name} . Second : is the use of exec script not for auth just for some additional function will affect the speed of auth in present of unlag statments in defult config third : I use radsec for auth , what is the best way to determine the active online NAS that connected to freeradius box fourth : I read tons of doc about MAC Auth but I need the script to check that against last mac in radacct what is the best way to do that sorry for the long questions . mohammed

3 2

Sorry For missunderstand
by mohamed almeshal 14 Dec '21

14 Dec '21

dear Savers ... I think I miss the parameters (module mean for me the section like Authorize Authintcate ... etc ) what I'm asking about is I need to build custom unlag like the condition in expiration module like this : expiration { userlock = 1 } if (userlock) { update reply { Reply-Message += "Account expired" } userlock } expire_on_login sql_session_timeout sql_octets_limit What I'm need is to put custom if condition in each module that reject the user for hotspot message and I wonder if I can use the userlock in every module like the expiration . //// Also about the loop what I'm going to do is just use exec to and get it work fine with php, but please what is the best way to write exec statments .

2 1

ippool 0.0.0.0 assignment problem
by Mirko Alberio 14 Dec '21

14 Dec '21

Hi! Hope this can be useful for someone. I found the base problem of my radius ippool assignment problem! Maybe for future reference for other users, the problem was: WHITESPACE in an ip pool address row! So in some way the NAS where assuming 0.0.0.0 as framed ip address for this. This is the radiusd -X output that helped me: (1675) sqlippool: Executing query: COMMIT (1675) sqlippool: EXPAND START TRANSACTION (1675) sqlippool: --> START TRANSACTION (1675) sqlippool: Executing query: START TRANSACTION (1675) sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE SKIP LOCKED (1675) sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'pool1' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'xxxxxxxxx'), (callingstationid <> 'XX:XX:XX:75:36:B6'), expiry_time LIMIT 1 FOR UPDATE SKIP LOCKED (1675) sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'pool1' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'xxxxxxxxx'), (callingstationid <> 'XX:XX:XX:75:36:B6'), expiry_time LIMIT 1 FOR UPDATE SKIP LOCKED (1675) sqlippool: EXPAND COMMIT (1675) sqlippool: --> COMMIT (1675) sqlippool: Executing query: COMMIT *(1675) sqlippool: Invalid IP number **[12.34.56.7__] **returned from instbase query.* rlm_sql (sql): Released connection (11) (1675) sqlippool: EXPAND IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1675) sqlippool: --> IP Allocation FAILED from pool1 (did vlan102 cli XX:XX:XX:75:36:B6 port 15731656 user xxxxxxxxx) (1675) [sqlippool] = noop Mirko Alberio Amministratore di Sistemi Via Enrico Fermi, 235 - 36100 Vicenza - Italia Tel 0444 291302 - Fax 0444 566310 - www.telemar.it <http://www.telemar.it> Reg. Imp. Di Vicenza /C.F./P.I. 02508710247 Cap. Soc. € 120.000,00 I.V. R.E.A. VI-236292 <https://it-it.facebook.com/TelemarIt/> <https://www.instagram.com/telemar_it/> <https://it.linkedin.com/company/telemar-s-p-a-> Il presente messaggio non costituisce offerta e/o accettazione contrattuale. Ai sensi del Regolamento europeo per la protezione dei dati personali n. 679/2016 (GDPR) si precisa che le informazioni contenute in questo messaggio e/o nel/i file/s allegato/i sono riservate ed a uso esclusivo del destinatario. Qualora il messaggio in parola Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo e a non inoltrarlo a terzi, dandocene gentilmente comunicazione. Grazie. Pursuant to General Data Protection Regulation (GDPR), you are hereby informed that this message contains confidential information intended only for the use of the addressee. If you are not the addressee, and have received this message by mistake, please delete it and immediately notify us. You may not copy or disseminate this message to anyone. Thank you.

2 2

Users Files Match
by Nicolas Breuer 13 Dec '21

13 Dec '21

Hello, Can you check if this expected in FreeRadius 3.0.21. DEFAULT Suffix == "@REALM", NAS-IP-Address == 1.1.1.1 MS-Primary-DNS-Server = 8.8.8.8, Pool-Suffix = "BC", Fall-Through = Yes DEFAULT Suffix == "@REALM" Client-DNS-Pri = 9.9.9.9, Pool-Suffix = "BC", Fall-Through = Yes When the request is coming from NAS 1.1.1.1, this is fine and FR is sending DNS 8.8.8.8 Line 10 is a default one Line 56 is the Yellow Line 80 is an other default. (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 56 (0) auth_dsl: users: Matched entry DEFAULT at line 80 When the request is coming from an other NAS, it's expected to match the second one (line 61) but that doesn't happened. (0) [suffix] = noop (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 Is it expected?

3 14

Some Questions
by mohamed almeshal 11 Dec '21

11 Dec '21

Dear Savers ... I'm building Freeradius Web interface For Hotspot Management , I'm Stuck now with these issues . * if I want to build condition with moduls such as sql_octets_limit or pap can I use userlock statment more than one time in the file so I can set unlag condition for every module. * I need to set foreach loop to change user speed every time it's auth so I need to build forach loop , what is the best way to write COA statment for config file . * I need to send notification via telegram so I have to fire it up in post-auth by php script how I can achieve this goal . * last question is about idel timeout if it the best way to send the value from radius rather set in the router to control the stale session your's Mohammed

2 1

Concatenating Attributes with semi-colon (;)
by Dean Arnold 09 Dec '21

09 Dec '21

Hello Alan & FreeRadius Team, I am using FreeRadius with Google Secure LDAP & WPA2 Enterprise Auth and it's working great! I have a new requirement to integrate FreeRadius and pfSense for Admin/UI login and VPN authentication. I have successfully configured pfSense and FreeRadius for user authentication, but I am trying to return the user's LDAP group membership in a semi-colon (;) delimited reply:Class attribute as required by pfSense (see https://docs.netgate.com/pfsense/en/latest/usermanager/radius.html) I have managed to return the LDAP memberOf values to the default site post-auth section, and using unlang foreach I have successfully created a comma (,) delimited reply:Class attribute. The issue is pfSense requires the reply:Class list to be semi-colon delimited, and I don't see an obvious way of changing the delimiter used by %{Attr-Name[*]}. Is there a way to create a semi-colon (;) delimiter list from a multi valued attribute? Thank you in advance. This is my default site post-auth: foreach &reply:ldapMemberOf { if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { update reply { classMemberOf += "%{1}" } } } update reply { Class = "%{reply:classMemberOf[*]}" Please note, 'classMemberOf' and 'ldapMemberOf' are non response attributes (3000 & 3001) I added to the dictionary. The ldap module populates 'ldapMemberOf' with the value of the users 'memberOf' in the ldap.update section: reply:ldapMemberOf += 'memberOf' Here's the relevant server debug; note user has 5 assigned groups: (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "darnold" (0) ldap: Using user DN from request "uid=darnold,ou=District Office,ou=Users,dc=valleychristianschools,dc=org" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user "uid=darnold,ou=District Office,ou=Users,dc=valleychristianschools,dc=org" was successful rlm_ldap (ldap): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 94 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... ber_get_next failed. rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) foreach &reply:ldapMemberOf (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) EXPAND Foreach-Variable-0 (0) --> cn=allstaff,ou=Groups,dc=valleychristianschools,dc=org (0) EXPAND %{Foreach-Variable-0} (0) --> cn=allstaff,ou=Groups,dc=valleychristianschools,dc=org (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) -> TRUE (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) update reply { (0) EXPAND %{1} (0) --> allstaff (0) classMemberOf += allstaff (0) } # update reply = noop (0) } # if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) = noop (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) EXPAND Foreach-Variable-0 (0) --> cn=firewalladmins,ou=Groups,dc=valleychristianschools,dc=org (0) EXPAND %{Foreach-Variable-0} (0) --> cn=firewalladmins,ou=Groups,dc=valleychristianschools,dc=org (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) -> TRUE (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) update reply { (0) EXPAND %{1} (0) --> firewalladmins (0) classMemberOf += firewalladmins (0) } # update reply = noop (0) } # if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) = noop (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) EXPAND Foreach-Variable-0 (0) --> cn=support1,ou=Groups,dc=valleychristianschools,dc=org (0) EXPAND %{Foreach-Variable-0} (0) --> cn=support1,ou=Groups,dc=valleychristianschools,dc=org (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) -> TRUE (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) update reply { (0) EXPAND %{1} (0) --> support1 (0) classMemberOf += support1 (0) } # update reply = noop (0) } # if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) = noop (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) EXPAND Foreach-Variable-0 (0) --> cn=support2,ou=Groups,dc=valleychristianschools,dc=org (0) EXPAND %{Foreach-Variable-0} (0) --> cn=support2,ou=Groups,dc=valleychristianschools,dc=org (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) -> TRUE (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) update reply { (0) EXPAND %{1} (0) --> support2 (0) classMemberOf += support2 (0) } # update reply = noop (0) } # if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) = noop (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) EXPAND Foreach-Variable-0 (0) --> cn=support,ou=Groups,dc=valleychristianschools,dc=org (0) EXPAND %{Foreach-Variable-0} (0) --> cn=support,ou=Groups,dc=valleychristianschools,dc=org (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) -> TRUE (0) if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) { (0) update reply { (0) EXPAND %{1} (0) --> support (0) classMemberOf += support (0) } # update reply = noop (0) } # if ("%{Foreach-Variable-0}" =~ /cn=([^,=]+)/) = noop (0) } # foreach &reply:ldapMemberOf = noop (0) update reply { (0) EXPAND %{reply:classMemberOf[*]} (0) --> allstaff,firewalladmins,support1,support2,support (0) Class = 0x616c6c73746166662c6669726577616c6c61646d696e732c737570706f7274312c737570706f7274322c737570706f7274 (0) } # update reply = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 130 from 10.4.0.40:1812 to 10.4.0.1:45899 length 0 (0) Class = 0x616c6c73746166662c6669726577616c6c61646d696e732c737570706f7274312c737570706f7274322c737570706f7274

4 5

Getting started with FreeRADIUS for the first time
by Network RADIUS 08 Dec '21

08 Dec '21

** Getting started with FreeRADIUS --------------------------------------- After an administrator installs FreeRADIUS for the first time, the big question is “Now what?”. Most sites need complex policies, interactions with databases, and logging. Yet the documentation for the server doesn’t give detailed instructions for how to configure the server for your particular location. As a result, many administrators are left wandering around the configuration files and documentation, wondering what to do next. Read the full article… https://networkradius.com/articles/2021/08/23/setting-up-free-radius-for-th… <https://networkradius.com/articles/2021/08/23/setting-up-free-radius-for-th…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Modify NAS-Port-Id value in mysql
by Yannick Champs 07 Dec '21

07 Dec '21

Hi all, how can I modify NAS-Port-Id attribute value (truncate string operation) before it gets recorded in MySQL database. I've read about ulang and understand that /etc/raddb/sites-enabled/default file should be modified. which section "post-auth", "preacct", "accounting" should I modify ? Is there another way to do it ? Thank you in advance. -- Yannick

3 2

User with password and user without password
by Angelo Corsaro 06 Dec '21

06 Dec '21

Hi all, I need a basic input to (if possible) fix my problem: now my radius is verifying only SIM (we're talking a private APN) with only Calling-Station-Id and I disabled the pap and chap as below [...] authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { # pap ok } [...] but in a near future a different client will be authenticate with User-Name, Cleartext-Password and Calling-Station-Id (always coming from a private APN): how can I manage those different requests ? I thought a simple "if" into the file site-enabled/default in the authorize/preprocess section: if (ClearText-Password == "Void") { update attribute { ClearText-Password := "--" } } and re-enabling the verify of the password in in authenticate section. But it seems too easy :) Cheers, Angelo

2 3

In FreeRadius 3.x+StrongSwan IKEv2 how to limited user upload/download
by Jackie 06 Dec '21

06 Dec '21

I had install FreeRadius 3.x+StrongSwan IKEv2 for the vpn service in Centos 7 how to limited user upload/download in freeradius? I had google not found any setup tutorial for freeradius 3.x Thanks

2 1