- Freeradius-Users - lists.freeradius.org

rlm_rest: Authentication by token?
by Michael Schwartzkopff 20 Dec '21

20 Dec '21

Hi, In the documentation of rlm_rest I see several auth methods documented. My REST API works with a header field where a token is passed: something like: curl -H "Authorization: Token $TOKEN" Is there a simple way to configure the rest module to generate this header or do I have to do something like: update control { REST-HTTP-Header := "Authorization: Token 0x123245678" } Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 2

calling python3 form dynamic-clients server
by Michael Schwartzkopff 19 Dec '21

19 Dec '21

I want to use a python3 module in the authorization section of the dynamic-clients server. When I use my python3 module in an other server I get data in the p structure. But p is empty if I call the module from dynamic-clients server. Any idea, what goes wrong? The output of the module is: (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { *** authorize *** *** radlog call in authorize *** None {} do_python_single:618, authorize - updateDict is not dictionary do_python_single:675, authorize - RLM_MODULE_FAIL (0) [python3] = fail (0) } # authorize = fail (0) } # server dynamic_clients Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 3

rest module and clients
by Michael Schwartzkopff 19 Dec '21

19 Dec '21

hi, when I look into the rest module of FreeRADIUS, I see the methods authorize and authenticate and others. Can I use the rest module for the clients of my FreeRADIUS setup? Yes if, how? Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

2 2

EAP TLS certificates - Questions
by Elias Pereira 18 Dec '21

18 Dec '21

hello, I have this scenario in full operation at my work. I came here to try to solve some doubts, in case someone who uses this scenario may have passed. In many cell phones with the android operating system they require the option "domain" to be configured. For example my phone is android and does not require this option to be filled in. The thing is, on phones that require it, the connection is failing because we have no idea how to set the "domain". We tried only the domain, we tried the FQDN, both in lowercase and uppercase. Any ideas to help me? -- Elias Pereira

4 13

Multiple Vlan assigment in Free radius server with Cisco Nexus Switch.
by deepak rawat 16 Dec '21

16 Dec '21

Hi, Our Cisco switch -3548X on version 9.3.2 is having a dot1x port based feature is enabled and connected to a free radius server for authentication. We are trying to give the multiple Vlan in the Free radius server user file so that Cisco can allow our two Vlan 1968 and Vlan1969. We are trying the below configuration in user file of freeradius server where we are giving the two Vlan but the cisco Auth vlan is coming as default. > > > Free radius user file config for Cisco switch > > E23D213926.XXX.com Cleartext-Password := "54321" > Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, > Tunnel-Private-Group-ID = "1968,1969" > > > Cisco Dot1x output > > Dot1x Info for Ethernet1/11 > ----------------------------------- > PAE = AUTHENTICATOR > PortControl = AUTO > HostMode = MULTI HOST > ReAuthentication = Enabled > QuietPeriod = 60 > ServerTimeout = 30 > SuppTimeout = 30 > ReAuthPeriod = 3600 (Locally configured) > ReAuthMax = 2 > MaxReq = 2 > TxPeriod = 30 > RateLimitPeriod = 0 > InactivityPeriod = 0 > Mac-Auth-Bypass = Disabled > > Dot1x Authenticator Client List > ------------------------------- > Supplicant = 58:45:4C:E7:B3:42 > Domain = DATA > Auth SM State = AUTHENTICATED > Auth BEND SM State = IDLE > Port Status = AUTHORIZED > Authentication Method = EAP > Authenticated By = Remote Server > ReAuthPeriod = 3600 > ReAuthAction = Reauthenticate > TimeToNextReauth = 2639 > Auth-Vlan = 1 > > > If we give only one Vlan1968 then our setup is working but our node which need a authentication from cisco/free radius has a two vlan 1968 and 1969 , So we are not able to reach the default GW of 1969 vlan if we put only one vlan assignment in Radius server. > > So can anyone know how to set the two vlan in free radius server and in which pattern in user file as it is quite complicated. > > Regadrs, > > Deepak Rawat > > >

5 15

Freeradius not sending traffic-shaping attributes randomly (Works when in debug mode)
by Antônio Modesto 16 Dec '21

16 Dec '21

Hello everyone, I am facing a strange problem with one radius server (FreeBSD 12.2 + FreeRADIUS 2.0.21). In a random way, Freeradius is not sending some traffic-shaping attributes in the Access-Accept to the NAS (I confirmed it with wireshark). What is puzzling me is that when I run radiusd in debug mode (-X), the problem disappears. I tried using raddebug but it uses a lot of CPU power, so it is not viable to run it in production. What do you guys suggest? -- Att, *Antônio Modesto*

3 7

Thanks with Questions
by mohamed almeshal 16 Dec '21

16 Dec '21

thanks alan this simple word for represent my appreciation . but I'm still struggle with one simple but not work for me I try to custom replay the message when user password is wrong and when I set auth-type reject for user I read all the documents but still no luck if (notfound) { update reply { Reply-Message := "%{sql: select messge_txt from replay_message where reply_id = 1 }" } reject } this work for me fine if the user is not found in the db , but for password error and auth-reject not working even it's so simple I miss the key for that , I'm using password-with-header please save me as always

2 1

About my questions
by mohamed almeshal 15 Dec '21

15 Dec '21

Dear Savers ... I'm using php just to call some accessory type functions that work with php not for authentication , I think that will not affect any thing and also I found this in docs sorry for interput. now my last dummy question is : I'm using password-with-header : so if the password is wrong what module is rejected so I can implement custom replay message I'm using pap and I try to some couples integers with no luck it's keeps on invalid username and password . also if I set auth-type = reject what is the module that reject to handle also custom replay message thanks for you all , but I'm realy realy thankful for your kind and your this lovely softwate

2 1

Configuring PAP authentication
by Network RADIUS 15 Dec '21

15 Dec '21

** Configuring PAP authentication ------------------------------------------ The first step to getting any authentication working in FreeRADIUS is to configure PAP (Password Authentication Protocol), or clear-text passwords. Even though most deployments will end up using additional authentication protocols, PAP is the simplest and easiest to configure, which makes it the perfect place to start. And as we will see, once PAP is configured, many other authentication protocols become simple, too. Read the full article... https://networkradius.com/articles/2021/09/29/configuring-PAP.html <https://networkradius.com/articles/2021/08/23/protocols-and-password-compat…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/contact/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Questions
by mohamed almeshal 15 Dec '21

15 Dec '21

Dear Savers .... First Thank you Alan .. first : I'm new at building exec script by php ... I do read some docs about exec and I found that to build my script for update some values and telegram messages I have to build modules . but the doc's always refer to raddb/modules but I have freeradius 3.0.25 and it's on etc I think the alternative is mod-enabled is that ok also in php script what is the variable should I use to represent of the %{User-Name} . Second : is the use of exec script not for auth just for some additional function will affect the speed of auth in present of unlag statments in defult config third : I use radsec for auth , what is the best way to determine the active online NAS that connected to freeradius box fourth : I read tons of doc about MAC Auth but I need the script to check that against last mac in radacct what is the best way to do that sorry for the long questions . mohammed

3 2