- Freeradius-Users - lists.freeradius.org

Freeradius, BYOD and certs
by Chris Bradley 03 Dec '21

03 Dec '21

Hi everyone! We're trying to update our freeradius so that it will work with Android 11+ clients without using the "do not validate" option. What we want to do is allow BYOD devices to connect to our freeradius server (using LDAP authentication) and connect by putting the domain entry in for connecting with an android. Freeradius is working fine with LDAP. Ultimately, I'm trying to put a certificate on the freeradius server so that BYOD clients (android 11+ specifically) can authenticate using LDAP *without* them having to download a certificate from somewhere before attempting the connection to freeradius. >From what I understand, I can't do that with a wildcard certificate or a self-signed one. So, if that's possible, I need some guidance on how to get it accomplished and what kind of cert I need to procure. Thanks! -- This message originated from Bartholomew Consolidated School Corporation, Columbus, Indiana. The message and any attachments may be confidential or privileged and are intended only for the individual or entity identified above as the addressee. This email should not be disseminated, distributed, or copied. If you are not the addressee, or if this message has been addressed to you in error, you are not authorized to read, copy or distribute this message or any attachments; and we ask that you please delete it and notify the sender by return e-mail. Delivery of this message and any attachments to any person other than the intended recipient(s) is not intended in any way to waive confidentiality or a privilege. All personal messages express views only of the sender, which are not to be attributed to Bartholomew Consolidated School Corporation, and may not be copied or distributed without this statement.

5 4

HTTP headers
by Stjepan Roić 02 Dec '21

02 Dec '21

Hi, I'm trying to set up EAP-TTLS wifi auth to REST API endpoint. I started with basic config and have local auth working but stuck on getting Access-Accept from the API. I have set up rest module but struggling to insert HTTP headers into the request. Can't find it in the docs and only previous topic I found is this one: http://lists.freeradius.org/pipermail/freeradius-users/2020-July/098472.html where you suggested how to insert headers in post auth methods. I tried the same in my authenticate just before "rest" but this doesn't work. update control { &REST-HTTP-Header :="secret: 1f215f4a27653bd17ddc54e320a1c61e37949fe5" &REST-HTTP-Header :="uuid: 84ce0574-5074-4b53-9ddc-fcb2c935a1b1" &REST-HTTP-Header :="Content-Type: application/json" } rest What is the correct way to insert HTTP header in the request for authentication sent to external REST server and what syntax should be used for multiple headers (I just multiplied rows here but not sure it should be like that)? Thank you

4 15

R: Re: FREERADIUS WITH MULTIPLE LDAP AUTHENTICATION SOURCES
by Diego Forcella 01 Dec '21

01 Dec '21

> Because you listed both modules in the authorization section as: > > authorize { > ... > domain1 > domain2 > ... > } > > The server doesn't know that the "domain1" module is for domain1.com. You have to tell it. You are right, i've listed both , not in authorize section but under authenticate section > You can do regular expression matches on the User-Name: > > if (User-Name =~ /(a)domain1.com/) { > domain1 > } > elsif (User-Name =~ /(a)domain2.com/) { > domain2 > } With your suggestion I tried radtest and works correctly, I then modified using (Realm == domain1) elseif (Realm ==domain2) and it works also in this way, thank you very much for your help I've another problem now, I need to use this with a captive portal that support only chap or ms-chapv2 and when a user try to login to captive portal configured with chap in freeradius log I have the error chap: ERROR: &control:Cleartext-Password is required for authentication or, if I set ms-chapv2 in captive portal, the error is (1) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (1) mschap: Creating challenge hash with username: xxx(a)xxx.com (1) mschap: Client is using MS-CHAPv2 (1) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (1) mschap: ERROR: MS-CHAP2-Response is incorrect It's possible to have chap (or ms-chapv2) and ldap working in freeradius? Thank's again for the support ------------------------------ INFORMATIVA PRIVACY (Reg.UE 2016/679 e D.Lgs.196/2003) Questa email ed i suoi eventuali allegati sono da considerarsi materiale riservato e di proprietà della scrivente società. Nel caso venisse ricevuta per errore non deve essere divulgata, copiata o distribuita per alcuna ragione. Le comunicazioni che transitano attraverso il presente indirizzo di posta elettronica hanno carattere e finalità prettamente lavorative, pertanto potranno essere conosciute all’interno dell’organizzazione aziendale. Qualsiasi dato personale sarà comunque trattato in conformità alle vigenti normative in materia di privacy e protezione dei dati personali. A tale riguardo potete esercitare tutti i diritti previsti dalla legge semplicemente rispondendo alla presente ed esplicitando la vostra richiesta. Maggiori info in materia di privacy: https://www.c2group.it/policy-privacy

2 5

Separating RADIUS Authentication and Accounting functionality
by Network RADIUS 01 Dec '21

01 Dec '21

** Why you should separate RADIUS Authentication and Accounting functionality (sometimes) --------------------------------------- Many ISP networks have Authentication and Accounting handled by the same databases. This configuration works for many situations, especially small and low-load systems. There are times, however, when it is beneficial to separate the functions of Authentication and Accounting. Doing so can increase performance, and scalability. Accounting requests can slow down authentication ISP customers expect to be able to access the network quickly and reliably. To provide a good customer experience, ISPs need the Authentication and Authorization functions to be extremely responsive to user requests. However, Accounting queries to do monthly billing statements can have an enormous impact if they are competing for resources with the Authentication queries. The solution here is to split the functionality in two. We recommend that ISPs deploy at least two separate RADIUS servers at each site. There should be a clear division of responsibilities between the servers. Read the full article… https://networkradius.com/articles/2021/02/10/separate-authentication-and-a… <https://networkradius.com/articles/2021/02/10/separate-authentication-and-a…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Re: Problem with limiting users to group in Active Directory
by Erik Frangež 01 Dec '21

01 Dec '21

Hi guys, I am still having problems to check if user is member of group... here is cut from logs where is comparison: (31) ldap1-vpn-student: EXPAND (sAMAccountName=%{User-Name}) (31) ldap1-vpn-student: --> (sAMAccountName=erik.frangez1) (31) ldap1-vpn-student: Performing search in "ou=um,dc=loki,dc=um,dc=si" with filter "(sAMAccountName=erik.frangez1)", scope "sub" (31) ldap1-vpn-student: Waiting for search result... (31) ldap1-vpn-student: User object found at DN "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap1-vpn-student): Released connection (0) (31) [ldap1-vpn-student] = ok (31) } # redundant = ok (31) policy check_ldap_group_vpn { (31) if (&ldap1-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") { (31) Searching for user in group "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" rlm_ldap (ldap1-student-um): Reserved connection (0) (31) Using user DN from request "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap1-student-um): Released connection (0) (31) User is not a member of "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" (31) if (&ldap1-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") -> FALSE (31) elsif (&ldap2-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") { (31) Searching for user in group "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" rlm_ldap (ldap2-student-um): Reserved connection (0) (31) Using user DN from request "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap2-student-um): Released connection (0) (31) User is not a member of "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" (31) elsif (&ldap2-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") -> FALSE (31) else { (31) [reject] = reject (31) } # else = reject (31) } # policy check_ldap_group_vpn = reject (31) } # Autz-Type LDAPS-VPN-STUDENT = reject If I run ldapsearch we could see that user is member of group, here: # IDM_VPN, Groups, QUEST, UM, loki.um.si dn: CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si objectClass: top objectClass: group cn: IDM_VPN description:: U2t1cGluYSBqZSBuYW1lbmplbmEgZG9zdG9wdSDFoXR1ZGVudG92IGRvIHN0b3Jp dGV2IFZQTi4gWiBuam8gdXByYXZsamEgSURNLg== member: CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si distinguishedName: CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si instanceType: 4 whenCreated: 20211118102555.0Z Please help me! Best, Erik On 11/29/21 9:38 PM, Alan DeKok wrote: > And I didn't notice in my last reply... > > don't email me off-list. The purpose of the list is to let everyone ELSE see what problems are being solved. Email the list. > > Any further emails sent directly to me will be ignored. > >> On Nov 29, 2021, at 3:07 PM, Erik Frangež <erik(a)frangez.net> wrote: >> >> Can you please help me? Thank you! >> >> >> >> -------- Posredovano sporočilo -------- >> Zadeva: Re: Problem with limiting users to group in Active Directory >> Datum: Sun, 28 Nov 2021 21:45:47 +0100 >> Od: Erik Frangež <erik(a)frangez.net> >> Za: Alan DeKok <aland(a)deployingradius.com> >> >> >> Hi Alan, >> >> here is whole log for one attempt: >> >> (74) Received Access-Request Id 42 from 164.8.15.42:54972 to 164.8.100.71:21812 length 71 >> (74) User-Name = "erik.frangez1" >> (74) User-Password = "*******" >> (74) Service-Type = Authenticate-Only >> (74) NAS-Port = 0 >> (74) NAS-IP-Address = 164.8.15.40 >> (74) # Executing section authorize from file /etc/raddb/sites-enabled/guard_vpn_student >> (74) authorize { >> (74) suffix: Checking for suffix after "@" >> (74) suffix: No '@' in User-Name = "erik.frangez1", looking up realm NULL >> (74) suffix: Found realm "NULL" >> (74) suffix: Adding Stripped-User-Name = "erik.frangez1" >> (74) suffix: Adding Realm = "NULL" >> (74) suffix: Authentication realm is LOCAL >> (74) [suffix] = ok >> (74) guard_vpn_student_file: users: Matched entry DEFAULT at line 1 >> (74) [guard_vpn_student_file] = ok >> (74) } # authorize = ok >> (74) Using Autz-Type LDAPS-VPN-STUDENT >> (74) # Executing group from file /etc/raddb/sites-enabled/guard_vpn_student >> (74) Autz-Type LDAPS-VPN-STUDENT { >> (74) redundant { >> (74) ldap1-vpn-student: EXPAND (sAMAccountName=%{User-Name}) >> (74) ldap1-vpn-student: --> (sAMAccountName=erik.frangez1) >> (74) ldap1-vpn-student: Performing search in "ou=um,dc=loki,dc=um,dc=si" with filter "(sAMAccountName=erik.frangez1)", scope "sub" >> (74) ldap1-vpn-student: Waiting for search result... >> (74) ldap1-vpn-student: User object found at DN "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" >> (74) [ldap1-vpn-student] = ok >> (74) } # redundant = ok >> (74) policy check_ldap_group_vpn_test { >> (74) if (ldap1-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") { >> (74) if (ldap1-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") -> FALSE >> (74) elsif (ldap2-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") { >> (74) elsif (ldap2-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") -> FALSE >> (74) else { >> (74) [reject] = reject >> (74) } # else = reject >> (74) } # policy check_ldap_group_vpn_test = reject >> (74) } # Autz-Type LDAPS-VPN-STUDENT = reject >> (74) Invalid user: [erik.frangez1] (from client guard port 0) >> (74) Using Post-Auth-Type Reject >> (74) Post-Auth-Type sub-section not found. Ignoring. >> (74) Delaying response for 1.000000 seconds >> (74) Sending delayed response >> (74) Sent Access-Reject Id 42 from 164.8.100.71:21812 to 164.8.15.42:54972 length 20 >> (74) Cleaning up request packet ID 42 with timestamp +19 >> >> >> >> User is part of group IDM_VPN on domain LOKI... >> >> Thank you for help! >> >> Best, Erik >> >> On 11/28/21 7:33 PM, Alan DeKok wrote: >>> On Nov 28, 2021, at 12:32 PM, Erik Frangež via Freeradius-Users <freeradius-users(a)lists.freeradius.org> >>> wrote: >>> >>>> I am having problems with configuring Radius authentication limiting users to group in Active directory. >>>> >>>> Here is configuration of LDAP: >>>> >>> We don't need to see that. >>> >>> Read >>> http://wiki.freeradius.org/list-help >>> >>> >>> >>> >>>> In sites-enabled for radius, I have specify this: >>>> >>> We don't need to see that, either. >>> >>> >>>> Authentication is not working. Here are logs: >>>> >>> Part of the logs. But whatever... >>> >>> >>>> rlm_ldap (ldap1): Reserved connection (0) >>>> (392) ldap1: EXPAND (sAMAccountName=%{User-Name}) >>>> (392) ldap1: --> (sAMAccountName=user) >>>> (392) ldap1: Performing search in "ou=ou,dc=domain,dc=dc,dc=dc" with filter "(sAMAccountName=user)", scope "sub" >>>> (392) ldap1: Waiting for search result... >>>> (392) ldap1: User object found at DN "..." >>>> rlm_ldap (ldap1): Released connection (0) >>>> (392) [ldap1] = ok >>>> (392) } # redundant = ok >>>> (392) policy check_ldap_group_vpn { >>>> (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { >>>> (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" >>>> >>> That seems wrong. "ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" ? Why the repetition? >>> >>> The default configuration works. The file mods-available/ldap has detailed instructions for getting it working with Active Directory. >>> >>> Follow the instructions, and it should work. >>> >>> >>>> User is member of group. Same configuration we are having for other domain and its working. >>>> >>> Is it *exactly* the same? i.e. with the same "ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" repetition? >>> >>> Alan DeKok. >>> >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html

2 1

FREERADIUS WITH MULTIPLE LDAP AUTHENTICATION SOURCES
by Diego Forcella 30 Nov '21

30 Nov '21

Hi all, I am trying to set up a single freeradius with multiple ldap servers to query. The goal is to have a single freeradius server authenticating users from different tenants. Ex: user(a)domain1.com must use only the ldap domain1 {} configuration user(a)domain2.com must use only the ldap domain2 {} configuration I configured the file /etc/freeradius/3.0/mods-available/ldap in order to have the 2 configurations ldap domain1 {} and ldap domain2 {} and the bind is correct The problem is that when I run a radtest the user is searched for both on domain1 and on domain2 and then the result is returned only for domain2 because it is the last one that is queried. I would like that if I make a query, domain1 or domain2 is used based on the suffix of the user I am querying I hope I was clear Thanks for your help Diego INFORMATIVA PRIVACY (Reg.UE 2016/679 e D.Lgs.196/2003) Questa email ed i suoi eventuali allegati sono da considerarsi materiale riservato e di proprietà della scrivente società. Nel caso venisse ricevuta per errore non deve essere divulgata, copiata o distribuita per alcuna ragione. Le comunicazioni che transitano attraverso il presente indirizzo di posta elettronica hanno carattere e finalità prettamente lavorative, pertanto potranno essere conosciute all’interno dell’organizzazione aziendale. Qualsiasi dato personale sarà comunque trattato in conformità alle vigenti normative in materia di privacy e protezione dei dati personali. A tale riguardo potete esercitare tutti i diritti previsti dalla legge semplicemente rispondendo alla presente ed esplicitando la vostra richiesta. Maggiori info in materia di privacy: https://www.c2group.it/policy-privacy

2 1

Seemingly obvious question
by Gregory Sloop 29 Nov '21

29 Nov '21

I'm running Ubuntu 20.04's packaged FR - and been happy with Enterprise-WPA using EAP-TLS on a single server - authenticating wireless clients. But we're putting more and more machines on E-WPA, and so the FR server becomes a critical resource. The obvious answer is to have two/multiple servers and that's a option in Unifi. (And most/all other Wifi AP's.) The question is: Since I'm just using certificates is there anything different that I really need to do, other than setting up the new server, essentially, identically to the first one? If I revoke certificates I understand I'll need to complete that process on both machines - essentially manually keeping them in sync. Do I have that right? (In this setup, both servers will use the same key and certificate - which means I can't revoke one and leave the other running, but that (revoking a server) really doesn't work anyway, since the clients don't look up a CRL somewhere reliable anyway. So, if I lose control of one of the servers, I'm screwed and will have to rebuild the entire PKI framework again, but that's going to happen even if I use different certs/keys for both servers. ...provided I conceptually understand things correctly.)

2 1

Problem with limiting users to group in Active Directory
by Erik Frangež 28 Nov '21

28 Nov '21

Hi guys, I am having problems with configuring Radius authentication limiting users to group in Active directory. Here is configuration of LDAP: ldap ldap1 { server = "Server" port = 389 identity = DOMAIN\user password = "password" basedn = "ou=OU,dc=domain,dc=dc,dc=dc" filter = "(sAMAccountName=%{User-Name})" groupmembership_filter = "(member=%{control:Ldap-UserDn})" groupmembership_attribute = "memberOf" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 user { filter = "(sAMAccountName=%{User-Name})" scope = "sub" base_dn = "ou=OU,dc=domain,dc=dc,dc=dc" access_positive = yes rebind = yes chase_referrals=yes } group { base_dn = "ou=OU,dc=domain,dc=dc,dc=dc" filter = "(sAMAccountName=%{User-Name})" scope = 'sub' membership_filter = "(member=%{control:Ldap-UserDn})" membership_attribute = 'memberOf' } tls { start_tls = no ca_file = "/etc/openldap/certs/ldap_certs.pem" require_cert = "demand" } dictionary_mapping = ${confdir}/ldap.attrmap keepalive { idle = 60 probes = 3 interval = 3 } } Policy: check_ldap_group_vpn { if (&ldap1-LDAP-Group[*] == "CN=group,OU=Groups,OU=OU,OU=OU,DC=DOMAIN,DC=DC,DC=DC") { ok } else { reject } } In sites-enabled for radius, I have specify this: authorize { suffix guard_vpn_file Autz-Type LDAPS-VPN { redundant { ldap1 ldap2 } check_ldap_group_vpn expiration } } Authentication is not working. Here are logs: rlm_ldap (ldap1): Reserved connection (0) (392) ldap1: EXPAND (sAMAccountName=%{User-Name}) (392) ldap1: --> (sAMAccountName=user) (392) ldap1: Performing search in "ou=ou,dc=domain,dc=dc,dc=dc" with filter "(sAMAccountName=user)", scope "sub" (392) ldap1: Waiting for search result... (392) ldap1: User object found at DN "..." rlm_ldap (ldap1): Released connection (0) (392) [ldap1] = ok (392) } # redundant = ok (392) policy check_ldap_group_vpn { (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" rlm_ldap (ldap1): Reserved connection (0) (392) Using user DN from request "CN=user" rlm_ldap (ldap1): Released connection (0) (392) User is not a member of "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") -> FALSE (392) elsif (&ldap2-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" rlm_ldap (ldap2): Reserved connection (0) (392) Using user DN from request "CN=user" rlm_ldap (ldap2): Released connection (0) (392) User is not a member of "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" (392) elsif (&ldap2-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") -> FALSE (392) else { (392) [reject] = reject (392) } # else = reject (392) } # policy check_ldap_group_vpn = reject (392) } # Autz-Type LDAPS-VPN = reject User is member of group. Same configuration we are having for other domain and its working. Thank you for any advise! Best, Erik

2 1

Freeradius 3.0.22 - mssql - Schema
by Clive Allen 28 Nov '21

28 Nov '21

Hi, I noticed that the mssql schema does not include a "nas" section that the "mysql" contains as follows: CREATE TABLE IF NOT EXISTS nas ( id int(10) NOT NULL auto_increment, nasname varchar(128) NOT NULL, shortname varchar(32), type varchar(30) DEFAULT 'other', ports int(5), secret varchar(60) DEFAULT 'secret' NOT NULL, server varchar(64), community varchar(50), description varchar(200) DEFAULT 'RADIUS Client', PRIMARY KEY (id), KEY nasname (nasname) ); I have converted this to "mssql" staments and created the nas table. However, the radtest that has proved successful does not seem to take any of the nas table entries but does take the username. For example, if I use the following inputs into the "nas" table: Server = <freeradius box> Shortname = <ServerName> Secret = secret User details: clive test123 := Cleartext-Password And then I utilise radtest as follows: radtest clive test123 localhost 1812 secret ---- I can try any combination here of localhost, IP address or name and get the same result. It does not even pass to mssql (no response at all). However, if I use the following: radtest clive test123 localhost 1 testing123 I get an access-accept. So, my question is - Does mssql with freeradius accept a "nas" table please?

1 1

rlm_sql_unixodbc: Errors
by Clive Allen 27 Nov '21

27 Nov '21

Hi Alan, Many apologies for not responding to your response to my issue. It was excellent that you responded so quickly. I have resolved the issue and mailing here so it will be available if anyone else has the same problem. For some reason, and unsure why, after following Microsofts installation process for the unix and ms - odbc drivers and then following the freeradius instructions for odbc installation it looked like the drivers were not present when running radius -X (even though unixodbc and msodbc were there afetr confirming). The way the issue was resolved was by completing the following: yum list freeradius-* We get the following appearing in the list: freeradius-unixODBC.x86_64 yum install freeradius-unixODBC.x86_64 I restarted mssql-server as a precaution and then ran radiusd -X and everything worked. I completed a radtest and got successful accept packet returned. Thank you for you help Alan. Very much appreciated. I do have another question but will ask that in a separate mail. Thank you again.

1 0