- Freeradius-Users - lists.freeradius.org

FreeRadius Accounting.
by Pizu 07 Apr '21

07 Apr '21

Hi, >From the proxy.conf is it possible to forward the accounting packets towards multiple firewalls? Currently am managing to send only towards only 1 firewall and the LDAP group is not being forward. Is it possible to have an example? as I cannot find anything in the documentation :( Regards, Pizu

2 6

query mschap with ntlm_auth samba4
by Nicolás Lopiano 07 Apr '21

07 Apr '21

Hello! Sorry for the inconvenience. I have been looking for information for a long time and could not find to solve the problem I am running into. My scenario is a vm with freeradius 3.0.17 joined to a samba4 domain with sssd, samba version 4.9.5-Debian. I need to get mschap to work via ntlm_auth. When making the query for ntlm_auth I have no problem and it works. But when making the query using mschap it gives me the following error: Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) ' Wed Apr 7 11:06:35 2021: Debug: (3) mschap: External script failed Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) Wed Apr 7 11:06:35 2021: ERROR: (3) mschap: MS-CHAP2-Response is incorrect Next I copy how I have the config files: cat /etc/samba/smb.conf [global] workgroup = DOMAIN netbios name = RADIUS realm = DOMAIN security = ads password server = DC.DOMAIN ntlm auth = mschapv2-and-ntlmv2-only winbind use default domain = no /etc/freeradius/3.0/sites-enabled/default authorize { chap mschap preprocess suffix eap { ok = return updated = return } ldap expiration logintime authenticate { Auth-Type MS-CHAP { mschap } Auth-Type ntlm_auth { ntlm_auth } Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } /etc/freeradius/3.0/mods-enabled/mschap mschap { with_ntdomain_hack = yes ntlm_auth = "/ usr / bin / ntlm_auth --allow-mschapv2 --request-nt-key --username =% {% {Stripped-User-Name}: -% {% {User-Name}: - None}} --domain =% {% {mschap: NT-Domain}: - MYDOMAIN} --challenge =% {% {mschap: Challenge}: - 00} --nt-response =% {% { mschap: NT-Response}: - 00} " pool { start = $ {thread [pool] .start_servers} min = $ {thread [pool] .min_spare_servers} max = $ {thread [pool] .max_servers} spare = $ {thread [pool] .max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } } I have tried several clients to check the service. He eapol_test and also radtest -t mschap. I can't find what the problem is any suggestion? Thanks a lot! Greetings.

2 1

Error: /etc/raddb/mods-enabled/mschap[10]: 'winbind' auth not enabled at compiled time
by Pizu 07 Apr '21

07 Apr '21

Hello, I am trying to use winbind and having the below error, can someone help? Error: /etc/raddb/mods-enabled/mschap[10]: 'winbind' auth not enabled at compiled time Error: /etc/raddb/mods-enabled/mschap[10]: Instantiation failed for module "mschap" My mschap config: MSCHAP configuration mschap { with_ntdomain_hack = yes use_mppe = yes require_encryption = no require_strong = no pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } passchange { } winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" } Centos Version 7.9 FreeRADIUS Version 3.0.13 Winbind Version 4.10.16 Regards, Pizu

4 7

moving from freeradius 2 to 3
by Brian Turnbow 07 Apr '21

07 Apr '21

Hello We have an outdated freeradius 2.0 setup that we are looking to upgrade to 3.0. The old setup has a mysql db and we have run into an issue trying to replicate the same configuration with 3.0. We have gotten everything installed and working but in our actual setup we use some regex expressions from the db such as NAS-Port-Type =~ ^(Ethernet|Virtual|PPPoEoVLAN)$ to filter nas port types or NAS-IP-Address =~ ^(192.168.0.11|192.168.0.227|192.168.0.34|192.168.0.244)$ to filter which nas users can connect from In 3.0 it seems that the use of regex from a db has been removed. Is there a way to make it work ? The goal We use different checks in different groups and assign the user to the correct group for the service he has purchased. If there is another way to accomplish this I am all ears. Thanks in advance Brian

3 3

Authenticate against FreeIPA PBKDF2_SHA256
by Marc Sauer 07 Apr '21

07 Apr '21

Hello, I would like to authenticate against our FreeIPA servers. The problem is that our passwords are stored in the following format: PBKDF2_SHA256 FreeRADIUS did not support this at all until version 3.0.22 [1]. The functionality has been merged into the v3.0.x branch in September 2020. Unfortonately it still does not work in 3.0.22 with FreeIPA passwords. The example-password I'm trying to authenticate against has the following content: {PBKDF2_SHA256}AAAIAEwR4+gKWf4IQAoqJWD7qwaUtanUiuYCJzD7ISaOwuvoBE4Ltq58p7hF4Or32gz2vrbGcD9JL7hUHoswrqGFlgCvDSNZD9MmuNePPk5SK/G3OdBMjZ6/6ioy5WJjKToPkE4cwsxL3F7nq0XzjvhzF9muy7I5HHSFYxxYCE92xk03JHi2Q1dlKqdsMDxF6wa50JO3aoVD6ZfqYr3It+JxzQTKrUS5JxHetbBdmm3WEhuMf4kgwfsCstE55kYfQCvB94D9Ro5s05MOgQulX9VyvOTB0xugOii290gLUssX1/qkacHVabTbA252kdxfguonASGEX7mpjJRskubgTHFadJ5i5TfodqvxJ/cghMaxZ1rkHXTZ9fBXxNZHltYHZVexhV3sJOq3Cq3eyvVuLfp3qwixPBJBWDC3Wv/mCSzdW5v6 When I try to authenticate against it, it shows the following error when running freeradius -X: (1) pap: Unknown header {PBKDF2_SHA256} in Password-With-Header, re-writing to Cleartext-Password (1) pap: Removing &control:Password-With-Header (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: ERROR: Cleartext password does not match "known good" password What I don't understand is, that FreeRADIUS says "Unknown header", although the PBKDF2_SHA256 support seems to be implemented. Is there anything wrong with my configration or is there still something wrong with the implementation of those kinds of hashes in FreeRADIUS? If I'd know C, I would love to help implementing the support. Maybe someone can help me with that. Cheers, Marc Sauer [1]: https://github.com/FreeRADIUS/freeradius-server/issues/2649 -- Marc Sauer Linux Systems Administrator Kunsthochschule für Medien Köln/ Academy of Media Arts Cologne Peter-Welter-Platz 2 50676 Köln https://www.khm.de https://en.khm.de tel: +49 221 20189 - 239 business mobile: +49 151 74230781

2 1

Fwd: Duplicate module "sql sql", in file /etc/freeradius/mods-enabled/sql
by rajabu kitindi 06 Apr '21

06 Apr '21

Folks I have no idea what's going on here, this is version 3.0.21 latest version. How do we solve this? I am running freeradius -X Raj -- MOTD: When we stop to think, we often miss our opportunity -- MOTD: When we stop to think, we often miss our opportunity

2 6

COA NAK simulation from server using radclient
by tejeswi 05 Apr '21

05 Apr '21

Hi Team, We are in need of your support to generate COA NAK message from server. Attached is the output of radiusd server output. Please help us in resolving this issue. Please note that we tried almost all possible ways to simulate COA NAk form server POV but no luck. -- ------------------------ Regards Tejeswi K -----------------------

2 6

Authorization problem in wireless networks in windows 10 for eduroam
by Vahap Can Dulkadiroğlu 31 Mar '21

31 Mar '21

Hello, For our university, we want to do Eduroam verification over FreeRadius (using version 3 and LDAP) using EAP-TTLS / PAP in Microsoft Windows 10 operating systems, but the password cannot be verified (access-challenge) because FreeRadius does not receive clear text. The same protocols (EAP-TTLS / PAP) are performed successfully for the Android operating system and ubuntu operating systems. As Freeradius stated in the directory settings, we think that the answer to this challenge is because there is no windows certificate compatibility. How can we solve this problem ? We look forward to your help. I share the relevant photos with you Vahap Can DULKADİROĞLU *Bilgi İşlem Daire Başkanlığı **/ Elektronik ve Haberleşme Mühendisi* *can.dulkadiroglu(a)samsun.edu.tr <can.dulkadiroglu(a)samsun.edu.tr>* 0(362) 313 00 55 - 1454 Canik Yerleşkesi Gürgenyatak Mahallesi Merkez Sokak No:40-2/1 CANİK/SAMSUN www.samsun.edu.tr *SAMSUN ÜNİVERSİTESİ* *‘‘Nitelikli Toplum İçin, Nitelikli Üniversite’’*

2 1

802.1x issues with different NAS' types
by Marco Miglietta 31 Mar '21

31 Mar '21

Hi. In order to solve the problem in passing VLAN related attribute during 802.1x authentication with Aruba AP, I found the post below useful. But this caused problems with VLAN assignment on Junipers switches during the 802.1x authentication process. What is a way to solve the problem? The solutions seem to be mutually exclusive. Thanks. Marco. ______________________________________________________________________________________________ Sending an attribute with the Access-Accept instead of Access-Challenge Phil Mayers p.mayers at imperial.ac.uk Wed Jan 12 18:00:05 CET 2011 Previous message: Sending an attribute with the Access-Accept instead of Access-Challenge Next message: Sending an attribute with the Access-Accept instead of Access-Challenge Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] On 12/01/11 16:33, Vivek Umasuthan wrote: > Hi All, > I am testing 802.1x support on our platform and I'm having trouble > figuring out how to include some attributes with Access-Accept. I read > the 'users' file man page but could not get the answer. You need to add the attribute in the "inner-tunnel" virtual server, and ensure you've set: use_tunneled_reply = yes ...in the "peap {}" section of "eap.conf" Previous message: Sending an attribute with the Access-Accept instead of Access-Challenge Next message: Sending an attribute with the Access-Accept instead of Access-Challenge Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] More information about the Freeradius-Users mailing list --

4 6

Mongo and operators
by Giedrius Baronas 31 Mar '21

31 Mar '21

Hello all, I try mongo db query in default instalation but I get error about key 'op' value ':=' witch is incorrect. How to solve the use of special characters in a mongo query? main/mongo/queries.conf <85 line> { \ '$project': { \ '_id': 0, \ 'attribute': '$attributes.k', \ 'value': '$attributes.v', \ 'op': ':=' \ } \ <92 line> } \ radius -X output: #(0) sql: ERROR: The op field for attribute ':= = (null)' is NULL, or non-existent. #(0) sql: ERROR: You MUST FIX THIS if you want the configuration to behave as you expect #(0) sql: ERROR: Value field is empty or NULL, skipping the entire row Giedrius Baronas www.baronai.lt

3 7