- Freeradius-Users - lists.freeradius.org

Freeradius Unlang Update ?
by Olivier CALVANO 19 Nov '20

19 Nov '20

Hello I have a quick question for simplicity: Currently I use: update reply { tunnel-Server-Endpoint: 0: = '172.16.1.1' tunnel-Client-Auth-Id: 0: = "LAC-172.16.1.1" tunnel-Server-Auth-Id: 0: = "LNS-172.16.1.1" Tunnel-Type: = "L2TP" Tunnel-Medium-Type: = "IPv4" Class: = "FTTH-TLM" Tunnel-Preference !* "" Framed-MTU !* "" Cisco-AVPair !* "" MS-Primary-DNS-Server !* "" MS-Secondary-DNS-Server !* "" Framed-IP-Address !* "" Framed-IP-Netmask !* "" Service-Type !* "" Framed-Protocol !* "" Port-Limit !* "" } I mostly need to send ONLY the first 5 attributes. do i have the option to delete all attributes in one command then put the 5 attributes i need? exemple: update reply { * !* "" tunnel-Server-Endpoint: 0: = '172.16.1.1' tunnel-Client-Auth-Id: 0: = "LAC-172.16.1.1" tunnel-Server-Auth-Id: 0: = "LNS-172.16.1.1" Tunnel-Type: = "L2TP" Tunnel-Medium-Type: = "IPv4" Class: = "FTTH-TLM" } thank you for your suggestion regards

3 2

Freeradius rlm_perl with Custom Perl
by Onur GURSOY 19 Nov '20

19 Nov '20

Hello everyone, currently, i can build freeradius rlm_perl successfully. But rlm_perl.se depends on libperl.so.5.26 => /usr/lib/x86_64-linux-gnu/libperl.so.5.26 but i want to use <foopath>/perl/lib/5.26.3/x86_64-linux-thread-multi/CORE/libperl.so How is this possible? This is problem for deployment point of view. Because I have custom perl which i build from source. and i want to use this instead of any other already installed perl which is in deployment machine. Many thanks With best regards -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

3 5

About Perl Flags in Rlm_Perl Config
by Onur GURSOY 18 Nov '20

18 Nov '20

Hello Everyone, rlm_perl is wonderful extension. including perl interpreter is good idea. but i have some trouble about perl flags in the perl module configuration. When i pass this to config it's ok. *perl_flags = "-T -I/opt/sinecins/rsc/scripts/radius"* But whe i pass this to config, perl has syntax error. *perl_flags = "-T -I<foopath>/scripts/radius -I<dummypath>/scripts/radius" * How can i pass *two include path* to perl module ? Many thanks, With best regards -- Onur GÜRSOY R&D Engineer in Embedded Systems Master Student at Gebze Institute Of Technology Department Of Electronic Engineering GSM : 0(545) 764 7653 e-mail: onurgursoygyte(a)gmail.com

3 2

LDAP authentication for Unifi wireless APs
by Erwin Rutgers 17 Nov '20

17 Nov '20

Hello freeradius community, To start off, this is my first post to the community so if there is anything I am doing wrong despite readying the help pages, please point this out to me and it will never happen again. Then to the plan and the problems: We are using Unifi Access points and like to switch to WPA-Enterprise authentication against our internal ldap. The ldap server is a freeipa server which contains the username and password for all of our users. After installation of freeradius, I entered a cleartext-password user in /etc/raddb/users and added the Aps as clients. In the Unifi controller, I configured a new RADIUS profile pointing to the freeradius server and added this to a test network. Wireless EAP authentication was successful. After that, I went on and configured the ldap module with the filters and ldap settings that apply for our freeipa server. That worked too then with a radtest command and I got a an Accept-Accept result with the credentials from a testuser in the ldap server. I already removed the Clear-text password user from the /etc/raddb/users file. From here on, I'm not quite sure on how to get both methods to connect properly. To get the ldap to work in the above test, I mainly wanted to prove that the freeradius ldap module was able to authenticate against our ldap at all. To get this to work I uncommented the following section in /etc/raddb/sites-available: Auth-Type LDAP { ldap } Your guides specifically stated that this should be avoided and when I ran a wireless connection test, the radiusd -X output gave a pretty clear message stating that setting Auth-Type will not work. So then, I disabled this section and ran another test. See the attached file: failed_attempt2.txt. Then I restored the /etc/raddb/mods-config/files/authorize file to it's original state and added "ldap" to the /etc/raddb/sites-available/default file instead of the Auth-Type LDAP part. I ran another test and added the debug information in file freeradius_debug2. Initially I chose for the ldap module instead of the ntlm_auth method because the ldap module allowed for better directory filtering to my liking. I did try to setup a samba ntlm connection to the freeipa server though, but the guides did not seem to work for freeipa. I hope this is enough information for anyone to work with. I'm looking forward to your insights. Thanks in advance and thank you for your time! Kind regards, Erwin

2 1

Create new accounting attributes
by Juan Diego 16 Nov '20

16 Nov '20

Hello everyone, I am new to working with FreeRADIUS and would appreciate your help. I would need to design new accounting attributes in a local environment, using either radclient or radeapclient as the client. As I have seen in the official documentation at https://networkradius.com/doc/current/concepts/dictionary/purpose.html, it is indicated that it is not necessary to modify the source code to add new attributes. I am confused with this, how would the client/NAS add the new accounting attributes to the radius package? Then, I understand that it is necessary to have a dictionary where the new accounting attributes appear so that the server can decode them. Please, if you know of any guide to implement new accounting attributes or what files need to be modified, I would greatly appreciate it. Thanks in advance and regards, John

3 3

expiration after one month, how?
by anisihadi2＠yahoo.com 14 Nov '20

14 Nov '20

Hello Dears I installed a freeradius server + mysql in centos 8 every thinks is ok but I want to expire one month after first login for a user. how can I do this. thank you about your great radius server. Best regard.

2 1

Automatic Yum upgrade of freeradius overwrite dictionary
by Rob Hughes 13 Nov '20

13 Nov '20

Hi, We have an auto yum upgrade on CentOS overwrite our /usr/share/freeradius/dictionary file last night. Is there a way to prevent this? Should we put $INCLUDE dictionary.whatever into /etc/raddb/dictionary instead? Regards Rob

2 1

Re: query on files under /etc/raddb/certs
by Dan Swartzendruber 13 Nov '20

13 Nov '20

Alan is on a roll, here! On November 12, 2020, at 7:14 PM, Alan DeKok <aland(a)deployingradius.com> wrote: On Nov 12, 2020, at 5:00 PM, SIMON BABY <simonkbaby(a)gmail.com> wrote: > > When I read the file README it says below content: Yes, please post that to the list. Because we haven't seen it before. > So can someone create a false certificate and key and create a session ? I think you didn't read my previous message. If someone breaks into your system, then having them read these certificate files is the LEAST of your worries. Stop worrying about useless things. If you want to know how the server uses these files, read the documentation and then default configuration files. > If we delete all these scripts also it is not possible to create any > certificate and we get complete control of where it gets the > certificates and keys ? Yes, because the scripts aren't available anywhere else on the Internet. Oh, wait... A secure system is *not* created by worrying about random things. A secure system is created by *understanding* things. Right now, you're asking very detailed questions, and not paying attention to the bigger picture. This is entirely the wrong approach. Your questions are irrelevant because they're based on a false understanding of how things work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

query on files under /etc/raddb/certs
by SIMON BABY 13 Nov '20

13 Nov '20

Hello, I see the files below are generated under /etc/raddb/certs directory. Can someone explain to me the usage of these files? Our system is very secure and did not want to create certs and keys dynamically. -rw-r--r-- 1 root 0 4393 Nov 5 18:47 01.pem -rw-r--r-- 1 root 0 4370 Nov 5 18:47 02.pem -rw-r----- 1 root 0 6155 Nov 5 18:42 Makefile -rw-r----- 1 root 0 8714 Nov 5 18:42 README -rwxr-x--- 1 root 0 2706 Nov 5 18:47 bootstrap -rw-r----- 1 root 0 1432 Nov 5 18:42 ca.cnf -rw-r--r-- 1 root 0 1256 Nov 5 18:47 ca.der -rw-r--r-- 1 root 0 1751 Nov 5 18:47 ca.key -rw-r--r-- 1 root 0 1757 Nov 5 18:47 ca.pem -rw-r----- 1 root 0 1103 Nov 5 18:42 client.cnf -rw-r--r-- 1 root 0 4370 Nov 5 18:47 client.crt -rw-r--r-- 1 root 0 1045 Nov 5 18:47 client.csr -rw-r--r-- 1 root 0 1743 Nov 5 18:47 client.key -rw-r--r-- 1 root 0 2581 Nov 5 18:47 client.p12 -rw-r--r-- 1 root 0 3545 Nov 5 18:47 client.pem -rw-r--r-- 1 root 0 424 Nov 5 18:47 dh -rw-r--r-- 1 root 0 229 Nov 5 18:47 index.txt -rw-r--r-- 1 root 0 21 Nov 5 18:47 index.txt.attr -rw-r--r-- 1 root 0 21 Nov 5 18:47 index.txt.attr.old -rw-r--r-- 1 root 0 120 Nov 5 18:47 index.txt.old -rw-r----- 1 root 0 1131 Nov 5 18:42 inner-server.cnf -rw-r--r-- 1 root 0 166 Nov 5 18:42 passwords.mk -rw-r--r-- 1 root 0 3 Nov 5 18:47 serial -rw-r--r-- 1 root 0 3 Nov 5 18:47 serial.old -rw-r----- 1 root 0 1125 Nov 5 18:42 server.cnf -rw-r--r-- 1 root 0 4393 Nov 5 18:47 server.crt -rw-r--r-- 1 root 0 1062 Nov 5 18:47 server.csr -rw-r--r-- 1 root 0 1751 Nov 5 18:47 server.key -rw-r--r-- 1 root 0 2589 Nov 5 18:47 server.p12 -rw-r--r-- 1 root 0 3576 Nov 5 18:47 server.pem -rw-r--r-- 1 root 0 3545 Nov 5 18:47 user(a)example.org.pem -rw-r----- 1 root 0 708 Nov 5 18:42 xpextensions Regards Simon

2 5

Status-Server requests are blocked if an Access-Request is waiting for downstream service to respond
by Ignacio Arces 12 Nov '20

12 Nov '20

Hello, I'm running a containerized FreeRADIUS server v3.0.19 with a custom authentication module written in C language that authenticates users through a HTTP API. I also configured the Status server as detailed in https://wiki.freeradius.org/config/Status and I'm using it to monitor my server by sending Server-Status requests using raclient to health check my server. We recently experienced an outage in the auth API and since we didn't have timeouts properly configured in the curl calls in our custom C module, the requests were hanging indefinitely. When this happened, we also noticed that our containerized server was restarted by Docker as the container was set to "Unhealthy" state, so the health checks were failing. Troubleshooting the health checks we found that Status-Server requests were not responding while the auth request was hanging waiting for the auth API to respond. Now that we have a 10s timeout properly configured in our curl requests, we have mitigated the undesired restarts but we still can understand why even a single stuck auth request is impacting Status-Server request.

2 4