- Freeradius-Users - lists.freeradius.org

using huntgroups to restrict users in particular groups
by Root, Paul T 01 Jun '20

01 Jun '20

Hi, I'm new to FreeRadius. I've built a test server with freeradius 3.0.13, mariadb 10.1.45, and daloradius 1.1-3 beta on CentOS 7. We are just starting into radius authentication. We just want it for logging into routers and switches for administration work. What I need is to define multiple groups of devices - in huntgroups. And multiple groups of users. There may be a base group of users that should be allowed to any huntgroup. But mostly, one user group is to be specific to one hunt group. I'm following the how-to for SQL-Huntgroups. https://wiki.freeradius.org/guide/SQL-Huntgroup-HOWTO MariaDB [radius]> select * from radhuntgroup; +----+-----------------+----------------------+--------------+ | id | groupname | nasipaddress | nasportid | +----+----------------+-----------------------+--------------+ | 1 | group1 | 10.161.161.0/24 | 0 | | 2 | group2 | 10.139.63.0/24 | 0 | +----+---------------+------------------------+-------------+ MariaDB [radius]> select * from radusergroup; +---------------+-----------------+-----------+ | username | groupname | priority | +---------------+-----------------+-----------+ | paul | usergroup1 | 0 | | ptr | usergroup2 | 0 | +---------------+-----------------+-----------+ MariaDB [radius]> select * from radgroupcheck; +----+--------------------------------------+-------------------+-----+-----------+ | id | groupname | attribute | op | value | +----+--------------------------------------+-------------------+-----+-----------+ | 1 | daloRADIUS-Disabled-Users | Auth-Type | := | Reject | | 2 | daloRADIUS-Disabled-Users | Auth-Type | := | Reject | | 3 | usergroup1 | Huntgroup-Name | == | group1 | | 4 | usergroup2 | Huntgroup-Name | == | group2 | +----+--------------------------------------+-------------------+-----+-----------+ However, both users can connect to either huntgroup. I must be missing something here. My impression is that this would be all that's needed. Maybe there is a configuration variable I missed? I also tried the update request to allow users groups/profiles to access a different has but if I edit sites-enables/defaults, I get an error trying to start radius. update request { Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress=='%{NAS-IP-Address}'}" # only allow usergroup1 to group1 if (SQL-Group == "usergroup1") { if (Huntgroup-Name != "group1") { reject } } } /etc/raddb/sites-enabled/default[307]: Entry is not in "attribute = value" format That's simplified but pretty much straight out of the how-to. I'm not stuck on the idea of daloradius or even SQL. But the user space will be managing, and they want a web admin. I could write my own simple one, as all we need to manage is users and huntgroups. Any ideas here? Thanks, Paul. Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root(a)centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 2

Freeradius 3 with LDAP Authentication Bind as User
by Jason Leiby 01 Jun '20

01 Jun '20

Hi Experts, I am trying to setup my radius server to authenticate users with their AD password. I do not have access to our corporate Active Directory so I cannot use Samba and winbind, I only have access to the LDAP server that ties into AD. Each user has read only access to LDAP so they can bind with the correct credentials and verify the password. I have successfully setup freeradius to connect to the LDAP server and verify credentials as long as the ‘identity’ and ‘password’ are provided in the ldap module. What I would like to do is bind as the verifying user instead of using a single account. Scouring the internet has proven fruitless, so I was hoping you can point me in the correct direction. I am happy to provide logs and configs if needed. I would first like to confirm that this is feasible. Thank you, Jason

3 7

Windows Clients with SSID {2,3,4 suffix}
by Ted Hyde (RSI) 29 May '20

29 May '20

Greets - this isn't specifically a question regarding FR, but I believe it has enough relevance to the list, as well as FR in a slightly abstracted way (perhaps the solution rather than the situation). I have been using FR to handle my radius auth, split between networking devices and clients for wireless AP for a number of years. The majority of my hardware is Cisco, with AP's both as autonomous and LWAPP with a WLC. I've been seeing it for quite a while now (from Win 10 forward at least) - and to a particular end have just "lived with it" however am wondering if there has been any solution observed - particularly since there is a large distribution of transient clients in the eduroam sector. The problem? Multiple APs for coverage show mutiple SSIDs in the windows wireless network selector. Thus you get MYSSID, MYSSID 2, MYSSID 3 and so on in some attempt to rationally allow the user to choose the AP they want to connect to. I have been googling for a while now - far too many rabbit holes with little solid results - and have come across reasoning such as "you don't want to choose the rogue AP, so this alerts you" and "this lets you choose the strongest AP in the area" etc. My android devices don't do this, the Mac and IOS clients I service don't do this, my Linux clients don't do this - everyone but Windows seems to have the ability to automatically roam and not present multiple variants with suffix numbers in the SSID list. The problem with the multiple SSIDs in the list is really that sometimes windows comes back with the "can't connect to this network' error, which really impresses people for sure! (not). Of course it would be awesome for someone to pipe up and say "here's the registry setting and done", but it may not be as simple as that, understood. So some more configuration info: I do run a mix of autonomous AP's/LWAPP APs in an area, which I choose is based upon device count - typically if I'm only doing coverage for 3 or 4 APs - the expense and hassle of a WLC often isn't warranted. I also have typiclly 3-7 SSIDs (thus mbssid options are on) supporting the network; not all SSIDs are present on all bands, nor on all APs - however a lab scenario with 3 APs and identical configs in a 2.4ghz only setup showed the exact same results, so I am not expecting the more advanced config to be a culprit. For encryption, I'm typically configured for aes-ccm and tkip. I run multiple models of AP's typically with their most recent firmware, and mostly a/b/g/n, 2.5Ghz/5Ghz with only a very little ac. However this may be the kicker: some clients don't have the ability to run an enterprise auth method - so it's WPA2/PSK for them. Thus I have a mix of authentication - the PSK is at the AP itself, and anything enterprise (like EAP-TLS) is pushed forward to an FR instance. Interestingly, the EAP-TLS SSID's don't show the suffixes all the time - if I hover with my laptop it takes quite a while for Win10 to start showing SSID 2 for them, while anything that was WPA2/PSK is immediately shown as multiple SSIDs with suffixes. Thus the overall question here is less FR and more about picking folks' brains, wherein the solution may be provided by FR using a different auth key management path than the local WPA2-PSK (although I have never attempted such). But either way, Many thanks, Ted.

1 0

Bulk and Active leasequeries
by Ivane Porchkhidze 29 May '20

29 May '20

Hello, This is my first letter to this mailing list and I apologize in advance for possible errors in the format or content of the letter. Brief introduction, our subscribers (GPON, aDSL) receive IP addresses from DHCP server (FreeRADIUS 3.0.14 + MySQL 5.7) in accordance with opt82. In the case of aDSL, there is also a RADIUS server (same FreeRADIUS 3.0.14 + MySQL 5.7), which sends to cisco ISG policie for customer according to ip address. Everything worked just fine until arrival of BNG from Juniper. This device requires Bulk and Active leasequeries. After several days of searching in google, I got the impression that this is not supported in version 3.0.x? Or am I doing something wrong? What about 4.0.0? Best regards, Ivane Porchkhidze This message (including any attachments) is confidential and may be privileged. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. Silknet shall not be responsible nor liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. Silknet does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference

2 4

Wifi + Active Directory without ntlm
by Клеусов Владимир Сергее вич 28 May '20

28 May '20

Hi, Source data: Active directory freeradius 3.0.21 In /etc/freeradius/mods-enabled/mschap ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key —domain=DOMAIN.COM<http://domain.com/> --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" Freeradius ldap module installed and configured Question: Is it possible to configure freeradius with Active Directory without ntlm ? If possible, how ? )

5 15

SQL SELECT statement
by Charly 19 May '20

19 May '20

Hello, I would like to update Cisco-AVPair attribute using a SQL request : update reply { Cisco-AVPair += "%{sql:SELECT value FROM radreply WHERE username = '%{User-Name}' AND attribute = 'Cisco-AVPair' ORDER BY id}" } But only the first row is returned. Charlye

2 7

Is it possible? CoA disconnect packet communication between radius 3 and Unifi AP Clients
by Luis Gutierrez 18 May '20

18 May '20

Hello, I am new to this mailing list. I will be brief, I need an AAA server over a network of Ubiquiti AP Unifi, I have to say that it was not difficult for me to install a freeradius 3.0.x server. My problem: But I can't disconnect devices, using CoA packets: echo User-Name = 'user' radclient 127.0.0.1:3799 disconnect testing123 I consult them: Someone managed to use the CoA disconnect packets between a freeradius 3.0.X server and AP's ubuquiti Unifi AP. I have read the ubiquiti forums without clear results. Greetings and thanks. -- Luis Gutierrez Cruz Movil: 71255832 Twitter: @LuisBPS

2 1

CHAP Authentication with rlm_perl module
by Imdad Hasan 16 May '20

16 May '20

So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible?

2 7

Remove my email from liste free radius
by rafik.benchemekh＠sofrecom.com 16 May '20

16 May '20

Hello Would you please remove my email from freeradius_user@list Thank you Rafik

2 1

SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad record mac
by Jim Shi 15 May '20

15 May '20

Hi, When I run eapol_test with PEAP/MSCHAPv2, I got the following error: SSL: (where=0x4008 ret=0x214) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:bad record mac EAP: Status notification: local TLS alert (param=bad record mac) OpenSSL: tls_connection_decrypt - Decryption failed - SSL_read error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac SSL: Failed to decrypt Phase 2 data Any idea why I am getting this error? Thanks Jim

2 1