- Freeradius-Users - lists.freeradius.org

How to integrate Freeradius with Oracle Database XE(18c)?
by Sajib Nandi 03 Apr '20

03 Apr '20

I have installed Freeradius and Oracle Database 18c XE. FreeRADIUS Version 3.0.20 -- it's working fine locally Oracle Database XE working fine. But I can not integrate Freeradius with Oracle Database. I need help regarding this How can I integrate Freeradius with oracle database. anyone can help? Thanks Nandi

5 9

Freeradius 3.0 and realms
by Anthony Stuckey 02 Apr '20

02 Apr '20

Is there good documentation of the changes made to realms between freeradius 2 and freeradius 3? We're trying to get windows machine login to work, and we're having the same problem as before. Once the machine is joined to the domain, Windows appends the domain to the machine name. We need to strip the domain off to find the proper identity. In freeredius 2, I was able to define a realm which did that, but that format no longer works for freeradius 3, and there seems to be no useful breadcrumb for how to create the new style realm.

2 1

openldap-ltb conflicts with package symas-openldap-servers
by Dave Macias 02 Apr '20

02 Apr '20

Hello, Saw the new 3.0.21 release email and wanted to try instead of the centos pkgs. Used this wiki https://networkradius.com/freeradius-packages/ but get a conflict: $ yum install freeradius Updating: ... ... ... Install ( 3 Dependent packages) Upgrade 1 Package (+2 Dependent packages) Total size: 11 M Is this ok [y/d/N]: y Downloading packages: warning: /var/cache/yum/x86_64/7/networkradius/packages/freeradius-config-3.0.21-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 41382202: NOKEY Retrieving key from file:///etc/pki/rpm-gpg/packages.networkradius.com.gpg Importing GPG key 0x41382202: Userid : "Network RADIUS Support (package signing) < packages(a)networkradius.com>" Fingerprint: 86e3 c308 3f30 8400 a898 5d2a be18 fc5a 4138 2202 From : /etc/pki/rpm-gpg/packages.networkradius.com.gpg Is this ok [y/N]: y Running transaction check Running transaction test Transaction check error: * file /usr/lib/systemd/system/slapd.service from install of openldap-ltb-2.4.49-1.el7.x86_64 conflicts with file from package symas-openldap-servers-2.4.49-1.el7.x86_64* Error Summary ------------- My current environment: 3.10.0-1062.18.1.el7.x86_64 CentOS Linux release 7.7.1908 (Core) Using centos repo pkg freeradius 3.0.13 How can i resolve? Please let me know if you need more information from me. Any input is much appreciated! Thank you, Dave

3 4

Debian 10 fresh install warnings
by Marcin Romanowski 02 Apr '20

02 Apr '20

Hello Fresh instal includes warnings: freeradius -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors ... reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". [...] Shoud I worry about it?

3 3

ipv6 address in users file
by Marcin Romanowski 30 Mar '20

30 Mar '20

Hello, I have problem with provide IPv6 from users file. I use files as redundant when sql will broke. in file: 2001:db8:2:8000:: Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000', Cisco-Avpair += 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT', Framed-IPv6-Prefix = '2001:db8:2:8000::/56', Idle-Timeout = 10800, Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' for ipv4 I have 192.168.1.12 Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000', Cisco-Avpair += 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT', Cisco-Avpair += 'subscriber:keepalive=interval 10', Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' and it works, but for ipv6 doesn't Debug says that radius can't find user :/ (0) Received Access-Request Id 94 from 10.249.1.202:1645 to 10.249.1.203:1912 length 152 (0) User-Name = "2001:DB8:2:8000::" (0) User-Password = "cisco" (0) Framed-IPv6-Prefix = 2001:db8:2:8000::/56 (0) Calling-Station-Id = "00:00:00:00:00:00" (0) NAS-Port-Type = PPPoEoE (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/0" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 10.249.1.202 (0) Acct-Session-Id = "00001200" (0) NAS-Identifier = "ASR_1" (0) Event-Timestamp = "Mar 30 2020 09:39:28 CEST" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/ikam-isg.server (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "2001:DB8:2:8000::", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) redundant { (0) ikam-isg: EXPAND %{User-Name} (0) ikam-isg: --> 2001:DB8:2:8000:: (0) ikam-isg: SQL-User-Name set to '2001:DB8:2:8000::' rlm_sql (ikam-isg): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (ikam-isg): Opening additional connection (0), 1 of 64 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname=bcman host=localhost user=bcman password=bcman rlm_sql_postgresql: Connection failed: could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (ikam-isg): Opening connection failed (0) *(0) [ikam-isg] = fail(0) [files] = noop* (0) } # redundant = noop (0) [expiration] = noop (0) [logintime] = noop *(0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type(0) pap: WARNING: Authentication will fail unless a "known good" password is available* (0) [pap] = noop (0) } # authorize = ok *(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject(0) Failed to authenticate the user* (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/ikam-isg.server (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 2001:DB8:2:8000:: (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 94 from 10.249.1.203:1912 to 10.249.1.202:1645 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 94 with timestamp +6 FreeRADIUS Version 3.0.16 Where I'm doing mistake? Best regards Marcin

3 4

Logs ip
by Клеусов Владимир Сергеевич 27 Mar '20

27 Mar '20

Hi I have two servers. One of the logs shows the ip address, but the other does not. How to set up logs in the form Auth: (140) Login OK: [ip_10.65.150.1/j0cgtr19MCVH] ?

3 3

Version 3.0.21 has been released
by Matthew Newton 24 Mar '20

24 Mar '20

As promised a couple of weeks or so ago, version 3.0.21 has now been released. Full release notes are available on the web site: https://freeradius.org/release_notes/?br=3.0.x&re=3.0.21 This is mainly a bugfix release, however there have been some new features. Specifically this release has quite a number of database related improvements, with thanks to Terry Burton. Apart from that most other updates were bug fixes, build improvements or dictionaries. Download from the usual places: https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_21 Packages are building and will be available on the Network RADIUS web site shortly: https://packages.networkradius.com/ Docker images will also be available on Dockerhub soon: https://hub.docker.com/u/freeradius -- Matthew

1 0

pam_radius_auth with Framed-IP-Address
by António Silva 24 Mar '20

24 Mar '20

Hi, How to get the "Framed-IP-Address" attribute from the Access-Accept replay from the radius server? Is it possible? Thanks. note: not sure if this is the right mailing to ask this question, sorry if is not.. -- Saludos / Regards / Cumprimentos António Silva

2 6

Special character not showing in RADPOSTAUTH
by JAHANZAIB SYED 24 Mar '20

24 Mar '20

WE have enable radpostauth to record unsuccessful dialing attempt. Passwords with special characters are not showing properly in radpostauth table. Example username: zaib password: myp@$$^&*w0rd In radpostauth I see this zaib myp@=3D24=3D24=3D5E=3D26=3D2Aw0rd Access-Reject RADPOSTAUTH config is below: query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, reply_msg, authdate, nasipaddress, mac) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%{reply:Reply-Message}', \ '%S', \ '%{NAS-IP-Address}', \ '%{Calling-Station-Id}')" } Regards, J. <http:///>

2 1

Freeradius 3 - Multiple sub-domains - NTLM/SAMBA
by Gregorio Luján Carboneras 23 Mar '20

23 Mar '20

Hello. Could you please give me any advice regarding how to configure freeradius 3 (PEAP-MSCHAP2), to works with multiple sub-domains via NTLM/SAMBA? I need to authenticate users from multiple sub-domains in “User Principal Name (UPN)” format: -Example: user1(a)domain.com<mailto:user1@domain.com> user2(a)it.domain.com<mailto:user2@it.domain.com> user3(a)sales.domain.com<mailto:user3@sales.domain.com> I have joined the freeradius to the active directory. When I request the users informatation via “wbinfo” command, I don´t obtain the domain information (only usernames). And only appears users from the principal domain (domain.com) -Example: Freeradius# wbinfo –u | grep user user1 Actually I don't really understand how the authentication between the freeradius and the AD is performed (via NTLM, SAMBA, Kerberos ... ???) Could someone please provide me with a link to documentation so I can understand it? Thank you very much De manera general, “ANADAT TECHNOLOGY, S. L.” garantiza la adopción de las medidas necesarias para asegurar el tratamiento confidencial de los datos de carácter personal, y le ofrece la posibilidad de ejercer su derecho de acceso, rectificación, supresión, oposición, portabilidad, limitación y decisiones individualizadas al tratamiento de sus datos personales, en los términos y condiciones previstos en el Reglamento General de Protección de Datos (RGPD), a través del correo electrónico info(a)anadat.es<mailto:info@anadat.es> . La información confidencial que pudiera contener este mensaje está destinada para ser leída únicamente por el destinatario. Nadie excepto él podrá leer, usar, publicar o reproducir el contenido parcial o total de este mensaje. En caso de recibir un mensaje por error, por favor notifíquelo al remitente lo antes posible.

3 4