- Freeradius-Users - lists.freeradius.org

PEAP-MSCHAPv2 replace snakeoil certificates
by Olivier Mahieu 11 Jan '20

11 Jan '20

Hello, I'm configuring a FreeRadius Ubuntu server to replace Windows NPS server. The Domain Controller is CA as well. The server is part of the domain and MSCHAP is configured. The "$ radtest -t mschap testuser testpassword 127.0.0.1 0 testing123" works as well. Now, I want to replace the snakeoil certificate by a generated server certificate, signed by Windows CA. I generated freeradius.cer (Signed by Win CA), freeradius.key and placed them in dir's below. ALso the Win root CA, I added in /usr/local/share/ca-certificates. [cid:6be2c43b-7b4f-4a79-8e69-5af486a693d9] Following, when I change eap like below; even with absolute path instead of ${certdir}; I get freeradius failure. [cid:a314427e-f5f0-4a90-8005-83d5d8032453] Systemctl restart freeradius: failure. radtest -t fails as well... Can someone point me the right direction? Thanks!!! Olivier

3 4

Package Repos Empty for Centos 6
by Nicolas Breuer 10 Jan '20

10 Jan '20

Hello, http://packages.networkradius.com/releases/centos/6/ Can you check why the repo directory is empty ? Thanks

2 5

Multiple radius clients from one IP
by Xander Lammertink 10 Jan '20

10 Jan '20

Hi all, I was working on setting up FreeRADIUS, however I came across the following problem: I'd like to have the clients of my access point with multiple SSIDs to authenticate using radius. The way I tried to set this up was by creating multiple clients each having their own secret and refer to a virtual server. Based on the radius client, the preferred virtual server would be chosen that would select the desired authentication mechanism. However, when I create two clients with the same "ipaddr" (which is the case for my access point), I get the following error: freeradius[1234]: Failed to add duplicate client client_name When reading the link below I see it's possible to use my approach, except the ipaddr thing is making stuff difficult. https://networkradius.com/doc/3.0.10/raddb/sites-available/home.html So is there a way to have multiple clients authenticate from the same IP address (each referring to another virtual server) without listing on multiple tcp/udp ports? Thanks for your help! Current non-working high-level configuration: listen { ... } client one { ... ipaddr = 10.0.0.2 virtual_server = server_one } client two { ... ipaddr = 10.0.0.2 virtual_server = server_two } server server_one { authorize { ... } ... } server server_two { authorize { ... } ... }

3 4

Match on undefined attribute.
by Matthew Schumacher 10 Jan '20

10 Jan '20

List, I can't seem to write a simple condition to match on a missing attribute. I just want to do this: if( ! &reply:Filter-Id ) { update reply { Vendor-Address-List := foo } } However, that always returns true, even if Filter-Id isn't returned in the Access-Accept. If I try: if( &reply:Filter-Id == "" ) { update reply { Vendor-Address-List := foo } } Then when Filter-Id isn't set, I get: ERROR: Failed retrieving values required to evaluate condition And no match. What is the correct way to match on missing reply attributes? Thanks, schu

3 3

How to use LDAP Group attributes in post-auth section?
by uj2.hahn＠posteo.de 09 Jan '20

09 Jan '20

Hi! I use freeradius 3.0.17 with LDAP module for a school. There are different LDAP groups (e.g. students and teacher). WLAN login time should be limited but differently for different groups. In freeradius I already extracted the LDAP group the user belongs to and I know how to limit the logintime (Current-Time == "wk1602-0800") or so. But of course I don't want to hardcode the group specific time strings. Idea is to define group attributes in LDAP which contain these strings. - Is it possible to map _group _specific attributes into LDAP module of freeradius, may be some code snippets as template.... - so far I use OpenLDAP as training vehicle. Here I can add a radius scheme. But final solution has to be (existing) Active Directory. Is above method usable there as well? - May be there is a completely different solution out there I'm not aware of. Any hints are very welcome! Thanks Uwe

3 5

Check to Allow user from a specific site (WISPr-Location-ID)
by Safiullah Tariq 09 Jan '20

09 Jan '20

Hello All, I have started using Daloradius and the Freeradius version 3 and found it wonderful. However, I still need some help. I have a unique situation which needs help. I have multiple sites which have been installed with mikrotik routers. I have installed RADIUS on a single location and made it the single point for user hotspot user (on Mikrotik) authentication. I have manually installed Freeradius and on top of that, installed daloradius by following the instruction on the following website: https://computingforgeeks.com/how-to-install-freeradius-and-daloradius-on-u… What I have achieved is: When a user wants to login, he is allotted XYZ speed limit with XYZ idle time and XYZ simultenous users. What I have Done: For testing purpose, I have made Reply Attributes: Fall-Through: value 1 , Op = Check Attribues: Auth Type: Value Reject, Op := WISPr-Location-ID: Value Site1, Op != What the above does is, it checks that if the user is trying to login from a site where the WISPr-Location-ID is now Site1, it rejects the user. And if the the WISPr-Location-ID is Site1, it allows the user to login. This works fine as I want. What my Goal is (what I want to do and have not been able achieve is): When the user is actually at the Site1 (where he is allowed), if I apply the Reply attribute of Speed limit, idle-timeout and (check attribute) simultaneous user; they don't get applied. In short I want: if the user is at site1, allow the user and apply this speed limit, idle timeout and simultenous users limit Otherwise, reject and do not allow on the network. Can anyone please help me in this regard? Regards, Safiullah Tariq

1 0

Group checking in LDAP module
by uj2.hahn＠posteo.de 08 Jan '20

08 Jan '20

Hi, I have some (probably) basic questions how to deal with Group checks in LDAP module. I setup LDAP with OpenLDAP and authorization works fine. Now I want to extend functionality by some group related post-auth checks. Each user is a member of a group. Some users are members of more than one group. freeradius -X shows me the following lines: (0) ldap: Group DN "cn=lehrer,ou=groups,dc=kms,dc=de" resolves to name "lehrer" (0) ldap: Resolving group DN "cn=gast,ou=groups,dc=kms,dc=de" to group name (0) ldap: Performing unfiltered search in "cn=gast,ou=groups,dc=kms,dc=de", scope "base" (0) ldap: Waiting for search result... (0) ldap: Group DN "cn=gast,ou=groups,dc=kms,dc=de" resolves to name "gast" (0) ldap: Adding cacheable user object memberships (0) ldap: &control:LDAP-Group += "lehrer" (0) ldap: &control:LDAP-Group += "gast" This is all fine because the user belongs to two groups. My assumption is, that control:LDAP-Group now contains both group names, e.g. "lehrer gast". For debugging purposes I output the value as reply message in the post-auth section. But logfile says: (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update reply { (0) EXPAND %{control:LDAP-Group} (0) --> lehrer (0) Reply-Message := lehrer Here the output is just the first group name, the other one is missing. Why is that? ------------------------------------------------------------------------------------------------------------------------------------ And there is a second question: LDAP module has a check filter in the group section : membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" During run time this filter does not generate any output: (0) ldap: EXPAND (&(objectClass=groupOfNames)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (0) ldap: --> (&(objectClass=groupOfNames)(|(member=uid3duhahn2cou3dpeople2cdc3dkms2cdc3dde)(memberUid=uhahn))) (0) ldap: Performing search in "ou=people,dc=kms,dc=de" with filter "(&(objectClass=groupOfNames)(|(member=uid3duhahn2cou3dpeople2cdc3dkms2cdc3dde)(memberUid=uhahn)))", scope "sub" (0) ldap: Waiting for search result... (0) ldap: Search returned no results (0) ldap: No cacheable group memberships found in group objects This is strange. When I run ldapsearch with same filter I do get results: ldapsearch -x -LLL -H ldap:/// -b dc=kms,dc=de -s sub "(&(objectClass=groupofnames)(|(member=uid=uhahn,ou=people,dc=kms,dc=de)(memberUid=jhahn)))" dn: cn=lehrer,ou=groups,dc=kms,dc=de cn: lehrer description: All users objectClass: groupOfNames objectClass: top member: uid=uhahn,ou=people,dc=kms,dc=de member: uid=mmeier,ou=people,dc=kms,dc=de dn: cn=gast,ou=groups,dc=kms,dc=de cn: gast description: All users objectClass: groupOfNames objectClass: top member: uid=gast,ou=people,dc=kms,dc=de member: uid=uhahn,ou=people,dc=kms,dc=de What's wrong here? Thanks a lot for help Uwe

2 2

Odp: Re: eap-tls with valid and fake certificates.
by codythejack 08 Jan '20

08 Jan '20

Hi ! Thanks for help. MM Dnia 27 grudnia 2019 23:42 Matthew Newton <mcn(a)freeradius.org> napisał(a): On Fri, 2019-12-27 at 17:47 +0100, codythejack wrote: Hello ! The Idea is to authenticate users with eap-tls with certficates. People without any certificate should use different vlan provided by Radius. Only supported authentication should be eap- tls. Is it possible to make authentication with eap-tls with certficates for valid users and some &#34;guest vlan&#34; for users which hasnt any or unknown certificates ? It's not possible. If the device doesn't present a valid certificate, it won't authenticate. You can't force an "Accept" with EAP methods. You will need to use a different method to handle guest accounts. If you want to use EAP-TLS only you will have to issue certificates to everyone. -- Matthew - List info/subscribe/unsubscribe? See www.freeradius.org www.freeradius.org

1 0

Vendor Extended attributes for freeradius dictionary acme
by Bill Schartner 08 Jan '20

08 Jan '20

Hello, I am running freeradius 3.0.13 and recently upgraded from 2.2.6 in order to use the extended attributes as specified in RFC6929. I have the new radius working fine. Oracle has defined a new VSA attribute with number 249 for the acme dictionary and some additional extended attributes to address avp depletion in the dictionary. It looks like the acme dictionary for freeradius is not up to date so we may need to eventually resync them. What I am trying to do is add VSA 249 to the acme dictionary as type evs and then add 14 additional attributes to an additional file called dictionary.acme.extended. I'm not sure if this is the right procedure. These additional attributes I plan to add to the dictionary.acme.extended file: AVP-Name VSA Id number x-attr-type Version -------------------------------------------------------------- Acme-PGW-IP-Address 249 1 1 Acme-SGW-IP-Address 249 2 1 Acme-Visited-Network-Identifier 249 3 1 Acme-Originating-IOI 249 4 1 Acme-Terminating-IOI 249 5 1 Acme-IMSI 249 6 1 Acme-IMEI 249 7 1 Acme-History-Info 249 8 1 Acme-Node-Functionality 249 9 1 Acme-SMS-Message-Type 249 10 1 Acme-SMS-Calling-partynumber 249 11 1 Acme-SMS-Called-partynumber 249 12 1 Acme-Message-Length 249 13 1 Acme-SMS-Timestamp 249 14 1 Any help is greatly appreciated. Thanks

2 1

rlm_sql_postgresql: db password appears in plaintext in logs
by L. Rose 07 Jan '20

07 Jan '20

Hello everyone, I'm not sure if this is a bug or a misconfiguration on our site. When running freeradius -X, the database password of our postgresql database appears in plaintext on the console: rlm_sql_postgresql: Connecting using parameters: dbname='radiusdb' host='127.0.0.1' port=1337 user='radiususer' password='example' Of course, the values for dbname, host, port, user and password are not the real values, but the real values appear in the debug output. I thought that freeradius -X should not print any confidential information? Or is this a feature? Thanks in advance, L. Rose

4 3