- Freeradius-Users - lists.freeradius.org

Script
by Aurélio de Souza Ribeiro Neto 13 Dec '19

13 Dec '19

Hello All, I'm using freeradius 3.0.20 in ubuntu + MySQL, and I want to implement a solution to discconect users when I don't receive 2 Interim Update Packets for example. How can I do this? Someone can help? Aurélio

3 2

Regex match on a variable is not working if length is long
by Chinnapaiyan, Nagamani 12 Dec '19

12 Dec '19

Hi, I am using freeradius-4.0.x version. This one works, (6) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*$number 43$$value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (6) EXPAND %{control:Tmp-String-7} (6) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7E:64)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:21:01:01:26:38:68:74:74:70:3A:2F:2F:31:30:2E:34:33:2E:31:39:2E:31:38:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:36:01:FF:40:01:00)(option-definition-set-name ViasatUT))])) (6) update control { But this one is not, (15) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*\(number 43$\(value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (15) EXPAND %{control:Tmp-String-7} (15) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7D:3A)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:02:09:55:54:00:00:00:00:00:00:07:03:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:04:11:55:54:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:05:04:0A:4F:FF:0F:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:26:42:68:74:74:70:3A:2F:2F:61:63:73:2E:64:65:76:2E:63:6D:74:2E:76:69:61:73:61:74:2E:69:6F:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:2A:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2B:04:0A:4F:FF:0F:2C:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:33:0C:55:54:32:00:00:00:00:00:00:00:29:08:36:01:FF:3B:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:3C:12:55:54:32:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:3D:04:0A:4F:FF:0F:3E:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2E:74:61:72:2E:67:7A:3F:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:2E:74:61:72:2E:67:7A:40:01:00)(option-definition-set-name ViasatUT))])) (15) ERROR: regex failed: regex evaluation failed with code (-27): <INVALID> (15) ERROR: Condition evaluation failed because the value of an operand could not be determined (15) ... (15) } Both are same conditions with different values in them. Why second one is not working? Regards, Nagamani Chinnapaiyan

3 5

Does freeRADIUS 3 support PostgreSQL 11
by Min Wang 11 Dec '19

11 Dec '19

Does freeRADIUS 3 support PostgreSQL 11? Best regards, Min Wang Global Data Services New York Stock Exchange An Intercontinental Exchange Company (NYSE: ICE) 11 Wall St. | New York, NY 10005 Tel: +1 212.656.2441 | Mob: +1 201.936.9888 Min.Wang(a)theice.com<mailto:Min.Wang@theice.com> [ice] [Intercontinental Exchange - email.png]<https://icespace.cpex.com/servlet/JiveServlet/showImage/102-61239-14-18333/…> ________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), its subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired.

3 9

Trying not to send outer identity in the Access-Accept message
by Torres López María Isabel 11 Dec '19

11 Dec '19

Dear Sir or Madam. Currently, we are running Freeradius 3.0.11. It works correctly with our wireless controler, but when we upgrade the firmware of our wireless controlles, the users are not able to stablish sesión anymore. The problem is that the freeradius is sending two User-Name values in the Access-Accept packet (the inner and the outer identity), and the Wireless controler detects two values and drops the packet. The authentication is correct, but the Wireless controller does not stablish the user sesión. Besides, as the Freeradius sends both identities, sometimes the accountings shows the outer identity, not the inner one. ¿Is there any way to send only the inner identity in the Access-Accept packet? (6) Login OK: [pruebas.wifi(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F via TLS tunnel) (6) } # server inner (6) Virtual server sending reply (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) eap_ttls: Got tunneled Access-Accept (6) eap: Sending EAP Success (code 3) ID 8 length 4 (6) eap: Freeing handler (6) [eap] = ok (6) } # authenticate = ok (6) Login OK: [anonymous(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F) (6) Sent Access-Accept Id 56 from 192.168.153.175:1812 to 172.17.47.240:37462 length 0 (6) User-Name = "anonymous(a)uah.es" (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) MS-MPPE-Recv-Key = 0x567a04806953128ea5aadb908f6728a6753794d66a6ec189964c4f2e54cfb15b (6) MS-MPPE-Send-Key = 0x068df56d4605c2a4b62e8f4eee3fdb12031bdebf9eaa4201d6d08b310246d6d4 (6) EAP-Message = 0x03080004 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) Finished request Best regards. Mª Isabel Torres López Comunicaciones - Servicios Informáticos Universidad de Alcalá Correo: Isabel.torres(a)uah.es<mailto:Isabel.torres@uah.es> Telefono: 918856458

2 1

NT Status file lock conflict - 0xc0000054
by Innes Hatton 11 Dec '19

11 Dec '19

Hi, Currently I have an issue with a radius servers, every day the user authentication appears to not work for our Eduroam WIFI, after restarting the server everything begins to work again. I am currently using SAMBA to connect FreeRADIUS to Active Directory. Please see the errors below, any advice would be appreciated [root@EKCRadius5 /usr/home/netsys]# su freeradius $ /usr/local/bin/ntlm_auth --request-nt-key --domain=EASTKENT --username=service.freeradius --password=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx NT_STATUS_FILE_LOCK_CONFLICT: A requested read/write cannot be granted due to a conflicting file lock. (0xc0000054) Fri Dec 6 08:15:24 2019 : Error: No response to status check 909333 ID 41 for home server xxxxxxxxxxxxx port 1812 Fri Dec 6 08:15:24 2019 : Error: (909322) Ignoring duplicate packet from client 110-CAN-APS port 47516 - ID: 103 due to unfinished request in component authenticate module eap_peap Fri Dec 6 08:15:24 2019 : ERROR: (909214) mschap: ERROR: Failed to read from child output Thanks, Innes 'This email and any files transmitted with it are confidential and for the use of the individual or entity to whom they are addressed. If you are not the intended recipient be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is prohibited' - EKC Group

2 1

dhcpclient DHCP-Vendor display problem
by Chinnapaiyan, Nagamani 11 Dec '19

11 Dec '19

Hi, I am using freeradius 4.0.x version. The dhcpclient displays a truncated DHCP-Vendor option in reply packet. If I take a pcap it shows full DHCP-Vendor. Server side: (0) Sending DHCP-Offer XID e7ef0a2f from 10.43.18.62:6767 to 10.43.18.44:6767 via eth1 ... (0) DHCP-Vendor = 0x010300a0bc0209555400000000000007030e5554000000000000030703070016041155545f332e372e332e372e32322e62696e05040a4fff060c0200010e0100145e0100020103110500440044070043004301000201030606c0a86400180700500050010102010306070016001701010201060a000000080101020106ac1000000c0101020106c0a80000100101020106a9fe00001001010201067f00000008330c5554320000000000000029083b0e55543200000000000307030600003c115554325f332e372e332e362e302e62696e3d040a4fff06 ... Client side: # /usr/bin/dhcpclient -i eth1 -x -f /opt/viasat/dhcp_fr_citests/dhcpclient-modem_discover.txt 10.43.18.62:6767 Sending DHCP-Discover Id e7ef0a2f from 0.0.0.0:6767 to 10.43.18.62:6767 length 322 ... ... Received DHCP-Offer Id e7ef0a2f from 10.43.18.62:6767 to 0.0.0.0:6767 via eth1 length 553 ... DHCP-Vendor = 0x010300a0bc0209555400000000000007030e5554000000000000030703070016041155545f332e372e332e372e32322e62696e05040a4fff060c0200010e0100145e0100020103110500440044070043004301000201030606c0a86400180700500050010102010306070016001701010201060a000000 ... Regards, Nagamani Chinnapaiyan

2 1

Using freeradius just for device administrative access
by Coy Hile 10 Dec '19

10 Dec '19

Hi all, I'm finally getting around to setting up RADIUS in my lab so I can centralize authentication and authorization access to network devices. Assume for sanity's sake, NAS information and user information stored in a SQL database. Does anyone have any boilerplate for what can be thrown away wholesale from the default configs when *not* doing 802.1x or other end-user authentication/authorization. -- Coy Hile coy.hile(a)coyhile.com

2 1

Allow same user to authenticate with different passwords
by Taymour Gabr 10 Dec '19

10 Dec '19

Hi All, We are trying to allow users to authenticate with different passwords using an SQL database and freeradius version 3.0.17 (hotel scenario, where unrelated people can have the same family name). I've already seen these two links: http://freeradius.1045715.n5.nabble.com/Help-FreeRadius-Users-with-multiple… http://lists.freeradius.org/pipermail/freeradius-users/2009-February/035570… and I've had a look at the queries.conf file for mysql. I found the 'authorize_check_query', but that query just resolves to present all the fields for the username, and 'authorize_check_query' is not used elsewhere to use those results to retrieve the password... . So I am still at a loss of how I can change freeradius to accept a different type of radcheck table with multiple fields for the password per user, and where I would change the logic of how it accepts any of these passwords. Addiionally it should use Simultaneous-Use checks per username+password combination rather than per username. But that's of course something we can change within the sql server events and triggers. Thanks, Kind Regards, Taymour

3 4

get AP MAC Address
by juliana sales porto 06 Dec '19

06 Dec '19

Hello guys, I have a question. Is that possible I take the Mac Address from RB or AP mikrotik when the user is authenticating on hotspot system? Att, Juliana Porto

3 4

Microsoft ODBC bug
by Dom Latter 06 Dec '19

06 Dec '19

Hi all, I have been experimenting with Microsoft SQL Server as a replacement for our current mysql servers [1]. I installed Microsoft's own "ODBC Driver 17 for SQL Server" and have tested against both SQL Server running on the same Linux machine as Freeradius itself, and SQL Server running on a Windows machine. In both cases I found the same (what appears to be a) bug, which I will describe below for the benefit of the archives, even though it is (probably) not a problem with freeradius. Because people hitting this are very likely to be searching with terms including "freeradius". Also there is a chance that it is somehow specific to the interaction with freeradius. Because it is hard to imagine even Microsoft releasing something with such a glaring fault. I'll also give a work-around. I think I will now try iodbc instead - anybody here used it? Right, the bug. Here's my custom attribute: ATTRIBUTE My-Int 3004 integer Here's part of the post-auth section in the "outer" site: update control { My-Int := "%{sql:SELECT 9999 }" My-Int := "%{sql:SELECT 10000 }" My-Int := "%{sql:SELECT '10000' }" Here's debug output: EXPAND %{sql:SELECT 9999 } --> 9999 My-Int := 9999 Executing select query: SELECT 10000 rlm_sql_unixodbc: 22003 [Microsoft][ODBC Driver 17 for SQL Server]Numeric value out of range ERROR: Error fetching row ERROR: Unknown error ERROR: SQL query failed: <INVALID> EXPAND %{sql:SELECT 10000 } --> My-Int := 0 Executing select query: SELECT '10000' EXPAND %{sql:SELECT '10000' } --> 10000 My-Int := 10000 As you can see, if an integer is more than four digits long, the driver throws an error. But if you return the number as a string, it works fine. I'd love to see the source code for this... [1] Everything else is SQL Server and our current integration between the two databases is rather clunky; a homogeneous environment makes sense, whatever I personally think of Microsoft <grin>.

7 26