- Freeradius-Users - lists.freeradius.org

Configuring FreeRADIUS to use ntlm_auth for MS-CHAP
by Linux Threads 29 Aug '19

29 Aug '19

HI after following http://deployingradius.com/documents/configuration/active_directory.html and running: radtest -t mschap myNT_user myNTpass 192.168.1.250 0 client-secret freeradius -XX Thu Aug 29 13:29:50 2019 : Debug: (10) modsingle[authorize]: returned from pap (rlm_pap) Thu Aug 29 13:29:50 2019 : Debug: (10) [pap] = noop Thu Aug 29 13:29:50 2019 : Debug: (10) } # authorize = ok Thu Aug 29 13:29:50 2019 : Debug: (10) Found Auth-Type = mschap Thu Aug 29 13:29:50 2019 : Debug: (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Thu Aug 29 13:29:50 2019 : Debug: (10) authenticate { Thu Aug 29 13:29:50 2019 : Debug: (10) modsingle[authenticate]: calling mschap (rlm_mschap) Thu Aug 29 13:29:50 2019 : WARNING: (10) mschap: No Cleartext-Password configured. Cannot create NT-Password Thu Aug 29 13:29:50 2019 : WARNING: (10) mschap: No Cleartext-Password configured. Cannot create LM-Password Thu Aug 29 13:29:50 2019 : Debug: (10) mschap: Client is using MS-CHAPv1 with NT-Password Thu Aug 29 13:29:50 2019 : ERROR: (10) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Thu Aug 29 13:29:50 2019 : ERROR: (10) mschap: MS-CHAP2-Response is incorrect Thu Aug 29 13:29:50 2019 : Debug: (10) modsingle[authenticate]: returned from mschap (rlm_mschap) Thu Aug 29 13:29:50 2019 : Debug: (10) [mschap] = reject Thu Aug 29 13:29:50 2019 : Debug: (10) } # authenticate = reject Thu Aug 29 13:29:50 2019 : Debug: (10) Failed to authenticate the user Thu Aug 29 13:29:50 2019 : Debug: (10) Using Post-Auth-Type Reject I hate to ask but do you have any Ideas? Regards

2 1

Re: Many Mac Addresses to several Vlan ID's Authentication(Aruba Switch) - How to deploy?
by Sabic, Enes 29 Aug '19

29 Aug '19

Hallo Thx for quick response. I've a appeal. Can you please give me a short instruction in which files should I make these configs which are necessary? BIG THX and Br, Enes

1 0

issues with radius proxy settings
by Prem Khanal 28 Aug '19

28 Aug '19

Hi Team, I am running freeradius 3.0.16 on ubuntu 18.04 as a proxy server. The setup is as such that Device enrollment management system forwards radius accounting packets to radius proxy and then radius proxy server forwards the accounting packets to one or multiple Fortigates accepting radius accounting packets. The issue I am having is when one of the Fortigate is not able to accept packets ( network level issue or firewall level issue ), the proxy server starts creating detail and detail.work files and as soon as the Fortigate interface is up it (Radius proxy) tries to push the backlog from these files. The problem is, if the interface has been down for couple of hours the backlog is so huge ( and new requests are frequently coming ) that it can not redirect current traffic to specific firewall. If I delete the detail and detail.work file and restart the free radius server then it starts functioning normally. I believe I am missing some configuration. Kindly guide me what could be the workaround for this. I am looking for following solution: 1. Is there any way to setup a notification as soon as freeradius proxy marks a fortigate as Zombie? 2. The proxy just stops functioning ( even though it is trying to process detail and detail.work files in the background ) i.e. stops forwarding accounting packets to specific firewalls even after the communication issue is resolved. How can we make it more resilient? ====================Proxy.conf================= home_server mainFortigate{ type = acct ipaddr = <<IP>> port = 1813 secret = << secret>> response_window = 40 zombie_period = 20 revive_interval = 20 status_check = status-server check_interval = 10 check_timeout = 100 num_answers_to_alive = 5 max_outstanding = 65536 coa { # Initial retransmit interval: 1..5 irt = 2 # Maximum Retransmit Timeout: 1..30 (0 == no maximum) mrt = 16 #Maximum Retransmit Count: 1..20 (0 == retransmit forever) mrc = 5 # Maximum Retransmit Duration: 5..60 mrd = 30 } } home_server_pool mainFortigatePool { type = fail-over home_server = mainFortigate } realm mainFortigateRealm { # # Realms point to pools of home servers. # # If you have a "home_server_pool" where all of the home servers # are of type "auth+acct", you can just use the "pool" # configuration item, instead of specifying both "auth_pool" # and "acct_pool". acct_pool = mainFortigatePool nostrip # There are no more configuration entries for a realm. } ============================================== ==========copy-acct-to-home-server======== =============dynamically determine the realm============= if(request:User-Name =~ /@/){ if(request:Huntgroup-Name != ''){ update control { Proxy-To-Realm := request:Huntgroup-Name } } } ================================================ Kindly let me know if more detail is needed. -- Regards Prem

2 5

How can I access the client cert in a post-auth script
by M. Ranganathan 27 Aug '19

27 Aug '19

I am building a FreeRadius application which uses EAP-TLS. In my application, I need to access the client certificate passed to freeradius by the client (Wpa-supplicant) in a post-authentication python script. Are there any how-to tips for this? Regards, Ranga -- M. Ranganathan

2 3

Module sqlippool and logs
by Rafael Ganascim 27 Aug '19

27 Aug '19

Hello all, I'm using freeradius 3.0.19. I have three sqlippool modules configured and working in my radius server (for ipv4, ipv6 and ipv6pd). For now, I want to enable the logs via linelog for the three instances, but I'm getting messages only from the first one, even when I declare three linelog instances. Here is the debug: >From IPV4 module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: EXPAND Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: --> Released IP x.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: [IPV4] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) { (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) -> TRUE (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) { (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: EXPAND %t %{control:Module-Success-Message} (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: --> Mon Aug 26 16:27:43 2019 Released IP 201.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: EXPAND /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: --> /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: [linelog] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: } # if (control:Module-Success-Message) = ok >From IPV6PD module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV6PD: EXPAND Released IPv6PD %{Delegated-IPv6-Prefix} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) (67191) Mon Aug 26 16:27:43 2019: Debug: IPV6PD: --> Released IPv6PD 2804:xxxx/56 (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: [IPV6PD] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: EXPAND %t %{control:Module-Success-Message} (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: --> Mon Aug 26 16:27:43 2019 Released IP 201.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: EXPAND /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: --> /var/log/radius/radius.log The linelog config is the same for both instances: linelog linelogv6 { filename = ${logdir}/radius.log escape_filenames = no permissions = 0600 format = "%t %{control:Module-Success-Message}" } The module SQLIPPOOL expands correctly to the IPv6PD address, but the linelog is only getting the data from the first IPv4 instance. Is it possible to get the last %{control:Module-Success-Message} instead of the first one? Regards, Rafael

2 6

Many Mac Addresses to several Vlan ID's Authentication(Aruba Switch) - How to deploy?
by Sabic, Enes 27 Aug '19

27 Aug '19

Hello I'm new to freeradius and not experienced. We've have 6 VlanID's in our deployment to special Images. So, we're deploying about 100 clients with these special images every day. We made a powershell script on windows where we can put in Mac Addresses and vlan id's. After putting in these entries, the script copies it to the freeradius server /tmp/mac2vlan.txt In the documentation there is a mac2vlan file. So the problem is how to deploy these mac addresses and vlan id's to this mac2vlan file? Will it be a good idea to make a mariadb import from /tmp/mac2vlan into the table(with two entries - one is macaddress and the other vlanid) or to work with the mac2vlan file itself?? I don't know how to approach this problem? I hope you understand what I mean.... Br, Enes

2 1

External shell script return value for inner-tunnel
by Trevor Jennings 27 Aug '19

27 Aug '19

Hello, We have been using FreeRadius for a long time and now we are in the process of doing dynamic vlan assignments for EAP clients based on a custom AD attribute "persontype". I created a new module called bowdpersontype which does a LDAP search for the user to pull their persontype attribute, then placed this under eap in the inner tunnel. Testing vlan assignment works here, however I want to base their vlan on what their attribute is, for example staff, faculty, admin. This part is easy, however I'm not sure on how I use the value returned in the external script. My module looks like this:- --- exec bowdpersontype { wait = yes output_pairs = reply shell_escape = yes program = "/etc/freeradius/testldap.sh %{Stripped-User-Name}" } --- This test script will output:- echo "UserType=$bowdpersontype" And the inner tunnel:- --- bowdpersontype if (UserType =~ /STAFF/) { update reply { ..... ..... } } --- The debug output does show me the result from the external script and 'ok' message. How do I read the value to be used after the call? Cheers, - Trevor

3 2

Auth: (24) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject):
by Gilbert Rebeiro 25 Aug '19

25 Aug '19

I'm migrating a functioning freeradius install version 2.2.8 on ubuntu 16.04 LTS to version 3.0.16 on ubuntu 18.04 LTS I setup daloradius this time. I've setup my clients I've setup my users I deliver DSL and do auth and assign static IP addresses I need radius to return the Framed-IP-Address attribute if required This is all in mysql and I need accounting to be stored in mysql also. So far I'm getting this: Auth: (24) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test(a)xxx.xxxx.xx/!yyyyyyyy!] (from client 999.888.777.666 port 268439551 cli xxxxxxadsfad-47:621) Any suggestions? Thank you. G

4 10

wifi 802.11 to pap and perl handoff
by Linux Threads 23 Aug '19

23 Aug '19

Hi FR Users, please can you guide me how to handoff my wifi auth username and password to FR outer-el via PAP and then pass the username and password to linotp perl script via the inner-tunnel tried to follow this http://lists.freeradius.org/pipermail/freeradius-users/2016-November/085830… however not getting it to work Fri Aug 23 12:28:17 2019 : Debug: (3) Auth-Type Perl { Fri Aug 23 12:28:17 2019 : Debug: (3) modsingle[authenticate]: calling perl (rlm_perl) Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'user(a)domain.com' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '10.0.1.200' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '0' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '1400' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'State'} = &request:State -> '0xddf0c4bcddf2c0541f3e258e95c5a160' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> '60-03-47-12-C5-7F' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> 'A0-D3-7A-2A-9F-B3' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Wireless-802.11' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Aug 23 2019 12:28:17 SAST' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x020200060315' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0x6bc127eb10d5809e9d53dd36e30ffa26' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'EAP-Type'} = &request:EAP-Type -> 'NAK' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'Perl' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'Perl' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '1400' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'user(a)domain.com' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:State = $RAD_REQUEST{'State'} -> '0xddf0c4bcddf2c0541f3e258e95c5a160' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x020200060315' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> '60-03-47-12-C5-7F' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '10.0.1.200' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> 'A0-D3-7A-2A-9F-B3' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Aug 23 2019 12:28:17 SAST' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Wireless-802.11' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0x6bc127eb10d5809e9d53dd36e30ffa26' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:EAP-Type = $RAD_REQUEST{'EAP-Type'} -> 'NAK' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '0' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &reply:Reply-Message = $RAD_REPLY{'Reply-Message'} -> 'LinOTP server denied access!' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Perl' Fri Aug 23 12:28:17 2019 : Debug: (3) modsingle[authenticate]: returned from perl (rlm_perl) Fri Aug 23 12:28:17 2019 : Debug: (3) [perl] = reject Fri Aug 23 12:28:17 2019 : Debug: (3) } # Auth-Type Perl = reject Fri Aug 23 12:28:17 2019 : Debug: (3) Failed to authenticate the user Fri Aug 23 12:28:17 2019 : Debug: (3) Using Post-Auth-Type Reject Fri Aug 23 12:28:17 2019 : Debug: (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Fri Aug 23 12:28:17 2019 : Debug: (3) Post-Auth-Type REJECT { Fri Aug 23 12:28:17 2019 : Debug: (3) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Regards Juan

2 2

How to limit internet bandwidth consumption by radius
by juliana sales porto 22 Aug '19

22 Aug '19

Hello everyone, I would like to know how I can limit bandwidth consumption by radusergroup on freeradius for aruba equipment. By Mikrotik I use the parameters username, groupname and the user authenticates to the hotspot with this bandwidth navigation limit I would like to know if is possible do the same to aruba Att, Juliana Porto

4 3