- Freeradius-Users - lists.freeradius.org

freeradius with UNIFI APs
by Nawar Al Tarazi 22 Aug '19

22 Aug '19

I have a problem , My freeradius Server works with Radtest , with Normal Home Router but not with UNIFI APs , he is the debug , The Server send the Access-Accept but the AP seems to not accept the connection from the Server my Hardware is Unifi please Help (0) Received Access-Request Id 4 from 192.168.1.6:44463 to 192.168.1.10:1812 length 245 (0) User-Name = "oktaradius(a)contentful.com" (0) NAS-IP-Address = 192.168.1.6 (0) NAS-Identifier = "F09FC2307B82D74DA8A1" (0) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "8C-85-90-C9-C4-A5" (0) Connect-Info = "CONNECT 0Mbps 802.11b" (0) Acct-Session-Id = "9CDA00101279DBED" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027074 (0) WLAN-AKM-Suite = 1027073 (0) Framed-MTU = 1400 (0) EAP-Message = 0x0216001e016f6b746172616469757340636f6e74656e7466756c2e636f6d (0) Message-Authenticator = 0xeec65192e2ddf53d4d33db8190adf232 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) authorize { (0) update control { (0) Proxy-To-Realm := LOCAL (0) } # update control = noop (0) eap: Peer sent EAP Response (code 2) ID 22 length 30 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 23 length 6 (0) eap: EAP session adding &reply:State = 0xfaa47198fab36411 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) Sent Access-Challenge Id 4 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (0) EAP-Message = 0x011700061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xfaa47198fab36411baefeb91c43d0602 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 5 from 192.168.1.6:44463 to 192.168.1.10:1812 length 394 (1) User-Name = "oktaradius(a)contentful.com" (1) NAS-IP-Address = 192.168.1.6 (1) NAS-Identifier = "F09FC2307B82D74DA8A1" (1) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "8C-85-90-C9-C4-A5" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "9CDA00101279DBED" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027074 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x021700a115800000009716030100920100008e03035d5188828d15cd4d7a82bf0731e77373065ecf57a0bf3f4d4082633bee46876100002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00 (1) State = 0xfaa47198fab36411baefeb91c43d0602 (1) Message-Authenticator = 0xbe4a540bc251f8055feaedc56f6d5fff (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) authorize { (1) update control { (1) Proxy-To-Realm := LOCAL (1) } # update control = noop (1) eap: Peer sent EAP Response (code 2) ID 23 length 161 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) authenticate { (1) eap: Expiring EAP session with state 0xfaa47198fab36411 (1) eap: Finished EAP session with state 0xfaa47198fab36411 (1) eap: Previous EAP request found for state 0xfaa47198fab36411, released from the list (1) eap: Peer sent packet with method EAP TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Authenticate (1) eap_ttls: Continuing EAP-TLS (1) eap_ttls: Peer indicated complete TLS record size will be 151 bytes (1) eap_ttls: Got complete TLS record (151 bytes) (1) eap_ttls: [eaptls verify] = length included (1) eap_ttls: (other): before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (1) eap_ttls: TLS_accept: SSLv3/TLS read client hello (1) eap_ttls: >>> send TLS 1.2 [length 003d] (1) eap_ttls: TLS_accept: SSLv3/TLS write server hello (1) eap_ttls: >>> send TLS 1.2 [length 03e8] (1) eap_ttls: TLS_accept: SSLv3/TLS write certificate (1) eap_ttls: >>> send TLS 1.2 [length 014d] (1) eap_ttls: TLS_accept: SSLv3/TLS write key exchange (1) eap_ttls: >>> send TLS 1.2 [length 0004] (1) eap_ttls: TLS_accept: SSLv3/TLS write server done (1) eap_ttls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_ttls: In SSL Handshake Phase (1) eap_ttls: In SSL Accept mode (1) eap_ttls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 24 length 1004 (1) eap: EAP session adding &reply:State = 0xfaa47198fbbc6411 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) Sent Access-Challenge Id 5 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (1) EAP-Message = 0x011803ec15c00000058a160303003d02000039030349e81822793d24a35e670383027a3eada3f2f3378a72d3789a4e393459bb0f3600c030000011ff01000100000b0004030001020017000016030303e80b0003e40003e10003de308203da308202c2a003020102020101300d06092a864886f70d0101 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xfaa47198fbbc6411baefeb91c43d0602 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 6 from 192.168.1.6:44463 to 192.168.1.10:1812 length 239 (2) User-Name = "oktaradius(a)contentful.com" (2) NAS-IP-Address = 192.168.1.6 (2) NAS-Identifier = "F09FC2307B82D74DA8A1" (2) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Calling-Station-Id = "8C-85-90-C9-C4-A5" (2) Connect-Info = "CONNECT 0Mbps 802.11b" (2) Acct-Session-Id = "9CDA00101279DBED" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027074 (2) WLAN-AKM-Suite = 1027073 (2) Framed-MTU = 1400 (2) EAP-Message = 0x021800061500 (2) State = 0xfaa47198fbbc6411baefeb91c43d0602 (2) Message-Authenticator = 0xd673ec1af4da37f49eee91a44fff135f (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) authorize { (2) update control { (2) Proxy-To-Realm := LOCAL (2) } # update control = noop (2) eap: Peer sent EAP Response (code 2) ID 24 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) authenticate { (2) eap: Expiring EAP session with state 0xfaa47198fbbc6411 (2) eap: Finished EAP session with state 0xfaa47198fbbc6411 (2) eap: Previous EAP request found for state 0xfaa47198fbbc6411, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 25 length 434 (2) eap: EAP session adding &reply:State = 0xfaa47198f8bd6411 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) Sent Access-Challenge Id 6 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (2) EAP-Message = 0x011901b215800000058a1243396539a2f1ad1b6a17603569def5a0794b3af441b40273fd27a0361b18742b5e898d798d94b85c2aaa4ede14cfe7c5f7406c7d5eb178bc1e609fbfefb1920ce1f720d4bbd7ea7e4c91a2b0160303014d0c0001490300174104c4784b7e2fc3e8cf21033a4766054d0266e0 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xfaa47198f8bd6411baefeb91c43d0602 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 7 from 192.168.1.6:44463 to 192.168.1.10:1812 length 369 (3) User-Name = "oktaradius(a)contentful.com" (3) NAS-IP-Address = 192.168.1.6 (3) NAS-Identifier = "F09FC2307B82D74DA8A1" (3) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Calling-Station-Id = "8C-85-90-C9-C4-A5" (3) Connect-Info = "CONNECT 0Mbps 802.11b" (3) Acct-Session-Id = "9CDA00101279DBED" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027074 (3) WLAN-AKM-Suite = 1027073 (3) Framed-MTU = 1400 (3) EAP-Message = 0x0219008815800000007e1603030046100000424104c9371a045101d7c7d9563212df6bc5a5b2417a499869eeaa50453d1f81bc96938addc1a9bf0512021dfdf2091938b4da9646febec921b00a57a717e72e7155861403030001011603030028860b3611b6543395b1c6bbaaf83beea322054daf0beb35 (3) State = 0xfaa47198f8bd6411baefeb91c43d0602 (3) Message-Authenticator = 0xd8e7b2d6e17e721eda1f459d4d421864 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) authorize { (3) update control { (3) Proxy-To-Realm := LOCAL (3) } # update control = noop (3) eap: Peer sent EAP Response (code 2) ID 25 length 136 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) authenticate { (3) eap: Expiring EAP session with state 0xfaa47198f8bd6411 (3) eap: Finished EAP session with state 0xfaa47198f8bd6411 (3) eap: Previous EAP request found for state 0xfaa47198f8bd6411, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (3) eap_ttls: Got complete TLS record (126 bytes) (3) eap_ttls: [eaptls verify] = length included (3) eap_ttls: TLS_accept: SSLv3/TLS write server done (3) eap_ttls: <<< recv TLS 1.2 [length 0046] (3) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (3) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (3) eap_ttls: <<< recv TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS read finished (3) eap_ttls: >>> send TLS 1.2 [length 0001] (3) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (3) eap_ttls: >>> send TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS write finished (3) eap_ttls: (other): SSL negotiation finished successfully (3) eap_ttls: SSL Connection Established (3) eap_ttls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 26 length 61 (3) eap: EAP session adding &reply:State = 0xfaa47198f9be6411 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) Sent Access-Challenge Id 7 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (3) EAP-Message = 0x011a003d15800000003314030300010116030300286d3279646040945eb6f8d448620c0719de823b9e656e0260d632d35eacaa5fa8a16d89afdfad464c (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xfaa47198f9be6411baefeb91c43d0602 (3) Finished request Waking up in 4.8 seconds. (4) Received Access-Request Id 8 from 192.168.1.6:44463 to 192.168.1.10:1812 length 332 (4) User-Name = "oktaradius(a)contentful.com" (4) NAS-IP-Address = 192.168.1.6 (4) NAS-Identifier = "F09FC2307B82D74DA8A1" (4) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "8C-85-90-C9-C4-A5" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "9CDA00101279DBED" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) EAP-Message = 0x021a00631580000000591703030054860b3611b65433960489141a64f3a8cb7c13b947583a4921f0806cd7acc46445465f35fb81bd6104f94599eefeb0d061f172f627a632af17613fac442a331cd9cb5030708bebf6dcf788682be55ac8c3f52b02ae (4) State = 0xfaa47198f9be6411baefeb91c43d0602 (4) Message-Authenticator = 0xdfcd2b5cc81d4042154a25f616974409 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authorize { (4) update control { (4) Proxy-To-Realm := LOCAL (4) } # update control = noop (4) eap: Peer sent EAP Response (code 2) ID 26 length 99 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authenticate { (4) eap: Expiring EAP session with state 0xfaa47198f9be6411 (4) eap: Finished EAP session with state 0xfaa47198f9be6411 (4) eap: Previous EAP request found for state 0xfaa47198f9be6411, released from the list (4) eap: Peer sent packet with method EAP TTLS (21) (4) eap: Calling submodule eap_ttls to process data (4) eap_ttls: Authenticate (4) eap_ttls: Continuing EAP-TLS (4) eap_ttls: Peer indicated complete TLS record size will be 89 bytes (4) eap_ttls: Got complete TLS record (89 bytes) (4) eap_ttls: [eaptls verify] = length included (4) eap_ttls: [eaptls process] = ok (4) eap_ttls: Session established. Proceeding to decode tunneled attributes (4) eap_ttls: Got tunneled request (4) eap_ttls: User-Name = "oktaradius(a)contentful.com" (4) eap_ttls: User-Password = "BetAThetA135" (4) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (4) eap_ttls: Sending tunneled request (4) Virtual server inner-tunnel received request (4) User-Name = "oktaradius(a)contentful.com" (4) User-Password = "BetAThetA135" (4) FreeRADIUS-Proxied-To = 127.0.0.1 (4) NAS-IP-Address = 192.168.1.6 (4) NAS-Identifier = "F09FC2307B82D74DA8A1" (4) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "8C-85-90-C9-C4-A5" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "9CDA00101279DBED" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) WARNING: Outer and inner identities are the same. User privacy is compromised. (4) server inner-tunnel { (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authorize { (4) update control { (4) Proxy-To-Realm := LOCAL (4) } # update control = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [pap] = noop (4) if (User-Password) { (4) if (User-Password) -> TRUE (4) if (User-Password) { (4) update control { (4) Auth-Type := ldap (4) } # update control = noop (4) } # if (User-Password) = noop (4) } # authorize = noop (4) Found Auth-Type = ldap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authenticate { rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 153 seconds rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 152 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 151 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 150 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 149 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (5), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://contentful.ldap.oktapreview.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (5) (4) ldap: Login attempt by "oktaradius(a)contentful.com" (4) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (4) ldap: --> (uid=oktaradius(a)contentful.com) (4) ldap: Performing search in "ou=users,dc=contentful, dc=oktapreview, dc=com" with filter "(uid=oktaradius(a)contentful.com)", scope "sub" (4) ldap: Waiting for search result... (4) ldap: User object found at DN "uid=oktaradius(a)contentful.com ,ou=users,dc=contentful,dc=oktapreview,dc=com" (4) ldap: Waiting for bind result... (4) ldap: Bind successful (4) ldap: Bind as user "uid=oktaradius(a)contentful.com,ou=users,dc=contentful,dc=oktapreview,dc=com" was successful rlm_ldap (ldap): Released connection (5) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (6), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://contentful.ldap.oktapreview.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (4) [ldap] = ok (4) } # authenticate = ok (4) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) } # server inner-tunnel (4) Virtual server sending reply (4) eap_ttls: Got tunneled Access-Accept (4) eap: Sending EAP Success (code 3) ID 26 length 4 (4) eap: Freeing handler (4) [eap] = ok (4) } # authenticate = ok (4) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) Sent Access-Accept Id 8 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (4) MS-MPPE-Recv-Key = 0x8c05d9a6191d353cf4101fe02b866e7a91dc69e4192eacd39647f6167f7cfd41 (4) MS-MPPE-Send-Key = 0x6e524da319bdd251d5f4b702316813dfed52e1ee2eb530ff93e742b8d1be8df4 (4) EAP-Message = 0x031a0004 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) User-Name = "oktaradius(a)contentful.com" (4) Finished request Waking up in 2.1 seconds. Waking up in 2.1 seconds. (0) Cleaning up request packet ID 4 with timestamp +149 (1) Cleaning up request packet ID 5 with timestamp +149 (2) Cleaning up request packet ID 6 with timestamp +149 (3) Cleaning up request packet ID 7 with timestamp +149 Waking up in 7.7 seconds. (4) Cleaning up request packet ID 8 with timestamp +149 Ready to process requests -- Nawar Al Tarazi IT Working Student nawar.tarazi(a)contentful.com +4915787991702 www.contentful.com

7 10

Max Connections Limit
by chrisming520 21 Aug '19

21 Aug '19

Hi experts: I have 3000,0+ users , when 1500 users connect radius server at same time , all can be authenticated . but if there are more than 1500 users,the rest (some of them ) can not get connect to server , get error like : NO REPLY FROM SERVER . can you tell me how to solve this problem ? thank you in advance . looking forward your answer Best regards Chris:-) 发自我的iPhone

4 3

Working with LDAP, radius clients, users, etc
by Paul Pathiakis 21 Aug '19

21 Aug '19

Hi, What would be the correct configuration for something like this: I'd like all the clients in domain example.com to authenticate using the same 'secret' - foobar If the address space for example.com is 192.168.0.0/22, does my client entry look like this in clients.conf: client example.com { ipaddr = 192.168.0.0/22 secret = foobar}? Is my understanding correct that any and all clients that are configured in the 192.168.0.1 - 192.168.3.254 range can be authenticated via freeradius at that point, using just the secret 'foobar'? Moving on, I also want to verify that the user is in the LDAP database before starting the login process. In my /etc/raddb/mods-available/ldap file, I should have an entry that looks like (without certs for now): ldap { server = 192.168.1.20 (LDAP Server address) port = 389 base_dn = 'ou=People,dc=example,dc=com' (Where my 'user' entries live) update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' membership_attribute = 'memberOf' } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' # shortname = 'radiusClientShortname' # nas_type = 'radiusClientType' # virtual_server = 'radiusClientVirtualServer' # require_message_authenticator = 'radiusClientRequireMa' }} ### OK, I'm a little confused about the attribute block above.### In my openldap configuration, I have put the schema files include /etc/openldap/schema/freeradius.schema include /etc/openldap/schema/freeradius-clients.schema in the location above and those are the schema files I got from downloading the FreeRADIUS source in the <path>/doc/schemas/ldap/openldap/ location and I copied them into correct location. I know this isn't an LDAP list, however with regards to the schemas and attribute block, is thischecking to see if those entries exist (radiusClientIndentifier, radiusClientSecret) in the user entry in ldap?That is, is this using those schema entries to authenticate the user for access to the client? I'm starting to see that FreeRADIUS will authenticate all the units on a network from the first two points and then check the existence of the user from LDAP. However, if I'm trying to be very secure, wouldn't I want to limit the scope of the machines? For example, say I have a smallish network that grows/contracts with the number of hosts on the desktop and it has as few as a 100 and almost 250. So, I have 192.168.1.0/24 as my CIDR network. I can use DHCP and Dynamic Updating of DNS, to track everything at the IP level but I don't want to have hosts that are in an 'unknown' state on my network. For arguments sake, I have someone that plugs into my network and knows the address space that is used. They are not a 'sanctioned user' for that network space but due to the scope of what RADIUS allows in my above network range of 192.168.0.0/22, the machine gets authenticated. It seems that it would be beneficial to have an entry for all the machines in my LDAP to allow authentication for that client. Is this possible? I'm thinking it would be a good thing to be able to have entry upon entry of clients and users on a case-by-case basis added and removed to LDAP with a flag in the record to allow authentication. Do people do this? Am I going in the wrong direction? If so, which way? If not, how would this be addressed? TY! P

2 3

session is nil
by Sajad Tahernejad 21 Aug '19

21 Aug '19

Hi, I want use session:playAndGetDigits in position lua script, but gived me this error /scripts/lua/callcenter-announce-position.lua:39: attempt to index global 'session' (a nil value) Please help me Thanks.

2 1

Freeradius SSL issue
by sangram kishore 21 Aug '19

21 Aug '19

Hi Experts, I've working freeradius setup in ubuntu18. Today when I start free radius I've observed this below error. #radiusd -X *libssl version mismatch. built: 1010007f linked: 1010100f Much appreciated any help here. Thanks, Sangram.

2 3

PEAP - fast reconnect
by Marcin Marszałkowski 21 Aug '19

21 Aug '19

I’ve been looking through docs but I couldn’t find an answer. Does Freeradius support fast reconnect (for roaming wifi users) with EAP PEAP by default or it needs to be enabled/configured? Regards Martin

2 10

Internal vs external proxy server
by Artis Caune 21 Aug '19

21 Aug '19

Hi guys, Can someone please point me in right direction of why reply attributes gets deleted from internal proxy reply ? If I use: DEFAULT Proxy-To-Realm := "dialup" realm dialup { virtual_server = dialup } server dialup { authorize { dialup_sql_auth pap } authenticate { Auth-Type PAP { pap } } post-auth { update reply { &Alc-Subsc-ID-Str := "DIALUP-%{%{Stripped-User-Name}:-%{User-Name}}" } } } default server gets reply from dialup server but ignore any reply attributes and returns empty Accept. I can copy attribute from proxy-reply in post-proxy and see it in radclient accept. update reply { &Alc-Subsc-ID-Str := &proxy-reply:Alc-Subsc-ID-Str } But if i use same config but change dialup from internal to external proxy it works and I can see all return attributes: server dialup { listen { type = auth ipaddr = 127.0.0.1 port = 1645 } ... } realm dialup { authhost=127.0.0.1:1645 secret=xxx } Thanks, Artis

2 3

Error after modification in the users file.
by Schmid, Marco 20 Aug '19

20 Aug '19

Hello, after modifying the users file, I get the following error: „Parse error (check) for entry DEFAULT: Unknown name „Ldap-Group“ I’m using freeradius version 3.0.16. It worked under version 3.0.13 Greetings Marco Mit freundlichen Grüßen Marco Schmid Technik [cid:email_indasys_connectivity.jpg@9824D5A5.0001]<http://www.indasys.de> indasys connectivity GmbH Leitzstraße 4c D-70469 Stuttgart Telefon: Telefax: E-Mail: Web: +49 711 896659 110 +49 711 896659 149 Marco.Schmid(a)indasys.de<mailto:Marco.Schmid@indasys.de> www.indasys.de<http://www.indasys.de/> USID: DE273320932 HRB: 734651 AG Stuttgart Geschäftsführer: Sebastian Schwab, Dominik Appich

2 1

Runtime Memory Optimization - freeradius2 for OpenWRT
by Lalit Kumar Mishra 20 Aug '19

20 Aug '19

Hi, I recently compiled freeradius2 for OpenWrt attitude adjustment, did selective compilation of freeradius2 only with EAP-TLS module since I want to use only this module. I am facing two issues, Can someone help me over this. 1. Freeradius2 is taking 3.7 MB RAM runtime memory on OpenWRT board, Can we further optimize/ reduce runtime memory requirement on OpenWRT. 2. Freeradius2 is not starting without debug mode. Any input/ pointers would help. Thank you. Regards Lalit

2 1

Ldap Query
by Schmid, Marco 20 Aug '19

20 Aug '19

Hello, I’ve installed the packages „freeradius“ and „freeradius-ldap“ Freeradius in Version 3.0.16. When I modify the „user“-file, I can’t start freeradius any more. Parse errof „Ldap-Group“ unknown. I did the same under freeradius 3.0.13, and it worked. Has something changed since then? Greetings Marco Mit freundlichen Grüßen Marco Schmid Technik [cid:email_indasys_connectivity.jpg@9824D5A5.0001]<http://www.indasys.de> indasys connectivity GmbH Leitzstraße 4c D-70469 Stuttgart Telefon: Telefax: E-Mail: Web: +49 711 896659 110 +49 711 896659 149 Marco.Schmid(a)indasys.de<mailto:Marco.Schmid@indasys.de> www.indasys.de<http://www.indasys.de/> USID: DE273320932 HRB: 734651 AG Stuttgart Geschäftsführer: Sebastian Schwab, Dominik Appich

1 0