- Freeradius-Users - lists.freeradius.org

separating Useres
by myxmail1919＠yahoo.com 24 Jun '19

24 Jun '19

Hi Guys, i have freeradius 3.0.15 and Mysql DB we use MAC authentication so everyone allowed to connect if they are not exceeded their limits. (anonymusers , not exist in DB ) In /etc/freeradius/3.0/sites-available/default I have update control { Max-Daily-Session= 1800 } update control { Acct-Output-Octets := 307200 } So by default every user has 1800 Seconds and 300 Mb daily limit is there anyway to make exception for some users ? like 7200 seconds and 1 Gb daily limit Thanks

1 1

FREERADIUS - show VLAN in radacct's NAS-PORT-ID column
by JAHANZAIB SYED 23 Jun '19

23 Jun '19

IN A tEST lab, We are using an old box with FreeRADIUS Version 2.2.8 along with Mikrotik routerboard (v6.43.3) as NAS. Vlans are properly configured. users connect via pppoe service. Each Vlan has pppoe server assigned. in Radacct "nas-port-id" column, how can we show VLAN name or Vlan number instead of just numbers. currently in radacct we can see this NAS-PORT-ID column: 1548484 NAS-PORT-ID column: 1529618 at another network I can saw the VLAN names there, like NAS-PORT-ID column: Vlan11 NAS-PORT-ID column: vlan20 is there any additional config required on freeradius to achieve this ? Regards, J.Z <http:///>

2 1

Conflicting vs Duplicate
by Bassem Mettichi 21 Jun '19

21 Jun '19

Hello, could you please give me the difference between conflicting packet and ducplicate packet? Thanks Bassem

2 1

problem with Simultaneous-Use roaming
by Mustafa Nassir 21 Jun '19

21 Jun '19

hi there i have problem with 802.1X , i have multi openwrt access point all it work with wpa2-enterprise and freeradius server with mysql in other side , in freeradius i enable Simultaneous-Use my problem is when my users move from first ap to second or to third ap its disconnect and reconnect and in some time its take over 10-30 second to reconnect successful . i set ideal time-out 1s and life-time 1s . its reconnect faster than first one , but its stay disconnect when they move , any idea ? Note: when i disable Simultaneous-Use its work fine and client stay connect but when i enable it i see this problem . Note: I use value 1 for Simultaneous-Use .

4 8

EAP-AKA support in FreeRADIUS
by sangram kishore 20 Jun '19

20 Jun '19

Hi Experts, I am using FreeRADIUS (3.0.19). Does FreeRADIUS support EAP-AKA? If yes, please share the pointers to the code, build commands and sample configurations for the same. Much appreciated any help here. Thanks, Sangram Kishore

2 4

How *not* to do research: MS NPS vs FreeRADIUS
by Alan DeKok 20 Jun '19

20 Jun '19

I found a fun paper today. Their conclusion? MS NPS is faster than FreeRADIUS! http://iajit.org/PDF/November%202019,%20No.%206/13255.pdf Some quotes, and my comments follow. The research revealed that FreeRADIUS by default allows the support for a variety of authentication methods including the ones using clear text passwords. This is okay if the implementer thinks of a broader compatibility but at the same time allows the network intruders may manipulate the user passwords. Additionally, FreeRADIUS was trying to initiate full authentication sessions when only reconnections were required. This ended up in increased overhead of the authentication system Comment: They didn't enable fast session resumption, so FreeRADIUS didn't use it. They then blamed FreeRADIUS for not using it. This is proven via the following statement: Overhead in reconnections were large in FreeRADIUS as it initiated a new EAP session altogether, resulting in an overhead nearly equal to that of a complete authentication phase. Comment: Yes, if you don't enable fast session resumption, FreeRADIUS does a complete authentication. It's not "nearly equal" to a complete authentication, it *is* a complete authentication. In addition to the RADIUS service, Microsoft NPS was capable of checking the health state of the connecting client and any non-compliant clients can be blocked or applied for automatic remediation of network health procedures. Comment: Not true. FreeRADIUS has had SoH support for a long time now. And further, it's not a surprise that MS products work together with proprietary MS protocols. Overhead in failed authentications were observed lower in Microsoft NPS Comment: Because FreeRADIUS has "reject_delay = 1" by default. For security reason. However, MS NPS doesn't do this. So it's less secure, but it's faster! Microsoft NPS has better performance for successfully authenticated sessions. Comment: Because they didn't change the default configuration. Which does all kinds of things that are useful to many people, but which aren't required for PEAP. The take-away is: * it's easy to generate fake statistics if you're willing to do a hack job of analysis * the default configuration of MS NPS is optimized for Windows and PEAP * the default configuration of FreeRADIUS is optimized to work everywhere Don't be fooled by nice graphs and polite lies. This only worth of this paper is to show people how *not* to write a paper. Alan DeKok.

2 1

clarification on eap configuration files and certificates
by Marco Santantonio 20 Jun '19

20 Jun '19

hi all, I have some doubts about eap module configuration file. In my organization we use a public CA for radius server certificates. The freeradius version is 3.0.12 from debian stable repository. What's the difference between: 1) setting only the server certificate in "certificate_file" and using "ca_file" to indicate the certificate of authority that issued "certificate_file" OR 2) set in "certificate_file" not only the server certificate, but also all of the CA certificates used to sign the server certificate and comment "ca_file" (this is my current configuration) I ask you this question because the ultimate goal is to deny use of EAP-TLS and allow only PEAP. I have read various posts with different solutions and I am a bit confused. Thank you! Marco -- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************

2 5

failed linking to libcrypto error during compilation from source
by Tal Nur 20 Jun '19

20 Jun '19

Hi all, I tried to compile FR from source on my Ubuntu 18.04 server according the instructions on wiki.freeradius.org.When I run ./configure command I got error: failed linking to libcrypto error I found the location of libcrypro.so.1.1. And run again ./configure command with explicit path to libcrypto.so..1.1: ./configure --with-openssl-lib-dir=/usr/lib/x86_64-linux-gnu/But I got again the same error message: failed linking to libcrypto error How can I fix the problem? Regards, nurtal

3 2

Exec-Program-Wait not working
by Gianni Costanzi 19 Jun '19

19 Jun '19

Hi, I was using the following syntax on Freeradius 2.x to determine if a user could connect to a particular IP address, even if the authentication succeeds, based on some parameters passed to a script: XXX747 Auth-Type = System, Realm == imp Service-Type := Login-User, cisco-avpair = "shell:priv-lvl=2", Exec-Program-Wait = "/opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm}" It worked on my old 2.x installation, now I'm on the last version available on Red Hat Enterprise 7, which is 3.0.13-10.el7_6. The syntax gives no error, but the script is not invoked (it contains an invocation to logger system command to put an entry in /var/log/messages and I can't see it), even if the above entry in the users (authorize) file is mached. What could be the problem? If this is the wrong way to implement this check can you give me an hint on how should I do it on 3.x Freeradius installation? Wed Jun 19 17:01:52 2019 : Debug: (12) files: users: Matched entry XXX747 at line 497 Wed Jun 19 17:01:52 2019 : Debug: /opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm} Wed Jun 19 17:01:52 2019 : Debug: Parsed xlat tree: Wed Jun 19 17:01:52 2019 : Debug: literal --> /opt/script/radius/bin/check_operator_access.sh Wed Jun 19 17:01:52 2019 : Debug: attribute --> NAS-IP-Address Wed Jun 19 17:01:52 2019 : Debug: literal --> Wed Jun 19 17:01:52 2019 : Debug: attribute --> User-Name Wed Jun 19 17:01:52 2019 : Debug: literal --> Wed Jun 19 17:01:52 2019 : Debug: attribute --> Realm Wed Jun 19 17:01:52 2019 : Debug: (12) files: EXPAND /opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm} Wed Jun 19 17:01:52 2019 : Debug: (12) files: --> /opt/script/radius/bin/check_operator_access.sh 172.16.120.218 XXX747@imp imp Wed Jun 19 17:01:52 2019 : Debug: (12) modsingle[authorize]: returned from files (rlm_files) Wed Jun 19 17:01:52 2019 : Debug: (12) [files] = ok Thank you in advance for any help. Best regards, Gianni Costanzi

3 14

get statistics for sql connection pool
by Daniel Finger 18 Jun '19

18 Jun '19

Hi! If the radius server is running for about a month, I get messages like "No connections available and at max connection limit". Looking at the database, only very few connections are really connected (for example 2 out of 50), there are no slow queries, not much traffic (maybe one or two packets per second) and I really don't see a reason for this. Restarting freeRADIUS immediately fixes the problem. I suspect I am using a module (I have 2 own modules running) which does not return a connection to the connection pool under some circumstances. Is it possible to get statistics about the sql connection pool usage? This could help me size the number of connections I need and get a hint, if I am reaching the limit, before I hit it. Greetings, Daniel Finger

2 2