- Freeradius-Users - lists.freeradius.org

Help with Freeradius/freeradius-server Docker Container
by Reuben Fischman 11 Mar '19

11 Mar '19

I'm attempting to run the freeradius/freeradius-server:latest docker container on top of Ubuntu 18.04. Whenever I execute the docker run example shown on the docker hub, the container seems to start and then immediately quit. Trying to pull log information using docker logs doesn't show anything (empty set is returned) Any help is appreciated!

3 3

Stop the accounting response
by Raghu nathan 10 Mar '19

10 Mar '19

Hello Team, We have the setup to update the postgreSQL database for START and STOP accounting request and its working fine. I would like to have an option to make freeRADIUS not to send reply for any accounting messages but accounting request should get logged in Database. Will it be possible on freeRADIUS 3.0.13? Regards, Raghu

4 4

How to set Acct-Interim-Interval for all users ?
by John Erickson 09 Mar '19

09 Mar '19

Hello, How to add the Acct-Interim-Interval attribute for all users ? I'm using freeradius 3 on centos 7. I know that one way is to insert it into the radreply table or the radgroupreply table. If possible, where and how to set it for all users in the config files under /etc/raddb, so I can avoid adding it many times in the mysql tables ? Thank you.

2 4

Security issues with public CA and signing certificates?
by June Murderer 09 Mar '19

09 Mar '19

Hello everyone, I am following up on what Alan wrote two years ago regarding self-signed certificates and public CAs. The concern was regarding the possibility of setting up a rogue access point. For clients who do not have WiFi pre-configured, does not change anything if it is a self-signed certificate or a certificate from a public CA, because most of the users would trust the *fake* RADIUS certificate if it has all the humanly-readable field of the *original* certificate. For clients who do have WiFi pre-configured, Alan stated that people who use self-signed CAs for RADIUS are safe from this attack, while people who use public CAs might not be safe since someone could pay the $3k or so to get a signing certificate issued by that same CA and create the server certificate. According to Alan, this approach should work because most supplicants historically have not cached the *server* certificate. Instead, they only track the CA certificate. By googling I was able to download the exact CA certificate we use and I was also able to download one of the three signing certificates (I suppose the root), so probably the two signing certficates I wasn't able to find are the intermediate ones. However, on iOS, whenever I download the configuration profile I can see all the info of the CA certificate and the three signing certificates. Would be possible for someone with major hacking skills to deploy the server certificate by downloading or creating the signing certificates with all these informations (not sure whether the private keys can be found)? June.

2 5

UDP Lost Packets
by Oscar 09 Mar '19

09 Mar '19

Hi, At the moment I have arroung 1.000 mikrotik routers with hotspot using freeRadius as auth and account. The radius server is on AWS Frankfurt and most of the clients are working ok. But there are some (10 or so) cliens that are losing always udp packets and arround 10% of request are lost. And also Form this locations some days the lost packets from that lacations increase to 100% . I can solve this routing the radius to a VPN directly from the router to the radius server and the 0% of lost packets. I've found this doc: <https://www.rfc-editor.org/pdfrfc/rfc6613.txt.pdf> https://www.rfc-editor.org/pdfrfc/rfc6613.txt.pdf And I really sure that the problem is that on some clients the packets are lost probably by the fragmentation of the udp packet that get lost. And when the ISP from that clients update, or change or noone knows why the result is that our upd radius packets are all lost. Anyone know if there is something I can do to improve this ? I've tried to change MTU on mikrotik but not success. Thanks,

2 1

Integrate ldap query to freeradius
by Boudjoudad Abdelkader 08 Mar '19

08 Mar '19

Hello, How can i integrate this ldap query in freeradius authentication to get the group name of user ? ldapsearch -h server.example.com -p 389 -x -W -D "cn=Directory Manager" "uid=username" | grep memberOf | awk '{print $2}' | cut -d ',' -f -1 Thanks,

4 4

Counter Attribute Mikrotik-Total-Limit Must be Integer64
by One Zero Art 08 Mar '19

08 Mar '19

Hi, Trying to prevent authorization of users after usage limited data. I have set sqlcounter for this but debug mode showing this error "counter Attribute Mikrotik-Total-Limit Must be Integer64". Inserted "Mikrotik-Total-Limit" in radcheck. I have set other counter but those were working fine. Searched google but no luck. I also check default Mikrotik dictionary, Mikrotik-Total-Limit exist there with interger and id 17. Should I changed that or how can I update attribute? I am using Ubuntu 18.4 and Freeradius 3.0.16 Thank

3 3

Help on What is the preferred OpenSSL version for freeradius 3.16
by shivu prasad 07 Mar '19

07 Mar '19

Hi All, We have in the process to release our module on top of the freeradius server , can you let me know what is the preferred OpenSSL version for freeradius 3.16 so that we can add it in pre-requisite for customers? Regards, Shivaprasad

3 4

problem with outer and inner (User-Name).
by dg 06 Mar '19

06 Mar '19

Hello, can anyone help ? I have problem with identity. I am testing it with windows 7 and my cisco switch - ethernet. when i log in (and using identity ) i have in logs: Mon Mar 4 18:23:07 2019 : Auth: (36) Login OK: [tom/<via Auth-Type = eap>] (from client SW1 port 0 via TLS tunnel) Mon Mar 4 18:23:07 2019 : Auth: (37) Login OK: [whatever/<via Auth-Type = eap>] (from client SW1 port 50002 cli A1-A2-04-E7-5C-8D) i know that radius logs what its get from NAS but in this case i have problem with accounting (its log "whatever" instead of "tom") i know that to log the inner User-Name, it needs to be copied from the inner-tunnel to the outer. in /etc/raddb/sites-enabled/inner-tunnel in post-auth i have update outer.session-state { &User-Name := &User-Name } i also tried (from FreeRADIUS Begginers's Guide): if(outer.request:User-Name != request:User-Name) update reply { User-Name := "%{request:User-Name}" } } but in logs when i trying to log in i still have: Mon Mar 4 18:23:07 2019 : Auth: (36) Login OK: [tom/<via Auth-Type = eap>] (from client SW1 port 0 via TLS tunnel) Mon Mar 4 18:23:07 2019 : Auth: (37) Login OK: [whatever/<via Auth-Type = eap>] (from client SW1 port 50002 cli A1-A2-04-E7-5C-8D) in /etc/raddb/mods-enabled/eap i have "use_tunneled_reply = yes" what am i doing wrong ? can anyone help ? i have FreeRADIUS Version 3.0.15 best regards

2 1

double quotes in Tunnel-Private-Group-Id
by Marc Boisis 06 Mar '19

06 Mar '19

We migrate from freeradius 2.2.5 to a new server in 3.0.13 The attribute Tunnel-Private-Group-Id come from same ldap server between the two freeradius server . With 2.2.5 : Access-Accept Id 105 from 10.10.10.21:1812 to 10.10.10.21:44901 length 0 Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN With 3.0.13 : Access-Accept Id 105 from 10.10.10.21:1812 to 10.10.10.21:44901 length 0 (20) Tunnel-Type := VLAN (20) Tunnel-Medium-Type := IEEE-802 (20) Tunnel-Private-Group-Id := "\"2\"" Why there is backslashed double quote in the value with the 3.0.13 and what can I do to remove them, my clients doesn't understand them ? Thanks

2 2