- Freeradius-Users - lists.freeradius.org

How to retain Module-Failure-Message from inner-tunnel when using PEAP
by Peter Steadman 04 Jan '19

04 Jan '19

Hello I am struggling to extract the inner-tunnel reject message to linelog and should be grateful for some help please. Instead of getting; Module-Failure-Message := "Rejected: User-Name contains whitespace" the cached message it is being replaced in the final eap exchange by; The users session was previously rejected: returning reject (again.) I did find this post; http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074957… which is exactly my issue helpfully with a solution, but unfortunately I seem to be struggling to apply the solution. - in inner-tunnel, post-auth-type Reject, do: update outer.session-state { Module-Failure-Message := &request:Module-Failure-Message } This seems to work ok but when I try applying the second part; And then in the “default” virtual server, post-auth section, you can use: %{%{session-state:Module-Failure-Message}:-%{Module-Failure-Message}} I just get the error "Missing attribute value" when trying to start the server which leads me to suspect that I am not putting this in right place or formatting it incorrectly. Could someone please give me an example of this "%{%{session-state:Module-Failure-Message}:-%{Module-Failure-Message}}" in the context of the post-auth section. many thanks Pete -- <https://twitter.com/warwickshirecol> <https://www.facebook.com/WarwickshireCollege> <https://www.linkedin.com/edu/warwickshire-college-group-355076> <https://www.instagram.com/warwickshirecol/> College Email Disclaimer This message and any files transmitted with it is intended for the addressee only and may contain information that is confidential or privileged. Unauthorised use is strictly prohibited and may be unlawful. If you are not the addressee, you should not read, copy, disclose or otherwise use this message, otherwise than to notify the College via postmaster(a)warkscol.ac.uk <mailto:postmaster@warkscol.ac.uk>. You should delete this message and any files transmitted with it from your computer and destroy any copies made. Warwickshire College gives no warranty or representation as to the accuracy or reliability of the message and files and does not necessarily endorse any opinions expressed within it.

3 3

FreeRadius 3 OpenLDAP and MAC based Auth
by Jürgen Northe 04 Jan '19

04 Jan '19

Hi folks, I have already a running environment with Freeradius2 + OpenLDAP to provide a simple NAC solution but now its time to setup a replacement with version 3. So far everything is working but somehow the "authorize" of the client is not "processed". Compared with the version 2, I am missing the rlm_ldap: radiusAuthType -> Auth-Type == Accept along with the other attributes stored in the directory. I do have a the dictionary_mapping file and the entries in the enabled ldap module. I am fighting the whole day with this issue but can't even find hint in he running environment. The Laptop exists in the LDAP (bind ok, object can be found) and has the usual radius attributes like Tunnel-Private-Group-Id set as the LDAP database is restored from the running one. With the following statement in default, I do get an "Accept", but still missing the required attributes like tunnel-type and all the others. ### redundant_ldap{ ok = return } if (!ok) { reject } else { update control { Auth-Type := Accept } } radiusd -X (1) Received Access-Request Id 186 from 192.168.0.7:3437 to 192.168.0.215:1812 length 240 (1) User-Name = "106530670342" (1) User-Password = "106530670342" (1) NAS-IP-Address = 192.168.0.7 (1) NAS-Identifier = "SWSG1AP1-7-v161121" (1) NAS-Port = 16879715 (1) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (1) NAS-Port-Type = Ethernet (1) Service-Type = Call-Check (1) Framed-Protocol = PPP (1) Calling-Station-Id = "10-65-30-67-03-42" (1) Acct-Session-Id = "10101121726a6010" (1) Huawei-Connect-ID = 675841 (1) Huawei-Product-ID = "H3C S5120-52C-EI" (1) Huawei-Startup-Stamp = 956750420 (1) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy rewrite_calling_station_id { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}%{2}%{3}%{4}%{5}%{6}} (1) --> 106530670342 (1) &Calling-Station-Id := 106530670342 (1) } # update request = noop (1) [updated] = updated (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (1) ... skipping else: Preceding "if" was taken (1) } # policy rewrite_calling_station_id = updated (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "106530670342", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry DEFAULT at line 195 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) redundant redundant_ldap { rlm_ldap (ldap1): Reserved connection (1) (1) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap1: --> (cn=106530670342) (1) ldap1: Performing search in "dc=firma,dc=de" with filter "(cn=106530670342)", scope "sub" (1) ldap1: Waiting for search result... (1) ldap1: User object found at DN "cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=firma,dc=de" rlm_ldap (ldap1): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap1): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap1): Connecting to ldap://radldap1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful (1) [ldap1] = ok (1) } # redundant redundant_ldap = ok (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> 106530670342 (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds

2 1

Use network range in hungroups file
by Daniel Finger 04 Jan '19

04 Jan '19

Hi! I would like to compare the Client-IP-Address to a network in the huntgroup file. Since FreeRADIUS 2 I am using something like this: huntgroup1 Client-IP-Address =~ 192\.168\..* With FR3 I hoped I could use something like: huntgroup1 Client-IP-Address < 192.168/16 But this results in an Error: Error: /etc/raddb/mods-config/preprocess/huntgroups[56]: Parse error (check) for entry huntgroup1: Invalid IPv4 mask length "/16". Only "/32" permitted for non-prefix types Is it somehow possible with FR3 to compare the Client-IP-Address to a network range in the huntgroups file? Sincerely, Daniel

3 2

FreeRadius 3 OpenLDAP and MAC based Auth
by Jürgen Northe 04 Jan '19

04 Jan '19

.. and the output with the statement mentioned below.... Any help appreciated!! Thank you in advance. Jürgen rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful (0) [ldap1] = ok (0) } # redundant redundant_ldap = ok (0) if (!ok) { (0) if (!ok) -> FALSE (0) else { (0) update control { (0) Auth-Type := Accept (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 189 from 192.168.0.215:1812 to 192.168.0.7:3437 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Finished request Waking up in 4.9 seconds. > Hi folks, > I have already a running environment with Freeradius2 + OpenLDAP to provide a simple NAC solution but now its time to setup a replacement with version 3. > > So far everything is working but somehow the "authorize" of the client is not "processed". Compared with the version 2, I am missing the > rlm_ldap: radiusAuthType -> Auth-Type == Accept > along with the other attributes stored in the directory. > I do have a the dictionary_mapping file and the entries in the enabled ldap module. I am fighting the whole day with this issue but can't even find hint in he running environment. > The Laptop exists in the LDAP (bind ok, object can be found) and has the usual radius attributes like Tunnel-Private-Group-Id set as the LDAP database is restored from the running one. > > With the following statement in default, I do get an "Accept", but also without the required attributes. > redundant_ldap{ > ok = return > } > > if (!ok) { > reject > } > else { > update control { > Auth-Type := Accept > } > } > > > > radiusd -X > (1) Received Access-Request Id 186 from 192.168.0.7:3437 to 192.168.0.215:1812 length 240 > (1) User-Name = "106530670342" > (1) User-Password = "106530670342" > (1) NAS-IP-Address = 192.168.0.7 > (1) NAS-Identifier = "SWSG1AP1-7-v161121" > (1) NAS-Port = 16879715 > (1) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" > (1) NAS-Port-Type = Ethernet > (1) Service-Type = Call-Check > (1) Framed-Protocol = PPP > (1) Calling-Station-Id = "10-65-30-67-03-42" > (1) Acct-Session-Id = "10101121726a6010" > (1) Huawei-Connect-ID = 675841 > (1) Huawei-Product-ID = "H3C S5120-52C-EI" > (1) Huawei-Startup-Stamp = 956750420 > (1) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235> (1) # Executing section authorize from file /etc/raddb/sites-enabled/default > (1) authorize { > (1) policy filter_username { > (1) if (&User-Name) { > (1) if (&User-Name) -> TRUE > (1) if (&User-Name) { > (1) if (&User-Name =~ / /) { > (1) if (&User-Name =~ / /) -> FALSE > (1) if (&User-Name =~ /@[^@]*@/ ) { > (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (1) if (&User-Name =~ /\.\./ ) { > (1) if (&User-Name =~ /\.\./ ) -> FALSE > (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE > (1) if (&User-Name =~ /\.$/) { > (1) if (&User-Name =~ /\.$/) -> FALSE > (1) if (&User-Name =~ /(a)\./) { > (1) if (&User-Name =~ /(a)\./) -> FALSE > (1) } # if (&User-Name) = notfound > (1) } # policy filter_username = notfound > (1) policy rewrite_calling_station_id { > (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { > (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE > (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { > (1) update request { > (1) EXPAND %{toupper:%{1}%{2}%{3}%{4}%{5}%{6}} > (1) --> 106530670342 > (1) &Calling-Station-Id := 106530670342 > (1) } # update request = noop > (1) [updated] = updated > (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated > (1) ... skipping else: Preceding "if" was taken > (1) } # policy rewrite_calling_station_id = updated > (1) [preprocess] = ok > (1) [chap] = noop > (1) [mschap] = noop > (1) suffix: Checking for suffix after "@" > (1) suffix: No '@' in User-Name = "106530670342", looking up realm NULL > (1) suffix: No such realm "NULL" > (1) [suffix] = noop > (1) eap: No EAP-Message, not doing EAP > (1) [eap] = noop > (1) files: users: Matched entry DEFAULT at line 195 > (1) [files] = ok > (1) [expiration] = noop > (1) [logintime] = noop > (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type > (1) pap: WARNING: Authentication will fail unless a "known good" password is available > (1) [pap] = noop > (1) redundant redundant_ldap { > rlm_ldap (ldap1): Reserved connection (1) > (1) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) > (1) ldap1: --> (cn=106530670342) > (1) ldap1: Performing search in "dc=firma,dc=de" with filter "(cn=106530670342)", scope "sub" > (1) ldap1: Waiting for search result... > (1) ldap1: User object found at DN "cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=firma,dc=de" > rlm_ldap (ldap1): Released connection (1) > Need 4 more connections to reach 10 spares > rlm_ldap (ldap1): Opening additional connection (6), 1 of 26 pending slots used > rlm_ldap (ldap1): Connecting to ldap://radldap1-215:389 > TLSMC: MozNSS compatibility interception begins. > tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. > tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. > TLSMC: MozNSS compatibility interception ends. > rlm_ldap (ldap1): Waiting for bind result... > rlm_ldap (ldap1): Bind successful > (1) [ldap1] = ok > (1) } # redundant redundant_ldap = ok > (1) } # authorize = ok > (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject > (1) Failed to authenticate the user > (1) Using Post-Auth-Type Reject > (1) # Executing group from file /etc/raddb/sites-enabled/default > (1) Post-Auth-Type REJECT { > (1) attr_filter.access_reject: EXPAND %{User-Name} > (1) attr_filter.access_reject: --> 106530670342 > (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (1) [attr_filter.access_reject] = updated > (1) [eap] = noop > (1) policy remove_reply_message_if_eap { > (1) if (&reply:EAP-Message && &reply:Reply-Message) { > (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (1) else { > (1) [noop] = noop > (1) } # else = noop > (1) } # policy remove_reply_message_if_eap = noop > (1) } # Post-Auth-Type REJECT = updated > (1) Delaying response for 1.000000 seconds

1 0

Guest mode with different passprhases
by Hans-Christian Esperer 03 Jan '19

03 Jan '19

Hi all, I'd like to achieve the following: A wifi where both regular users and guests can log in. All users should use PEAP to establish an encrypted connection. Normal users then use a combination of username,passphrase, nothing unusual here. Guests, however, shall be able to login with username "guest" and a PIN number as passphrase. Several PIN numbers should be allowed, but each PIN number only once, or for a certain amount of time after the first usage. The idea is that each guest is assigned a PIN number to be used once, when they need access, and upon first usage of that PIN it is deleted or marked as used in a database and cannot be used a 2nd time. PINs should be randomly generated as needed. Is this at all possible? If so, how would one best implement it? Writing your own Perl module? Is there something available in the default distro to achieve this behavior? Thanks in advance, HC

3 3

Freeradius MSSQL
by Bram Assendorp 03 Jan '19

03 Jan '19

Hi, I'm trying to get Freeradius to work with MSSQL. I have "driver = "rlm_sql_mssql"" but as stated in the above section: > # Configuration for the SQL module > # > # The database schemas and queries are located in subdirectories: > # > # sql/<DB>/main/schema.sql Schema > # sql/<DB>/main/queries.conf Authorisation and Accounting > queries > # > # Where "DB" is mysql, mssql, oracle, or postgresql. There should be a file within, sql/mssql/main/schema.sql but it's not there, there is no mssql folder. Also when selecting the rlm_sql_mssql driver, what should be the "dialect"? Should it just be mssql? Thank you!

3 5

Question about SQL logs in fr3
by Andrés Gómez 03 Jan '19

03 Jan '19

Hi dear list. I have been using freeradius 2.x from many years ago, buy now I am testing v 3.0.16. Everything works great, buy I have some Logs That I didn't have in v2.x, about MySQL: Wed Jan 2 21:04:57 2019 : Info: rlm_sql (sql): Opening additional connection (115), 1 of 32 pending slots used Wed Jan 2 21:04:57 2019 : Info: rlm_sql (sql): Opening additional connection (116), 1 of 31 pending slots used Wed Jan 2 21:05:05 2019 : Info: rlm_sql (sql): Opening additional connection (117), 1 of 30 pending slots used Wed Jan 2 21:05:10 2019 : Info: rlm_sql (sql): Opening additional connection (118), 1 of 29 pending slots used Wed Jan 2 21:05:17 2019 : Info: rlm_sql (sql): Opening additional connection (119), 1 of 28 pending slots used Wed Jan 2 21:05:20 2019 : Info: rlm_sql (sql): Opening additional connection (120), 1 of 27 pending slots used Wed Jan 2 21:05:21 2019 : Info: rlm_sql (sql): Opening additional connection (121), 1 of 26 pending slots used Wed Jan 2 21:06:00 2019 : Info: rlm_sql (sql): Opening additional connection (122), 1 of 25 pending slots used Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (119): Hit idle_timeout, was idle for 113 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (115): Hit idle_timeout, was idle for 113 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (116): Hit idle_timeout, was idle for 110 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (120): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (118): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (121): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (117): Hit idle_timeout, was idle for 70 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (122): Hit idle_timeout, was idle for 70 seconds It is the nomal behavior? I want to migrate a fr v2.x with a lot o Autentication and Accounting queries (arount 600 Auth queries per minute, and much more accounting queries per minute), What would be the best coniguration of connections in sql module and sites-enabled/default file? I only use web authenticvation (PAP), I dont use EAP, MSCHAP, DIGEST, etc Best Regards -- *C. Andrés Gómez R.*

2 1

RESTful API
by Daniel Kong 02 Jan '19

02 Jan '19

I know you guys are very busy helping the rest but I hope you can help me with this. I would like freeradius to authenticate with 3rd party application via REST API. I do have the configuration like below. connect_uri = "http://10.18.6.22:8081/apps/" authenticate { uri = "${..connect_uri}/user/%{User-Name}/%{User-Password}" method = "get" } Problem is that I do not know what to be included in the request and response for every authenticate, authorize, post-auth, and accounting. For the response, I just include the HTTP status is sufficient for authentication? How about the response for authorize, post-auth, and accounting? If the freeRadius is configured to use RESTful API, does other post-auth, authorize, and accounting can be use with mysql so that only authentication is using rest?

5 10

Expiration AVP Value Format
by Ali Arslan 02 Jan '19

02 Jan '19

Hi, I am using freeradius 3.x with mysql, and want to set expiraton date for some users in radcheck table as attribute = "Expiration", op = "==", value = endDate What should be the format of the "endDate" string here? Thanks.

2 2

Trouble with FR3 users file format
by Diggins Mike 02 Jan '19

02 Jan '19

Hello and Happy New Year! I am building a new FR3 server running the latest version to replace my FR2 server. Both authenticate users using ntlm-auth only and Radtest confirms that is working for PAP and MSCHAP. However, my ported users file seems to be causing a change in behaviour. This is what the users file looks like (from FR2). userid2 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" guest002 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" userid3 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" userid4 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" DEFAULT Auth-Type = ntlm_auth Only some of my users are in this file and have reply attributes. All other users also use ntlm_auth but have no reply attributes and are not listed in the file. Again, this worked in FR2. Using the same file in FR3, authentication works correctly whether the user is in the file or not which is correct. However, I do not get the Reply-Message attributes in the reply unless the user happens to be the very first one listed in the file (userid2 in this case). guest002 gets nothing returned nor do any of the others. If I remove the DEFAULT statement at the end of the file, any user in the users file authenticates correctly and gets the proper attributes returned in the Reply-Message. However, anyone not in the users file can no longer authenticate using PAP. Only MSCHAP works. I have users using both methods but no local passwords on the FR server. It seems redundant to specify the ntlm_auth type for every user in my users file given that's the only available option for authentication. Is there a correct way to do this and restore the previous behaviour? -Mike

2 3