- Freeradius-Users - lists.freeradius.org

Guest mode with different passprhases
by Hans-Christian Esperer 03 Jan '19

03 Jan '19

Hi all, I'd like to achieve the following: A wifi where both regular users and guests can log in. All users should use PEAP to establish an encrypted connection. Normal users then use a combination of username,passphrase, nothing unusual here. Guests, however, shall be able to login with username "guest" and a PIN number as passphrase. Several PIN numbers should be allowed, but each PIN number only once, or for a certain amount of time after the first usage. The idea is that each guest is assigned a PIN number to be used once, when they need access, and upon first usage of that PIN it is deleted or marked as used in a database and cannot be used a 2nd time. PINs should be randomly generated as needed. Is this at all possible? If so, how would one best implement it? Writing your own Perl module? Is there something available in the default distro to achieve this behavior? Thanks in advance, HC

3 3

Freeradius MSSQL
by Bram Assendorp 03 Jan '19

03 Jan '19

Hi, I'm trying to get Freeradius to work with MSSQL. I have "driver = "rlm_sql_mssql"" but as stated in the above section: > # Configuration for the SQL module > # > # The database schemas and queries are located in subdirectories: > # > # sql/<DB>/main/schema.sql Schema > # sql/<DB>/main/queries.conf Authorisation and Accounting > queries > # > # Where "DB" is mysql, mssql, oracle, or postgresql. There should be a file within, sql/mssql/main/schema.sql but it's not there, there is no mssql folder. Also when selecting the rlm_sql_mssql driver, what should be the "dialect"? Should it just be mssql? Thank you!

3 5

Question about SQL logs in fr3
by Andrés Gómez 03 Jan '19

03 Jan '19

Hi dear list. I have been using freeradius 2.x from many years ago, buy now I am testing v 3.0.16. Everything works great, buy I have some Logs That I didn't have in v2.x, about MySQL: Wed Jan 2 21:04:57 2019 : Info: rlm_sql (sql): Opening additional connection (115), 1 of 32 pending slots used Wed Jan 2 21:04:57 2019 : Info: rlm_sql (sql): Opening additional connection (116), 1 of 31 pending slots used Wed Jan 2 21:05:05 2019 : Info: rlm_sql (sql): Opening additional connection (117), 1 of 30 pending slots used Wed Jan 2 21:05:10 2019 : Info: rlm_sql (sql): Opening additional connection (118), 1 of 29 pending slots used Wed Jan 2 21:05:17 2019 : Info: rlm_sql (sql): Opening additional connection (119), 1 of 28 pending slots used Wed Jan 2 21:05:20 2019 : Info: rlm_sql (sql): Opening additional connection (120), 1 of 27 pending slots used Wed Jan 2 21:05:21 2019 : Info: rlm_sql (sql): Opening additional connection (121), 1 of 26 pending slots used Wed Jan 2 21:06:00 2019 : Info: rlm_sql (sql): Opening additional connection (122), 1 of 25 pending slots used Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (119): Hit idle_timeout, was idle for 113 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (115): Hit idle_timeout, was idle for 113 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (116): Hit idle_timeout, was idle for 110 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (120): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (118): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (121): Hit idle_timeout, was idle for 109 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (117): Hit idle_timeout, was idle for 70 seconds Wed Jan 2 21:07:10 2019 : Info: rlm_sql (sql): Closing connection (122): Hit idle_timeout, was idle for 70 seconds It is the nomal behavior? I want to migrate a fr v2.x with a lot o Autentication and Accounting queries (arount 600 Auth queries per minute, and much more accounting queries per minute), What would be the best coniguration of connections in sql module and sites-enabled/default file? I only use web authenticvation (PAP), I dont use EAP, MSCHAP, DIGEST, etc Best Regards -- *C. Andrés Gómez R.*

2 1

RESTful API
by Daniel Kong 02 Jan '19

02 Jan '19

I know you guys are very busy helping the rest but I hope you can help me with this. I would like freeradius to authenticate with 3rd party application via REST API. I do have the configuration like below. connect_uri = "http://10.18.6.22:8081/apps/" authenticate { uri = "${..connect_uri}/user/%{User-Name}/%{User-Password}" method = "get" } Problem is that I do not know what to be included in the request and response for every authenticate, authorize, post-auth, and accounting. For the response, I just include the HTTP status is sufficient for authentication? How about the response for authorize, post-auth, and accounting? If the freeRadius is configured to use RESTful API, does other post-auth, authorize, and accounting can be use with mysql so that only authentication is using rest?

5 10

Expiration AVP Value Format
by Ali Arslan 02 Jan '19

02 Jan '19

Hi, I am using freeradius 3.x with mysql, and want to set expiraton date for some users in radcheck table as attribute = "Expiration", op = "==", value = endDate What should be the format of the "endDate" string here? Thanks.

2 2

Trouble with FR3 users file format
by Diggins Mike 02 Jan '19

02 Jan '19

Hello and Happy New Year! I am building a new FR3 server running the latest version to replace my FR2 server. Both authenticate users using ntlm-auth only and Radtest confirms that is working for PAP and MSCHAP. However, my ported users file seems to be causing a change in behaviour. This is what the users file looks like (from FR2). userid2 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" guest002 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" userid3 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" userid4 Auth-Type = ntlm_auth Reply-Message = "attr1, attr2" DEFAULT Auth-Type = ntlm_auth Only some of my users are in this file and have reply attributes. All other users also use ntlm_auth but have no reply attributes and are not listed in the file. Again, this worked in FR2. Using the same file in FR3, authentication works correctly whether the user is in the file or not which is correct. However, I do not get the Reply-Message attributes in the reply unless the user happens to be the very first one listed in the file (userid2 in this case). guest002 gets nothing returned nor do any of the others. If I remove the DEFAULT statement at the end of the file, any user in the users file authenticates correctly and gets the proper attributes returned in the Reply-Message. However, anyone not in the users file can no longer authenticate using PAP. Only MSCHAP works. I have users using both methods but no local passwords on the FR server. It seems redundant to specify the ntlm_auth type for every user in my users file given that's the only available option for authentication. Is there a correct way to do this and restore the previous behaviour? -Mike

2 3

REG: Cisco-AV Pair not sent
by 8zero2 operations 31 Dec '18

31 Dec '18

Hi, I am trying to allocate a string in Cisco-AV Pair and send it as reply attribute, It works till the length is 247 chars when it becomes 248 nothing is sent back.. and when it is > 248 radius gives malformed packet error(This is no problem) But when it is 248 and nothing is sent back. It becomes a big problem as some security risks arise. Please help update reply { Cisco-AVPair = "url-redirect-acl=Web_Auth" Cisco-AVPair += "%{exec:/bin/cat /usr/local/etc/raddb/test}" } When string length is 248 ~ echo 'Service-Type="Call-Check",User-Name="ff:ff:ff:ff:ff:ff"' | radclient -x 127.0.0.1:1812 auth testing123 Sent Access-Request Id 7 from 0.0.0.0:55619 to 127.0.0.1:1812 length 45 Service-Type = Call-Check User-Name = "ff:ff:ff:ff:ff:ff" Received Access-Accept Id 7 from 127.0.0.1:1812 to 0.0.0.0:0 length 53 Cisco-AVPair = "url-redirect-acl=Web_Auth" ~ cat test url-redirect= https://abcdef.abc.in:8443/register.php?eu=kMd3HIyURkpxYd%2BxLUCYTG%2B2Oqce… ======================================================= When string length is <248 ~ echo 'Service-Type="Call-Check",User-Name="ff:ff:ff:ff:ff:ff"' | radclient -x 127.0.0.1:1812 auth testing123 Sent Access-Request Id 224 from 0.0.0.0:41832 to 127.0.0.1:1812 length 45 Service-Type = Call-Check User-Name = "ff:ff:ff:ff:ff:ff" Received Access-Accept Id 224 from 127.0.0.1:1812 to 0.0.0.0:0 length 308 Cisco-AVPair = "url-redirect-acl=Web_Auth" Cisco-AVPair = "url-redirect= https://abcdef.abc.in:8443/register.php?eu=kMd3HIyURkpxYd%2BxLUCYTG%2B2Oqce… " ~ cat test url-redirect= https://abcdef.abc.in:8443/register.php?eu=kMd3HIyURkpxYd%2BxLUCYTG%2B2Oqce… Regards, Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 4

policy in fr 3
by Andrés Gómez 29 Dec '18

29 Dec '18

Hi dear list. I will migrate an old freeradius server v2.x o the lastest v 3.0.17. REading the documentation about I see that the file policy.conf that I use in v2 to rewrite the calledstationid in accounting, in not used in v3. In old v2, I have this policy: rewrite.called_station_id { if((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) { update request { Called-Station-Id := "%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}" } # SSID component? if ("%{8}") { update request { Called-Station-Id := "%{Called-Station-Id}" } } updated } else { update request { Called-Station-Id := "%{tolower:%{Called-Station-Id}}" } } } then I enable it in sites-availables/default: authorize { rewrite.called_station_id rewrite.calling_station_id ... } How can I do this in v3.0.x? Best regards!! -- *C. Andrés Gómez R.*

2 2

Get md5 password from chap-password and chap-challenge
by Imdad Hasan 27 Dec '18

27 Dec '18

Respected All, Can i get md5 password from CHAP-Password and CHAP-Challenge in external php script in freeradius 2.2.6.? If, Yes than please suggest me the way to get md5 password. Thank you. Warm regards Imdadali Kadiwala

2 1

Anything special to apply a server cert by CSR for eap-tls?
by luckydog xf 26 Dec '18

26 Dec '18

I come accross a blog https://frasertweedale.github.io/blog-redhat/posts/2017-08-14-ad-cs.html which suggests that **In AD CS, the template to use is indicated by an X.509 extension in the certificate signing request (CSR). The template specifier can be one of two extensions.** So if I just run command **make server.csr** and do nothing, the cert request against windows CA would fail as I met before. Because an X509 extension should be added in CSR. Something like : ------------------ Attributes: Requested Extensions: 1.3.6.1.4.1.311.20.2: # Your Cert template OID ..... ----------------- As it's hard to add this extension, so here is a way to fix the error I met before. 1. In MS CA, create your server template, duplicate `computer` and name it as `temp-computer`, please make sure DNS name is unchecked in Subject Alternative Name of `temp-computer`. As this required FreeRadius is a member of MS Active directory. 2. change server.cnf and make sever.csr. 3. copy server.csr to MS CA. 4. Run-->cmd, run ---------------- certreq -submit -attrib “CertificateTemplate:temp-computer" -------------- A window pops up, choose your server.csr file. 5. Done, save your certificate and copy to Freeradius server /etc/raddb/certs/ -------- An alternative way is copying MS CA to Freeraidus and signing a server certiificate. I'll skip this one. Over, good luck. Hope some could fix the scripts of Makefile, add cert template required by MS CA. :) Merry X-mas !!!

1 1