- Freeradius-Users - lists.freeradius.org

Sometimes passwords are coming in with junk
by Sam T 10 Nov '18

10 Nov '18

Hi! We are getting close to a workable solution with freeradius! When running freeradius in debug mode we can see that sometimes it comes in correctly, and other times in some kind of junky value. We need some help to see if this is an encrypt/decrypt issue, and where we may be able to align things to have 100% success rate with password traversing. some interesting things. When we login and get a =failed, we can generally get a success the 2nd time when trying again right away. here is some of the data pulled from debug. both times password was 000000 rad_recv: Access-Request packet from host 67.168.xxx.6 port 44529, id=58, length=173 User-Name = "freetest01" Acct-Session-Id = "1848a37b" NAS-Identifier = "712-xxxxxx" Framed-IP-Address = 10.255.10.51 NAS-Port-Id = "ssid1_1848a37b" Calling-Station-Id = "2C-6E-85-95-C1-C6" Called-Station-Id = "AC-86-74-7A-35-10" Class = 0x47726f75703d33362c5376633d3531 Event-Timestamp = "Nov 1 2018 08:37:03 UTC" Service-Type = Login-User User-Password = "`\033\244\361\310\337H" NAS-Port = 35 NAS-IP-Address = 192.168.1.128 # Executing section authorize from file /etc/freeradius/sites-enabled/xxxxxx.rad then rad_recv: Access-Request packet from host 67.168.xxx.6 port 57254, id=178, length=173 User-Name = "freetest01" Acct-Session-Id = "3b6dcf1b" NAS-Identifier = "712-xxxxxx" Framed-IP-Address = 10.255.10.51 NAS-Port-Id = "ssid1_3b6dcf1b" Calling-Station-Id = "2C-6E-85-95-C1-C6" Called-Station-Id = "AC-86-74-7A-35-10" Class = 0x47726f75703d33362c5376633d3531 Event-Timestamp = "Nov 1 2018 08:32:55 UTC" Service-Type = Login-User User-Password = "000000" NAS-Port = 35 NAS-IP-Address = 192.168.1.128

3 4

[Q] radacct table is empty ...
by Zeus Panchenko 09 Nov '18

09 Nov '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, my FR v.3.0.12 up and running, eap works as expected, users DB is in LDAP now I'm trying to get accounting data in SQL ( to have all the data written to files /usr/local/var/log/radius/radacct/X.X.X.X/auth-detail-YYYYmmddand ) but I'm failing to get it working ... all SQL tables except radpostauth are empty ... I have no idea why here are details: - ---[ `ls -al mods-enabled/' quotation start ]------------------------------------------- ... lrwxrwxr-x 1 radius radius 21 Apr 26 2016 eap -> ../mods-available/eap ... lrwxrwxr-x 1 radius radius 22 Apr 26 2016 ldap -> ../mods-available/ldap ... - ---[ `ls -al mods-enabled/' quotation end ]------------------------------------------- - ---[ sites-enabled/default quotation start ]------------------------------------------- authorize { ... eap { ok = return } ... } authenticate { eap } accounting { detail sql attr_filter.accounting_response } session { sql } post-auth { update { &reply: += &session-state: } sql } - ---[ sites-enabled/default quotation end ]------------------------------------------- /usr/local/var/log/radius/radacct/X.X.X.X/auth-detail-YYYYmmdd files are created and updated ... what can be the cause why SQL table radacct is empty then? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQQYIXL6FUmD7SUfqoOveOk+D/ejKgUCW+R15QAKCRCveOk+D/ej KoUjAJ9UUxqLHKWpUH5J16/tuWP/2d6d7gCggz9NjGYhjsRj63ZvFtxRIk8t39Q= =29MD -----END PGP SIGNATURE-----

2 1

Change Fixed IP to POOL on Fail
by Aurélio de Souza Ribeiro Neto 07 Nov '18

07 Nov '18

Hello Everyone. I'm using FreeRadius 3-3.0.17_2 and I want to pick an IP from Pool to a user who uses Fixed IP and tries to connect with wrong password. I tried to put this set in my default file and Fixed IP always overrides the pool IP. Auth-Type MS-CHAP { mschap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" } update reply { Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" } ok } } Some hint? Thanks Aurélio

1 0

Adding Filter-Id Attribute to Accounting Requests
by Alessandro Romano 05 Nov '18

05 Nov '18

Dear All, i need to add the attribute "Filter-ID" from database radusergroup to accounting-request packet. At the moment i retreive the attribute only in access-accept packet BR Alessandro Romano C.T.O. Cell: 3351402534 Positivo SRL Via San Leonardo 52 84131 Salerno ( Sa )

3 13

AIRTAME_authentificate_issue
by jean-francois_MONI 05 Nov '18

05 Nov '18

Hi, Does anyone has ever succeed to connect a computer to an airtame device ? The airtame is well connected to the wifi radius network and has an IP. The laptop is also connected to the same network. but the laptop can't connect to the AIRTAME device. A mystery to me... thanks for any feedback -- Jean-François MONI Technicien Informatique Université de Bordeaux IINS - UMR 5297 - Centre Broca Nouvelle-Aquitaine 146, Rue Léo Saignat 33076 Bordeaux Cedex Tél. 05.33.51.47.93

3 2

How its works and How to use Framed-ip-address
by One Zero Art 02 Nov '18

02 Nov '18

Hi, I successfully installed freeradius on Ubuntu 18**. I am using PPPoE server in mikrotik. I want to control PPPoE user ip address. Only match ip address, username and password can connect with network. Is this even possible? Also, I want to know about Framed-ip-address and how its works with freeradius. I searched google but not found my need. Thank you :) Sorry for Bad English.

2 3

Can I use two or more freeradius server certificates for the same virtual site?
by work vlpl 02 Nov '18

02 Nov '18

Hello. Certificates have limited lifespan. And when certificate will expire, there is a probability that new certificate will not be trusted by clients with old configuration. I am searching the way to smooth it. One of the ideas is to configure freeradius to use two server certificates. They will have different expiration date. So the old clients will be able to use old certificate and the new clients or clients with updated configuration will be able to accept new server certificate. I tried to place two different eap modules one by one like ... eap eap2 ... In hope that this will work like it works with modules with different types (chap -> mschap -> pap). If client does not accept server certificate from the first module, then try to send certificate from the second module. But eap module is not simple and is called multiply times (Challenge response) to setup eap session, thus this approach does not work. And in radius request I don't have any attributes that could help me to narrow request to the specific eap module. So, is it possible to use two or more freeradius server certificates? Or maybe somebody have ideas how to configure eap modules to do it. -- Vladimir

5 11

Logging EAP-TLS failures
by Norman Elton 02 Nov '18

02 Nov '18

I'm using linelog to syslog RADIUS packets. I've found that if I call my linelog in my "authorize" section, immediately after referring to my EAP module, my linelog has access to all the certificate details. Issuer, expiration, etc. I'd like to have similar details when the certificate is invalid. If the linelog is in the "authorize" section, right after my EAP module, its never reached, as the EAP failure causes the whole authorize section to fail immediately. I've tried putting it in the post-auth section as well, but cannot get it positioned such that the certificate details are available. I've also tried configuring the EAP and linelog modules in a "redundant" section, hoping that the linelog would pick up after the EAP failure. No luck there either. Am I headed in the right direction? Is there a way to catch the certificate details in a linelog module after the certificate has been found invalid? Thanks Norman

3 3

Apostrophe in username
by Dom Latter 02 Nov '18

02 Nov '18

We are using a mysql-backed v3 server and eap / peap / mschapv2. A new user has come along whose email address contains an apostrophe, ('single quote' if you prefer) which is unusual but legitimate. By default we allow users to use their email address as a username. I have found the safe_characters list here: /etc/freeradius/mods-config/sql/main/mysql/queries.conf Without the apostrophe in the safe_characters list, it gets encoded to =27 and so the db query [1] fails to find a user with that username. With the apostrophe in the list, the query fails with "an error in your SQL syntax"... Is there any way out of this conundrum except putting mime-encoded data in the database? [1] authorize_check_query from sql/mysql/dialup.conf

5 11

LDAP OU based authentication
by Tom Yard 02 Nov '18

02 Nov '18

Dear people, I have a Freeradius 2.2.5 authenticating against Active Directory (LDAP). Past week, the AD contained groups and users, and in freeradius I used this option OK and I could authenticate users belonging to WiFi group with the corresponding User-Name: If (LDAP-Group == "WiFi") ... But now, the AD has changed and it hasn't groups anymore. So I have to do an OU based authentication for the users: Basedn: OU=technology,OU=mexico,DC=company,DC=com I've read that DN's are also accepted as LDAP-Group values, so now I'm using this condition: If (LDAP-Group == "OU=technology,OU=mexico,DC=company,DC=com")... but it doesn't work. Please how can I authenticate users in accordance with their OU and not their groups? Thanking in advance, regards. Tommy

3 2