- Freeradius-Users - lists.freeradius.org

AIRTAME_authentificate_issue
by jean-francois_MONI 05 Nov '18

05 Nov '18

Hi, Does anyone has ever succeed to connect a computer to an airtame device ? The airtame is well connected to the wifi radius network and has an IP. The laptop is also connected to the same network. but the laptop can't connect to the AIRTAME device. A mystery to me... thanks for any feedback -- Jean-François MONI Technicien Informatique Université de Bordeaux IINS - UMR 5297 - Centre Broca Nouvelle-Aquitaine 146, Rue Léo Saignat 33076 Bordeaux Cedex Tél. 05.33.51.47.93

3 2

How its works and How to use Framed-ip-address
by One Zero Art 02 Nov '18

02 Nov '18

Hi, I successfully installed freeradius on Ubuntu 18**. I am using PPPoE server in mikrotik. I want to control PPPoE user ip address. Only match ip address, username and password can connect with network. Is this even possible? Also, I want to know about Framed-ip-address and how its works with freeradius. I searched google but not found my need. Thank you :) Sorry for Bad English.

2 3

Can I use two or more freeradius server certificates for the same virtual site?
by work vlpl 02 Nov '18

02 Nov '18

Hello. Certificates have limited lifespan. And when certificate will expire, there is a probability that new certificate will not be trusted by clients with old configuration. I am searching the way to smooth it. One of the ideas is to configure freeradius to use two server certificates. They will have different expiration date. So the old clients will be able to use old certificate and the new clients or clients with updated configuration will be able to accept new server certificate. I tried to place two different eap modules one by one like ... eap eap2 ... In hope that this will work like it works with modules with different types (chap -> mschap -> pap). If client does not accept server certificate from the first module, then try to send certificate from the second module. But eap module is not simple and is called multiply times (Challenge response) to setup eap session, thus this approach does not work. And in radius request I don't have any attributes that could help me to narrow request to the specific eap module. So, is it possible to use two or more freeradius server certificates? Or maybe somebody have ideas how to configure eap modules to do it. -- Vladimir

5 11

Logging EAP-TLS failures
by Norman Elton 02 Nov '18

02 Nov '18

I'm using linelog to syslog RADIUS packets. I've found that if I call my linelog in my "authorize" section, immediately after referring to my EAP module, my linelog has access to all the certificate details. Issuer, expiration, etc. I'd like to have similar details when the certificate is invalid. If the linelog is in the "authorize" section, right after my EAP module, its never reached, as the EAP failure causes the whole authorize section to fail immediately. I've tried putting it in the post-auth section as well, but cannot get it positioned such that the certificate details are available. I've also tried configuring the EAP and linelog modules in a "redundant" section, hoping that the linelog would pick up after the EAP failure. No luck there either. Am I headed in the right direction? Is there a way to catch the certificate details in a linelog module after the certificate has been found invalid? Thanks Norman

3 3

Apostrophe in username
by Dom Latter 02 Nov '18

02 Nov '18

We are using a mysql-backed v3 server and eap / peap / mschapv2. A new user has come along whose email address contains an apostrophe, ('single quote' if you prefer) which is unusual but legitimate. By default we allow users to use their email address as a username. I have found the safe_characters list here: /etc/freeradius/mods-config/sql/main/mysql/queries.conf Without the apostrophe in the safe_characters list, it gets encoded to =27 and so the db query [1] fails to find a user with that username. With the apostrophe in the list, the query fails with "an error in your SQL syntax"... Is there any way out of this conundrum except putting mime-encoded data in the database? [1] authorize_check_query from sql/mysql/dialup.conf

5 11

LDAP OU based authentication
by Tom Yard 02 Nov '18

02 Nov '18

Dear people, I have a Freeradius 2.2.5 authenticating against Active Directory (LDAP). Past week, the AD contained groups and users, and in freeradius I used this option OK and I could authenticate users belonging to WiFi group with the corresponding User-Name: If (LDAP-Group == "WiFi") ... But now, the AD has changed and it hasn't groups anymore. So I have to do an OU based authentication for the users: Basedn: OU=technology,OU=mexico,DC=company,DC=com I've read that DN's are also accepted as LDAP-Group values, so now I'm using this condition: If (LDAP-Group == "OU=technology,OU=mexico,DC=company,DC=com")... but it doesn't work. Please how can I authenticate users in accordance with their OU and not their groups? Thanking in advance, regards. Tommy

3 2

Rewrite Rule
by Maile Halatuituia 02 Nov '18

02 Nov '18

Hi I have this Cisco-AVPair = "acct-input-octets-ipv6=xxx" on my radius acct-request packet coming from my Cisco BRAS. I want to rewrite it to something like this acct-input-octets-ipv6=xxx on my preacct section of my default server (/etc/freeradius/sites-available/default) config and update my request ..... I have this policy already if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { update request { &acct-input-octets-ipv6 := "%{2}" } } But seems it doing nothing. Maybe my regex above is wrong or something but that's why I ask . Here is the portion of my freeradius -X I think it is relevant to this question. # Executing section preacct from file /etc/freeradius/sites-enabled/default (2) preacct { (2) policy acct_counters64.preacct { (2) update request { (2) WARNING: Can't find &Acct-Input-Gigawords. Using 0 as operand value (2) EXPAND %{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets} (2) --> 52 (2) &Acct-Input-Octets64 = 52 (2) WARNING: Can't find &Acct-Output-Gigawords. Using 0 as operand value (2) EXPAND %{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets} (2) --> 92 (2) &Acct-Output-Octets64 = 92 (2) } # update request = noop (2) } # policy acct_counters64.preacct = noop (2) [preprocess] = ok (2) if ( &User-Name !~ /\@/ ) { (2) if ( &User-Name !~ /\@/ ) -> FALSE (2) update request { (2) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} (2) --> 1541032848 (2) &FreeRADIUS-Acct-Session-Start-Time := Nov 1 2018 13:40:48 +13 (2) } # update request = noop (2) policy acct_unique { (2) update request { (2) Tmp-String-9 := "ai:" (2) } # update request = noop (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (2) EXPAND %{hex:&Class} (2) --> (2) EXPAND ^%{hex:&Tmp-String-9} (2) --> ^61693a (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (2) else { (2) update request { (2) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (2) --> 8022139d00768a562a41866693fa1427 (2) &Acct-Unique-Session-Id := 8022139d00768a562a41866693fa1427 (2) } # update request = noop (2) } # else = noop (2) } # policy acct_unique = noop (2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { (2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE (2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) { (2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) -> FALSE (2) } # preacct = ok Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

3 16

Wiki Documentation Error
by Dan M 31 Oct '18

31 Oct '18

There is a bad link on the wiki. The Getting Started page (http://wiki.freeradius.org/guide/Getting%20Started) Has text If you need to install it yourself, the Wiki >installation< page contains detailed instructions for a number of platforms. The page linked by "installation" doesn't seem to exist because it comes up as http://wiki.freeradius.org/create/Installation 403 - Forbidden (I'm sure it's forbidden because the public can't create pages) Perhaps it can be repaired Dan M

3 2

Evaluate condition against LDAP with ulang
by Tom Yard 31 Oct '18

31 Oct '18

Hi people, I have implemented a Freeradius sever running OK that authenticate against LDAP. Firstly, I have a LDAP tree with users under groups, such as: CN=Network,OU=Employess,DC=company,DC=com and my evaluating condition wit ulang was: if (LDAP-Group == Network) And the authentication was OK. But now, the LDAP administrators has modify the LDAP tree and now the users are under the OU as below: OU=Employess,DC=company,DC=com How can I evaluate the condition "if the user is under OU=Employees" ??? Because if I use if (LDAP-Group == Employees), it doesn't authneticate. Thanks a lot, regards !!!

3 3

pap + mac auth authentication problem
by Frédéric Goudal 31 Oct '18

31 Oct '18

Hello, I’m in the following situation : - I have switches that share either wifi and wired connexions. - on wifi connexion I have an eap/peap authentication - what I want is that on wired connexion, if the user/password authentication fail, authentication is done on mac-adress with automatic vlan configuration. I have a working wifi configuration on a first server I have a working wired configuration on a second server Is there any way to mix both on a single server ? Server version is 3.0.17 The wifi configuration is : authorize { preprocess mschap suffix eap files ldap } authenticate { Auth-Type MS-CHAP { mschap } eap } The wired configuration is : authorize { filter_username rewrite.called_station_id_ipb rewrite.calling_station_id_ipb preprocess suffix update control { Auth-Type := Accept Tunnel-Private-Group-Id :=" %{ldap:ldap://ldap.xxx/ou=hosts,dc=xxx,dc=xxx?radiusTunnelPrivateGroupId?sub?(&(objectClass=radiusProfile)(macAddress=%{Calling-Station-ID}))}" } if (!"%{control:Tunnel-Private-Group-ID}") { reject } expiration logintime } authenticate { } post-auth { update { &reply: += &session-state: } -sql update reply { &Tunnel-Private-Group-Id := "%{control:Tunnel-Private-Group-Id}" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Type := "VLAN" } remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject } Post-Auth-Type Challenge { } }

4 12