- Freeradius-Users - lists.freeradius.org

pap: WARNING: Authentication will fail unless a "known good" password is available
by ahmet erkol 12 Oct '18

12 Oct '18

Hi, I installed freeradius 3.0.16 with mysql. But i have an error and warning like this. (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject I couldn't find a solution. This is the mysql radcheck table, mysql> select * from radcheck; +----+----------+--------------------+----+--------+ | id | username | attribute | op | value | +----+----------+--------------------+----+--------+ | 8 | ahmet | User-Password | := | 123456 | +----+----------+--------------------+----+--------+ This is the whole debug Ready to process requests (0) Received Access-Request Id 71 from 10.26.144.169:54792 to 10.9.15.250:1812 length 45 (0) User-Name = "ahmet" (0) User-Password = "123456" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ahmet", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> ahmet (0) sql: SQL-User-Name set to 'ahmet' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ahmet' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ahmet' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'ahmet' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'ahmet' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> ahmet (0) sql: SQL-User-Name set to 'ahmet' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'ahmet', '123456', 'Access-Reject', '2018-10-12 09:37:39') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'ahmet', '123456', 'Access-Reject', '2018-10-12 09:37:39') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> ahmet (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 71 from 10.9.15.250:1812 to 10.26.144.169:54792 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 71 with timestamp +2 Ready to process requests

5 13

[proposal] to add LDAP freeradius-radaact.schema
by Zeus Panchenko 12 Oct '18

12 Oct '18

<#secure method=pgp mode=sign sender=0FF7A32A> hi, I need to write to client's configuration LDAP object, values of these acct attributes: NAS-Port-Id NAS-Port-Type Called-Station-Id NAS-Identifier NAS-IP-Address Timestamp I wasn't able to find any among existing ones, so I want to propose to extend current freeradius LDAP schemas with the one for accounting (file is attached) I believe it'd be great to have it in one place, rather than write custom schema ... -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) attributetype ( 1.3.6.1.4.1.11344.5.1.1.1 NAME 'radiusAcctSessionId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.2 NAME 'radiusAcctUniqueId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.3 NAME 'radiusUserName' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.4 NAME 'radiusRealm' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.5 NAME 'radiusNASIPAddress' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.6 NAME 'radiusNASPortId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.7 NAME 'radiusNASPortType' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.8 NAME 'radiusAcctStartTime' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.9 NAME 'radiusAcctUpdateTime' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.10 NAME 'radiusAcctStopTime' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.11 NAME 'radiusAcctInterval' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.12 NAME 'radiusAcctSessionTime' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.13 NAME 'radiusAcctAuthentic' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.14 NAME 'radiusConnectInfoStart' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.15 NAME 'radiusConnectInfoStop' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.16 NAME 'radiusAcctInputOctets' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.17 NAME 'radiusAcctOutputOctets' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.18 NAME 'radiusCalledStationId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.19 NAME 'radiusCallingStationId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.20 NAME 'radiusAcctTerminateCause' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.21 NAME 'radiusServiceType' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.22 NAME 'radiusFramedProtocol' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.11344.5.1.1.23 NAME 'radiusFramedIpAddress' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) objectclass ( 1.3.6.1.4.1.11344.5.1.2.1 NAME 'radiusacct' SUP top AUXILIARY MAY ( radiusAcctSessionId $ radiusAcctUniqueId $ radiusUserName $ radiusRealm $ radiusNASIPAddress $ radiusNASPortId $ radiusNASPortType $ radiusAcctStartTime $ radiusAcctUpdateTime $ radiusAcctStopTime $ radiusAcctInterval $ radiusAcctSessionTime $ radiusAcctAuthentic $ radiusConnectInfoStart $ radiusConnectInfoStop $ radiusAcctInputOctets $ radiusAcctOutputOctets $ radiusCalledStationId $ radiusCallingStationId $ radiusAcctTerminateCause $ radiusServiceType $ radiusFramedProtocol $ radiusFramedIpAddress ) )

2 1

Free Radius + Pfsense + Captive portal + Social Login
by hiran bhagvan 12 Oct '18

12 Oct '18

Hi I have just installed Pfsense and free radius. Can anyone tell me if it is possible for me to configure pfsense / free radius to achieve the following. I have a number of Hardware Firewall Routers at different locations around the country. I want to offer "Guest wifi" i want users to connect the the guest SSID and then see a splash screen with the option to login with facebook, google, twitter etc. Once they login their MAC address of their device will be saved on pfsence database so if that user goes to another site and connects to another router they will not have to login again. Is this possible? If it is can anyone tell me how i go about configuring this with pfsence / free radius. Thank Hiran Image by FlamingText.com

3 3

Username tolower
by Nischal Mathabhik 12 Oct '18

12 Oct '18

Hi All, I am trying to locate the place in freeradius 3 where it i can set it to change the username tolower before it passes it to ldap for Authentication. -- Regards,

2 2

Hello, freeradius + pptpd
by Andrew Lemstrom 11 Oct '18

11 Oct '18

Hello, I recently took it upon myself to set up PPTPd with FreeRadius. I appear to have RadiusClient attached and working as I am seeing requests going to the FreeRadius server, however, it is rejecting them. When I test with radtest, it appears to be working fine with the user credentials. Has anyone else experienced this issue? What information would you like from me pertaining to this setup? The configuration all appears correct but I am curious if it just simply isn't talking the lingo thus rejecting it as its formatted wrong. Either way, your help is greatly appreciated! Thank you, Andrew Lemstrom

2 1

How to connect remote database with freeradius
by One Zero Art 11 Oct '18

11 Oct '18

Hi, I am new in freeradius. I am trying to connect remote mariadb database into freeradius. My remote database on shared hosting. I have tried to connect with shared hosting ip address but its not working. Can anyone please give me a solution. Thank you

2 1

FreeRADIUS with FortiClient help
by Dimitrios Panagiotaros 11 Oct '18

11 Oct '18

Hello, My name is Dimitrios and I've successfully set up a test FreeRADIUS and AD server and am able to authenticate to AD via the FreeRADIUS server. I've also been able to include the Google Authenticator and authenticate with 2FA when I SSH into a linux box with it. What I'm trying to do is see if it is possible to authenticate via a FortiClient SSL VPN with 2FA. I'm able to authenticate without 2FA but whenever I go to add 2FA, I receive errors and it's not able to. I'm reaching out because I'm trying to figure out if there is any documentation out there for this or if you know of a way to do this? I've seen in a couple forums that this is possible but no one has elaborated on how to go about doing this and figured I'd reach out to see if maybe anyone else has heard of this. Please let me know! Thanks, Dimitrios Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more visit the Mimecast website.

2 1

Freeradius 3.0.15 Fair Usage Policy doesn't work
by Görkem İnanç Korkmaz 10 Oct '18

10 Oct '18

I am running on the freeradius 3.0.15 on Ubuntu 16.04 almost over 4 month. But still I couldn't figure out how to deploy fair usage policy. I just want to reply Mikrotik-Rate-Limit to user when they hit the quota for daily. 1- nano /etc/freeradius/mods-enabled/sqlcounter I added the following counter sqlcounter dailyquota{ count_attribute = Acct-Input-Octets counter_name = My-Total-Data-Limit check_name = My-Total-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE UserName='%{User-Name}'" } 2- nano /etc/freeradius/sites-enabled/default nano /etc/freeradius/sites-available/default In authorize section added the counter name authorize { ...... dailyquota ...... } In accounting section added the counter query and reply message accounting { ...... if ( "%{sql: SELECT ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE UserName='%{User-Name}'}" > "%{sql: SELECT value from radcheck where username='%{User-Name}' and attribute='My-Total-Limit'}" ) { update disconnect { Mikrotik-Rate-Limit := "2M/2M" Reply-Message := "You have reached your transfer limit. Limited bandwidth" } } ...... } 3- Define the My-Total-Limit attribute on dictionary ATTRIBUTE My-Total-Limit 3001 integer64 4- Add the user with the attribute that 10 MB quota INSERT INTO radcheck (id ,username ,attribute ,op ,value) VALUES (NULL , 'gorkem', 'Cleartext-Password', ':=', '123'); INSERT INTO radcheck (id ,username ,attribute ,op ,value) VALUES (NULL , 'gorkem', 'My-Total-Limit', ':=', '10000000'); 5- Restart the freeradius service, try to authenticate then look your accounting data. Result is interesting, when user pass over his quota (10MB), user can still keep going to use internet. Nothing changed while user is connected. But If the user logout, He try to login again reply message deployed when he logged in. After than user can get the new speed limit for his session. I don't want to do this. I think it must be automatically. I want to send CoA reqeust to Mikrotik NAS client for change the user speed limit automatically. How can I achive that? Is there anyone figure out, that how to do ? Here is my debug output: https://drive.google.com/open?id=1ClT3D291tO6GXf9L6VPJ1h1ZTsizFUhu Also there one more question, in my debug output that i realized. When I add the dailyquota freeradius, it automatically add the reply_name=Session-Timeout to counter. So I looked on the Mikrotik router of the users session timeout is deployed My-Total-Limit value as the time 10000000 seconds (almost 116 day) How can I solve this problem, Is there anyone figure out, how it should be done? Görkem İnanç KORKMAZ Junior IT Engineer

3 5

REG: difference in debug and normal mode
by 8zero2 operations 10 Oct '18

10 Oct '18

Hi, Is there a difference in terms of the way packets are accepted when running in debugging mode versus the normal mode. I have a very strange scenario where radius crashes when put in normal mode but runs just fine in debugging mode. I suspect it may be due to sudden surge in load, but then that would only be the case when the way radius handles packets in the two cases is different. Thanks in advance for the help. Regards, Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

4 9

Re: Freeradius REST module Authentication problem -
by Görkem İnanç Korkmaz 10 Oct '18

10 Oct '18

Hi Arran, I read those documents but I didn't understant how to deploy rest module for authentication and accounting exactly Junior IT Engineer System and Network Specialist

2 3