- Freeradius-Users - lists.freeradius.org

Problem with rlm_sql_oracle to initialise.
by Saurabh Lahoti 03 Oct '18

03 Oct '18

Hi, While running radiusd -X, below error is interpreted for rlm_sql_oracle: rlm_sql (sqlADSL): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sqlADSL): Opening connection failed (0) rlm_sql (sqlADSL): Removing connection pool /usr/app/radius/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sqlADSL" Could you please help how to get rid of this error..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

fair usage policy best practices
by Ali Arslan 02 Oct '18

02 Oct '18

Hi, I am a newbie in freeradius. My radius server should handle multiple NAS devices from multiple vendors (Cisco, Mikrotik, juniper). I want to implement FUP (fair usage policy), Every user may buy different rates and fair usage limits, after he/she downloads fair usage limit quantity the rate will be lower. I see 2 options: 1- An application that checks periodically the download quantities of users and and send SSH command to server to request CoA from NAS like: echo "User-Name={UserName}, Rate-Limit={RateLimit}" | radclient NAS-IP:coaPort CoA secret 2- Unlang code in default site accounting section In first option the check period should be low enough so that users wont download too much excess of their limit, this will hang server. I need your suggestions about best practices for FUP, and some instructions if second option is suggested. a. arslan

2 3

Can I define an internal attribute for a module?
by Alejandro Perez-Mendez 02 Oct '18

02 Oct '18

Hi, I'm developing a Python module that implements a very simple TOTP functionality (it basically replaces the value of Cleartext-Password with the original value plus the expected TOTP code), so the user has to provide a concatenation of the original password and the OTP code to authenticate. This works well so far. The doubt I have is where and how to store the OTP secret codes. So far, for development, I have a Python dictionary defined on the Python module with all the User-Name -> Secret key associations, but having these on the code is not a good practice and it requires managing two user lists, one for authentication (users file or SQL DB or LDAP...) plus this OTP secret list. This might lead to inconsistencies. The first option I thought of was to make use of the config {} subsection of the python module, but it would still be a second user list (besides the main one used for authentication). Then I thought that I might be able to define an internal attribute (similar to Cleartext-Password) that contained the OTP secret. It would be defined as follows: ATTRIBUTE OTP-Secret 3000 string And then use it on the "users" file or on the DB as follows: alex(a)test.org Cleartext-Password := "OneTestingPassword", OTP-Secret := "7MR674BRPXXNYGGMPFA52MW6GSMA6JQL" This way I would be able to define the OTP Secret right next to the user password, on any backend that I'd like to use (users file, LDAP, SQL...). I've tested it and it works, so question is: Can I define internal attributes for private module usage? If so, how are numbers allocated? Can I use any number I want if it's not currently in use? Thanks, -- Alejandro Perez-Mendez Technical Specialist (AAA), Trust & Identity M (+34) 619 333 219 Skype alejandro_perez_mendez jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

3 3

how to allow only AD domain members
by Walter Laub 02 Oct '18

02 Oct '18

Hi, I configured to authenticate (via winbindd) against AD. It works, but it is possible to authenticate as well on non-AD-member devices with an AD user. Is it possible to authenticate only with the mandatory criteria "AD membership"? Thank you. Regards, Wlater

2 1

smstop with Cisco Wireless
by Paul Aviles 01 Oct '18

01 Oct '18

Hello, I am new to the community and was wondering if anyone has manage to configure freeradius with a Cisco 5508 or 2504 controller for guest authentication with smstop. The goal is to provide a static wep2 password and force the users to enter their cell number where they will receive an sms message for 2 factor authentication. If the number matches, then the user will be authenticated. I currently have regular freeradius and a 2504 working, but missing the smstop/capture/validate part. Anyone with something similar out there? Regards, Paul

2 1

Config FreeRadius (3.0.16) to work with SQL: The Guide is outdated - please helps
by james.ngobui＠gmail.com 01 Oct '18

01 Oct '18

Hello everyone, Recently, I implemented freeradius for our home office. I was able to use the method of editing the user file to add user to authorize them using our network. Now I would like to use mySQL with phpMyAdmin to control and manage other users. So I installed Lamp Stack from here: https://www.digitalocean.com/community/tutorials/how-to-install-linux-apache -mysql-php-lamp-stack-ubuntu-18-04 which basically install Apache server, SQL server and PHP server. I have all 3 up and run OK. Anyway, after that I follow the Guide here to setup the mySQL https://wiki.freeradius.org/guide/SQL-HOWTO-for-freeradius-3.x-on-Debian-Ubu ntu After I finished installing the freeradius-mysql module and created the "radius" database, it shows up in the phpMyAdmin windows. I was excited. However, further more in the Guide, I found a lot of difference/discrepancies in term of file names, location of the files like sql (not sure if sql.conf?). It seems that the Guide is now outdated and pending for update to catch up with the new version of Freeradius file organization As a result, when I attempt to use SQL to authorize the users, the server keeps rejecting my username/password I run radtest and it says "No reply from server" Could someone please instruct me how to start from the scratch again with a proper file's names, locations of each required files, what to edit, etc..? I thank you very much indeed for your support. Again, thanks James --- This email has been checked for viruses by AVG. https://www.avg.com

7 15

pass_all_vps option for rlm_python
by work vlpl 01 Oct '18

01 Oct '18

Hello, I found the not described option `pass_all_vps` for rlm_python module. Is this option intended only for testing? I am asking because neither https://wiki.freeradius.org/modules/Rlm_python page, neither default python config files from `.../raddb/mods-available` does not say anything about this options. I am -- Vladimir

4 7

Multiple keytabs on Kerberos
by LAUDREN Olivier 01 Oct '18

01 Oct '18

Hello, Is there a way to use more than 1 keytab and SPN in a FreeRADIUS configuration (I mean on the same FreeRADIUS server)? If so, how to do it? Thank you. Ce message contient des informations confidentielles à l'intention exclusive du destinataire. Il ne peut être utilisé, divulgué ou copié de quelconque façon que ce soit par une personne autre que le destinataire désigné. Si vous n'êtes pas le destinataire désigné, merci de contacter l'expéditeur et d'effacer ce message. L'expéditeur de ce message n'est pas mandaté à représenter le Parlement européen. Dès lors, ce message ne constitue pas nécessairement le point de vue officiel du Parlement européen, ni un engagement juridique opposable à ce dernier. This message contains confidential information intended solely for the attention of the named addressee. It may not be used, disclosed or copied in any way whatsoever by anyone else than the intended addressee. If you are not the intended addressee, please contact the sender and delete this message. The sender of this message is not authorized to represent the European Parliament and therefore this message does not necessarily reflect the official position of the European Parliament and is not legally binding upon it.

2 2

FreeRADIUS does not recognize device added in the NAS table
by James Ngo 30 Sep '18

30 Sep '18

Hello everyone, I was able to setup the FreeRADIUS server to authorise the user to our office wireless network. We have another pop-up office, which is VPN-ed to our main office. All devices of the both offices are able to see each other. Main office: 10.11.11.0/24 Pop-up office: 10:23.23.0/24 I create new record in the NAS table, with information pertaining to our wireless AP at the pop-up office. I uncomment the NAS in the sql.conf file I restart the server I started the server in debug log. The address 10.23.23.54 is the IP address of the Access Point in the pop-up office. The details of the devices I added manually in the NAS table, according to its fields ID: 22 Nasname: PopUpOff Shortname: TestAP Type: other Port: 1812 Secret: test123 Server: 10.23.23.54 Community: Null Description: RADIUS Client Below is the log file content. I highlight one Error that is failed to resolve the Nasname PopUpOff to IPv4, etc.... so I changed to the NAS IP address but that did not work either. But it keeps saying it is ignoring the auth request... etc... Do I have to put these in the clients.conf file as well? But that would defeat the SQL purpose I guess? Any help would be appreciated --------------------------------------------------------------------------------------------------- Sat Sep 29 18:06:41 2018 : Info: rlm_sql (sql): Opening additional connection (31), 1 of 31 pending slots used Sat Sep 29 18:16:13 2018 : Info: Signalled to terminate Sat Sep 29 18:16:13 2018 : Info: Exiting normally Sat Sep 29 18:16:13 2018 : Info: rlm_sql (sql): Closing connection (31) Sat Sep 29 18:16:13 2018 : Info: rlm_sql (sql): Closing connection (30) Sat Sep 29 18:34:19 2018 : Info: Debugger not attached Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sat Sep 29 18:34:19 2018 : Warning: [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". Sat Sep 29 18:34:19 2018 : Warning: [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". Sat Sep 29 18:34:19 2018 : Info: rlm_sql_mysql: libmysql version: 5.7.23 Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Attempting to connect to database "radius" Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used *Sat Sep 29 18:34:19 2018 : Error: Failed resolving "PopUpOff" to IPv4 address: Name or service not known* Sat Sep 29 18:34:19 2018 : Info: Need 5 more connections to reach 10 spares Sat Sep 29 18:34:19 2018 : Info: rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used Sat Sep 29 18:34:19 2018 : Info: Loaded virtual server <default> Sat Sep 29 18:34:19 2018 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Sat Sep 29 18:34:19 2018 : Info: # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:331 Sat Sep 29 18:34:19 2018 : Info: Loaded virtual server inner-tunnel Sat Sep 29 18:34:19 2018 : Info: Loaded virtual server default Sat Sep 29 18:34:19 2018 : Info: Ready to process requests Sat Sep 29 18:34:29 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 57553 proto udp Sat Sep 29 18:34:32 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 57553 proto udp Sat Sep 29 18:34:34 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 57553 proto udp Sat Sep 29 18:34:37 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.2.2.54 port 57553 proto udp Sat Sep 29 18:34:38 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 57553 proto udp Sat Sep 29 18:34:42 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 37297 proto udp Sat Sep 29 18:34:43 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 57553 proto udp Sat Sep 29 18:34:45 2018 : Error: Ignoring request to auth address * port 1812 bound to server default from unknown client 10.23.23.54 port 37297 proto udp Sat Sep 29 18:57:29 2018 : Info: Signalled to terminate Sat Sep 29 18:57:29 2018 : Info: Exiting normally Sat Sep 29 18:57:29 2018 : Info: rlm_sql (sql): Closing connection (5) Sat Sep 29 18:57:29 2018 : Info: rlm_sql (sql): Closing connection (4) Sat Sep 29 18:57:29 2018 : Info: rlm_sql (sql): Closing connection (3) Sat Sep 29 18:57:29 2018 : Info: rlm_sql (sql): Closing connection (2) Sat Sep 29 18:57:29 2018 : Info: rlm_sql (sql): Closing connection (1) Sat Sep 29 18:57:29 2018 : Info: rlm_sql (sql): Closing connection (0)

3 2

Additional NDS error messages missing in FR3 ?
by Anja Ruckdaeschel 29 Sep '18

29 Sep '18

Hi there! With FR2 you could acesss the NDS error messages, e.g. NDS error: no additional information available (-338) NDS error: failed authentication (-669) NDS error: login lockout (-197) ... and log them. In FR3 I still can see them with ldap_debug = 0xFFFF All I get e.g. with Module-Failure-Message is Bind was not permitted: Server was unwilling to perform which is the LDAP Error Code 53, which is okay, but I'd really like to log the additional messages, because it's really useful... Is there a way to still access those and log them in radius.log ....? Thank you very much. Ciao Anja

2 3