- Freeradius-Users - lists.freeradius.org

WPA2 Client Authentication using Radius and remote LDAP server
by daada muyiwa 22 Sep '18

22 Sep '18

Hello Guys, I have been trying to set up Freeradius to remotely query an LDAP server when it gets authentication requests from a Wireless LAN Controller. I have been able to test that the Freeradius Server can communicate with the LDAP Server by using a Radtest tool (I get the access-accept reply) but when I try to query the remote LDAP server with requests from the Wireless LAN controller I get the following response: [ldap] No default NMAS login sequence[ldap] looking for check items in directory...[ldap] looking for reply items in directory ...WARNING: No ''known good'' password was found in LDAP. Are you sure that the user has been configured properly? Not sure if its the EAP section of the request that has issues. Your assistance would be highly appreciated. Muyiwa

7 15

converting username to lowercase
by JAHANZAIB SYED 22 Sep '18

22 Sep '18

I am running FreeRADIUS Version 2.2.8 (yes its old) along with Mikrotik Router as NAS (pppoe Server) in radacct table see some user entries with mixed uppercase ,example User1 USER2 in radcheck, the user is defined in lower case. why radacct is putting some user with random lower/uppercase ? How can I force it to use only lowercase for usernames? <http:///>

2 4

Vendor specific attributes in Access-Accept message
by Andrei Abonyo Omondi 21 Sep '18

21 Sep '18

Hello i am trying to send below two Cisco Vendor Specific Attributess in every access-accept message. How do i do this? CiscoAVPair := "subqos-policy-in=S99_IN_POLICING_5Mbps" CiscoAVPair := "subqos-policy-out=S99_OUT_POLICING_5Mbps" I've read that i need to add the VSAs to the dictionary but i cant figure out how to do this. Also how do i set the rule that in every access-accept the VSA are sent? I tried adding them to the user file luck this but no luck… - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - testing Cleartext-Password := "password" CiscoAVPair := "subqos-policy-in=S99_IN_POLICING_5Mbps" CiscoAVPair := "subqos-policy-out=S99_OUT_POLICING_5Mbps" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - This is what I'm getting from radiusd -X output - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[90]: Parse error (reply) for entry testing: Expecting operator Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If someone could also point me to a good guide or wiki on adding and testing VSAs that would be great Best regards, ________________________________ Note: All emails sent from Safaricom Limited are subject to Safaricom’s Email Terms & Conditions. Please click here to read the policy. http://www.safaricom.co.ke/images/Downloads/Terms_and_Conditions/safaricom_…

2 1

MAC Auth Bypass with default allow
by Mark Muehlbauer 21 Sep '18

21 Sep '18

FreeRadius + MySQL + MAC Authentication Bypass. Scenario: I would like to authenticate all incoming MAC addresses as valid and assign them to VLAN X. Initially I have this working just fine using the users file. Entry in users: DEFAULT Cleartext-Password := "%{User-Name}" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "22" I have MySQL and Radius talking just fine against MAC based authentication. However, I cannot find where the same DEFAULT (allow all MACs) entry should be added to allow this same functionality, but now with a MySQL backend. Thank you any and all in advance for your guidance.

2 1

Mixing pam and ldap
by Douglas Hammond 21 Sep '18

21 Sep '18

using freeradius 3 I have pam working well. I use pam to authenticate against winbind and google-authenticator. I now want to get the user groups from ldap as pam does not pass them along. I have ldap setup only in authorize. I see the user lookup performed and found but no group lookup is done. When is the group lookup performed? Can I mix ldap authorize with pam authenticate like this or is this not going to work? Is the ldap group lookup dependant on the user ldap authentication being successful?

2 2

Problem connecting oracle database with odbc connector
by Saurabh Lahoti 20 Sep '18

20 Sep '18

Hi, While trying to build Freeradius with Oracle & SQL, below error is interpreted with radiusd -X rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connection not open rlm_sql_unixodbc: Can't allocate the stmt rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sqlADSL): Opening connection failed (0) rlm_sql (sqlADSL): Removing connection pool /usr/app/radius/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sqlADSL" Which libraries are missing, could you help please..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

1 0

Fw: Re: WPA2 Client Authentication using Radius and remote LDAP server
by daada muyiwa 20 Sep '18

20 Sep '18

> You don't. It's impossible. You need to follow the Active Directory configuration guide: Deploying RADIUS: Configuring Authentication with Active Directory | | | | Deploying RADIUS: Configuring Authentication with Active Directory Alan DeKok / Design by Andreas Viklund - http://andreasviklund.com/ Deploying RADIUS: The web site of the book | | | This link will not help because the AD is running on a ''separate'' machine. The link shows how to integrate SAMBA and Freeradius on the same machine. I still need help. Also the version of EAP used is PEAP as the request are coming from a Cisco Wireless LAN Controller. On Wednesday, September 19, 2018, 11:41:24 AM GMT+1, Alan DeKok <aland(a)deployingradius.com> wrote: On Sep 19, 2018, at 5:04 AM, daada muyiwa via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Is it an actual LDAP server? Or is it Active Directory? > ''Active directory'' Then it's not a real LDAP server. It's close. but not quite a real LDAP server. >> Allow FreeRADIUS to read the "known good" password from LDAP, and it will Just Work. > > How do I make Freeradius decrypt the EAP request and query the AD with the clear text password in order to authenticate a user. You don't. It's impossible. You need to follow the Active Directory configuration guide: http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.

3 2

Problem connecting oracle database with odbc connector
by Saurabh Lahoti 20 Sep '18

20 Sep '18

Hi, While debugging freeradius build, following error is interpreted with odbc connector: rlm_sql_unixodbc: IM002 [unixODBC][Driver Manager]Data source name not found and no default driver specified rlm_sql_unixodbc: Connection failed rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sqlADSL): Opening connection failed (0) rlm_sql (sqlADSL): Removing connection pool /usr/app/radius/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sqlADSL" My SQL config is as below: sql sqlADSL { driver = "rlm_sql_unixodbc" server = "RadiusDbProd" port = 3306 login = "radius" password = <<< secret >>> radius_db = "RADSP01" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "" logfile = "/usr/app/Radiuslogs/anathana/sqltrace_ADSL.sql" default_user_profile = "" client_query = "SELECT id,nasname,shortname,type,secret FROM nas" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = ".query" type { accounting-on { } accounting-off { } start { } interim-update { } stop { } } } post-auth { reference = ".query" } } Could you help please..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

Re: Freeradius-LDAP module failed to compile
by Saurabh Lahoti 19 Sep '18

19 Sep '18

Hi , Many thanks..!! Solved. ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

1 0

Freeradius-LDAP module failed to compile
by Saurabh Lahoti 19 Sep '18

19 Sep '18

Hi, While compiling freeradius, ldap module failed to build with below error interpreted with configure: === configuring in src/modules/rlm_ldap (/home/u5496622/freeradius-server-release_3_0_17/src/modules/rlm_ldap) configure: running /bin/sh ./configure --disable-option-checking '--prefix=/usr/app/radius' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for ldap_init in -lldap... no checking for ldap_init in -lldap in /usr/local/lib... no checking for ldap_init in -lldap in /opt/lib... no checking for ldap.h... no checking for ldap.h in /usr/local/include/... no checking for ldap.h in /opt/include/... no checking for sasl/sasl.h... no checking for sasl/sasl.h in /usr/local/include/... no checking for sasl/sasl.h in /opt/include/... no configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap ldap.h. configure: creating ./config.status config.status: creating all.mk config.status: creating config.h config.status: config.h is unchanged Which additional package is needed to complete ldap build..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

3 3