- Freeradius-Users - lists.freeradius.org

MAC Auth Bypass with default allow
by Mark Muehlbauer 21 Sep '18

21 Sep '18

FreeRadius + MySQL + MAC Authentication Bypass. Scenario: I would like to authenticate all incoming MAC addresses as valid and assign them to VLAN X. Initially I have this working just fine using the users file. Entry in users: DEFAULT Cleartext-Password := "%{User-Name}" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "22" I have MySQL and Radius talking just fine against MAC based authentication. However, I cannot find where the same DEFAULT (allow all MACs) entry should be added to allow this same functionality, but now with a MySQL backend. Thank you any and all in advance for your guidance.

2 1

Mixing pam and ldap
by Douglas Hammond 21 Sep '18

21 Sep '18

using freeradius 3 I have pam working well. I use pam to authenticate against winbind and google-authenticator. I now want to get the user groups from ldap as pam does not pass them along. I have ldap setup only in authorize. I see the user lookup performed and found but no group lookup is done. When is the group lookup performed? Can I mix ldap authorize with pam authenticate like this or is this not going to work? Is the ldap group lookup dependant on the user ldap authentication being successful?

2 2

Problem connecting oracle database with odbc connector
by Saurabh Lahoti 20 Sep '18

20 Sep '18

Hi, While trying to build Freeradius with Oracle & SQL, below error is interpreted with radiusd -X rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connection not open rlm_sql_unixodbc: Can't allocate the stmt rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sqlADSL): Opening connection failed (0) rlm_sql (sqlADSL): Removing connection pool /usr/app/radius/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sqlADSL" Which libraries are missing, could you help please..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

1 0

Fw: Re: WPA2 Client Authentication using Radius and remote LDAP server
by daada muyiwa 20 Sep '18

20 Sep '18

> You don't. It's impossible. You need to follow the Active Directory configuration guide: Deploying RADIUS: Configuring Authentication with Active Directory | | | | Deploying RADIUS: Configuring Authentication with Active Directory Alan DeKok / Design by Andreas Viklund - http://andreasviklund.com/ Deploying RADIUS: The web site of the book | | | This link will not help because the AD is running on a ''separate'' machine. The link shows how to integrate SAMBA and Freeradius on the same machine. I still need help. Also the version of EAP used is PEAP as the request are coming from a Cisco Wireless LAN Controller. On Wednesday, September 19, 2018, 11:41:24 AM GMT+1, Alan DeKok <aland(a)deployingradius.com> wrote: On Sep 19, 2018, at 5:04 AM, daada muyiwa via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Is it an actual LDAP server? Or is it Active Directory? > ''Active directory'' Then it's not a real LDAP server. It's close. but not quite a real LDAP server. >> Allow FreeRADIUS to read the "known good" password from LDAP, and it will Just Work. > > How do I make Freeradius decrypt the EAP request and query the AD with the clear text password in order to authenticate a user. You don't. It's impossible. You need to follow the Active Directory configuration guide: http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.

3 2

Problem connecting oracle database with odbc connector
by Saurabh Lahoti 20 Sep '18

20 Sep '18

Hi, While debugging freeradius build, following error is interpreted with odbc connector: rlm_sql_unixodbc: IM002 [unixODBC][Driver Manager]Data source name not found and no default driver specified rlm_sql_unixodbc: Connection failed rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sqlADSL): Opening connection failed (0) rlm_sql (sqlADSL): Removing connection pool /usr/app/radius/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sqlADSL" My SQL config is as below: sql sqlADSL { driver = "rlm_sql_unixodbc" server = "RadiusDbProd" port = 3306 login = "radius" password = <<< secret >>> radius_db = "RADSP01" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "" logfile = "/usr/app/Radiuslogs/anathana/sqltrace_ADSL.sql" default_user_profile = "" client_query = "SELECT id,nasname,shortname,type,secret FROM nas" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = ".query" type { accounting-on { } accounting-off { } start { } interim-update { } stop { } } } post-auth { reference = ".query" } } Could you help please..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

Re: Freeradius-LDAP module failed to compile
by Saurabh Lahoti 19 Sep '18

19 Sep '18

Hi , Many thanks..!! Solved. ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

1 0

Freeradius-LDAP module failed to compile
by Saurabh Lahoti 19 Sep '18

19 Sep '18

Hi, While compiling freeradius, ldap module failed to build with below error interpreted with configure: === configuring in src/modules/rlm_ldap (/home/u5496622/freeradius-server-release_3_0_17/src/modules/rlm_ldap) configure: running /bin/sh ./configure --disable-option-checking '--prefix=/usr/app/radius' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for ldap_init in -lldap... no checking for ldap_init in -lldap in /usr/local/lib... no checking for ldap_init in -lldap in /opt/lib... no checking for ldap.h... no checking for ldap.h in /usr/local/include/... no checking for ldap.h in /opt/include/... no checking for sasl/sasl.h... no checking for sasl/sasl.h in /usr/local/include/... no checking for sasl/sasl.h in /opt/include/... no configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap ldap.h. configure: creating ./config.status config.status: creating all.mk config.status: creating config.h config.status: config.h is unchanged Which additional package is needed to complete ldap build..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

3 3

Installing from RPM with Samba4
by Norman Elton 19 Sep '18

19 Sep '18

Hi, First, apologies for what is more a RPM/YUM problem than a FreeRADIUS problem. I've been using the RedHat-supplied RPMs for many years on our RHEL6 servers, but am trying to move toward networkradius-supplied packages, in order to keep up to date with more recent FreeRADIUS releases. We currently have the samba4 packages installed: # rpm -qa | grep samba samba4-winbind-clients-4.2.10-15.el6.x86_64 samba4-libs-4.2.10-15.el6.x86_64 samba4-winbind-4.2.10-15.el6.x86_64 samba4-common-4.2.10-15.el6.x86_64 samba4-4.2.10-15.el6.x86_64 The samba4-libs package provides /usr/lib64/samba/libwbclient.so.0. When I try to install the newer version of FreeRADIUS, it's not happy with this dependency, and tries to install samba-winbind-clients, resulting in a conflict: --> Processing Dependency: libwbclient.so.0()(64bit) for package: freeradius-3.0.17-2.el6.x86_64 ---> Package samba-winbind-clients.x86_64 0:3.6.23-51.el6 will be installed Error: samba4-common conflicts with samba-common-3.6.23-51.el6.x86_64 Looking at the specfile on github, I see this nugget: %{?el7:Requires: libwbclient} %{?el6:Requires: samba4-libs} %{?el6:Requires: samba4-winbind-clients} Since I'm RHEL6, I'm not sure where the libwbclient dependency is coming from. Using repoquery, I can show the requirements of freeradius: # repoquery --requires freeradius | grep libwbclient libwbclient.so.0()(64bit) libwbclient.so.0(WBCLIENT_0.12)(64bit) libwbclient.so.0(WBCLIENT_0.9)(64bit) And what samba4-libs provides: # repoquery --provides samba4-libs | grep libwbclient libwbclient.so.0(SAMBA_4.2.10)(64bit) libwbclient.so.0(WBCLIENT_0.10)(64bit) libwbclient.so.0(WBCLIENT_0.11)(64bit) libwbclient.so.0(WBCLIENT_0.12)(64bit) libwbclient.so.0(WBCLIENT_0.9)(64bit) They're not quite the same, and I'm not sure what the part inside the parentheses actually does. All that said ... any ideas how to install FreeRADIUS alongside samba4? Thanks Norman

3 9

sending Group-Name in accounting Packets to FortiGate
by Somanath Mishra 18 Sep '18

18 Sep '18

Hi, I am forwarding accounting packets to fortiGate , but Group-Name is missing in this packet. Group-Name is coming in radacct table. So to show Group-Name i modified radacct table, after that it showed. So same need to do , i guess. Can you suggest where need to modify to get Group-Name in forwarding packet?

2 3

attr_rewrite replaced by ulang
by Gabriel Marais 18 Sep '18

18 Sep '18

Hi Guys We are in the process of setting up a test environment so we can migrate from 2.x to 3.x Reading the documentation, attr_rewrite is obsolete and should be replaced by ulang... I have this in my sites-available/default authorized { realmchange ... } realmchange is referenced back to:- attr_rewrite realmchange { attribute = realm searchin = packet searchfor = ".+" replacewith = %{Called-Station-Id} maxmatches = 1 new_attribute = yes } 1. How do I write this in ulang? 2. Do I put the ulang section under authorize { ... } section? Many thanks, Gabriel

2 1