- Freeradius-Users - lists.freeradius.org

Installing from RPM with Samba4
by Norman Elton 19 Sep '18

19 Sep '18

Hi, First, apologies for what is more a RPM/YUM problem than a FreeRADIUS problem. I've been using the RedHat-supplied RPMs for many years on our RHEL6 servers, but am trying to move toward networkradius-supplied packages, in order to keep up to date with more recent FreeRADIUS releases. We currently have the samba4 packages installed: # rpm -qa | grep samba samba4-winbind-clients-4.2.10-15.el6.x86_64 samba4-libs-4.2.10-15.el6.x86_64 samba4-winbind-4.2.10-15.el6.x86_64 samba4-common-4.2.10-15.el6.x86_64 samba4-4.2.10-15.el6.x86_64 The samba4-libs package provides /usr/lib64/samba/libwbclient.so.0. When I try to install the newer version of FreeRADIUS, it's not happy with this dependency, and tries to install samba-winbind-clients, resulting in a conflict: --> Processing Dependency: libwbclient.so.0()(64bit) for package: freeradius-3.0.17-2.el6.x86_64 ---> Package samba-winbind-clients.x86_64 0:3.6.23-51.el6 will be installed Error: samba4-common conflicts with samba-common-3.6.23-51.el6.x86_64 Looking at the specfile on github, I see this nugget: %{?el7:Requires: libwbclient} %{?el6:Requires: samba4-libs} %{?el6:Requires: samba4-winbind-clients} Since I'm RHEL6, I'm not sure where the libwbclient dependency is coming from. Using repoquery, I can show the requirements of freeradius: # repoquery --requires freeradius | grep libwbclient libwbclient.so.0()(64bit) libwbclient.so.0(WBCLIENT_0.12)(64bit) libwbclient.so.0(WBCLIENT_0.9)(64bit) And what samba4-libs provides: # repoquery --provides samba4-libs | grep libwbclient libwbclient.so.0(SAMBA_4.2.10)(64bit) libwbclient.so.0(WBCLIENT_0.10)(64bit) libwbclient.so.0(WBCLIENT_0.11)(64bit) libwbclient.so.0(WBCLIENT_0.12)(64bit) libwbclient.so.0(WBCLIENT_0.9)(64bit) They're not quite the same, and I'm not sure what the part inside the parentheses actually does. All that said ... any ideas how to install FreeRADIUS alongside samba4? Thanks Norman

3 9

sending Group-Name in accounting Packets to FortiGate
by Somanath Mishra 18 Sep '18

18 Sep '18

Hi, I am forwarding accounting packets to fortiGate , but Group-Name is missing in this packet. Group-Name is coming in radacct table. So to show Group-Name i modified radacct table, after that it showed. So same need to do , i guess. Can you suggest where need to modify to get Group-Name in forwarding packet?

2 3

attr_rewrite replaced by ulang
by Gabriel Marais 18 Sep '18

18 Sep '18

Hi Guys We are in the process of setting up a test environment so we can migrate from 2.x to 3.x Reading the documentation, attr_rewrite is obsolete and should be replaced by ulang... I have this in my sites-available/default authorized { realmchange ... } realmchange is referenced back to:- attr_rewrite realmchange { attribute = realm searchin = packet searchfor = ".+" replacewith = %{Called-Station-Id} maxmatches = 1 new_attribute = yes } 1. How do I write this in ulang? 2. Do I put the ulang section under authorize { ... } section? Many thanks, Gabriel

2 1

Could not link driver rlm_sql_unixodbc
by Saurabh Lahoti 18 Sep '18

18 Sep '18

Hi, While compiling freeradius 3.0.17 with sql & perl, below error interpreted with debug mode: Could not link driver rlm_sql_unixodbc: /usr/app/radius/lib/rlm_sql_unixodbc.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld Which additional package needs to be installed for unixodbc module..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

LDAP-UserDN is not unique per ldap module instance (auth problem when multiple ldap module instances used)
by Kostas Zorbadelos 17 Sep '18

17 Sep '18

Hello all, in my current authentication policy, I use 2 instances of the LDAP module. The first instance queries the directory in a specific branch and gets information used in later checks. The other instance is used to authorize the user (and also authenticate him in some rare situations) and queries another branch. The problem is that when the second LDAP module is used for the authentication, it tries to bind with an LDAP-UserDN attribute obtained from the first module. I need to rewrite control:LDAP-UserDN for this to work. Tracing a bit the source, I saw that LDAP-UserDN is set with the '=' operator: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm… Is this by design? I would expect each module instance to have its own LDAP-UserDN and use that when used in authentication. Am I missing something, or is this something worth of raising a github issue? Regards, Kostas -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba

2 8

Receive EAP and proxy out with PEAP
by Christian Salway 16 Sep '18

16 Sep '18

Hello, My client doesn't support PEAP but the NPS server is configured to only use PEAP, so I was wondering if freeRadius could be used as a proxy to receive EAP-MSCHAPv2 and proxy using PEAP-MSCHAPv2? Thanks,Christian

2 1

Authenticating against Active Directory using winbind
by Christoffer Jönsson 15 Sep '18

15 Sep '18

Hello! I used this guide a year ago to enable 802.1x on my switches and APs and it worked without any problems to authenticate to my Samba4 AD/DC: https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind. Today I am having trouble getting it to work because it wont accept the password when running this command or connecting from switches: "radtest -t mschap adtest Password1 127.0.0.1 0 testing123". And winbind returns this result: "NTLM CRAP authentication for user [auth.chrjsn.se]\[adtest] returned NT_STATUS_WRONG_PASSWORD". But running this command, it authenticates with this result: ntlm_auth --username=adtest --domain=auth.chrjsn.se Password: NT_STATUS_OK: Success (0x0): "Plain-text authentication for user AUTH.CHRJSN.SE\adtest returned NT_STATUS_OK (PAM: 0)" Radiusd reports that password has expired, when it has not. I have reset the password for adtest and administrator with same results. I don't know if there's any new settings or something and I'm really stuck here. It also doesn't matter which version of samba/freeradius I'm using. Thanks!

4 10

Debian Stretch: No radutmp file though seeing Accounting message at network level
by Olivier 14 Sep '18

14 Sep '18

Hello, I'm currently testing SimultaneousUse setting in WPA2 Enterprise WiFi environment. I'm quite new to Radius (both concepts and implementations). After reading this (very interesting) document [1], I assigned myself a first step: seeing useful data through radwho command, no matter if Freeradius relied on a completely different source on input to implement SimultaneousUse feature. In my testing, I'm having: # radwho Fri Sep 14 12:28:55 2018 : Error: Unable to check file "/var/log/freeradius/radutmp": No such file or directory radwho: Error reading /var/log/freeradius/radutmp: No such file or directory 1. I read in [2] then that /var/log/freeradius/radutmp is created by Freeradius whenever it receives accounting data. Is it correct on Debian Stretch when package's config is mostly left unchanged ? 2. At network level, I see that my WiFi AP are sending Account-Request and receiving back Account-Response. Does it prove Freeradius's Accounting is turned on and running or shall I for instance, read this Response content ? Is there a better way to look at Freeradius "running features" ? [1] https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/configurati… [2] http://lists.freeradius.org/pipermail/freeradius-users/2014-April/071808.ht… Best regards

4 4

Recommanded way to display properties for a given user ?
by Olivier 14 Sep '18

14 Sep '18

Hello, I've just discovered radmin and its capabilty to display clients list and details. Is there a way a way to get the same kind of display but for configured Users (ie entries that can be configured in /etc/freeradius/3.0/users file) as those entries can inherit properties from several sources (Groups, default values, various backends, ...) ? If I'm not mistaken, /var/log/syslog nor /var/log/freeradius/radius.log do not print such detailed data when freeradius daemon is launched with -x option. Best regards

2 3

issue with realm
by Somanath Mishra 14 Sep '18

14 Sep '18

Hi, I am facing issue with configuring realms. My requirement was "need to forward accounting packet to Fortigate". In radacct i am not getting Realm . below you can see my radacct table data. --------------------------------------------------------------------- # radacctid, acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctinterval, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress '2', '3C07A8C0-0008A16D', '33dcf4d9b2a4e05be6c38b2b6509ea6c', 'bob', 'students', '', '192.168.0.4', '0', 'Wireless-802.11', '2018-09-13 14:59:36', '2018-09-13 14:59:36', '2018-09-13 15:06:07', NULL, '390', 'RADIUS', 'CONNECT Unknown Radio', 'CONNECT Unknown Radio', '625711', '8754721', '00:0c:29:67:6d:ec', '17:f0:r4:b0:fe:td', 'User-Request', '', '', '192.168.0.60' -------------------------------------------------------------------- so to show realm value in radacct and send accounting packets to fortigate i modified in radiusd.conf and proxy.conf. below you can see change that i made to conf files: radiusd.conf:= modules { realm FortiGate { format = suffix delimiter = "@" } } proxy.conf:= Proxy-To-Realm:="FortiGate" and realm FortiGate { authhost =192.168.0.1:1812 accthost =192.168.0.1:1813 secret =a1rl08 } ----------------------------------------------------------------- I am not getting anything. I know i am doing wrong. Can you suggest me please how to achieve this?

2 1