- Freeradius-Users - lists.freeradius.org

acctstoptime updated without acctterminatedcause
by Luc Zimmermann 20 Jun '18

20 Jun '18

Hi everybody, I use coova chilli as captive portal and freeradius for users authentications and I have problems with freeradius that I can't reproduce unfortunatly for now. in raddact table i can see sometimes some rows with an acctstoptime not NULL but the acctterminatedcause is blank (not null... blank, empty) and i think that problem didn't close the connection on the nasid. more stange (or not... maybe it's linked), approx 50% of that problems have an acctupdateinterval greater than the stop interval. where do you think this could come from ? I use coova 1.3.2 on openwrt/lede & freeradius 3.14 on a dedicated server (debian 9). Thx Luc

2 1

Mikrotik-Total-Limit attribute Not working.
by Imdad Hasan 18 Jun '18

18 Jun '18

Respected All, I use Mikrotik-Total-Limit attribute for send a remain data of user in radreply.But that is only working upto 9 GB or something. I try to google for that and i found new attribute Mikrotik-Total-Limit-Gigawords. But also that is like puzzle.When i send Mikrotik-Total-Limit = 2 than that shows 12 GB and when i send 10 than that shows just random number every time. Warm Regard's Imdadali Kadiwala

1 0

Different DHCP Pools based on User
by Paul 18 Jun '18

18 Jun '18

Hi, is there some possibility to configure the following scenario: We have multiple Users, say Alice and Bob and Charles (and many more). All of them authenticate via a FreeRadius Server and need an IP via DHCP, but Alice needs IPs from 10.1.0.0/24, Bob from 1xx.xxx.28.0/24 and Charles from 192.168.10.0/24. I couldn't find an example of this or remotely similar scenarios. Thanks in advantage! Paul

4 7

network radius packages for centos 7
by Kacper Wirski 18 Jun '18

18 Jun '18

Hello, I'm trying to install freeradius RPM's for centos 7.5. I've added key and repos according to https://networkradius.com/freeradius-packages/index.html, but unfortunately I'm getting /Package freeradius-3.0.17-2.el7.centos.x86_64.rpm is not signed /(and for all other packages from the repo) when installing with yum. Did anyone hit same issue? Also, as a sidenote, starting from RHEL/centos 7.5 default openldap package is built with openssl libraries, so I think that there will no longer be need for "hard" dependencies for openldap-ltb from rhel/centos 7.5 and up. Regards, Kacper

1 0

Learning Path FreeRadius
by Uchenna Nebedum 16 Jun '18

16 Jun '18

Good Day all, With my recent venture into setting up a RADIUS server using freeRadius. i have discovered there's a lot i don't know about the capabilities and setup of freeRadius, Please can anyone point me in the direction of useful learning material on more advanced setup like the setup of realms, unlang and the likes and also materials on scaling too. I have read the beginners installation guide. Please any help would be greatly appreciated. Best Regards Uchenna Nebedum

2 2

puzzled by unusual freeradius log format
by Andris Bjornson 15 Jun '18

15 Jun '18

Hello, I'm trying to process freeradius logs into logstash / elasticsearch. I'm finding that the log format of my freeradius server seems different from the standard freeradius log examples I'm seeing in search results The freeradius log lines are multiline with indentation *but* each line of a multiline event begins with a (nnnnnn) index number prior to the indentation for example: (65216309) Received Accounting-Request Id 151 from 10.5.0.102:17420 to 10.5.0.172:2813 length 469 (65216309) Acct-Status-Type = Interim-Update (65216309) User-Name = "60:21:01:9f:9c:54" (65216309) Framed-IP-Address = 10.80.137.221 (65216309) Calling-Station-Id = "60:21:01:9f:9c:54" I can't seem to find explanation of this format in freeradius docs or what this leading number represents, and I can't seem to find where it is configured. Can anyone help me understand where these (nnnnn) index numbers come from in the logs? Ultimately my goal is correctly reassembling these lines in ELK using multiline processing. My freeradius server OS is CentOS Linux release 7.4.1708 My freeradius version is freeradius-3.0.15-5.el7.centos.x86_64 Thanks much! Andris --- Andris Bjornson | EveryLayer <http://www.everylayer.com/> skype: andris.bjornson

3 2

post-auth configuration
by Dom Latter 15 Jun '18

15 Jun '18

Just curiosity really. My inner-tunnel configuration is appended below. It seems that my update to the outer session state has to be in both the main post-auth section and the REJECT subsection. Seems a bit counter- intuitive; what I would expect is the main section to apply to both ACCEPTs and REJECTs and then subsections to be applied additionally where appropriate. So just wondering what the rationale is. post-auth { #sql update outer.session-state { &User-Name = &User-Name } Post-Auth-Type REJECT { update outer.session-state { &User-Name = &User-Name } attr_filter.access_reject } }

2 6

FreeRadius works, but i cant connect with WIndows!
by Nolden, Samuel 15 Jun '18

15 Jun '18

Hey, i have freeradius running on Linux and everything works fine but one thing dont! > Wed Jun 13 11:14:04 2018 : Auth: (192) Login OK: [gast/<via Auth-Type = eap>] (from client SVG_EDV3 port 0 via TLS tunnel) > Wed Jun 13 11:14:04 2018 : Auth: (192) Login OK: [gast/<via Auth-Type = eap>] (from client SVG_EDV3 port 0 cli 3C-2E-FF-87-FC-39) > Wed Jun 13 11:25:28 2018 : Auth: (198) Login OK: [gast/<via Auth-Type = eap>] (from client SVG_EDV1 port 0 via TLS tunnel) > Wed Jun 13 11:25:28 2018 : Auth: (198) Login OK: [gast/<via Auth-Type > = eap>] (from client SVG_EDV1 port 0 cli 00-61-71-79-46-74) Wed Jun 13 > 11:31:11 2018 : ERROR: (203) eap_peap: ERROR: TLS Alert > read:fatal:unknown CA Wed Jun 13 11:31:11 2018 : Auth: (203) Login > incorrect (eap_peap: TLS Alert read:fatal:unknown CA): > [host/NB-Praktikant01.svg.de/<via Auth-Type = eap>] (from client > SVG_EDV1 port 0 cli 74-E5-F9-83-97-3A) I cant conect to WLAN with my Mac or Windows, it just work with Mobile Phones ;/ What can i do?

2 1

FreeRadius - Cisco - Different privileges levels based on source device sending the Access-Request.
by Laurent Dumont 15 Jun '18

15 Jun '18

Hi everyone. We are currently experimenting with Radius and are looking to find a way to change the privilege levels when logging into a certain class of devices(and only these ones). Right now, we have the following setup. 1. Users attempts to log into a Cisco radius enable device. 2. Device starts the auth process with an Access-Request. 3. Freeradius checks the LDAP/FreeIPA backend and sends the reply with the VSA "“cisco-avpair" for the correct privilege level based on LDAP group membership. This works great but I'm looking for a way to change the returned privilege level based on the source device. Is there a way that the Access-Request can send additional attributes like hostnames, IOS versions or anything specific to the end device where the auth attempts starts? There are ways that the privilege level can match different permissions but those change means that each device will need to have the correct local configuration and I'd rather manage everything centrally ideally. Thank you!

4 3

Change PEAP user-name and user-password
by Seth Lampman 13 Jun '18

13 Jun '18

I am trying to figure out if what i want to do is possible. I work for a VPN vendor. We support device auth as well as user auth. User auth is always required no matter what. I have a customer that wants device auth only using eap-tls. No issues this works fine. They want to disable user auth and user only device certificate auth which we do not support. I want to bascially be able to accept all user auth requests presented to the radius server which would in effect give them what they want. I know that with eap\mschapv2 (we dont support lesser protocols) you cannot have auto accept all requests due to mutual auth required. My thought was to create a default user in freeradius and then update user-name and user-password to the deafult user. So joe tries to authenticate and unlang rewrites joe to default user. And rewrites joes password to default user password. Auth succeeds. Ive researched the forums and i think i need to do this on the outer tunnel as well as the inner tunnel? I cant find anything that is clear on that. If someone could point me in the right direction and let me know if i am on the right track? Thanks >

3 4