- Freeradius-Users - lists.freeradius.org

Can FreeRADIUS retry authentication with another Active Directory after Post-Auth-Type REJECT
by Peter Drucker 11 Jun '18

11 Jun '18

Hi, I'm looking for a different kind of fall-through. Is it possible for FreeRadius to fall-through to another Active Directory after Post-Auth-Type Reject? Thanks, Peter.

3 10

Bad talloc magic value - unknown value
by Saurabh Lahoti 11 Jun '18

11 Jun '18

Dear, With radiusd running as a daemon process, interprets below error & crashes: Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value Could you please help in identify the problem here..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

check password !?
by تعلم البرمجة 09 Jun '18

09 Jun '18

Hello I have freeradius 3.0.12 and I want check if cleartext-password == chap or mschap password how I can do this

2 3

Accounting not working
by Uchenna Nebedum 08 Jun '18

08 Jun '18

Good Day All, Please my radius server sends access-accept with required attributes, but even with accounting turned on, radacct table is still empty.. Tried testing with NTRadPing but there's no response from server. Please how do i fix this. Warm regards, Uchenna Nebedum

3 7

Problem with coa request for multiple NAS
by Imdad Hasan 08 Jun '18

08 Jun '18

Respected All, How can i handle coa request for multiple NAS, can i make multiple server instance for every NAS in originate-coa file or any other simple way to do that. How can i achieve to handle multiple NAS's coa request. Warm Regard's Imdadali Kadiwala

2 1

Can I conditionally proxy?
by Gary Algier 07 Jun '18

07 Jun '18

Hello, I have used FreeRADIUS before as a RADIUS server but I now wish to use it as a conditional proxy. We have two RADIUS servers that implement 2 factor authentications. We wish to migrate from the old system to the new system a few users at a time. I would like to setup FreeRADIUS to do something like this: if (the user is in a particular AD group) {// I can do an LDAP lookup, if necessary proxy to the new 2fa system } else { proxy to the old 2fa system } Can anyone help with examples of some sort of conditional proxying? Gary A. Algier Principal System Administrator Office: +1.856.787.2758 Mobile: +1.856.278.0724 E-mail: Gary.Algier(a)Mavenir.com www.mavenir.com ________________________________ This e-mail message may contain confidential or proprietary information of Mavenir Systems, Inc. or its affiliates and is intended solely for the use of the intended recipient(s). If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies in your control and contact us by e-mailing to security(a)mavenir.com. This message contains the views of its author and may not necessarily reflect the views of Mavenir Systems, Inc. or its affiliates, who employ systems to monitor email messages, but make no representation that such messages are authorized, secure, uncompromised, or free from computer viruses, malware, or other defects. Thank You

3 3

matching operator name case sensitive
by Peter Steadman 07 Jun '18

07 Jun '18

Hi I am totally new to freeradius and with the help of the excellent wiki ( https://wiki.freeradius.org/guide/eduroam) have a working test server with only one apparent simple niggling issue, operator name matching is case sensitive when using the expression below to match multiple domains. I understand that cannot use "/i" in the this instance but am really struggling to find another way making this case insensitive. I should really appreciate it if someone could give me a hint, point me in another direction or even better give an example. many thanks Pete if (&Stripped-User-Domain != "${operator_name1}") && (&Stripped-User-Domain != ${operator_name2}")&& (&Stripped-User-Domain != "${operator_name3}") && (&Stripped-User-Domain != "${operator_name4}") { update { control:Load-Balance-Key := &Calling-Station-ID control:Proxy-To-Realm := 'eduroam' # Operator name (RFC 5580) identifies the network the # request originated from. It's not absolutely necessary # but it helps with debugging. request:Operator-Name := "1${operator_name1}" } return } -- <https://twitter.com/warwickshirecol> <https://www.facebook.com/WarwickshireCollege> <https://www.linkedin.com/edu/warwickshire-college-group-355076> <https://www.instagram.com/warwickshirecol/> College Email Disclaimer This message and any files transmitted with it is intended for the addressee only and may contain information that is confidential or privileged. Unauthorised use is strictly prohibited and may be unlawful. If you are not the addressee, you should not read, copy, disclose or otherwise use this message, otherwise than to notify the College via postmaster(a)warkscol.ac.uk <mailto:postmaster@warkscol.ac.uk>. You should delete this message and any files transmitted with it from your computer and destroy any copies made. Warwickshire College gives no warranty or representation as to the accuracy or reliability of the message and files and does not necessarily endorse any opinions expressed within it.

2 1

Get inner tunnel attributes to outer server for logging.
by Dom Latter 07 Jun '18

07 Jun '18

Firstly: "FreeRADIUS Version 3.0.16, for host x86_64-pc-linux-gnu" We are using MsCHAPv2 over TLS. I've been trying to get the inner-tunnel username and module failure message back to the "outer" session similar to this situation: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074994… or this: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074961… I have read a lot of the archived posts but am still not sure what's the "right" way of doing it. I have got most of it working except when the user is rejected by the inner tunnel. To be clearer, we want the inner-tunnel username to be available for the linelog and to go in to the postauth table. Is there some sort of definitive howto for this? It seems to be a common situation.

3 5

Accounting logs to include session start, session end & user ID field.
by Saurabh Lahoti 07 Jun '18

07 Jun '18

Dear, Could you please help in getting accounting logs with session start time, end time & user ID for audit purpose..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

Re: Invalid packet code 1 sent to a accounting port from client : IGNORED
by Saurabh Lahoti 06 Jun '18

06 Jun '18

Dear Alan, This error received after configuring F5 loadbalancer (as a client) who monitors health status of accounting service from it's peer nodes. Could there be nay other alternative way to achieve this..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1