- Freeradius-Users - lists.freeradius.org

RADIUS wifi not working on Windows with domain users
by Forster Arnaud 10 Apr '18

10 Apr '18

Hello all, I've a problem in a school with computers connected to the school domain (I'm using samba). For private computers, there's no worry ; they are asked to enter a username/password to connect to the wifi and this works fine. But for laptops belonging to the domain, when I try to connect, no username/password is requested and the connection just fail. It seems this is a windows problem but I wonder If I can don something from the freeradius side ... thanks to all for your help -- Meilleures salutations – Freundliche Grüsse – Best regards MW*PROGRAMMATION*SA *Arnaud Forster* /Ingénieur systèmes// //Rue Charles Schäublin 2/ /CH-2735 Malleray/ /phone: +41 (0)32 491 65 30/ /fax: +41 (0)32 491 65 35/ /web: www.mwprog.ch <http://www.mwprog.ch/>/ /kb: kb.mwprog.ch <http://kb.mwprog.ch/>/

5 9

Clients in virtual servers
by Stanislav Lorenc 10 Apr '18

10 Apr '18

On 9 Apr 2018, at 17:11, Stanislav Lorenc <stanislav.lorenc at cernovice.net <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >/i register NAS clients into two virtual servers with the same ip and this fall with duplicate error. / The error is intended - you've added a duplicate client. >/Is there way how to register NAS clients separately. / That's not possible, but what behaviour would you be expecting? Packets randomly assigned to a virtual server? Packets to be sent to both virtual servers simultaneously and two responses returned? Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. -------------------------------------------- -------------------------------------------- -------------------------------------------- Hi i expect if packet is send to concrete virtual server on concrete port will be process within this server. I use radius in mikrotik and i have multiple radius account in mikrotik for different services. Look like this: /radius add address=192.168.1.100 authentication-port=9999 realm=cernovice_net secret=test service=login timeout=3s < -- Check user access to device add address=192.168.1.100 authentication-port=1111 realm=ppp secret=test service=ppp timeout=3s <-- check users for pppoe services One server for ppp services with realm ppp and second server for user access to device. For different purposes i have different virtual servers with own business logic and users separate in virtual server. This device send request from one management IP. More IP is possible but confusing. Problem is occurred if device send packet from port 9999 for check access to device and client is registered in first virtual host(port 1111 - ppp services). Request is process within ppp virtual server instead of login virtual server Mikrotik Log: -> send request to 9999 09:33:58 radius,debug new request 0d:02 code=Access-Request service=login 09:33:58 radius,debug sending 0d:02 to 192.168.1.100:9999 09:33:58 radius,debug,packet sending Access-Request with id 2 to 192.168.1.100:9999 09:33:58 radius,debug,packet Signature = 0x268b43fc121da2883c30f476ee137502 09:33:58 radius,debug,packet Service-Type = 1 09:33:58 radius,debug,packet User-Name = "lorenc" 09:33:58 radius,debug,packet CHAP-Challenge = 0xe593b52e5739b57a979f8a40629e19d2 09:33:58 radius,debug,packet CHAP-Password = 0x0018ab7cf3a5fb9364723bc9343dd086 09:33:58 radius,debug,packet 10 09:33:58 radius,debug,packet Calling-Station-Id = "30:5A:3A:02:ED:BB" 09:33:58 radius,debug,packet NAS-Identifier = "male_rb_test" 09:33:58 radius,debug,packet MT-Realm = 0x6365726e6f766963655f6e6574 09:33:58 radius,debug,packet NAS-IP-Address = 192.168.1.223 09:33:59 radius,debug,packet received Access-Reject with id 2 from 192.168.1.100:9999 09:33:59 radius,debug,packet Signature = 0x27f48d656775fe94bd345924a9988c11 09:33:59 radius,debug received reply for 0d:02 Radius output executed by /etc/freeradius/sites-enabled/test_local_ppp_services.virtual_server.conf ( ppp services and client register inside this virtual server): Tue Apr 10 10:17:23 2018 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.223 port 51032, id=10, length=131 Service-Type = Login-User User-Name = "lorenc" CHAP-Challenge = 0x7f54c88e8ff8a895b536c9e4f26f43ba CHAP-Password = 0x0079373826d8a430860427d8691478870e Calling-Station-Id = "30:5A:3A:02:ED:BB" NAS-Identifier = "male_rb_test" Mikrotik-Realm = "cernovice_net" NAS-IP-Address = 192.168.1.223 Tue Apr 10 10:17:28 2018 : Info: server test_local_ppp_services { Tue Apr 10 10:17:28 2018 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/test_local_ppp_services.virtual_server.conf Tue Apr 10 10:17:28 2018 : Info: +group authorize { Tue Apr 10 10:17:28 2018 : Info: ++[preprocess] = ok Tue Apr 10 10:17:28 2018 : Info: [chap] Setting 'Auth-Type := CHAP' Tue Apr 10 10:17:28 2018 : Info: ++[chap] = ok Tue Apr 10 10:17:28 2018 : Info: ++[mschap] = noop Tue Apr 10 10:17:28 2018 : Info: [test_local_ppp_services_sql] expand: %{User-Name} -> lorenc Tue Apr 10 10:17:28 2018 : Info: [test_local_ppp_services_sql] sql_set_user escaped user --> 'lorenc' Tue Apr 10 10:17:28 2018 : Debug: rlm_sql (test_local_ppp_services_sql): Reserving sql socket id: 3 ... If i register NAS client to the right virtual server - it is executed correctly. So i need make two or more separated clients list for each virtual server. Stanislav Lorenc

2 1

Clients in virtual servers
by Stanislav Lorenc 09 Apr '18

09 Apr '18

Hello, i register NAS clients into two virtual servers with the same ip and this fall with duplicate error. First registration: Mon Apr 9 17:21:59 2018 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 6 Mon Apr 9 17:21:59 2018 : Debug: rlm_sql (test_local_auth_sql): Read entry nasname=192.168.1.223,shortname=test_local_auth=::male_rb_test::ether2::192.168.1.223,secret=test Mon Apr 9 17:21:59 2018 : Debug: rlm_sql (test_local_auth_sql): Adding client 192.168.1.223 (test_local_auth::male_rb_test::ether2::192.168.1.223, server=test_local_auth) to clients list and second virtual server registration: Mon Apr 9 17:37:38 2018 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 6 Mon Apr 9 17:37:38 2018 : Debug: rlm_sql (test_local_test_sql): Read entry nasname=192.168.1.223,shortname=test_local_test::male_rb_test::ether2::192.168.1.223,secret=test Mon Apr 9 17:37:38 2018 : Debug: rlm_sql (test_local_test_sql): Adding client 192.168.1.223 (test_local_test::male_rb_test::ether2::192.168.1.223, server=test_local_test) to clients list Mon Apr 9 17:37:38 2018 : Error: Failed to add duplicate client test_local_test::male_rb_test::ether2::192.168.1.223 I check source code and registration and every virtual server has own client list. Virtual server names in register info are different. But it look like clients are registred into global list. Is there way how to register NAS clients separately. Thanks Best Regards, Stanislav Lorenc

2 1

freeradius + NTLM + samba AD 4.5.x
by Dr. Peer-Joachim Koch 09 Apr '18

09 Apr '18

Hi, we have updated our samba AD domain from 4.4.x to 4.5.x. The release notes for 4.5.0 included "NTLMv1 authentication disabled by default". So we had to enable it to get our radius (freeradius) server working (for 802.1x). What would be the best way to change the freeradius configuration in such a way, that we can disable NTLMv1 again. The radius server is used for WLAN (802.1x) and for VPN. -- Bye, Peer ________________________________________________________ Max-Planck-Institut für Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

6 5

Calling radius_exec_program() with request set to NULL
by Isaac Boukris 09 Apr '18

09 Apr '18

Hello friends, The comment above it suggests it should be possible to call 'radius_exec_program()' without a request (like at server instantiation): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/main/exec.c… However, it currently doesn't even let me compile with a NULL request, due to nonull expectation. Would it make sense to fix it, and allow NULL request, or is there a way around it? It works ok with the patch below, though I am not sure what's the correct substitute for all the RDEBUG / RERROR occurrences, see: https://github.com/frenche/freeradius-server/commit/8929b28bd8a4186d2d77226… Thanks!

2 3

Version Upgrdation Issue
by Somanath Mishra 09 Apr '18

09 Apr '18

Hello Tom, We were using Freeradius Version 2.x and it is running well . We want to update now to Version 3.x .So How should we do? There are lots of confusion about version upgradation. Should we install from scratch and reconfigure our settings or we can directly update Version 2 to 3. Please help me on that.Thank you

3 2

Cisco IOS Authentication
by Tom Griffin 09 Apr '18

09 Apr '18

Hello, We are looking into using freeRADIUS to provide authentications to our Cisco IOS devices. There is a very helpful guide on the wiki ( https://wiki.freeradius.org/vendor/Cisco) however, the article only lists 'Cleartext-Password' as an acceptable method for storing the user's password attribute within freeRADIUS. Is it possible to use a more secure method of storing the passwords that is compatible with Cisco IOS? Thanks Tom Griffin University of Sheffield

4 4

Using machine auth from a remote eduroam site
by Alex Sharaz 07 Apr '18

07 Apr '18

For a long long time now I've been using freeradius to auth PEAP and EAP-TLS inbound requests from eduroam to our Tier 1 FreeRadius ( 3.0.16) servers. We now want to enable our managed laptops to connect to eduroam at a remote site using machine authentication using EAP-TTLS. I've got part of the way in that I can see an inbound request from host/<fqdn of laptop> and a failure "Login incorrect (mschap: No such user [0xC0000064]): [host/dpslap001.its.york.ac.uk] (from client yorkcc port 76 cli 80-86-F2-E0-7D-24 via TLS tunnel)" So I guess this makes sense as our machines are in a different part of our AD Tree to our users. On our clearpass system I check for a username of the form host/.....york.ac.uk/ and do an auth against different AD tree branch and everything works. I'm using winbindd on our Tier 1 FR servers. Guess I need to create another mschap instance specifically for machine auths and point it at another part of the AD tree. Assuming that's what I have to do, how do I point mschap at a different part of the AD tree for authentication? Rgds Alex

8 19

source ip check
by Bassem Mettichi 06 Apr '18

06 Apr '18

Hello, i have keeplaived and lvs with 2 freerdaius servers running version 3.0.16 on redhat 7 ( keeplaived is configured with NAT option) when i send an accounting start from a client vm using radclient i get this response: radclient: Received reply to request we did not send. (id=134 socket 3) have you any idea how to resolve this issue, my freeradius servers is listenning on all interfaces ( *). Thanks a lot Mettichi Bassem

3 4

-d <raddb> Set configuration directory (defaults to /etc/raddb).
by Mitch Sullivan 05 Apr '18

05 Apr '18

Hi Team. I'd like to have the configuration directory located at a different location to its default (A docker volume). So do I simply kick off freeradius like below radius -d /pathtodockervolume/ Cheers Mitch. Mitch.Sullivan mitch.sullivan(a)swarm64.com IT administrator | Swarm64 AS Swarm64 AS Zweigstelle Hive Ullsteinstr. 114 | 12109 Berlin | Germany

2 1