- Freeradius-Users - lists.freeradius.org

Digital certificate
by Tchesco 15 Feb '18

15 Feb '18

Good afternoon everyone, I'm new here, and I do not write well in English, but I need help with FreeRadius. My scenario is as follows, I'm using FreeRADIUS Version 3.0.13 on CentOS 7 to authenticate wireless equipment in my network. My wireless system has two Alcatel-Lucent OAW-4604-US controllers, and more than 50 access point. FreeRadius is up and running. Only they requested that a digital certificate be installed, where the equipment is recognized as being valid. I've already got a valid certificate for a week to test, but I can not get it up and running. Does anyone know how to do this? NOTE: For generating the valid certificate, I sent the generated "server.csr" as the README file to the "/ etc / raddb / certs /" folder. Regards, Francisco Trindade. +55 (48) 3221-2760

2 1

Multiple post-auth queries
by Gianluca Laudano 15 Feb '18

15 Feb '18

Hello, I'm running freeradius 3.0.12 on Debian Stretch amd64 + mysql 5.6 I'm trying to execute multiple queries at post-auth with a configuration like this: query= "statement 1; statement 2; statement 3" With this configuration active I often (not always) get this MySQL error: sql_time: ERROR: rlm_sql_mysql: ERROR 2014 (Commands out of sync; you can't run this command now): HY000 The error does't appear if I just execute two statements. The statements execute insert and updates Thanks in advance Gianluca

3 4

Accees requests log
by Bassem Mettichi 13 Feb '18

13 Feb '18

Hello, iam using freeradius 3.0.16 and i need to enbale log for acceess requets any one could help how to enbale logging for access requests because in this version i can't see the auth log module on mods-available. Thanks in advance

4 4

Error after successful bind using Samba4, it might be the userPassword attribute
by Ing. Pedro Pablo Delgado Martell 13 Feb '18

13 Feb '18

I'm trying to set freeradius authentication against a *Samba Active Directory Domain Controller v4.3.0* (*sernet-samba-ad*) server. The parameters in my ldap module file look like this: server = "192.168.1.8" identity = "cn=root,cn=Users,dc=eleka,dc=co,dc=cu" password = password basedn = "dc=eleka,dc=co,dc=cu" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" When I run *radtest root password 127.0.0.1 0 testing123* in debug mode (freeradius -X) I get a successful bind (*[ldap] Bind was successful*) but after that, this error is shown: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? I found here http://lists.freeradius.org/pipermail/freeradius-users/2015-December/081338… that it might be a problem related to Samba4 which looks like doesn't has a userPassword attribute and the freeradius LDAP module can map *userPassword* attribute defined in *ldap.attrmap* I also executed this query using ldapsearch (*without any issue* so identity works): ldapsearch -LLL -b "dc=eleka,dc=co,dc=cu" -h 192.168.206.8 -D "cn=root,cn=Users,dc=eleka,dc=co,dc=cu" -w password userPassword=* # refldap://eleka.co.cu/CN=Configuration,DC=eleka,DC=co,DC=cu # refldap://eleka.co.cu/DC=DomainDnsZones,DC=eleka,DC=co,DC=cu # refldap://eleka.co.cu/DC=ForestDnsZones,DC=eleka,DC=co,DC=cu

2 1

IPv6 subnet as client ipaddr
by Klara Mall 12 Feb '18

12 Feb '18

Hi, we just wanted to configure an IPv6 subnet as client with the variable ipaddr. Found out that only a single IPv6 IP address is working with the variable ipaddr. With ipv6addr subnet is working, too. Does not work: client test { ipaddr = fd76:70:6e:1::/64 secret = XXXXXXXXXXXXXXXXXXXXXXXXX } Does work: client test { ipaddr = fd76:70:6e:1::1 secret = XXXXXXXXXXXXXXXXXXXXXXXXX } Does work: client test { ipv6addr = fd76:70:6e:1::/64 secret = XXXXXXXXXXXXXXXXXXXXXXXXX } Error log message: Failed to parse IPv4 address string "fd76:70:6e:1::/64" /etc/freeradius/3.0/clients.conf[270]: Error parsing client section Is it a bug? Tested in freeradius 3.0.12 and 3.0.16. Same behaviour. Thank you Klara

2 1

Simple freeradius install ins wrong by default
by Ing. Pedro Pablo Delgado Martell 12 Feb '18

12 Feb '18

My boss asked me to set up a wireless hotspot at the company I work. I decided to use freeradius (first time used) and captive portal (under pfSense). I saw a few tutorial videos on YouTube and for a basic installation were all almost the same. *OS: Ubuntu Server 16.04 LTS* *Guide: *https://wiki.freeradius.org/guide/Getting-Started *User:* root Next are the commands I used for the first basic use: 1. root@radius:~# apt-get update -y && apt-get upgrade -y 2. root@radius:~# apt-get install -f freeradius freeradius-ldap 3. root@radius:~# freeradius -X *Failed binding to authentication address * port 1812: Address already in use** **/etc/freeradius/radiusd.conf[273]: Error binding to port for 0.0.0.0 port 1812* Really don't get why is freeradius telling the port is already in use. I took some port info, BEFORE the installation, and this is how it look: tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 320 10.10.10.252:22 10.10.10.18:29324 ESTABLISHED No further connections, not even any of them listening on 1812. After installation the netstat -van output: tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 10.10.10.252:22 10.10.10.18:29340 ESTABLISHED udp 0 0 0.0.0.0:47291 0.0.0.0:* udp 0 0 127.0.0.1:18120 0.0.0.0:* udp 0 0 0.0.0.0:1812 0.0.0.0:* udp 0 0 0.0.0.0:1813 0.0.0.0:* udp 0 0 0.0.0.0:1814 0.0.0.0:* According to the tutorial (https://wiki.freeradius.org/guide/Getting-Started) the output should be: |Ready to process requests| |Thanks in advance! | **

3 2

Freeradius Solution (CHAP with LDAP encrypted password)
by Tsirkas Georgios 12 Feb '18

12 Feb '18

Hello, I am trying connect to a radius client, which can authenticate only with CHAP. Users credentials are stored encrypted in LDAP database. Unfortunately CHAP requires only cleartext password. I dont want to store users credentials plain-text. Is there a solution about it? Thank you, George

7 11

cisco phones
by Vacheslav 12 Feb '18

12 Feb '18

Peace, I still can't authenticate the ip phones using md5 on the voice vlan, they keep getting authenticated on the data vlan. I ducked ducked the internet and found that: "device-traffic-class=voice:= Cisco-AVPair" Must be added. So I added it username of the ip phone in daloradius but the behavior has not changed. Perhaps, that must be added manually to the users file for it work. I only found documentation on how to do that in cisco ACS.

7 25

Redis authorize module
by Bassem Mettichi 10 Feb '18

10 Feb '18

Hello, has any one developped an authorize module for redis database with freeradius. thanks an advance

2 1

Handling user based on an attribute in a dynamic manner
by Nathan Ward 10 Feb '18

10 Feb '18

Hi, I’m working on a solution where I need to auth differently, and return different attributes based on a user’s access type. I can see the interface that a user has arrived on, and from that look up the access type. We have maybe 100 different interfaces which can change a bit, divided in to 3 or 4 different access types. Once I know the access type, I can choose which of the other attributes I use to authenticate the user. We run 3.0.16 (or will by the time this is deployed). I’m trying to figure out a good way to map those 100 interfaces to access types, without a change meaning a restart. We run LDAP right now, we don’t have SQL servers running on our front end servers, and I’d rather avoid it. Right now, I’m considering SQLite, but I’m not certain how it would handle: 1) A 3rd party process opening the db file to write periodically - I see posts about only one writer, and that’s fine I only want one writer, but I want to write from a different application.. is that OK? 2) Changes to the file, would they require a restart - I presume the DB file is not cached in memory in FreeRADIUS somehow, but that’s just a guess. Our auth load is quite manageable, so, if a request blocked for a second or two while the write was happening that would be OK - but errors/false negatives would be bad. Can anyone help with these before I go spending a bunch of time testing? Any other solutions I should consider? A server restart is always an option, but, I’d rather avoid it if possible. -- Nathan Ward

3 2