- Freeradius-Users - lists.freeradius.org

Problem or a question !?
by Ariel García Reyes 01 Dec '17

01 Dec '17

We have a problem or a question !? We are connecting several cell phones through 3g, our provider is routing us through an APN to a FreeRadius server that we are managing through RadiusDesk, but we would like to know how to obtain the information about the traffic that is generated by the clients in our server in a period of shorter time There is some way to force from our FreeRadius so that when the client (cellular) authenticates we can get traffic information periodically every 5 minutes for example. I have read and I know that there is a variable (Acct-Interim-Interval) that has or plays an important role, but we do not know how to use it! The configuration of the delivery time of the traffic information is configured in the ISP NAS or can we manage it in our server in some other way? -- ________________________________________________ Lic. Ariel García Reyes. GNU/Linux Registered User #357058

2 1

nas "per_socket_client" configuration -> sql
by kjonca＠o2.pl 01 Dec '17

01 Dec '17

Is it possible to have equivalent of: [...] clients alfa { client ni { ipaddr = ni.kjonca secret = verysecret nastype = other } client test { ipaddr = alfa.kjonca secret = verysecret nastype = other } } [...] listen { [...] clients = alfa } I am in doubt but maybe I missed something. KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html QOTD: "I sprinkled some baking powder over a couple of potatoes, but it didn't work."

3 3

unsubscribe
by osman tuzcu 30 Nov '17

30 Nov '17

30 Kas 2017 9:12 PM tarihinde "Josh toal" <joshtoal17(a)gmail.com> yazdı: > Hi Gurus > > I am new to freeradius. > > Installed freeradius 3.X and did basic configuration with the access point > and it works. > > Now I am trying to do configuration for eap-sim authentication. I have the > SIM credentials. > > Can somebody help me in understanding configuration required to implement > eap-sim based authentication . > > > > josh > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html

1 0

freeradius 3.0.13 LDAP - reply custom Vendor Specific
by Paweł Cituk 30 Nov '17

30 Nov '17

Hi I have connected freeradius to freeIPA's ldap ( https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based…) I try to authenticate IPMI server trough freeradius but it require two custom attributes (Vendor Specfic) ie for admin H=4 and I=4. How should I configure freeradius to reply for every request with custom above attributes (without adding them in the ldap schema) I found here http://wiki.freeradius.org/modules/Rlm_ldap that I should add for example: radiusReplyAttribute: Cisco-AVPair := "ip:addr-pool=dialin_pool". Unfortunately I completely dont know where in raddb/mod-avaliable/ldap should I place similar line. Any help would be very appreciated Regards, Paweł

4 9

freeradius with Active Directory via winbind or MAC address access
by Vieri 29 Nov '17

29 Nov '17

Hi, I would like to allow access when user authentication is approved by AD through winbind, OR when the MAC address is in a local file. I'm trying to follow this guide: https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind but also this other guide: https://wiki.freeradius.org/guide/mac-auth#mac-auth-or-802-1x My software versions: freeradius-3.0.14 samba-4.5.10 Samba/winbind works fine: # ntlm_auth --username=user --domain=DOMAIN Password: NT_STATUS_OK: Success (0x0) freeradius build.log looks good: checking for wbclient.h in /usr/include/samba-4.0/... yes checking for wbcCtxAuthenticateUserEx in -lwbclient... yes # grep winbind_ /etc/raddb/mods-available/mschap | grep -v ^# winbind_username = "%{mschap:User-Name}" winbind_domain = "DOMAIN" # tail -n 6 /etc/raddb/clients.conf client 10.215.144.92 { ipv4addr = 10.215.144.92 secret = testrad shortname = testsys require_message_authenticator = no } >From 10.215.144.92: # radtest -t mschap user password 10.215.144.91 0 testrad Sent Access-Request Id 181 from 0.0.0.0:39653 to 10.215.144.91:1812 length 132 User-Name = "user" MS-CHAP-Password = "password" NAS-IP-Address = 10.215.144.92 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "user" MS-CHAP-Challenge = 0x5e0a69983fa65564 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000005b82652f1e38b465daebf5a3fb1a2697b12af97676f7c721 Received Access-Reject Id 181 from 10.215.144.91:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Radius log: (0) Received Access-Request Id 181 from 10.215.144.92:39653 to 10.215.144.91:1812 length 132 (0) User-Name = "user" (0) NAS-IP-Address = 10.215.144.92 (0) NAS-Port = 0 (0) Message-Authenticator = 0x1905f61891b983253895b1d8d33976d8 (0) MS-CHAP-Challenge = 0x5e0a69983fa65564 (0) MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000005b82652f1e38b465daebf5a3fb1a2697b12af97676f7c721 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) policy rewrite_calling_station_id { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_calling_station_id = noop (0) if (!EAP-Message) { (0) if (!EAP-Message) -> TRUE (0) if (!EAP-Message) { (0) authorized_macs: EXPAND %{Calling-Station-ID} (0) authorized_macs: --> (0) [authorized_macs] = noop (0) if (!ok) { (0) if (!ok) -> TRUE (0) if (!ok) { (0) [reject] = reject (0) } # if (!ok) = reject (0) } # if (!EAP-Message) = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> user (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 181 from 10.215.144.91:1812 to 10.215.144.92:39653 length 20 # grep user /etc/raddb/radiusd.conf | grep -v '#' user = radius I cannot find any subdir named 'winbindd_privileged': # ls /var/lock/samba/ brlock.tdb mutex.tdb smbXsrv_session_global.tdb g_lock.tdb names.tdb smbXsrv_tcon_global.tdb gencache_notrans.tdb printer_list.tdb smbXsrv_version_global.tdb leases.tdb serverid.tdb smb_krb5 locking.tdb smbXsrv_client_global.tdb smbd_cleanupd.tdb msg.lock smbXsrv_open_global.tdb Why is my radtest above not getting an Access-Accept? Thanks, Vieri

3 6

virtual servers
by Andrew Meyer 29 Nov '17

29 Nov '17

I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up. For reference i've been trying to follow these sites:Freeradius Example Configuration - OTPme | | | Freeradius Example Configuration - OTPme Redmine | | | https://wiki.freeradius.org/config/Virtual-server Do I add the virtual_server=profile1 to the type of authentication in the eap config file? Thank you,

3 7

Is pkcs8 file format supported
by Sumant Gupta 28 Nov '17

28 Nov '17

Hi, I am using pkcs8 file format in private key file (eap config file) placeholder. private_key_file = ${certdir}/*DevFromRoot-Server-AABBCCDD.pkcs8* But after that when i restart freeradius i get the following error: *rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line* *rlm_eap_tls: Error reading private key file /etc/freeradius/certs/DevFromRoot-Server-AABBCCDD.pkcs8* *rlm_eap: Failed to initialize type tls* */etc/freeradius/eap.conf[17]: Instantiation failed for module "eap"* */etc/freeradius/sites-enabled/default[310]: Failed to load module "eap".* If i use the .pem file format it works! Regards Sumant

4 4

Any last requests for 3.0.16?
by Alan DeKok 28 Nov '17

28 Nov '17

I think we're pretty much good to go for 3.0.16. Any last requests / bugs to report? If not, I'll release 3.0.16 later this week. Alan DeKok.

4 10

Re: Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Hi Matthew It is indeed... I've already spoken to Adrian on this - but it's not a quick fix from their side - but they are looking at it - hence the seeing what we can do for now If I can work round it while Adrian looks it's the best of both > --- Original message --- > Subject: Re: Accoiunting proxy Issue > From: Matthew Newton <matthew(a)newtoncomputing.co.uk> > To: <freeradius-users(a)lists.freeradius.org> > Date: Monday, 27/11/2017 2:20 PM > > On Mon, 2017-11-27 at 14:08 +0000, Richard J Palmer wrote: >> >> It all seems to make sense but if I have any questions I'll ask but >> that looks to be enough to me > > Assuming this is a FireBrick from RevK (of Andrews & Arnold), I would > definitely raise it with them, and would be fairly surprised if it > wasn't fixed. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Accoiunting proxy Issue
by Richard J Palmer 27 Nov '17

27 Nov '17

Thanks Alan That sounds sensible - I'll have a look at this - it looks very sensible. It all seems to make sense but if I have any questions I'll ask but that looks to be enough to me Thanks again for your help Richard On Monday 27/11/2017 at 1:40 pm, Alan DeKok wrote: > On Nov 26, 2017, at 3:28 PM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> However the firebrick does not provide the username in interim updates >> or stop messages - which means that the proxy based on realm fails >> (the username / realm is not there). > > That's just stupid. I mean, how hard is to to follow a spec which > was written 20 years ago? > >> >> Is there a way using unlang to proxy these - I was looking at the >> lines in detail - we do also have the records in our SQL server and >> from the AcctSessionID I can look up the username which is possible >> >> I do have one other possibility. The Interim updates have a field: >> Chargeable-User-Identity = "XXXXX" >> Which I can set as part of the auth process (I already add some >> fields in post_proxy). Is there a way in FreeRadius to inspect this >> field in a accounting packet and if set to 'resellerx' set the packet >> to be sent to their proxy / home server ? > > You can do anything in "unlang". > > - in "post-auth", create a Chargeable-User-Identity > - store the Chargeable-User-Identity and User-Name into the radacct > table via an SQL statement > > - in "preacct", look up Chargeable-User-Identity in SQL, and get the > User-Name > > > The simple way is to just mangle the incoming packet (no one cares > about this by the time post-auth is called): > > post-auth { > ... > ... create Chargeable-User-Identity in the reply ... > ... > > update request { > Acct-Status-Type = Start # pretend we're starting a session > Chargeable-User-Identity := &reply:Chargeable-User-Identity > ... anything else you need... > } > sql.accounting # store the packet into radacct > ... > } > > and then in preacct: > > preacct { > ... > > if (!User-Name && Chargeable-User-Identity) { > update request { > User-Name := "%{sql:SELECT username from radacct where cui = > %{Chargeable-User-Identity} > } > > } > > ... and proxying, suffix, etc. > > } > > You'll need to add a ''cui' column to the radacct table. And, > update the accounting 'start' query to store Chargeable-User-Identity > in the 'cui' column. > > But that's about it. The details matter, but it's not *too* > complex. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1