- Freeradius-Users - lists.freeradius.org

Help with ippool-dhcp servers (two in redundancy)
by Nataniel Klug 30 Oct '17

30 Oct '17

Hello, I got into a problem and I am not been able to find a solution. I have a scenario where I have two Freeradius IPPool DHCP servers that serve the same network. When an equipment send an request for DHCP both servers get the same request and one of them reply to it. I want to make a delayed response in one of them so I can keep the IP allocation more reliable. I am getting deadlocks in MySQL when running with two servers and I think this is caused by the multiple request in those servers. Atenciosamente, *Nataniel Klug* | nataniel.klug(a)gmail.com

3 4

Setting internal attributes per client
by Nathan Ward 30 Oct '17

30 Oct '17

Hi, We have some RADIUS servers handling clients from 3 different vendors/models of BNGs and so on, and have to return different attributes to each (Cisco-AVPair to Ciscos, etc. etc.). Right now I have some policies that match request:NAS-IP-Address against a list of IPs. It’s a bit annoying to have to add clients in clients.conf and in the policy config. Manageable sure, but, I’m wondering if there’s a better way. Is there a way to have some sort of per-client policy, other than matching NAS-IP-Address or similar? Can I look at shortname as configured in clients.conf (I could add tokens to this, for example, ‘iosxrbng_<original hostname>’. I considered multiple virtual servers, which is still something I’m considering but not sure that’s the best solution either. Open to suggestions! It occurred to me that a useful thing would be setting attributes in clients.conf, i.e.: client example.org { ipaddr = radius.example.org secret = testing123 Tmp-String-0 = BNGFlavourPurple } Maybe. :-) -- Nathan Ward

4 5

ldap group membership check issue
by Евгений Подберезкин 30 Oct '17

30 Oct '17

Hello. I'm trying to check a group of user in Active directory (Win2008) using rlm_ldap. While we have several domains in transitive relations, I should send username with domain part. When domain name is a suffix ( epodberezkin(a)chtpz.ru) it is working, prefix - not (when windows uses login username and domain automatically - f.e. CHTPZ0\epodberezkin) part of mods-enabled/ldap user { base_dn = "dc=chtpz,dc=ru" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } Output of radiusd -X shows, that "DOMAIN\" part is not removed, so sAMAccountname is incorrect Fri Oct 27 14:48:39 2017 : Debug: (7) files: Searching for user in group "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Reserved connection (0) Fri Oct 27 14:48:39 2017 : Debug: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) Fri Oct 27 14:48:39 2017 : Debug: Parsed xlat tree: Fri Oct 27 14:48:39 2017 : Debug: literal --> (sAMAccountName= Fri Oct 27 14:48:39 2017 : Debug: XLAT-IF { Fri Oct 27 14:48:39 2017 : Debug: attribute --> Stripped-User-Name Fri Oct 27 14:48:39 2017 : Debug: } Fri Oct 27 14:48:39 2017 : Debug: XLAT-ELSE { Fri Oct 27 14:48:39 2017 : Debug: attribute --> User-Name Fri Oct 27 14:48:39 2017 : Debug: } Fri Oct 27 14:48:39 2017 : Debug: literal --> ) Fri Oct 27 14:48:39 2017 : Debug: (7) files: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) Fri Oct 27 14:48:39 2017 : Debug: (7) files: --> ( *sAMAccountName=CHTPZ0\5c5cepodberezkin*) Fri Oct 27 14:48:39 2017 : Debug: (7) files: Performing search in "dc=chtpz,dc=ru" with filter "(sAMAccountName=CHTPZ0\5c5cepodberezkin)", scope "sub" Fri Oct 27 14:48:39 2017 : Debug: (7) files: Waiting for search result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://DomainDnsZones.chtpz.ru/DC=DomainDnsZones,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://ForestDnsZones.chtpz.ru/DC=ForestDnsZones,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Rebinding to URL ldap://chtpz.ru/CN=Configuration,DC=chtpz,DC=ru Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Waiting for bind result... Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: rlm_ldap (chtpzldap): Bind successful Fri Oct 27 14:48:39 2017 : Debug: (7) files: Search returned no results How can I fix this??

3 5

Re: Freeradius-Users Digest, Vol 150, Issue 60
by dahili.network＠gmail.com 28 Oct '17

28 Oct '17

Dear friends i am looking paid help on freeradius to offer unpaid page to ppoe customers my email is dahili.network(a)gmail.com unpaid page on real ip web server page is php and curently working for mac auth users but unpaid ppoe disconnected that is why unuseable to ppoe users freeradius may default accept connection ider user paid or unpaid but if unpaid with route to unpaid section if paid than route to paid section ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Saturday, October 28, 2017 1:00 PM Subject: Freeradius-Users Digest, Vol 150, Issue 60 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: ldap group membership check issue (Alan DeKok) > 2. Re: Radius proxy request to other radius for OTP auth > (Satish Patel) > 3. Re: Radius proxy request to other radius for OTP auth (Alan DeKok) > 4. Re: Radius proxy request to other radius for OTP auth > (Satish Patel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 27 Oct 2017 08:48:03 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: ldap group membership check issue > Message-ID: <3A589B8E-AF8B-46C5-B9FA-9344D95BDA1C(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On Oct 27, 2017, at 7:49 AM, Евгений Подберезкин <epodber(a)gmail.com> > wrote: >> >> Thanks for the reply. I 've already added the realms to proxy.conf , but >> adding ntdomain module wasn`t obvious for me (suffix is enabled by >> default, >> so I did not care of it). > > Yes, that's not obvious. > >> I have one more question, could you give me hint. >> >> If check LDAP-Group in etc/raddb/users, it works. >> >> DEFAULT chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru" >> >> DEFAULT Auth-Type := Reject >> Reply-Message = "Group do not match" >> >> But if I need to set an attribute in post-auth, it does not >> >> F.e. in sites-enabled/default or sites-enabled/inner-tunnel > > That sets the attribute in the *inner-tunnel*. You still need to get it > to the outer, default server. > > See raddb/mods-available/eap. Look for "use_tunneled_reply". > >> post-auth { >> >> if (chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { >> Tunnel-Private-Group-ID := "165" >> } >> >> >> radiusd -X : >> >> (9) # Executing section post-auth from file >> /opt/freeradius3/etc/raddb/sites-enabled/default >> (9) post-auth { >> (9) if (chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") { >> (9) *if (chtpzldap-LDAP-Group == >> "CN=WiFi_CHTPZ,OU=WiFi,OU=CHTPZ,DC=chtpz,DC=ru") -> FALSE* > > Which means it doesn't match. Find out why, first. > > See the comments at the top of the "inner-tunnel" virtual server for how > to debug it. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Fri, 27 Oct 2017 12:05:24 -0400 > From: Satish Patel <satish.txt(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Radius proxy request to other radius for OTP auth > Message-ID: > <CAPgF-for5jSuCE3anKQ+sUdvaXC548c6JSHS27oMQ2CTOM8PHA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > In short this is what i am planning to do with FreeRadius instead of > IAS windows > http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… > > We have Multi Factor authentication (password+OTP) for VPN login, and > MFA (multi factor auth) provided by onelogin company, in my Cisco ASA > i tell my RADIUS server is onlogin in cloud and my asa authenticate > users from there, but that company doesn't support Attribute Class 25 > which i posted in link, so i was thinking to build Freeradius in-house > and do whatever i want there for grouping and then proxy request to > onlogin for OTP stuff. In short my local radius will act like Proxy > and forward request to onelogin in cloud for OTP. > > I am not sure it's possible or not so just trying to see what people > think about it or any other way out. > > On Fri, Oct 27, 2017 at 8:43 AM, Alan DeKok <aland(a)deployingradius.com> > wrote: >> On Oct 26, 2017, at 10:58 PM, Satish Patel <satish.txt(a)gmail.com> wrote: >>> Recently we decided to create multiple Group Policy for VPN and every >>> group will have own permission to access application, like Sales, >>> Finance and contractor etc, In short contractor can't access Finance >>> related application etc. >> >> I'm not sure that's possible in RADIUS. You can send policies to the >> VPN (maybe), but the VPN may ignore them. >> >>> After reading found ASA support RADIUS attribute Class 25 where i can >>> create OU=sales and implement policy base on whatever LDAP memberOf >>> list users. >> >> That's vague... what, exactly are you doing? What piece of the network >> is doing what? >> >>> But unfortunately onelogin doesn't support that kind of attributes >>> mapping and now we stuck here so only solution is to deploy on radius >>> server and integrate with google authenticator. >> >> How does deploying a RADIUS server help with controlling access to >> applications? >> >>> So i have question is there anyway i can use FreeRadius locally and >>> use attributes Class 25 and then proxy authentication to onlelogin >>> RADIUS? >> >> FreeRADIUS can use Class. So? What does it *do* with it? >> >>> What should i do and what you guys suggest here? >> >> First, you have to describe what you're doing. Which network machines >> are involved? What are they doing? What information do they exchange? >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 3 > Date: Fri, 27 Oct 2017 12:10:28 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Radius proxy request to other radius for OTP auth > Message-ID: <17B7D2F9-A785-487D-B691-38EEDE050FAC(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > >> On Oct 27, 2017, at 12:05 PM, Satish Patel <satish.txt(a)gmail.com> wrote: >> >> In short this is what i am planning to do with FreeRadius instead of >> IAS windows >> http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… > > You just configure FreeRADIUS to send the Class attribute back. That > should be simple. > >> We have Multi Factor authentication (password+OTP) for VPN login, and >> MFA (multi factor auth) provided by onelogin company, in my Cisco ASA >> i tell my RADIUS server is onlogin in cloud and my asa authenticate >> users from there, but that company doesn't support Attribute Class 25 >> which i posted in link, > > Then you can't do it. > >> so i was thinking to build Freeradius in-house >> and do whatever i want there for grouping and then proxy request to >> onlogin for OTP stuff. In short my local radius will act like Proxy >> and forward request to onelogin in cloud for OTP. > > That still isn't clear. If the VPN doesn't support Class, then adding > FreeRADIUS won't help. > > Alan DeKok. > > > > > ------------------------------ > > Message: 4 > Date: Fri, 27 Oct 2017 12:37:12 -0400 > From: Satish Patel <satish.txt(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Radius proxy request to other radius for OTP auth > Message-ID: > <CAPgF-fqKM-Jq1WteajY3h+aC1f8vGxazSUdTVT-bftG4v7dbpg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > >> That still isn't clear. If the VPN doesn't support Class, then adding >> FreeRADIUS won't help. > > VPN does support that Class > > On Fri, Oct 27, 2017 at 12:10 PM, Alan DeKok <aland(a)deployingradius.com> > wrote: >> >>> On Oct 27, 2017, at 12:05 PM, Satish Patel <satish.txt(a)gmail.com> wrote: >>> >>> In short this is what i am planning to do with FreeRadius instead of >>> IAS windows >>> http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… >> >> You just configure FreeRADIUS to send the Class attribute back. That >> should be simple. >> >>> We have Multi Factor authentication (password+OTP) for VPN login, and >>> MFA (multi factor auth) provided by onelogin company, in my Cisco ASA >>> i tell my RADIUS server is onlogin in cloud and my asa authenticate >>> users from there, but that company doesn't support Attribute Class 25 >>> which i posted in link, >> >> Then you can't do it. >> >>> so i was thinking to build Freeradius in-house >>> and do whatever i want there for grouping and then proxy request to >>> onlogin for OTP stuff. In short my local radius will act like Proxy >>> and forward request to onelogin in cloud for OTP. >> >> That still isn't clear. If the VPN doesn't support Class, then adding >> FreeRADIUS won't help. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 150, Issue 60 > ************************************************* > --- Bu e-posta, AVG tarafından virüslere karşı kontrol edildi. http://www.avg.com

1 0

Radius proxy request to other radius for OTP auth
by Satish Patel 27 Oct '17

27 Oct '17

Let me explain what we are trying to do, we have Cisco anyconnect VPN and we are using onelogin RADIUS (https://www.onelogin.com/) for OTP, we have our own OpenLDAP server and onelogin sync our directory service and provide Auth with OTP solution. Recently we decided to create multiple Group Policy for VPN and every group will have own permission to access application, like Sales, Finance and contractor etc, In short contractor can't access Finance related application etc. After reading found ASA support RADIUS attribute Class 25 where i can create OU=sales and implement policy base on whatever LDAP memberOf list users. But unfortunately onelogin doesn't support that kind of attributes mapping and now we stuck here so only solution is to deploy on radius server and integrate with google authenticator. So i have question is there anyway i can use FreeRadius locally and use attributes Class 25 and then proxy authentication to onlelogin RADIUS? What should i do and what you guys suggest here?

2 4

rlm_winbind group membership check
by Евгений Подберезкин 27 Oct '17

27 Oct '17

Hi. I need to authenticate wifi users via PEAP(mschap) with group checking against windows active directory. We have several domains in transitive relations. Basic authentication via winbind works fine. But since the groups may be in different domains, I must check group membership with domain prefix. And I can not set up rlm_winbind to work correctly. Could you help me, please. root@chtpzfreeradius:/opt/sbin# cat /opt/etc/raddb/users | grep -v "#" DEFAULT Winbind-Group == "CHTPZ0\\wifi_chtpz" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID := "165" DEFAULT Auth-Type := Reject Reply-Message = "Groups do not match" root@chtpzfreeradius:/opt/sbin# cat /opt/etc/raddb/mods-enabled/winbind | grep -v "#" winbind { winbind_username = "%{%{Stripped-User-Name}:-%{User-Name}}" group { group_search_username = "%{%{Stripped-User-Name}:-%{ User-Name}}" group_add_domain = no } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } } Output of radiusd -Xx shows, that module strips domain part of group name. Thu Oct 26 09:58:52 2017 : (7.0) files - EXPAND %{%{Stripped-User-Name}:-%{User-Name}} Thu Oct 26 09:58:52 2017 : (7.0) files - %{%{Stripped-User-Name}:-%{ User-Name}} Thu Oct 26 09:58:52 2017 : (7.0) files - Parsed xlat tree: Thu Oct 26 09:58:52 2017 : XLAT-IF { Thu Oct 26 09:58:52 2017 : (7.0) files - attribute --> Stripped-User-Name Thu Oct 26 09:58:52 2017 : } Thu Oct 26 09:58:52 2017 : XLAT-ELSE { Thu Oct 26 09:58:52 2017 : (7.0) files - attribute --> User-Name Thu Oct 26 09:58:52 2017 : } Thu Oct 26 09:58:52 2017 : (7.0) files - --> CHTPZ0\\epodberezkin Thu Oct 26 09:58:52 2017 : (7.0) files - Reserved connection (4) Thu Oct 26 09:58:52 2017 : (7.0) files - Trying to find user "CHTPZ0\epodberezkin" in group "CHTPZ0\wifi_chtpz" Thu Oct 26 09:58:53 2017 : (7.0) files - Successfully retrieved user's groups Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10004 to name "CHTPZ0\domain users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "domain users" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10026 to name "CHTPZ0\msk2_docs_инструкции_r" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "msk2_docs_инструкции_r" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10027 to name "CHTPZ0\bad_sites" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "bad_sites" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10028 to name "CHTPZ0\wallpaper_disable" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wallpaper_disable" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10029 to name "CHTPZ0\ucc-archive-read" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ucc-archive-read" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10030 to name "CHTPZ0\acs_administrartor" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "acs_administrartor" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10020 to name "CHTPZ0\wwwg" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wwwg" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10031 to name "CHTPZ0\h239_xray_read" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "h239_xray_read" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10032 to name "CHTPZ0\administrators-chtpzsfbfe1" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "administrators-chtpzsfbfe1" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10033 to name "CHTPZ0\administrators-chtpzsfbdb1" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "administrators-chtpzsfbdb1" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10034 to name "CHTPZ0\цит-интернет" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "цит-интернет" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10035 to name "CHTPZ0\password policy high" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "password policy high" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10036 to name "CHTPZ0\csadministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "csadministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10037 to name "CHTPZ0\rtcuniversalserverreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name " rtcuniversalserverreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10038 to name "CHTPZ0\rtcuniversalglobalwritegroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "rtcuniversalglobalwritegroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10039 to name "CHTPZ0\csserveradministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "csserveradministrator" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10040 to name "CHTPZ0\rtcuniversalglobalreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name " rtcuniversalglobalreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10041 to name "CHTPZ0\rtcuniversalserveradmins" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "rtcuniversalserveradmins" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10042 to name "CHTPZ0\rtcuniversaluserreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name " rtcuniversaluserreadonlygroup" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10043 to name "CHTPZ0\vpn_1ceh_video" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vpn_1ceh_video" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10016 to name "CHTPZ0\1с chtpzfile2" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "1с chtpzfile2" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10044 to name "CHTPZ0\wi-fi_dip" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wi-fi_dip" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10045 to name "CHTPZ0\vpndip" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vpndip" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10046 to name "CHTPZ0\wifi local" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wifi local" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10015 to name "CHTPZ0\proxyusers" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "proxyusers" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10014 to name "CHTPZ0\управление по работе с соц.объектами(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "управление по работе с соц.объектами(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10047 to name "CHTPZ0\серверные (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "серверные (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10012 to name "CHTPZ0\rever1" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "rever1" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10048 to name "CHTPZ0\dhcp users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "dhcp users" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10011 to name "CHTPZ0\день информирования (чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "день информирования (чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10049 to name "CHTPZ0\wifi vip" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wifi vip" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10050 to name "CHTPZ0\zavod" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "zavod" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10051 to name "CHTPZ0\zip(запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "zip(запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10010 to name "CHTPZ0\охрана труда_ цех №1(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "охрана труда_ цех №1(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10052 to name "CHTPZ0\asa_vpn_users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "asa_vpn_users" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10053 to name "CHTPZ0\_система технического учета (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "_система технического учета (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10054 to name "CHTPZ0\департамент по тк (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "департамент по тк (запись)" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10055 to name "CHTPZ0\users chtpz-cit" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "users chtpz-cit" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10008 to name "CHTPZ0\l(чтение)" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "l(чтение)" *Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10056 to name "CHTPZ0\wifi_chtpz"* *Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "wifi_chtpz"* Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10057 to name "CHTPZ0\vnc_access" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vnc_access" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10058 to name "CHTPZ0\vnc_moscow" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "vnc_moscow" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10059 to name "CHTPZ0\ciscoms" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ciscoms" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10006 to name "CHTPZ0\ts2008" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ts2008" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10060 to name "CHTPZ0\ооо универсальные системы" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "ооо универсальные системы" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10061 to name "CHTPZ0\oss_members" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "oss_members" Thu Oct 26 09:58:53 2017 : (7.0) files - Resolved GID 10001 to name "BUILTIN\users" Thu Oct 26 09:58:53 2017 : (7.0) files - Checking plain group name "users" *Thu Oct 26 09:58:53 2017 : (7.0) files - No groups found that match* Thu Oct 26 09:58:53 2017 : (7.0) files - Released connection (4) P.S. and could you also tell me the recommended (more stable) version of freerad with rlm_windind root@chtpzfreeradius:/opt# cat /etc/debian_version 9.2

2 2

new freeradius setup
by Andrew Meyer 26 Oct '17

26 Oct '17

I am running CentOS 7. I am setting up FreeRADIUS again. Documenting it step-by-step. I am only working the test user at the moment but I am getting the following error: Tue Oct 24 19:30:28 2017 : Debug: (0) User-Name = "bob"Tue Oct 24 19:30:28 2017 : Debug: (0) User-Password = "hello"Tue Oct 24 19:30:28 2017 : Debug: (0) NAS-IP-Address = 10.150.10.40Tue Oct 24 19:30:28 2017 : Debug: (0) NAS-Port = 0Tue Oct 24 19:30:28 2017 : Debug: (0) Message-Authenticator = 0x7c0ca39b4c7952c808f3602792b02eb6Tue Oct 24 19:30:28 2017 : Debug: (0) session-state: No State attributeTue Oct 24 19:30:28 2017 : Debug: (0) Empty authorize section. Using default return values.Tue Oct 24 19:30:28 2017 : ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = RejectTue Oct 24 19:30:28 2017 : Debug: (0) Failed to authenticate the userTue Oct 24 19:30:28 2017 : Auth: (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [bob/hello] (from client localhost port 0)Tue Oct 24 19:30:28 2017 : Debug: (0) Using Post-Auth-Type RejectTue Oct 24 19:30:28 2017 : Debug: (0) Post-Auth-Type sub-section not found. Ignoring.Tue Oct 24 19:30:28 2017 : Debug: (0) Delaying response for 1.000000 secondsTue Oct 24 19:30:28 2017 : Debug: Thread 3 waiting to be assigned a requestTue Oct 24 19:30:28 2017 : Debug: Waking up in 0.6 seconds.Tue Oct 24 19:30:29 2017 : Debug: (0) Sending delayed responseTue Oct 24 19:30:29 2017 : Debug: (0) Sent Access-Reject Id 16 from 10.150.10.40:1812 to 10.150.10.40:43969 length 20Tue Oct 24 19:30:29 2017 : Debug: Waking up in 3.9 seconds.Tue Oct 24 19:30:33 2017 : Debug: (0) Cleaning up request packet ID 16 with timestamp +67Tue Oct 24 19:30:33 2017 : Info: Ready to process requests Here is my config from /etc/raddb/users:bob Auth-Type := Accept Cleartext-Password := "hello" Reply-Message := "Hello, %{User-Name}" I tried not using a client config and then ended up putting in the following: client testing { ipaddr = 10.150.0.0/16 secret = testing123 } radtest bob hello 10.150.10.40:1812 0 testing123Sent Access-Request Id 119 from 0.0.0.0:56648 to 10.150.10.40:1812 length 73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 10.150.10.40 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello"Received Access-Reject Id 119 from 10.150.10.40:1812 to 0.0.0.0:0 length 20(0) -: Expected Access-Accept got Access-Reject Is there something I missed in the configuration? Thank you,

5 17

Statistic from Status server
by Peter Balsianok 26 Oct '17

26 Oct '17

Hi, I want to retrieve statistic for particular home server via Status-Server. but server sends empty answer. At the end of debug log you can find request. Help please, thx Debug log: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /app/radius/freeradius-3.0.13/share/freeradius/dictionary including dictionary file /app/radius/freeradius-3.0.13/share/freeradius/dictionary.dhcp including dictionary file /app/radius/freeradius-3.0.13/share/freeradius/dictionary.vqp including dictionary file /app/radius/conf/auth-test/dictionary including configuration file /app/radius/conf/auth-test/radiusd.conf including configuration file /app/radius/conf/auth-test/templates.conf including configuration file /app/radius/conf/auth-test/proxy.conf including configuration file /app/radius/conf/auth-test/clients.conf including files in directory /app/radius/conf/auth-test/mods-enabled/ including configuration file /app/radius/conf/auth-test/mods-enabled/unpack including configuration file /app/radius/conf/auth-test/mods-enabled/files including configuration file /app/radius/conf/auth-test/mods-enabled/expr including configuration file /app/radius/conf/auth-test/mods-enabled/preprocess including configuration file /app/radius/conf/auth-test/mods-enabled/chap including configuration file /app/radius/conf/auth-test/mods-enabled/attr_filter including configuration file /app/radius/conf/auth-test/mods-enabled/always including configuration file /app/radius/conf/auth-test/mods-enabled/linelog including configuration file /app/radius/conf/auth-test/mods-enabled/perl including configuration file /app/radius/conf/auth-test/mods-enabled/ldap including configuration file /app/radius/conf/auth-test/mods-enabled/realm including configuration file /app/radius/conf/auth-test/mods-enabled/pap including files in directory /app/radius/conf/auth-test/policy-enabled/ including configuration file /app/radius/conf/auth-test/policy-enabled/RAN-BACKUP including configuration file /app/radius/conf/auth-test/policy-enabled/accounting including configuration file /app/radius/conf/auth-test/policy-enabled/SkyToll.new including configuration file /app/radius/conf/auth-test/policy-enabled/huntgroup including configuration file /app/radius/conf/auth-test/policy-enabled/post-proxy including configuration file /app/radius/conf/auth-test/policy-enabled/FixedLTE including configuration file /app/radius/conf/auth-test/policy-enabled/username including configuration file /app/radius/conf/auth-test/policy-enabled/nas including configuration file /app/radius/conf/auth-test/policy-enabled/SkyToll including files in directory /app/radius/conf/auth-test/sites-enabled/ including configuration file /app/radius/conf/auth-test/sites-enabled/control-socket including configuration file /app/radius/conf/auth-test/sites-enabled/default including configuration file /app/radius/conf/auth-test/sites-enabled/status main { name = "auth-test" prefix = "/app/radius/freeradius-v3" localstatedir = "/app_log/radius/auth-test/" sbindir = "/app/radius/freeradius-v3/sbin" logdir = "/app_log/radius/auth-test/" run_dir = "/app_log/radius/auth-test/" libdir = "/app/radius/freeradius-v3/lib" radacctdir = "/app_log/radius/auth-test//radacct" panic_action = "gdb -silent -x /app/radius/conf/auth-test/panic.gdb %e %p 2>&1 | tee /app_log/radius/auth-test//gdb-auth-test-%p.log" hostname_lookups = no max_request_time = 7 cleanup_delay = 2 max_requests = 25600 pidfile = "/app_log/radius/auth-test//radius.pid" checkrad = "/app/radius/freeradius-v3/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 0.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } WARNING: Ignoring "response_window = 30.000000", forcing to "response_window = 7.000000" home_server vse_server1_prod { ipaddr = 10.14.135.145 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 6 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 username = "orange-system" password = "incorrect" limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } WARNING: Ignoring "response_window = 30.000000", forcing to "response_window = 7.000000" home_server vse_server2_prod { ipaddr = 10.14.135.146 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 6 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 username = "orange-system" password = "incorrect" limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } WARNING: Ignoring "response_window = 30.000000", forcing to "response_window = 7.000000" home_server_pool prod_pool_vse { type = load-balance home_server = vse_server1_prod home_server = vse_server2_prod } realm vsetest.sk { auth_pool = prod_pool_vse nostrip } realm vseazd.sk { auth_pool = prod_pool_vse nostrip } realm vseusec.sk { auth_pool = prod_pool_vse nostrip } realm vsegps.sk { auth_pool = prod_pool_vse nostrip } realm vsesec.sk { auth_pool = prod_pool_vse nostrip } realm vseewo.sk { auth_pool = prod_pool_vse nostrip } realm vseims.sk { auth_pool = prod_pool_vse nostrip } realm vsdvip.sk { auth_pool = prod_pool_vse nostrip } realm LOCAL { authhost = LOCAL accthost = LOCAL } realm NULL { authhost = LOCAL accthost = LOCAL } realm DEFAULT { authhost = LOCAL accthost = LOCAL } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = PERL # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Autz-Type = Status-Server # Instantiating module "files" from file /app/radius/conf/auth-test/mods-enabled/files reading pairlist file /app/radius/conf/auth-test/mods-config/files/authorize reading pairlist file /app/radius/conf/auth-test/mods-config/files/authorize reading pairlist file /app/radius/conf/auth-test/mods-config/files/accounting reading pairlist file /app/radius/conf/auth-test/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /app/radius/conf/auth-test/mods-enabled/preprocess # Instantiating module "attr_filter.post-proxy" from file /app/radius/conf/auth-test/mods-enabled/attr_filter reading pairlist file /app/radius/conf/auth-test/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /app/radius/conf/auth-test/mods-enabled/attr_filter reading pairlist file /app/radius/conf/auth-test/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /app/radius/conf/auth-test/mods-enabled/attr_filter reading pairlist file /app/radius/conf/auth-test/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /app/radius/conf/auth-test/mods-enabled/attr_filter reading pairlist file /app/radius/conf/auth-test/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /app/radius/conf/auth-test/mods-enabled/attr_filter reading pairlist file /app/radius/conf/auth-test/mods-config/attr_filter/accounting_response # Instantiating module "reject" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "fail" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "ok" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "handled" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "invalid" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "userlock" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "notfound" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "noop" from file /app/radius/conf/auth-test/mods-enabled/always # Instantiating module "updated" from file /app/radius/conf/auth-test/mods-enabled/always radiusd: #### Loading Virtual Servers #### server { # from file /app/radius/conf/auth-test/radiusd.conf } # server server default { # from file /app/radius/conf/auth-test/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading pre-proxy {...} # Loading post-auth {...} } # server default server status { # from file /app/radius/conf/auth-test/sites-enabled/status # Loading authorize {...} } # server status radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "/app/radius/conf/auth-test/control.socket" mode = "rw" peercred = yes } } listen { type = "auth" ipv4addr = * port = 10812 limit { max_pps = 0 max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv4addr = * port = 10645 limit { max_pps = 0 max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "status" ipaddr = 127.0.0.1 port = 28121 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on command file /app/radius/conf/auth-test/control.socket Listening on auth address * port 10812 bound to server default Listening on auth address * port 10645 bound to server default Listening on status address 127.0.0.1 port 28121 bound to server status Listening on proxy address * port 33049 Ready to process requests (0) Received Status-Server Id 246 from 127.0.0.1:40048 to 127.0.0.1:28121 length 74 (0) Message-Authenticator = 0x4c348183f7bb200825f992012e53b89e (0) FreeRADIUS-Statistics-Type = 131 (0) FreeRADIUS-Stats-Server-IP-Address = 10.14.135.145 (0) FreeRADIUS-Stats-Server-Port = 1812 (0) # Executing group from file /app/radius/conf/auth-test/sites-enabled/status (0) Autz-Type Status-Server { (0) [ok] = ok (0) } # Autz-Type Status-Server = ok (0) Sent Access-Accept Id 246 from 127.0.0.1:28121 to 127.0.0.1:40048 length 0 (0) Finished request Waking up in 1.9 seconds. (0) Cleaning up request packet ID 246 with timestamp +35

3 11

Cisco + Radius
by Yahn do Amaral Almeida Pinheiro 26 Oct '17

26 Oct '17

I'm trying to use the cisco to authenticate in freeradius, but it's not working. When I test a request, it appears in the radius debug that the password is wrong, but I'm sure it's right. Would you have any documents that could tell me about configuring Radius + Cisco? And, what is cisco-vsa-hack?

3 3

Multiple Windows Domains
by Brian Smith - IN2IT 26 Oct '17

26 Oct '17

Hello All Doing a little research. We have a customer that has 5 different Windows Active Directory domains (separate companies) all using their own IP address ranges. What they want to achieve, irrespective on where the users physically reside is for the radius server to identify the user from their login details and then issue out the correct IP address for that company. Has anyone done anything like this using FreeRadius? Regards Brian Smith IN 2 IT Tel: +27 11 453 9136 Fax: +27 11 453 1788 Connect with me on Facebook <https://www.facebook.com/BrianSmithIN2IT> https://www.facebook.com/BrianSmithIN2IT <http://www.in2it.co.za/> in2itlogo <http://www.facebook.com/pages/in2itcoza/146008768784049> facebook <https://www.linkedin.com/company/in2it-> linkedin PLEASE NOTE: For Technical queries, log your request via the IN2IT Ticket system. This may be found on <http://www.in2it.co.za> www.in2it.co.za under the Log Support option. This is the preferred system for support for reasons of transparency. Whatsapp, email and SMS requests do not guarentee immediate action. Tickets may be created telephonically, please phone should the above system not be available.

3 2