- Freeradius-Users - lists.freeradius.org

How to manipulate NAS-Port-ID from freeswitch using libfreeradius v1.1.7 ?
by Dmitriy Borisov 13 Mar '17

13 Mar '17

Hello, All! I`ve a problem :( I must interoperate with PortaBilling Radius server, which requires from me to send 5060 in NAS-Port-Id attribute. I can`t understood, how can I do this. It always equal to zero. I found that I must write something to /etc/freeradius/port-id-map, but I don`t know what port freeswitch using (eg /dev/tty0) Help me, please!

2 2

system startup/stop scripts when building from source
by Bill Schoolfield 13 Mar '17

13 Mar '17

When you build from source are there any scripts for starting and stopping the server? I'm running FreeRADIUS Version 3.0.13 on centos 6.x Bill

4 8

SQL-Group outside of sql module
by Andrea Gabellini 13 Mar '17

13 Mar '17

Hi, is it possible to use the attribute SQL-Group outside of the sql module after calling it? During the server startup in debug mode, i see: ... rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked Creating attribute SQL-Group ... I tried to use it but expanding it results in an empty string. Thanks, Andrea -- ---------------------------------------------------------------- If you smoke after sex, you're doing it too fast ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

2 1

Support Ntdomain and Suffix For Ad authentication
by Arnab Roy 13 Mar '17

13 Mar '17

Hi , I am just trying to see if its possible to get usernames of both formats to authenticate on FR. Based on the howto here http://wiki.freeradius.org/guide/freeradius-active-directory-integ ration-howto It seems to be either or in the mschap module. I tried a few combination like so in the username expansion --username=%{%{mschap:User-Name}:-00} --> Domain\username works , but username@d omain breaks because we are not passing the Stripped username --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} user@domain works but domain\user breaks. Any way I can combine the above to expansions and support both username formats .. Your help is appreciated. Many Thanks Arnab

2 1

Broken link
by Brian Candler 13 Mar '17

13 Mar '17

http://freeradius.org/freeradius-client/ links to http://wiki.freeradius.org/Radiusclient But if I click it, I get: http://wiki.freeradius.org/__omnigollum__/auth/github/callback?code=a959d3e… " Authentication failed Insufficient data from authentication provider, email not provided or empty Try again <http://wiki.freeradius.org/__omnigollum__login?origin=%2Fcreate%2FRadiuscli…> " I *think* this is because the wiki thinks I'm trying to create a non-existent page. Perhaps this is the right link instead? http://wiki.freeradius.org/project/Radiusclient (although that page may be old, since it links to freeradius-client-1.1.6 rather than 1.1.7) Regards, Brian.

2 1

Freeradius with LDAP and in second LDAP Authorization or Proxying
by Jörn Volkhausen 13 Mar '17

13 Mar '17

Good Morning i have a problem with the Set-Up i have to do. we have two types of costumers (managed and unmanaged). In our Setup we get all access-requests to the same radius server. In this radius Server then we have to decide if we have to proxying the request (unmanaged costumer) or authorize against our LDAP server (unmanaged costumer). The information if the costumer ist managed/unmanaged along with proxy and user information is in the same ldap and i have to query it first for deciding what to do. Is such a setup possible with freeradius? My specs: Ubuntu 16.04 FreeRADIUS Version 2.2.8 (2.2.8+dfsg-0.1build2 from apt) The basic setup with authorization/authentication against the ldap is running very well, but the extension with the unmanaged costumers give my head ache. I need help to find the right direction to run. Thanks Jörn

2 2

Problem with huntgroups upgrading from 2.2.9 to 3.0.x
by Andrea Gabellini 13 Mar '17

13 Mar '17

Hi, I'm upgrading from FR 2.2.9 to FR 3.0.13. I'm testing the configuration in my lab. I've a problem with huntgroups. This is my huntgroups file: adsl NAS-IP-Address == 1.2.3.4 Group == adslhome, Group == adslbusiness, Group == adslpro Suppose a user is in the group adslbusiness. I get the "No Huntgroup" error. exchanging the last two lines the same user can log in: adsl NAS-IP-Address == 1.2.3.4 Group == adslhome, Group == adslpro, Group == adslbusiness It seems that it works only if the last condition is true. The same huntgroups file works fine in FR 2.2.9. Is it changed some logic from 2.x to 3.x? Thanks, Andrea -- ---------------------------------------------------------------- Una candela accesa infiamma un'altra candela, e in tal modo si riesce ad accendere migliaia di candele, cos ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

2 2

eap_peap: fatal access_denied error
by mustafa mujahid 11 Mar '17

11 Mar '17

Hello all, I've been trying to authentication LAN on Cisco 2960 Switch. I've done configurations with PAP but this is the first time working with EAP. I have run into a bit of an issue. I receive a 'fatal :access denied error' in the debug log while testing with a single client. Radius version is 3.0.12 Please find full debug log attached as it was quite long, along with my defaults file , eap module file and inner tunnel. the Error as shown in debug output : (6) Received Access-Request Id 111 from 10.10.99.5:1645 to 115.186.154.51:1812 length 208 (6) User-Name = "inzamam.shafiq" (6) Service-Type = Framed-User (6) Framed-MTU = 1500 (6) Called-Station-Id = "F4-1F-C2-29-F2-04" (6) Calling-Station-Id = "5C-B9-01-40-7A-51" (6) EAP-Message = 0x0207002f1980000000251503010020c16512711bcb968946945393a285231d100f4ad033f9b228472d29b6fe0f9330 (6) Message-Authenticator = 0xe7d930474f3ffad35c235370b081c91f (6) NAS-Port-Type = Ethernet (6) NAS-Port = 50004 (6) NAS-Port-Id = "FastEthernet0/4" (6) State = 0x83dbc94886dcd087405afa3e400f12a5 (6) NAS-IP-Address = 10.10.99.5 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) [preprocess] = ok (6) auth_log: EXPAND /var/log/radius/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log: --> /var/log/radius/log/radius/radacct/10.10.99.5/auth-detail-20170308 (6) auth_log: /var/log/radius/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/log/radius/radacct/10.10.99.5/auth-detail-20170308 (6) auth_log: EXPAND %t (6) auth_log: --> Wed Mar 8 11:05:41 2017 (6) [auth_log] = ok (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "inzamam.shafiq", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 47 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x83dbc94886dcd087 (6) eap: Finished EAP session with state 0x83dbc94886dcd087 (6) eap: Previous EAP request found for state 0x83dbc94886dcd087, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer indicated complete TLS record size will be 37 bytes (6) eap_peap: Got complete TLS record (37 bytes) (6) eap_peap: [eaptls verify] = length included (6) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal access_denied (6) eap_peap: ERROR: TLS Alert read:fatal:access denied (6) eap_peap: WARNING: No data inside of the tunnel (6) eap_peap: [eaptls process] = ok (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state ? (6) eap_peap: ERROR: Tunneled data is invalid (6) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 7 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/default (6) Post-Auth-Type REJECT { (6) sql: EXPAND .query (6) sql: --> .query (6) sql: WARNING: No such configuration item .query (6) [sql] = noop (6) } # Post-Auth-Type REJECT = noop (6) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (6) Sending delayed response (6) Sent Access-Reject Id 111 from 115.186.154.51:1812 to 10.10.99.5:1645 length 44 (6) EAP-Message = 0x04070004 (6) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 105 with timestamp +9 (1) Cleaning up request packet ID 106 with timestamp +9 (2) Cleaning up request packet ID 107 with timestamp +9 (3) Cleaning up request packet ID 108 with timestamp +10 (4) Cleaning up request packet ID 109 with timestamp +10 (5) Cleaning up request packet ID 110 with timestamp +10 (6) Cleaning up request packet ID 111 with timestamp +10 Ready to process requests I read that radius works with EAP out of the box. I'm sorry I don't have more troubleshooting info as I couldnt figure out how to move forward from here. If I could be pointed in the right direction it would be greatly appreciated. Please let me know if further information is required. BR/Mustafa.

3 8

Issue with 3.0.13 upgrade
by Antoine JOUBERT 10 Mar '17

10 Mar '17

Hi, I've encountered an issue while trying to upgrade one of my freeradius servers from 3.0.12 to 3.0.13. I've done the following to reproduce the issue. I've installed freeradius 3.0.12 on a new server from compiled debian packages : version=3.0.12 dpkg -i freeradius_${version}+git_amd64.deb freeradius-common_${version}+git_all.deb freeradius-config_${version}+git_amd64.deb freeradius-utils_${version}+git_amd64.deb libfreeradius3_${version}+git_amd64.deb After the install, the daemon runs fine : pgrep -alf radius 17866 /usr/sbin/freeradius I've then tried to upgrade it to 3.0.13, from compiled debian packages as well : version=3.0.13 dpkg -i freeradius_${version}+git_amd64.deb freeradius-common_${version}+git_all.deb freeradius-config_${version}+git_amd64.deb freeradius-utils_${version}+git_amd64.deb libfreeradius3_${version}+git_amd64.deb [...] Checking FreeRADIUS daemon configuration...failed (The server is not configured to listen on any ports. Cannot start). [...] After the upgrade, the mods-enabled and sites-enabled folders are empty : ll /etc/freeradius/mods-enabled total 0 ll /etc/freeradius/sites-enabled total 0 Is anybody else having issues upgrading to 3.0.13 ? Any idea what could be causing this ? Thanks ! Regards, Antoine

3 3

Any training sessions available for understanding and configuring radius server
by bbnlradius 10 Mar '17

10 Mar '17

Hi, Can any one please do let me know if there is any good classes available for administration/performance tuning/HA etc. Thanks Arun

2 1