- Freeradius-Users - lists.freeradius.org

Store a attribute in session-state list till the next interim update?
by firing neurons 18 Nov '16

18 Nov '16

Hi, I want to store a Tmp-String-0 attribute in session-state list and retrive it and use it in a conditional in the next interim update. Can this be done? FN

2 1

Version 3.0.12 reply:Packet-Type not set to Access-Reject in Post-Auth-Type REJECT section
by Thor Spruyt 18 Nov '16

18 Nov '16

Hi, I stumbled upon a possible issue with v3.0.12 when rejecting a previously accepted user in de post-auth section. Here's my linelog module instance and post-auth section configuration: linelog linelog_auth { filename = ${logdir}/radius.log reference = "%{reply:Packet-Type}" format = "" Access-Accept = "%t : Access-Accept: User-Name=%{User-Name}" Access-Reject = "%t : Access-Reject: User-Name=%{User-Name}" } post-auth { # ACCEPT { reject linelog_auth # } Post-Auth-Type REJECT { linelog_auth } } And here's the debugging output: (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SSHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/server.conf (0) post-auth { (0) [reject] = reject (0) } # post-auth = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/server.conf (0) Post-Auth-Type REJECT { (0) linelog_auth: EXPAND %{reply:Packet-Type} (0) linelog_auth: --> Access-Accept (0) linelog_auth: EXPAND %t : Access-Accept: User-Name=%{User-Name} (0) linelog_auth: --> Fri Nov 18 15:12:54 2016 : Access-Accept: User-Name=x (0) linelog_auth: EXPAND /var/log/radius/radius.log (0) linelog_auth: --> /var/log/radius/radius.log (0) [linelog_auth] = ok (0) } # Post-Auth-Type REJECT = ok (0) Sent Access-Reject Id 48 from x.x.x.x:1812 to x.x.x.x:1814 length 0 (0) Finished request So using the always reject module in post-auth works to get an Access-Reject at the end. But for some reason, it looks like the reply:Packet-Type is not changed to Access-Reject when entering the Post-Auth-Type REJECT section. Am I forgetting to set something in addition to just "reject" or should the reply:Packet-Type value have been updated when the linelog module is called ? My workaround would be to set reply:Packet-Type in the Post-Auth-Type REJECT section before calling the linelog module. Like so and then it works ok: post-auth { # ACCEPT { reject linelog_auth # } Post-Auth-Type REJECT { update reply { Packet-Type := Access-Reject } linelog_auth } } Would that be a good workaround or are there better workarounds ? -- Regards, Thor

2 2

FreeRadius 3.0.11 and Winbind
by Albert K 18 Nov '16

18 Nov '16

Hi, I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping. https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind Existing Setup 1) Windows 2012R2 Acitive Directory Server Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group

4 8

No TLS 1.2
by David Ward 18 Nov '16

18 Nov '16

We are looking into how to change TLS behavior on radiusd. This is for testing purpose, so I want to intentionally only allow TLS 1.0. Currently running: FreeRADIUS Version 3.0.12. Is there a way to make this version only accept TLS 1.0, right now we are using older 2.x version to test this. -David

3 3

TLS Cache
by Adam Bishop 17 Nov '16

17 Nov '16

Using 3.0.x is it possible to simply test for a resumed/cached session in post-auth? I think I can do it by setting an attribute in the outer virtual server, then checking to see if the inner virtual server modified it or not, but that seems hacky. The end goal is that I'd like to include a value in the linelog config so that I can monitor the effectiveness of the cache, so it gets noticed if a change breaks it. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

1 0

using groupname in accounting/authorize in deafult
by firing neurons 17 Nov '16

17 Nov '16

Hi, TL;DR: read last 5 lines. I want to use the groupname of the user for which the NAS has sent Access/Accouting-Request or Interim update in a sql query (via xlat) in default. I have tired groupname='%{Group}' groupname='%{Sql-Group}' (this should be the one i think) groupname='%{Group-name}' but it always resolves to '' (empty) like the attributes doesn't exist. doing Tmp-String-0 := "%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}" will set Tmp-String-0 to the groupname but when i try to use it in another query like groupname='%{Tmp-String-0}', it resovles to '' (empty). Basically I want this to happen: for two groups named abc and abc_ex with the same attribute name having diffrent vaules of said attribute: groupname = '%{Sql-Group}_Ex' resolves to groupname = abc_ex and groupname = '%{Sql-Group}' resolves to groupname = abc Regards, FN

1 0

Skip policy check if there is no outer request
by Adam Bishop 16 Nov '16

16 Nov '16

I'm using the 'filter_inner_identity' policy to check if a user is trying to do nasty things with their outer/inner id's. However, it has the side effect of preventing me from doing such things. I can whitelist the NAI easily enough, but for this situation I can rely on there not being an outer request (I'm poking the inner-tunnel port directly with radclient). Can I test for the existence of an outer request using unlang? Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 2

Temporary accounts
by Zsolt 16 Nov '16

16 Nov '16

Hi all! Can I set up users accounts in v3.x which expire after some specified time after login? (If yes, how?)

4 7

different answers depending on the time
by Marcin 16 Nov '16

16 Nov '16

Hi Now my configuration responses to NAS with Mikrotik-Rate-Limit regardless of the time and get data from database. I'd like to speed up speed depending on time and when client will connect between 23 and 11 I'd like to multiply his speed. I can create another column for night speeds in database. In freeradius configuration i can create another section, similar to present, which will get data from night speeds is there any solution to configure freeradius to different answer depending on time? something like this, depending on condition? if ( time between 11 and 23){ normal_speeds } else { night_speeds } -- Pozdrawiam Marcin / nicraM

3 6

framed-pool
by Zubair Ayub 16 Nov '16

16 Nov '16

i was using mikrotik routers and using framed pool attribute now i move to cisco want to remove framed pool attribute. any help because when i remove this attribute my user stop connecting.

2 1