- Freeradius-Users - lists.freeradius.org

Re: Ubiquiti AP Working with FreeRadius (David Teston)
by Jose Quezada 14 Nov '16

14 Nov '16

>Hello, >I am currently using Ubiquiti Unifi APs, but I don't use a Ubiquiti dictionary. You can restrict bandwidth using the Ubiquiti Cloud Controller. You can run the Controller on the same server as FreeRadius (which is what I do), or you can run it on any desktop OS. The Controller doesn't always have to be running, but it's much easier to use/debug when it's on a server. >I highly suggest using the Controller because the interface is comprehensive and intuitive. Please feel free to ask me any questions about my setup. If people want the full configuration posted, I'll be glad to do that too. >David Thanks a lot Sr David And if it is the case that I have to limit users by sessions and by bandwidth depending on who the user is. Could cloud controller help me with that? I think not. For that reason i want to know if I'd do with some moduls or something like that in radius. Although I have to create them. Thanks David, Jose Quezada

1 0

password-less keys for TLS
by Matt Zagrabelny 11 Nov '16

11 Nov '16

Hello, I am wondering what folks think about password-less keys for TLS? Both the server key - and the client key under EAP-TLS. The password for the server key is on disk in a config file, so a password encrypted key seems just about as safe as a password-less key. The client keys are bit more vulnerable when they aren't encrypted, but I thought I would ask the list if anyone is rolling client certs without passwords. Thanks for any feedback! -m

2 1

Matching a prefix in huntgroups file
by Brian Candler 11 Nov '16

11 Nov '16

What is the way to match a range of IPs in the preprocess huntgroups file? This is with freeradius 3.0.12. Unfortunately, the sample huntgroups file doesn't show any example of matching a range. Here's what I've tried: network NAS-IP-Address =~ ^10\.254\. network NAS-IP-Address =~ "^10\.254\." network NAS-IP-Address =~ "10\.254\..*" network NAS-IP-Address =~ /^10\.254\./ Those all don't match: (0) if (&Huntgroup-Name == "network") { (0) ERROR: Failed retrieving values required to evaluate condition network NAS-IP-Address == 10.254.0.0/16 gives a parse error: /etc/raddb/mods-config/preprocess/huntgroups[5]: Parse error (check) for entry network: Invalid IPv4 mask length "/16". Only "/32" permitted for non-prefix types network 10.254.0.0/16 == NAS-IP-Address gives a different parse error: /etc/raddb/mods-config/preprocess/huntgroups[5]: Parse error (check) for entry network: Invalid vendor name in attribute name "10.254.0.0/16" I know *something* is happening with the regexps, because I can get a compilation error if I make it invalid: network NAS-IP-Address =~ ^10\.254\ /etc/raddb/mods-config/preprocess/huntgroups[5]: Parse error (check) for entry network: Error at offset 9 compiling regex for NAS-IP-Address: Pattern compilation failed: \ at end of pattern But it won't match the supplied NAS-IP-Address. I have no problem with a simple == condition matching a single IP address though. Any clues? Thanks, Brian.

7 30

radacct table not working corectly
by Zubair Ayub 11 Nov '16

11 Nov '16

my radacct table not working properly its not getting total online users some users are missing in radacct but they are online. thanks in advance regard zubair ayub

2 3

Elegant solution to per MAC Framed-IP-Address?
by Toby Walsh 11 Nov '16

11 Nov '16

I'm setting up my network to have a DHCP server with host reservations. I'm using EAP-Auth with PEAP-mschapv2 on each user's device, so they log in with a username and password and CA. I'm using mysql to back Freeradius and in the radreply table when I started configuring I had a username and Framed-IP-Address for my single test device. However, each user may connect with one of several devices, each with a different reserved IP. So I'd prefer to lookup the Framed-IP-Address with a MAC address instead despite using the regular username for authentication. Rather than reinvent the wheel myself, has anyone done this in a nice clean way and is willing to share their custom queries/config? Or can I just ignore the radreply table altogether and delete the Framed-IP-Address? Thanks, Toby

2 2

Re: Logging the debug output
by Brett Randall 11 Nov '16

11 Nov '16

> > Date: Wed, 9 Nov 2016 22:42:37 +0000 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > Subject: Re: Logging the debug output > > On Thu, Nov 10, 2016 at 09:35:06AM +1100, Brett Randall wrote: > > Is there a config setting that allows me to log the same output > > that that the debug mode produces to a file that I can then go > > through at a later stage? > > You can use radmin to select some or all debug output and give a file > for it to be written to. > > Matthew > Perfect, that did just what I needed. Thanks Matthew. Brett.

2 1

Ubiquiti AP Working with FreeRadius
by Jose Quezada 10 Nov '16

10 Nov '16

Hello Everybody, Good Day! I want to make an implementation with an Ubiquiti AP but I have noticed that it does not have VSAs (Dictionaries) ... Has any of you done it? How you did it? I want to Restrict User Session, Bandwidth and some rules like that... Thank you in advance

3 2

Unlang - Adding attribute NAS-Port-Id where response = Access-Accept
by Marcos Vinícius 10 Nov '16

10 Nov '16

Hello guys, I need to add attribute NAS-Port-Id and send this attribute with the same value of attribute UserName. I need to do this, because my accel-ppp needs attribute NAS-Port-Id to set the values of interfaces when client connect. I dont want to add this atrribute NAS-Port-Id in all users (mysql), i know if i do this, the problem is solved. But my freeradius operate together my ERP, and its terrible to contact the support and request this modification. I want to rewrite the Access-Accept adding NAS-Port-Id=UserName using UNLANG. I try to do this, but failed. Someone help me? Thanks :) *Att,* *Marcos Vinicius*

2 2

Two python modules
by Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) 10 Nov '16

10 Nov '16

Hello all, using source FR from github on SLES 12 SP1. I would like to use two python modules. Python with only one module is working fine. Now I just added "python two" and place the two.py into the same place as one.py but get following error message. Looks like for the second module the python path is not taken. I've tested with exported python path and integrated into the config file. Thu Nov 10 08:48:19 2016 : Info: Python version: 2.7.9 (default, Dec 21 2014, 11:02:59) [GCC] Thu Nov 10 08:48:19 2016 : Debug: # Instantiating module "two" from file /usr/local/etc/raddb/mods-enabled/python Thu Nov 10 08:48:19 2016 : Error: python_function_load - Module 'two' not found Thu Nov 10 08:48:19 2016 : Error: <type 'exceptions.SystemError'> (null argument to internal routine) Thu Nov 10 08:48:19 2016 : Error: python_function_load - Failed to import python function 'two.auth' Thu Nov 10 08:48:19 2016 : Error: /usr/local/etc/raddb/mods-enabled/python[20]: Instantiation failed for module "two" EXPORT -> declare -x PYTHONPATH="/usr/local/etc/raddb/mods-config/python:/usr/lib64/python2.7:/usr/lib64/python2.7/site-packages:/usr/lib64/python2.7/lib-dynload" python one{ # python_path="/usr/local/etc/raddb/mods-config/python/:/usr/lib64/python2.7/:/usr/lib64/python2.7/site-packages/:/usr/lib64/python2.7/lib-dynload/" module = one mod_authorize = ${.module} func_authorize = authorize mod_post_auth = ${.module} func_post_auth = post_auth } python two{ # python_path="/usr/local/etc/raddb/mods-config/python/:/usr/lib64/python2.7/:/usr/lib64/python2.7/site-packages/:/usr/lib64/python2.7/lib-dynload/" module = two mod_authorize = ${.module} func_authorize = auth } Hope someone could help me Thanks in advance! Best Regards, Paul

1 0

Logging the debug output
by Brett Randall 09 Nov '16

09 Nov '16

Hi all I have an ongoing issue with a FreeRADIUS third-party module that is very intermittent (only shows up at a random time each day). In the past, running FreeRADIUS in debug mode has been very helpful, but I don't like leaving it running from a command line indefinitely. Is there a config setting that allows me to log the same output that that the debug mode produces to a file that I can then go through at a later stage? I realise this will impact performance and consume space... Thanks Brett.

3 2