- Freeradius-Users - lists.freeradius.org

v3.0.10: how to specify allowed SSID list in users file?
by "František Hanzlík" 14 Nov '16

14 Nov '16

I want authenticate WiFi users on freeradius-3.0.10. AP provides several SSIDs and I want certain users to be able connect just to certain SSIDs. Users are few, and I want for AAA use files module. My idea is use notation something like this (in users file mods-config/files/authorize): tom Cleartext-Password := "to", Wifi-Allowed = "SSID1,SSID2" pepa Cleartext-Password := "pp", Wifi-Allowed = "SSID1" petr Cleartext-Password := "pe", Wifi-Allowed = "SSID3" and then test it in default server "authorize" section somewhere after "files" module specification with unlang code something as: switch &Called-Station-SSID { case "SSID1" { if (&control:Wifi-Allowed =~ /.*SSID1.*/ ) { ok } else { reject } } case "SSID2" { if (&control:Wifi-Allowed =~ /.*SSID2.*/ ) { ok } else { reject } } } Called-Station-SSID I've filled by calling rewrite_called_station_id at beginnig of the "authorize" section (just after "filter_username"), this part seems be fine. Unfortunately, all my attempts ends unsuccessfully, mostly with syntax error in 'users' file, or at run at 'if (&control:Wifi-Allowed ...' with error "ERROR: Failed retrieving values required to evaluate condition ". Attribute "Wifi-Allowed" i tried declare in %{raddb}/dictionary or %{raddb}/dictionary.local, both without success. Is it even possible to carry out this way? What should be the correct procedure? I also tried another way, where I had additional file in form: SSID1:user1,user3,user4 SSID2:user1 SSID3:user2 and parse it with slightly modified etc_group module and then check with similar unlang code as above - and it work fine; but as a disadvantage there must be two configuraton files. I would have been happier if it was possible to have a user, its password (or certificate - it's also possible?), and him allowed SSID in one (perhaps "users") file. TIA, Franta

3 2

Freeradius and Unifi Vlan
by Gabriel Ozaki 14 Nov '16

14 Nov '16

Hi Im trying to use freeradius to assign the VLAN of a connection using the unifi AP, like in this page: https://help.ubnt.com/hc/en-us/articles/219654087-UniFi-Using-VLANs-with-Un… My server is a Debian jessie fresh install with Freeradius 3.0.12(compiled from source, using defaults) and unifi controler 5.3.5(beta version, but i see some guys using radius+vlan using a cisco solution) My AP is a UniFi AP-AC-Lite firmware 3.7.24.5422 My users file(the default file and i add in the end): kemi Cleartext-Password := "1q2w3e4r" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 3 My clients.conf client private-network-1 { ipaddr = 192.168.3.0/24 secret = testing123 } In radiusd.conf i only change line 510: allow_vulnerable_openssl = 'CVE-2016-6304' The radiusd -X when i use radtest(i attatch the full log) (0) Login OK: [kemi/1q2w3e4r] (from client private-network-1 port 0) (0) Sent Access-Accept Id 130 from 192.168.3.1:1812 to 192.168.3.1:56590 length 0 (0) Tunnel-Type = VLAN (0) Tunnel-Medium-Type = IEEE-802 (0) Tunnel-Private-Group-Id = "3" (0) Finished request The radiusd -X when i use the AP: (9) post-auth { ... } # empty sub-section is ignored (9) Login OK: [kemi/<via Auth-Type = eap>] (from client private-network-1 port 0 via TLS tunnel) (9) } # server inner-tunnel (9) Virtual server sending reply (9) Tunnel-Type = VLAN (9) Tunnel-Medium-Type = IEEE-802 (9) Tunnel-Private-Group-Id = "3" (9) MS-MPPE-Encryption-Policy = Encryption-Required (9) MS-MPPE-Encryption-Types = 4 (9) MS-MPPE-Send-Key = 0x5cbfff77aff0148b908c8cec2efaae2c (9) MS-MPPE-Recv-Key = 0xd4ad8206c448c3530a1e547ee91f173c (9) EAP-Message = 0x03030004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "kemi" (9) eap_ttls: Got tunneled Access-Accept (9) eap_ttls: No information to cache: session caching will be disabled for session 4487edec31086c9129e937fada901fbda23ba4600dd0d7e67f0c5e1a843ba264 (9) eap: Sending EAP Success (code 3) ID 58 length 4 But unifi still using vlan 1, is possible the unifi is not receiving the Tunnel information? Thanks

5 13

Freeradius DHCP - strange behavior
by kjonca＠o2.pl 14 Nov '16

14 Nov '16

I try to migrate from isc-dhcp and I have strange behaviour: --8<---------------cut here---------------start------------->8--- Debug: Server core libs: Debug: freeradius-server : 3.0.12 Debug: talloc : 2.0.* Debug: ssl : 1.1.0c release Debug: pcre : 8.39 2016-06-14 --8<---------------cut here---------------end--------------->8--- (packaged by dabian) /etc/freeradius/3.0/sites-available/dhcp (excerpt) --8<---------------cut here---------------start------------->8--- listen { type = dhcp ipaddr = 0.0.0.0 src_ipaddr = 192.168.200.200 port = 6700 interface = lan broadcast = yes } --8<---------------cut here---------------end--------------->8--- with this configuration --8<---------------cut here---------------start------------->8--- sudo /sbin/dhclient -p 6701 -d -v wlan0 --8<---------------cut here---------------end--------------->8--- works as expected. but when I try to change port to 67 it stop respond to broadcast queries :( ie. --8<---------------cut here---------------start------------->8--- sudo /sbin/dhclient -d -s 192.168.200.200 -v wlan0 --8<---------------cut here---------------end--------------->8--- works, while: --8<---------------cut here---------------start------------->8--- sudo /sbin/dhclient -d -v wlan0 --8<---------------cut here---------------end--------------->8--- not. dhclient and freeradius were run on different boxes with router between them. i tried with different "ipaddr" option (0.0.0.0 , 255.255.255.255 , 192.168.200.200) but without success. I realize, that it is not neccessarily freeradius fault, but I have no idea what should I check. KJ -- http://wolnelektury.pl/wesprzyj/teraz/ To find a friend one must close one eye; to keep him -- two. -- Norman Douglas

3 4

Re: Ubiquiti AP Working with FreeRadius (David Teston)
by Jose Quezada 14 Nov '16

14 Nov '16

>Hello, >I am currently using Ubiquiti Unifi APs, but I don't use a Ubiquiti dictionary. You can restrict bandwidth using the Ubiquiti Cloud Controller. You can run the Controller on the same server as FreeRadius (which is what I do), or you can run it on any desktop OS. The Controller doesn't always have to be running, but it's much easier to use/debug when it's on a server. >I highly suggest using the Controller because the interface is comprehensive and intuitive. Please feel free to ask me any questions about my setup. If people want the full configuration posted, I'll be glad to do that too. >David Thanks a lot Sr David And if it is the case that I have to limit users by sessions and by bandwidth depending on who the user is. Could cloud controller help me with that? I think not. For that reason i want to know if I'd do with some moduls or something like that in radius. Although I have to create them. Thanks David, Jose Quezada

1 0

password-less keys for TLS
by Matt Zagrabelny 11 Nov '16

11 Nov '16

Hello, I am wondering what folks think about password-less keys for TLS? Both the server key - and the client key under EAP-TLS. The password for the server key is on disk in a config file, so a password encrypted key seems just about as safe as a password-less key. The client keys are bit more vulnerable when they aren't encrypted, but I thought I would ask the list if anyone is rolling client certs without passwords. Thanks for any feedback! -m

2 1

Matching a prefix in huntgroups file
by Brian Candler 11 Nov '16

11 Nov '16

What is the way to match a range of IPs in the preprocess huntgroups file? This is with freeradius 3.0.12. Unfortunately, the sample huntgroups file doesn't show any example of matching a range. Here's what I've tried: network NAS-IP-Address =~ ^10\.254\. network NAS-IP-Address =~ "^10\.254\." network NAS-IP-Address =~ "10\.254\..*" network NAS-IP-Address =~ /^10\.254\./ Those all don't match: (0) if (&Huntgroup-Name == "network") { (0) ERROR: Failed retrieving values required to evaluate condition network NAS-IP-Address == 10.254.0.0/16 gives a parse error: /etc/raddb/mods-config/preprocess/huntgroups[5]: Parse error (check) for entry network: Invalid IPv4 mask length "/16". Only "/32" permitted for non-prefix types network 10.254.0.0/16 == NAS-IP-Address gives a different parse error: /etc/raddb/mods-config/preprocess/huntgroups[5]: Parse error (check) for entry network: Invalid vendor name in attribute name "10.254.0.0/16" I know *something* is happening with the regexps, because I can get a compilation error if I make it invalid: network NAS-IP-Address =~ ^10\.254\ /etc/raddb/mods-config/preprocess/huntgroups[5]: Parse error (check) for entry network: Error at offset 9 compiling regex for NAS-IP-Address: Pattern compilation failed: \ at end of pattern But it won't match the supplied NAS-IP-Address. I have no problem with a simple == condition matching a single IP address though. Any clues? Thanks, Brian.

7 30

radacct table not working corectly
by Zubair Ayub 11 Nov '16

11 Nov '16

my radacct table not working properly its not getting total online users some users are missing in radacct but they are online. thanks in advance regard zubair ayub

2 3

Elegant solution to per MAC Framed-IP-Address?
by Toby Walsh 11 Nov '16

11 Nov '16

I'm setting up my network to have a DHCP server with host reservations. I'm using EAP-Auth with PEAP-mschapv2 on each user's device, so they log in with a username and password and CA. I'm using mysql to back Freeradius and in the radreply table when I started configuring I had a username and Framed-IP-Address for my single test device. However, each user may connect with one of several devices, each with a different reserved IP. So I'd prefer to lookup the Framed-IP-Address with a MAC address instead despite using the regular username for authentication. Rather than reinvent the wheel myself, has anyone done this in a nice clean way and is willing to share their custom queries/config? Or can I just ignore the radreply table altogether and delete the Framed-IP-Address? Thanks, Toby

2 2

Re: Logging the debug output
by Brett Randall 11 Nov '16

11 Nov '16

> > Date: Wed, 9 Nov 2016 22:42:37 +0000 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > Subject: Re: Logging the debug output > > On Thu, Nov 10, 2016 at 09:35:06AM +1100, Brett Randall wrote: > > Is there a config setting that allows me to log the same output > > that that the debug mode produces to a file that I can then go > > through at a later stage? > > You can use radmin to select some or all debug output and give a file > for it to be written to. > > Matthew > Perfect, that did just what I needed. Thanks Matthew. Brett.

2 1

Ubiquiti AP Working with FreeRadius
by Jose Quezada 10 Nov '16

10 Nov '16

Hello Everybody, Good Day! I want to make an implementation with an Ubiquiti AP but I have noticed that it does not have VSAs (Dictionaries) ... Has any of you done it? How you did it? I want to Restrict User Session, Bandwidth and some rules like that... Thank you in advance

3 2