- Freeradius-Users - lists.freeradius.org

String expansion of attributes value from database
by Krzysztof Grobelak 13 Jul '16

13 Jul '16

Hello All, Is it possible to have similar functionality in a database stored reply item as with users file? in users file: user1 Cleartext-Password := “super_secret" Alc-Subsc-ID-Str := "%{Alc-Client-Hardware-Addr}", Alc-Subsc-Prof-Str := "sub_profile_1", Alc-SLA-Prof-Str := “sla_profile_1" The above works and the %{Alc-Client-Hardware-Addr} gets expanded to a correct mac address. However when the following is used in database: +----+----------------+--------------------+----+-------------------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+-------------------------------+ | 1 | profile_1 | Alc-Subsc-ID-Str | := | "%{Alc-Client-Hardware-Addr}" | | 2 | profile_1 | Alc-Subsc-Prof-Str | := | sub_profile_1 | | 3 | profile_1 | Alc-SLA-Prof-Str | := | sla_profile_1 | +----+----------------+--------------------+----+-------------------------------+ The value of Alc-Subsc-ID-Str attribute is returned as is, without expansion. The comments in the sql module say that the sql should mirror the users file in functionality so i’m assuming i’m missing something ;) Can you advice please? Regards, Kris

3 6

dhcp after wpa_supplicant auth on Unbuntu 16.04
by Alex Sharaz 13 Jul '16

13 Jul '16

Hi, Performing eap-tls on wired interface of an Ubuntu VM. Everything works o.k. and I'm in a vlan supporting IPv4 pooled addressing and SLACC IPv6. But interface IPv4 address is from before wpa_supplicant auth. Any easy way to delay dhpc request until after the wpa_auth operation? Rgds Alex

2 1

Swapping input and output octets
by Anuruddha Premalal 13 Jul '16

13 Jul '16

Hi All, One of the NAS in our network is reporting the accounting the wrong way (input and output octets are swapped). I'm trying to fix it by adding a logic similar to below at the start of the accounting section if( request:NAS-IP-Address == "192.168.1.7" && Acct-Status-Type != "Start"){ Temp-Attribute = &Acct-Input-Octets update request { Acct-Input-Octets := &Temp-Attribute Acct-Output-Octets := &Acct-Input-Octets } } I need to use a temporary variable to perform the data swapping. However I couldn't find a documentation of use of temporary variables or any such. Is there a better way to achieve this. How can a variable be used to store a value for a temporary reason without adding it to the request body. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 2

Fwd: i can`t allow all ipv4 home_server
by تعلم البرمجة 13 Jul '16

13 Jul '16

hello i want allow all ipv4 home server to control coa client 0.0.0.0/0 { secret=123123 coa_server= example_coa #working fine } home_server example_coa { type=coa ipaddr= * #allow all ip Not working secret=123123 ..... } sorry for my language english

2 1

i can`t allow all ipv4 home_server
by تعلم البرمجة 13 Jul '16

13 Jul '16

hello i want allow all ipv4 home server to control coa client 0.0.0.0/0 { secret=123123 coa_server= example_coa #working fine } home_server example_coa { type=coa ipaddr= * #allow all ip Not working secret=123123 ..... } sorry for my language english

2 1

(no subject)
by تعلم البرمجة 13 Jul '16

13 Jul '16

hello i want allow all ipv4 home server to control coa client 0.0.0.0/0 { secret=123123 coa_server= example_coa #working fine } home_server example_coa { type=coa ipaddr= * #allow all ip Not working secret=123123 ..... } sorry for my language english

1 0

FreeRadius logs into ELK server
by Alex Sharaz 12 Jul '16

12 Jul '16

Just been looking at configuring an ELK server for various stuff and was wondering if anyone had done any work in importing freeradius logs into one A

3 5

FreeRADIUS 3.0.1 [Proxy To Another Radius if Reject Received]
by Ibrahim Almahfooz 12 Jul '16

12 Jul '16

Hi Everybody, We are an ISP and we have two radius servers. Each is connected to a different Database for a purpose. One of our requirements is to tune the primary radius to proxy requests to the secondary in case those requests got rejected by the primary. Flow is as below: Request flow need to be Primary to Secondary (One-way ONLY) Requests are sent to the Primary Radius, then if: a- Access Accept - Okay b- Access Reject - Send same request to the secondary Radius. Would you be so kind and advise on the above setup? Is it doable and what are the possible methods to implement such? Kind regards, Ibrahim --

3 8

pam_radius - Choose Authentication Type
by tirili＠web.de 11 Jul '16

11 Jul '16

Hello list, is there a possibility to force authentication type for a specific NAS? Currently - when having pam_radius configured for SSHD logins there is "User-Password" sent in clear. How could MSCHAP being forced? e.g. from radtest mschap is working, and I get an Accept. radtest -t mschap -x aduser adpassword 192.168.0.123:21812 0 testing123 Sending Access-Request Id 83 from 0.0.0.0:58815 to 192.168.0.223:21812 User-Name = 'aduser' NAS-IP-Address = 192.168.0.238 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x30fb2004f73cbc0e MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000023532ec8407591c34 d2c080afae6edb888f822115566aabb Received Access-Accept Id 83 from 192.168.0.223:21812 to 192.168.0.238:58815 length 84 MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Using PAM_RADIUS trying to Login: rad_recv: Access-Request packet from host 192.168.0.238 port 41971, id=41, length=91 User-Name = "aduser" User-Password = "adpassword" NAS-IP-Address = 192.168.0.238 NAS-Identifier = "sshd" NAS-Port = 27766 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "localhost" Mon Jul 11 11:11:50 2016 : Info: +- entering group authorize {...} Mon Jul 11 11:11:50 2016 : Info: [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.238/detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.238/detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [detail] expand: %t -> Mon Jul 11 11:11:50 2016 Mon Jul 11 11:11:50 2016 : Info: ++[detail] returns ok Mon Jul 11 11:11:50 2016 : Info: [preprocess] hints: Matched DEFAULT at 35 Mon Jul 11 11:11:50 2016 : Info: [preprocess] expand: %{User-Name}(a)test.local -> aduser(a)test.local Mon Jul 11 11:11:50 2016 : Info: ++[preprocess] returns ok Mon Jul 11 11:11:50 2016 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.238/auth-detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.238/auth-detail-20160711 Mon Jul 11 11:11:50 2016 : Info: [auth_log] expand: %t -> Mon Jul 11 11:11:50 2016 Mon Jul 11 11:11:50 2016 : Info: ++[auth_log] returns ok Mon Jul 11 11:11:50 2016 : Info: ++[mschap] returns noop Mon Jul 11 11:11:50 2016 : Info: [suffix] Looking up realm "test.local" for User-Name = "aduser(a)test.local" Mon Jul 11 11:11:50 2016 : Info: [suffix] Found realm "test.local" Mon Jul 11 11:11:50 2016 : Info: [suffix] Adding Stripped-User-Name = "aduser" Mon Jul 11 11:11:50 2016 : Info: [suffix] Adding Realm = "test.local" Mon Jul 11 11:11:50 2016 : Info: [suffix] Authentication realm is LOCAL. Mon Jul 11 11:11:50 2016 : Info: ++[suffix] returns ok Mon Jul 11 11:11:50 2016 : Info: [eap] No EAP-Message, not doing EAP Mon Jul 11 11:11:50 2016 : Info: ++[eap] returns noop Mon Jul 11 11:11:50 2016 : Info: ++[unix] returns notfound Mon Jul 11 11:11:50 2016 : Info: ++[files] returns noop Mon Jul 11 11:11:50 2016 : Info: ++[expiration] returns noop Mon Jul 11 11:11:50 2016 : Info: ++[logintime] returns noop Mon Jul 11 11:11:50 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Jul 11 11:11:50 2016 : Info: ++[pap] returns noop Mon Jul 11 11:11:50 2016 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Mon Jul 11 11:11:50 2016 : Info: Failed to authenticate the user. Mon Jul 11 11:11:50 2016 : Auth: Login incorrect: [aduser(a)test.local] (from client bastionng port 27766 cli localhost) Mon Jul 11 11:11:50 2016 : Info: Using Post-Auth-Type Reject Mon Jul 11 11:11:50 2016 : Info: +- entering group REJECT {...} Mon Jul 11 11:11:50 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> aduser(a)test.local Mon Jul 11 11:11:50 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 11 11:11:50 2016 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 11 11:11:50 2016 : Info: Delaying reject of request 0 for 1 seconds Mon Jul 11 11:11:50 2016 : Debug: Going to the next request Mon Jul 11 11:11:50 2016 : Debug: Waking up in 0.9 seconds. Mon Jul 11 11:11:51 2016 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 41 to 192.168.0.238 port 41971 Mon Jul 11 11:11:51 2016 : Debug: Waking up in 4.9 seconds. Any help is appreciated. Thomas

3 2

Re: using SSL certs with EAP-TLS
by Wouter 11 Jul '16

11 Jul '16

>>> Again, all is working, but I'd like to get rid of the warning! Any >>> help? I also sent Matthieu an email offlist. After reading http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/iOS-quot-no… and https://discussions.apple.com/thread/5967450 I'm beginning to think: it can't be done, no warning on iOS. One will always get a certificate not verified warning upon the first connect in iOS. iOS's brother OS X is not complaining.

2 1