- Freeradius-Users - lists.freeradius.org

Support for EAP-AKA in free radius
by manjunath uthappa ponnachana 27 Mar '16

27 Mar '16

Hi, Wanted to know whether free radius support EAP-AKA.Heard there is some patch available for EAP-AKA in free radius.Please let me know  the link/source from where this patch can be downloaded.It will be helpful, if somebody can send the steps for configuring free radius with EAP-AKA. Thanks & regardsManjunath

1 0

FR V3 returns no attribute Cisco-AVPAir, Framed-IP-Adress
by Stephane Branchoux 26 Mar '16

26 Mar '16

Hello, I would like to upgrade my FR V2 to V3. I installed a new FR V3 and just modified /etc/raddb/sites-available/default file to test ldap connectivity I read docs, man pages, wiki ... # diff /etc/raddb/sites-available/default /etc/raddb/sites-available/default.orig 382,389c382 < #-ldap < ldap < if ((ok || updated) && User-Password) { < update { < control:Auth-Type := ldap < } < } < --- > -ldap 495,497c488,490 < Auth-Type LDAP { < ldap < } --- > # Auth-Type LDAP { > # ldap > # } 671c664 < #cui --- > # cui 677c670 < reply_log --- > # reply_log 695c688 < ldap --- > # ldap diff /etc/raddb/mods-available/ldap.orig /etc/raddb/mods-available/ldap 12c12,13 < server = "ldap.rrdns.example.org ldap.rrdns.example.org ldap.example.org" --- > # server = "ldap.rrdns.example.org ldap.rrdns.example.org ldap.example.org" > server = "ldapmaster.univ-perp.fr ldapmaster1.univ-perp.fr" 20a22,24 > # > identity = "cn=Manager,dc=univ-perp,dc=fr" > password = ZZZZZ 24a29 > base_dn = "dc=univ-perp,dc=fr" 74,78c79,83 < # control:NT-Password := 'ntPassword' < # reply:Reply-Message := 'radiusReplyMessage' < # reply:Tunnel-Type := 'radiusTunnelType' < # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' < # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' --- > control:NT-Password := 'ntPassword' > reply:Reply-Message := 'radiusReplyMessage' > reply:Tunnel-Type := 'radiusTunnelType' > reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' > reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' 84,85c89,90 < # control: += 'radiusCheckAttributes' < # reply: += 'radiusReplyAttributes' --- > #control: += 'radiusCheckAttributes' > #reply: += 'radiusReplyAttributes' 95c100 < # edir_autz = no --- > edir_autz = no 117c122,124 < filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" --- > #filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}}) (mail=%{%{Stripped-User-Name}:-%{User-Name}}))" > #filter = "(|(uid=%{Stripped-User-Name:-%{User-Name}}) (mail=%{Stripped-User-Name:-%{User-Name}}))" 125c132 < # access_attribute = "dialupAccess" --- > # access_attribute = "dialupAccess" 181c188,189 < membership_attribute = "memberOf" --- > #membership_attribute = "memberOf" > membership_attribute = "eduPersonPrimaryAffiliation" Authentication again LDAP in ok : radtest -x stephane xxxxxxxxx localhost 10 testing123 Sending Access-Request Id 157 from 0.0.0.0:41822 to 127.0.0.1:1812 User-Name = 'YYYYYYYY' User-Password = 'XXXXXXX' NAS-IP-Address = 194.167.137.68 NAS-Port = 10 Message-Authenticator = 0x00 Received Access-Accept Id 157 from 127.0.0.1:1812 to 127.0.0.1:41822 length 20 debug is : Received Access-Request Id 247 from 127.0.0.1:41643 to 127.0.0.1:1812 length 78 User-Name = 'stephane' User-Password = 'sssssssssssss' NAS-IP-Address = 194.167.137.xx NAS-Port = 10 Message-Authenticator = 0x32e138a8b8b22a81acf0e74bd6e8cd13 (0) Received Access-Request packet from host 127.0.0.1 port 41643, id=247, length=78 (0) User-Name = 'stephane' (0) User-Password = 'YYYYYYYYYYYY' (0) NAS-IP-Address = 194.167.137.xx (0) NAS-Port = 10 (0) Message-Authenticator = 0x32e138a8b8b22a81acf0e74bd6e8cd13 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "stephane", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap : EXPAND (|(uid=%{%{Stripped-User-Name}:-%{User-Name}}) (mail=%{%{Stripped-User-Name}:-%{User-Name}})) (0) ldap : --> (|(uid=stephane) (mail=stephane)) (0) ldap : EXPAND dc=univ-perp,dc=fr (0) ldap : --> dc=univ-perp,dc=fr (0) ldap : Performing search in 'dc=univ-perp,dc=fr' with filter '(|(uid=stephane) (mail=stephane))', scope 'sub' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Processing user attributes (0) ldap : control:Password-With-Header += '{SSHA}UUUUUUUUUJ' rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) if ((ok || updated) && User-Password) (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap : Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (0) WARNING: pap : Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type LDAP { (0) ldap : Login attempt by "stephane" rlm_ldap (ldap): Reserved connection (4) (0) ldap : Using user DN from request "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Waiting for bind result... (0) ldap : Bind successful (0) ldap : Bind as user "uid=stephane,ou=people,dc=univ-perp,dc=fr" was successful rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) reply_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log : --> /var/log/radius/radacct/127.0.0.1/reply-detail-20160323 (0) reply_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20160323 (0) reply_log : EXPAND %t (0) reply_log : --> Wed Mar 23 14:48:32 2016 (0) [reply_log] = ok (0) ldap : EXPAND . (0) ldap : --> . (0) ldap : EXPAND Authenticated at %S (0) ldap : --> Authenticated at 2016-03-23 14:48:32 rlm_ldap (ldap): Reserved connection (4) (0) ldap : Using user DN from request "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Waiting for bind result... (0) ldap : Bind successful (0) ldap : Modifying object with DN "uid=stephane,ou=people,dc=univ-perp,dc=fr" (0) ldap : Waiting for modify result... rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [exec] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sending Access-Accept packet to host 127.0.0.1 port 41643, id=247, length=0 Sending Access-Accept Id 247 from 127.0.0.1:1812 to 127.0.0.1:41643 (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. The problem is that FR returns access-accept but no ldap attributes Cisco-AVPAir, Framed-IP-Adress .... Where is my mistake ? Many thanks in advance The same radtest on my FR V2 returns : rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=172, length=86 Framed-IP-Address = 10.100.0.254 Cisco-AVPair = "shell:priv-lvl=15" Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "5" Service-Type = Login-User Brocade-Auth-Role = "admin" -- stephane BRANCHOUX Centre de Ressources Informatiques de l'Université de Perpignan. Systèmes/Réseaux - RSSI mailto:stephane.branchoux@univ-perp.fr 04 68 66 21 24 / 07 60 73 38 42

3 3

Re: about simultaneous & wispr-bandwidth
by Anirudh Malhotra 26 Mar '16

26 Mar '16

Use both attributes in one group simultaneous use and bandwidth dont use two different groups. At once only one group will be used. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in On 27 Mar 2016, 00:35 +0530, Serkan Kasap<s.kasap(a)turquoise.com.tr>, wrote: > Hi, > > Today i saw a problem and need yours help. > > i am using simultaneous use option and wispr-bandwith up&down. > > İf i use two options for one user first attribute working second not > working. > > For example user name: cat simultaneuse : 1 bandwith up:500 bandwith > down:500 > > i need to use them together. İ thing i am making some mistakes. > > > > İf i use just simultaneous or bandwith it's working but with together not > working. > > > > > > Radusergroup table > > "username" "groupname" "priority" > > "cat" "speed_512" "1" > > "cat" "user_limit_1" "1" > > > > Radgroupreply table > > "id" "groupname" "attribute" "op" "value" > > "19" "speed_512" "WISPr-Bandwidth-Max-Up" "==" "504800" > > "20" "speed_512" "WISPr-Bandwidth-Max-Down" "==" > "504800" > > > > Radgroupcheck table > > "id" "groupname" "attribute" "op" "value" > > "3" " user_limit_1" "Simultaneous-Use" ":=" "1" > > > > > > > > Thanks. > > > > serkan > > > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

about simultaneous & wispr-bandwidth
by Serkan Kasap 26 Mar '16

26 Mar '16

Hi, Today i saw a problem and need yours help. i am using simultaneous use option and wispr-bandwith up&down. İf i use two options for one user first attribute working second not working. For example user name: cat simultaneuse : 1 bandwith up:500 bandwith down:500 i need to use them together. İ thing i am making some mistakes. İf i use just simultaneous or bandwith it's working but with together not working. Radusergroup table "username" "groupname" "priority" "cat" "speed_512" "1" "cat" "user_limit_1" "1" Radgroupreply table "id" "groupname" "attribute" "op" "value" "19" "speed_512" "WISPr-Bandwidth-Max-Up" "==" "504800" "20" "speed_512" "WISPr-Bandwidth-Max-Down" "==" "504800" Radgroupcheck table "id" "groupname" "attribute" "op" "value" "3" " user_limit_1" "Simultaneous-Use" ":=" "1" Thanks. serkan

1 0

Debian 8 prevents the NAS to generate data volume accounting
by oatech 26 Mar '16

26 Mar '16

Something strange is happening : While the Windows 10 client does have a valid accounting stop message generated, with proper data accounting values ( Acct-Input-Packets, Acct-Output-Packets, Acct-Input-Octets, Acct-Output-Octets), the Debian 8 client always have 0 in each of these fields. Ex : sudo cat /var/log/freeradius/radacct/192.168.1.2/detail-20160324 | grep Acct-Input-Octets Acct-Input-Octets = 43976 Acct-Input-Octets = 845 Acct-Input-Octets = 394240 Acct-Input-Octets = 0 Acct-Input-Octets = 371260 Acct-Input-Octets = 0 ( Here, Windows 10 gets proper values recorded, Debian 8 always gets 0 ) Does anybody understand what may cause Debian 8 to prevent data accounting ? I'm using a very standard Freeradius/MySQL setup ... Clients : Windows 10 / Debian 8 NAS : Cisco SB WAP121 RADIUS Server : Debian 8 / FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, Authentication : PEAP/MSCHAPv2 --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

3 4

FR with Mikrotik - FUP Quota Bandwidth not changing auto
by AACABLE / Mikrotik System 26 Mar '16

26 Mar '16

Greetings, I have FR 2.x with Mikrotik 6.x. I want that when user quota limit end, his bandwidth package should change from 1mb to 512k. I have made counter and its working as expected. The only issue is that the changes are not being done on the fly. Changes applies only when user disconnects, and re-login. Same thing happens for users whose monthly quota limit finish but they are keep connected and gets denied only on re-login. When I issue following command it works fine. (for the bandwidth COA and POD) echo User-Name := "zaib", Mikrotik-Rate-Limit = 512k/512k | radclient -x 101.11.11.255:1700 coa 12345 [Mikrotik accepts this command and change the bandwidth on the fly] echo user-name=zaib | radclient -x 101.11.11.255:1700 disconnect 12345 [Mikrotik accepts this command and disconnects the user as instructed] How can I do this on the fly using FR? I know its the job of NAS but NAS will act only when FR will tell him to do so. Kindly assist. *SQL *Counter: *=============* counter-name = Mikrotik-Total-Limit check-name = Mikrotik-Total-Limit reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctInputOctets)+SUM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k}'" } *=============* *AUTHORIZE *Section: dailyquota { reject = 1 } if (reject) { ok update reply { Mikrotik-Rate-Limit := "512k/512k" Reply-Message := "You have reached your daily 300MB transfer limit. Enforcing 512k FUP Policy - zaib " } } *=============* -- Regard's JAY-Z

2 11

Freeradius/LDAP Authentication issue
by Benjamin Dupalut 25 Mar '16

25 Mar '16

Hi, First of all, sorry for my bad english. I have installed Freeradius (Version: 2.2.5+dfsg-0.2) on Debian 8.3 to authenticate users via our LDAP. I face an issue when i perform this radtest : /radtest toto "totopassword" 127.0.0.1 18120 "clientpassword"/ Here is the freeradius -X debug : rad_recv: Access-Request packet from host 127.0.0.1 port 44928, id=111, length=48 Sending duplicate reply to client localhost port 44928 - ID: 111 Sending Access-Reject of id 111 to 127.0.0.1 port 44928 Waking up in 2.9 seconds. Cleaning up request 2 ID 111 with timestamp +114 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44928, id=111, length=48 User-Name = "toto" User-Password = "Ғ\325\354R\010\r\035\303b\230Fo8đ" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[mschap] = noop [suffix] No '@' in User-Name = "toto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop ++group { [ldap_1] performing user authorization for toto [ldap_1] expand: %{Stripped-User-Name} -> [ldap_1] ... expanding second conditional [ldap_1] expand: %{User-Name} -> toto [ldap_1] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=toto) [ldap_1] expand: ou=Users,dc=XXXX,dc=fr -> ou=Users,dc=XXXX,dc=fr [ldap_1] ldap_get_conn: Checking Id: 0 [ldap_1] ldap_get_conn: Got Id: 0 [ldap_1] performing search in ou=Users,dc=XXXX,dc=fr, with filter (uid=toto) [ldap_1] checking if remote access for toto is allowed by uid [ldap_1] No default NMAS login sequence [ldap_1] looking for check items in directory... [ldap_1] sambaNtPassword -> NT-Password == 0x3344424445363937443731363930413736393230344245423132323833363738 [ldap_1] sambaLmPassword -> LM-Password == 0x4343463931353545334537444234353341414433423433354235313430344545 [ldap_1] userPassword -> Cleartext-Password == "{MD5}ICy5YqxZB1uWSwcVLSNLcA==" [ldap_1] userPassword -> Password-With-Header == "{MD5}ICy5YqxZB1uWSwcVLSNLcA==" [ldap_1] sambaNtPassword -> NT-Password == 0x3344424445363937443731363930413736393230344245423132323833363738 [ldap_1] sambaLmPassword -> LM-Password == 0x4343463931353545334537444234353341414433423433354235313430344545 [ldap_1] looking for reply items in directory... [ldap_1] user toto authorized to use remote access [ldap_1] ldap_release_conn: Release Id: 0 +++[ldap_1] = ok ++} # group = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! } # server inner-tunnel Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> toto attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 111 to 127.0.0.1 port 44928 Waking up in 4.9 seconds. Cleaning up request 3 ID 111 with timestamp +120 Ready to process requests. The user and client passwords are correct and i don't understand the following errors : WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Thank you for your replies. Cordialement, - - Benjamin Dupalut Administrateur système et réseau Service des Moyens Informatiques Généraux (SMIG) ESIEE Paris 2 bd Blaise Pascal - 93162 Noisy-le-Grand Cedex T : +33 1 45 92 66 17 benjamin.dupalut(a)esiee.fr www.esiee.fr / www.cci-paris-idf.fr

7 17

LDAP Authentication.
by scatmanwalks 24 Mar '16

24 Mar '16

Hi, I have LDAP authentication working fine, checked and tested. Incurred a little problem when integrating with the device, because of EAP, but now using two-stage with inner-tunnel to get around this. Now, all that I'm left with, is how to filter out the users. I have two filters that I want to use from OpenLDAP. They are as follows: accountStatus enabledService I want it to check these two variables, and based on the results to accept or reject the users. So, firstly, if accountStatus = active, the user will be accepted. The second variable enabledService = wifi, if this also matches, it means they are allowed to use the WIFI network. I already have the default filter: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" so not sure if I just need to edit this appropriately, or another way? Regards Ian

3 3

Re: debug User-Profile
by MichaelLeung 24 Mar '16

24 Mar '16

i find this in wiki.freeradius.org LDAP ATTRIBUTES In version 2, the mapping between RADIUS attributes <http://wiki.freeradius.org/protocol/Attributes> and LDAP <http://wiki.freeradius.org/protocol/LDAP> attributes is in raddb/ldap.attrmap. You can edit that file and add any new mapping that you may need. The LDAP-schema file is located in doc/RADIUS-LDAPv3.schema. Before adding any radius attributes the ldap server schema should be updated. All ldap entries containing radius attributes should contain at least "objectclass: radiusprofile" radiusCheckItem and radiusReplyItem are special. They allow the administrator to add any check or reply item respectively without adding it in the ldap schema. The format should be: ldap-attribute: radius-attribute operator value The version 3 attribute mapping is in the module configuration file |raddb/mods-available/ldap| For Example: radiusReplyItem: Cisco-AVPair := "ip:addr-pool=dialin_pool" but i dont understand , if we mapping the radius attr and ldap attr, then give it a values , why do we stored the replyitem in LDAP. On 03/18/2016 01:46 PM, MichaelLeung wrote: > does freeradius 3.0.4 still have ldap.attrmap ? > > On 03/18/2016 12:46 PM, MichaelLeung wrote: >> how can i get radiusReplyItem from LDAP? >> >> On 03/18/2016 09:25 AM, MichaelLeung wrote: >>> any help ? >>> >>> On 03/17/2016 05:31 PM, MichaelLeung wrote: >>>> any reply ? >>>> >>>> On 03/17/2016 03:20 PM, MichaelLeung wrote: >>>>> well , i define a ldap-group check policy >>>>> >>>>> # >>>>> devicemanager_check { >>>>> if (Ldap-Group == "DeviceManager") { >>>>> update reply { >>>>> &User-Profile := >>>>> "cn=DeviceManager,ou=Admin,ou=Group,dc=gd,dc=quantum-info,dc=com" >>>>> } >>>>> } >>>>> elsif (Ldap-Group == "Device_Write") { >>>>> update reply { >>>>> &Reply-Message += "Welcome,Device Operator" >>>>> } >>>>> } >>>>> elsif (Ldap-Group == "Device_Reivew") { >>>>> update reply { >>>>> &Reply-Message += "Welcome Device Reviewer" >>>>> } >>>>> } >>>>> else { >>>>> update reply { >>>>> &Reply-Message += "you are not authorized >>>>> to access , please confirm that you have the permission..." >>>>> } >>>>> reject >>>>> } >>>>> } >>>>> >>>>> i am not sure that user override the User-Profile or not. >>>>> >>>>> >>>>> On 03/17/2016 10:56 AM, MichaelLeung wrote: >>>>>> hi list >>>>>> >>>>>> my freeradius version is 3.0.4 >>>>>> >>>>>> i have enabled ldap modules and the radius profile feature of it . >>>>>> >>>>>> and i need to check the user is in the speacific Ldap-Group, and >>>>>> assign the User-Profile which contain all radius Reply-Items in it . >>>>>> so when my NAS try to authenticate , i can only see radius -X >>>>>> responding : >>>>>> (0) Sending Access-Accept packet to host 10.1.1.13 port 1812, >>>>>> id=96, length=0 >>>>>> (0) User-Profile := >>>>>> 'cn=Device_Superior,ou=Admin,ou=Group,dc=gd,dc=abc,dc=com' >>>>>> it was not going to print out what reply item the User-Profile >>>>>> contained. >>>>>> and actually, i define the reply item as >>>>>> Huawei-Exec-Privilege := "15" >>>>>> it will give the highest admin right to the user belong to Group >>>>>> Device_Superior to Operate the Device . >>>>>> >>>>>> how can i debug the User-Profile? >>>>> >>>> >>> >> >

2 5

Upgrade 2.1 to 2.2 and EAP-TLS Problem
by Oliver Werner 23 Mar '16

23 Mar '16

Hi, i will test upgrade my Freeradius 2.1.12 (Debian Wheezy) to 2.2.5 (Debian Jessie). So my configured sites for MAC authentication and sql module look like working right now. But also i have configured a eap-tls site where i can’t auth anymore. my eap.conf: eap eapcert { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 tls { certdir = ${confdir}/certs cadir = ${certdir}/ca CA_file = ${cadir}/cacert.crt # Freeradius01 private_key_password = <secret> private_key_file = ${certdir}/Freeradius.pem certificate_file = ${certdir}/Freeradius.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} cipher_list = "DEFAULT" check_crl = yes crl_file = ${cadir}/cacrl.pem CA_path = ${cadir} rsa_key_length = 1024 rsa_key_exchange = yes virtual_server = "kontrast" cache { enable = no lifetime = 24h max_entries = 255 } verify { } } } and my sites-enabled/kontrast look: server kontrast { listen { ipaddr = * port = 1810 type = auth virtual_server = kontrast } authorize { eapcert { ok = return } } authenticate { eapcert } post-auth{ } } in version 2.2 i got an error here: +group authorize { [eapcert] EAP packet type response id 241 length 6 [eapcert] No EAP Start, assuming it's an on-going EAP conversation ++[eapcert] = updated +} # group authorize = updated Found Auth-Type = eapcert # Executing group from file /etc/freeradius/sites-enabled/kontrast +group authenticate { rlm_eap: No EAP session matching the State variable. [eapcert] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eapcert] Failed in handler ++[eapcert] = invalid +} # group authenticate = invalid Failed to authenticate the user. [tls] } # server kontrast [tls] Certifictes were rejected by the virtual server [eapcert] Handler failed in EAP/tls [eapcert] Failed in EAP select ++[eapcert] = invalid +} # group authenticate = invalid Failed to authenticate the user. } # server kontrast Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 4 to 192.168.10.167 port 39133 EAP-Message = 0x04f10004 Message-Authenticator = 0x0 anyone has an idea? kind regards OLIVER WERNER System-Administrator Kontrast Communication Services GmbH Grafenberger Allee 100, 40237 Düsseldorf, Germany Fon +49-211-91505-500 Fax +49-211-91505-530 www.kontrast.de <http://www.kontrast.de/> Amtsgericht Düsseldorf: HRB 26934 Geschäftsführer: Joachim Fischer, Anja Grote-Lutter, Leontine van der Vlist <https://www.facebook.com/kontrast.communication> <https://twitter.com/KONTRAST_de> <http://www.xing.com/companies/kontrastcommunicationservicesgmbh> <http://www.linkedin.com/company/kontrast-communication-services-gmbh> <https://vimeo.com/kontrastcs> <http://instagram.com/kontrast_de>

4 6