- Freeradius-Users - lists.freeradius.org

FR + Active Directory + Dynamic VLAN
by Andrés Gómez 24 Jun '15

24 Jun '15

Hi everybody. I need to try the Radius authentication against an Active Directory server, I found this guide where is used FR to authenticate LAN hosts, and control the switch ports: http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… But, is it possible to use FR in a WLAN and assign a D-VLAN to a NAS? It is a guide? Regards, -- *C. Andrés Gómez R.*

1 0

CallingStation ID
by Andrés Gómez 24 Jun '15

24 Jun '15

Hi everybody!! I'm trying to do a web based authentication and a MAC auth with the same NAS, so I plan to take the data in the table raddacct (calingstationid) in the first login of each user, to create a new user in the radcheck table for the MAC auth in the next sessions of the same user. Example. User1 -> web based auth -> radacct data -> callingstationid (MAC) taking callingstationid -> radcheck username I made it manually and it works, but I have an issue. The CallingStationID is written in this way: 90-4E-2B-61-BF-E3 But, the MAC auth request is arriving in this way: 904e2b61bfe3 So If I copy the callingstationid from raddacct table, to the radcheck table, the MAC auth won't work; because the formats of data are differents. How can I modify the calling station ID that will be written in the radacct table? I have read that there are some ulang lines in the policy.conf file, but I don't understand how to use them. Regards, -- *C. Andrés Gómez R.*

2 2

Attribute IP addresses to users while authenticating against external server
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "*/etc/freeradius/users*" contains the following: *DEFAULT Auth-type := perl* The linotp module configuration is as follows: ################## authorize { preprocess IPASS suffix ntdomain files expiration logintime pap } #here the linotp perl module is called for further processing authenticate { perl } accounting { detail unix radutmp exec attr_filter.accounting_response } *##################*I need to know how can I provide IP addresses to connecting users using the "*Frame-IP-Address*" attribute while still autheticating against the external server?? Thanks for your help! Hatim

2 1

Attribute IP addresses to users while authenticating against external server!
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I'm running freeradius version 2.1.12. I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "/etc/freeradius/users" contains the following: DEFAULT Auth-type := perl The linotp module configuration is as follows: ################## authorize { preprocess IPASS suffix ntdomain files expiration logintime pap } #here the linotp perl module is called for further processing authenticate { perl } accounting { detail unix radutmp exec attr_filter.accounting_response } ################## I need to know how can I provide IP addresses to connecting users using the "*Frame-IP-Address*" attribute while still autheticating against the external server?? Thanks for your help! Hatim

1 0

Attribute IP addresses to users while authenticating against external server
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "*/etc/freeradius/users*" contains the following: *DEFAULT Auth-type := perl* The linotp module configuration is as follows: *authorize { preprocess IPASS suffix ntdomain files expiration logintime pap}#here the linotp perl module is called for further processingauthenticate { perl}accounting { detail unix radutmp exec attr_filter.accounting_response}*I need to know how can I provide IP addresses to connecting users using the " *Frame-IP-Address*" attribute while still autheticating against the external server?? Thanks for your help! (Sorry for the last incomplete mail)

1 0

(no subject)
by HaTiM Chikhi 24 Jun '15

24 Jun '15

Hi, I have configured my freeradius server to authenticate users against an external server (LinOTP server) using a perl plugin. The authentication is working correctly. My users' conf file "/etc/freeradius/users" contains the following: DEFAULT Auth-type := perl The linotp module configuration is as follows: authorize { preprocess IPASS suffix ntdomain files expiration logintime pap } #here the linotp perl module is called for further processing authenticate { perl } accounting { # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response } Now, I want to provide IP addresses to connecting users using the "Frame-IP-Address" attribute. I don't now how to do that since I'm -- *CHIKHI Hatim* *Stage Administrateur Réseau et Sécurité* *Linkbynet*

1 0

radiusd.log not showing authentication requests
by Stefano Zanmarchi 24 Jun '15

24 Jun '15

Hello, I'm setting up a new radius server, copying the configuration from the actual one (both are 2.1.12). Everything is working in debug mode, but if I start the new radius normally it just shows start|stop info ("ready to process requests") in the radiusd.log file, not the authentication requests. The actual server instead is logging fine: Tue Jun 23 17:40:23 2015 : Auth: Login OK: [marie.curie(a)studenti.unipd.it] (from client server2.unipd.it port 1 cli 00-26-b6-f8-6f-e5 via TLS tunnel) Tue Jun 23 17:40:23 2015 : Auth: Login OK: [marie.curie(a)studenti.unipd.it] (from client server2.unipd.it port 1 cli 00-26-b6-f8-6f-e5) The "log" section of the radiusd.conf on both servers is: log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } Is there some other setting to activate authentication logging in radiusd.log file? I'm sure I'm missing something, but I can't see where. Thank you very much for your help, Stefano

2 2

acct-start-time
by Jake He 24 Jun '15

24 Jun '15

Hi, I am running freeradius v3. acct-start-time is not inserted into the sql database. Below is the from the debug log. After running this sql, acctstarttime field is 0000-00-00 00:00:00. I want the acct-start-time to have date and time. INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('82100105', 'bce29f02064857e16fe65303d219cfe4', 'jake', '', '10.1.1.23', '', 'Wireless-802.11', 1435126480, 1435126480, NULL, '0', 'RADIUS', '', '', '0', '0', '', '', '', 'Framed-User', '', '')

1 1

Issue with intermediate CAs
by Alan DeKok 23 Jun '15

23 Jun '15

We had a CVE issued today: http://www.ocert.org/advisories/ocert-2015-008.html OpenSSL doesn't check intermediate CAs for expiry when setting the "check CRL" flag. You need to set another flag saying "I really mean check ALL of the CRLs". FreeRADIUS didn't set that flag. The impact for 99% of people is nothing. In order to be vulnerable, you have to have all of the following in the configuration: 1) the RADIUS system has to use a public CA 2) use an intermediate CA to issue client certificates 3) enable EAP-TLS Most people don't have EAP-TLS enabled. A small number of people might be using an intermediate CA. A vanishingly small number of people will be using a public CA for RADIUS. Using a public CA is a *terrible* idea. We have been recommending against it for years. The problem got a CERT advisory issued because technically it is a security bug, and the original person who reporting it didn't want to contact security(a)freeradius.org. We'll get 2.2.8 and 3.0.9 out soon. In the mean time, most people can ignore this issue. Alan DeKok.

5 7

Please check: 3.0.9 is going to be released soon
by Alan DeKok 23 Jun '15

23 Jun '15

For people with time... please check that the v3.0.x branch from github works for you. It passes all of our tests, including tests we added since 3.0.8 was released. But the tests aren't exhaustive. If all goes well, we will release 3.0.9 on Friday. Alan DeKok.

1 0