- Freeradius-Users - lists.freeradius.org

Freeradius and OpenLDAP certificates
by Stefan Kania 03 Oct '23

03 Oct '23

Hi to all, I'm new to Freeradius, but not new to OpenLDAP. I got Freeradius running with ldap-connection and Kerberos-authentication for searching the LDAP-tree. Authentication with radtest and a LDAP-user is working: ------------ radtest u1-verw geheim 192.168.56.47 1812 Passw0rd Sent Access-Request Id 23 from 0.0.0.0:50791 to 192.168.56.47:1812 length 77 User-Name = "u1-verw" User-Password = "geheim" NAS-IP-Address = 192.168.56.47 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "geheim" Received Access-Accept Id 23 from 192.168.56.47:1812 to 192.168.56.47:50791 length 20 ------------ I don't want to use MySQL, instead I would like to use OpenLDAP Starting with OpenLDAP 2.5 you can create and manage user and host certificats with the overlay "autoca". You can copy your own CA and the key into OpenLDAP and then let OpenLDAP create the certificate and the key for users and hosts. The certificate will be stored in the attribute userCertificate;binary and userPrivateKey;binary the certificate is in DER-format. I now would like to use the certificates from OpenLDAP for authentication. How can I use certificates located in OpenLDAP for user- and host- authentication? Stefan

3 5

Problems to authenticate against an Azure AD -Ldap
by Uwe Faber 02 Oct '23

02 Oct '23

Hi folks, i hopw you can help after reading thousends articles and making hundred of trials with the freeradius with no succes. Here ist the situation, we have an Azure AD and for this an ldap server front-end. So i could connect to the AD over the ldap. for testing reason i implementet an Local openldap server and testet ist with the eapol test and it works without problems, but if i change the ldap connection to the azure/ldap i got the following error: 5) ldap_khs: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (5) ldap_khs: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) regards Uwe

5 17

Re: Problems to authenticate against an Azure AD -Ldap
by Uwe Faber 02 Oct '23

02 Oct '23

1 0

FreeRADIUS on mac
by Robert Fernandez 30 Sep '23

30 Sep '23

Has anyone gotten FreeRADIUS 3.2.3 to compile on Macintosh. When I run “make” it errors on the line: configure: error: failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL)

2 1

Quick question about FreeRADIUS and timezones
by Stefan Paetow 29 Sep '23

29 Sep '23

Hi, I know this is probably something really obvious but… Does FreeRADIUS log in UTC or the local timezone? Is there anything specific in terms of settings (in radiusd.conf) to make FreeRADIUS log in UTC by default if it does not? I’ve looked at the date {} module and I note that both the ‘date’ and the ‘wispr2date’ xlats have the option to output things in UTC… would that be the only thing where this can be tweaked? With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 For eduroam support, please contact the eduroam team via help(a)jisc.ac.uk and mark it for eduroam’s attention. On Wednesdays and Fridays, I am not available between 12:00 and 15:00. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800.

2 2

Lockout by IP number?
by Ann Cantelow 28 Sep '23

28 Sep '23

Hello, I am looking to implement a lockout for excessive login tries. I have been following advice offered at https://wiki.freeradius.org/guide/lockout , and thank you very much for that. Is there a variable like '%{User-Name}' for IP number? I would like to do a lockout based on IP number as well as User-Name. I see the IP is listed in the radius log, but I haven't been able to find an attribute that I figure will give this information. I've looked in the dictionary files, but maybe I've somehow missed it. My radius version is 2.1.12 on RHEL6, and client nastype is cisco. Radius upgrade to version 3 is planned. Radius log example lines showing ip numbers: ... Wed Sep 27 11:29:13 2023 : Auth: Login incorrect: [edc] (from client [clientname] port 212271104 cli 62.122.184.231) Wed Sep 27 11:29:14 2023 : Auth: Login incorrect: [edc] (from client [clientname] port 86839296 cli 62.122.184.231) Wed Sep 27 11:29:16 2023 : Auth: Login incorrect: [qazwsx] (from client [clientname] port 241688576 cli 62.122.184.231) Wed Sep 27 11:29:17 2023 : Auth: Login incorrect: [qazwsx] (from client [clientname] port 166244352 cli 62.122.184.231) ... Many thanks, Ann Cantelow

4 4

Simple question (Request Duration)
by Andy Arp 27 Sep '23

27 Sep '23

Is there a builtin value i can emit to linelog that will indicate how long a given request has taken from start to finish? -- Thanks, Andy Arp

3 3

dhcp v6
by Charles Hedrick 27 Sep '23

27 Sep '23

I see there's support for DHCP v6, but I don't see any usable documentation or examples. The sample site file doesn't return any information. Does anyone have either documentaiton or a working configuration file that returns info, prerably from sql, though I can presumably combined with v4 info for that.

2 1

Freeradius+pbkdf2
by Andre Luis Forigato 27 Sep '23

27 Sep '23

Hello, My users' passwords are stored in ldap using pbkdf2 encryption, until Freeradius v2 all users were successfully authenticated, when migrating to the Freeradius 3.2.3 version users are unable to authenticate using pbkdf2 encryption. What could have happened? Is there any way to resolve this problem? Thank you very much. Att, André Luis Forigato RNP

2 1

EAP-TTLS Diameter usage
by Härtl, Calvin 21 Sep '23

21 Sep '23

Hi all, first of all, thank you for your help so far! I do have another question regarding EAP-TTLS. According to eap ttls | FreeRADIUS Documentation (networkradius.com)<https://networkradius.com/doc/3.0.10/raddb/mods-available/eap/ttls.html> and RFC5281 (RFC 5281: Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0) (rfc-editor.org)<https://www.rfc-editor.org/rfc/rfc5281.html#page-15>), Diameter is being used in this protocol to allow the usage of AVPs. But is there another reason why EAP-TTLS uses Diameter packages? I am asking, since I checked some PEAP packages with Wireshark and these packages, while not using Diameter, still have AVPs incorporated in them. I also can not find any sources that state why Diameter was specifically chosen for EAP-TTLS. Was there another advantage that Diameter offers in the case of EAP-TTLS? I.e. client roaming capabilities, failover, etc.? Kind regards, Calvin

2 1