- Freeradius-Users - lists.freeradius.org

connection timeout for login
by moore moore 14 May '15

14 May '15

hello. using freeradius client 1.1.6 embedded in process in linux. if configuration file option I can see there is option for:login_timeout and session timeout # timeout for all login tries # if this time is exceeded the user is kicked out login_timeout 60 But cannot see similar option for login timeout to use in embedded fashion. Is this supported? thank you.

1 1

Filenames in headers
by Nathan Ward 14 May '15

14 May '15

Hi, This is very much a cosmetic thing, even more so than other things I’ve posted lately, but these things bug me :-) When valuepair.c was split out, the old filename was left in the boilerplate in value.c and pair.c. I’ve come up with a few of these sort of things and am wary of list noise. Would you like me to submit future things as PRs on Github, or post to -developers to reduce the noise on -users? -- Nathan Ward

2 1

Strange in dictionary
by vanish 13 May '15

13 May '15

Greeting. I found something strange in dictionary work. 1. I have next sql query for radreply: "SELECT 1 id, '%{SQL-User-Name}' username, 'Cisco-Account-Info' attribute, 'AOPEN_DNS' value, '=' op from TABLE(SET {1}) \ union \ SELECT 2 id, '%{SQL-User-Name}' username, 'Cisco-Account-Info' attribute, 'AL4REDIRECT_SERVICE' value, '+=' op from TABLE(SET {1})" When user authenticate is successfull - FR send Access-Accept packet to cisco device: >Sending Access-Accept of id 201 to 10.10.10.1 port 1645 > Cisco-Account-Info = "AOPEN_DNS" > Cisco-Account-Info += "AL4REDIRECT_SERVICE" Everything work fine. 2. But when i want to send Cisco-AVPair attribute to cisco: "SELECT 1 id, '%{SQL-User-Name}' username, 'Cisco-Account-Info' attribute, 'AOPEN_DNS' value, '=' op from TABLE(SET {1}) \ union \ SELECT 2 id, '%{SQL-User-Name}' username, 'Cisco-Account-Info' attribute, 'AL4REDIRECT_SERVICE' value, '+=' op from TABLE(SET {1})" union \ SELECT 3 id, '%{SQL-User-Name}' username, 'Cisco-AVPair' attribute, 'ip:addr-pool=pool1' value, '=' op from TABLE(SET {1})" I get next error: Error: rlm_sql: Failed to create the pair: Unknown attribute "Cisco-AVPair " requires a hex string, not "ip:addr-pool=pool1" I check dictionary.cisco: >#cat /usr/share/freeradius/dictionary.cisco | egrep "Info|AVP" >ATTRIBUTE Cisco-AVPair 1 string >ATTRIBUTE Cisco-Account-Info 250 string >ATTRIBUTE Cisco-Service-Info 251 string >ATTRIBUTE Cisco-Control-Info 253 string Attributes exists, but error occure. Please explain me, where the mistake.

2 2

External accounting script help
by Paul Boehmer 12 May '15

12 May '15

First post please be gentle. Working on a migration from XtRadius 1.2.1B2 to FreeRadius 3.0.8. In my XtRadius users file, I have the following line: ------------------------------ DEFAULT Acct-Status-Type = "Start" Exec-Program-Account = "/radius/scripts/startrad.sh %u %f %y %n %p" ------------------------------ From what I understand in the documentation, I created the following the file in mods-enabled called startrad. The file contains: ------------------------------- # -*- text -*- exec startrad { wait = yes program = "/radius/scripts/startrad.sh %{User-Name} \ %{Framed-IP-Address} \ %{NAS-Port-Type} \ %{NAS-IP-Address} \ %{NAS-Port-Id}" input_pairs = request output_pairs = reply packet_type = Access-Accept } --------------------------------- The shell script right now just dumps the arguments to a flat text file. I call this module in my sites-enabled/default config in the accounting section like so: --------------------------------- accounting { detail unix radutmp sradutmp -sql exec if ( "%{Acct-Status-Type}" == "Start"){ startrad } } ----------------------------------- From there, I execute "radius -X | tee -a log" and I see the module enabled and executed, but the result is (showing what I think are relevant entries): ------------------------------------ ... including configuration file /radius/raddb/mods-enabled/startrad ... ... # Instantiating module "startrad" from file /radius/raddb/mods-enabled/startrad exec startrad { wait = yes program = "/radius/scripts/startrad.sh %{User-Name} %{Framed-IP-Address} %{NAS-Port-Type} %{NAS-IP-Address} %{NAS-Port-Id}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } ... ... (1) User-Name = 'testuser' (1) Acct-Authentic = RADIUS ... ... (1) Acct-Status-Type = Stop (1) NAS-Port-Type = Virtual (1) NAS-Port = 16777297 (1) Class = 0x61693a6238623938653064353564393061376235626533303763663239313737363134 (1) Service-Type = Framed-User ... ... ... (0) if ( "%{Acct-Status-Type}" == "Start") { (0) EXPAND %{Acct-Status-Type} (0) --> Stop (0) if ( "%{Acct-Status-Type}" == "Start") -> FALSE (0) startrad: Executing: /radius/scripts/startrad.sh %{User-Name} %{Framed-IP-Address} %{NAS-Port-Type} %{NAS-IP-Address} %{NAS-Port-Id}: (0) startrad: EXPAND %{User-Name} (0) startrad: --> testuser (0) startrad: EXPAND %{Framed-IP-Address} (0) startrad: --> ***.***.***.238 (0) startrad: EXPAND %{NAS-Port-Type} (0) startrad: --> Virtual (0) startrad: EXPAND %{NAS-IP-Address} (0) startrad: --> ***.***.***.226 (0) startrad: EXPAND %{NAS-Port-Id} (0) startrad: --> (0) startrad: Program returned code (0) and output '' (0) startrad: Program executed successfully (0) [startrad] = ok (0) } # accounting = ok ... ... ------------------------------------- So, despite the if/then statement being false, the startrad module is still being executed. I've seen numerous postings on similar question, but any answers I did find are several years old. Am I correct in moving the script to a module and sites-enabled/default files from the mods-config/files/authorize (aka users)? Please advise. Thanks. -- Paul Boehmer pboehmer(a)seidata.com

4 7

(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by escalanterj＠gmail.com 12 May '15

12 May '15

Hello, I just installed Freeradius 3 and get this error. Could you please give me a clue? Thanks BR Freundliche Grüsse Javier Escalante 00 41 78 689 85 69 escalanterj(a)gmail.com freeradius: FreeRADIUS Version 3.0.3, for host x86_64-pc-linux-gnu, built on May 20 2014 at 11:59:21 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/dhcp including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/linelog including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 0.0.0.0/0 { require_message_authenticator = no secret = <<< secret >>> shortname = "private-network-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_radutmp # Instantiating module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/freeradius/mods-enabled/replicate # Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_detail # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_digest # Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_files # Instantiating module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" usersfile = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/freeradius/mods-config/files/authorize [/etc/freeradius/mods-config/files/authorize]:99 Cistron compatibility checks for entry John Doe ... [/etc/freeradius/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/freeradius/mods-config/files/authorize [/etc/freeradius/mods-config/files/authorize]:99 Cistron compatibility checks for entry John Doe ... [/etc/freeradius/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Loaded module rlm_unix # Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_exec # Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_expr # Instantiating module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Instantiating module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/freeradius/mods-enabled/dhcp # Loaded module rlm_pap # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_always # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_soh # Instantiating module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 55797 Ready to process requests.

3 2

how to setup MAC based authentication with LDAP
by Thomas Stather 12 May '15

12 May '15

Hello list I am new to RADIUS and i'd like to know how to setup a mac-based authentication for my clients. Here is what i have so far: -freeradius 3.0.3 -/etc/raddb/clients.conf (setupped with the IPs of the NAS devices) Now i'm unsure how to configure the mods-enabled/ldap configuration. All the hosts are located in an OU named "hosts", the mac-address of each host has the attribute name "macAddress" within the host object (i.e cn=testdevice). My virtual server in sites-enabled/macauth looks like this: server macauth { authorize { preprocess # clean the Calling-Station-ID rewrite_calling_station_id # now authenticate against LDAP ldap if (!ok) { reject } else { # accept update control { Auth-Type := Accept } } } authenticate { Auth-Type LDAP { ldap } } # Pre-accounting. Decide which accounting type to use. preacct { preprocess # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique } # Accounting. Log the accounting data. accounting { # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # filter attributes from the accounting response attr_filter.accounting_response } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp } } Can somebody help please? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

8 23

FreeRadius and OpenSSL 1.0.2
by Ed Ceaser 12 May '15

12 May '15

To resurrect an old thread: http://lists.freeradius.org/pipermail/freeradius-users/2015-March/076365.ht… I too am having this exact problem on Debian Wheezy as of today. Freeradius 2.2.5, and openssl 1.0.2a. Switching from EAP-TTLS/MSCHAPv2 to PEAP/MSCHAPv2 fixed the problem. I haven't had a chance to do much debugging on it today; did anyone ever make any progress on this? I was going to run it through strace / gdb to see if I could get started on figuring out whats up, but if anyone has any insight let me know. -Ed

2 1

Re: 802.1x dynamic vlan assignment not assigning VLAN
by Martijn Craeghs 12 May '15

12 May '15

Thanks for the quick reply. I figured i missed something in the freeradius configuration to enforce these attributes somehow. Don't have a very big knowledge of freeradius. So thanks for the confirmation that i should be looking at the switch rather than the freeradius (which I have been doing mostly). Kind regards Martijn Craeghs On 12 May 2015 at 13:46, Alan DeKok <aland(a)deployingradius.com> wrote: > On May 12, 2015, at 7:11 AM, Martijn Craeghs <martijncr(a)msn.com> wrote: > > As far as authentication goes it works. My user get's authenticated and > > recieves an Access-Accept message in this form. > > That's good. All of the correct VLAN attributes are there. > > > Sending Access-Accept of id 12 to xxx.xxx.xxx.xxx port 6103 > > Tunnel-Private-Group-Id:0 = "vlan_name" > > This should be the string representing the VLAN number... i.e. "50". > > > I've added the tunnel attributes to my LDAP directory and like the > previous > > freeradius debug message show it's stored in the radius package. > > Then you've configured FreeRADIUS correctly. > > > I've ran out of options and forums to look through at this point. > > > > Would be glad if someone could give me a push in the right direction. Not > > even sure if i should look for the problem on the freeradius side or the > > switch side. > > It's probably the switch. Use the VLAN number, not name, in the > FreeRADIUS configuration. That will probably make the switch assign the > correct VLAN. > > As always, when the packet from FreeRADIUS is correct and it still > doesn't work... blame the NAS / AP / switch. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

802.1x dynamic vlan assignment not assigning VLAN
by Martijn Craeghs 12 May '15

12 May '15

I recently dived into 802.1x authentication with dynamic vlan assigment. My current set up contains of: - A client - A SG220 cisco switch (the supplicant) - A freeradius (authenticator) based on an LDAP AD - A fortigate for firewall purposes and acting as DHCP server. As far as authentication goes it works. My user get's authenticated and recieves an Access-Accept message in this form. Sending Access-Accept of id 12 to xxx.xxx.xxx.xxx port 6103 Tunnel-Private-Group-Id:0 = "vlan_name" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-MPPE-Recv-Key = 0xd899b158c44adb59894a8ad4c7554010571fffe1c3ef87f74db910c482c2be82 MS-MPPE-Send-Key = 0xe094d1c3e2fb5d5153963089c533278338d655284858156b0fb2e78e72ab7060 EAP-Message = 0x03320004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "username" I've added the tunnel attributes to my LDAP directory and like the previous freeradius debug message show it's stored in the radius package. I've read countless of threads where you should add "use_tunneled_reply = yes" to your eap.conf file which i have done as shown below: eap { use_tunneled_reply = yes default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key pem_file_type = yes certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no max_entries = 255 } verify { } } ttls { virtual_server = "inner-tunnel" } peap { virtual_server = "inner-tunnel" } mschapv2 { } } As far as switch config goes for an interface: encrypted radius-server host xxx.xxx.xxx.xxx auth-port 1812 acct-port 0 key "some hash"== priority 1 usg-type 802.1x aaa authentication enable default radius dot1x system-auth-control vlan 50 name "vlan_name" interface gi1 switchport mode access dot1x port-control auto spanning-tree portfast The switch vlan's get their dhcp from fortigate where the vlan's are also created. I've only got it working to the point where i've set static access ports. I've ran out of options and forums to look through at this point. Would be glad if someone could give me a push in the right direction. Not even sure if i should look for the problem on the freeradius side or the switch side. If you need more files or logs just give me a poke. kind regards

2 1

Dynamic client
by Diego Fernando Bermudez Garzon 12 May '15

12 May '15

Hello forum In this moment im developing an application that uses the freeradius. the behavior of the app is like this: - At this first, the user tries to connect to the wifi router. - Then the router validate with the freeradius if the user is into its database. - Given that the user is not into the radius, it responds with a rejected message. - Then the router send the user to a web page where is my app - Now, my app catch the mac address of the user device and saves it into another database. - Once the mac is saved, my app inserts the mac address of the user into the freeradius, with a slq sentence. Now the problem is that when I insert this user into the freeradius my wifi router is not able to detect this insertion. So my question is, how can I send/generate a request from the freeradius to my router when this insertion is carried out? I don't want to force the router to refresh its tables, because when I have too many users the router get stuck.

2 1