- Freeradius-Users - lists.freeradius.org

recv-coa/send-coa doc bug?
by Nathan Ward 07 May '15

07 May '15

Hi, I am doing some research before starting some CoA work, and noticed what I think is a documentation bug, both on v3.0.x and v3.1.x. Line 40 of raddb/sites-available/coa reads: # recv-coa section. This applies to *both* CoA-Request and ^^^^ I suspect that this should instead read: # send-coa section. This applies to *both* CoA-Request and ^^^^ This looks like a pretty standard copy+paste+edit mistake, but I wanted to check to see if the original is actually correct. I started looking through the code to confirm and get a bit lost in how CoA packets are sent exactly, but I *think* I’m correct in saying that the docs have a mistake. -- Nathan Ward

2 1

Sharing a client cert for EAP-TLS with many identical devices?
by Martin Pauly 07 May '15

07 May '15

Hi all, not exactly an FR problem, but at least I hope not a trivial question: My institution is taking part in a program to test the use of 100+ WiFi Clients handed out to students for use during a lecture or even for online exams. So we have 140 iPads along with a "filling station" for easy bulk configuration. WiFi auth will be done with EAP-TLS against FR. Now my question: Do I definitely need 140 client certs to deploy them on the iPads or could I get along with one cert for # all? The only drawback I can see is that if one iPad gets lost, I have to renew the client cert on _all_ of them, which I could bear due to the easy bulk config. Anything else? THX in advance Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 2

different user perms for different clients
by Pat Cain 07 May '15

07 May '15

FreeRADIUS Version 3.0.7 Hello, I'm migrating to freeradius from Radiator, and the configuration files are very, very different, so I'm looking for some conceptual guidance, or some working examples. Essentially, I'm just not getting it when it comes to configuring a different list of users for each freeradius client. Not sure if I'm supposed to use huntgroups or features within client definitions. The background: We use Radius to authenticate access to Cisco switches (and some APC UPS devices). Our switches are mostly managed solely by a group of admins (users useraa, userbb, and usercc), and a user userdd with read-only access. Our Cisco switches are currently all statically listed as follows (in clients.conf): client coswe008 { ipv4addr = 10.79.161.102 secret = leauth nas_type = cisco } I have a file with our info configured in /etc/raddb/mods-enabled/passwd: passwd fss_passwd { filename = /usr/local/etc/raddb/fss-users.passwd delimiter = | format = "*User-Name:Crypt-Password:=Service-Type:=Cisco-AVPair:=APC-Service-Type" hash_size = 100 ignore_nislike = yes allow_multiple_keys = no } and the contents of fss-users.passwd: # File Format is (extra spaces around the '|' for ease of reading) # User-Name | Crypt-Password | Service-Type | Cisco-AVPair | APC-Service-Type useraa|OwdaaacZLaaaE|NAS-Prompt-User|shell:priv-lvl=15|Admin userbb|OwdbbbcZLbbbE|NAS-Prompt-User|shell:priv-lvl=15|Admin usercc|OwdccccZLcccE|NAS-Prompt-User|shell:priv-lvl=15|Admin userdd|OwddddcZLdddE|NAS-Prompt-User|shell:priv-lvl=1| and this works fine. What I'd like to be able to change, though, is for userdd to have admin access to two of our switches, and read access to all the rest. The essence of this question is how do I customize the user list for each client? Is it a huntgroup, or a conditional include in the clients.conf file? Thanks for what you can offer on this topic, pjc PS - is there an archive for this list that can be searched?

3 2

unlang dailycounter
by Pablo Umanzor 07 May '15

07 May '15

Hello , i'm using FR 3.0.3 under debian7,mysql this is the situation: - a NAS with unlang rule (match a nas-ip-address) to get internet access 1 hour per day to computer wired pc - in the same building there are wireless hotspots that doesn't match the unlang rule and controlled by another NAS * both NASes managed by the same Freeradius server (radacct table) 1st: an user connects by wireless hotspot for 2 hrs 2nd: again the same user wants to get access by wired pc but is rejected (because has reached the limit per day) how i can give 1 hour internet access by wired independent if this user accesses after or before by wireless? this is the rule to wired NAS if (NAS-IP-Address == x.y.z.u) { update reply { Mikrotik-Rate-Limit := 1024k/2048k Port-Limit := 1 } update control { Max-Daily-Session := 3600 } } regards pablo umanzor

2 1

How to enable Access-challenge in Free radius
by sridhar Varadarajan 06 May '15

06 May '15

I have installed Free radius in a windows box and using this radius server to authenticate into my application. I now come across with another need like in addition to authentication i need to overhead with one more option ie. "Access challenge". Can anyone tell me in which file & what needs to be configured so that my radius server can put back a Access-challenge request towards my application so upon providing replying for this challenge request from my application, my radius server should allow me to login in. Regards, Sridhar

2 1

how to show all clients connected on freeradius 3
by rints harry 06 May '15

06 May '15

Hi, when I do radwho , i have this error Wed May 6 01:45:22 2015 : Error: /usr/local/etc/raddb/policy.d/eap[10]: Parse e rror in condition Wed May 6 01:45:22 2015 : Error: if (control:State) { Wed May 6 01:45:22 2015 : Error: ^ Expected a module return code radwho: Error reading or parsing radiusd.conf.

2 1

post-auth and ldap problem
by Coil93 06 May '15

06 May '15

Hi, I'm using freeradius-3.0.8 for basic authz with AD integration. My config is very simple. ./sites-enabled/test authorize { ldap if (!ok) { reject } else { update control { Auth-Type := Accept } } } post-auth { ldap } ./mods-enabled/ldap ldap { server = 'ldaps://192.168.0.1' server = 'ldaps://192.168.0.2' identity = 'cn=Radius Server,ou=services,dc=test,dc=com' password = ***** user { base_dn = 'ou=wifi,dc=test,dc=com' } post-auth { update { description += "Authenticated at %S" } } } So, I want to modify "Description" field for AD user to add a new value to an existing record, but not to replace it. The problem is that radiusd is unwilling to modify the existing value with += operator and sending Auth-Type Reject to NAS. (2) # Executing section post-auth from file /etc/raddb/sites-enabled/alpha (2) post-auth { (2) ldap: EXPAND . (2) ldap: --> . (2) ldap: EXPAND Authenticated at %S (2) ldap: --> Authenticated at 2015-05-05 17:23:03 rlm_ldap (ldap): Reserved connection (4) (2) ldap: Using user DN from request "CN=Sony Xperia Z,OU=WiFi,DC=test,DC=com" (2) ldap: Modifying object with DN "CN=Sony Xperia Z,OU=WiFi,DC=test,DC=com" (2) ldap: Waiting for modify result... (2) ldap: ERROR: Failed modifying object: Type or value exists (2) ldap: ERROR: Server said: 00002081: AtrErr: DSID-030F154F, #1: 0: 00002081: DSID-030F154F, problem 1006 (ATT_OR_VALUE_EXISTS), data 0, Att d (description) . rlm_ldap (ldap): Released connection (4) (2) [ldap] = fail (2) } # post-auth = fail (2) Using Post-Auth-Type Reject When used the := operator, radiusd will replace all data in Description field with "Authenticated at 2015-05-05 17:23:03" string without any problem. My question is Is there any way to append value, not replace, for AD attributes? How to avoid rejects with failed post-auth status? Thank you, JM

2 2

logging connection ciphers?
by Krause, Kilian 06 May '15

06 May '15

Hi, to evaluate which of our clients still use certain weaker ciphers for our InfoSec folks, we'd like to log the TLS connection parameters for each 802.1x EAP request. Is there any option we could enable or does FreeRADIUS not permit to directly log the negotiated cipher and other internal TLS parameters? Thanks for any pointers. Best, Kilian

1 0

"Best" authentication mechanisms for Wi-Fi
by Hoggins! 06 May '15

06 May '15

Hello list, We're using FreeRADIUS to authenticate users to access our Wi-Fi. It works very well. The thing is : we use a mechanism that works perfectly for Android and Linux (NetworkManager) clients, but some can't access it, due to limitations. I'm thinking of some Windows flavors here. We store our passwords hashed in a MySQL database, and recommend the users to connect using "WPA2 Enterprise (802.11x) using TTLS method and PAP for phase2. Do you think that we could find a more "universal" combination that even "old" Windows clients would be compatible with ? I know that my vocabulary might sound really "newbie", although we've been running the system for quite some years now, and we had set it up using tutorials and some customization. But reading again the config. files, I can see that I might have to look into the specifics on Windows compatibility in eap.conf file. Anyway, in the meantime, if you have some hints on that, I'll be glad to read them. Best !

5 9

Accounting for cisco aironet
by Sautron Nick 06 May '15

06 May '15

Hello everyone, I have a problem with the accounting of HotSpots aironet cisco. The problem is that the data is fitted into the table "radpostauth" therefore I do not have all the information of accounting. Normally given should be inserted into the table "radacct" I have configured the sql.conf file, and well create the database. Have you ever encountered this problem? How to solve it? Best regards S.Nick

2 1