- Freeradius-Users - lists.freeradius.org

Realm Config
by Carlos Botejara 25 Aug '23

25 Aug '23

I need to configure 2 realms, and validate users depending on the realm from which they connect, I need specific rules for each site (with different sql queries). The users are in a mysql database. I configured the Realms in the proxy.conf file as follows (because I don't have domain) realm1 { nostrip } realm2 { nostrip } The realm is configured in the Mikrotik router of each site. The Realm attribute for Mikrotik is Mikrotik-Realm [image: image.png] Could you help me with this?

2 6

Freeradius Authentification with active directory
by Etienne CREMILLIEUX 23 Aug '23

23 Aug '23

Hello, I try a connection my freeradius with active directory. the command sudo freeradius -X return this : *(1) ldap: --> Authenticated at 2023-08-23 17:16:46rlm_ldap (ldap): Reserved connection (1)(1) ldap: EXPAND (sAMAccountName=%{Stripped-User-Name}%{user-name}})(1) ldap: --> (sAMAccountName=wifirst_test(a)prodges.local})(1) ldap: Performing search in "ou=Utilisateurs,dc=prodges,dc=local" with filter "(sAMAccountName=login_test@**domain* *.local})", scope "sub"(1) ldap: Waiting for search result...(1) ldap: Search returned no resultsrlm_ldap (ldap): Released connection (1)Need more connections to reach 10 sparesrlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots usedrlm_ldap (ldap): Connecting to ldaps://172.19.16.7:636 <http://172.19.16.7:636>* I have a FreeRADIUS Version 3.2.1 on Debian GNU/Linux 12 (bookworm) My conf /etc/freeradius/3.0/mods-enabled/ldap : *ldap { # Note that this needs to match the name(s) in the LDAP server # certificate, if you're using ldaps. See OpenLDAP documentation # for the behavioral semantics of specifying more than one host. # # Depending on the libldap in use, server may be an LDAP URI. # In the case of OpenLDAP this allows additional the following # additional schemes: # - ldaps:// (LDAP over SSL) # - ldapi:// (LDAP over Unix socket) # - ldapc:// (Connectionless LDAP) server = 'ldaps://172.19.16.7 <http://172.19.16.7>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>'# server = 'ldap.rrdns.example.org <http://ldap.rrdns.example.org>' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. port = 636 # Administrator account for searching and possibly modifying. # If using SASL + KRB5 these should be commented out. identity = 'login_sync(a)domain.local' password = 'password123' # Unless overridden in another section, the dn from which all # searches will start from. base_dn = 'DC=**domain* *,DC=local'* * user { # Where to start searching in the tree for users base_dn = "ou=Utilisateurs,dc=**domain* *,dc=local" # Filter for user objects, should be specific enough # to identify a single user object. # # For Active Directory, you should use # "samaccountname=" instead of "uid=" # # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(sAMAccountName=%{Stripped-User-Name}%{user-name}})" # filter = "(UserPrincipalName=%{Stripped-User-Name}:%{user-name}})" # For Active Directory nested group, you should comment out the previous 'filter = ...' # and use the below. Where 'group' is the group you are querying for. # # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. # This applies only to DN attributes. This is an extended match operator that walks # the chain of ancestry in objects all the way to the root until it finds a match. # This reveals group nesting. It is available only on domain controllers with # Windows Server 2003 SP2 or Windows Server 2008 (or above). # # See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir… <https://social.technet.microsoft.com/wiki/contents/articles/5392.active-dir…> # # filter = "(&(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=ou=Utilisateurs,dc=* *domain* *,dc=local))" # SASL parameters to use for user binds # # When we're prompted by the SASL library, these control # the responses given. # # Any of the config items below may be an attribute ref # or and expansion, so different SASL mechs, proxy IDs # and realms may be used for different users.* Regards Etienne -- *Ce message et toutes les pièces jointes (ci-après le "message") sont établis à l’intention exclusive des destinataires désignés. Il contient des informations confidentielles et pouvant être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de détruire le message. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse de l'émetteur*

1 0

Fwd: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS
by King Slaver 23 Aug '23

23 Aug '23

---------- Forwarded message --------- From: King Slaver <nandishchauhan.ssstd9(a)gmail.com> Date: Sat, 19 Aug, 2023, 2:01 pm Subject: AUTO AND MANUAL DISCONNECT NOT WORK FREE RADIUS-DALO RADIUSS To: <freeradius-users-owner(a)lists.freeradius.org> Greetings, I have my local CentOS 7 VM, WITH FREE Radius version 3.0.22, and daloradius 1.3 All the things are configured correctly with openvpn, All accounting is working. But when accessperiod reaches, it sends a coa disconnect request, which results in recv- coa And disconnect ACK but the user still connected, if it loggot manualy on next login it gets error of plan reached. However fot me it is also not working manual radius -x disconnect, it does same send and gets received, user still got connected. It's been too long I been doing rnd, help me for it. I am waiting for answer soon. As I hope.

3 2

Regarding LDAP Module
by Vinit Bhosle 23 Aug '23

23 Aug '23

Dear Support, I have installed Freeradius 3.2.2. but I am getting an error while using LDAP module. Following is the error /usr/local/etc/raddb/mods-enabled/ldap[8]: Failed to link to module 'rlm_ldap': /usr/local/lib/rlm_ldap.so: cannot open shared object file: No such file or directory I am using CentOS Linux release 8.4.2105. How to load rlm_ldap ? Regards Vinit

2 1

FreeRadius 3.2.3 not starting due to missing MongoDB driver
by Ibrahim Al Mahfooz 22 Aug '23

22 Aug '23

Hello All, We are unable to start FreeRadius with MongoDB sql driver enabled on sql module, it is stating: Could not link driver rlm_sql_mongo: /usr/lib64/freeradius/rlm_sql_mongo.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/raddb/mods-enabled/sql[27]: Instantiation failed for module "sql" We installed Freeradius v3.2.3 using the official repo of Rocky Linux 8 below: http://packages.networkradius.com/freeradius-3.2/rocky/ # dnf install freeradius Appreciate your help of what could be missing from the installation steps to make it work Best regards

2 5

freeradius and postgres - why needs to restart freeradius every nas table change?
by Jarosław Kłopotek 22 Aug '23

22 Aug '23

Hi guys, 1. I added "disabled" boolean type column to nas table. 2. I added "disabled IS NOT TRUE" as WHERE condition in /etc/freeradius/3.0/mods-config/sql/main/postgresql/queries.conf I run SQL query: UPDATE nas SET disabled = true WHERE id = 2000; I expect: "no login anymore" I get: "I can login" After restarting freeradius - I get what I want. Is is normal? -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000

2 2

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

Accounting Start Time in Interim-Update of queries.conf is written differently between MySQL and Postgresql
by Ibrahim Al Mahfooz 18 Aug '23

18 Aug '23

Hello, I'm working on migrating from MySQL to Postgresql and during the process of customization of accounting section inside queries.conf file of Postgresql, I found a discrepancy in the accounting start time of the Interim-Update section made me wondering if there is any reason why not written in the same logic as MySQL queries.conf file, here is what I'm referring to: FR Version: 3.2.3 File paths: 1. Postgresql: /etc/raddb/mods-config/sql/main/postgresql/queries.conf 2. MySQL/etc/raddb/mods-config/sql/main/mysql/queries.conf The differences are in the accounting start time inside the interim-update section: - In mysql it is written as: FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ - While in postgresql it is: ${....event_timestamp}, \ I found that the line in postgresql queries actually causing the start to be inaccurate since it will reflect current time while it should reflect the elapsed time (current time - accounting session time) Having this, I had to change the line to this and it seems to be working: TO_TIMESTAMP(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ Any reason why it is not written with the same logic of MySQL queries file? Will the change I made impose any risks or issues down the road? Thanks.

2 1

New and better documentation is now online
by Alan DeKok 18 Aug '23

18 Aug '23

We have put new documentation online at https://freeradius.org/documentation/freeradius-server/3.2.4/ The files are automatically generated from the "doc" directory in the source tree. We are using Antora (https://antora.org/) as the underlying layout tool. The result is not only improved documentation, but also documentation which is easier to navigate. Even better, for v4 (coming soon, really!) we have worked hard at documenting just about everything which can be documented. All of the features of "unlang" are documented, with syntax and examples. Almost every configuration file is available in the same documentation tree, with cross-links to modules, unlang, etc. I hope that this effort makes the server easier to use and configure. Alan DeKok.

6 6

How "bind as user" mode works?
by Rodrigo Abrantes Antunes 17 Aug '23

17 Aug '23

Hi, I was following this thread https://lists.freeradius.org/pipermail/freeradius-users/2020-May/098077.html There, is said this: "Check the help in the ldap module. There are update control Auth type lines inside that set the Auth type to ldap and will Auth with bind instead of reading the password from ldap". I have followed this guide and it works with radtest but not with wifi. https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic… Do I need to have access to the user password in active directory to allow wifi authentication with freeradius? I don't have this access and I thought the "bind as user" mode would solve this (bind with the logging in user, just like ldapsearch) but I think it is not what I thought. How can achieve that? Am I restricted to mschap?

3 13