- Freeradius-Users - lists.freeradius.org

ldap responses in freeradius 3.0.4
by Mark Williams 19 Feb '15

19 Feb '15

I use some custom linelogs in my own config which then go to syslog. I noticed that the radius.log actually has statements detailing the ldap responses to an auth attempt (invalid user, incorrect login, etc). I'd like to be able to use some similar messaging in my custom linelog. I browsed the rad_auth file and, while I'm not well versed in C, I was able to determine how the messages are being generated. I'd rather not have to code my own module to accomplish this however. Suggestions? Have I missed an attribute or run-time variable with the return code of an ldap request?

2 1

Ldap-UserDn
by Stefan Paetow 19 Feb '15

19 Feb '15

Hi, Is there any way to check for the existence of Ldap-UserDn for a bind-as-user option? We're trying to document how to use the users file together with LDAP bind-as-user. Any suggestions will be most helpful :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 1

rlm_graphite?
by Arran Cudbard-Bell 19 Feb '15

19 Feb '15

Just looking at graphite and wondering if anyone thinks a native rlm_graphite module to update counters using accounting data would be useful. One big advantage graphite has advantages over other systems in that it can be used to graph very large numbers of metrics. It could be used to produce traffic graphs for every user on a network for example. The module would implement the pickle protocol, and use a connection pool for TCP Connection caching. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 10

SQL based IP pool
by Fabrizio Fiore Donati 19 Feb '15

19 Feb '15

Hi, we need to user sql ip pool to assign the ip to the customer. About 10000 ip address. I see that i can use two module, Rlm_sqlhpwippool or Rlm_sqlippool which one do you suggest ? any special requirements ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

3 6

Freeradius 3.0.4 authentication to FreeIPA 4.1.2
by Charles Jennings 18 Feb '15

18 Feb '15

Environment: Fedora release 21 (Twenty One) {Linux ipa.socnet.demonet.net 3.18.5-201.fc21.x86_64 #1 SMP Mon Feb 2 21:00:58 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux} radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 19 2015 at 19:42:17 ipa: VERSION: 4.1.2, API_VERSION: 2.109 I am a freeradius noob. I figure if I can get to the point where I can do a test with radtest locally, I can get from there. I cannot find any documentation on the internet that is coherent for me to give me a step-by-step configuration for authenticating radius against FreeIPA. I would prefer (I think) to use the Kerberos portion of FreeIPA as opposed to the OpenLDAP portion - however, I can go either way. I just need a nudge in the configuration of freeradius to freeipa. Any help would be very much appreciated. As a side note, I am authenticating successfully against my IPA infrastructure - I just can't seem to find the information I need to tie freeradius to freeipa. Thanks.

3 4

Re: radwho gives an empty output
by Mert Uzun 18 Feb '15

18 Feb '15

>> To mention my work detailly, on GNS3, I have one c7200 cisco router as >> NAS(for administration access to router only, not to provide an >> internet connection) and a freeradius server on ubuntu server 14.04. I >> configured my NAS to send accounting update per one minute. In >> /var/log/freeradius/radacct/(ip of the nas)/detail-(date), I can read a >> txt file where some accounting infos are written but when I issue >> "radwho" command, I can not see anything but the titles for non-written >> accounting details. > > Read the debug output, and look for the “radutmp” module. What does it > say when the server receives an Accounting-Request? Unfortunately I saw no output by radutmp module. I only saw auth_log outputs that prompting outputs into a txt file (I tried some configurations on detail.log). I think that I may have not noticed a useful information but I have no idea about what it is. However, because I configured my NAS to request accounting logouts, my server send accounting reply when any user log off on the NAS. > >> I also issued freeradius -X command and got "ready to process request", >> my server can properly process authentication requests also. > > The point is to read the output *after* it says “Ready to process > requests”. That tells you what it’s doing when it processes requests. > I read each row after receiving a request. I couldn't see any radutmp module output as I said above. At least I know what I need to focus on now. >> However, I'm not completely unsuccessful to get any output from radwho. >> I had done some configurations on freeradius and managed to get proper >> outputs with radwho on the same topology and system. Unfortunately, my >> server got disfunctioned when I had tried to configure it for active >> directory authentication. I could only recovered it by re-installing >> then I lost and forgot what I did to use radwho. > > You should use “git” for revision control on the raddb directory. It > helps a lot. I should have learned this function before. Due to malfunctions on my computer, I lost whole topology and virtual machines but I will remember this advice in future thank you a lot. > >> I can't remember what I did to get radwho output before I lost whole >> configuration and what I can't notice now. > > If you send Accounting packets which have useful session data in them, > radwho will “just work”. > After reading this, I read my accounting configuration on the NAS. I suspected of a forgotten accounting command. Then I issued some accounting commands to apply "trial&error". Unfortunately, radwho didn't work again. I will continue to search for any missing accounting commands. In general, those details were all caused from the previous topology which I lost completely recently. I will build it up again in a few days. After a short process of adding clients and users, I will read debug details as you recommend and share results. Thanks for your help. -- Mert Uzun Elektrik Mühendisliği Bölümü-2. Sınıf Öğrencisi

1 0

Users file formatting
by Jonathan Gazeley 18 Feb '15

18 Feb '15

Hi list, This is hopefully a simple question. I've been using a simple users file to authenticate a handful of users that don't exist in AD with entries like this, which works: test-account1 Cleartext-Password := "password", MS-CHAP-Use-NTLM-Auth := no I also want to have a couple of test accounts that are restricted to MAC addresses. test-account2 Cleartext-Password := 'password', Calling-Station-Id == "00:11:22:33:44:55", MS-CHAP-Use-NTLM-Auth := no However radius -XC bombs out with "Unexpected trailing comma in check item list for entry test-account2" According to the manpage for the users file, I've formatted it correctly with commas between each check-item. I wondered if MS-CHAP-Use-NTLM-Auth was a reply-item so I tried to move it onto its own line with a tab, but this throws "Parse error (reply) for entry test-account2 (unknown error)" Can anyone advise on how to format users entries like this, and even if it is possible to require specific mac addresses in this way? Thanks, Jonathan

2 3

Weird message from RADIUS running at debug level
by Clement Ogedengbe 18 Feb '15

18 Feb '15

I am running RADIUS ( has embedded ntlm_auth to authenticate to Windows AD) at debug level. The message below gets occasionally displayed on the screen. The serer continues to authenticate users anyway, but wonder if anyone has any idea of what is going on here. Usage: [OPTION...] --helper-protocol=helper protocol to use operate as a stdio-based helper --username=STRING username --domain=STRING domain name --workstation=STRING workstation --challenge=STRING challenge (HEX encoded) --lm-response=STRING LM Response to the challenge (HEX encoded) --nt-response=STRING NT or NTLMv2 Response to the challenge (HEX encoded) --password=STRING User's plaintext password --request-lm-key Retrieve LM session key --request-nt-key Retrieve User (NT) session key --use-cached-creds Use cached credentials if no password is given --diagnostics Perform diagnostics on the authentictaion chain --require-membership-of=STRING Require that a user be a member of this group (either name or SID) for authentication to succeed --pam-winbind-conf=STRING Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required Help options: -?, --help Show this help message --usage Display brief usage message Common samba config: --configfile=CONFIGFILE Use alternate configuration file Common samba options: -V, --version Print version

3 2

Git issue
by David Peterson 18 Feb '15

18 Feb '15

When I try to checkout branch 2.x I get this: root@freeradius:/usr/src# git clone git@github.com:FreeRADIUS/freeradius-server.git Cloning into 'freeradius-server'... Warning: Permanently added the RSA host key for IP address '192.30.252.128' to the list of known hosts. Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. David

2 2

mysql, different tables based on NAS
by Miha 18 Feb '15

18 Feb '15

Hi, it is possible/how to insert based on NAS, accouting requests in different table, database? tnx miha

3 4