- Freeradius-Users - lists.freeradius.org

custom reply message
by Rando Nakarmi 21 Aug '14

21 Aug '14

Hello there, I use radutmp file for simualtanesou use and set Simultaneous-Use := 2 -- this works very well for me. but for the third connection it fails (which is normal) but I get message Invalid User in radius.log file which is in fact confusing. radiusd[26044]: Invalid user: user@localhost/<no User-Password attribute>] How do I change or where so than I can add custom message for simultaneous-Use message like "your connection exceed the limit" etc. any example or sample would help me.

1 0

Serving multiple groups of users
by Marcus Ng 21 Aug '14

21 Aug '14

Hi, I would like to configure freeradius2 to have multiple listening ports, with each port catering to a unique group of users. I.e. if a user comes in through listening port 1, his credentials will be checked against a subset of the radcheck. if a user comes in through listening port 2, his credentials will be checked against a different subset of the radcheck. The subsets do not mix. What is the easiest way to do that? I am using postgres for authorization. -Marcus

5 10

hi friends
by Ciprian ARSENIE 20 Aug '14

20 Aug '14

Hi I want to implement this tcl script on a cisco http://www.yasinkaplan.com/docs/simplelcr.pdf I have this auth querry rad_recv: Access-Request packet from host xxxxxxxxxxx port 1645, id=4, length=298 User-Name = "2001" User-Password = "" Cisco-AVPair = "call-id=77a36bec512d59f2148f4a935ed0c2f6@37.153.137.2:5060" h323-conf-id = "h323-conf-id=B6EED6D8 27D911E4 88FA91CF 8B17EE77" Cisco-AVPair = "remote-media-address=xxxxxxxx" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "h323-ivr-out=transactionID:3" Called-Station-Id = "40755xxxxxxx" Service-Type = Login-User NAS-IP-Address = 46.214.35.172 And database is heare voip_cdr=# SELECT * from destinations ; prefix | destination | type | carrier --------+-------------+------------+------------ 4075 | RO ORANGE | MOB | 9901 (1 row) voip_cdr=# select * from carriers ; carrier | description ---------+------------- 9901 | orange (1 row) I m stucked heare CREATE function [dbo].[select_carrier](@dnis nvarchar(50)) returns table as return select top 1 'cisco|100' as Attribute, 'carrier:' + carrier as [Value] from destinations where prefix=substring(@dnis,1, len(prefix)) order by len(prefix) desc and as exmple of querry for freeradius is authorize_check_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" Thanks in advance

1 0

freeRADIUS -> AD Auth
by nfischer＠hush.com 19 Aug '14

19 Aug '14

Hi, after I fully crashed my freeRADIUS Server I have to ask again: It still fails with: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: hausmeister@OBLAN [mschap] Told to do MS-CHAPv2 for hausmeister@OBLAN with NT-Password [mschap] expand: %{Stripped-User-Name} -> hausmeister [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=hausmeister [mschap] Creating challenge hash with username: hausmeister@OBLAN [mschap] expand: %{mschap:Challenge} -> 01b99ad5745936be [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=01b99ad5745936be [mschap] expand: %{mschap:NT-Response} -> cfebe53922a2a18a8e0f423e8562a651148d2b18cd4fbc3e [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt- response=cfebe53922a2a18a8e0f423e8562a651148d2b18cd4fbc3e Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject so Im not sure why. I think its because hes not allowed to execute the ntlm or my mschap is cofigured wrong. (or both) I checked the users/groups: sambashare:x:111:haus-meister winbindd_priv:x:112:freerad freerad:x:113:freerad ssl-cert:x:114:freerad looks fine to me? So my NTLM_Auth string in the modules/mschap is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" I allso tried a lot of other stuff nothing change. Hope you can help me again. -- Mit freundlichem Gruß Nicolas Fischer email: nfischer(a)hush.com jabber: jagger(a)jabber.ccc.de tel: 01573-0420888 Skype: jagger64 TOX: Just ask me :) PGP-Key: http://keyserver.ubuntu.com/pks/lookup?op=vindex&fingerprint=on&search=0xCF… If you sent me a PGP Crypted Mail I´ll be happy and will give you a free cookie :)

4 7

freeradius + firebird, how install in Ubuntu Linux
by Антон - 19 Aug '14

19 Aug '14

Good day! For begin I read the manual, FAQ and some resourses founded in web, but I can't find any complete guide, how install and configure freeradius with module rlm_sql_firebird on ubuntu server, and how I can get this module or compile it, desirable of standard package system of Ubuntu. Unfortunately, my knowledge is not enough. Please, may be I can get some little manual about this issue? Thanks in advance! p.s. I use Linux Ubuntu 12.04 LTS.

2 1

Upgrading FreeRadius
by Martin Ubank 18 Aug '14

18 Aug '14

We have FreeRadius v2.2.0 running on Centos 6 VMs and want to upgrade to v2.2.5. Various files in /usr/local/etc/raddb have been customised for use with our eduroam network. Is there a recommended upgrade method for v2.2.5? Thanks for any advice forthcoming. Martin.

3 6

OpenLDAP Group membership to Filter-ID
by Alex Gregory 17 Aug '14

17 Aug '14

Hello- I would like to make it so that the users in: ou=corp,ou=Users,dc=team,dc=company,dc=com Get mapped a Filter-ID of corp and the users in: ou=dev,ou=Users,dc=team,dc=company,dc=com Get mapped a Filter-ID of dev. I can then apply firewall rules to give them access to certain resources and not others. This will also make it so that if they access the wrong network they should not have the proper access without the correct group membership. In inner-tunnel I have: authorize { if ( Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=affirm,dc=com/ ) { update control { Tmp-String-1 := "corp" } } if ( Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=affirm,dc=com/ ) { update control { Tmp-String-1 := "dev" } } post-auth { update reply { Filter-Id := "%{control:Tmp-String-1}” } I can see in the log that its not matching which means I am not matching correctly. It ends up passing the Filter-ID which is blank. So I know the post auth section is working correctly. Here is the relevant log info: Tue Aug 12 22:50:47 2014 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Tue Aug 12 22:50:47 2014 : Info: +- entering group authorize {...} Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=company,dc=com/ ) Tue Aug 12 22:50:47 2014 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 12 22:50:47 2014 : Info: expand: ou=Users,dc=team,dc=company,dc=com -> ou=Users,dc=team,dc=company,dc=com Tue Aug 12 22:50:47 2014 : Info: expand: %{Stripped-User-Name} -> Tue Aug 12 22:50:47 2014 : Info: ... expanding second conditional Tue Aug 12 22:50:47 2014 : Info: expand: %{User-Name} -> joeuser Tue Aug 12 22:50:47 2014 : Info: expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=joeuser) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=Users,dc=team,dc=company,dc=com, with filter (uid=joeuser) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=corp,ou=Users,dc=team,dc=company,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] object not found Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Debug: rlm_ldap::ldap_groupcmp: Group ou=corp,ou=Users,dc=team,dc=company,dc=com not found or user is not a member. Tue Aug 12 22:50:47 2014 : Info: ? Evaluating (Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=company,dc=com/) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=corp,ou=Users,dc=team,dc=company,dc=com/ ) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=company,dc=com/ ) Tue Aug 12 22:50:47 2014 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 12 22:50:47 2014 : Info: expand: ou=Users,dc=team,dc=company,dc=com -> ou=Users,dc=team,dc=company,dc=com Tue Aug 12 22:50:47 2014 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=dev,ou=Users,dc=team,dc=company,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Aug 12 22:50:47 2014 : Debug: [ldap] object not found Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Debug: rlm_ldap::ldap_groupcmp: Group ou=dev,ou=Users,dc=team,dc=company,dc=com not found or user is not a member. Tue Aug 12 22:50:47 2014 : Info: ? Evaluating (Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=company,dc=com/) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++? if (Ldap-Group =~ /ou=dev,ou=Users,dc=team,dc=company,dc=com/ ) -> FALSE Tue Aug 12 22:50:47 2014 : Info: ++[chap] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[mschap] returns noop Tue Aug 12 22:50:47 2014 : Info: [suffix] No '@' in User-Name = "joeuser", looking up realm NULL Tue Aug 12 22:50:47 2014 : Info: [suffix] No such realm "NULL" Tue Aug 12 22:50:47 2014 : Info: ++[suffix] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[control] returns noop Tue Aug 12 22:50:47 2014 : Info: [eap] No EAP-Message, not doing EAP Tue Aug 12 22:50:47 2014 : Info: ++[eap] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[files] returns noop Tue Aug 12 22:50:47 2014 : Info: [ldap] performing user authorization for joeuser Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Aug 12 22:50:47 2014 : Info: [ldap] ... expanding second conditional Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: %{User-Name} -> joeuser Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=joeuser) Tue Aug 12 22:50:47 2014 : Info: [ldap] expand: ou=Users,dc=team,dc=company,dc=com -> ou=Users,dc=team,dc=company,dc=com Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 12 22:50:47 2014 : Debug: [ldap] performing search in ou=Users,dc=team,dc=company,dc=com, with filter (uid=joeuser) Tue Aug 12 22:50:47 2014 : Info: [ldap] No default NMAS login sequence Tue Aug 12 22:50:47 2014 : Info: [ldap] looking for check items in directory... Tue Aug 12 22:50:47 2014 : Debug: [ldap] userPassword -> Password-With-Header == "{MD5}hashreplaced" Tue Aug 12 22:50:47 2014 : Info: [ldap] looking for reply items in directory... Tue Aug 12 22:50:47 2014 : Info: [ldap] user joeuser authorized to use remote access Tue Aug 12 22:50:47 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 12 22:50:47 2014 : Info: ++[ldap] returns ok Tue Aug 12 22:50:47 2014 : Info: ++[expiration] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[logintime] returns noop Tue Aug 12 22:50:47 2014 : Info: ++[pap] returns updated Tue Aug 12 22:50:47 2014 : Info: Found Auth-Type = PAP Tue Aug 12 22:50:47 2014 : Info: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel Tue Aug 12 22:50:47 2014 : Info: +- entering group PAP {...} Tue Aug 12 22:50:47 2014 : Info: [pap] login attempt with password "password" Tue Aug 12 22:50:47 2014 : Info: [pap] Using MD5 encryption. Tue Aug 12 22:50:47 2014 : Info: [pap] Normalizing MD5-Password from base64 encoding Tue Aug 12 22:50:47 2014 : Info: [pap] User authenticated successfully Tue Aug 12 22:50:47 2014 : Info: ++[pap] returns ok Tue Aug 12 22:50:47 2014 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel Tue Aug 12 22:50:47 2014 : Info: +- entering group post-auth {...} Tue Aug 12 22:50:47 2014 : Info: expand: %{control:Tmp-String-1} -> Tue Aug 12 22:50:47 2014 : Info: ++[reply] returns noop } # server inner-tunnel Tue Aug 12 22:50:47 2014 : Info: [ttls] Got tunneled reply code 2 Filter-Id = "" Tue Aug 12 22:50:47 2014 : Info: [ttls] Got tunneled Access-Accept Tue Aug 12 22:50:47 2014 : Info: [eap] Freeing handler Tue Aug 12 22:50:47 2014 : Info: ++[eap] returns ok Tue Aug 12 22:50:47 2014 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Tue Aug 12 22:50:47 2014 : Info: +- entering group post-auth {...} Tue Aug 12 22:50:47 2014 : Info: ++[exec] returns noop Sending Access-Accept of id 16 to xxx.xxx.xxx.xxx port 32768 Filter-Id = "" MS-MPPE-Recv-Key = 0x85725d86e7ab1448510e48ba9b900cd3cbf3d7436f36f9b391dab4d35b3d69b1 MS-MPPE-Send-Key = 0x191e9e59df4f7108ac1542e48434330db030957911f7a3fb75ae40456057bf1f EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "joeuser" Tue Aug 12 22:50:47 2014 : Info: Finished request 9. Thank you for the help. I appreciate it. BTW if this does’t make sense I can provide more details as to what I am trying to do. I figured I would spare that unless needed. Thanks, Alex

4 11

postgres cisco freeradiusd voip
by Ciprian ARSENIE 17 Aug '14

17 Aug '14

Hello I want to thank you in advance to those I will answer this question. I have configured a RADIUS server with postgresql to store cdr of a cisco 3845 . So far everything has been pretty simple. my question is how do I calculate the length of the call betwen h323disconnecttime h323connecttime. can someone help me with some postgresql Selects to retrive duration o calls /day/week/mount

1 0

How freeradius logs Accounting?
by Mark jensen 17 Aug '14

17 Aug '14

I have configure free radius to authenticate users (using LDAP as back-end DB) it worked very well but there is a logging probem: the logged-in log:(radius.log) Sat Aug 16 13:53:29 2014 : Auth: Login OK: [Mark/<via Auth-Type = EAP>] (from client private-network-1 port 0 via TLS tunnel) Sat Aug 16 13:53:29 2014 : Auth: Login OK: [Mark/<via Auth-Type = EAP>] (from client private-network-1 port 5 cli F0-4D-A3-B1-34-16) Accounting: Sat Aug 16 14:02:56 2014 NAS-IP-Address = . . . . . . why the start-time record is different from the Timestamp in radius.log, or in other words when accounting logs start? another problem is when I logout as "Mark" and login as "Mike", it logs it successfully in radius.log: Sat Aug 16 13:53:29 2014 : Auth: Login OK: [Mark/<via Auth-Type = EAP>] (from client private-network port 0 via TLS tunnel) Sat Aug 16 13:53:29 2014 : Auth: Login OK: [Mark/<via Auth-Type = EAP>] (from client private-network port 5 cli F0-4D-A3-B1-34-16) Sat Aug 16 14:06:26 2014 : Auth: Login OK: [Mike/<via Auth-Type = EAP>] (from client private-network port 0 via TLS tunnel) Sat Aug 16 14:06:26 2014 : Auth: Login OK: [Mike/<via Auth-Type = EAP>] (from client private-network port 5 cli F0-4D-A3-B1-34-16) but it didn't log any thing in raddact that according to Mike, even after a while? what should I do?

2 2

postgresql freeradius for voip
by Ciprian ARSENIE 16 Aug '14

16 Aug '14

Hello I want to thank you in advance to those I will answer this question. I have configured a RADIUS server with postgresql to store cdr of a cisco 3845 . So far everything has been pretty simple. my question is how do I calculate the length of the call betwen h323disconnecttime h323connecttime. can someone help me with some postgresql Selects to retrive duration o calls /day/week/mount

1 0