- Freeradius-Users - lists.freeradius.org

Control reject delay per-request?
by Phil Mayers 26 Feb '14

26 Feb '14

We have a radius virtual server that takes macauth requests. We know for sure it won't receive user traffic and/or dictionary attacks. But it's in the same process as another, which might. Can we set a control: item or similar to set the reject delay to some requests and not others? I'd rather not break it out into a separate process for this sole reason. Version is 2.2.3

2 1

Max-Daily-Session for current station only
by Lorenzo Milesi 26 Feb '14

26 Feb '14

Hi. I'd like to create a counter which is exactly like the Max-Daily-Session, but should count only the time consumed on the current Called-Station-Id only. This because using HuntGroups I'd like to allow the user to connect 1h from station A and 2h from station B. Having a look at the rlm_sqlcounter shipped with FR2 I find there are only three possible parameters to be used in the query, and this doesn't include the NAS. Any help on how to implement this counter? Thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 4

Freeradius 2.1 - Accouting packets mirring
by Antonio Modesto Amaral Sousa 26 Feb '14

26 Feb '14

Hello everyone, I'll apologize in advance for asking something that have been already asked in this list, but the answers for those previous questions couldn't help me a lot. I work at an ISP and we have an instance of Freeradius 2.1 that is responsible for accounting, authentication and IP address redistribution. We are testing a new equipment from Allot (Netenforcer) that can do traffic analysis and traffic shaping, in order for this equipment to work correctly and recognize our subscribers traffic, it needs to receive a copy of our radius accounting requests and responses, as I said before, I've found some information about 'copy-acct-to-home-server' file and radrelay, the problem is that in the comments in this file it says something about 'detail' file and stuff, I don't know nothing about it, I just know that my server is configured to store the accounting information into a mysql table, I just need it to send a identical copy of this packets to the appliance. What's the easiest way to do this without messing up with my current configuration? Thanks a lot. --

4 4

freeradius-3.0.1 ldap authenticate
by d zz 26 Feb '14

26 Feb '14

Is there a simple doc about configure ldap authenticate with freeraidus-3.0.1 ? I am confused about it. I've questioned the developer on Github https://github.com/FreeRADIUS/freeradius-server/issues/531, but it did not solve my problem. In "mods-available/ldap" # Note: set_auth_type was removed in v3.x.x # Equivalent functionality can be achieved by adding the following # stanza to the authorize {} section of your virtual server. # # ldap # if ((ok || updated) && User-Password) { # update { # control:Auth-Type := ldap # } # } So I add the stanza to virtual server, "radiusd -X" says Unknown value 'ldap' for attribute 'Auth-Type' I then add VALUE Auth-Type LDAP 1026 to "/usr/local/share/freeradius/dictionary.freeradius.internal", but "radiusd -X" says (0) Found Auth-Type = LDAP (0) WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. (0) Failed to authenticate the user. Any body can tell me a clear progress about configure ldap authenticate? Thanks very much.

7 14

How to avoid logging cleartext passwords upon unix authentication failures
by Gianni Costanzi 25 Feb '14

25 Feb '14

Hi, we're using Freeradius Version 2.2.0 to authenticate users against unix unsers/passwords stored on the freeradius server. We noticed that when a user authentication fails, the following line appears with the cleartext password within it: Tue Feb 25 11:36:49 2014 : Auth: [unix] invalid password "wrongPassword" Is it possible to tell the unix module not to log passwords? We already disabled authentication requests' logging in the main radiusd.conf file, but there seem not to be an option to disable authentication failures' logging for the unix module, am I wrong? Thank you for any help, Gianni Costanzi

3 3

log *** instead of actual User-Password in postauth_query
by Michael Weissenbacher 24 Feb '14

24 Feb '14

Dear List! I am wondering if there is a way to convert a password to a number of asterisk symbols (*) matching the length of the actual password using unlang. For obvious reasons i do not want to log the cleartext password in radpostauth. But i don't want to completely omit the field either. Changing the postauth_query in dialup.conf is pretty straightforward, but i could not figure out how to replace the password with the exact same number of * symbols. The best i could come up with so far is: %{%{#User-Password}:-0} Which outputs the length of the password as a number. Is there a straightforward way to achieve what i want? tia, Michael

2 2

EAP-PEAP drops attributes
by freerad＠spambin.de 23 Feb '14

23 Feb '14

Hi, I've set up a Cisco WLC carrying several SSIDs authenticating against freeradius using EAP-PEAP. I would like to make it so that specific users can only connect to some SSIDs. Requests contain the attribute "Airespace-Wlan-Id" which contains the numeric index of the SSID the request is associated to. I have therefore set up my users file like this: test1 Auth-Type == EAP, Airespace-Wlan-Id == 2, NAS-IP-Address == 192.168.225.110, Cleartext-Password := "test1" This, however, doesn't seem to work as freeradius seems to drop the Airespace-Wlan-Id attribute while processing the request. As can be seen in the debug trace (debug_fail.txt), the user is being matched at first ([files] users: Matched entry test1 at line 173) but isn't found later on. When I remove that one check from the users file leaving test1 Auth-Type == EAP, NAS-IP-Address == 192.168.225.110, Cleartext-Password := "test1" the request is being accepted (see debug_ok.txt). The reject is clearly coming from freeradius being unable to match the request against the users file therefore being unable to get to the cleartext password, but only when I'm checking the Airespace-Wlan-Id attribute. However, as can be seen, the attribute is present in the request and the user is matched at first, even for the failed attempt. This is freeradius 2.1.8 on Ubuntu 10.04, I'm not using inner-tunnel for EAP. I'm clearly missing something here, could somebody point me in the right direction? Thanks and regards, Bodo Bodo Bellut bodo(a)bellut.net | USE PGP! +-----------+ Stangefolstr. 17 Fax/Mobile: just ask | (key via server |\ O---m /| 44141 Dortmund Fon: +49-700-77-BELLUT | or on request) |/---------\| PGP: 768/FA18A639 AE 5A 47 40 5A A0 D6 15 8E 54 44 AA 8D DD 6E BD+-----------+

3 5

Reply-Message
by nicolas.clo＠ricoh-industrie.fr 21 Feb '14

21 Feb '14

Hi List, Actually, I catch MS-CHAP-Error by regex and I update Reply-Message with specific messages . I log this via sql ( module sql enable in inner-tunnel - Post-Auth-Type REJECT section) The problem is that I have two lines of logs errors, one with the good reply message and one with nothing because the module sql is present in inner-tunnel (Post-Auth-Type REJECT) and default server (Post-Auth-Type REJECT ) I would like to know is there a way to copy Reply-Message in inner-tunnel to Reply-Message in default virtual server in disable the module sql in inner-tunnel (Post-Auth-Type REJECT section ). My test show me that Reply-Message is cleaning when Freeradius pass from one to other virtual server. Thanks . Nicolas.

4 12

freeRADIUS client programming: AVPs for PEAP
by Prateek Fulzele 20 Feb '14

20 Feb '14

Hi, I am doing RADIUS client programming on embedded system which is going to act as an NAS for my RADIUS server. I got the PAP-MD5 working with the client library v1.1.6, but having some difficulties in using PEAP/MSCHAPv2. Can someone suggest me a list of AVPs (Attribute-Value-Pairs) for the PEAP support - their names and the possible order in which they need to get set in the request to the server. If there are any online FAQs/Tutorials for this, let me know. Thanks, Prateek

2 1

FreeRadius rlm_rest usage
by Justin Menga 20 Feb '14

20 Feb '14

Hi Are there any samples anywhere on how to use the RLM REST module? Thanks Justin

2 1