- Freeradius-Users - lists.freeradius.org

Allow all MAC address
by Pascal Legrand 29 Nov '22

29 Nov '22

Hello, I use freeradius to limit the access to our network by filtering MAC address: XXXXXXXXXXXX Cleartext-Password := "XXXXXXXXXXXX", Machine-Name := "COMPUTER_1" When we receive new computers, we use the FOG software to deploy a clean image on all new computers. The problem is that we have not yet set up Freeradius to allow these news computers to access our network. My question is the following: is it possible to authorize punctually all MAC addresses to access the network while we recover them to configure Freeradius? The idea would be to add a line like : ALL_MAC_ADDRESS Cleartext-Password := "ALL_MAC_ADDRESS", Machine-Name := "NEW_MACHINE" Does Freeradius allow regular expressions in its configuration file? If yes, what should be the form of this regular expression? Thank you in advance for your help. Pascal

4 4

eap_peap error messages
by Stefan Paetow 24 Nov '22

24 Nov '22

Hi Alan et al, Just a quick question – when eap_peap encounters a TLS error, is that available in the Module-Error-Message? i.e. let’s take this example: (2) eap_peap: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (2) eap_peap: ERROR: System call (I/O) error (-1) Would the three ‘ERROR:’ messages be in &request:Module-Failure-Message (or &session-state: Module-Failure-Message)? I can’t particularly With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 On Mondays and Wednesdays, I am not available between 12:00 and 15:00. For eduroam support, please contact us via help(a)jisc.ac.uk and mark it for the eduroam team’s attention. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 2

oauth2 proxy mode
by Laurent Estevez 24 Nov '22

24 Nov '22

Hi, Do you have any feedback on oauth2* authentication and freeradius 3. I would like to connect MS Azure on a freeRaius standard package installation with this mode, but I am having problems implementing this module (error run freeradius service) Thanks in advance, * source : https://github.com/jimdigriz/freeradius-oauth2-perl

4 5

Is there something like a post-dhcp section?
by Hermann.Lauer＠uni-heidelberg.de 23 Nov '22

23 Nov '22

Hello All, is something like a post-dhcp section in the virtual dhcp server possible, i.e. executed after the packet type specific DHCP-Request or DHCP-Request section are finished, the reply is setup and the server had decided what to do with the request? Sorry if I missed that in the documentation. Thanks and greetings Hermann

2 1

Radius and port 77
by Pascal Legrand 23 Nov '22

23 Nov '22

Hello, i'm using radius authentication (freeradius) on alcatel switchs and i can see in freeradius logs this kind of message : Login OK: [XXXXXXXXXXXX/XXXXXXXXXXXX] (from client Switch port 77 cli XXXXXXXXXXXX) Does someone could explain me what means "port 77" As much I understand this notation : Login OK: [XXXXXXXXXXXX/XXXXXXXXXXXX] (from client Switch port 1021) As much i cant understand "port 77" Thanks for your help Pascal

2 1

Cannot increase open file descriptors above 1024
by Ibrahemoo Ghost 18 Nov '22

18 Nov '22

I use FreeRADIUS Version 3.0.20 as both proxy and (auth/acct) server. I have more than 80 realms with over 180 clients connected. Every one of them is redirecting to a different site file with separate sql module to a seperate database in the same db server. My problem is with this large amount of databases and tables i hit the fixed limit of 1024 open file descriptors and the radius.log file shows: mysql error: can't create unix socket (24) I double checked with: ls /proc/${freeradius_pid}/fd | wc -l it prints 1024 that's why I am sure its problem with the open files limit I tried to increase it manually but with no luck at all. Whenever I increase it the freeradius server stops working. So is there something I can do to increase the file descriptors limit ? Or am I doing something wrong?

4 11

Use “fast reconnect” to speed up repeat authentication requests
by uj2.hahn＠posteo.de 18 Nov '22

18 Nov '22

Hi, Alan and team! In your article https://networkradius.com/articles/2020/12/10/design-blueprint-for-universi… you describe the fast reconnect approach for universities. I was going to give it try but haven't found any docs describing how to do that. Or is this a solution you offer on a commercial base? Thanks for your help Regards Uwe

2 1

MSCHAP No logon servers are currently available (again, but solved)
by uj2.hahn＠posteo.de 16 Nov '22

16 Nov '22

Hi, all! I refer to this older thread with same subject: https://lists.freeradius.org/pipermail/freeradius-users/2021-August/100519.… I run into a similar issue and like to share the way I solved it: I implemented a Freeradius/AD solution some years ago in a school. (Win10 clients, MS server/AD in Azure cloud) This had been working fine all the time, but after the school installed some Microsoft updates to their clients Freeradius stopped working. No authorization was possible. I debugged it down to above error message when I run ntlm_auth manually (saw same message in FR debug log). Somehow the communication between Ubuntu based FR server and Windows server/AD was broken now. My guess was the the updated Windows environment needs an improved communication protocol with higher security level. So I upgraded Ubuntu to version 22.04 LTS to get a more recent Samba version (4.15.9). But this didn't help. I modified smb.conf as described in https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… , but this didn't help neither. Also a reboot of the FR Ubuntu server didn't help. But then I rejoined FR server to domain: net join -U admin (will prompt for password). The FR server has been part of the domain for years. But somehow this got broken. Not sure which of the actions above was root cause, but the "net join" command was finally the key. So don't forget it even though think you did it earlier already . Just to help others in case they run in same issue. Regards Uwe

2 1

Radutmp is empty
by Sébastien 65 16 Nov '22

16 Nov '22

Hi there, The radutmp file is still empty. The radwho command does not return any user... The radlast command is empty... I don't use MySQL. Here is the configuration I use for radutmp : /etc/freeradius/3.0/sites-available/default authorize { ... files ... accounting { ... radutmp ... session { ... radutmp ... I use NTRadPing to perform tests, the Radius server accepts my Authentication request without error... How to activate the logs ? Thanks

2 5

Use rest module differently for each site
by Matthew McTague 15 Nov '22

15 Nov '22

Hi there, I'm using FreeRADIUS 3.2.1 on AlmaLinux 8.6, from the NetworkRADIUS repo. I want to use the rest module for multiple sites, default and dhcp. I ideally want to change uri and data, which will contain different information for a BNG's RADIUS requests vs a DHCP relay sending DHCP requests to FreeRADIUS. Is there a way to duplicate the rest module, or configure additional sections with custom naming? I realise I could probably use a custom dictionary attribute, but I'd rather avoid this if possible. I'm confident there will be a better way to achieve this. Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

2 2