December 2006 - Freeradius-Users - lists.freeradius.org

Mulitple sql groups
by Stavros Patiniotis 08 Dec '06

08 Dec '06

Hi all, If I have mulitple sql groups, radgroupreply items that are returned are not restricted to the groups which the radgroupcheck items match. It seems that the first row of the radgroupreply table is returned to the nas (as long as the user is a member of this group however EVEN if the radreplyceck items do not match for this group). I assume that this is not correct? Is there therefore a way to get multiple sql groups to work correctly? Cheers, Stavros EscapeNet

2 3

help
by John Wan 07 Dec '06

07 Dec '06

Hi All, My freeradius version is 1.3 I have managed to get the freeradius and the chillispot on my Linux EL 4.0 box, with the user name and password in the file "/etc/raddb/users" and everything works fine. But I would like to use the Windows 2k3 AD to authenticate the username and password instead of using the user name and password from the file "/etc/raddb/users" or in mysql. Alexandre Coninx (From: freeradius-users(a)lists.freeradius.org) claimed : " I authenticate the users against a Windows (AD) domain with PEAP +MSCHAPv2 + ntlm_auth. It works well." which you can find from the following webpage: http://lists.cistron.nl/pipermail/freeradius-users/2005-April.txt I would like to have some documentation/procedures to configure my freeradius to authenticate the username and password from the Windows 2k3 AD instead of from the file "/etc/raddb/users" or the mysql database. Any idea? Please help. Many thanks in advance. John -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

FreeRadius Framed-IP-Address
by Daniel Romero 07 Dec '06

07 Dec '06

Hi. I have freeradius working with eap/peap. The users can autenthicate them, but the Framed-IP-Address don't work, they can't get an ip address... but, if I connect an DHCP to the network, all work fine: authentication->get address-> network access What can be wrong with the Framed-IP-Address??? This is an example of successfuly connection: ... Sending Access-Accept of id 44 to 192.168.100.185 port 1391 Framed-IP-Address := 192.168.100.211 Framed-IP-Netmask := 255.255.255.0 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Type:0 := VLAN MS-MPPE-Recv-Key = 0x1714c6bb40821fd973e97f7bbfa7a05110206fb083138414a453fb4c08ab3b56 MS-MPPE-Send-Key = 0x6d7baa66c5cea48be8998e1bf9b04a46ae59905700e923b6f9a1462da7ce3b22 EAP-Message = 0x032c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "profesor01" Finished request 8

2 3

Global address pool
by Paul Khavkine 07 Dec '06

07 Dec '06

Hi folks. I'm looking into ways to implement a "global address pool" for multiple NASes and multiple RADIUS servers. I see that there's 2 possible ways of doing it with FreeRADIUS. 1) use rlm_ippool 2) use rlm_sqlippool I'm leaning towards rlm_sqlippool since it can be used to "lease" an address to a subscriber for a period of time so they get same ip address for the duration of the "lease". Is there any other ways to implement NAS independent address pool and be able to "lease" same address to a subscriber ? Is anyone using sqlippool in production ? Thanx Paul

2 1

RE: Problem with EAP/MD5 behind proxy
by Josh Howlett 07 Dec '06

07 Dec '06

You're stripping the realm at the proxy; add "nostrip" to the realm stanza defined in realms.conf for the server you're proxying to. Josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. > freeradius.org] On Behalf Of Hans Bornemann > Sent: 07 December 2006 10:57 > To: freeradius-users(a)lists.freeradius.org > Subject: Problem with EAP/MD5 behind proxy > > Hi, > > I run into this problem: > > Config: > > 802.1x client (Windows XP with 802.1x / md5 ) --> freeradius-proxy --> > freeradius-server > > Same prg-version on both server (1.1.0) > same radius.conf > same users file > > if i try to authenticate against the proxy without realm, > everything ist > o.k. > > if i try this with a realm the second radius-server shows this error: > > rlm_eap: Identity does not match User-Name, setting from EAP Identity > rlm_eap: Failed in handler > > > any ideas? > > Hans > > > -- > Hans Bornemann > Universitaet Dortmund - Hochschulrechenzentrum > Tel. ++49 231 755 2132 Fax. ++49 231 755 2731 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 5

Authentication registers on MySQL
by Felipe Neuwald 07 Dec '06

07 Dec '06

Hi Folks, I'm building a new freeradius server here, and I wanna make some implementations: 1. Log every authentication (sucessfull or not) to MySQL database; 2. but, log *only* the last 10 registers of authentication in database. The database connection is already working ok, and I'm retrieving the user information from radcheck table. Does anybody knows how to implement this? Thanks, Felipe Neuwald.

1 0

Error rlm_exec
by Serg Max 07 Dec '06

07 Dec '06

I can't start freeradius 1.1.3_1 on FreeBSD6 radius.log: Error: radiusd.conf[226] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid file format ??? Sergu

2 1

NAS Port always 0
by Tom Murphy 07 Dec '06

07 Dec '06

Hi, I'm using a linux box as the NAS. PPP connections come in and get fed to radiusclient which in turn contacts a FreeRADIUS 1.1.3 server. Some of the PPP connections are dynamic, most are static. I did set up ippool properly in FreeRADIUS, but it dishes out only 2 IP addresses. Doing some searching around, I discovered this is because the Nas-Port is always 0 (as evidenced by the radius log files). So it will only send those two addresses out because it "thinks" the same user is logging on each time? Is there a way to tell the pppd-radius plugin, or, radiusclient to use a different "NAS Port" when it sends the RADIUS authentication requests? The pppd-radius man page says I can use "map-to-ifname" or "map-to-ttyname" (I'm using PPP v2.4.4b1). However, looking at the source code for pppd-radius, in radius.c it appears the NAS Port is hardcoded as zero. Would it then, be up to radiusclient to send the NAS Port? It appears to only have facility for setting NAS Port from the tty, and that's not an option for me. Has anyone else had this similar problem? I need to get FreeRADIUS to actually dish out more than the same 2 IP addresses. Regards, Tom

3 4

Problem with EAP/MD5 behind proxy
by Hans Bornemann 07 Dec '06

07 Dec '06

Hi, I run into this problem: Config: 802.1x client (Windows XP with 802.1x / md5 ) --> freeradius-proxy --> freeradius-server Same prg-version on both server (1.1.0) same radius.conf same users file if i try to authenticate against the proxy without realm, everything ist o.k. if i try this with a realm the second radius-server shows this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity rlm_eap: Failed in handler any ideas? Hans -- Hans Bornemann Universitaet Dortmund - Hochschulrechenzentrum Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

1 0

SQL connections and radius restart
by Guido 07 Dec '06

07 Dec '06

The exactly question is, how could I detect when freeradius loses connection with the SQL and how can I reconnect it automatically. I have been reading "configurable_failover" and "supervise-radiusd.txt", but didn't find a way to do this. Thanks Guido >Guido wrote: > Hi list, I'm using freeradius with Ms-SQL. Freeradius can open > connections as many as are configured in mssql (num_sql_socks = 3). It > is ok, but when SQL go down, or when connection with SQL go down > freeradius can't connect to SQL until freeradius is restarted. So, I > need a way to rstart freeradius when any problem with SQL happens. Send a HUP signal to the server. Alan DeKok.

2 1