March 2006 - Freeradius-Users - lists.freeradius.org

RE: on the right track?
by Galloway, David Mr KRS 02 May '06

02 May '06

I just worked this out yesterday. Best way for me (I found) was to create two groups (one is pubnet-dialup the other is pubnet-extend) I set this in the /etc/raddb/users file # Authentication for pubnet-dialup group DEFAULT Auth-Type = System, Group == "pubnet-dialup" Fall-Through = 1 # authentication for pubnet-extend group DEFAULT Auth-Type = System, Group == "pubnet-extend" Fall-Through = 1 # Defaults for all framed connections. # # sets timeout for group "pubnet-dialup" DEFAULT Service-Type == Framed-User, Group == "pubnet-dialup" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 14400, Idle-Timeout = 1800, Fall-Through = Yes # Sets timeout for group "pubnet-extend" DEFAULT Service-Type == Framed-User, Group == "pubnet-extend" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 28800, Idle-Timeout = 1800, Fall-Through = Yes I authenticate against two groups. Then set the timeouts per each group (first is for 4 hours, second 8). Hope that helps. Regards, David Galloway Public Networks Administration KRS IT Network Operations Help Desk (805) 355-2444 Direct (805) 355-4512 -----Original Message----- From: freeradius-users-bounces+david.l.galloway=us.army.mil(a)lists.freeradius.org [mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradi us.org] On Behalf Of mbjohn(a)duke.edu Sent: Thursday, February 23, 2006 3:43 AM To: freeradius-users(a)lists.freeradius.org Subject: on the right track? Hello all! I've tried to search the web and the archives for an answer to this question and didn't come up with anything, so I hope I'm not duplicating a question that's already been answered. Currently, where I work, we run two modem pools. One pool is limited to certain users who are allowed to connect up to 8 hrs at a time. The other pool is for general users who are given 15 min to quickly check email or search for something on the web (fwiw, they're allowed to reconnect after their time is up....). As broadband has become more available, less and less users are using the modem pool. We still have a handful of people from both groups who are still using it. So, in the interest to provide the service for the people still using it while not paying for unused lines, we're trying to consolidate things. We have a Cisco AS5300 terminal server that already uses freeradius w/ kerberos to authenticate users. We would like to take that a step further and use freeradius to limit usage time based on the user name (certain users are allowed 8hrs while all others are given 15min). Looking over the config files in /etc/raddb, it appears the attrs file is just what I need to use. Would I be able to use a combination of huntgroups and the attrs file to accomplish what I need? I know in the documentation for the "fisp" entry, it talks about not having a Fall-Through entry. Does that mean it CANNOT have a Fall-Through entry, or that the given example does not? Am I on the right track with this, or should I look elsewhere? Thanks for your help! Brian - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

Client certs with MSCHAPV2 in PEAP
by Dave Huff 25 Apr '06

25 Apr '06

I would like to configure this setup using Freeradius. My WinXP client (Intel ProSET) supports this, but FR chokes on it when enabled. I've got PEAP-EAP-MSCHAPV2 working with just password authentication. I noted this http://www.opensubscriber.com/message/freeradius-users@lists.freeradius.org/ 1873393.html but was unable to figure out where the DEFAULT EAP-TLS-Require-Client-Cert := Yes should be set. Relative Linux/Freeradius noob, FC4/2.6.15-1.1831 Freeradius 1.0.4 Thanks, Dan H

5 10

WiFi & Mac address authentication
by Guillaume 13 Apr '06

13 Apr '06

Hi guys! I recently install a freeradius for test purpose in a WiFi environement. But, i still a a problem, and I hope that you will be able to help me. The radius server version is: 1.0.4. I try to set a mac authentication and a certificates based authentication, but in the freeradius.cnf i dont find any entry for loading a list of authorised MAC address. Is there any option to create it, or i have to configure this mac address list on each APs? thanks for your replies. Guillaume

4 10

Version 1.1.1 stops responding
by King, Michael 10 Apr '06

10 Apr '06

So I built 1.1.1 on Debian. After a period of so many hours (variable) it stops responding. (Sometimes 2hours, sometimes 16hours) Now here's where it get's weird, (and makes me suspect it might not be freeRADIUS at the root cause) If I stop and restart the freeRADIUS service, it continues to ignore RADIUS packets. But if I restart the server (hard reboot) it works fine. Till it stops responding again. Obviously this is not enough information to help you diagnose the problem. How do I gather that information? The box is a 233 Pentium with 64 megs of ram. Has about 15 AP's, with around 100 users (not simultaneous, maybe 30 simultaneous) So what's the suggested way of gathering more info? Running debug mode piping to a text file?

7 8

Re: dialup admin & ippool administraton
by Olaf Schäfer 10 Apr '06

10 Apr '06

> the sqlippool module in cvs does this.. This module sounds interesting - something I haven't take into my considerations keeping the dynamic ippool data in the sql-db, too. And it's obvious to do it this way using a primary and a backup server. But the configuration information like "range-start" etc. is still stored in the radiusd.conf. My idea was to put these configuration information for each ippool into the mysql-db. Some background information for better understanding :) My task is to migrate from MS-IAS to freeradius. Thus people are used to do administration tasks with a GUI. :) At least normal production administration tasks should be integrated within a GUI. Putting configuration information into a db would save the parsing and editing the radius.conf by dialup-admin scripts. best regards, Olaf

3 3

Re: dialup admin & ippool administraton
by Olaf Schäfer 05 Apr '06

05 Apr '06

> > > > But the configuration information like "range-start" etc. is still > > stored in the radiusd.conf. My idea was to put these configuration > > information for each ippool into the mysql-db. > > That may be harder to do. But if you can create a patch, it will be > welcome. I'm afraid this exceeds my abilities :( Thus I resigned to the fact and have started to parse the radiusd.conf via PHP. Olaf Schaefer

4 3

frontend for freeradius???
by Pelusa Vali 05 Apr '06

05 Apr '06

hi list, i have a question, are there any freeradius frontend to administer users, but which don't assume i have ldap or mysql?? my users are only in users file, i reviewed dialup_admin and php radius accounting tool, but both assume i have mysql or ldap, i just want some program with graphical interface to add users and passwords in freeradius, and if possible monitor them. are there something like that?? thanks. _______________________________________________________________ In what sea are the Gulf of Bothnia and the Gulf of Finland both located? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=171

3 4

Two times authorization and/or both proxying and serving
by Mark Supersonik 05 Apr '06

05 Apr '06

Sorry I forgot the subject !!! Here it goes again! Hi friends! I speak from the tongue of an engineering student in a research group trying to implement a RADIUS proxy system. My doubt is: can a freeradius server do first an authorization of a request throught a DB (i.e MySQL) and proxy then if so or reject it (if all isn't in rule)? I mean, summarizing: Can a request be authenticated/authorized for two times? We want only to accept access if each one of the two servers process the authentication successfully. Thanks in advance for all the support you can give us, hope to hear from you Marc (Nets Research Group [Pompeu Fabra University]) _________________________________________________________________ Dale rienda suelta a tu tiempo libre. Mil ideas para exprimir tu ocio con MSN Entretenimiento. http://entretenimiento.msn.es/

2 6

L2tp and fixed Framed IP Address for ADSL customers
by Adil Bikarbass 04 Apr '06

04 Apr '06

Hello All, I've just setup an L2tp tunnel with my ADSL service provider and would like to have some of my ADSL subscribers get a fixed IP address instead of the dynamically assigned IP Pool I'm using a Cisco 3845. The ADSL users are connecting just fine over the L2tp tunnel the issue is that they're getting dynamically assigned address from the Cisco IP pool even if a fixed IP is set on FreeRadius attributes Do you have any idea on how make this subscribers get the Radius Fixed IP instead of the dynamic one? Thanks In Advance -- |-Adil Bikarbass |-IT Manager, MTDS |-tel +212.3.767.4861 |-fax +212.3.767.4863 |-gsm +212.6.139. 4541 |-14, rue 16 novembre |-Rabat, Kingdom of Morocco

4 8

Separate query for authentication and authorization
by vignesh 03 Apr '06

03 Apr '06

Hello I want to have multiple queries in RADIUS (e.g. one for prepaid and one for postpaid users). can I do this in Free Radius, if yes how do I specify free radius to execute particular query. Also the authentication and authorization seems to call the same query. Can I have different query fro authentication and authorization. Thanks Vignesh

3 2