August 2006 - Freeradius-Users - lists.freeradius.org

(no subject)
by c k 14 Aug '06

14 Aug '06

I m using EAP-TLS as an authentication protocol.I want to authorize the clients in my network to access only certain protocol traffics.For some users i want to allow only http,while for others http and ftp.How can i create such kind of profiles and perform access control on routers.Sorry friends i m new to radius...plz help me out. --------------------------------- See the all-new, redesigned Yahoo.com. Check it out.

2 1

Re: Does Freeradius support IAPP (802.11f)??
by David Mitton 14 Aug '06

14 Aug '06

One should be aware that 802.11f has been deprecated by the IEEE. To use it requires support in all your Access Points and the RADIUS server(s). Windows IAS certainly does not support it. Using the hostap only helps if you are using that software for your APs. And it says "minimal". Exactly what that means should be discussed with the maintainer(s) of that software. I'm not aware of an availible implementation in commercial APs. But I would like to hear of any. (not sure that further discussion really belongs on this list) Dave. ----- Original Message ----- From: "zhu yunwu" To: "FreeRadius users mailing list" Subject: Re: Does Freeradius support IAPP (802.11f)?? Date: Fri, 11 Aug 2006 15:45:50 +0800 Thank you for your help. I have another question: 1) does the radius server provided by windows 2003 support the IAPP (802.11F)? if yes, how to configure it? 2) Is IAPP function in hostapd able to work properly without further development? On 8/11/06, Alan DeKok <aland(a)deployingradius.com> wrote:"zhu yunwu" <zhuywtwin(a)gmail.com> wrote: > Now I am using the Freeradius. Could you tell me whether IAPP ( > 802.11f) is really suppported in Freeradius? No, sorry. > if not,could you please kindly advise that > what kind of radius server support IAPP and how to configure it? http://hostap.epitest.fi/ It has documentation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Reject packet with zero length
by muralidhar.gangaraju＠wipro.com 13 Aug '06

13 Aug '06

Hi all, We are using FreeRADIUS server for one of our requirements and we saw freeradius server sending a reject packet with zero length attributes. Could anybody of u can help me in understanding in what circumstances FreeRadius server will send a reject packet with zero length attributes in between the access challenges OR access requests. In the normal scenario when the password or certificate mismatch is found the FreeRADIUS sends an access-Reject packet with EAP-Message and message Authenticator. But in the below case it does not send any attributes. One such instance where we observed radius server sending reject packet with zero attributes is as follows. Going to the next request Cleaning up request 17 ID 243 with timestamp 44dd6e90 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 246 to 10.201.114.29:1050 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.201.114.29:1050, id=165, length=158 NAS-IP-Address = 10.201.114.147 NAS-Port = 2 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = 128 Called-Station-Id = "60-c4-b6-48-80-00:" Calling-Station-Id = "fc-50-d1-ba-70-00" NAS-Port-Id = "fc-50-d1-ba-70-00" State = 0xe92296731885b23183f47834fb748272 User-Name = "root" EAP-Message = 0x020500060d00 Message-Authenticator = 0x035037019647238daa63c6f29829afd2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 modcall[authorize]: module "preprocess" returns ok for request 20 modcall[authorize]: module "chap" returns noop for request 20 modcall[authorize]: module "mschap" returns noop for request 20 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" Please let me know if u need any more information. Thanks in advance. Regards, G Muralidhar Raju. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

freeradius web manage
by Marwan Sultan 13 Aug '06

13 Aug '06

Hello Everyone, Would please anyone recommend for me any interface web package that allowes me to controll and manage freeradius users ? I'm on freebsd 6.1, mysql 4.1 ChilliSpot and freeradius. I tried myprepaid but its so buggy. So anyone knows about similar interface please? Marwan Sultan. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

Unresponsive child
by Matt Dunkin 12 Aug '06

12 Aug '06

After some recent changes to my rlm_perl perl script I am getting the following messages all the time... Tue Aug 8 08:08:50 2006 : Error: WARNING: Unresponsive child (id 2966633392) for request 28 Tue Aug 8 08:08:50 2006 : Error: WARNING: Unresponsive child (id 2977528752) for request 27 Tue Aug 8 08:08:50 2006 : Error: WARNING: Unresponsive child (id 2988153776) for request 25 Usually after a lot of these radius will crash and will need to be restarted. I was receiving the sql running out of connections error but I am not getting those anymore after tuning my tables. I don't believe at this point that this is a mysql issue however any suggestions would be appreciated. I do access mysql from my perl script so that could be the problem. Each function in the perl script opens a mysql connection then closes it before finishing the function. Could this be the problem? Should I create an initial connection and use it throughout the script? Thanks Guys, I know you will know what the problem is.

4 5

Nas with dynamic IP address
by Ludovic Toussaint 12 Aug '06

12 Aug '06

I have freeradius with mysql and chillispot. The freeradius works with a static ip address, but most of the Nas are behind dynamic public IP adress as they are connected with Xdsl. Does it possible to check Nas validity not with their IP adsress but with their Mac Address. I actully set up a Nas in sql with IP 0.0.0.0/0. it works, but i think it s not safe. Thanks in advance for your help.

2 1

Radius Dial Up Admin
by Faisal Butt 12 Aug '06

12 Aug '06

Hi, I am installing FreeRadius 1.12 with Dial Up Admin...Can anyone provide or hint the procedure for Dial Up admin? Thanks. Best Regards, M. Faisal

2 1

installation dirs on debian
by YvesDM 12 Aug '06

12 Aug '06

Hi, Just starting with freeradius. I'm confused about installation directories. I'm trying to install freeradius on debian stable. When I install using apt-get (installs 1.0.2 currently), I get freeradius installed in /etc/freeradius. When I install the same version using the tar.gz it gets installed in /usr/local/etc/raddb/ Why is that? The docs show me that /etc/freeradius is the new installation dir. If I want to use the tar.gz and compile myself, do I have to change the dir's by hand or is there an easier way to do this? I've looked into the debian directory in the tarball, but it doesn't learn me anything about this. Can someone point me to the right direction? Many tnx yves

6 15

Authenticate users from multiple realms on the same NAS
by Scott Lambert 11 Aug '06

11 Aug '06

Hi, I've been using GNU-RADIUS and asked this question on the GNU-RADIUS list last week but didn't get any responses. The ISP I work for has recently aquired two other local ISPs. None of the ISPs have their customers setup to authenticate with username@realm. I need to merge dial-up numbers and bring the DSL aggregation together in order to reduce costs. That means, I will have potentially three users with the username of "bob" trying to login on the same NAS box with no way to tell which one they are other than the password the user supplies. The NAS address and everything else I can think of will be the same for all users. (we lack caller-id features). Is it possible to setup radius to authenticate these users? I'm willing to switch RADIUS servers if someone has a nifty module that makes magic happen. I've been skimming through the FreeRADIUS mailing list and trying to search google for pointers on how to accomplish this. Unfortunately, the search terms I have been trying are pretty much useless. "multiple realms", "multiple domains" combined with or without "one NAS", "same NAS" ... If anyone has pointers to documentation that tells me why it can't be done or how to do it, or even a "hey stupid, it's not that complicated", I would appreciate the help. -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

3 8

Fw: to install Radius without CA
by Aldo Carranza 11 Aug '06

11 Aug '06

----- Original Message ----- From: Aldo Carranza To: freeradius-users(a)lists.freeradius.org Sent: Wednesday, August 09, 2006 7:17 PM Subject: to install Radius without CA I want know how to install Radius without CA, only that Users authenticate, Without interacting with the client. Thanks very much Aldo Carranza -------------------------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0