December 2008 - Freeradius-Users - lists.freeradius.org

freeradius mysql apache2 for Wi Fi hotspotsetup
by Mini Jerome 19 May '09

19 May '09

Hi, I have installed free radius to work with mysql on Ubuntu 6.0.6 with radiusclient Nomadicx AG 2000 and it works fine. At present on Nomadix , internal web server is on and it gives the login and logout pages whenever a mysql databse username and passwords are submitted ,session starts on radius server I would like to make the login/logout pages from an external web server instead of internal webserver of nomadix which is configured on Nomadix and restrict users to go to loginpage forcefully , whenever the wifi customer has been assigned dynamic IP from Nomadix. Can any one help????//???????? Mini Jerome

3 2

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

debug log and syslog
by Jehan PROCACCIA 03 Apr '09

03 Apr '09

hello I can run debug log by starting radiusd -X , but for production, I want logs to go to a file and not stdout . When I start radiusd without -X I only get very few logs, how can I have equivalent to -X log with syslog or a log file ? or a least get more log the the very few ones I get with that config: /etc/raddb/radiusd.conf log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radiusd.log } It's a freeradius-2.0.3-3.el5 on a centos 5 for now with that config I only get 2 lines in radiusd.log when I log in 802.X EAP-ttls , telling: Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [procacci] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [anonymous] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) with radius -X I get a lot more, can I have at least more than these 2 lines ? thanks .

5 8

Reloading CRL for EAP-TLS
by Jan Tomasek 13 Mar '09

13 Mar '09

Hi, I'm trying implement freeRadius for users using EAP-TLS. My eap.conf: > eap { > ... > > tls { > private_key_file = /etc/ssl/private/radius.etest.cesnet.cz.key.pem > certificate_file = /etc/ssl/certs/radius.etest.cesnet.cz.crt.pem > > CA_path = /etc/ssl/certs/ > > fragment_size = 1024 > > include_length = yes > > check_crl = yes > } > When CRL is changed on disk during freeRadius is running it never notices changed version and still uses older cached. This behavior come from OpenSSL I guess. For my implementation is this serious problem. Complete restart of freeRadius will break ongoing EAP sessions and introduce random problems with service for users I found mailing list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg31354.… When I try send HUP signal to running freeRadius it crashes with return code 1 in case it didn't process any request. Log output is in file crash1.log When I send HUP signal to running freeRadius which processed several requests it survive and crash with segfault after receiving first request after the HUP signal. Log output is in crash2.log I was testing with freeRadius version 1.1.4 and 1.1.7 both with same result. Is there chance to get this fixed? Best regards -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

4 6

Conversion to Version 2
by Doug Hardie 10 Mar '09

10 Mar '09

I have been using FreeRadius 1.x for a number of years. It has worked just fine. All I am using it for is to authenticate and authorize dial-in users (its about as simple as you can get). The only unusual item is I have a couple of fairly complex modules for authorization and accounting. The question is should I bother to upgrade to 2.x. I don't have a need for any of the new features it provides. I don't even use most of the features in 1.x. My largest concern is the modules. I don't recall seeing anything here about what changes would be required for them other than I believe they have to be compiled with the server. Currently the modules are compiled separately and placed in /usr/local/lib and everything just works.

4 20

sql insert via unlang
by Flamur Rogova 28 Jan '09

28 Jan '09

Hi, I have a couple of modules in this order, and I need to log only rejects(from each module) to sql, - check_password, "a1 User-Password := "a1" - check_maxoctets, "a1 Max-All-Octets := 100000" in my authorize section, I have this, ... check_password if(notfound) { # log notfound to sql, the line below gives error... "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" } check_maxoctets if(reject) { # log to sql... } ... When I start radiusd, it gives: ... rlm_fastusers: Loaded 3 users and 1 defaults /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to find module "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }". /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to parse "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" entry. /home/radius205/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules ... man unlang says it is possible to obtain results from db, but I need to execute only sql INSERT, is my syntax wrong ? Thanks, Flamur

7 10

mysql fail over
by Peter Ellens 22 Jan '09

22 Jan '09

Hi Everyone I've been trying to setup MySQL fail over with freeradius I've followed http://wiki.freeradius.org/SQL_HOWTO#Additional_Snippets But I get weird results. If I stop the first sql server service, freeradius starts to use the second sql server, as expected. But if I stop the entire first server (ie poweroff) freeradius still continues to try and use sql1, hanging... I have tryed this with real servers and with virtual servers, both react the same, if you take down the first sql service it will start to use the second, but if you power off or suspecd the first sql server, radius hangs trying to get to the server. I have tryed freeradius 2.1.0., 2.1.1 and 2.1.3, on redhat enterprise 4 compiled from source. Restarting freeradius it will notice the first sql server is down and use the second sql server. Can anyone confirm this behaviour? Any ideas how to get it working correctly? Secondly, I have been looking into sqlippool and MySQL fail over. We would really like to be able to use a read/write master and read only slave, but it looks to me that the sqlippool needs to be writeable to mark the IP address as used and avoid duplicate IP allocation. Can someone confirm this? Thanks Peter

2 3

Problem with freeradius.org website
by Karl Auer 21 Jan '09

21 Jan '09

Is anyone else experiencing problems with the freeradius.org website? I'm new to freeradius, so maybe this is normal for the site, but I'm getting massive waits (minutes) generally ending in timeouts. Both the addresses are pingable. The Wiki is OK, it's just the website at freeradius.org. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

9 26

rlm_sql_oracle and instant client 11.1 rpm install
by Alok Vimawala 03 Jan '09

03 Jan '09

Hello, I spent the last few days fighting to get FreeRadius 2.1.3 installed on a RHEL-5 box with the Oracle Instant Client + SDK rpm install. The Oracle client version is 11.1. Every time, I issued the configure command it would skip over building the rlm_sql_oracle module. I eventually modified the configure.in file in "./src/modules/rlm_sql/ drivers/rlm_sql_oracle/" I went ahead and created a patch for the directory in question, but I am not sure where to submit it to. I tried using the bugs.freeradius.org website, but it was unable to create an account (the system never emailed me with a password). If you folks can direct me to where I can do that, it would be most appreciated. Thanks, Alok ----------------------------------------------------- Alok Vimawala Senior Network Administrator Housing Information Technology Office University of Michigan avimawal(a)umich.edu

3 4

Group Authorization Question
by Mike Diggins 02 Jan '09

02 Jan '09

I have authentication working from my cisco ASA550 VPN appliance to a FreeRadius 2.1.1 server, using NTLM_AUTH for backend authentication. That all works. Now I need to add authorization into the mix. 1. On the Radius server, I want to add a group X with a list of authorized usernames. 2. On the VPN side, the user selects a profile, and logs in, but I only want members of group X to be able to connect to that profile, even if the authentication is correct. I have no idea how to make the connection between the group profile I select on the VPN side, with the group X on the radius side. I'm not even sure how (or where) to create such a group with freeRadius. Can anyone point me in the right direction? -Mike

5 7