November 2009 - Freeradius-Users - lists.freeradius.org

Re: Book About Free-Radius Configurations
by INACIO ALVES 18 Nov '09

18 Nov '09

Thanks Alan Dekok, I think that I saw in your blog that you is writting a book about RADIUS. The project continues? And about the book http://www.amazon.com/Radius-Jonathan-Hassell/dp/0596003226/ref=pd_sim_b_3 do you know it? I'm need to buy some book to configure a freeradius server on my network. Thanks, Inácio Alves Bacharel em Matemática(UFC)/Técnico em Conectividade(IFCE) http://www.polluxweb.com/inacioalves/site

9 13

Re: Authenticate Many Sites on dynamic IPs through One Freeradius Server
by Charles (KOL) Goma 18 Nov '09

18 Nov '09

I have test-configured freeradius to work on my hotspot. It works fine and I am happy. I am planning to have about 17 of my sites authenticate through one freeradius server. These 17 HOTSPOTS are in different parts of the country and have dynamic IPs. 1. How do I configure that in clients.conf? 2. Bandwidth charges are different in most of the 17 sites. How can i set these billing difference in my setup. Any lead on these two will be highly appreciated. Charles

3 2

Expanding run-time variables and checking access_attr for allow
by Nicolás Velázquez 18 Nov '09

18 Nov '09

Hi all, We are running 2.1.3 and we'll upgrade soon for several reasons. Two of them can be the questions I'll explain now. We need to search the authorize check for users in one place of LDAP tree and the user password must be checked in another place. My config file is as follows: dictionary_mapping=/etc/raddb/ldapmap_vpn.conf ldap_connections_number=10 timeout=10 server="ldap://canela.ti.uam.es" port=389 identity="cn=uam_voip_admin,cn=users,dc=uam,dc=es" password="#######" base_filter = "(uniquemember=cn=%{User-Name},cn=users,dc=uam,dc=es)" basedn="dc=uam,dc=es" filter="(uid=%{Stripped-User-Name:-%{User-Name}})" default_profile = "cn=ACCESSO_CUDI,cn=Groups,dc=uam,dc=es" access_attr_used_for_allow = yes access_attr = "cn" The non-usual parameters to do what we need are base_filter and default_profile. But the problem is that base_filter doesn't expand. The debug shows us the process and base_filter doesn't expand. rad_recv: Access-Request packet from host 150.244.108.4 port 1025, id=69, length=158 User-Name = "nicolas.velazquez(a)uam.es" User-Password = "########" NAS-Port = 5259264 Called-Station-Id = "150.244.108.4" Calling-Station-Id = "150.244.2.23" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "150.244.2.23" NAS-IP-Address = 150.244.108.4 Cisco-AVPair = "ip:source-ip=150.244.2.23" server vpn_auth { +- entering group authorize {...} [suffix] Looking up realm "uam.es" for User-Name = "nicolas.velazquez(a)uam.es" [suffix] Found realm "uam.es" [suffix] Adding Realm = "uam.es" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [users_vpn] users: Matched entry DEFAULT at line 3 [users_vpn] expand: %{User-Name} -> nicolas.velazquez(a)uam.es [users_vpn] users: Matched entry nicolas.velazquez(a)uam.es at line 16 ++[users_vpn] returns ok [uam_vpn] performing user authorization for nicolas.velazquez(a)uam.es [uam_vpn] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [uam_vpn] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=nicolas.velazquez(a)uam.es) [uam_vpn] expand: dc=uam,dc=es -> dc=uam,dc=es rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap://canela.ti.uam.es, authentication 0 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as cn=uam_voip_admin,cn=users,dc=uam,dc=es/######## to ldap://canela.ti.uam.es rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=uam,dc=es, with filter (uid=nicolas.velazquez(a)uam.es) [uam_vpn] checking if remote access for nicolas.velazquez(a)uam.es is allowed by cn rlm_ldap: performing search in cn=ACCESSO_CUDI,cn=Groups,dc=uam,dc=es, with filter (uniquemember=cn=%{User-Name},cn=users,dc=uam,dc=es) rlm_ldap: object not found or got ambiguous search result [uam_vpn] default_profile/user-profile search failed [uam_vpn] looking for check items in directory... [uam_vpn] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [uam_vpn] user nicolas.velazquez(a)uam.es authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[uam_vpn] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop Found Auth-Type = UAM_VPN +- entering group UAM_VPN {...} [uam_vpn] login attempt by "nicolas.velazquez(a)uam.es" with password "#######" [uam_vpn] user DN: cn=nicolas.velazquez(a)uam.es,cn=Users,dc=uam,dc=es rlm_ldap: (re)connect to ldap://canela.ti.uam.es, authentication 1 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as cn=nicolas.velazquez(a)uam.es,cn=Users,dc=uam,dc=es/######## to ldap://canela.ti.uam.es rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [uam_vpn] user nicolas.velazquez(a)uam.es authenticated succesfully ++[uam_vpn] returns ok Login OK: [nicolas.velazquez(a)uam.es] (from client asa-vpn port 5259264 cli 150.244.2.23) } # server vpn_auth Sending Access-Accept of id 69 to 150.244.108.4 port 1025 User-Name = "nicolas.velazquez(a)uam.es" Class = "OU=########" Finished request 0. Is this a failure corrected in any of the versions form 2.1.3? Or am I doing anything wrong? The second question. If I put, ONLY FOR CHECK, the base_filter = "(uniquemember=cn=nicolas.velazquez(a)uam.es,cn=users,dc=uam,dc=es)" the LDAP replies with No Such Object. But the radius authorization sends ok. The misconfiguration of LDAP is not the question here. The question here is: documentation says if the parameter not exists the authorization doesn't work. Is the server using the cn string used in the request? Am I doing ANOTHER thing wrong? Thank you very much in advance, Nicolas Nicolás Velazquez Campoy Unidad Técnica de Comunicaciones Tecnologías de la Información. UAM http://rincon.uam.es/dir?cw=389407348632812

1 0

Re: help--- IPsec VPN on radius
by Yagnesh Dave 18 Nov '09

18 Nov '09

Hi, Found the problem, it is with the service type attribute. I am getting this error on the freeradius /usr/local/etc/raddb/users[24719]: Parse error (reply) for entry tatablue-vpn.vsnl.net: Unknown value outbound for attribute Service-Type How to rectify this problem of "outbound" service type. Regards, Dave On Wed, 18 Nov 2009 16:22:30 +0530 wrote >Hi, > > I am trying to configure this on Free Radius; > > # setup for IPSec VPDN, > ezvpn Password := "cisco" > Service-Type = outbound, > Cisco-Avpair = "ipsec:tunnel-password=cisco123", > Cisco-Avpair="ipsec:tunnel-type*esp", > Cisco-Avpair="ipsec:group-lock=1", > Cisco-Avpair="ipsec:key-exchange=ike", > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > > test@ezvpn Password := "test123" > Cisco-Avpair="ipsec:tunnel-type*esp", > Cisco-Avpair="ipsec:group-lock=1", > Cisco-Avpair="ipsec:key-exchange=ike", > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > Now, When I run the freeRadius, I get this error in the log file > > /usr/local/etc/raddb/users[24374]: Parse error (reply) for entry ezvpn: Unknown value outbound for attribute Service-Type > Errors reading /usr/local/etc/raddb/users > > > Please tell what is the correct config to get it working. > > Regards, > Dave. > >

1 0

Re: Algum brasileiro nessa lista?
by INACIO ALVES 18 Nov '09

18 Nov '09

Olá aos brasileiros, Sou mais um que está aprendendo (e tendo problamas) o FreeRADIUS. Espero que possamos trocar experiências e configurarmos de modo que o mesmo atenda nossas necessidades. Atualmente estou no básico sobre o protocolo RADIUS e nos primeiros passos com os arquivos de configuração do FreeRADIUS. Até mais. Inácio Alves Bacharel em Matemática(UFC)/Técnico em Conectividade(IFCE) http://www.polluxweb.com/inacioalves/site

2 1

help--- IPsec VPN on radius
by Yagnesh Dave 18 Nov '09

18 Nov '09

Hi, I am trying to configure this on Free Radius; # setup for IPSec VPDN, ezvpn Password := "cisco" Service-Type = outbound, Cisco-Avpair = "ipsec:tunnel-password=cisco123", Cisco-Avpair="ipsec:tunnel-type*esp", Cisco-Avpair="ipsec:group-lock=1", Cisco-Avpair="ipsec:key-exchange=ike", Cisco-Avpair="ipsec:addr-pool=hw-pool", test@ezvpn Password := "test123" Cisco-Avpair="ipsec:tunnel-type*esp", Cisco-Avpair="ipsec:group-lock=1", Cisco-Avpair="ipsec:key-exchange=ike", Cisco-Avpair="ipsec:addr-pool=hw-pool", Now, When I run the freeRadius, I get this error in the log file /usr/local/etc/raddb/users[24374]: Parse error (reply) for entry ezvpn: Unknown value outbound for attribute Service-Type Errors reading /usr/local/etc/raddb/users Please tell what is the correct config to get it working. Regards, Dave.

1 0

Re: Freeradius-Users Digest, Vol 55, Issue 80
by Gilbert Lo 18 Nov '09

18 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Accounting : Alvarion WiMax Base Station as NAS
by Sylvain De Muynck 17 Nov '09

17 Nov '09

Thanks for your prompt reply, I am trying to contact technical support team from Alvarion to get more documentations and support however it looks like it is not going to be easy regarding all your replies. Ah.. Alvarion as NAS..! By the way, for those who tried it, was the session time-out (authentication part) working ? Regards Sylvain Sylvain De Muynck Executive assistant to VAS/ISP and head of Operations Millicom Lao Co., Ltd. (Tigo Lao) 14 Lane Xang Avenue, PO Box 4693 Vientiane, Lao PDR Tigo: +856 207 800 563 Office: +856 207 800 700 Fax: +856 207 800 701 Email: sylvain.demuynck(a)tigolao.com -----Original Message----- From: freeradius-users-bounces+sylvain.demuynck=tigolao.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+sylvain.demuynck=tigolao.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, November 18, 2009 4:49 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 55, Issue 77 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Authenticating in a Debian lenny through freeradius (Wagner Pereira) 2. Re: Nas update with DynDNS (????????? ?????) 3. RE: SSID based authentication (Garber, Neal) 4. RE: Accounting : Alvarion WiMax Base Station as NAS (Ben Wiechman) 5. Re: Authenticate Many Sites on dynamic IPs through One Freeradius Server (Charles (KOL) Goma) 6. Re: Book About Free-Radius Configurations (INACIO ALVES) 7. Re: Book About Free-Radius Configurations (Marinko Tarlac) 8. adding eap-tls/peap/ttls support to freeradius problem (Tomas Pelka) ---------------------------------------------------------------------- Message: 1 Date: Tue, 17 Nov 2009 10:14:59 -0200 From: Wagner Pereira <wpereira(a)pop-sp.rnp.br> Subject: Authenticating in a Debian lenny through freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4B0293C3.8030606(a)pop-sp.rnp.br> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi, What should I edit in a Debian lenny aiming to authenticate my user in another server running freeradius (via PAP method, according to Alan Dekok in http://deployingradius.com) Thanks. -- Wagner Pereira PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo http://www.pop-sp.rnp.br (11) 3091-8902 ------------------------------ Message: 2 Date: Tue, 17 Nov 2009 15:42:41 +0300 From: ????????? ????? <avkosykh(a)gmail.com> Subject: Re: Nas update with DynDNS To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <879ce10d0911170442n660b450u5b45628ba274526e(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" hi. try to use sites-available/dynamic-clients. i'm use this fearture, add new client to mysql table and don't need to restart radius. ? ?????????, ????? ????????? 2009/11/17 Fahd Kasri <fahd.kasri(a)weblib.eu> > To avoid restarting radiusd everytime the Nas table is updated, I want to > use something similar to DynDNS. Does radiusd cache the domain's IP address > at startup or does it resolve the domain name every time? > > -- > Fahd > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Accounting : Alvarion WiMax Base Station as NAS
by Sylvain De Muynck 17 Nov '09

17 Nov '09

Dear All, As everyone already tried to use BreeMax Alvarion BTS as NAS for the freeradius ? I got trouble for the accounting part of it : * Cannot see upload/download (acct-input/output-octets) * Total time is always equal to 0 * No interim updates (even if Acct-Interim-Updates configured) It seems like I should configure this on my NAS however I do not know how could I do it. Thanks in advance for your advises, Let me know if you need for details regarding my architecture, Regards Sylvain

3 2

SSID based authentication
by Peter Carlstedt 17 Nov '09

17 Nov '09

Hello everyone. As you know by now I am the one asking alot of questions but if you dont ask you dont learn;) Well I have been searching the net for an answer but have not found any. I described in my lastest question how to get SSID authentication to work but I missed on important thing. If I want an enduser to be able to connect to the same SSID on multiple AP´s then I can not use "Called-Station-ID" since it also includes information about the mac address for a specific AP. So how do I do to be able to authenticate by just using the SSID and not the mac address for a specific AP? Im using mikrotik and it do not have dynamic VLAN so I will have to bind a VLAN per SSID. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1