February 2009 - Freeradius-Users - lists.freeradius.org

RADIUS attributes: acctoutputoctects and acctinputoctect in mikrotik
by Santiago Balaguer García 19 May '09

19 May '09

7 7

freeradius mysql apache2 for Wi Fi hotspotsetup
by Mini Jerome 19 May '09

19 May '09

Hi, I have installed free radius to work with mysql on Ubuntu 6.0.6 with radiusclient Nomadicx AG 2000 and it works fine. At present on Nomadix , internal web server is on and it gives the login and logout pages whenever a mysql databse username and passwords are submitted ,session starts on radius server I would like to make the login/logout pages from an external web server instead of internal webserver of nomadix which is configured on Nomadix and restrict users to go to loginpage forcefully , whenever the wifi customer has been assigned dynamic IP from Nomadix. Can any one help????//???????? Mini Jerome

3 2

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

debug log and syslog
by Jehan PROCACCIA 03 Apr '09

03 Apr '09

hello I can run debug log by starting radiusd -X , but for production, I want logs to go to a file and not stdout . When I start radiusd without -X I only get very few logs, how can I have equivalent to -X log with syslog or a log file ? or a least get more log the the very few ones I get with that config: /etc/raddb/radiusd.conf log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radiusd.log } It's a freeradius-2.0.3-3.el5 on a centos 5 for now with that config I only get 2 lines in radiusd.log when I log in 802.X EAP-ttls , telling: Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [procacci] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [anonymous] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) with radius -X I get a lot more, can I have at least more than these 2 lines ? thanks .

5 8

Bandwidth limit
by Gunza 20 Mar '09

20 Mar '09

Dear All, I have installed Mikrotik Router OS server for PPPoE and I have installed Ubuntu Server 8.10 with Freeradius+My Sql server. I want to create user with bandwith limit in mysql database. Anybody please help me.

5 7

Reloading CRL for EAP-TLS
by Jan Tomasek 13 Mar '09

13 Mar '09

Hi, I'm trying implement freeRadius for users using EAP-TLS. My eap.conf: > eap { > ... > > tls { > private_key_file = /etc/ssl/private/radius.etest.cesnet.cz.key.pem > certificate_file = /etc/ssl/certs/radius.etest.cesnet.cz.crt.pem > > CA_path = /etc/ssl/certs/ > > fragment_size = 1024 > > include_length = yes > > check_crl = yes > } > When CRL is changed on disk during freeRadius is running it never notices changed version and still uses older cached. This behavior come from OpenSSL I guess. For my implementation is this serious problem. Complete restart of freeRadius will break ongoing EAP sessions and introduce random problems with service for users I found mailing list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg31354.… When I try send HUP signal to running freeRadius it crashes with return code 1 in case it didn't process any request. Log output is in file crash1.log When I send HUP signal to running freeRadius which processed several requests it survive and crash with segfault after receiving first request after the HUP signal. Log output is in crash2.log I was testing with freeRadius version 1.1.4 and 1.1.7 both with same result. Is there chance to get this fixed? Best regards -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

4 6

NLTM_AUTH (PAP) and MS-CHAP2 together?
by Mike Diggins 10 Mar '09

10 Mar '09

After getting NTLM_AUTH working using PAP, I decided to try the MS-CHAP2 as well and that appears to work, but I had to remove the line "DEFAULT Auth-Type := ntlm_auth" from my users file. When I do that MS-CHAP2 works, but PAP doesn't. I will have various radius clients, some of which support MS-CHAP2, but some do not. How can I use both together? My users will be connecting to both services, so defining a specific AUTH-TYPE for each user won't work. -Mike

3 6

Conversion to Version 2
by Doug Hardie 09 Mar '09

09 Mar '09

I have been using FreeRadius 1.x for a number of years. It has worked just fine. All I am using it for is to authenticate and authorize dial-in users (its about as simple as you can get). The only unusual item is I have a couple of fairly complex modules for authorization and accounting. The question is should I bother to upgrade to 2.x. I don't have a need for any of the new features it provides. I don't even use most of the features in 1.x. My largest concern is the modules. I don't recall seeing anything here about what changes would be required for them other than I believe they have to be compiled with the server. Currently the modules are compiled separately and placed in /usr/local/lib and everything just works.

4 20

Realms and Accounting
by liran tal 08 Mar '09

08 Mar '09

Hey, Regarding realms handled in the local server (mysql) and accounting... I have defined realms in the users file such as: DEFAULT Realm == "example.com", Autz-Type := SQL_EXAMPLE and in radiusd.conf I add in authorize { } Autz-Type SQL_EXAMPLE { sql_example } and as expected authentication works just fine by looking up in the current database. To enable accounting for both realms I have done the same thing in radiusd.conf for the accounting { } module: Acct-Type SQL_EXAMPLE { sql_example } Although this is defined no accounting records are saved in the database. I am wondering if I'm missing something else like adding the Acct-Type to the users file too, such as: DEFAULT Realm == "example.com", Autz-Type := SQL_EXAMPLE, Acct-Type := SQL_HOTELNOVA Regards,

2 4

Two factor authentication to both LDAP directory and SecurID
by Greg Vickers 03 Mar '09

03 Mar '09

Hi all, Firstly, this relates to a question asked for our project by Amy Hawke: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-January/msg… Since the above conversation, I've had an email discussion with Alan DeKok and clarified a few things - it seems that what we want to do is achievable with FreeRADIUS so I'd like to ask the list. Situation: We have an existing LDAP directory which holds username and password information. We purchased RSA's SecurID with the intention of implementing a second factor of authentication to be used in conjunction with our existing username and password. At the time, it was not realised that the intention of SecurID is to replace your existing source of authentication information - which will not be doing! Scenario: To pilot the SecurID product, we selected VPN access to a part of our network, protected by a Cisco ASA5500 series device. We are in the process of moving away from the MS IAS RADIUS solution to FreeRADIUS. We know that MS IAS cannot do what we want to do. What we want to do: When a user attempts to access the VPN, have them provide their username/password as well as (their same) username and tokencode from their SecurID fob. It is OK if they provide the password and tokencode separately or together. (I spoke to the folks at Radiator, and they have a programming ability in their RADIUS server to chop up the password field before it's authenticated, i.e. have the tokencode and password provided in the same field at the client, then take the first eight characters of the 'password' field, send that string plus the username to SecurID via RADIUS, and the rest of the characters from the 'password' field and the username to our LDAP directory.) Ideally we would prompt them for username, password and tokencode at the same time. Can FreeRADIUS do this (it seems that Access-Challenge is exactly what we want: http://en.wikipedia.org/wiki/RADIUS#AAA) or a similar thing to solve our requirement? Thanks, -- Greg Vickers Phone: +61 7 3138 6902 IT Security Engineer & Project Manager Queensland University of Technology, CRICOS No. 00213J

2 6