June 2009 - Freeradius-Users - lists.freeradius.org

[freeradius] fail-over ldap + reply-item missing
by François Mehault 09 Jun '09

09 Jun '09

Hi all I try to do a fail-over with two ldap on my freeradius. I read this article http://wiki.freeradius.org/Fail-over, I instantiated two openldap modules and i use the keyword redundant in my /raddb/site-available/default in authorize and authenticate section. redundant { Primary-ldap Secondary-ldap } I also enabled reply_log When the two ldap are launched, it works. reply log : Tue Jun 9 11:45:53 2009 Packet-Type = Access-Accept Reply-Message = "Utilisateur: fmehault, group: Administrateur" Cisco-AVPair = "shell:priv-lvl=15" Service-Type = NAS-Prompt-User But if i stop the Secondary-ldap, I have just : reply log : Tue Jun 9 11:49:19 2009 Packet-Type = Access-Accept I can see in my log that radiusd try to contact Secondary-ldap at first. Why ? Then it test 3 times, rather than test Primary-ldap, why ? I will be please to give you more information about my problem to help me to fix it, ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.4:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.4:389 rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 [...] rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server [...] rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server resume : Primary-ldap started Secondary-ldap started It works Primary-ldap stoped Secondary-ldap started It works Primary-ldap started Secondary-ldap stoped Access-Accept without reply-item ... If someone can explain me what is my problem Regards, François

2 3

freeradius mysql configuration problem
by kalesameer 09 Jun '09

09 Jun '09

hi, I am not able to configure freeradius to use mysql.The output of radiusd -X command is shown below. Can anyone tell me what my mistake is?? [root@localhost mysql]# radiusd -X FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Apr 5 2009 at 21:27:58 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 102.168.0.100 { require_message_authenticator = no secret = "testing123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 0 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[152]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } Errors initializing modules [root@localhost mysql]# -- View this message in context: http://www.nabble.com/freeradius-mysql-configuration-problem-tp23929645p239… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 5

h3c:Framed-IP-Address cisco:'Calling-Station-Id'
by miaowang 09 Jun '09

09 Jun '09

hello: i have a h3c route and a cisco route,i want to set a user only can telnet to this two route from a PC with ip address 192.168.1.22,but h3c route use Framed-IP-Address = 192.168.1.22, CISCO use Calling-Station-Id = "192.168.1.22" how to set in mysql radcheck? -------------------------------------------------------- 100, 'miaowang', 'Framed-IP-Address', '==', '192.168.1.21' 101, 'miaowang, 'Calling-Station-Id', '==', '192.168.1.21' ---------------------------------------------------- the value upon is error ,how to config ? thanks ! miaowang Packet-Type = Access-Request Tue Jun 9 13:24:15 2009 NAS-IP-Address = 192.168.1.4 NAS-Port = 1 Cisco-NAS-Port = "tty1" NAS-Port-Type = Virtual User-Name = "miaowang" Calling-Station-Id = "192.168.1.22" User-Password = "111111" Client-IP-Address = 192.168.1.4 Packet-Type = Access-Request Fri Jun 5 09:48:31 2009 NAS-IP-Address = 192.168.1.15 NAS-Identifier = "Quidway" NAS-Port = 40961 NAS-Port-Type = Ethernet Framed-IP-Address = 192.168.1.22 User-Name = "miaowang" Calling-Station-Id = "0000-0000-0000" Service-Type = Login-User Login-IP-Host = 192.168.1.15 Framed-MTU = 1500 User-Password = "111111" Client-IP-Address = 192.168.1.15 2009-06-09 miaowang

2 1

PPTPD Bandwidth Shaping
by Neville 08 Jun '09

08 Jun '09

Hi everyone, I was hoping for a few pointers on this... My setup is <internet><freeradius><ppp><work> This is working fine with the exception of Bandwidth Shaping. Basically, I want to create my own ATTRIBUTES for setting Max-UP / Max-Down and use ip-up.local to "AWK" these attributes from if [ -f /var/run/radattr.$1 ] then DOWNSPEED=`/bin/awk '/Max-Down-Limit/ {print $2}' /var/run/radattr.$1` UPSPEED=`/bin/awk '/Max-Up-Limit/ {print $2}' /var/run/radattr.$1` #echo $DOWNSPEED #echo $UPSPEED #echo $FILTERS /sbin/tc qdisc del dev $1 root > /dev/null /sbin/tc qdisc del dev $1 ingress > /dev/null ##### speed client->server if [ "$DOWNSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 handle ffff: ingress /sbin/tc filter add dev $1 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate ${DOWNSPEED }kbit burst 12k drop flowid :1 fi fi I've tried to use the following attributes from chillispot as a reply attribute, ChilliSpot-Bandwidth-Max-Down := 500, but I get the following error :- rlm_sql: Failed to create the pair: Invalid octet string "500" for attribute name "ChilliSpot-Bandwidth-Max-Down" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user I've also copied dictionary.chillspot to /usr/share/radiusclient-ng as:- VENDOR ChilliSpot 14559 BEGIN-VENDOR ChilliSpot ATTRIBUTE ChilliSpot-Max-Input-Octets 1 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Output-Octets 2 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Total-Octets 3 integer ChilliSpot ATTRIBUTE ChilliSpot-Bandwidth-Max-Up 4 integer ChilliSpot ATTRIBUTE ChilliSpot-Bandwidth-Max-Down 5 integer ChilliSpot ATTRIBUTE ChilliSpot-Config 6 string ChilliSpot ATTRIBUTE ChilliSpot-Lang 7 string ChilliSpot ATTRIBUTE ChilliSpot-Version 8 string ChilliSpot ATTRIBUTE ChilliSpot-OriginalURL 9 string ChilliSpot # Configuration management parameters (ChilliSpot Only) ATTRIBUTE ChilliSpot-UAM-Allowed 100 string ChilliSpot ATTRIBUTE ChilliSpot-MAC-Allowed 101 string ChilliSpot ATTRIBUTE ChilliSpot-Interval 102 integer ChilliSpot Not sure what else I'm missing as a majority of the internet search point to editing /etc/raddb/dictionary, but this is not there with freeradius 2.1.6 Any advise work be greatly recieved. Thx Nev

3 2

To proxy or not to proxy?
by Kanwar Ranbir Sandhu 08 Jun '09

08 Jun '09

Hi All, I'm going to have a fairly simple setup whereby two freeradius 2.1.6 servers will be configured as "primary" and "secondary" on the NAS. Each freeradius server will also be running mysql locally so that acct and auth will be handled on the same box. I'm going to use buffered-sql as well, just in case mysql goes down or has issues keeping up with updates. Based on what I've read and understood, it doesn't make much sense to me to use freeradius' proxy and home_server features in proxy.conf. I will have two realms, so I can configure those in proxy.conf. Other than that, I don't think I need any other feature (in proxy.conf). Is there a reason why I should consider using home servers and/or proxies? I guess I'm just trying to figure out if I'm shooting myself in the foot by not using them. Thanks, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 19:30:34 up 15 days, 20:40, 3 users, load average: 0.32, 0.13, 0.04

2 2

FreeBSD 7.2 vs Linux for mysql server
by Alexander Kosykh 08 Jun '09

08 Jun '09

Hi. Could you share your experience in question of choice an OS for mysql server and maybe some detail of configuration. Thank you. Best regards Alexander Kosykh

2 1

Authentication
by michel＠casa.co.cu 08 Jun '09

08 Jun '09

Hi I am newcomer to freeradius, I use the version is 1.1.3 release 1.4.el5 is coming in the repository of centos, my users are in the windows directory, I would like to authenticate users as follows michel(a)casa.co.cu. Excuse my English is very poor, appreciate any help Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

8 9

Re: Re: Reply-message and supplicant
by David Mitton 08 Jun '09

08 Jun '09

4 3

Remove AV pair in post_proxy/pre_proxy section
by R.Filatov＠ttk.ru 08 Jun '09

08 Jun '09

Hello! Example, this code based on rlm_perl don't work sub post_proxy { # For debugging purposes only delete $RAD_REPLY{"ERX-Ingress-Policy-Name"}; #return RLM_MODULE_OK; return RLM_MODULE_UPDATED; } Attribute ERX-Ingress-Policy-Name avalible in recive packet Best Regards Filatov Ruslan

2 1

How to activate the certificate revocation list I created
by Josh Hiner 08 Jun '09

08 Jun '09

Hello, I have been searching for documentation on activating a certificate revocation list I just created with openssl. It is a crl.pem signed by my ca cert. I just need freeradius to reference it so that the one certificate I revoked gets denied on authentication. Here is what I have so far in my eap.conf (I am running freeradius 2.1.3 on REHL) crl_file = ${raddbdir}/certs/makecertificates/issued/crl.pem check_crl = yes CA_path = ${raddbdir}/certs/makecertificates/issued/ Are these lines correct? Are any lines I have up there unnecessary? Also, do I need to have my CA certificate in the same directory as the crl.pem file? It seems to hint towards that in the eap.conf file. Thanks for any help

2 2