July 2009 - Freeradius-Users - lists.freeradius.org

Request Items, Config/control Items; rlm_sql
by Michael Bryant 21 Jul '09

21 Jul '09

Hi, Using Freeradius 2.1.0 (debian package), with rlm_sql. I am trying to, in radcheck, set a value, which I can then compare against in radgroupcheck. When I try this, with a custom attribute in either raddb/dictionary , a VSA, or Tmp-String-* it seems to be appearing in the config items list, as opposed to the request one, so rlm_sql doesn't check against it. Any ideas how I can get this to work? Cheers --Mike

4 7

Server Log say user authenticate but modem shows error 691
by amritap sinha 21 Jul '09

21 Jul '09

Dear All, I have try to implement freeradius in RHCL 4 with my sql. My data base connected to the radius server properly and my radius server authenticate the user properly inside the network and outside the network. My problem is that when I try to connect any user through dial up connection my NAS and radius response and password authenticate(basically I using CHAP password for authentication) but modem shows error 691 in Windows XP O.S. Please any one help me with providing a suitable solution. Thanks & Regards Amritap Sinha

4 4

Radius Log authencate but error 691
by amritap sinha 21 Jul '09

21 Jul '09

Dear All, I have try to implement freeradius in RHCL 4 with my sql. My data base connected to the radius server properly and my radius server authenticate the user properly inside the network and outside the network. My problem is that when I try to connect any user through dial up connection my NAS and radius response and password authenticate(basically I using CHAP password for authentication) but modem shows error 691 in Windows XP O.S. Please any one help me with providing a suitable solution. I sent all the configuration file and radiusd –X out put in zip format. Thanks & Regards Amritap Sinha

1 0

Radius Authentication failure
by Vamsi Krishna Valiveti 21 Jul '09

21 Jul '09

Hi, I am using freeradius-server-2.1.4. I changed only the below files Users "iss" Auth-Type := Local, User-Password == "iss123" Clients.conf client 13.0.0.5 { secret = AricentRadius shortname = fs nastype = other With the above changes I am getting error marked RED . Please help WARNING: See "man rlm_pap" for more information. [files] users: Matched entry iss(a)future.com<mailto:iss@future.com> at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> iss(a)future.com<mailto:iss@future.com> attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 1 to 12.0.0.2 port 49153 Waking up in 4.9 seconds. Cleaning up request 0 ID 1 with timestamp +10 Ready to process requests. Rgds, Vamsi ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 2

RE: Alternate server certificate
by Ivan Kalik 21 Jul '09

21 Jul '09

> Don't both solutions have the same risk (my first idea was to use a 2nd > eap instance with the public CA)? I understand the risk; but, in this > case, it's a tradeoff between presenting a cert signed by a public CA > (makes it easier for these outside users to configure our wireless), have > all guest users not validate the server cert (even worse) or distribute > our internal CA's cert to every guest user (not logistically practical). So, why do you bother authenticating users on guest SSID at all? Just leave it open. Even if there is a registration form or such stuff where user will be giving sensitive information that should be protected by SSL on the web server anyway - no need to encrypt on wireless side as well. And the fact that someone can snoop and find out which information pages are your guests reading shouldn't really be of any practical concern. Ivan Kalik Kalik Informatika ISP

1 0

Re: Info regarding radius and tacacs
by Ivan Kalik 21 Jul '09

21 Jul '09

> Can anyone let me know if there is free downloadable > > 1: Radius server with support for Ipv6 Freeradius. > 2: Tacacs server with support for Ipv6. Ask Cisco. Ivan Kalik Kalik Informatika ISP

1 0

Info regarding radius and tacacs
by Vamsi Krishna Valiveti 21 Jul '09

21 Jul '09

Hi , Can anyone let me know if there is free downloadable 1: Radius server with support for Ipv6 2: Tacacs server with support for Ipv6. Rgds, Vamsi ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

SQL and huntgroups
by Kanwar Ranbir Sandhu 20 Jul '09

20 Jul '09

Hi All, I want to use huntgroups in freeradius 2.1.6. I have a sql backend for auth and acct, so naturally I want to put huntgroups into mysql as well. I've read the wiki on how to do this, and I understand the notes. However, the wiki entry mentions that the following should either go into radiusd.conf or in sites-enabled/default: update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" } Can I put that into my virtual server (also in sites-enabled) instead of the two options presented in the wiki? Or, is it much better to put it into the default config file? Thanks, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.25-170.2.72.fc10.x86_64 x86_64 GNU/Linux 16:41:50 up 2 days, 23:12, 4 users, load average: 0.54, 0.53, 0.37

2 1

trouble with scheme
by Tony P. 20 Jul '09

20 Jul '09

hi have 2 problems with radius-ldap scheme into mysql i have to set in database 2 items to check my radgroupcheck for the users... Max-Monthly-Session -> not exist in the scheme and Called-Station-Id -> just support 1 value need put on 2 or more regards Tony

2 1

Alternate server certificate
by Garber, Neal 20 Jul '09

20 Jul '09

We have Access Points that contain multiple SSIDs. Some are for internal use and some are for guest access. All are secured using WPA w/PEAP. I would like FreeRadius to present a cert. from our internal CA for the SSIDs that are internal and present a cert. from one of the CA's that Windows trusts by default for guest access. I haven't found a way to control this on the AP (i.e., to select a different RADIUS server address or port based upon SSID). Is it possible to accomplish this in FreeRadius given that I can determine the SSID by looking at a request attribute? Some ideas I have are: - Have two instances of the EAP module (one for internal SSIDs and one for guest) and select which one to use with some unlang code (based upon the value of 1 request attribute) - Create a virtual server for guest access that uses an EAP module with the cert. from the well-known CA Will either or both of the above work? Is there a better way? We plan to convert our guest access to a captive portal, but it won't be ready for a while. Thank you for your assistance.

1 0