January 2010 - Freeradius-Users - lists.freeradius.org

Hide/Delete keepusaliveuser in radpostauth table
by Sylvain De Muynck 26 Jan '10

26 Jan '10

Dear all, I need to get a keepalive user for my NAS to be authenticated every minutes. Also, for monitoring purpose, I am using this table to check which user get authenticated. Is there a specific way to delete automatically or to say to the Radius server not to add this particular user in the database? In fact, I am authenticated this user every minutes so this table is not significant anymore. Thanks for your reply, Sylvain

1 0

accounting question
by Marlon Duksa 26 Jan '10

26 Jan '10

Hi, I have redundant NAS nodes and they obviously have two different NAS-IP. If one NAS fails, the entity for which I'm accounting traffic is automatically switched over to the redundant NAS which can keep sending accounting records to Radius. However, the records will have different NAS-IP, NAS-Identier and NAS-Port-ID. The acct-session-id and framed-ip-addrss will be the same (and this is what I use to identify the entity for which I collect acct info). Is there any way that this new records will be written to the same file as before the failover so that I can correlate the records? I see that the acct directory is in /var/log/freeradius/radacct/<NAS-IP>/. This <NAS-IP> directory name is what is bothering me. Is there any way to change this? Thanks Marlon

3 3

dropped request after ldap "constraint violating"
by chui 26 Jan '10

26 Jan '10

Hi, >From radius.log, the symptom of the failure goes as follow 1. rlm_ldap receives "constraint violation" reply from ldap. 2. other authentication requests immediately followed the constraint violation reply failed with "incorrect login" sample radius log - Jan 12 13:44:05 : rlm_ldap: lblempnum=012345, ou=people, o=LBL, c=US bind to ldap:636 failed Constraint violation Jan 12 13:44:05 : Login incorrect: [012345] (from client XXX port 24772 cli 0017.abcd.3fe0 via TLS tunnel) Jan 12 13:44:12 : Login incorrect: [test-account] (from client XXX port 0) - At my site, I run radiusd with the -s flag. Freeradius operation with the backend ldap server is monitored by nagios running check_radius. I also have cacti checking the round trip transaction time between radiusd and ldap in five minutes interval. For trouble shooting purposes, I obtained a copy of the ldap log around the same time frame. The ldap log showed that the user account 012345 has exceeded the failed login attempts and the account was locked out, thus the "constraint violation". However, there was no ldap log entry indicating any bind operation request from the radiusd for the [test-account]. Nagios run the radius monitoring in 1 minute interval, and it usually recover the next minute or so. Cacti showed average radiusd-ldap rtt was under 500ms. Can anybody shed some light on this failure scenario? Thanks Cedric

2 1

LDAP timeouts
by freeradius＠corwyn.net 25 Jan '10

25 Jan '10

I'm currently using freeradius2-2.1.7-2.el5 on CentOS 5.2 for Cisco and L2TP VPN user authentication (via a Sonicwall firewall), using LDAP back to a AD environment, with the Windows built in VPN client. (for very specific details of that environment see my post of Tue, Dec 1, 2009 at 6:31 PM ) The Cisco environment works flawlessly. Every time I attempt to log in it works. The Windows environment works, with one quirk, if no one has logged in for a while (~15-30 min), the next user gets: Thu Jan 14 19:31:51 2010 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Thu Jan 14 19:31:51 2010 : Info: rlm_ldap: Attempting reconnect Thu Jan 14 19:31:51 2010 : Auth: Login OK: [user] (from client VPN port 0) The end user reports that the first attempt to login fails, but the second succeeds. Further attempts will succeed until it's been a while since anyone logged in. That's only true for VPN users, logging into a Cisco never causes the same issue - works every time. Both servers refer to the same ldap module. I only have about 4 VPN users right now, so I'm thinking it's not a load problem. In some respecting I'm thinking it's the reverse of a load problem - that once I have more users on the system there won't be a long period of time where no one has logged in, and so the problem will go away. Thoughts? I'd like for the user to (barring network issues) be able to log on the first time, every time. Thanks Rick

2 3

freeradius does not send tunnel-type.
by Gildo Castro 25 Jan '10

25 Jan '10

Hi, I have a problem with my freeradius server, after the authentication, it does not send the tunnel-type or Tunnel-Medium-Type information. Can anyone help me? PEAP: Got tunneled reply RADIUS code 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "teste3" PEAP: Processing from tunneled session code 0x967b688 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "teste3" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS Saving tunneled attributes for later modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group EAP (returns handled) for request 8 Sending Access-Challenge of id 47 to 10.1.10.1 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010a00261900170301001b44323057d9f66e452eb3025c6b0adde60971049e6c8c20901a25f0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a5c33fd9b76ead074d1c636d08bb94f Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.10.1:1645, id=48, length=147 User-Name = "teste3" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.1.10.1 NAS-Port = 7 Calling-Station-Id = "00-22-15-62-54-BA" State = 0x9a5c33fd9b76ead074d1c636d08bb94f EAP-Message = 0x020a00261900170301001bd3cca956e18d7127395a3c5cad6f3b564c44038b5dc9740734ca57 Message-Authenticator = 0x8a2cb874d839aa15123357e704f34b95 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "teste3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 171 users: Matched entry teste3 at line 224 modcall[authorize]: module "files" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group EAP for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success Using saved attributes from the original Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group EAP (returns ok) for request 9 Sending Access-Accept of id 48 to 10.1.10.1 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User User-Name = "teste3" MS-MPPE-Recv-Key = 0xf058f1dbb8a5f02902f4d6536af78b333ab73568070fbaac3e281171e9cb31be MS-MPPE-Send-Key = 0xcffa34fb8461d53aff874f3749bee52662c85f05d88c04c8d47453530de47630 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 -- --------------------------------------------------------------------------------------------------- Gildo Castro da Silva JR. ---------------------------------------------------------------------------------------------------

2 1

EAP-TLS User-Name not matching
by Huckle Berry 25 Jan '10

25 Jan '10

First off, forgive me if this has been asked before on this list (I did do a search first, yet no results proved useful). I am on a fact finding mission to see whether freeradius is going to be feasible to deploy in my environment (~50 users over ~40 windows and linux desktops). On a test network I have configured an Ubuntu 9.10 Server with a patched freeradius that has openssl (oh what fun that was to build). I have so far altered the original configuration by only a few lines, as everywhere I go I see Alan screaming "Don't change the config!". I changed eap.conf by the following default_eap_type = tls ... fragment_size = 1024 include_length = yes I also changed users to include a few lines, most of which are incorrect, one of which may be correct (but I'm not sure). I added them one at a time in case one did the trick, but no such luck. example.com/user user(a)example.com host/user winlaptop/user WinLaptop/user I also edited client.conf to include my NAS (pretty standard change so I'm not going to detail it) The issue is when a windows client (A user by the name of user on a laptop named WinLaptop) attempts to connect, it cannot Authenticate. The error seems to be that the user name doesn't match between something and the TLS attrtibute. I would love more info on what this implies and how TLS and Radius work with each other. I get the following radiusd -X output: (sorry for the length) FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 15 2010 at 23:02:23 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.1.1 { ipaddr = 192.168.1.1 require_message_authenticator = no secret = "secret123" shortname = "AP" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 3079, id=0, length=145 User-Name = "user(a)example.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x6e28f191648ccbe2be4c4354a7975433 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "example.com" for User-Name = "user(a)example.com" [suffix] Found realm "example.com" [suffix] Adding Stripped-User-Name = "user" [suffix] Adding Realm = "example.com" [suffix] Proxying request from user user to realm example.com [suffix] Preparing to proxy authentication request to realm "example.com" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm example.com. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 139 to 127.0.0.1 port 1812 User-Name = "user" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Proxying request 0 to home server 127.0.0.1 port 1812 Sending Access-Request of id 139 to 127.0.0.1 port 1812 User-Name = "user" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=139, length=136 User-Name = "user" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0016b6e2cc20" Calling-Station-Id = "00904b1f9671" NAS-Identifier = "0016b6e2cc20" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000150175736572406578616d706c652e636f6d Message-Authenticator = 0xa892984cce17699fd5732b0db2faf7a8 Proxy-State = 0x30 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 139 to 127.0.0.1 port 1814 Proxy-State = 0x30 Waking up in 4.9 seconds. rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=139, length=23 Proxy-State = 0x30 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user(a)example.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 0 to 192.168.1.1 port 3079 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 139 with timestamp +8 Cleaning up request 0 ID 0 with timestamp +8 Ready to process requests. Thanks in advance for any help! ~Huckle Berry

5 26

Re: config files separation for each sites enabled
by Fred 25 Jan '10

25 Jan '10

Thanks, Alan, I will check. Bye.

1 0

config files separation for each sites enabled
by Fred 25 Jan '10

25 Jan '10

Hello freeradius-users, I have 6 virtual servers on version 2.1.8, each listening on differents ip addresses lo:[1-6]. I saw it was easy to separate clients files, using clients site-name {} , and including a sitename.client.conf. But as huntgroups and users files seems to be loaded globally before sites instanciation, I found no way to dedicate huntgroup and users file to each server instance, as done previously for clients... Is there any way to achieve this without having to launch many radiusd in differents location ? Best regards, Fred MAISON

2 1

ldap auth
by José Campos 25 Jan '10

25 Jan '10

Hello, Can someone give me some guidelines to config freeradius (freeradius-2.1.7-1.fc11.i586) to do ldap auth. Witch files must I config. José Campos

1 0

IP delivery for MAC records
by Sylvain De Muynck 25 Jan '10

25 Jan '10

Dear freeradius users, I am currently facing an issue on my network architecture. Before, I was using freeradius with a DHCP server running in order to attribute IPs addresses to my customers (I work for an ISP) This configuration is perfectly working however for security, maintenance and monitoring, I took the choice of delivering IP addresses through my radius server. In fact, our Base Station got 2 modes of working, one is Ethernet and the other is IP mode data, so I juste configured as IP mode data to get it working. WHAT IS THE PROBLEM : when I connect my computer it is perfectly working and I can get my IP and all network parameters to get an access to the Internet however, when I want to change of computer, it does not work anymore. We were thinking about record of the MAC address as a security level and would like to get to know more about it. The attributes we are using are : Framed-Netmask --> Netmask Filter-Id --> DNS in this attribute (that's vendor attribute Alvarion) Framed-route --> Routing to the gateway Framed-Ip-address --> the IP addresse If you don't know, could you please advice me on how to troubleshoot this issue. Thanks in advance for your help, Best regards Sylvain

2 1