September 2010 - Freeradius-Users - lists.freeradius.org

Re: Re: radius client / send NAS IP ?
by Michael Arndt 27 Sep '10

27 Sep '10

Hello Alan, sorry, my fault :-) radclient saves my day, indeed i can send any attribute / value pair i like thanks for your help Micha

1 0

Re: Pushing group attribute from OpenDirectory to Cisco
by Sander van Loosbroek 26 Sep '10

26 Sep '10

Just wanted to let you all know that I got it working with your instructions. In the end I realized that there were multiple groups associated with each user and that such a lookup wasn't gonna work anyway. I created single user entries like this in the users file: user1 Cleartext-Password := "userpassword" Service-Type = NAS-Prompt-User, cisco-avpair = "webvpn:user-vpn-group=management" The user has to be active in the OpenDirectory as well for this to work but this is desired behaviour in my configuration anyway. Now the avpair gets pushed to the Cisco router and used to select the correct policy in the WebVPN context. I'm gonna write a blogpost on my full setup on http://edgetechnology.wordpress.com that explains the full setup for those interested. Thank you all for your help. Sander On 24 sep 2010, at 12:00, freeradius-users-request(a)lists.freeradius.org wrote: > Date: Fri, 24 Sep 2010 09:04:34 +0200 > From: Sander van Loosbroek <sander(a)vanloosbroek.com> > Subject: Re: Freeradius-Users Digest, Vol 65, Issue 105 > To: freeradius-users(a)lists.freeradius.org > Message-ID: <9C852831-8F4D-4DCF-9A2A-1D6C3D8EDD96(a)vanloosbroek.com> > Content-Type: text/plain; charset=us-ascii > > What I'm trying to do is retrieve the user group from the OpenDirectory instead of setting a static one. There is only one NAS and the Mac OS X Server runs a standalone OpenDirectory Master so I don't need any huntgroups then? > > On 24 sep 2010, at 05:42, freeradius-users-request(a)lists.freeradius.org wrote: > >> Date: Fri, 24 Sep 2010 08:02:38 +1200 >> From: Peter Lambrechtsen <plambrechtsen(a)gmail.com> >> Subject: Re: Pushing group attribute from OpenDirectory to Cisco >> To: FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >> Message-ID: >> <AANLkTik16Nrmbb1OmrVWcFuhTFKnLEDYwvPFs5FydrbT(a)mail.gmail.com> >> Content-Type: text/plain; charset="iso-8859-1" >> >> In the "users" file is where you specify the reply attributes in my example. >> >> So using your example: >> >> DEFAULT Huntgroup-Name == CiscoVPN, Ldap-Group == >> "cn=CiscoVPN,ou=Roles,ou=Radius,DC=ACME,DC=COM" >> Service-Type = "NAS-Prompt-User", >> Idle-Timeout = 600, >> Cisco-AVPair = >> "webvpn:user-vpn-group=whatevervpngroupyouwanttoaddtheuserto" >> >> Then you can either use the huntgroup file and set the IP addresses of the >> Routers (NAS's) you're using: http://wiki.freeradius.org/Huntgroups >> >> Or you can have the Huntgroups in ldap as per my e-mail, and that would be >> if you have a more dynamic environment or want to move the NAS between >> different huntgroups easily. >> >> >> >> On Fri, Sep 24, 2010 at 2:03 AM, Sander van Loosbroek < >> sander(a)vanloosbroek.com> wrote: >> >>> Hello Peter and Alan, >>> >>> Thank you for your reply. I've given the documentation of Peter a look but >>> I'm not that familiar with LDAP or how its underpinnings work in OS X >>> Server. >>> >>> When the Cisco router now authenticates against the FreeRADIUS server all >>> works fine except for the fact that the group name is not returned with the >>> webvpn:vpn-user-group attribute. What is unclear to me is how I instruct >>> FreeRADIUS to include that attribute when it returns the authorization >>> message. I have made the following addition to my clients file: >>> >>> client 192.168.13.1/32 { >>> secret = xxx >>> shortname = vpn >>> nastype = cisco >>> } >>> >>> I have added a policy to the Cisco router to pick up the attribute but it >>> doesn't seem to get through. Can you suggest what to try next? >>> >>> Thanks, >>> Sander >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html

2 1

is the book published?
by Spacelee 25 Sep '10

25 Sep '10

is the book for freeradius published? -- *Space Lee*

1 2

DHCP server does not process requests
by Alexander Shikoff 25 Sep '10

25 Sep '10

Hello, In my network there is Cisco ISG acting as DHCP relay. It relays requests from customers to DHCP server of freeradius: Sep 25 12:51:05.045: DHCPD: input i/f override GigabitEthernet0/1.33 for client Sep 25 12:51:05.045: DHCPD: Reload workspace interface GigabitEthernet0/1.33 tableid 0. Sep 25 12:51:05.049: DHCPD: tableid for 193.200.84.232 on GigabitEthernet0/1.33 is 0 Sep 25 12:51:05.049: DHCPD: client's VPN is . Sep 25 12:51:05.049: DHCPD: using received relay info. Sep 25 12:51:05.049: DHCPD: Sending notification of DISCOVER: Sep 25 12:51:05.049: DHCPD: htype 1 chaddr 00e0.9110.8347 Sep 25 12:51:05.049: DHCPD: remote id 000600226b2a8d52 Sep 25 12:51:05.049: DHCPD: circuit id 000400210103 Sep 25 12:51:05.049: DHCPD: interface = GigabitEthernet0/1.33 Sep 25 12:51:05.049: DHCPD: class id 4d53465420352e30 Sep 25 12:51:05.049: DHCPD: No internally specified class returned Sep 25 12:51:05.049: DHCPD: Looking up binding using address 193.200.84.232 Sep 25 12:51:05.049: DHCPD: Found previous binding with giaddr 193.200.84.232 Sep 25 12:51:05.049: DHCPD: Keeping state for received DHCPDISCOVER, from UNNUM-IF Sep 25 12:51:05.049: DHCPD: setting giaddr to 193.200.84.232. Sep 25 12:51:05.053: DHCPD: BOOTREQUEST from 0100.e091.1083.47 forwarded to 193.200.85.22. freeradius listens 67 port on 193.200.85.22: # sockstat |grep rad freeradius radiusd 94903 5 udp4 193.200.85.22:67 *:* I see incoming packets: # tcpdump -vvvni re0 port 67 tcpdump: listening on re0, link-type EN10MB (Ethernet), capture size 96 bytes 16:05:23.403248 IP (tos 0x0, ttl 254, id 142, offset 0, flags [none], proto UDP (17), length 345) 193.200.84.232.67 > 193.200.85.22.67: BOOTP/DHCP, Request from 00:e0:91:10:83:47, length 317, hops 1, xid 0x4bb0c74b, Flags [none] (0x0000) Gateway-IP 193.200.84.232 Client-Ethernet-Address 00:e0:91:10:83:47 [|bootp] 16:05:26.404455 IP (tos 0x0, ttl 254, id 143, offset 0, flags [none], proto UDP (17), length 345) 193.200.84.232.67 > 193.200.85.22.67: BOOTP/DHCP, Request from 00:e0:91:10:83:47, length 317, hops 1, xid 0x4bb0c74b, secs 768, Flags [none] (0x0000) Gateway-IP 193.200.84.232 Client-Ethernet-Address 00:e0:91:10:83:47 [|bootp] But radiusd does not process them: I see no any debug output when running 'radiusd -X'. The dhcp configuration is default from raddb/sites-available, I only added 'detail' in every dhcp-section. Any ideas? Thanks in advance. -- MINO-RIPE

2 2

Re: Re: radius client / send NAS IP ?
by Michael Arndt 25 Sep '10

25 Sep '10

Alan, thx for answering at least the radclient of the installed version does not allow to add those attributes according to manpage if i read your hint right i should download an actual version and compile to get an radclient with enhanced abilities :-) TIA Micha ----- ursprüngliche Nachricht --------- Subject: Re: radius client / send NAS IP ? Date: Sa 25 Sep 2010 15:01:49 CEST From: Alan DeKok<aland(a)deployingradius.com> To: FreeRadius users mailing list<freeradius-users(a)lists.freeradius.org> Michael Arndt wrote: > is there a radtest client where i can send those attribute / value pairs > intentionally ? $ man radclient Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ---- ursprüngliche Nachricht Ende ----

2 1

radius client / send NAS IP ?
by Michael Arndt 25 Sep '10

25 Sep '10

Hello *, at the time beeing i have to use an old radius version for different reasons. freeradius-client-1.1.5-36 freeradius-devel-1.1.6-47 freeradius-1.1.6-47 freeradius-client-devel-1.1.5-36 freeradius-client-libs-1.1.5-36 for real logins at WLAN Hot Spot the DEFAULT NAS-IP-Address == "192.168.123.45" or DEFAULT Called-Station-Id =~ ".*:MYSSID" are part of the check ( via criteria in users ) is there a radtest client where i can send those attribute / value pairs intentionally ? else in my traces i will always see a refused as test result, since from localhost those parameters will not match Prio low, would just be nice for testing TIA Micha

2 1

rlm_exec: Wait=yes but no output defined
by Michael Arndt 25 Sep '10

25 Sep '10

Hello *, radiusd -X in different places announces rlm_exec: Wait=yes but no output defined. Did you mean output=none? Will freeradius fall back internally to output=none without inserting this attribut / value in the config ? Or should i mandatory add output=none ? TIA Micha

1 0

Last call for 2.1.10
by Alan DeKok 25 Sep '10

25 Sep '10

I've put some preliminary tar files on: http://git.freeradius.org/pre/ If there are any issues, let me know now. Otherwise we'll release 2.1.10 on Monday. The changelog is *extensive*. There are a large number of minor bugs fixed, and a lot of minor new features added. But the result is that the server has taken a significant step ahead in usability and functionality. Thanks to everyone for testing intermediate releases. Alan DeKok.

10 23

Multiple Databases
by sekchel lee 24 Sep '10

24 Sep '10

I want Multiple databases group1 ==> databases1 group2 ==> databases 2 .. .. Please Help me

2 1

Radius proxy - kind of
by Matija Levec 24 Sep '10

24 Sep '10

Hi everyone! First a little bit of explaining... - auth_server 1 client - fr_proxy -[ - auth_server 2 (client=random NAS, fr_proxy=freeradius, auth_server=two-factor auth server(s)) Currently we have clients authenticating directly to auth_server 1. We would like to gradually (and transparently) move users to new authenticators which use auth_server 2 Question What I would like to accomplish is: If auth_server 1 returns notfound or reject or fail, proxy request to auth_server 2 Is it possible to use 'configurable module fail over'-like syntax for configuring proxy (home)servers? I hopes this makes sense. Anyway... all ideas appreciated! Regards, Matija

1 0