October 2011 - Freeradius-Users - lists.freeradius.org

password in EAP request
by Alex rsm 06 Oct '11

06 Oct '11

Hi, In example.pl perl script $RAD_REQUEST{'User-Name'} returns the username of the EAP request message. How can I get the password of the EAP request? $RAD_REQUEST{'User-Password'} won't return the password. rad_recv: Access-Request packet from host 24.26.79.31 port 50168, id=207, length=185 User-Name = "test" NAS-IP-Address = 10.0.0.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "00-26-4A-FC-EB-B2" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xce81437fce8047c9464d6ff62d386d00 Message-Authenticator = 0x5feafac09a6cce51d36958efc628f397 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 209 ++[files] returns ok User-Name=test User-password= rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: State = 0xce81437fce8047c9464d6ff62d386d00 rlm_perl: RAD_REQUEST: Calling-Station-Id = 00-26-4A-FC-EB-B2 rlm_perl: RAD_REQUEST: Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: RAD_REQUEST: Message-Authenticator = 0x5feafac09a6cce51d36958efc628f397 rlm_perl: RAD_REQUEST: User-Name = test rlm_perl: RAD_REQUEST: NAS-Identifier = belair rlm_perl: RAD_REQUEST: EAP-Message = 0x020100060319 rlm_perl: RAD_REQUEST: Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: RAD_REQUEST: EAP-Type = NAK rlm_perl: RAD_REQUEST: NAS-IP-Address = 10.0.0.31 rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: Framed-MTU = 1400 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair State = 0xce81437fce8047c9464d6ff62d386d00 rlm_perl: Added pair Calling-Station-Id = 00-26-4A-FC-EB-B2 rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x5feafac09a6cce51d36958efc628f397 rlm_perl: Added pair User-Name = test rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x020100060319 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = NAK rlm_perl: Added pair NAS-IP-Address = 10.0.0.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled

7 9

Trapeze dictionary enhancement proposal
by Fred 06 Oct '11

06 Oct '11

he all, Here is some possible enhancement on dictionary.trapeze +# +# For use with FreeRadius and Trapeze Networks MSS software 1.1 +# or greater. +# +# For assistance, email support(a)trapezenetworks.com. +# +# $Id$ +# +# +VENDOR Trapeze 14525 -ATTRIBUTE Trapeze-VLAN-Name 1 string -ATTRIBUTE Trapeze-Mobility-Profile 2 string -ATTRIBUTE Trapeze-Encryption-Type 3 string -ATTRIBUTE Trapeze-Time-Of-Day 4 string -VENDORATTR 14525 Trapeze-SSID 5 string -VENDORATTR 14525 Trapeze-End-Date 6 string -VENDORATTR 14525 Trapeze-Start-Date 7 string -VENDORATTR 14525 Trapeze-URL 8 string -VENDORATTR 14525 Trapeze-User-Group-Name 9 string -VENDORATTR 14525 Trapeze-Qos-Profile 10 string -VENDORATTR 14525 Trapeze-Simultaneous-Logins 11 string -VENDORATTR 14525 Trapeze-COA-Replace-Username 12 string -VENDORATTR 14525 Trapeze-Audit 13 string +# Attributes for MSS 1.1 and later + +BEGIN-VENDOR Trapeze + +ATTRIBUTE Trapeze-VLAN-Name 1 string +ATTRIBUTE Trapeze-Mobility-Profile 2 string +ATTRIBUTE Trapeze-Encryption-Type 3 string +ATTRIBUTE Trapeze-Time-Of-Day 4 string + +# New attributes for MSS 3.0 and later + +ATTRIBUTE Trapeze-SSID 5 string +ATTRIBUTE Trapeze-End-Date 6 string +ATTRIBUTE Trapeze-Start-Date 7 string +ATTRIBUTE Trapeze-URL 8 string + +END-VENDOR Trapeze Best regards, Fred MAISON

3 5

pfSense with freeRadius and CHAP
by Mark 06 Oct '11

06 Oct '11

Hi all, I have a weird problem, as you can see in the log below the client can successfully authenticate once and after that fails. The network structure is: 1) pfSense with freeRadius as firewall, authentication and accounting server 2) A HP ProCurve 2626 with MAC based port access 3) A wireless access point Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 2048 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.2.1 IP address [10.0.2.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded Counter counter: filename = "/usr/local/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 1317852000 [2011-10-06 00:00:00] Module: Instantiated counter (daily) counter: filename = "/usr/local/etc/raddb/db.weekly" counter: key = "User-Name" counter: reset = "weekly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Weekly-Session-Time" counter: check-name = "Max-Weekly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Weekly-Session-Time is number 1832 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 1318111200 [2011-10-09 00:00:00] Module: Instantiated counter (weekly) counter: filename = "/usr/local/etc/raddb/db.monthly" counter: key = "User-Name" counter: reset = "monthly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Monthly-Session-Time" counter: check-name = "Max-Monthly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Monthly-Session-Time is number 1834 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 1320098400 [2011-10-31 23:00:00] Module: Instantiated counter (monthly) counter: filename = "/usr/local/etc/raddb/db.forever" counter: key = "User-Name" counter: reset = "never" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Forever-Session-Time" counter: check-name = "Max-Forever-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Forever-Session-Time is number 1836 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 0 [2011-10-05 22:00:00] Module: Instantiated counter (forever) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.2.1:1812 Listening on accounting 10.0.2.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.2.2:1024, id=55, length=197 Framed-MTU = 1480 NAS-IP-Address = 10.0.2.2 NAS-Identifier = "Melkweg-0" User-Name = "00026f898b62" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1d-b3-2f-3f-3f" Calling-Station-Id = "00-02-6f-89-8b-62" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x36a38cdd1a470aebb4c6e8887360fb3fc9 Message-Authenticator = 0xdefb1131a6c68c375b062393ad67c22d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00026f898b62", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00026f898b62 at line 1 modcall[authorize]: module "files" returns ok for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "00026f898b62" with CHAP password rlm_chap: Using clear text password "00026f898b62" for user 00026f898b62 authentication. rlm_chap: chap user 00026f898b62 authenticated succesfully modcall[authenticate]: module "chap" returns ok for request 0 modcall: leaving group CHAP (returns ok) for request 0 Processing the session section of radiusd.conf modcall: entering group session for request 0 radius_xlat: '/var/log/radutmp' modcall[session]: module "radutmp" returns ok for request 0 modcall: leaving group session (returns ok) for request 0 Login OK: [00026f898b62/<CHAP-Password>] (from client Switch1 port 1 cli 00-02-6f-89-8b-62) Sending Access-Accept of id 55 to 10.0.2.2 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 55 with timestamp 4e8cb778 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.2.2:1024, id=56, length=197 Framed-MTU = 1480 NAS-IP-Address = 10.0.2.2 NAS-Identifier = "Melkweg-0" User-Name = "00026f898b64" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1d-b3-2f-3f-3f" Calling-Station-Id = "00-02-6f-89-8b-64" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x37fe6aa7c21b09f9fff29122501809899b Message-Authenticator = 0x4aad343a1934af2951356edec927fd4e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "00026f898b64", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 1 rlm_chap: login attempt by "00026f898b64" with CHAP password rlm_chap: Could not find clear text password for user 00026f898b64 modcall[authenticate]: module "chap" returns invalid for request 1 modcall: leaving group CHAP (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [00026f898b64/<CHAP-Password>] (from client Switch1 port 1 cli 00-02-6f-89-8b-64) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 56 to 10.0.2.2 port 1024 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 56 with timestamp 4e8cb7b6 Nothing to do. Sleeping until we see a request. Attached are the radiusd.conf and users file, please help me out… Yours sincerely, Mark van Beek

2 1

mschap group restriction
by das-ich 06 Oct '11

06 Oct '11

Hi all! How it is possible to add restriction on group at mschap? Just --require-membership-of=GROUP-NAME not working Thanks for the answer.

1 0

Mac access mixed ldap access same NAS
by Alejandro Gandara 06 Oct '11

06 Oct '11

Hi list, does someone know if Its possible mix MAC auth with ldap AUTH in the same NAS. I mean, I have multiple connection to one NAS but a few users will access through mac address, and others will access trhough auth ldap + passwords. Nowadays Ive configured ldap access but I dont know how to configure freeradius to allow connect a few users(16-20) trhough mac auth. As always thanks you very much for your time and peacence. Regards, Alejandro Gándara Junior System Administrator

3 2

MySQL and FreeRADIUS environment
by tonimanel 06 Oct '11

06 Oct '11

Hi everybody, In my company we are thinking to implement a FreeRADIUS server with MySQL on Linux. We need to duplicate FreeRADIUS service because we think that this is a critical service for us but the authentication process only could be done with the master server(FreeRADIUS and MySQL service, both in only one server). For the other hand, if we want to replicate the data base servers, we would have to synchronize two database servers but we would not know wich would be the best solution, cluster or synchronize. Maybe we will not to need a MySQL cluster service and we will need two servers only. First with master FreeRADIUS service and master MySQL service and the second with slave FreeRADIUS service and slave MySQL service. What do you think about the best solution to implement this environment? I hope your answer. Thank you very much. Regards, -- View this message in context: http://freeradius.1045715.n5.nabble.com/MySQL-and-FreeRADIUS-environment-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 18

Reply-Message in freeradius
by Dagia Dorjsuren 06 Oct '11

06 Oct '11

Hello, How to add Reply-Message in freeradius? anyone advise me pls. For example : I would like to send "Your username or password is wrong" message to NAS if the someone to access to my freeradius via wrong password from that NAS Thanks,

4 4

Re: Rewriting wimax calling-station-id with perl
by James T Mugauri 05 Oct '11

05 Oct '11

Hi, As you are undoubtedly aware, the ubuntu/debian package of freeradius comes without the wimax module (despite having the wimax module) installed. My own attempts to compile/install/build deb package for ubuntu always die with the infamous "undefined reference to `lt_preloaded_symbols'" that apparently has even Alan opting to forsake libtool. Because many people would still like to implement mac authentication on a wimax network, I was wondering whether the c subroutine that does this in the module: /* * Fix Calling-Station-Id. Damn you, WiMAX! */ vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID); if (vp && (vp->length == 6)) { int i; uint8_t buffer[6]; memcpy(buffer, vp->vp_octets, 6); /* * RFC 3580 Section 3.20 says this is the preferred * format. Everyone *SANE* is using this format, * so we fix it here. */ for (i = 0; i < 6; i++) { fr_bin2hex(&buffer[i], &vp->vp_strvalue[i * 3], 1); vp->vp_strvalue[(i * 3) + 2] = '-'; } vp->vp_strvalue[(5*3)+2] = '\0'; vp->length = (5*3)+2; DEBUG2("rlm_wimax: Fixing WiMAX binary Calling-Station-Id to %s", buffer); } can be easily translated to perl to rewrite the calling-station-id (only when it does not meet the standard), as that module works fine and is correctly compiled? If so, would anyone here be able to mash up a few lines of perl code to this end? Please? I, unfortunately am not familiar enough with c to translate the logic behind the code above flawlessly. Hopefully, JamesTM Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley On 10/05/2011 02:10 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: FreeRadius with Eduroam - Accounting (Alan DeKok) > 2. Re: MySQL and FreeRADIUS environment (tonimanel) > 3. Re: FreeRadius with Eduroam - Accounting (Phil Mayers) > 4. Mac access mixed ldap access same NAS (Alejandro Gandara) > 5. Re: MySQL and FreeRADIUS environment (Fajar A. Nugraha) > 6. Re: MySQL and FreeRADIUS environment (tonimanel) > 7. MySQL and FreeRADIUS environment (tonimanel) > 8. Re: MySQL and FreeRADIUS environment (Alan DeKok) > 9. Re: MySQL and FreeRADIUS environment (tonimanel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 05 Oct 2011 12:09:39 +0200 > From: Alan DeKok<aland(a)deployingradius.com> > Subject: Re: FreeRadius with Eduroam - Accounting > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<4E8C2CE3.7000802(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: >> It's a bad way of doing it. At least with replicate every accounting packet has a chance... Using Acct-Delay-Time you'll end up dumping anywhere between 1-15 seconds accounting data for all realms if one realm is unreachable. > <shrug> > > if (Packet-Transmit-Counter> 5) { > ok > } else { > ... proxy ... > } > > If the home server doesn't get it after 5 tries, throw it away. > > In 2.1.10& later, IIRC. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Wed, 5 Oct 2011 03:49:16 -0700 (PDT) > From: tonimanel<antoniofernandez(a)fabergames.com> > Subject: Re: MySQL and FreeRADIUS environment > To: freeradius-users(a)lists.freeradius.org > Message-ID:<1317811756198-4872269.post(a)n5.nabble.com> > Content-Type: text/plain; charset=us-ascii > > My FreeRADIU version is 2.1.10 on Debian. Suggest me update? Or is a valid > verstion to work and implement freeradius replication with radrelay? > > Thanks, > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/MySQL-and-FreeRADIUS-environment-tp… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > ------------------------------ > > Message: 3 > Date: Wed, 05 Oct 2011 11:50:12 +0100 > From: Phil Mayers<p.mayers(a)imperial.ac.uk> > Subject: Re: FreeRadius with Eduroam - Accounting > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4E8C3664.5070000(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 05/10/11 09:56, Arran Cudbard-Bell wrote: >> On 5 Oct 2011, at 10:40, Phil Mayers wrote: >> >>> On 10/05/2011 09:26 AM, Alan DeKok wrote: >>>> Phil Mayers wrote: >>>>> I guess that's ok, in that it stops an unresponsive realm >>>>> blocking other realms, but wouldn't another solution be to add >>>>> a config item to the detail reader to drop packets which are>X >>>>> seconds old? >>>> if (Acct-Delay-Time> 3600) { ok } else { ... do proxy .... } >>> >>> Ah ha! Clever. I had forgotten the detail reader created/updated >>> that attribute. Yay FreeRADIUS! >> It's a bad way of doing it. At least with replicate every accounting >> packet has a chance... Using Acct-Delay-Time you'll end up dumping >> anywhere between 1-15 seconds accounting data for all realms if one >> realm is unreachable. > Whereas with rlm_replicate, you risk dropping arbitrary accounting > packets because there is no retry. There is no ideal solution, because > radius accounting was never designed for the kind of loosely-coupled > federation that is Eduroam. > > For me, since most Eduroam sites don't care about receiving federated > accounting, my primary concern is for my server to carry on functioning, > and that means the detail file should not grow without bound. I don't > really care how that happens - as long as it does. > > > > ------------------------------ > > Message: 4 > Date: Wed, 5 Oct 2011 13:06:33 +0200 > From: Alejandro Gandara<agandara(a)optaresolutions.com> > Subject: Mac access mixed ldap access same NAS > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CAF40+uwJa0dZ-3YNcr=QkRu1NUrL6Lhy77W2RhEPDuNWjtbGkg(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi list, > > does someone know if Its possible mix MAC auth with ldap AUTH in the same > NAS. > > I mean, I have multiple connection to one NAS but a few users will access > through mac address, and others will access trhough auth ldap + passwords. > > Nowadays Ive configured ldap access but I dont know how to configure > freeradius to allow connect a few users(16-20) trhough mac auth. > > As always thanks you very much for your time and peacence. > > Regards, > > Alejandro G?ndara > Junior System Administrator >

3 2

radius dhcp
by Alexandre Chapellon 05 Oct '11

05 Oct '11

Hello, I have a setup where th user initiates DHCP request to the NAS. The NAS then tries to authenticate the user using regular radius requests (basicilly Access-Request with username=macaddr). If authenticated the NAS relay the dhcp request to a dhcp server That works. I want to know if there is any *standardized* way to specify the NAS the DHCP server to relay the DHCP request to, using attributes in the radius Access-Accept? I have found dhcp dictionnary (talking about gateway DHCP to RADIUS) but am not sure it is intended to do that. If not does anybody knows if it's possible with redback xxxSE BRAS? Regards. -- <http://www.horoa.net> Alexandre Chapellon Ingénierie des systèmes open sources et réseaux. Follow me on twitter: @alxgomz <http://www.twitter.com/alxgomz>

2 1

Trying to configure Cisco WLC 5500 for radius auth
by Jefferson Davis 05 Oct '11

05 Oct '11

Hi all, Trying to configure our cisco WLC's to play nice with freeradius... Looking for some pointers to get the two of them talking. Will have windows, linux, and personal devices like smartphones connecting, though I suspect the bulk will be smartphones. I would rather not hand out the PSK to users as I know this will get loose. I have set up a WLAN for this but it does not seem to be talking to freeradius. Will the traffic be coming from the WLC or the designated WLAN for the SSID? Would very much appreciate any pointers. I've got it working as far as authenticating my switches and routers. Saved us probably $10k plus. -- Jefferson K Davis Technology and Information Systems Manager Standard School District 1200 North Chester Ave Bakersfield, CA 93308 661.392.2110 ext 120 (office) 661.392.0681 (fax) http://district.standard.k12.ca.us

2 1