October 2011 - Freeradius-Users - lists.freeradius.org

Freeradius + MySQL + WiFi PEAP authorisation only to a group of users
by Lumir Lindovsky 22 Jan '12

22 Jan '12

Hello, I would like to help with this: I have Freeradius version 2.1.6 I have it running with SQL and DialupAdmin. How do I give access to wifi users who authenticate with username & pass over PEAP only to a group of users? I mean that authorised would be only users from group WIFI and not other users belonging to other group like OpenVPN. Now it authorises everybody from the radcheck table. I am very new to radius and even if I was searching the net for some time I cannot find the answer which would fir my needs. Thank you for help! Lumir

4 5

no calling-station-id received
by S Adrian 09 Jan '12

09 Jan '12

Hey everybody .... I don't seem to get a calling-station-id packet when a username is trying to connect. I'm running gentoo and have the following package versions: net-dialup/ppp-2.4.5-r1 USE="activefilter atm dhcp eap-tls pam radius -gtk -ipv6" 0 kB net-dialup/rp-pppoe-3.10-r1 USE="-X" 0 kB net-dialup/freeradius-2.1.7 USE="mysql pam ssl threads udpfromto -bindist -debug -edirectory (-firebird) -frascend -frxp -kerberos -ldap -postgres -snmp" 0 kB Another problem I seem to have is people using the same pool_key in my radippool table :/ Where should I start digging ? Thanks in advance.

4 8

802.1x authentication
by gary 11 Dec '11

11 Dec '11

Hi All I am trying to set up 802.1x with EAP PEAP/TTLS method by using intel PROSset client tool with the PC. Sometimes authentication success but mostly it fail. Log attached could someone give me some direction?thanks a lot. Best Regards Gary

5 8

Daily accounting
by David Roze 02 Dec '11

02 Dec '11

Hi everyone, I have seen a lot of people who are trying to get traffic accounting collected at regular intervals to generate graphs and view per day/month etc... I have made a few modifications in order to achieve this. You can see it at http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html It works on Mysql setup but can be adapted to any db. I'd be grateful to get some feedback on this. A lot of ISPs are running into this problem. Hope this helps Regards, David

2 1

radzap: Nothing to send
by Angel L. Mateo 24 Nov '11

24 Nov '11

Hello, I have a script using radzap to zap clients. This script with freeradius 1.1.7 worked, but since I updated to 2.1.10 it didn't work. The command I run is: root@vulpes21:~/scripts/radius# radzap -P 9937 -u <user> -N 10.57.112.8 localhost <secret> radclient: Nothing to send. The output for this user in radwho -R is: User-Name = "<user>" Acct-Session-Id = "00002CC6" NAS-IP-Address = 10.57.112.8 NAS-Port = 9938 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 92 Calling-Station-Id = "9084.0d64.2d83" Any idea? One difference between my 1.1.7 config and the new one is that now I'm using virtual servers? Could it be the reason? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 6

Limit guest/anonymous users for 15 minutes
by CyAndrew 23 Nov '11

23 Nov '11

Hello, could someone give me a hints about how to reach a configuration when users with anonymous/guest account are able to access for limited time only and then blocked for some period of time? Example: 1. First user log in as guest/guest. 2. Access is granted for FIRST user and his device for let say 15 minutes only. 3. Second use log in as guest/guest. 4. Access is granted for SECOND user and his device for 15 minutes only. 5. Access for FIRST user expires. 6. Access for SECOND user expires. Is it possible to configurate such a behaviour with SQL user storage? Thank you very much for any hint or configuration example. CyAndrew -- View this message in context: http://freeradius.1045715.n5.nabble.com/Limit-guest-anonymous-users-for-15-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

FreeRADIUS EAP-TLS Lookup Client Cert From LDAP DIT
by subcon 21 Nov '11

21 Nov '11

I've searched for this sort of posting, but found issues unrelated that responded to my search string, so I decided to post it here. OK, currently I have Radius authenticating LDAP users via PAP. Works great. Imagine I want to store x509 certificate data (specifically a client certificate) in an attribute in LDAP (perhaps as a binary attribute, etc). I would like FreeRADIUS, should it be passed a client certificate INSTEAD of a user/pass, to take the DN of the cert and match it to some attribute which contains said DN and cert-data. The ultimate goal of all of this is to allow the continued use of LDAP and store the certificates (to be compared against) in the tree and not on some filesystem basis. Note that I want FreeRADIUS to continue supporting PAP user/pass auth, but only as a secondary fall-back (e.g: customer doesn't have client cert installed on machine, but has a user and password). Is this possible? Does this make sense to you? Let me know if I need to re-explain anything. Thank you, subcon -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-EAP-TLS-Lookup-Client-Ce… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4

Fixed Duration Weekly, Monthly and Daily Accounts
by JennyBlunt 12 Nov '11

12 Nov '11

Looking for some advise regarding accounts with a preset amount of time. I have freeradius setup and working with the sqlcounter module. Am just a little lost. How do I create a group which provides access for a preset amount of time, for instance one day, week or month. I've tried by using expiration but don't think thats right. Will the noreset parameter do this? In our current system (not freeradius), we'd set this up as a continuous account which starts the counter the first time the users logs on. It's only the daily, weekly, monthly plans that work like this. I feel if we set a monthly rule to allow 43200 minutes, the user will get a lot of time online! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Fixed-Duration-Weekly-Monthly-and-D… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 18

Re: Authorising Clients by Calling Station ID Not IP
by JennyBlunt 12 Nov '11

12 Nov '11

Hi Can anyone out there help me with this??? I really need to authorize our dynamic clients against a db which includes the called-station-id I can see called-station-id is only sent after authorization but need to see if this can be changed. My requirements are: 1. Allow all dynamic clients through 2. Lookup their called-station-id in the db 3. Use the 'hotspot' shared secret which is done per location and stored in the same table as above 4. Allow or disallow access to user Thanks Jenny -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authorising-Clients-by-Calling-Stat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 22

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61