December 2011 - Freeradius-Users - lists.freeradius.org

Domain Group Authentication
by McSparin, Joe 28 Dec '11

28 Dec '11

I currently have FreeRadius setup to authenticate agains Active Directory and it works great. I was wondering though for everyone out there using it if you had any reccomendations for this scenario: I have users that will connect wirelessly using their NT domain username and password on the hospitals wireless devices. I also however have doctors that will bring in their own laptops and connect. When they connect with their laptops though I do not want them to have the same privileges as when they connect on the hospital wireless devices. If they are connecting with their laptops even though they use their Ntdomain user name and password I want to restrict them to a public vlan. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 1

Can't start server on mac OS X
by maldridge 28 Dec '11

28 Dec '11

I have tried for a few weeks now to get this working. I have a mac os machine running with 10.6 installed and updated. I had a linux friend help me with the dependancies/compiling and we were able to compile with no errors. The problem came in attempting to start the server. It appears to hang consistently at the stage where it attempts to generate a key, with a permission denied error. I am comfortable in the terminal, but I need specific instructions to execute. Any help is appreciated. Below are the contents from the debug that it spit out when loading. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Can-t-start-server-on-mac-OS-X-tp51… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Installing Third Part Certificate on FreeRadius
by McSparin, Joe 27 Dec '11

27 Dec '11

I have a certificate called AddTrustExternalCARoot.crt that I would like to have FreeRadius start using. I know I need to change the eap.conf to look at the new cert however I was noticing that when the test certificates are created there is both a server.crt and server.pem. Is there a difference and do I need to do something to create a AddTrustExternalCARoot.pem file. Thanks, Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3

freeradius first hour free ???
by backghost 27 Dec '11

27 Dec '11

i have installed this configuration: CentOS 5.1; freeradius 1.1.3; i have installed VMware on Centos, and pfsense (freeBSD) on it; i also have my php aplication on Centos and i use it for add new user to mysql and for generate report about used trafic; when user try to browse some page (google.com; facebook.com; e.t.c) pfsense popup its captive portal, and if user have username and pass he can pass throught, but if havent it cant, so everything works perfect. what i need? i just wana to make all my new users, to have first hour free to use internet, and when the hour exceed then the pfsense captive portal popup. sory for my english, i google about this thing all 4 days, and i belive i dont answer right question, so i think somebody can help me about this thing. tthank you again -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-first-hour-free-tp510124… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Freeradius accounting of inner identity when using PEAP
by Pietro Accerboni 27 Dec '11

27 Dec '11

Hi all, I'm testing accounting on a freeradius (version 2.1.11). The nas appliances are Cisco Wireless APs, and I've configured PEAP/MSCHAPv2 authentication (using a openldap backend, where the freeradius server verify username and passwords). Anyway, all works, so authentication succeds without issues, and also i get network access accounting infos on the radius server (i see the 1813 port radius packes, also i can see users with radwho). The problem arises from the tunneled nature of PEAP. Accounting works, i guess, only on the esternal attribute User-Name, so all users that (correctly) configure outer identity with a generic 'anonymous' is logged in the accounting session with the same, useless, username: # radwho Login Name What TTY When From Location anonymous anonymous shell S276 Tue 11:53 10.4.5.5 But in my configuration freeradius is not only a proxy, it also behave as a eap server, manage the tls tunnel with the user supplicant, and verify the inner peap/mschapv2 credentials, so from the freeredius '-X' log I can see: ------------------------------------ [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { [peap] Setting User-Name to 'realusername' --------------------------------------- Hhere 'realusername' is a placeholder for one of my real users, but i can get this info only running freeradius with '-X' option. Is there some practical way to get this information from freeradius or, better, 'link' this information with the Accounting-Request packets i get from the nas after the authentication phase? Thanks in advance Pietro

2 1

Decoding Access Request Parameters
by Ratnesh Sinha 27 Dec '11

27 Dec '11

Hi, I am using FREERADIUS v.2.1.12 I am getting the following attributes in Access Request from Radius Client: ATTRIBUTE User-Name 1 string ATTRIBUTE User-Password 2 string ATTRIBUTE NAS-IP 4 ipaddr ATTRIBUTE NAS-Port 5 integer ATTRIBUTE Service-Type 6 integer ATTRIBUTE Prepaid-acct-Capability 91 octets ATTRIBUTE Prepaid-Acct-Quota 90 octets ATTRIBUTE Session-Termination-Capability 88 integer ATTRIBUTE Calling-Station-ID 31 string ATTRIBUTE Correlation-Id 44 string I am getting the following printed on the radius server console: rad_recv: Access-Request packet from host 127.0.0.1 port 47213, id=2, length=195 User-Name = "testuser" Vendor-Specific = 0x0001869f010a7465737475736572 Vendor-Specific = 0x0001869f020a77656c636f6d6531 Vendor-Specific = 0x0001869f04067f000001 Vendor-Specific = 0x0001869f0506000011d7 Vendor-Specific = 0x0001869f060600000008 Vendor-Specific = 0x0001869f5b071234567890 Vendor-Specific = 0x0001869f580600000001 Vendor-Specific = 0x0001869f1f0c39383830323136313434 Vendor-Specific = 0x0001869f2c0c31323334353637383930 User-Password = "welcome1" Message-Authenticator = 0x728dfb62b5b0ff17703c64ac1b97d6da Pl. help me out how to get these attributes in my C program rlm module. Regards, Ratnesh

1 0

Re: freeradius first hour free ???
by Alan Buxey 27 Dec '11

27 Dec '11

Fairly easy to do, especially with a recent version (ie 2.x) of freeradius alan

2 1

Is it Possible to use FreeRadius without certificates
by McSparin, Joe 26 Dec '11

26 Dec '11

I would like to just have freeRadius authenticate against my active directory in windows using only the user name and password in Active Directory for authentication. Is this possible to do I don't want to have to mess with installing certificates on the user machines or the server. Is this possible? Thanks, Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 2

radwho once again
by Mateusz Pałosz 26 Dec '11

26 Dec '11

On Mon, 15 Dec 2008 13:28:04 -0200, somebody ask about radwho. server:~# radwho radwho: Error reading /var/log/freeradius/sradutmp: No such file or directory Answer was to uncomment sradutmp in accounting section. But I want to know, how to force radwho to read from existing /var/log/freeradius/radutmp? -- Kind regards - Matthew

2 1

Logging User Accounts
by Andreas Rudat 26 Dec '11

26 Dec '11

Hello, I try to log users if they connect to radius, is it possible to track that without all other informations from debug mode? So best would be I only see that: [TIME]: foobar logged in Thanks

1 0