March 2011 - Freeradius-Users - lists.freeradius.org

Can I have 2 virtual servers one in normal mode and the other in proxy mode created?
by Ranjith T 15 Mar '11

15 Mar '11

Hi, can I have 2 virtual servers created with the following set-up, - First virtual server configured as normal RADIUS server. - Second virtual server configured as proxy to external RADIUS server? Can anyone please point to me where I can find it? I had tried the readings from free radius, but could not find it. The sites-available/README section says the following,(and I am confused). 3. Capabilities and limitations The only sub-sections that can appear in a virtual server section are: listen client authorize authenticate post-auth pre-proxy post-proxy preacct accounting session All other configuration parameters (modules, etc.) are global. Thanks Ranjith T

2 1

Set reject in post-auth
by paul smith 15 Mar '11

15 Mar '11

Hi, I've been trying to set reject in the post-auth section if a certain attribute hasn't been set, but it doesn't seem to work (obviously I've messed it up) post-auth { if (!Session-Timeout) { update control { Auth-Type := Reject } } } Am I updating the wrong thing, or is it not possible to perform a reject in the post-auth? thanks, paul

3 4

DH parameter generation hanging
by Riccardo Veraldi 15 Mar '11

15 Mar '11

Hello, freeradius 2.1.10 here on soekris net5501 radiusd: FreeRADIUS Version 2.1.10, for host i386-unknown-openbsd4.9, built on Mar 11 2011 at 11:20:43 the problem is when starting freeradius, it hangs forever when generating DH parameters. Any clue on this problem ? thank you Rick Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/dev/arandom" random_file = "/dev/arandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ...............+.................................................................Child PID 17850 is taking too much time: forcing failure and killing child. ...............................+...................................+........................+.................................+..+...............................................................+..............+....

2 2

SQL Counter Escape String !
by Suman Dash 15 Mar '11

15 Mar '11

Please anyone advice me the way to escape run-time variables in freeradius. I am using STR_TO_DATE and freeradius run-time variable is over-riding the mysql time variables SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives 2012-03-14 21:37:23 in MySQL Whereas in freeradius SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives '14 0 2011 20:001122334455:_ 14 = Current Date 0 = MTU 2011 = Current Year 001122334455 = Calling-Station-ID _ = Speed I have tried escaping as per the thread http://freeradius.1045715.n5.nabble.com/Changing-the-format-of-a-date-attri… But no luck .. My Entire Counter is : query = "SELECT SUM(acctsessiontime) FROM tbl_acct where \ username = 'suman' AND acctstarttime BETWEEN \ (SELECT STR_TO_DATE((SELECT value FROM tbl_check \ WHERE username = 'suman' AND attribute = 'Activation'), '%d %M %Y %H:%i:%s')) \ AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' \ AND attribute = 'Expiration'), '%d %M %Y %H:%i:%s'))" The Above Query Ends Up Showing 14 0 2011 23:001122334455:_ Any help in this matter will be highly appreciated ! Cheers !

3 5

need someone to set up radius
by Matthew 14 Mar '11

14 Mar '11

I / we need someone to set up our radius. Our old 1.0.1 freeradius took a dive. We have just built a ubuntu 10.04 LTS server and install radius on it. We need it to take a handoff from Covad and authenticate our users. Prefer to use Mysql and dialup-admin interface. Will Pay money via paypal or check whichever you prefer. This is a contract position and will pay up to $400.00. You can also call 1-888-510-3614 US/Can, or 480-248-3933 outside there. E-mail is best though. Thank you. Go SuperNet by... The Web OnRamp Networks LLC

1 0

Access Accept vs Tunneled reply
by David Peterson 14 Mar '11

14 Mar '11

I am trying to work out where I would be putting attributes for Access Accept. I am sending the following in a reply: (822) [ttls] Got tunneled reply code 2 WiMAX-Classifer-Direction = Bi-Directional WiMAX-Classifer-Priority = 1 WiMAX-ClassifierID = 1 WiMAX-Downlink-QOS-Id = 1 WiMAX-Uplink-QOS-Id = 1 WiMAX-Transport-Type = Ethernet WiMAX-Direction = Bi-Directional WiMAX-Packet-Data-Flow-Id = 1 WiMAX-QoS-Id = 1 WiMAX-Schedule-Type = Best-Effort WiMAX-Maximum-Sustained-Traffic-Rate = 31457289 WiMAX-VLAN-ID = 192 R3-IF-Name = "vpws" PDFID = 1 MS-CHAP2-Success = 0xc0533d31434143314146453345463545453936444336303741423437383932303738433539 443531373533 MS-MPPE-Recv-Key = 0x7d918cc693141550f2c5b39922ad18da MS-MPPE-Send-Key = 0xe3fb5674a52feb22dee4a8c636909169 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed However, the NAS vendor states that the reply attributes should be sent during this portion of the radius handshake: Sending Access-Accept of id 72 to 172.16.4.2 port 1812 MS-MPPE-Recv-Key = 0x8616d5a2fbb28b308b5ddf419333f8a2a07b79bfbdd679b4161262be7480eb54 MS-MPPE-Send-Key = 0x7f856a84bf226204dc2c4c3f5a25c9d808cb584c1b927dafb1a09ab7a360cfc8 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{sm=1}D8F69CCE1EF580B70933A526924A2D0C" Currently I have the attributes listed as a group reply. How do I send the attributes needed during the access accept packet? David

8 17

String Escape in SQL Counter !
by Suman Dash 14 Mar '11

14 Mar '11

Please anyone advice me the way to escape run-time variables in freeradius. I am using STR_TO_DATE and freeradius run-time variable is over-riding the mysql time variables SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives 2012-03-14 21:37:23 in MySQL Whereas in freeradius SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives '14 0 2011 20:001122334455:_ 14 = Current Date 0 = MTU 2011 = Current Year 001122334455 = Calling-Station-ID _ = Speed I have tried escaping as per the thread http://freeradius.1045715.n5.nabble.com/Changing-the-format-of-a-date-attri… But no luck .. My Entire Counter is : query = "SELECT SUM(acctsessiontime) FROM tbl_acct where \ username = 'suman' AND acctstarttime BETWEEN \ (SELECT STR_TO_DATE((SELECT value FROM tbl_check \ WHERE username = 'suman' AND attribute = 'Activation'), '%d %M %Y %H:%i:%s')) \ AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' \ AND attribute = 'Expiration'), '%d %M %Y %H:%i:%s'))" The Above Query Ends Up Showing 14 0 2011 23:001122334455:_ Any help in this matter will be highly appreciated ! Cheers !

1 0

Concurrent Sessions per user
by Moayad Mohammad 14 Mar '11

14 Mar '11

Dear, Is there is a way to control the concurrent sessions per user? Regards,

3 3

Need help on FreeRadius+OTP+OpenLDAP integration
by pradyumna dash 14 Mar '11

14 Mar '11

Hi, I need a documentation on how to implement FreeRadius+OTP+OpenLDAP, I have installed and configured FreeRadius+OpenLDAP before but never used OTP, and also would like to know how OTP will be configured with SASL and how does SASL auth store OTP parameters. Another problem am facing is, first there is an authentication with freeradius but the next thing that is triggered in pam.d/ssh is the "account" section for authorization and here OpenLDAP requires password for the second time. So a user needs to login twice because of this. How to solve this issue Please help me out to solve this issue. Regards, Pradyumna

2 1

Need help on FreeRadius+OTP+OpenLDAP integration
by pradyumna dash 14 Mar '11

14 Mar '11

Hi, I need a documentation on how to implement FreeRadius+OTP+OpenLDAP, I have installed and configured FreeRadius+OpenLDAP before but never used OTP, and also would like to know how OTP will be configured with SASL and how does SASL auth store OTP parameters. Another problem am facing is, first there is an authentication with freeradius but the next thing that is triggered in pam.d/ssh is the "account" section for authorization and here OpenLDAP requires password for the second time. So a user needs to login twice because of this. How to solve this issue Please help me out to solve this issue. /Neo

1 0