April 2011 - Freeradius-Users - lists.freeradius.org

multiple authentication methods
by Nick Kalen 01 Apr '11

01 Apr '11

Hello, looking at the docs, it looks like it's not possible to try to authenticate against a local LDAP server and in case it failes send it to another radius server? Can someone please prove me wrong?

2 1

sqlcounter & returning Gigawords?
by YvesDM 01 Apr '11

01 Apr '11

Hi, We 're about to upgrade our radius which is still running 1.1.7 We use monthly datalimits so we patched the sqlcounter in order to make it reply max 4GB of left quota (to avoid wrapping), even if the user still has 10GB quota left. Of course this results in a logged out user when he reaches a session of 4GB. As general datatraffic increases we would like to avoid this in our new radius setup. In the newest version, is there a way to reply gigawords from sqlcounter? If not, is there another solution to this? Many thx. Yves

2 2

same username different password on different NAS
by Richard Thornton 01 Apr '11

01 Apr '11

I am just learning about freeradius now, and would like to see if I can use it to manage access and logging for users at a few hundred locations. Each remote office has between 1 and 50 users, and at first glance freeradius will do the job, but I just noticed a problem with overlapping usernames. I am not sure if I need to use virtual servers, or if there is a better / easier way. The problem is that each location may have a user with the same login name as a different location. For a simple example, each site could have a login of "manager", but the manager username at each site would probably pair up with a different password. Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location? I'm picturing something like the radcheck table containing an additional field for NAS such that freeradius would key off the combined of NAS address and username fields, rather than just the username field. I am not opposed to using virtual servers if that is a better idea, but I'm worried about the overhead of several hundred of them... Any ideas or pointers to docs would be appreciated. -Richard

4 4

Installing to pfsense
by Franz 01 Apr '11

01 Apr '11

Hi, I have currently installed freeradius 2.1.10 and Mysql 5..5.10 on a pfsense box which is freebsd. I want this to work with mysql however I was wondering how to install freeradius with mysql support as I am unable to do it via ports or try any commands or flags with ./configure via tarball. Only pkg_add is available, can I recompile or install from scratch to get freeradius to bind to mysql? Thanks, Frank

4 10

Question about authentication
by matteo 01 Apr '11

01 Apr '11

Hello list, suppose I want to authenticate a device capable of using PEAP with EAP-MS-CHAP v2 or EAP-GTC and TTLS with EAP-MS-CHAP v2 or MS-CHAPv2 and I have user password stored in LDAP (linux) with the crypt scheme and freeradius server 2.1.9. Is there any mechanism to successfully authenticate the client? for example getting user password from ldap, and comparing with the one in the request packet (previously encrypted)? Thanks in advance. Matteo

2 1

access challenge on empty password
by izotov 01 Apr '11

01 Apr '11

Hi, I use pam_radius with openssh on a FreeBSD box. When I authenticate, and for the first time I simply enter an empty password then the second time I am prompted for the password characters are echoed on the terminal. As I can see my freeradius server responses an access challenge to request with an existing user and empty password combo. Is this a normal behaviour? How can I configure the system not to do so? Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/access-challenge-on-empty-password-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Freeradius + Active Directory
by Ronald Chan 01 Apr '11

01 Apr '11

Hi List, I'm really sorry if this has been asked before, I was able to setup to authenticate radius via AD, now the problem my problem is, is there a way i can apply for Max-All-Session to each account on ad, just like with any other modules like rlm_sql ?, or I should say, is there a pre-autheticate section on the configs just like with pre-accounting section?, please bare with my english :D. Thanks in advance, Best regards, Ronaldo Chan

4 5