May 2011 - Freeradius-Users - lists.freeradius.org

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61

Sending accounting packets to more than one server?
by Tim McNabb 27 Oct '11

27 Oct '11

Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I'm working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done? Thanks in advance, -Tim

6 12

Freeradius mysql acct copy
by Alexander Kosykh 27 Oct '11

27 Oct '11

Hi. I need to copy acct packets to my billing server and save acct in standart freeradius radacct table in mysql. I'm saving acct in radacct table now, but can't duplicate them to other (billing) radius server. I've tried to use copy-acct-to-home-server but no success. As I understand, virtual server from copy-acct-to-home-server use a detail files to read acct information from default server. Is the way to don't use detail file and use mysql? Regards, Alexander.

4 6

How to configure proxy server to send a copy of acct to remote/home server
by Difan Zhao 27 Oct '11

27 Oct '11

Dear experts, I configured my Freeradius2.1.7 server to be a proxy server which will forward the PEAP authentication packages to a remote server. The authentication part works great. I configured my switch to send accounting information to the proxy server. The proxy server is using MySQL to store the acct info. This part works fine too. However I'm requested to also send a copy of the acct info to the remote server... I'm still checking my switch (Cisco) and see if it can send two copies of acct info to two different servers at the same time. However, is it possible to make FreeRadius to automatically forward a copy to the remote server?? Thanks! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com INTERNET | MEDIA | VOICE The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

3 2

EAP-TLS + Symbian = weird behaviour
by Zeus V Panchenko 14 Oct '11

14 Oct '11

Hi, may somebody advice, please i have: > uname FreeBSD 8.1-RELEASE amd64 > radiusd -v radiusd: FreeRADIUS Version 2.1.10, for host amd64-portbld-freebsd8.1, built on Apr 4 2011 at 22:44:15 radiusd configured with EAP-TLS only and works fine with xNIX-es, WinXP, Android and Maemo with Symbian (Nokia E51, E52) i face much weird picture ... the same device works fine (getting authorized well) via one AP in my LAN and remote VPN, but receiving !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session for state ... did not finish! !! Please read http://wiki.freeradius.org/Certificate_Compatibility !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! via another AP (in remote VPN, while other OS still authorized well) AP are the same models and configured the same way what can cause this behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 6

Freeradius capable of url-redirect
by Nathan McDavit-Van Fleet 15 Aug '11

15 Aug '11

Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2. I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access. http://www.cisco.com/en/US/products/ps6366/products_configuration_example091 86a0080956185.shtml Is this handled somehow is Freeradius?

6 12

can policy.conf be used to create an access control list
by michael lamborn 28 Jul '11

28 Jul '11

Hi, I am using version freeRadius 1.1.7. I am trying to create an access control list via radius, to prevent specific PC's/locations from accessing my network. Please see my policy.conf example below. My freeRadius server keeps sending an access-accept, when I try to login in from my office as a test, which has the IP address 10.2.222.35. I don't understand why the server is allowing the login. It seems logical to me the way that I have approached an implementation, but I can't find any specific info from the wiki or in internet searches. So I am not sure if I am still misconfigured or if it just doesn't work for some other reason. Thanks, Mike In policy.conf, I have the following, but it doesn't have any affect ( I do have '$INCLUDE ${confdir}/policy.conf' in my radiusd.conf file): policy { forbid_login_ip_hosts { %{request:Login-IP-Host} =~ /^10.2./ { reject } } }

3 2

Re: Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory
by John 27 Jul '11

27 Jul '11

I attached the captured packets. Please open it with wireshark. The password from OD is “********”. It is neither cleartext password nor encrypted password. --- 10年3月18日，周四, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: Re: Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年3月18日,周四,下午7:01 I configured the LDAP module talks to Open Directory, based on the debug looks the password fetched from OD, but the authentication always failed. Is there any guide for freeRADIUS+ldap+OD integrating? I setup freeRADIUS talks to OpenLDAP, it works well. Can OD return cleartext password like OpenLDAP do? John. --- 10年3月15日，周一, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年3月15日,周一,下午12:59 John wrote: > Hello, > We want to setup freeRADIUS with Peap/MSCHAPv2 talk to Apple Open > Directory. I found this option 'use_open_directory'. But looks we need > to install freeRADIUS on the same machine with Open > Directory.(https://lists.freeradius.org/pipermail/freeradius-users/2010-Feb… > > Do we have to run freeRADIUS on the same machine with OpenDirectory? Yes. > Is > there a work-around that we can run freeRADIUS seperate from OpenDirectory? OpenDirectory is an LDAP server. Configure that way in FreeRADIUS. It might work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----下面为附件内容----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

rlm_sql: "NUMERIC VALUE OUT OF RANGE" error
by Vegard Svanberg 07 Jul '11

07 Jul '11

Freeradius 2.1.0. I have a NAS which sends a NAS-Port-Id attribute in the range 2147483648..2164260863. PostgreSQL doesn't like the query Freeradius performs. It's choking when trying to insert for instance '2163214239::integer' into the radacct table. $ select 2163214239::integer; ERROR: integer out of range Example: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('80f0079f', '5c9f0b7076dcc9c0', 'username', NULLIF('', ''), '1.2.3.4', 2163214239::integer, 'Wireless-802.11', ('2008-09-26 09:52:52'::timestamp - '1'::interval - '3382'::interval), ('2008-09-26 09:52:52'::timestamp - '1'::interval), NULLIF('3382', '')::bigint, '', '', (('0'::bigint << 32) + '57743'::bigint), (('0'::bigint << 32) + '294709'::bigint), 'hotspot', 'XX:XX:XX:XX:XX:XX', 'Lost-Service', '', '', NULLIF('192.168.12.94', '')::inet, 0) rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error integer out of range rlm_sql_postgresql: Postgresql Fatal Error: [22003: NUMERIC VALUE OUT OF RANGE] Occurred!! [sql] Couldn't insert SQL accounting STOP record - ERROR: integer out of range rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Quick fixes...? -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

6 6

Authentication Problem
by john decot 24 Jun '11

24 Jun '11

Hi , I have been using freeradius-server-2.1.10 . Dialupadmin is using for web based administration. It was working fine till yesterday. I have changed added attribute to check Max-All-Session. Then I have face problem of No authenticate method (Auth-Type) found for the request: Rejecting the user however the authorized section is working fine. After googling i have check with option default Auth-Type = Local but it was not success. this error occurs for new create user only , old user are authenticating normally. I have revert back my changes with removing attribute to check Max-All-Session but still the error exists. Please advise me. Regards, John

5 11