May 2011 - Freeradius-Users - lists.freeradius.org

New FreeRADIUS wiki - Help appreciated!
by Arran Cudbard-Bell 27 May '11

27 May '11

Dear Users, One of the largest complains with FreeRADIUS is the lack of comprehensive documentation. The current wiki @ wiki.freeradius.org has served its purpose, but has ultimately failed to provide an update to date, well organised source of documentation. The current major problems with the wiki are: * spam users - which meant we had to lock registration, and discouraged new users from contributing * exporting information - all pages are stored in an sql lite instance, which makes it hard to automatically roll pages into releases * formatting information - Information stored in the wiki is in the Media wiki format, whereas the documentation bundled with FreeRADIUS is either unformatted or in rst format. To try and solve these issues and glue everything together a bit more, i've been working with Alan DeKok to set up a new instance of Gollum. Gollum is a ruby on rails application which exposes a git repository as wiki site. Gollum can render files in many markup languages including plaintext, RST and Mediawiki format, which means we can import all current server documentation, all current wiki documentation and have them neatly presented in a single wiki site. Neat huh? But what about spam and registration? Well by default gollum doesn't authenticate anyone. But because it's a rails application we can drop in a library called 'OmniAuth' which uses Oauth to authenticate a bunch of providers. This allows us to leverage authentication and spam account prevention services of providers like GitHub, Facebook and Twitter. Unfortunately the new wiki isn't ready from primetime. The mediawiki page format renderer in gollum isn't perfect, so we need to convert those pages to RST as a priority. If you want to help out, please do the following: 1) Sign up for Facebook, Twitter or GitHub 2) Go to http://power.freeradius.org:4567 3) Pick a page where the MediaWiki format doesn't render correctly 4) Edit it 5) Change edit mode from MediaWiki to reStructuredText 6) Convert markup to RST (see here: http://docutils.sourceforge.net/docs/ref/rst/restructuredtext.html) 7) Save the page 8) Get warm fuzzy glow from contributing to open source Also please report any bugs here: https://github.com/github/gollum/issues?_pjax=true&state=open Many Thanks, Arran Arran Cudbard-Bell RM-RF Limited - Security consultation and contracting VoIP: +1 916-436-1352 Cell: +44 7854041841

6 21

IPv6 Accounting
by Shannon Ward 27 May '11

27 May '11

Can someone point me to docs or help me get my head around what changes need to be done for IPv6 Accounting? Looks like I may need to add some fields to radacct and update the INSERT and UPDATE statements with IPv6 variables. Is it necessary to run freeradius dual stack for IPv6 AAA? Version 2.3.11-6 MySQL backend I am using sql_log Thanks Shannon

3 3

Copy accounting to a proxy and ignore reply
by Sandro Magri 27 May '11

27 May '11

I'm running a farm of freeradius server 2.1.1, 16 with Suse Linux and 32 with Sun Solaris, and I need to proxy a copy of accounting packet to a pool of remote home server, without wait for reply/ack from remote servers, and without retries or failover, for performance reasons. The accounting packet ( +1000/sec) must go asap in one db of a pool di mysql servers before to be proxied, rejecting accounting if all the dbservers fails . It's possibile to do this with freeradius in a very efficient manner? Any idea for the better way to implement this configuration? I'm trying with a config like: ........ accounting { redundant{ sqldb1 sqldb2 sqldb3 sqldb4 detail } if ( "%{Called-Station-Id}" == "my.apn.domain" ) { update control { Proxy-To-Realm := "homeserver_pool" } } linelog } ...... but I'm thinking about using the internal radrelay in freeradius, proxying after copying acct to detail file, like: sites-available/copy-acct-to-home-server sites-available/robust-proxy-accounting sites-available/decoupled-accounting Best regards and thanks in advance, Sandro Magri

2 2

Problem with Cache and Reject Users
by Rafal Kaminski 27 May '11

27 May '11

Hi, I have problem with users which type 2-3 times bad password. In debug mode i have something like this: Fri May 27 16:11:01 2011 : Info: [peap] The users session was previously rejected: returning reject (again.) Fri May 27 16:11:01 2011 : Info: [peap] *** This means you need to read the PREVIOUS messages in the debug output Fri May 27 16:11:01 2011 : Info: [peap] *** to find out the reason why the user was rejected. Fri May 27 16:11:01 2011 : Info: [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. Fri May 27 16:11:01 2011 : Info: [peap] *** what went wrong, and how to fix the problem. All is fine if users put good password and auth. with LDAP. But some times they made some typo :( I tried read all line in debug mode, how is write here, but I have one question: - Is there any possible to remove/clean this cache? I set in eap.conf - cache enable=on and lifetime = 1 hours, but nothing. Thanks a lot for help. Best, Rafal Kaminski

2 3

Default accounting
by Tim McNabb 26 May '11

26 May '11

Where does accounting logging primarily go by default? Can it be sent to a text file? Thanks in Advance, Timothy McNabb Network Administrator Velociter Wireless, Inc (209)838-1221

3 2

Different Auth Methods based on client entries with ntlm_auth
by O'Neil, Donald A. 26 May '11

26 May '11

Is there any way to perform a different authentication method based on the specific client entry (or group of entries) using the ntlm_auth method? We're implementing the ntlm_auth interface to AD, and need to specify the group to authenticate against differently for different classes of machines/devices. I've followed the instructions on http://deployingradius.com/documents/configuration/active_directory.html and it works great for one group when I add the option --require-membership-of=SomeGroup but I need a way to figure out how to specify that group name, perhaps based on the nastype, or some other variable I can set in the client configuration. Any ideas? Don O'Neil Senior Network Engineer SAIC - CCSD Network Operations (702) 351-7261 cell (702) 799-6174 fax 0099-5941 wan oneilda(a)saic.com

1 0

TLS Check Cn Question
by David Mitchell 26 May '11

26 May '11

Greetings, currently I'm using the check_cert_cn option in my EAP-TLS setup. I think I may have the need to support two possible CN formats. Is there any way to do a conditional check? I don't think the eap.conf file is unlang interpreted so I don't think I can include full regexp or if-then conditionals can I? Is there some other way to accomplish this? The docs mention possibly doing this by checking TLS-Client-Cert-CN but I'm not sure where exactly I would do that. Thanks in advance, -David Mitchell ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 3

Debug STDOUT
by Norman Zhang 26 May '11

26 May '11

[root@box ~]# /usr/sbin/radiusd -xx [root@box ~]# ps aux | grep radius radiusd 32539 0.0 0.1 148872 2672 ? Ssl 10:50 0:00 /usr/sbin/radiusd -xx root 32564 0.0 0.0 61220 752 pts/0 R+ 10:50 0:00 grep radius For some reason I can't get radius -x to display to STDOUT. Any hints? Norman

2 1

Authorize only through a Postgres Query
by Pedro Costa 26 May '11

26 May '11

Hi, I'm currently trying to implement an authorization process only, between a Cisco GGSN and Freeradius. My idea is for the freeradius to authenticate regardless of the MS (IMSI) and after authentication it Queries a Postgresql Database based upon IMSI to get the IP Pool that he will be used. On a previous post Phil Mayers explained how i could do the SQL query (Freeradius GGSN->Postgresql Based upon SELECT it will trigger a specific IP Pool). But my issue is that i'm not able to authenticate (regardless of the IMSI - No database query is required for this) and execute the SQL XLAT being (the SQL SELECT that will get the IP Pool name for the specific IMSI). So how can i set up the Freeradius to authenticate my attempts from the GGSN and grab the IMSI (from the Login data), execute the SQL XLAT and return in the reply the specific IP address (from the IPPool that was selected based on the SQL XLAT)? BR, Pedro Costa

2 1

Two different sets of Group Authentication
by Raheel Itrat 26 May '11

26 May '11

Hi, Currently I am authenticating only One group of users in Cisco Switches group. Now, I have to add another VPN group and distinguish between two sets of group autentication , VPN Users, and Cisco switches. I'd like to control access to each of those separately (different AD Groups SIDs). Do i have to do somethinbg like creating two modules (ntlm_auth and ntlm_auth2) or two different mschap modules with respective ntlm_auth entries? Even then how would it differentiate between the two? Is defining huntgroups an option if using ntlm as Auth type? BR, Raheel

1 0