July 2011 - Freeradius-Users - lists.freeradius.org

Freeradius 2.0.5 simple configuration fail
by ael.gain＠free.fr 06 Jul '11

06 Jul '11

Hi everyone, I'm currently trying to set a Freeradius 2.0.5 on a synology NAS which I installed via ipkg. I would like to authenticate the wifi users throught a netgear WG103 '802.1x enabled'. So i've just modified the users file to add a 'rad' user : "rad Cleartext-Password := "rad"" And added in clients.conf : client 10.1.1.16 { secret = ap_pass shortname = ap } I configured the ap according to these settings. Everything works fine when using radtest, but when trying to authenticate with the ap, i get the debug output that I put in attached file. I suppose the problem comes from : "auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user." I search the Internet a whole day to fix this error without making the radius working... Do you have any idea ? thanks

2 1

Next Pool option
by Antonio Maciá 06 Jul '11

06 Jul '11

Hi! Im running the 2.1.11 version and I would like to know how to configure next-pool options in the ippool file in order to get a ip from a secondary pool when the first pool is starved. Lets say I have two pools, 172.16.1.0/24 and 192.168.10.0/24 and I want that as soon as the 172.16.1.0 range is empty, the Radius start giving addresses form the 192.168.10.0 pool. Is it possible? Thanks in advance.

2 3

FreeRadius 2.1.10 with Oracle support under Fedora 14
by Aurélien Lafranchise 06 Jul '11

06 Jul '11

Hi all, It might be redondant with another but slightly different. I have installed FreeRadius thanks to yum over Fedora 14. Everything went fine and was working fine until I need to add the Oracle support to have the accounting working with on Oracle database. When I needed LDAP support I installed the package freeradius-ldap.x86_64. Unfortunately I can't find the same for Oracle and I don't think it is already installed in the basic package. When I configured sql.conf and activate in site-available/default the accounting sql section I get this error : /etc/raddb/sites-enabled/default[393]: Failed to load module "sql". /etc/raddb/sites-enabled/default[360]: Errors parsing accounting section. Could you help me to find a solution ? Cheers Aurélien

8 27

IIS authentication with FREERADIUS !
by aacable 06 Jul '11

06 Jul '11

Hello All, I am stuck in a situation and need help. I have a ISP type local network, I am using Mikrotik router as PPPOE server and FREERADIUS (ubuntu) as a radius server for about 2000+ users. I Have 5 Terabyte of Media sharing server, (hosted on IIS FTP) , Is there any way that IIS can get authentication from FREERADIUS ? so that only those users can access ftp media sharing server who have account on radius server. Can you please give me some hints on how I can configure IIS to use authentication from FREERADIUS server ? Help plz :) Regards, SYED JAHANZAIB -- View this message in context: http://freeradius.1045715.n5.nabble.com/IIS-authentication-with-FREERADIUS-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Log the IP client after a successful login
by joanroldan 06 Jul '11

06 Jul '11

Hi, Is it possible lo to log the IP address of the client after a successfull auth/login? Something like that: Tue Jul 5 17:18:46 2011 : Auth: Login OK: [elopez(a)irta.es/<via Auth-Type = EAP>] (from client WLC_SSCC port 1 cli B8-C7-5D-E4-A3-6B) *$IPADDRESS* Thanks in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Log-the-IP-client-after-a-successfu… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

WISPr-Bandwidth-Max-Down / ChilliSpot-Bandwidth-Max-Down ?
by becoco 05 Jul '11

05 Jul '11

Hello, What is the difference between WISPr-Bandwidth-Max-Down and ChilliSpot-Bandwidth-Max-Down ? Thank you, Mickael

2 1

"use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 05 Jul '11

05 Jul '11

Hello All, I'm using FreeRADIUS 2.1.11 as a proxy for authenticating PEAP clients with RADIUS server not supporting EAP. All is working well except that when I use "proxy_tunneled_request_as_eap = no" in eap.conf, FreeRADIUS is not passing back all the AVPs sent by RADIUS server in Access-Accept(MSCHAPv2) to the Client, only few ones. But when I set it as "proxy_tunneled_request_as_eap = yes", FreeRADIUS is relaying back all the AVPs received from the RADIUS server properly. eap.conf: ------------ eap { peap { copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } } Hence, in spite of setting "use_tunneled_reply = yes", why isnt FR copying all attributes in Access-Accept back to client ? Is this some bug, fixed in 3.x ? -- Nitin

2 1

Different config based on NAS
by Hilton Boyce 05 Jul '11

05 Jul '11

Hi I need to know if there is a way of having the same username and password but sending a different reply based. For example Client send request for DSL Auth send reply for that config or client send L2TP Auth reply with different config. regards Hilton

2 2

AW: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 05 Jul '11

05 Jul '11

>>> Defining all three server whithin one section in modules/ldap >>> >>> ldap { >>> server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" >>> .} >>> >>> And setting just "ldap" within authorize and authenticate: >>> >>> With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. >>> (1-3 minutes at most will be acceptable, "zero outage" >>> gorgeous/expected) >>It should not take 15 minutes. >>What is your "net_timeout" set to? >net_timeout = 1 >timelimit = 2 >timeout = 4 >For testing i added a hostroute to an other gateway (=host unreachable) OK, i tested around with a single ldap section. Setting a route to a different interface for testing was a bad idea! I watched at the connections on the ldap port, and made my tests. - I made the first request (with positive answer) - A connection to one server was opend and resides "established"! - adding the route for that server to an other gateway - the established connection is still visible (netstat -anlp | grep <ldap-server-port>) - all requests for the next 15 minutes fail (server not rachable) - after 15 minutes, the esablished connection terminates, and a new connection to an other server is opened. Radius has switched to an other server, and everything went fine from now on. But i made the same test again, with "tcpkill" from the dsniff package, instead of setting a route. And with this tests radius switches imediately to an other server, no request fails! :-) Now is just unclear, will these tests be representative for real ldap-server or connection problems? Jan

2 1

Freeradius 2.1.11 and Oracle support
by Aurélien Lafranchise 05 Jul '11

05 Jul '11

Hi all, I thought that the 2.1.11 version should be easier to compile and get Oracle support. However, I can tell you that is not easy. I am doing a ./configure --with-oracle-version=11 --with-oracle-lib-dir=/usr/lib/oracle/11.2/client64/lib --with-oracle-include-dir=/usr/include/oracle/11.2/client64 but the ./src/modules/rlm_sql/drivers/rlm_sql_oracle/config.log tell me some interesting stuff, I have the feeling that it does not take the oracle version number : ... conftest.c:8:17: fatal error: oci.h: No such file or directory ... configure:2771: gcc -o conftest -g -O2 -I/usr/include/oracle/11.2/client64/ conftest.c -L/usr/lib/oracle/11.2/client64/lib/ -lclntsh -lnnz10 >&5 => should be lnnz11 /usr/bin/ld: cannot find -lnnz10 => normal, i don't have it ... configure:2837: WARNING: FAILURE: rlm_sql_oracle requires: libclntsh libnnz10. => why 10 ? ... Thanks Aurélien Lafranchise | Consultant *Tél. : +33 (0)6 03 88 36 26 *| Fax : +33 (0)1 75 43 55 11 www.snype-consulting.com

2 2