January 2012 - Freeradius-Users - lists.freeradius.org

SQL Statement in users file
by McSparin, Joe 05 Jan '12

05 Jan '12

Does this seem like a doable scenario in the users file it doesn't return anything but I'm not sure if it is query issue or if those values are not available in the users file. DEFAULT Auth-Type = "ntlm_auth" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-id = "%{sql:SELECT 'vlans.assigned_vlan' FROM 'vlans' WHERE 'vlans.device_mac' = '%{Calling-Station-Id}'}" Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 5

freeradius+openvpn disconnect user from radius
by Azfar Hashmi 05 Jan '12

05 Jan '12

Anyone confirm me that openvpn support session-timout/acct-session-timeout, i want radius to tell my NAS to disconnect users if they reached their expiration. Currently its not working.

3 11

Re: Freeradius with EAP-SIM
by Alan Buxey 05 Jan '12

05 Jan '12

Ready to process requests. ...and that's it. Where's the incoming query to be dealt with? alan -- Message may be brief as it has been sent from my mobile

3 3

Using FreeRadius to override VLAN Assignment
by McSparin, Joe 04 Jan '12

04 Jan '12

I have put the following into my users files DEFAULT Auth-Type = "ntlm_auth" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-id = "1001" I have told my access point to Allow RADIUS Override on the VLAN Assignment however the VLAN is not getting overridden. Does the Above entry into my users file not actually send back a vlan assignment and if not is there somewhere else this is supposed to be done? Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 7

Accounting not working
by John Corps 04 Jan '12

04 Jan '12

Hello All, I have 4 servers setup exactly the same at 4 different locations. Each server is using the exact same configs and is working perfectly well doing what I want it to do. The only issue I have is at the 1 location, I am not getting any accounting requests and therefor nothing is being updated in the radacct table. Starting radiusd in debug mode -X shows that its listening for accounting requests the exact same as the 3 other locations, just no accounting requests are coming through. Is there any way to do a test to see if its even listening and working at all? I have been racking my brain over this the last few days, checking switch and router configs etc but that is all the same as the other 3 locations as well, everything is the same at all 4 locations, just this one location isn't doing the accounting. Any help would be great :) Thanks.

3 5

RE: Radperf message error
by Serge Toussaint 04 Jan '12

04 Jan '12

Hi, For a big test for 9 000 requests with radperf, I have got the message : Radperf: received response to request we did not send. (id=125 socket 19) ( 500 lines) ???? Serge -----Message d'origine----- De : freeradius-users-bounces+stoussaint=netprest.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+stoussaint=netprest.com@lists.freeradius.or g] De la part de Daniel Finger Envoyé : mercredi 4 janvier 2012 16:11 À : FreeRadius users mailing list Objet : Re: Not sending all trusted CA Certificates in EAP-TLS Server Hello Hi! As far as I can see the Server does not send the full certificates, but only announces the certificates the server knows. I did not read the RFC yet, but I assume that this only informs the client which certificates can be requested to verify the server certificate chain. Am 04.01.2012 15:09, schrieb Alan DeKok: >> Is it possible to change the behaviour that only the certs in the >> certificate_file are used? > > Use CA_path instead of CA_file. That might help. It does indeed help. Thanks! -- Regards Daniel Finger

1 0

Not sending all trusted CA Certificates in EAP-TLS Server Hello
by Daniel Finger 04 Jan '12

04 Jan '12

Hi! We are using 802.1X EAP TTLS to Authenticate Phones in our network. It is working, but after seeing a tcpdump, the Radius Server is sending all known CA Certificates to the Client during EAP TLS Negotiation. Our Config looks like this: private_key_file = ${certdir}/radius_server.key Containing the private Key of the Radius Server certificate_file = ${certdir}/radius_server.crt This contains the radius certificate and the corresponding self-signed CA certificate. CA_file = ${cadir}/trusted_ca.pem Contains different sub-CA certifikates and the self-signed root certificate of the sub-CA used to issue client certs (!= server cert) During EAP-TLS negotiation the Radius Server sends all known certificates (the ones in the certificate_file and the one in the CA_file) to the client. Is it possible to change the behaviour that only the certs in the certificate_file are used? This should be enough for the clients to verify the server certificate. -- Regards Daniel Finger

2 2

Need basic help with accouting
by Cosmin Neagu 04 Jan '12

04 Jan '12

Hello radius users, I need some basic info/redirection to start using accounting with freeradius. I already learned how to use authentication, but i'm unable to figure out from details in configurations files how to do some accounting - basic stuff like when a user logs in or out for start. Can anyone point me to some documentation on how to do basic accounting for beginners? --

3 4

Framed-IP-Address not working
by Azfar Hashmi 04 Jan '12

04 Jan '12

I have assigned static ip to some users but users still getting ip addresses from openvpn server pool. what I am missing?

4 7

Active Directory with Radius Accounting
by McSparin, Joe 03 Jan '12

03 Jan '12

I have setup FreeRadius to work with Active Directory for User name Authentication. My next step is going to be to start authenticating the MAC address as well. I have setup my sql database and created the required schema. I have uncommented the lines in radiusd.conf and sql.conf and sites-available/default.conf to start doing radius accounting. My access point is pointing the radius server for accounting. Would it be the acme of foolishness on my part to assume that is all I need to do for my radius server to start logging the information from my connecting clients? Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3