February 2012 - Freeradius-Users - lists.freeradius.org

Ldap binding with different attribute
by LEONARDO FELL 28 Feb '12

28 Feb '12

Hi everbody, I have a freeradius+openldap working well, but I'd like to make some changes. Below are the ldap module configuration: server = "ldap.mycompany.br" identity = "cn=Admin,dc=univates,dc=br" password = xxxxxx basedn = "dc=mycompany,dc=br" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap_acad.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 The users auth w/ a bind using the normal attrs (uid and password), but I think it'd better if users ALSO could use another attrs like 'studentCode' to auth, instead of only uid/password. Anyone know how to do that? Cheers! -- Leonardo Fell

1 0

Use FreeRadius as Proxy for Cisco ACS
by Maz17 28 Feb '12

28 Feb '12

Hi everyone, I'm setting up for my company a new Freeradius server and i have to use it as a proxy for a CISCO ACS server. But i'm new at this and don't know how to do this. What type of auth i have to use for this configuration ? Are there any HOWTO that can help me in my process ? Thanks for yours help ! | CLIENT | --------------> | FR Server | -------------> | CISCO ACS DB | GDN -- View this message in context: http://freeradius.1045715.n5.nabble.com/Use-FreeRadius-as-Proxy-for-Cisco-A… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 7

Freeradius multiple account records per login
by ivaylosp 28 Feb '12

28 Feb '12

Hi there, My RADIUS server hard drive recently crashed and i had to reinstall everything from scratch. I got everything working but now every time a user logs in i get 3 sessions registered in the accounting table. I remember this being a networking issue of some sort but i can not remember or find any record of what could cause this behavior. Currently my server IP for binding is set to *: listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } Does anyone know the reason for this behavior? Regards, Ivaylo Petkov -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-multiple-account-records… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Can I test a perl script?
by Fabricio Flores 27 Feb '12

27 Feb '12

I have a perl script that obtains username and password from a pg database. I'm new at freeradius, so I only can do a radtest with a localhost user. Can I test my perl script with an user from the pg database? how y do the radtest? -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas Blog Personal <http://fabricioflores.wordpress.com/>

2 7

[OFF-TOPIC] Freeradius and MySQL Cluster
by Antonio Modesto 27 Feb '12

27 Feb '12

Good Morning, I am doing some tests with MySQL Cluster, and I want to migrate my backend to it. But I am having some "troubles/doubts" with it. When I use a empty radius database, it works ok. But when I try to import my current database to MySQL with the NDBCLUSTER engine, I got this error: ERROR 1114 (HY000) at line 143: The table 'radacct' is full I think that I must do some tuning to adjust MySQL cluster to my requirements, but I don't know exactly what to change, below is my config.ini: [ndbd default] # Options affecting ndbd processes on all data nodes: NoOfReplicas=2 # Number of replicas DataMemory=512M # How much memory to allocate for data storage IndexMemory=512M # How much memory to allocate for index storage # For DataMemory and IndexMemory, we have used the # default values. Since the "world" database takes up # only about 500KB, this should be more than enough for # this example Cluster setup. [tcp default] # TCP/IP options: portnumber=2202 # This the default; however, you can use any # port that is free for all the hosts in the cluster # Note: It is recommended that you do not specify the port # number at all and simply allow the default value to be used # instead [ndb_mgmd] # Management process options: hostname=192.168.1.32 # Hostname or IP address of MGM node datadir=/var/lib/mysql-cluster # Directory for MGM node log files [ndbd] hostname=192.168.1.30 # Hostname or IP address datadir=/usr/local/mysql/data # Directory for this data node's data files [ndbd] hostname=192.168.1.31 # Hostname or IP address datadir=/usr/local/mysql/data # Directory for this data node's data files [mysqld] [mysqld] I know that this is not the best place to talk about database problems, but I think that there is a lot of people here that use Freeradius with MySQL Cluster that could help me. Thanks in advance.

4 6

FreeRADIUS exiting with Signal 11 on FreeBSD
by Hugh Blandford 27 Feb '12

27 Feb '12

I am running FreeRADIUS 2.1.10 on 64bit FreeBSD 8.1-RELEASE-p1 with LDAP auth and accounting records being sent to file and MySQL. I get the following in radius.log: Sun Dec 5 05:14:57 2010 : Info: Exiting normally. and the following in messages: Dec 5 05:14:57 cat kernel: pid 68292 (radiusd), uid 133: exited on signal 11 This has also occurred on two other occasions. I found somone else in the list archives who had a similar sounding problem on FreeBSD but there didn't appear to be an issue. Any suggestions as to what I can do to avoid this problem? Thanks, Hugh Blandford -- Hugh Blandford Island Internet ph 1300 130 428 mb 0412 016 875

6 23

freerqdisu2 and peap-eap-tls
by Riccardo Veraldi 27 Feb '12

27 Feb '12

Hello, I am considering if it is worth to use PEAP with eap-tls in the inner tunnel, so peap-eap-tls. I find it useful for windows people authenticationg in the eduroam environment. Anyway I did not find documentation about it aside this note http://wiki.freeradius.org/EAP-PEAP and I would like to implement it. is there someone who tryed this method with freeradius2 ? is this supported ? thank you Rick

3 2

Freeradius Multiple accounting sessions per login
by Ivaylo Petkov 27 Feb '12

27 Feb '12

Hi there, My RADIUS server hard drive recently crashed and i had to reinstall everything from scratch. I got everything working but now every time a user logs in i get 3 sessions registered in the accounting table. I remember this being a networking issue of some sort but i can not remember or find any record of what could cause this behavior. Currently my server IP for binding is set to *: listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } Does anyone know the reason for this behavior? Regards, Ivaylo Petkov

2 1

RE: Welcome to the "Freeradius-Users" mailing list
by Javier Ruiz Escalante 26 Feb '12

26 Feb '12

Hello, I'm new in Freeradius and I get the same message, although I want to get the data from a Mysql Data base, can someone help me? I don't even know if radius makes the query, can I find out if the sql query has been performed? Below is the debug file: rad_recv: Access-Request packet from host 127.0.0.1 port 48102, id=67, length=61 User-Name = "mysqltest" User-Password = "testsecret" NAS-IP-Address = 192.168.182.1 NAS-Port = 0 Sun Feb 26 21:26:04 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sun Feb 26 21:26:04 2012 : Info: +- entering group authorize {...} Sun Feb 26 21:26:04 2012 : Info: ++[preprocess] returns ok Sun Feb 26 21:26:04 2012 : Info: ++[chap] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[mschap] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[digest] returns noop Sun Feb 26 21:26:04 2012 : Info: [suffix] No '@' in User-Name = "mysqltest", looking up realm NULL Sun Feb 26 21:26:04 2012 : Info: [suffix] No such realm "NULL" Sun Feb 26 21:26:04 2012 : Info: ++[suffix] returns noop Sun Feb 26 21:26:04 2012 : Info: [eap] No EAP-Message, not doing EAP Sun Feb 26 21:26:04 2012 : Info: ++[eap] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[files] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[expiration] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[logintime] returns noop Sun Feb 26 21:26:04 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sun Feb 26 21:26:04 2012 : Info: ++[pap] returns noop Sun Feb 26 21:26:04 2012 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Sun Feb 26 21:26:04 2012 : Info: Failed to authenticate the user. Sun Feb 26 21:26:04 2012 : Info: Using Post-Auth-Type Reject Sun Feb 26 21:26:04 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sun Feb 26 21:26:04 2012 : Info: +- entering group REJECT {...} Sun Feb 26 21:26:04 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> mysqltest Sun Feb 26 21:26:04 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sun Feb 26 21:26:04 2012 : Info: ++[attr_filter.access_reject] returns updated Sun Feb 26 21:26:04 2012 : Info: Delaying reject of request 0 for 1 seconds Sun Feb 26 21:26:04 2012 : Debug: Going to the next request Sun Feb 26 21:26:04 2012 : Debug: Waking up in 0.9 seconds. Sun Feb 26 21:26:05 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 67 to 127.0.0.1 port 48102 Sun Feb 26 21:26:05 2012 : Debug: Waking up in 4.9 seconds. Sun Feb 26 21:26:10 2012 : Info: Cleaning up request 0 ID 67 with timestamp +3 Sun Feb 26 21:26:10 2012 : Info: Ready to process requests. Thank you very much in advane. ;-)) -----Original Message----- From: freeradius-users-bounces+fruiz002=hotmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+fruiz002=hotmail.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: domingo, 26 de febrero de 2012 21:28 To: fruiz002(a)hotmail.com Subject: Welcome to the "Freeradius-Users" mailing list Welcome to the Freeradius-Users(a)lists.freeradius.org mailing list! To post to this list, send your email to: freeradius-users(a)lists.freeradius.org General information about the mailing list is at: http://lists.freeradius.org/mailman/listinfo/freeradius-users If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: http://lists.freeradius.org/mailman/options/freeradius-users/fruiz002%40hotm ail.com You can also make such adjustments via email by sending a message to: Freeradius-Users-request(a)lists.freeradius.org with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: 11071107 Normally, Mailman will remind you of your lists.freeradius.org mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you.

2 1

Oauth2 Google?
by Jesse Crayston 25 Feb '12

25 Feb '12

Hello, I'm wondering if I could get help, or find documentation(even just a draft) on setting up Oauth2 on a freeradius server(omniauth?). I'm looking to use my google apps domain user database, to manage users, and control access through an Untangle captive portal, which is already setup(then probably drop the portal and do EAP, though I'll play to see if I can start with EAP). Also if I'm on the completely wrong/old track, I'm no too worried about changing the plan now. Thanks for the time/sorry for not lurking more before posting, Jesse

2 3