March 2012 - Freeradius-Users - lists.freeradius.org

Mac Auth Rewrite SSID Issue
by John Corps 14 Mar '12

14 Mar '12

Hello All, I have had this setup (http://wiki.freeradius.org/Mac-Auth) for a long time and it has been working well. Now I am experiencing an issue with the rewrite of the called station id to extract the SSID from the wireless. Anyone know how I can update the rewrite called station id function to allow the SSID to have spaces? For example, "called-station-id = 00-11-22-33-44-55:SSID WITH SPACE" is just extracting the SSID as "SSID" I need it to show as "SSID WITH SPACE" but aswell be able to process others like "SSID-NEW-SSID01" Any help is appreciated. I think I am overlooking this, but I could be wrong, so any help would be great. Thanks.

2 2

LDAP conns: Problem
by Prateek Kumar 14 Mar '12

14 Mar '12

Hi , When I am starting my freeradius in debug mode then I am getting this message rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xb7897598 <------------ message Module: Linked to module rlm_eap Module: Instantiating eap I have enabled my ldap module in inner-tunnel & sites-available/default at all places in both the files. I have configured following things in modules/ldap file server, identity, password, basedn, filter, ldap_connections_number, timeout, timelimit, net_timeout, start_tls = no, dictionary_mapping, edir_accounting_policy_check = no I am able to authenticate the user using radtest utility. Is this normal to see that message if not how can I remove this . Also what does this message conveys. Thanks All Regards, Prateek

2 2

(no subject)
by Aren Chua 14 Mar '12

14 Mar '12

http://sonographyhq.com/wp-content/plugins/wp-policies/wp-static/info.php?h…

1 0

multiple NAS behind multiple NAT with one radius server.
by 甄鹏 14 Mar '12

14 Mar '12

Hello Everybody: Recently I am working on a project, it requires a radius server(which i use freeradius for sure) that could be shared by multiple NASes which are behind multiple NAT.(one NAS to one NAT) But not really easy for me, i have the following problem. I use freeradius+mysql, for the radius.nas table,it requires nasname which must be(？) the IP address of the NAS,but NAS only have a private IP address like 192.168.***.***，i know after through the NAT,it will get a public IP address, but the IP address is dynamics,so How could I set up the nasname for radius.nas table??? I read the clients.conf file, it said the nasname could be a hostname,but it also said the radius server will only inquire the DNS server for one time,so what will happen if the router of NAT rebooted and got a different IP address?? Is there anyway could solve my problems? Right now,what i am doing is I said the nasname as 0.0.0.0 and netmask 0 (in clients.conf),two different NAS could be connect to the radius server? is this a solution? Thank you in advanced.

4 4

How to configure FreeRadius as Captive Portal
by ulislam.raihan 14 Mar '12

14 Mar '12

Hi All, I am a new person using freeRadius server. I have a wireless access point with WPA authentication option. It does not have any support for 802.1x or configuring Radius server.But i want to implement some central security using Radius server.Is it possible to configure the FreeRadius server in such a way so that i can setup an captive portal. Any suggestion will be highly appreciated. Thanks Raihan -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-configure-FreeRadius-as-Capt… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

Connect with different user but radius does not know that!
by ZhenJoey 14 Mar '12

14 Mar '12

Hello all: I got a problem again. I setup the freeradius+mysql system,it looks like work well,but today,i got a problem like this. I have two users User1 and User2(different Cleartext-Password). After turn on the radius server(in debug mode) and NAS,the first time i use User1 to login, it connected,great. and then,i broken the connection and try again as User2,it also connected,but at the debug information it said that the use expand:%{User-Name} -> is still User1. It is weird for me. i restart the radius server, connect again with User2 information, still report as User1, but if i reboot the AP and connect as User2 (radius server does not need to restart here),it works, radius said know here is User2, but after that i use User1 to connect,samething happens, server said it still User2 not User1. It seems like the NAS's problem, i try two kind of NAS(compex wps 543 and Netgear WG103),the same situation? any one could help me here? Thanks in advanced. Joey

2 2

Detail log file .CSV format
by Shreya Shah 13 Mar '12

13 Mar '12

Hi, Is it possible to get the detail file under radacct in .CSV or text format ? Thanks in advance. -Shreya.

3 2

Re: Starting freeradius with ip/port options only works in debug mode?
by Alan Buxey 13 Mar '12

13 Mar '12

Selinux? What does radius.log say when it fails as a standard daemon? alan

1 0

Starting freeradius with ip/port options only works in debug mode?
by Vivek Mehrotra 13 Mar '12

13 Mar '12

Hello, When I wish to give IP/Port options to start radiusd, I cannot get it started in non-debug mode. Any idea why? Looks like certain configuration happens the very first time after which I can re-start in non-debug mode. Thanks in advance, vivek

1 0

How to reject users who don't match unlang
by Scott McLane Gardner 13 Mar '12

13 Mar '12

I have the following in my sites-available/default: authorize { ... # Allow only NET Staff members to log into BAND and HAPF if (Ldap-Group == "NET Staff" && (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4")) { update reply { Passport-Access-Priority = 6 } } # Reject everyone else elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") { reject = 1 } ... What I want is to only allow NET Staff members to log in and reject everyone else who tries to log into these resources. I'm getting the following in my log: Tue Mar 13 12:55:32 2012 : Info: ++? elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") -> TRUE Tue Mar 13 12:55:32 2012 : Info: ++- entering elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") {...} Tue Mar 13 12:55:32 2012 : Info: +++- elsif (NAS-IP-Address == "192.168.6.5" || NAS-IP-Address == "192.168.6.4") returns notfound Tue Mar 13 12:55:32 2012 : Info: ++- group authorize returns notfound What is the correct syntax to reject this way?

2 4