May 2012 - Freeradius-Users - lists.freeradius.org

Attributes
by Shawky Skaff 11 May '12

11 May '12

Hi, In dialup admin, under the groups and users I have the option to add an attribute, however the option which I need is not in the list. The list provided is - Protocol - IP address - IP netmask - Framed-MTU - Compression Used - Service Type - Session Timeout - Idle Timeout - Port Limit - Lock Message The option which I need to add is Framed-Route, how can I do this? Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

2 2

Realms
by Shawky Skaff 11 May '12

11 May '12

Hi, I'm stuck on realms. Basically when I test a user with the realm name, the radius debug throws an error telling me "No such realm" How would I go about configuring a realm? I believe it's got something to do with proxy.conf? Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

1 1

How to exclude particular user from the logging
by dorje2007＠seznam.cz 10 May '12

10 May '12

Hi is it possible to exclude particular user to not being logged in the radius.log file ? I have some users that periodically connect and download config files from the routers and they filled the log quite a lot Thanks Pet

2 3

Prob web wiki.freeradius.org
by Torsten Lehmann 10 May '12

10 May '12

Hallo, http://wiki.freeradius.org/ (or faq) returns: Forbidden regards Torsten

8 11

FreeRadius as proxy with SoH support
by Tobias Berndes 10 May '12

10 May '12

Hello, how can i configure my freeradius server as a proxy to the master radius server in my network, but the freeradius server have to use SoH for Packetfence. Thank you! Tobi

2 1

FreeRadius 2.1.12: radclient without coa
by Treusch Thorsten 10 May '12

10 May '12

Hi there, we have FreeRadius 2.1.12 installed in our lab mostly for testing purpose of our nodes. Now we have started to evaluate CoA on FreeRadius for both scenarios: a) Receive CoA packets from Node b) Send CoA-Requests to node (and analyze CoA-Ack, CoA-Nack Reading through several pages i always found "radclient" with the option "coa" to send/initiate CoA-Packets. And some of my colleagues (development) also use radclient for this purpose. BUT if i look at our radclient (v2.1.12) the coa option is missing there ? Last login: Sat May 5 15:17:27 2012 from dhcp-10-61-100-168.cisco.com [freeradius@sca-radius ~]$ radclient Usage: radclient [options] server[:port] <command> [<secret>] <command> One of auth, acct, status, or disconnect. Is it possible that this coa option was removed with v2.1.12 (or earlier) ? If yes, is there an alternative to send CoA packets from FreeRadius server ? I don't want to send CoA packets as a follow up to Access Request packet, but want to start it from FreeRadius. Many thanks for any helpful feedback, Thorsten

4 4

Minor update glitch in FR 2.1.12 rpm (CentOS/RH)
by up＠3.am 09 May '12

09 May '12

Just an FYI (sorry if this has already been covered): If you update FR via yum in CentOS or RedHat, as is usual practice with RPMs, conf files that have been modified are not overwritten, so the new version is installed with an ".rpmnew" suffix. This works great for most of the config files, but not the modules. For some reason, the .rpmnew module file is loaded instead of the original one: including configuration file /etc/raddb/modules/ldap.rpmnew The original module is there, but not loaded at run time...perhaps because it sees the .rpmnew one first? Fixing it is trivial, of course, once you see what the problem is, but I thought perhaps the rpm maintainers or FR developers might want to be made aware of it.

2 1

Accessing attribute in control list
by Mike 09 May '12

09 May '12

> > Hi guys, > > I am setting an attribute in the auth section of my config . I am able to access the attribute in the same section and preform unlang operations on said attribute, however, i am unable to access the same from the pre-proxy section of my config. The attribute just expands as blank. > > Is this a limitation of the software or is there a way I can access this attribute set in one section from another? > > Small background, originally i wanted to use ldap-group for group checking which turns out not to be possible due to the clients ldap not being configured correctly for groups, they are unwilling to change. So i want to be able to check against a different attribute set manually. > > An example would be appreciated if it is possible. > > > >

2 2

mySQL user wifi authentication error on freeradius
by xadow20 09 May '12

09 May '12

Hi! I'm new to freeradius. My Setup is: Ubuntu Server 10.04 Freeradius 2.1.8 daloRADIUS 0.9-9 When I try to authenticate on AP wireless with a user on /etc/freeradius/users it succedd well. But When I create a user on daloradius it gives the output above, can anyone tell me what i'm doing wrong? Thanks [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - user [peap] Got tunneled request EAP-Message = 0x02070008016e736f server { PEAP: Got tunneled identity of user PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x02070008016e736f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> u -- View this message in context: http://freeradius.1045715.n5.nabble.com/mySQL-user-wifi-authentication-erro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 13

Synchronous + Asynchronous proxying
by mimir 09 May '12

09 May '12

Hello, According to proxy.conf asynchronous configuration is disabled. I want to manage the realms by setting parameter synchronous or asynchronous, means that switch the configuration each other. Asynchronous is needed to queue the accounting packages, retransmission etc. Do you have any comment on this? # In 2.0, the server is always "synchronous", and setting # "synchronous = no" is impossible. This simplifies the # server and increases the stability of the network. # However, it means that the server (i.e. proxy) NEVER # originates packets. It proxies packets ONLY when it receives # a packet or a re-transmission from the NAS. If the NAS never # re-transmits, the proxy never re-transmits, either. This can # affect fail-over, where a packet does *not* fail over to a # second home server.. because the NAS never retransmits the # packet. # # If you need to set "synchronous = no", please send a # message to the list <freeradius-users(a)lists.freeradius.org> # explaining why this feature is vital for your network. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Synchronous-Asynchronous-proxying-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6