May 2012 - Freeradius-Users - lists.freeradius.org

How to use RADACCT in freeradius?
by faizal ghazali 29 May '12

29 May '12

Hi, My lecturer had give me an assignment to setup a freeradius server on ubuntu and print out an accounting report from the server. i have success setup this marvellous server with this tutorial link * http://www.howtoforge.com/setting-up-a-freeradius-based-aaa-server-with-mys… * and this *http://www.youtube.com/watch?v=fVRDbAxKcqw* : ) thanks 4 the great tutorial. The problem is i dont know what data to fill in the attribute in radacct phpmyadmin table and also don't know how to create a basic accounting report such as client start time connect, what is client ip, mac, etc.. can somebody help me for this matter? your help would be much appreciated. i am sorry for my stupidity and my broken English. plsss help me sir...

3 2

Address already in use but server is not running
by Michael Aldridge 29 May '12

29 May '12

I recently had to install debian 6.0 on one of my servers after a hard drive crash, and while I had freeradius running before, I can't seem to get it running now. I ran sudo apt-get install freeradius and hit enter to accept the additional packages, and I also installed dialup admin with the intention of getting to it after getting freeradius running, but now I am running into trouble with starting freeradius. The install completed without errors, but running sudo ./freeradius -X produces the following: Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 I can post the full contents of the debug dump, but this appears to be the only point at which an error is encountered. I am quite sure that there is not an instance already running, so I don't know what else could be using the port. Any ideas?

3 4

"No NAS-Port seen"
by Adam Karajah 28 May '12

28 May '12

Dears, I have freeradius installed on CentOS, and i am very interested in Simultaneous-use attribute to limit the number of logins per user. Anyway my nas seems to not sending NAS-Port attribute to freeradius which causes realm radutmp not to work. i looked all over the internet but i conuldnt find a solution, please help me to find a workaround to solve this problem. these are the two lines i keep seeing as an output from the debugging command radiusd -X : rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! its very urgent. thanks in advance.

2 4

freeradius integration to new Open Directory
by John 28 May '12

28 May '12

Hi, We use PEAP (ms-chapv2) + freeradius + Samba to integation with Open Directory (OSX version < 10.6.8), it work good. But in new OSX 10.7, there is no SMB component. Is there a way to let PEAP (ms-chapv2) + freeradius integation with new Open directory? Best, Hangjun

2 3

How do I set a reply attribute that is not sent in the Access-Accept
by niall el-assaad 27 May '12

27 May '12

Hi, I want to define my own attribute that I set in the inner server, but then check it in the outer config. The problem is that I don't want free radius to send it in the access-accept message at the end. I remember reading somewhere I could define a RADIUS dictionary with certain numbers that FreeRADIUS would not send externally, but after looking for an hour I can't find it. Would anyone be able to point me in the right direction. Much appreciated, niall

2 4

unsubscribe
by srg 26 May '12

26 May '12

unsubscribe

1 0

Get current used certificate (id?) by IP or Mac
by Max Burkhardt 25 May '12

25 May '12

Hi all, I want to write a web interface. The web interface is available behind an WPA2 eap-tls network(using freeradius). And when the user logging in with their username & password, it should check if the user logged in to the WPA2 Network, with an specific Username. So for example is there a possibility to activate a mysql/psql/.. database and write into a table all current users which are logged in or is there a possibility to check with an SH-command the current users or an user by ip/mac/.. or etc. . ? Thanks for any response ;) MfG. Max

1 0

FR over TCP
by yagizozen 25 May '12

25 May '12

Hello Guys, I have a question about radius over tcp, is it possible? Can we use TCP instead of udp with freeradius (for more secure communication link and some other reasons) and how? can you forward me to necessary documentations if it is possible and I can read and understand how. Thank you !! -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-over-TCP-tp5713364.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: Proxying multiple times to virtual and external servers
by Alan Buxey 24 May '12

24 May '12

From my mobile. So terse... if("%{Called-Station-Id}" =~ /:eduroam$/){ update control { proxy-to-server = eduroam } } ...or such (there will be some lexical errors above) Search the mail Archives as there have been similar discussions PS its 'eduroam', NEVER a capital E alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart ----- Reply message ----- From: "Graeme Hamilton" <g.j.hamilton(a)stir.ac.uk> Date: Thu, May 24, 2012 15:36 Subject: Proxying multiple times to virtual and external servers To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Hello, I'm configuring FreeRADIUS (2.1.12) for use as part of our Eduroam deployment. We're using EAP-MSCHAPv2 authentication, so I've got both an outer and inner virtual server configured and working correctly. Currently, the outer server configuration (configured as default i.e. without a 'server' stanza) assumes that connections from our wireless controller clients are only ever Eduroam-related, and it processes them accordingly - does realm checks, proxy logic, mandatory logging, etc. This is acceptable for now, since Eduroam is currently the only wireless service we provide which uses 802.1X authentication. Ideally, I'd like a generic default virtual server which would process all authentications initially, but which would act upon the suffix (e.g. ':eduroam') appended to the Called-Station-Id by our wireless controllers to proxy the request off to another virtual server dedicated to that particular function, where further actions specific to that purpose can be carried out. Reading the comments in proxy.conf suggests that it's possible to proxy requests containing a particular realm off to another virtual server, but that such requests cannot subsequently be proxied again. This would break Eduroam, since visitors to our campus need to have their requests proxied off to the national proxy servers once we've processed them. Is there any way to achieve this functionality whilst retaining the ability to proxy requests multiple times, or should I just dedicate the whole FreeRADIUS instance to Eduroam and use the functionality of our wireless controllers to direct authentication attempts on specific SSIDs to specific RADIUS server groups, if and when the need arises? Regards, Graeme Graeme Hamilton Senior Network Specialist Information Services University of Stirling -- The Sunday Times Scottish University of the Year 2009/2010 The University of Stirling is a charity registered in Scotland, number SC 011159. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Proxying multiple times to virtual and external servers
by Graeme Hamilton 24 May '12

24 May '12

Hello, I'm configuring FreeRADIUS (2.1.12) for use as part of our Eduroam deployment. We're using EAP-MSCHAPv2 authentication, so I've got both an outer and inner virtual server configured and working correctly. Currently, the outer server configuration (configured as default i.e. without a 'server' stanza) assumes that connections from our wireless controller clients are only ever Eduroam-related, and it processes them accordingly - does realm checks, proxy logic, mandatory logging, etc. This is acceptable for now, since Eduroam is currently the only wireless service we provide which uses 802.1X authentication. Ideally, I'd like a generic default virtual server which would process all authentications initially, but which would act upon the suffix (e.g. ':eduroam') appended to the Called-Station-Id by our wireless controllers to proxy the request off to another virtual server dedicated to that particular function, where further actions specific to that purpose can be carried out. Reading the comments in proxy.conf suggests that it's possible to proxy requests containing a particular realm off to another virtual server, but that such requests cannot subsequently be proxied again. This would break Eduroam, since visitors to our campus need to have their requests proxied off to the national proxy servers once we've processed them. Is there any way to achieve this functionality whilst retaining the ability to proxy requests multiple times, or should I just dedicate the whole FreeRADIUS instance to Eduroam and use the functionality of our wireless controllers to direct authentication attempts on specific SSIDs to specific RADIUS server groups, if and when the need arises? Regards, Graeme Graeme Hamilton Senior Network Specialist Information Services University of Stirling -- The Sunday Times Scottish University of the Year 2009/2010 The University of Stirling is a charity registered in Scotland, number SC 011159.

2 1