May 2012 - Freeradius-Users - lists.freeradius.org

Online Users
by Shawky Skaff 18 May '12

18 May '12

Hi, When viewing the online users and I wish to drop or clear the connection, nothing actually happens. Is there anything that I need to do to get this working? Maybe linking this to my NAS somehow, as if I clear the connection from my NAS, it seems to do the job Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

2 1

Quota in DCCA
by yagizozen 18 May '12

18 May '12

Hello everyone, I am using DCCA in one of the systems. And I know that DCCA grant a quata when a request comes from GGSN. For Example, when a access request come from GGSN, DCCA rejects it depending on the AVPs OR accept the request and sends a predefined QUOTA to the GGSN so that after the user finish that quota, it returns and asks for more quota. When I take a snoop between GGSN and DCCA, I see a grouped AVP called "Multiple Services Credit Control" and inside this grouped AVP, it contains the quota and other information that is send to GGSN with the accept packet. If I implement this grouped AVP to the radius Access-ACCEPT packet, does it work? The GGSN is the same. Also can you help me about creating a GROUPED AVP?? sending a user-defined AVP is easy but how can I group more than one AVPs? Thank you very much. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Quota-in-DCCA-tp5711335.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius unable to read password from LDAP query to win2008 AD
by sonyisda1 17 May '12

17 May '12

Using FreeRadius on Ubuntu 12.04 FreeRadius is communicating with Windows 2008 R2 Active Directory server. I have MS-CHAP authentication working fine. This is used for VPN. I am setting up LDAP authorization and CHAP authentication. This will be used for router login. The router has the radius configuration pointing to FreeRadius box. >From the logs, the LDAP authorization appears to bind correctly but is unable to retrieve a clear password for the user account and thus user cannot be authenticated with CHAP. [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? I believe above indicates that no data is received from LDAP query and no password is retrieved. I have attached relevant debug log output and config files. http://freeradius.1045715.n5.nabble.com/file/n5711532/freeradius_-_x.txt freeradius_-_x.txt output from running freeradius server in debug mode http://freeradius.1045715.n5.nabble.com/file/n5711532/router_connection_att… router_connection_attempt.txt output from connection attempt for router http://freeradius.1045715.n5.nabble.com/file/n5711532/default.txt default.txt /etc/freeradius/sites-available/default http://freeradius.1045715.n5.nabble.com/file/n5711532/inner-tunnel.txt inner-tunnel.txt /etc/freeradius/sites-available/inner-tunnel http://freeradius.1045715.n5.nabble.com/file/n5711532/ldap.txt ldap.txt /etc/freeradius/modules/ldap -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-unable-to-read-password-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Backup and restore FR
by yagizozen 17 May '12

17 May '12

Hello everyone, It can be a little weird to ask this question, if it is I am sorry but is there any way to clone the FR application with everything related to another machine with same OS? If I am using FR on my centos and I want to install FR to another centos with the exactly same configs. Instead of installing FR and coping the configs one by one, is there any way to directly get a backup of FR in my main machine and restore it on the other machine? Also in case of any disaster scenarios, I can simple restore a previously backuped FR with efficient way in a little time. Any suggestions? Thank you -- View this message in context: http://freeradius.1045715.n5.nabble.com/Backup-and-restore-FR-tp5710672.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Conditionally passing custom attributes
by Jeremy Guthrie 17 May '12

17 May '12

Alan, I have asked Chad to ask out here. I have a stringent business requirement to live within a patch channel that is being maintained by SuSE. So while yes, we could compile the latest and greatest, I have to balance that that against the workload and management of a pile of other packages. Relying on the SuSE patch channel solves a ton of issues for me as it relates to effort, tracking security vulnerabilities, and compliance which all roll into cost. I've got hundreds of RADIUS servers out in the field and we rely on it heavily. We're very happy with freeradius. It works very well however we have just found a product that is having some issues we'd like to get to the root of. If it comes down to the release that SuSE's package of it isn't a good one, then we'd talk about internally upgrading freeradius or doing something else with the product we are trying to manage. At this point we have got this one product we need to see if we can get working. If you are looking for more information or other things you'd ask we do before posting to the list, we'd be happy to comply but I cannot afford self-packaging freeradius at this point. :( >Alan DeKok wrote: > > No, you're not. You can upgrade. The server comes with files that >lets you build a Suse RPM. > > There is *no technical reason* why you can't upgrade. The only >reasons are politics, and personal choice. > Alan DeKok. >Chad Lensert wrote: >> This is the version that is supplied with SuSE and needs to be >> managed via their patch channel, so I am required to use this version. -- *Jeremy Guthrie* Technical Architect - Orchestration | *CDW* 5520 Research Park | Madison, WI 53711 Phone: 608.298.1061 | Fax: 608.288.3007 | NOC: 608.298.1102 | Toll Free: 866.202.1807

2 1

Reject users based on LDAP attribute
by C.F. Yeung 17 May '12

17 May '12

We have 802.1x authentication via AD. It's okay. Now, we would like to reject users based on LDAP attribute, WLANStatus. Added attribute in dictionary and ldap.attrmap as follow. Where should I put the unlang? /etc/raddb/dictionary ATTRIBUTE My-Local-wlanStatus 3000 string /etc/raddb/ldap.attrmap replyItem My-Local-wlanStatus WLANStatus /etc/raddb/sites-available/default authorize { ... ldap if (My-Local-wlanStatus == "A1") { reject } ... } rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=student,o=example.com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... rlm_ldap: WLANStatus -> My-Local-wlanStatus = "A1" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (My-Local-wlanStatus == "A1") (Attribute My-Local-wlanStatus was not found)

3 6

EAP and automatically authenticating users
by David Peterson 17 May '12

17 May '12

I have a couple of users who have unknown usernames and passwords. They are also using EAP-TTLS for authentication. Is there a way to automatically authenticate all of them and if so, can I also send the Framed-Filter-Id attribute with the authentication response as if the user were truly authorized. David

3 6

Re: freeradius service doest start
by Baris Genc 17 May '12

17 May '12

> Dear All, > > When i try to start radius service on ubuntu service is fail. How to start > radius service on ubuntu? > > root@123:/etc/init.d# /etc/init.d/freeradius start > * Starting FreeRADIUS daemon freeradius > ...fail! > > root@123:/etc/init.d# /etc/init.d/freeradius reload > * Reloading FreeRADIUS daemon freeradius > * /var/run/freeradius/freeradius.pid not found... > ...done. > > root@123:/# radiusd -X The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Try: apt-get install <selected package> > Is there any person help to me? > Thank you. >

4 6

ntlm_auth in freeradius
by val john 17 May '12

17 May '12

Hi... i need to configure the freeradius with mschap (need to specify the ntlm_auth file path in "modules/mschap and modules/ntlm_auth files) , but i cant find the ntlm_auth file in my OS , is it coming with freeradius or we have to install it separately . Thank you John

5 8

Re: Conditionally passing custom attributes
by Chad Lensert 17 May '12

17 May '12

> Why? 2.1.1 was released almost 4 years ago. This is the version that is supplied with SuSE and needs to be managed via their patch channel, so I am required to use this version. > Well, it should work. It works for me in my testing. I'll continue to troubleshoot. I wasn't sure if there was some global config option or something obvious I might be missing or a bug in this version.

2 1