July 2012 - Freeradius-Users - lists.freeradius.org

libfreeradius vs libradius
by Arvind Gupta 27 Jul '12

27 Jul '12

Hi All I am new for RADIUS server authentication and looking to implement a RADIUS client. I found that there are many RADIUS client library available and most popular are libradius and libfreeradius. figuring out that which one is best and what is pros and cons of each one. Any information related to this will be more helpful to me. Thanks Arvind

3 7

Calling station ID
by madal 30 27 Jul '12

27 Jul '12

I have enabled the detail log in my freeradius server. It logs everything which is cool. However, in Calling-Station-ID it only logs the last octes as : Acct-Session-Id = "4FEE219C619400" User-Name = "test(a)test.com" Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 9 Acct-Output-Octets = 320 Acct-Input-Octets = 925 Acct-Output-Packets = 1 Acct-Input-Packets = 4 Calling-Station-Id = ".031" NAS-Port-Type = Async Acct-Terminate-Cause = User-Request Framed-IP-Address = 192.168.1.20 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "537e68121f1931c8" Stripped-User-Name = "test" Realm = "test.com" Timestamp = 1342054821 Request-Authenticator = Verified How do I or where do i adjust this parameter sothat full IP address is logged in calling-station-ID ? I looked at detail file in modules/detail but could not find the parameter M

5 7

Freeradius Installation Challenges
by George Innocent 27 Jul '12

27 Jul '12

I am not able to authenticate on the default users when testing freeradius server. Thanks to assist resolve this -- Regards: George Innocent.

2 2

Printing rlm_counter AVP's
by jobhunts02＠aol.com 26 Jul '12

26 Jul '12

I have added some AVP's for an rlm_counter and want to look at the values. I have tried using radclient but it prints only one of the AVP's I added. Since I added each AVP the same way, can anyone tell me what determines which AVP's radclient prints and what I can do to make sure all the AVP's I added are printed by radclient?

2 1

crl handling
by Wegener, Norbert 26 Jul '12

26 Jul '12

As far as I know freeradius uses openssl to handle crls. openssl also has an option -use_deltas to enable support for delta CRLs. Is this option available in freeradius? According to eap.conf it is necessary to restart radiusd if a new version of a crl is published. Are there plans to enable reading of a new crl without restarting the server? Thanks Norbert Wegener

4 3

Windows 7 Certificate
by Ismael Yáñez 26 Jul '12

26 Jul '12

Hi everybody, I just installed and configured FreeRADIUS 2.1.10 successfully. I am using it to authenticate Wifi users. I got trial certificates from GeoTrust, which are supposed to be accepted by windows 7. The thing is, that when I try to connect to to my wifi network a window pops up saying something like (original is german): The server "xx.xx.xx" presented a valid certificate from "GeoTrust Global CA", "GeoTrust Global CA" is however not configured as a valid anchor for the profile. In addition, the server "xx.xx.xx", which is being used to establish the connection, is not configured as a valid NPS server for the profile. (Original message in german) Der Server "xx.xx.xx" stellte ein gültiges, von "GeoTrust Global CA" ausgestelltes Zertifikat dar. "GeoTrust Global CA" ist jedoch nicht als gültiger Vertrauensanker für das Profil konfiguriert. Außerdem ist der Server "xx.xx.xx" für das Profil nicht als gültiger NPS-Server konfiguriert, mit dem Verbindungen hergestellt werden können. (End of original message I click on connect and it works, but I would like, if possible, to make this pop up disappear. Has anyone had this issue and if so know how to make it disappear? Regards, -- Ismael Yáñez A. Systemadministration Rocket Internet GmbH | Johannisstraße 20 | 10117 Berlin | Deutschland mobile: +49 162 290 4698 | mail: ismael.yanez(a)rocket-internet.de | skype: ismaelrocket www.rocket-internet.de Geschäftsführer: Dr. Johannes Bruder, Arnt Jeschke, Alexander Kudlich Eingetragen beim Amtsgericht Berlin, HRB 109262 USt-ID DE256469659

2 1

Accessing nas ip with rlm_python and rlm_perl
by Carl Pierre 25 Jul '12

25 Jul '12

Hello: Is it at all possible to access this information within these modules? I am trying to code different behavior in my code based on IP. Regards,

2 1

Certificate validation checkbox - windows 7 wired
by Morris, Andi 25 Jul '12

25 Jul '12

Hi all, I'm getting an odd problem where even when my clients are configured not to validate the server certificate (test environment at the mo) on their wired connections they are failing to authenticate on one freeradius server but getting access-accept on another. Debug output shows the familiar: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xbec39c4bbac58529 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I accept that it's very likely I've messed something up with install of the secondary server, and am planning to wipe it and start again tomorrow and THEN introduce the production certificates, but I'm confused as to why this certificate compatibility issue would even be mentioned in the debug if my client is set to validate any server. The odd thing is that my wireless clients are authenticating fine through this server, also set to not validate the server. Can anybody shed any light please? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

3 4

RE: Load Balance two FreeRADIUS servers (question)
by Aldo Zavala 25 Jul '12

25 Jul '12

Many thanks for your input Jim, that really addressed my questions... I appreciate it.! Aldo Zavala

1 0

Load Balance two FreeRADIUS servers (question)
by Aldo Zavala 25 Jul '12

25 Jul '12

Hi, I have reading few posts that ask how to Load Balance Two or more FreeRADIUS servers, and usually the expert's (Alan and others) answer is to put a load balancer in front of the FreeRADIUS servers, I will trust you but I still have some questions about this: 1.- What load balancer is recommended? I would suppose that not all of them will load balance the UDP RADIUS well, I see many appliance, brands, etc.. just a thought 2.- Will this scenario cover the fail-over part? when one of my two FreeRADIUS servers stop working, or restart, or crash will the load balancer appliance start sending packets only to the live server until it gets back up? 3.- Isn't the load balancer a single point of failure itself? How is this potential problem usually addressed? Thanks!! Aldo Zavala

3 3