September 2013 - Freeradius-Users - lists.freeradius.org

Building FreeRadius with custom LDAP libraries
by Nikolaos Milas 12 Sep '13

12 Sep '13

Hello, I am trying to use http://www.packetfence.org/downloads/PacketFence/freeradius/freeradius-2.2.… to create custom FreeRadius RPMs for RHEL/CentOS 6. The main aim is to add --with-dhcp compile option which is not included in the standard build. The secondary aim is to build using custom ldap libraries, because we are using LTB OpenLDAP RPM packages (http://ltb-project.org/wiki/download#openldap) The libraries as installed by these RPM packages are in /usr/local/openldap/lib64/ and /usr/local/openldap/include/ In the src.rpm I see: BuildRequires: openldap-devel which I can change to: BuildRequires: openldap-ltb-debuginfo but how can I define custom LDAP libraries? Can I use something like: export CPPFLAGS="${CPPFLAGS} -I/usr/local/openldap/include" export LDFLAGS="${LDFLAGS} -L/usr/local/openldap/lib64" ...as we do for building Dovecot, or CXXFLAGS="${CXXFLAGS} -I/usr/local/openldap/include"; export CXXFLAGS LDFLAGS="${LDFLAGS} -L/usr/local/openldap/lib64 -lldap -llber -R/usr/local/openldap/lib64"; export LDFLAGS ...as we do for building PowerDNS? ( We have found the above for other software after significant effort. I hope it'll be easier with FreeRadius! :-) ) Please advise! Thanks, Nick

4 6

Replicating to multiple servers.
by Cooper, Tom 12 Sep '13

12 Sep '13

Hi all, How can I replicate to more than 1 server? I have set up replication to one host, but when I set up a second host it does not replicate to it. However the first host works perfectly. I am using freeradius-2.2.0-1 This is what I have in my proxy.conf file. home_server ALOTT-SMP { type = acct ipaddr = 192.168.xx.xx port = 1813 secret = xxxxxxxx src_ipaddr = 192.168.xx.xx require_message_authenticator = no response_window = 4 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool ALLOT-SMP { # type = fail-over home_server = ALOTT-SMP } home_server PROCERA-SMP { type = acct ipaddr = 192.168.xx.xx port = 1813 secret = xxxxxxx src_ipaddr = 192.168.xx.xx require_message_authenticator = no response_window = 4 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool PROCERA-SMP { type = fail-over home_server = PROCERA-SMP } realm example.com { authhost = LOCAL accthost = LOCAL type = radius preacct { update control { #Replicate-To-Realm := 'ALLOT-SMP' Proxy-To-Realm := 'ALLOT-SMP' Proxy-To-Realm += 'PROCERA-SMP' } } accounting { replicate } } To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 4

free radius setup
by Swenson, Chris 11 Sep '13

11 Sep '13

I understand a bit more why people were bring up plain text passwords now. My radius server is being presented with peap ms-chapV2 credentials and I want it to receive authentication from my openldap server. It seems that the credentials in this format cannot be digested by openldap and acknowledged. The passwords in my openldap are encrypted as SHA Do I have this right? Is there an alternative. Maybe that FreeRadius 3.0.0 rc1 mentioned in one of the emails the other day? Thanks for your attention

5 9

radclient error
by Mehdi Ravanbakhsh 11 Sep '13

11 Sep '13

Hi All I have this Error when using radclient: radclient: Nothing to send. radclient:: Expected end of line or comma I do not know what is means ? (radclient is run by PlPerl script in my postgresql database engine) Best regards.

2 2

Debug show cleartext password
by Marco Aresu 11 Sep '13

11 Sep '13

Hi All i am getting a problem on Freeradius installed on CentOS. When i set the service Radiusd in debug mode and send an access request (default type PAP) through Radtest the debug show the password in cleartext. Is there an option to do not show the fiedl User-Password in cleartext? Many Thanks Marco Aresu

3 4

Re: sql_counter module doesn't count
by Russell Mike 10 Sep '13

10 Sep '13

Hi, I am willing to help, What kind of NAS do you use? Does your NAS support accounting ? Thanks RM -- On Mon, Aug 12, 2013 at 9:50 PM, lucia <j.eskobar(a)gmx.de> wrote: > Thanks for quick reply, > > well I guess not. Can you give me a hint how I can figure it out how I can > configure this ? > > I'm I right that I have to configure the accounting in the RADIUS > conf-files or is it part of the NAS it self. > Well OK I had a look into Wikipedia RADIUS and it looks like it is part of > the NAS. > But I do not find any comments via google about Synology and accounting.... > > I'm a bit confused now ... > > Regards, > Lu > > > > > > On 12.08.2013 23:34, Alan Buxey wrote: > > Hi > > That's just an authentication request.... accounting packets is what you > need. Is your kit configured to send accounting to this RADIUS server? > > alan > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

freeradius eam sim authorization to everyone
by Maxim Shoustin 10 Sep '13

10 Sep '13

Hello, I use freeradius 2.2.0 (runs on Ubuntu). I played enough with eap sim, (thanks for examples eapsim-02 - 06). My goal is to test client + AP but not freeradius authorization/authentication process. Ho can I configure freeradius to give success for every user, no matter what is imsi, challenge, kc or sres. Can I configure to give "OK" to any sim based on provider only, like "Orange", for example/ Thank you,

2 1

Re: my Radius goal radius and openldap.
by Swenson, Chris 10 Sep '13

10 Sep '13

Yeah, bit the goal is that it is passed to the server via a secure web page. The end goal here is getting authenticated users the right to connect to the secure ssid's. The Aruba wireless controllers are supposed to do that. If I am way over my head I have a consultant on contract. RHIP. Sent from my Verizon Wireless 4GLTE smartphone ----- Reply message ----- From: "Arran Cudbard-Bell" <a.cudbardb(a)freeradius.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: my Radius goal radius and openldap. Date: Mon, Sep 9, 2013 7:34 pm On 10 Sep 2013, at 00:19, "Swenson, Chris" <cswenson(a)curry.edu> wrote: > No, they are encrypted in the ldap database in md5 hash. Right, but you have the plaintext version from the user? > I might be too old to do bleeding edge stuff like 3.0 RC1 > I will take a look and a poke at it though. Fair enough. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

my Radius goal radius and openldap.
by Swenson, Chris 09 Sep '13

09 Sep '13

I already have functioning openldap with SSL. (actually a neat little multi master setup.) I would like to get this radius to authenticate against the openldap. I have dug around Google and found some useful looking pages, but I wonder if anybody has any hot tips on this so I don't feel like I am completely reinventing the wheel. Thanks Chris s.

2 3

RE: problem with initial setup solved
by Swenson, Chris 09 Sep '13

09 Sep '13

I guess I need to recycle my 2002 Shell O'Reilly book. -----Original Message----- From: freeradius-users-bounces+cswenson=curry.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+cswenson=curry.edu@lists.freeradius.org] On Behalf Of Swenson, Chris Sent: Monday, September 09, 2013 1:27 PM To: FreeRadius users mailing list Subject: RE: problem with initial setup That did it, In the version 1 the radtest must have been installed with the radius, not as a separate package. I have now also successfully tested. I wonder why the in the ticket I opened with red hat support they did not suggest the upgrade. Thanks to all. Chris S. -----Original Message----- From: John Dennis [mailto:jdennis@redhat.com] Sent: Monday, September 09, 2013 1:11 PM To: FreeRadius users mailing list Cc: Swenson, Chris Subject: Re: problem with initial setup On 09/09/2013 12:52 PM, Swenson, Chris wrote: > Thanks for the replies: > Ok, uninstalled #1 and updated to freeradius2 > > radiusd started without a hitch with testing Cleartext-Password := "password" in users file. > > When I ran radtest testing password localhost 0 testing123 > > Received -bash: /usr/bin/radtest: No such file or directory It's in the freeradius2-utils package. % yum install /usr/bin/radtest or % yum install freeradius2-utils or read how to use the yum package manager. -- John - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2