January 2014 - Freeradius-Users - lists.freeradius.org

dhcp subrange
by Laura Marzà Porcar 17 Jan '14

17 Jan '14

FR Version 2.1.10 Hello, for many of you this question is obvious, but I have doubts. I recently requested your assistance in compiling the dhcp for FR, but I'm mulling over and do not know how to configure a range of my network to run as dhcp. The question is: if I want to set a range for dhcp in the FR, a server dhcp must be previously installed, such as dhcp3-server?, or can I do it in the /etc/freeradius/sites-enabled/dhcp file? If, for example, I am currently allocating fixed ips in the range 10.18.0.0/16 at file "users", as I reserve a subrange of the range for that other users can have ips assigned by dhcp? Thanks, Laura

2 3

cisco reply attribute in perl module
by Mehdi Ravanbakhsh 17 Jan '14

17 Jan '14

Hi All I need to reply multiply Cisco-AVPair attribute in perl module but i can not use any operation like += so what is the solution ? Best regards

2 1

Wrong ID for IWF-Session in RFC 4679 dictionary
by Guillaume Nault 17 Jan '14

17 Jan '14

Hi, The IWF-Session attribute is set to 252 in dictionary.rfc4679, while the Vendor-Type defined by RFC 4679 is 254 (https://tools.ietf.org/html/rfc4679#section-3.3.18) This is consistent with the value used by the TR-101 specification (section 3.9.6 in http://www.broadband-forum.org/technical/download/TR-101.pdf) The following diff would fix the issue: --- a/share/dictionary.rfc4679 +++ b/share/dictionary.rfc4679 @@ -58,6 +58,6 @@ # If this attribute exists, it means that IFW has been performed # for the subscribers session. # -ATTRIBUTE IWF-Session 252 octets # 0 +ATTRIBUTE IWF-Session 254 octets # 0 END-VENDOR ADSL-Forum Should I send a regular patch to fix this typo ? Regards, Guillaume

2 1

Selective disabling of logging into radius.log
by Alex Sharaz 17 Jan '14

17 Jan '14

Hi, While the majority of my logging gets offloaded to a mysql database I still use radius.log for “quick peeks” at authentication results. For my sql logging I’ve got conditional statements so that I don’t fill up the database with load balancer health check authentications. Unfortunately haven’t managed to selectively log auth attempts into radius.log. All I want to do is disable successful auth auth attempts into radius.log from the username associated with our F5 load balancer. Any easy way to do this ? A

3 2

DHCP
by Laura Marzà Porcar 17 Jan '14

17 Jan '14

Hi, I have freeradius 2.1.10 running with static IP clients, configure it myself, but now I need a range of dynamic ips. I have read that to do this, I have to install with the - with-dhcp, but if you have already installed and do not have the installation package, as I can configure the dhcp? At moment, I don't want to use a database My system is Debian 2.6.32-38 I hope that you understand me, my English is not too good thanks LAURA MARZÀ PORCAR Administración de Sistemas Departamento UUTT 964.722.633 - ext. 741 MARINA D'OR - España laura.marza(a)servidir.es http://www.marinador.com Soporte: http://soporte.marinador.com

4 15

Windows 8.1 connection problem
by Andres 17 Jan '14

17 Jan '14

Hi list, Does anyone have experience with subject? With Windows 8.1 we can not establish connection. We are using windows server 2008 AD and PEAP with server certificate validation Warning: !! EAP session for state ..did not finish! Is there ara known certificate compatibly problem? With Windows 8.0 and windows 7 same user settings works fine. Thanks Andres

4 3

Radacct table is growing and growing
by Rui Ribeiro 17 Jan '14

17 Jan '14

You have to offload old historical data out of your DB, for sure. Of particular importance is using innodb_file_per_table=1. If you arent using that, better configure it, and do a dump and restore of your DB. Alternatives for offloading in MySQL are SHARDING and PARTITIONING. In the meantime, you can add the DELAYED keyword in INSERT queries. There is no point in waiting for INSERT queries and delaying the authentication. Regards -- Rui Fernando Ferreira Ribeiro senior sysadmin ISCTE-IUL > Message: 5 > Date: Fri, 17 Jan 2014 09:18:47 +0100 > From: Antonio Fern?ndez P?rez <antoniofernandez(a)fabergames.com> > To: freeradius-users <freeradius-users(a)lists.freeradius.org> > Subject: Radacct table is growing and growing > Message-ID: > <CANz54joeyD8rXnDwEgUY7+k-wLmN820tz= > 6F+wx9wi1BS8-sxA(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi everybody, > > I have a radacct table with more than 12300000 rows. I have increased RAM > memory recently because the data base is working with InnoDB engine and was > necessary to load data into the buffer. But, anybody knows some technique > that allows freeradius makes authentications with radacct historical > tables? > > I have thought in grouping rows using the UserName, keeping only one row > for each user. Also I thought in make quarterly tables but this is a proble > to authenticate users. > > Any ideas? > > Thanks in advance. > > Regards, > > Antonio. >

1 0

Directing request to virtual server
by David Aldwinckle 16 Jan '14

16 Jan '14

Hi All, I have a NAS that sends two types of Access-Requests. They are VPN login (AnyConnect or IPSec), and CLI access for the NAS. I’m trying to direct the VPN requests into the virtual server “vpn”. I would like CLI requests to be handled by realm DEFAULT, so I’m trying to catch everything that doesn’t fit that category and direct it elsewhere. Here is an example of a request: --------------------------------- Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Received Access-Request packet from host <redacted> port 1025, id=24, length=185 Tue Oct 22 07:50:46 2013 : Debug: [<thread>] User-Name = "" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] User-Password = Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-Port = 229748736 Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Called-Station-Id = “<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Calling-Station-Id = "<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-Port-Type = Virtual Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Tunnel-Client-Endpoint:0 = "<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-IP-Address = <redacted> Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Cisco-AVPair = "ip:source-ip=<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Vendor-3076-Attr-146 = 0xxxxx Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Vendor-3076-Attr-150 = 0xxxxx ---------------------------------- What I am interested to know is if my way of accomplishing this task is efficient, or if there is a better way. I’m working on porting my configs to 3.0 and am striving for efficiency and simplicity. I’ve added the two nameless attributes to /etc/raddb/dictionary ATTRIBUTE CPVN3000-Tunnel-Group-Name 146 string ATTRIBUTE CPVN3000-Client-Type 150 string I created hints for each possible value of "CPVN3000-Tunnel-Group-Name” /etc/raddb/hints DEFAULT CPVN3000-Tunnel-Group-Name == “staff”, Strip-User-Name = Yes Hint = “VPN” DEFAULT CPVN3000-Tunnel-Group-Name == “guest”, Strip-User-Name = Yes Hint = “VPN” In /etc/raddb/users… DEFAULT Hint == “VPN”, Proxy-To-Realm := “VPN_REALM” And finally, in /etc/raddb/proxy.conf Realm VPN_REALM { virtual_server = “vpn” } How does that look? Regards, Dave

3 5

Version 3.0.1 has been released
by Alan DeKok 16 Jan '14

16 Jan '14

See http://freeradius.org/press/ for details. It fixes all known bugs in the 3.x series. Everyone using 3.0 should upgrade as soon as practical. Alan DeKok.

1 0

Radius and Ldap Authentication problem
by 亚坤李 16 Jan '14

16 Jan '14

Hello all, I set a radius server for wifi authentication, I can log in wifi by username and password in radius server user file using mobile phone. Then, I need to use ldap server as the backend database for user authentication, I can use radtest on radius to connect with ldap server successfully. However I can not log in to wifi by the username and password stored in ldap server. As mschapv2 is not supported by ldap, so I use ttls as the default peap method. The ldap server will only give me the information about accept or reject, but it would not reply me with a password. If possible, can anyone tell me the authentication process between ldap server and radius server. All of the above are the problem what I encountered by now, can anyone help with this, this problem really drive crazy, Thanks. Best Regards Li

4 3