December 2014 - Freeradius-Users - lists.freeradius.org

Reply-Message attribute
by Frank Wei 19 Dec '14

19 Dec '14

Hi all, The RFC said server can support multiple "Reply-Message" attribute. When I setup multiple "Reply-Message" on the servers "users" file and tried a Authentication request from a NAS. I can only see the first "Reply-Message" returned from the server. Does FreeRadius server support multiple "Reply-Message"? Regards, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

2 1

Firebird
by Osvaldo T Crispim Filho 18 Dec '14

18 Dec '14

Is there any firebird (for freeradius) user here? -- - Osvaldo T Crispim Filho -

1 0

OCSP Stapling with FR
by Philippe MARASSE 18 Dec '14

18 Dec '14

Folks, According to RFC 4366, during TLS handshake, server may send OCSP status along with certificate. Is it possible to do this with Freeradius ? I had an issue with OS X < 10.9.5 using WiFi with EAP-TLS auth : my mac tried to do OCSP on my radius server's certificate before getting internet access... 20s timeout before getting connected ! I think it would be nice to issue OCSP stapling to WiFi clients so they can check the certificate revocation status offline. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

3 2

Help on initial FreeRADIUS setup
by Quinn McLaughlin 17 Dec '14

17 Dec '14

Hi everyone, I’m new to FreeRADIUS and running into multiple issues setting up EAP and MySQL on a new FreeRADIUS install (OS X , Debian to come). I’d love to hire someone experienced with FreeRADIUS for a few hours to help me in the initial setup (via screenshare) and to understand the MySQL table structures, as I need another app to interface there. I’m an experienced coder but new to RADIUS concepts. I’m working with hotspot authentication. Some 1:1 help would save me days of research; thanks for your consideration. Please make sure to reply off-list. Thank you! Quinn McLaughlin

3 2

RE: FreeRadius and WPA2-Enterprise machine authentication - With ActiveDirectory interconnection..
by Franks Andy (RLZ) IT Systems Engineer 17 Dec '14

17 Dec '14

I wouldn't contradict anything others have said about this one, they know their stuff more than me, but we *sort of* do this - user auth using 802.1x plus mac address auth with macs stored in AD. Most wireless controllers I've seen will support 802.1x + MAC , and do it as 2 separate authentication transactions. Some will also let you decide the order the transactions appear in. Mac auth isn't great on its own, but in addition to 802.1x you are authing the user/whole computer with certs and the computer with mac addresses. Just my 2p, possibly off track or wrong practice though! Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Tim Reimers Sent: 11 December 2014 20:17 To: freeradius-users(a)lists.freeradius.org Subject: FreeRadius and WPA2-Enterprise machine authentication - With ActiveDirectory interconnection.. Hi everyone - I'm trying to design something here that I'm sure has been done before, but AFAIK, it crosses through a few different howto documents, and being new to this, I'm just not certain that I have pieced together all the relevant HOWTo docs and not missed a point at which the design won't communicate the needed information. The plan is to authenticate wireless users AND their computers. (so that a user cannot BYOD to the secure network; only laptops joined to the domain will work) I know that WPA2-Enterprise is what I need, to be able to have rotating keys, use Radius for authentication, etc. I know that WPA2-Enterprise requires certificates to validate the machines I already have a Microsoft CA server running in my AD environment, with the GPO needed to push out workstation certificate enrollment and so on, for other applications. My question is - Can FreeRadius (3.0.1) on centos 7 be configured to do the machine authentication using certs from the Microsoft CA server? Meraki is the wireless infrastructure, if that helps. Thanks, Tim - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 10

radiusAuthServAccessRequests - how to get?
by Bilik.AA＠lsrgroup.ru 17 Dec '14

17 Dec '14

Hello everybody! I use freeradius-server-2.2.5 and I need to get info as ’radiusAuthServAccessRequests’ from ’RADIUS-AUTH-SERVER-MIB’ through snmp and I already have ’ RADIUS-AUTH-SERVER-MIB.txt’ in ’/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/mibs/’ but I didn’t find smth about how it can be done, how can I get ’radiusAuthServAccessRequests’ info? Thank you, bigwigs ☺ С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01D01A18.98D04E30]

2 1

radclient -x does not output anything anymore
by Chaigneau, Nicolas 17 Dec '14

17 Dec '14

Hello, Previously, using radclient with -x option we had a trace of the packets and value pairs sent and received, such as: Sending Access-Request Id 16 from 0.0.0.0:59582 to 10.67.106.9:1812 NAS-IP-Address = 172.20.154.213 Calling-Station-Id = '5c-0a-5b-e0-e9-64' (...) Received Access-Accept Id 16 from 10.67.106.9:1812 to 10.67.106.9:59582 length 56 Class = 0x3333363630323536343833 Not anymore. These output came from rad_encode and rad_recv functions, but were removed. How can we check what radclient sends and receives now ? Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 2

How many up un a sql ip pool
by Fabrizio Fiore Donati 16 Dec '14

16 Dec '14

Hi all, we have 3 pppoe access server, now i want to use a centralized ip pool via radius, can freeradius manage an ip pool of about 10000 ip via sql-ip pool ? -- Fabrizio Fiore Donati

2 1

ntlm_auth taking too much time
by Khapare Joshi 16 Dec '14

16 Dec '14

Hello all, I am seeing ntlm_auth taking too much time in my couple of freeradius server lately, I am pretty much sure this is because of "BILL GATES" AD responding slow. Dec 15 22:51:16 radserver1radiusd[1884]: Child PID 3300 (/usr/bin/ntlm_auth) is taking too much time: forcing failure and killing child. Dec 15 22:51:20 radserver1 radiusd[1884]: Child PID 3302 (/usr/bin/ntlm_auth) is taking too much time: forcing failure and killing child. Dec 15 22:51:21 radserver1 radiusd[1884]: Child PID 3303 (/usr/bin/ntlm_auth) is taking too much time: forcing failure and killing child. Here are my Versions: samba-winbind-3.6.23-12.el6.x86_64 freeradius-2.1.12-6.el6.x86_64 Win$ows AD 2012 Can you point me for some help how to get rid off these message or configuration, parameter that i can add ? Happy Xmas K

2 1

&array[n]
by Arran Cudbard-Bell 15 Dec '14

15 Dec '14

I think someone asked about this a while back. As Module-Failure-Message attributes are appended to the request list, if there are multiple errors it was previously not possible to get the most recent without using foreach. There's now a new array access index [n] which will get the last attribute instance in the current request. update request { Module-Failure-Message := 'foo' Module-Failure-Message += 'bar' Module-Failure-Message += 'baz' } update reply { Reply-Message := &Module-Failure-Message[n] } Would send the most recent failure message in the reply-message. This will be available in v3.0.6. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0