March 2014 - Freeradius-Users - lists.freeradius.org

DHCPv6 support
by Nikolaos Milas 26 Mar '14

26 Mar '14

Hi, Are there any plans to provide DHCPv6 functionality any time soon? All the best, Nick

5 6

Re: IP-Address
by Bruce Richardson 26 Mar '14

26 Mar '14

Hi, thanks for all the replies to my query. They have helped me understand the problem and backed up what I already knew. Hopefully others will find the thread useful in the future. After having another in-depth look at it yesterday I have come to the conclusion that the elderly Cisco WiFi APs I am using are just too old to support all the features needed. Annoyingly the AP does know what the IP address is because you can see it on the connections table, but it refuses to paste it into the accounting data. I've tried various commands to force it. I have proved it can work because I have some Aerohive test kit that works perfectly. Freeradius passes the data to Checkpoint and the correct identity awareness is set up correctly. Thanks again Bruce. -- This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE

1 0

No remote authentication
by Benoit 26 Mar '14

26 Mar '14

Hello, This might have been asked before (and I hope so), but I can't get my freeradius server to respond remote authentications requests. I got the SQL authentication set up and things seem to work in local. radtest works for me with this command: radtest myuser mypass 127.0.0.1 1812 test which would be in my NAS: client 127.0.0.1{ ipaddr = 127.0.0.1 secret = test } -> I see the package accepted from debug mode on server. Now if I want to test through the Internet, using NTRadPing, I am not sure how I should set up my client, I tried (with xx.xx.xx.xx my IP as seen through the Internet): client xx.xx.xx.xx{ ipaddr = xx.xx.xx.xx secret = test } but the server debug mode (server side) does not react at all and stay in the waiting for requests state, while the client gets its requests to timeout. What am I missing? Did I get the IP thing right anyways?

6 10

how to organize groups of users getting access to groups of servers
by Jan-Frode Myklebust 25 Mar '14

25 Mar '14

I want to use freeradius to authenticate different groups of users (from LDAP) to sets of network devices, potentially with different access levels, but have a bit hard time understanding how this is supposed to be configured. Would be nice with some advice.. What I have so far is: # Give ldap group "firewall" super-user privilege on juniper firewalls: DEFAULT Ldap-Group == "cn=firewall,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP Juniper-Local-User-Name := "super-users", # Give ldap group "netadmin" "enable" access on cisco routers: DEFAULT Ldap-Group == "cn=netadmin,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP cisco-avpair = "shell:priv-lvl=15" But this doesn't work for users that are member of both groups, so I need to say that the first rule is limited to a set of juniper devices, and the second is limited to a set of cisco devices. What's the strategy we should use for expressing this? Is it possible without having to specify one rule for each NAS-IP-Address? I.e. being able to do some kind og grouping of clients to match on would be very helpful.. -jf

2 3

Using static library(disable shard library) will make -X fail.
by kids67.tw 25 Mar '14

25 Mar '14

Dear Support, I use 3.0.2 version for below configure: 3.0.2: ./configure --prefix=./bin/LINUX/freeradius --with-shared-libs=no --with-openssl-includes=./openssl/install/LINUX/include --with-openssl-libraries=./openssl/install/LINUX/lib --with-sqlite-lib-dir=./sqlite/install/LINUX/lib --with-sqlite-include-dir=./sqlite/install/LINUX/include I can make and make install successful, but after that I want to run ./radiusd -XC -d ./bin/LINUX/freeradius/etc/raddb/ It will display below fail: radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { ./bin/LINUX/freeradius/etc/raddb//mods-enabled/detail.log[17]: Failed to link to module 'rlm_detail': rlm_detail.so: cannot open shared object file: No such file or directory It means link module fail, but since I already configure without dynamic library, why it still want to link rlm_detail.so? My library path is: ./bin/LINUX/freeradius/lib/ and it only have rlm_*.a and rlm_*.la, don’t have any dynamic library. Does freeradius can not support static library? Please help, thanks. Regards, SAxonTseng

4 4

dhcp static pool getting prefence over sqlippool
by Mahima Kumar 23 Mar '14

23 Mar '14

Hello, So mysqlippool seems to be working fine as i can see in the debug that it is allocating a framed ip address everytymto a user.... But the problem is that the client is getting the ip address i mentioned in the dhcp static file and not the one assigned from the sqlippool. Now i removed the ip address from the dhcp static file but then the client is not getting any ip then. Can anyone help me with this? TIA -- Regards, Mahima Kumar 1365962

2 1

command to monitor radius service is running or not in nagios
by Rishabh.Shukla 21 Mar '14

21 Mar '14

Hello, I have configured and installed radius server but now i wish to monitor the "radius" service in nagios. But i am not getting any success if any body can help or let me know whether there is any command to moinitor that in nagios. i want to know whether the service is running or not Please help me Thanks and regards Rishabh.

2 1

Legacy style generic LDAP attributes
by Arran Cudbard-Bell 21 Mar '14

21 Mar '14

This was not included in 3.0.2 but will be in 3.0.3 The old v2.x.x rlm_ldap module supported generic valuepair attributes. These attributes allowed any attribute to be represented in LDAP without explicitly being added to the radius <-> LDAP attribute map. In 3.x.x this functionality was retained in the form of the 'valuepair_attribute'. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai… Unfortunately this isn't directly backwards compatible with with v2.x.x, as v2.x.x used attributes without list qualifiers, and inferred the attribute list from the attribute mapping type. As an interim measure to ease migration the rlm_ldap module now supports the old style functionality. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai… This will likely be removed in the next major version (unless someone comes up with a compelling reason to keep it) as it's essentially duplicate functionality. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: DHCP Dynamic pool and MAC authentication
by Thomas Bru 21 Mar '14

21 Mar '14

>> I am having the exact same issue. Can anybody assist with this issue. "anybody >> can connect a device on my network and the Freeradius server reply to DHCP >> Discover, assign an IP address using the mysql radipool table but without >> checking if the mac address is in the radcheck table." > Haven't looked at this directly, but it should be pretty easy. I'm > guessing you want to either copy DHCP-Client-Hardware-Address into > Calling-Station-Id, then call sql (with Calling-Station-Id in the > radcheck table), or just all DHCP-Client-Hardware-Address directly > into the radcheck table, then just call sql. > Based on the result code from sql, you probably then want to > update the DHCP-Message-Type to inhibit a reply if the MAC wasn't > found. Hello I successed to install and configure MAC Authentication ans DHCP pool. But at this point, I have done to many thing to explain how we can implement this solution. I hope I will reinstall it the next week and I will give you the solution. But the solution works :) Best Regards Thomas

1 0

DHCP Dynamic pool and MAC authentication
by Thomas Bru 20 Mar '14

20 Mar '14

Hello Everybody This is my first message on this mailing list so I hope I will do everything right. I need your help because I want to implement Freeradius as a DCHP server with an dynamic IP address pool (using radipool mysql table) and MAC authentication. I successed to install and activate DHCP server and dynamic pool but not authenticate. But, actually, my problem is anybody can connect a device on my network and the Freeradius server reply to DHCP Discover, assign an IP address using the mysql radipool table but without checking if the mac address is in the radcheck table. Before the activation of the dynamic IP pool, I can authenticate and if the authentication is OK, I give a static address to the client. The address was stored into the raply table). Now I can't do that with the dynamic pool. Did anybody can help me ? Thanks in advance for your helps and your replies. Best Regards Thomas

4 3