March 2014 - Freeradius-Users - lists.freeradius.org

802.1x EAP + Adtran authenticating on same radius server
by Alvin Ramos 20 Mar '14

20 Mar '14

Forgive me, I haven't worked with Radius in many years, I require some help with the following subject: Is it possible to have 802.1x EAP and Adtran to authenticate to freeradius? I've got the 802.1x EAP authenticating to Active Directory, but, when I add in the users file: Default LDAP-Group!="NetworkAdmins", Auth-Type := NTLM I can login to the adtran device, but not to the 802.1x EAP. Should I provide more information? Do anyone have a web site to suggest to help with this matter? [cid:image001.jpg@01CF4448.9CC194A0] Alvin Ramos Linux System Administrator Ph: 803.726.4032 1500 Hampton Street, Suite 101 Columbia, SC 29201

2 1

Upgrading from 2.2.2 to 3.0.1
by Nikolaos Milas 20 Mar '14

20 Mar '14

Hello, Some upgrade questions. I am on CentOS 6.5 and I've built 3.0.1 packages using: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources… I am wondering if it is possible to upgrade 2.2.2 to 3.0.1 (using these rpm packages). Is the configuration (as is working in 2.2.2) compatible (with 3.0.1)? Is 3.0.1 acceptable/proposed for production servers? The server is currently being used for eduroam and macauth (with ldap backend). We are planning to use it for DHCP too. Thanks, Nick

4 7

Version 2.2.4 has been released
by Alan DeKok 20 Mar '14

20 Mar '14

The changes from 2.2.3 are minor. Feature improvements * A "panic_action" can be set to have the server dump a gdb log on SEGV or other fatal error. * allow radmin command "set module status <module> <code>" which can be used to forcibly enable/disable modules. Bug Fixes * If the server fails to bind() after fork(), that is now reported to the parent, which exits with an error. * Session / delay times in MySQL are unsigned int. & Use --tag=CC for libtool. Closes #497. Because libtool is too stupid to notice that compiling means compilation. * Fix bug when copying attributes for vendors > 32767 * Fix behaviour on FreeBSD where sending packets from an interface bound to an IP address would fail when the server was built with udpfromto. * Don't fail config check if were listening on an IP which is also a home server. Some deployments have valid reasons to loop packets back to another virtual server. * Use correct port when DHCP relaying. * Set source IP address for DHCP packets from DHCP-Server-IP-Address, or DHCP-DHCP-Server-Identifier, if we're unable to otherwise determine the source IP.

4 6

Assign link-local addresses on authentication/authorization failure
by William C. Chandler 20 Mar '14

20 Mar '14

Hey all, I'm having trouble wrapping my brain around the correct way to do this, if at all possible. Some guidance would be greatly appreciated! I'm looking to assign link-local addresses to clients who fail to authenticate or fail to be authorized for access. I was wondering if this was even possible with radius? Would it be a DHCP-Reject in the post-auth section? Maybe something update reply? I've even thought about creating a new vlan with a dhcp server/scope of 169.254.254.x/24 and just dropping the users there... For more details -- setting up WPA enterprise wifi network, and we require our LDAP users to be part of certain groups to get on ("wirelessfaculty," and "wirelessstudents"). If they fail to authenticate due to bad password it'd be nice to give them a 169.254.0.1 address. Or if they're not in the proper group, a 169.254.0.2. This seems like it'd help us more quickly assess which step caused the hangup. Thanks for any ideas! --William Email correspondence to and from this address may be subject to the North Carolina Public Records law and may be disclosed to third parties by an authorized state official (NCGS. ch. 132). Student educational records are subject to FERPA.

2 1

Fwd: Disconnect users hanging
by Julio Fsnet 19 Mar '14

19 Mar '14

I have a problem. When the user tries to connect and already has a connection to it, an error pops multiple logins. I need to write this mysql error log somewhere or else knock the hanging connection, how can I do this?

2 7

Decoding HEX data in accounting interim-updates
by Callum Barr 19 Mar '14

19 Mar '14

Hi, We have an Alcatel-Lucent 7750SR when it sends its interim-updates we get an output like the following; Alc-Acct-O-statmode = "0x1 v4-v6" Alc-Acct-O-Inprof-Octets-64 = 0x0001000000000002a19e Alc-Acct-O-Outprof-Octets-64 = 0x00010000000000000000 Alc-Acct-O-Inprof-Pkts-64 = 0x00010000000000000e32 Alc-Acct-O-Outprof-Pkts-64 = 0x00010000000000000000 Alc-Acct-O-statmode = "0x2 v4-v6" Alc-Acct-O-Inprof-Octets-64 = 0x00020000000000000000 Alc-Acct-O-Outprof-Octets-64 = 0x00020000000000000000 Alc-Acct-O-Inprof-Pkts-64 = 0x00020000000000000000 Alc-Acct-O-Outprof-Pkts-64 = 0x00020000000000000000 Alc-Acct-O-statmode = "0x3 v4-v6" Alc-Acct-O-Inprof-Octets-64 = 0x00030000000000000000 Alc-Acct-O-Outprof-Octets-64 = 0x00030000000000000000 Alc-Acct-O-Inprof-Pkts-64 = 0x00030000000000000000 Alc-Acct-O-Outprof-Pkts-64 = 0x00030000000000000000 Alc-Acct-I-statmode = "0x8001 v4-v6" Alc-Acct-I-Hiprio-Octets_64 = 0x80010000000000012442 Alc-Acct-I-Lowprio-Octets_64 = 0x80010000000000000000 Alc-Acct-I-Hiprio-Packets_64 = 0x80010000000000000996 Alc-Acct-I-Lowprio-Packets_64 = 0x80010000000000000000 Alc-Acct-I-statmode = "0x8002 v4-v6" Alc-Acct-I-Hiprio-Octets_64 = 0x80020000000000000000 Alc-Acct-I-Lowprio-Octets_64 = 0x80020000000000000000 Alc-Acct-I-Hiprio-Packets_64 = 0x80020000000000000000 Alc-Acct-I-Lowprio-Packets_64 = 0x80020000000000000000 Alc-Acct-I-statmode = "0x8003 v4-v6" Alc-Acct-I-Hiprio-Octets_64 = 0x80030000000000000000 Alc-Acct-I-Lowprio-Octets_64 = 0x80030000000000000000 Alc-Acct-I-Hiprio-Packets_64 = 0x80030000000000000000 Alc-Acct-I-Lowprio-Packets_64 = 0x80030000000000000000 Each of the Alc-Acct-I-Hiprio-Octets_64 counters are formatted as follows; Eg. 0x80010000000000012442 where the first 2B represent the queue ID and the last 8B represent the octet counter in hex. So queue 1, 74818 octets How can I manipulate the data to put it into our database correctly? Say if I wanted to put the above information into field acct_queue1_in_octets and so onŠ We are running Freeradius v2.1.9 but can upgrade if needed. Many thanks in advance, Callum Barr Vibecom NZ

2 3

dhcp pool on freeradius server
by Mahima Kumar 18 Mar '14

18 Mar '14

Hello , Can anyone guide me about how to make a dhcp pool on the freeradius server? TIA -- Regards, Mahima Kumar 1365962

2 1

Howto group Users authenticated with ldap
by Mischa Diehm 18 Mar '14

18 Mar '14

Hi, we are authenticating users via ldap but don't have group attributes in ldap. Is there a way to define groups within radius itself so that I can actually use these groups in the users file like: # don't know where and how to setup a group like that group mon = user1, user2, user3 #use it in the users file DEFAULT Auth-Type := pap, group == mon, Huntgroup-Name == ons Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=0", Thanks in advance Mischa -- Mischa Diehm | Network Operations Center (NOC) UniBasel | UniRechenZentrum (URZ) Klingebergstr. 70 | CH-4056 Basel Tel. +41 61 267 2273 | http://urz.unibas.ch

2 4

Re: JSON format to use for rlm_rest
by Werner Stucky 17 Mar '14

17 Mar '14

Hi Arran Running like a charm now thanks. I'll keep testing, but so far it looks good. Thanks for the help.

2 1

Create date from system in ldap module
by Bogdan Siara 17 Mar '14

17 Mar '14

Hello, I use freeradius with ldap for eap-peap in my network. In ldap module I check user by means of: filter = "(&(uid=%{User-Name})(o=COMPANY))" I would like to add one more parameter to check attribute pwdchangedtime, for example: filter = "(&(uid=%{User-Name})(o=COMPANY)(pwdchangedtime>`date --date="90 day ago" "+%Y%m%d%H%M%S"T`))" How to realize this trick? Regards BS

3 4