August 2014 - Freeradius-Users - lists.freeradius.org

Get account's connection details
by Freddy Campbell 29 Aug '14

29 Aug '14

Hello people, I have a couple of questions to make about the working with FreeRadius. 1. Which are the differences, advantages and disadvantages of the storage of users information whether in files or sql server? 2. How can get user information about their general information, session time, amount of mb downloaded, IP connection and other statistics to show to the user? Thanks in advance. ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est� limpio.

2 1

FreeRadius in Windows - was Sourceforge and FreeRADIUS
by Rui Ribeiro 29 Aug '14

29 Aug '14

Neither to intrude in this sensitive matter, nor wanting to discuss it, I would just like to ask something for the sake of information. You are saying you dont have a Windows version, however I do recall reading some months ago about a Windows paid version too. At the time I *think* it was quite deliberate that it purported to be quite official i.e. your team. If it were not for this email I would not got the slightest idea it was another individual. Regards, > Message: 1 > Date: Thu, 28 Aug 2014 12:49:55 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Sourceforge and FreeRADIUS > Message-ID: <53FF5DB3.9040304(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Someone released a "FreeRADIUS for Windows" on sourceforge. > Initially, he didn't include the source. After some discussion, he put > up a copy of the "tar" file from an official release. > > That isn't good enough. FreeRADIUS does not build or run under > Windows. Any changes made to build on Windows MUST be released publicly. > > In addition, he seems to have added a demand for a serial number. > I've been getting a steady stream of questions from people asking how > they get a serial number for the software. I've had to tell them > they've been cheated. > > All versions of FreeRADIUS will be free to download and use. Always. > Requiring a secondary license or user registration is not allowed. > > I've sent a DMCA notice to Sourceforge, and they've removed the > offending software. It will not be allowed online until it is in > compliance with the GPLv2. > > Alan DeKok. > >

6 5

FreeRadius - ActiveDirectory authentication multiple domains
by Ricardo Esteves 29 Aug '14

29 Aug '14

Hi, I need to setup a radius server in order to authenticate users against ActiveDirectory. But i've got one problem, my activedirectory has multiple domains, for example: company.com branch1.company.com branch2.company.com branch3.company.com Anyone has any idea on the best way to accomplish this task? Multiple LDAP configurations? For example with multiple ldap settings is there anyway to preprocess the autentication request with a script to find which domain the user belongs and then use the corresponding ldap configuration to that domain? Best regards, Ricardo Esteves.

5 10

3Com Radius Failover
by Mike Ford 29 Aug '14

29 Aug '14

Hello, Yesterday I finally got my freeradius server playing nicely with a 3Com 5500 EI, thanks in no small part to the great posts in this forum. I have a question about failover radius configurations on the 3Com switch. I know this would probably be better posted on the 3Com / HP support site, but I thought I might get better answers here. ;) I know that it possible to have a primary and a secondary radius sever set up in the same radius scheme (example config below). # radius scheme freerad server-type extended primary authentication x.x.x.x primary accounting x.x.x.x accounting optional key authentication ****** key accounting ****** user-name-format without-domain # Is it possible to have a radius server set a primary, and if the server is not accessible, set the secondary to local login authentication? This is my first post here, sorry if there is not enough information, or if this post is in the wrong place. Thanks in advance!

1 0

3.0.4 release candidate 2
by Alan DeKok 29 Aug '14

29 Aug '14

I've put a release candidate on the net as: ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.4rc2.tar.gz After a few months of hard work, this should be the final release candidate. Please test it. We don't want any last-minute "oops" marring the release. The list of changed items is long. A number of small bug fixes, and a number of useful new features. We've also added more tests, to be sure that future releases don't go "backwards" in functionality and stability. Alan DeKok.

5 10

Re: FreeRadius in Windows - was Sourceforge and FreeRADIUS (Arran Cudbard-Bell)
by Rui Ribeiro 29 Aug '14

29 Aug '14

I have not replied to other previous similar message to not feed further this misunderstanding. I am not related in any way to the Windows guys, so I am not quite sure why I should have an interest into "introducing confusion". Relax a bit guys. I am quite aware this a serious matter - What I wanted to convey is that I found that site, and it appeared to be "very legit", only that - maybe on purpose. I may have read or not the previous message, however this one hit the point for me. Regards > Message: 2 > Date: Fri, 29 Aug 2014 11:11:53 +0200 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius in Windows - was Sourceforge and FreeRADIUS > Message-ID: <A19B4586-EB2C-4FA0-8002-AF5919A064E6(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > > You are saying you dont have a Windows version, however I do recall > reading some months ago about a Windows paid version too. At the time I > *think* it was quite deliberate that it purported to be quite official i.e. > your team. > > No. That is absolutely incorrect. You have not got that information from > either the FreeRADIUS users or FreeRADIUS developers list. > > I suspect you are attempting to purposely introduce confusion. > > > If it were not for this email I would not got the slightest idea it was > another individual. > > Well it is. > > This is serious. The GPLv2 violation is secondary. It's quite plausible > that the version being distributed on source forge may contain malicious > code. It would be fairly trivial to modify the server to forward > credentials to a remote site, whether they be from users, or the ones > embedded in the configuration. > > That's why it's so important from them to publish the actual code used to > create the windows binaries, so it can be checked against the code from our > repository. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS development team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > >

1 0

Sourceforge and FreeRADIUS
by Alan DeKok 28 Aug '14

28 Aug '14

Someone released a "FreeRADIUS for Windows" on sourceforge. Initially, he didn't include the source. After some discussion, he put up a copy of the "tar" file from an official release. That isn't good enough. FreeRADIUS does not build or run under Windows. Any changes made to build on Windows MUST be released publicly. In addition, he seems to have added a demand for a serial number. I've been getting a steady stream of questions from people asking how they get a serial number for the software. I've had to tell them they've been cheated. All versions of FreeRADIUS will be free to download and use. Always. Requiring a secondary license or user registration is not allowed. I've sent a DMCA notice to Sourceforge, and they've removed the offending software. It will not be allowed online until it is in compliance with the GPLv2. Alan DeKok.

1 0

configurable fail-over for policy virtual modules?
by Zenon Mousmoulas 27 Aug '14

27 Aug '14

Hi, should it be possible to do this: policy { check_something { if (Some-Attribute) { noop } else { reject } } } authorize { check_something { noop = return } } 2.x just gives a parser error, while 3.x also explains it failed to find "check_something" in the "modules" section. Thanks in advance for any insight, Z.

3 11

eap: set virtual server based on realm
by Saša Babić 27 Aug '14

27 Aug '14

Hi, is there a way to set virtual_server in eap based on realm (or non-stripped User-Name)? Thanks, -- Saša.

2 3

Avoiding UDP port 1814
by Brian Candler 26 Aug '14

26 Aug '14

[Using freeradius 2.1.12+dfsg-1.2ubuntu8 from ubuntu 14.04] I notice that freeradius listens on UDP port 1814. The problem is that this conflicts with another application I'm using: http://docs.ganeti.org/ganeti/master/man/ganeti-confd.html and I'd rather move freeradius than this one. However I cannot see how to change which port freeradius uses. There is no entry for 1814 in /etc/services. I see the following in freeradius -X output: Listening on proxy address * port 1814 but a grep -R of /etc/freeradius doesn't find 1814. Indeed, a grep -R of the entire source code doesn't find anything relevant for 1814. So my questions are: * why is FreeRADIUS using port 1814? Has it bound a socket to port 1814 for sending *outbound* proxy requests (and is only "Listening" in the sense that it receives replies to the requests it has sent?) * how can I bind this to a different port instead? In ./src/include/radius.h I can see #define PW_AUTH_UDP_PORT 1812 #define PW_ACCT_UDP_PORT 1813 but I'm stuck finding where 1814 is chosen. Ah, maybe it's this: port = sock->port + 2; /* skip acct port */ ... /* * Try to find a proxy port (value doesn't matter) */ for (sock->port = port; sock->port < 64000; sock->port++) { if (listen_bind(this) == 0) { *last = this; last = &(this->next); /* just in case */ break; } } which suggests that it's hard-coded to be the authentication port + 2, or the first available socket after that. OK, to test this theory: stop both apps, restart the other app which binds to 1814, then restart freeradius. # netstat -naup | grep freeradius udp 0 0 0.0.0.0:42388 0.0.0.0:* 23378/freeradius udp 0 0 127.0.0.1:18120 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1812 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1813 0.0.0.0:* 23378/freeradius udp 0 0 0.0.0.0:1815 0.0.0.0:* 23378/freeradius Yep, freeradius has moved to 1815. So I can make this work, but only if ganeti-confd starts *before* freeradius. Is there any setting I've missed which would allow the freeradius port scan to start at a different place? Thanks, Brian.

2 2