September 2014 - Freeradius-Users - lists.freeradius.org

How to store data to a custom table in phpmyadmin?
by rafa alfurqan 11 Sep '14

11 Sep '14

Hi all, is it possible to store IMSI code (IMSI for eap-sim data in users file) from freeradius to a custom table that i made in phpmyadmin, if it's possible can someone show me if the examples of the implementation? what i want to achieve is that for freeradius to store IMSI data to asterisk's real time table or for asterisk to read from freeradius's table for sip.conf and extension.conf username in asterisk files. really need help.

1 0

/etc/raddb/sites-enabled/default[90]: Expecting section start brace '{' after "{ Huntgroup-Name"
by Jeroen Bosch 11 Sep '14

11 Sep '14

Dear freeRADIUS users, FreeRADIUS Version 2.1.12 I'm trying to setup Huntgroups using the HOWTO http://wiki.freeradius.org/guide/SQL-Huntgroup-HOWTO After I add "{ Huntgroup-Name := "%{sql:SELECT groupnameFROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'}" }" to my sites-enabled/default configuration I get the following error message: including configuration file /etc/raddb/sites-enabled/default /etc/raddb/sites-enabled/default[90]: Expecting section start brace '{' after "{ Huntgroup-Name" Errors reading /etc/raddb/radiusd.conf How to resolve this error message? Thanks in advance! Kind regards, Jeroen Bosch *Design Driven Networking - Smarter, better, controllable networks * Jeroen Bosch | Developer Business Centre Leeuwenveldseweg 5n, 1382 LV Weesp, NL m: +31 6 22768473 | t: +31 20 894 3412 jeroen.bosch(a)netyce.com | www.netyce.com

2 3

Using radmin with v3.0.4
by Kev Pearce 11 Sep '14

11 Sep '14

Hi, With the following in my config: listen { type = control socket = ${run_dir}/${name}.sock mode = rw } I get this on start-up: radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "@localstatedir@/run/radiusd/radiusd.sock" mode = "rw" } Failed binding to @localstatedir@/run/radiusd/radiusd.sock: No such file or directory Is there a different way to setup radmin in v3? Cheers Kev/.

2 2

How to reject when user is not in the appropiate Huntgroup for site?
by Jeroen Bosch 11 Sep '14

11 Sep '14

Dear freeRADIUS users, FreeRADIUS Version 2.1.12 I'm trying to setup Huntgroups using the HOWTO http://wiki.freeradius.org/guide/SQL-Huntgroup-HOWTO after adding "update reply { Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'}" }" to my sites-enabled/default I do see the queries in the debugging information checking if the supplied user is part of the Huntgroup however when this is not the case the user still get's access: How do I reject when a user is nog in the appropiate Huntgroup? Thanks in advance! Kind regards, Jeroen Bosch *Design Driven Networking - Smarter, better, controllable networks * Jeroen Bosch | Developer Business Centre Leeuwenveldseweg 5n, 1382 LV Weesp, NL m: +31 6 22768473 | t: +31 20 894 3412 jeroen.bosch(a)netyce.com | www.netyce.com

2 4

dynamic_clients example in v3.0.4
by Kev Pearce 11 Sep '14

11 Sep '14

Hi all, In the dynamic_clients example file in FR v3.0.4 it uses the netmask field, but when you start up you get: 'netmask' field found in client dynamic is deprecated, use CIDR notation instead. Please fix your configuration Support for 'netmask' will be removed in a future release Just thought I'd let you know so you can amend the example dynamic_clients file. Cheers Kev/.

2 1

Subject: Re: Release of Version 3.0.4
by Mike Poole 11 Sep '14

11 Sep '14

> Message: 6 > Date: Wed, 10 Sep 2014 16:56:06 -0400 > From: Alan DeKok <aland(a)deployingradius.com<mailto:aland@deployingradius.com>> > To: FreeRadius users mailing list o <freeradius-users(a)lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org>> > Subject: Re: Release of Version 3.0.4 > Message-ID: <5410BAE6.8030609(a)deployingradius.com<mailto:5410BAE6.8030609@deployingradius.com>> > Content-Type: text/plain; charset=ISO-8859-1 > We encourage people to use the latest release, even when OS vendors don't upgrade their packages. > To help people use the latest release, we now offer "official" > pre-built packages. They currently are for a limited range of systems. > If there is demand for more packages, please ask. We'll see what we can do. > The packages are available here: > https://packages.networkradius.com/ > Alan DeKok. > ************************************************* Thank you Alan. We've been stuck on Wheezy and 2.1.12 and doing patches/fixes ourselves for the last couple of years. We are in the process of moving to Ubuntu for development but that's months away and this will help immensely.

2 1

change mac-address (Calling-Station-Id) on radius-request from AP to lower case
by Попов Александр 11 Sep '14

11 Sep '14

Hello, friends. Ubuntu 14.04, freeradius 2.1.12+dfsg-1.1ubuntu0.1 How to change mac-address (Calling-Station-Id) on radius-request from AP to lower case? Default rewrite_calling_station_id not help. Thank you. С уважением, Попов Александр pop5s(a)mail.ru

2 2

Request is supposed to be proxied to Realm SOMEREALM. Not doing EAP.
by Axel Luttgens 10 Sep '14

10 Sep '14

Hello, With proxying turned on, when an "outsider" connects to an AP of ours, the debug log shows: ... eap: Request is supposed to be proxied to Realm SOMEREALM. Not doing EAP. [ eap ] = noop ... Conversely, everything in the authorize section that follows: eap { ok = return } is executed for each roundtrip between the client and the remote server; in the case of EAP, that may mean a dozen of DB queries, a dozen of lines logged thru a linelog instance, and so on. Is this the behavior to be expected? (another way to ask: may I assume I didn't err in my config?) TIA, Axel

5 9

freeradius and AD auth with option require-membership-of
by Попов Александр 10 Sep '14

10 Sep '14

Hello, friends. Ubuntu 14.04, freeradius 2.1.12+dfsg-1.1ubuntu0.1 I'm trying to authenticate a user through Active Directory(ntlm_auth) with option --require-membership-of. When I run just from the console with the option --require-membership-of = 's-1-5-21-241991751-2423211274-3836920987-1626 - everything goes well. root@lf-mgr-02:/etc/freeradius# ntlm_auth --request-nt-key --domain=lenfi.ru --username=test2 --require-membership-of='s-1-5-21-241991751-2423211274-3836920987-1626' Password: NT_STATUS_OK: Success (0x0) When I add in mschap this option in debug I see: Could not parse s-1-5-21-241991751-2423211274-3836920987-1626 into separate domain/name parts! *** Error in `/usr/bin/ntlm_auth': free(): invalid pointer: 0x00007f13562b9e9c *** Exec-Program output: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d) Exec-Program-Wait: plaintext: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d) When I try add --require-membership-of=LENFI\\wirelessusers: Could not parse LENFILM\WirelessUsers into separate domain/name parts! *** Error in `/usr/bin/ntlm_auth': free(): invalid pointer: 0x00007f13562b9e9c *** Exec-Program output: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d) Exec-Program-Wait: plaintext: ?▒t?▒r▒▒▒<???▒▒▒▒1▒?▒▒I?|$?H?▒??j▒▒▒▒▒r (0xc000000d) Please tell me whether it is possible to add this option(--require-membership-of) in the config mschap to authenticate users of a AD group. Thank you! ---------------------------------------------------------------------- С уважением, Попов Александр pop5s(a)mail.ru

3 5

Re: eapol_test works but not wpa_supplicant with wired interface
by xxiao8 10 Sep '14

10 Sep '14

On 09/10/2014 05:00 AM, freeradius-users-request(a)lists.freeradius.org wrote: > > Message: 1 > Date: Wed, 10 Sep 2014 07:28:53 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, xxiao8 <xxiao8(a)fosiao.com> > Subject: Re: eapol_test works but not wpa_supplicant with wired > interface > Message-ID: <6b71a7f4-b85b-475f-a1ee-72b610af1334(a)email.android.com> > Content-Type: text/plain; charset="utf-8" > > Um. No. You also talk about multicast MAC . Thats not how 802.1X works . Yiur PAE/NAS needs to be configured for 802.1X and know the IP address of the radius server.... and since that link isn't authenticated yet it can't be the same one that radius lives on (!). > > In essence this isn't something dumb like DHCP... > > alan I will use an wireless-AP-router to act as the NAS then, thanks a lot for the info, I'm new to radius :) xxiao

1 0