January 2015 - Freeradius-Users - lists.freeradius.org

OS X Pam Radius 1.3.17
by Jason Miller 27 Jan '15

27 Jan '15

Hello All, Currently I am trying to configure and install Pam Radius 1.3.17 Auth module on OS X however I have been unable to get it to compile on OS X. I am able to compile version 1.4 with out any errors. I have gone to http://wiki.freeradius.org/building/Build to try and determine the correct steps to building the Pam Auth Module on OS X. When I am able to get it to compile I run in this error: pam_radius_auth.c358:23 error: variable has incomplete type 'struct timezon'11:03 AM struct timezone tz; I then Googled around and found this on stack overflow: http://www.google.com/url?q=http%3A%2F%2Fstackoverflow.com%2Fquestions%2F13… After moving all the correct pieces around I tried to test and go a lot of errors. I will not copy and paste the errors into this email unless someone would like me to, or want a .txt of the logs. I welcome any help on configuring Pam Auth Module on OS X. Thank you. Best Jason Jason Miller Lawrence Berkeley National Laboratory 1 Cyclotron Road MS 49R192 Berkeley, CA 94720 Email: Jmiller(a)lbl.gov Phone: (510) 486-6698

2 1

How to configure FreeRADIUS for Kerberos and LDAP
by Brendan Kearney 27 Jan '15

27 Jan '15

i have put together a doc to assist in the configuration of FreeRADIUS to use Kerberos for authentication (AuthN) and LDAP for authorization (AuthZ). I have modelled the configs after my environment, and taken into account the design and implementations choices i have made. others may have different needs, so some directives or values may need to be changed based on those needs. i make no guarantees that my configs will work in your environment. i have tried to use simple language, but be concise, precise and accurate. if points are ambiguous, lacking clarity or leave room for misinterpretation, please provide constructive feedback. if steps are sub-optimal, incorrect or contain typographical errors, please keep me honest, and indicate where the errors have occurred. i release this doc into the ether and lay no claim to its format, the data contained within it nor to the intellectual property rights of the rightful owners of any trademark, servicemark or copyright. thank you, brendan kearney

2 2

Freeradius and Cisco PPP forwarding
by Olivier CALVANO 26 Jan '15

26 Jan '15

Hi i want create with my cisco router a L2TP/PPP proxy forwarder. I use Freeradius for auth/accounting and want sent by radius the final destination of the tunnel.. Anyone have a configuration sample for freeradius ? thanks Olivier

3 2

checkrad and db based simultaneous use checks
by Bill Schoolfield 26 Jan '15

26 Jan '15

Hello All A client of mine just asked that we limit active sessions per user to 1 (e.g simultaneous use checking). Radutmp was already configured but I disabled it in favor of the checks via the SQL module. Things look to be working but I'm concerned as the radacct table has lots of (possibly old/bogus) records with no stop info that I assume will cause the check to return false negatives. We also configured checkrad and it is working. My question is this: how exactly is checkrad used? Is it used exclusively or in concert with the SQL module checks? Will I need to cleanup the radacct table or will checkrad "save" me? I have reviewed all the documents and configuration I can find but checkrad use is still a bit of a mystery to me. Bill

2 3

wpa2 enterprise separate users
by howtocisco 26 Jan '15

26 Jan '15

Hello! I have a running freeradius server version 2.1.12. Here's how thing are working: 1.Freeradius server is up and running, i have configured it to work with wpa2 enterprise eap-tls 2.Soho routers are configured to connect to freeradius server 3. In clients.conf i have defined multiple client directives ("Router1" and "Router2"), each with it's own public ip and different secret password (these are simple soho routers) 4. In users file i defined couple of users (let them be user "A" and user "B", each having their own certificate for authentication 5.User "A" is supposed to connect to Router1, and user "B" is supposed to connect to to Router2 6.User "A" can connect to Router1 via wifi, but also CAN connect to Router2, and the other way around: user "B" can connect to Router1 and Router2 (this make sense to me according how freeradius works) 7.What i want to achieve is to seperate those users the way, that they can only connect to defined Router (1 or 2, not both at the same time). Is there a way of doing it? Any help would be appreciated.

2 3

Re: Disconnect message!
by Haviaras Kostas 26 Jan '15

26 Jan '15

> Hi > > Which kind of user do you need to disconnect ? Hotspot user ? i user > CoovaChilli and deliver disconnection message on COA port of CoovaChilli > NAS using java application. it works fine. i am sorry if i did not > understand you. > > Thanks / --RM Yes, I am trying to disconnect Hotspot user from Mikrotik! The syntax is the same with the disconnect request ??? Thanks

2 1

using external script in virtual server config
by the2nd＠otpme.org 25 Jan '15

25 Jan '15

Hi list, currently i'm using freeradius-2.2.5 with an external authentication script for clear-text and ntlm requests. the setup is described here: https://www.otpme.org/redmine/projects/otpme/wiki/Freeradius_Example_Config… i have two questions regarding this setup. 1. for clear-text requests i always get "Auth: Invalid user: [heiko.baumann" on authentication failure. for ntlm request an "Auth: Login incorrect" is logged. i was using the script (exec) module before which logged "Auth: Login incorrect" on failure but i liked the idea of having the complete config in the virtual host file. i also tried to call my script from the authenticate section of my vhost but this was not working. 2. is it possible to call the script for ntlm/mschap authentication from the vhost config? currently its called from the mschap module. both are just cosmetic issues but it would be great to have everything in on file. :) also it would be great if someone with good freeradius skills could have a look at the example config because i'm not sure if its the best way to do external authentication with freeradius. regards the2nd

2 7

Change FreeRADIUS Default Port Number
by Russell Mike 23 Jan '15

23 Jan '15

Greetings Experts I often notice attacks on our FreeRADIUS server. To stop these attacks, i am thinking to change the default authentication port from 1812 to something different. 1.) Is it correct thing to do ? 2.) Would it even help ? Stop or reduce fake auth attempts ? 3.) How do we modify the default port to set different port for FreeRADIUS? Thanks / Regards --RM

4 7

Re: Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

> In v3.0.x HEAD we added the capability to send CoAs/DMs directly to a > NAS using the control:Packet-Dst-IP-Address attribute, and to read CoAs > using the detail reader. I am using Freeradius 3.0.4, I must update my version 3.0.6?

2 1

Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

Hello, I have been confused about how to create the disconnect message for a specific user. It is possible to create it from java application? I need some guidance what to read and look ! Sorry for my English! Thanks for your time and attention!

4 3