- Freeradius-Users - lists.freeradius.org

Backup and restore FR
by yagizozen 17 May '12

17 May '12

Hello everyone, It can be a little weird to ask this question, if it is I am sorry but is there any way to clone the FR application with everything related to another machine with same OS? If I am using FR on my centos and I want to install FR to another centos with the exactly same configs. Instead of installing FR and coping the configs one by one, is there any way to directly get a backup of FR in my main machine and restore it on the other machine? Also in case of any disaster scenarios, I can simple restore a previously backuped FR with efficient way in a little time. Any suggestions? Thank you -- View this message in context: http://freeradius.1045715.n5.nabble.com/Backup-and-restore-FR-tp5710672.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Conditionally passing custom attributes
by Jeremy Guthrie 17 May '12

17 May '12

Alan, I have asked Chad to ask out here. I have a stringent business requirement to live within a patch channel that is being maintained by SuSE. So while yes, we could compile the latest and greatest, I have to balance that that against the workload and management of a pile of other packages. Relying on the SuSE patch channel solves a ton of issues for me as it relates to effort, tracking security vulnerabilities, and compliance which all roll into cost. I've got hundreds of RADIUS servers out in the field and we rely on it heavily. We're very happy with freeradius. It works very well however we have just found a product that is having some issues we'd like to get to the root of. If it comes down to the release that SuSE's package of it isn't a good one, then we'd talk about internally upgrading freeradius or doing something else with the product we are trying to manage. At this point we have got this one product we need to see if we can get working. If you are looking for more information or other things you'd ask we do before posting to the list, we'd be happy to comply but I cannot afford self-packaging freeradius at this point. :( >Alan DeKok wrote: > > No, you're not. You can upgrade. The server comes with files that >lets you build a Suse RPM. > > There is *no technical reason* why you can't upgrade. The only >reasons are politics, and personal choice. > Alan DeKok. >Chad Lensert wrote: >> This is the version that is supplied with SuSE and needs to be >> managed via their patch channel, so I am required to use this version. -- *Jeremy Guthrie* Technical Architect - Orchestration | *CDW* 5520 Research Park | Madison, WI 53711 Phone: 608.298.1061 | Fax: 608.288.3007 | NOC: 608.298.1102 | Toll Free: 866.202.1807

2 1

Reject users based on LDAP attribute
by C.F. Yeung 17 May '12

17 May '12

We have 802.1x authentication via AD. It's okay. Now, we would like to reject users based on LDAP attribute, WLANStatus. Added attribute in dictionary and ldap.attrmap as follow. Where should I put the unlang? /etc/raddb/dictionary ATTRIBUTE My-Local-wlanStatus 3000 string /etc/raddb/ldap.attrmap replyItem My-Local-wlanStatus WLANStatus /etc/raddb/sites-available/default authorize { ... ldap if (My-Local-wlanStatus == "A1") { reject } ... } rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=student,o=example.com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... rlm_ldap: WLANStatus -> My-Local-wlanStatus = "A1" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (My-Local-wlanStatus == "A1") (Attribute My-Local-wlanStatus was not found)

3 6

EAP and automatically authenticating users
by David Peterson 17 May '12

17 May '12

I have a couple of users who have unknown usernames and passwords. They are also using EAP-TTLS for authentication. Is there a way to automatically authenticate all of them and if so, can I also send the Framed-Filter-Id attribute with the authentication response as if the user were truly authorized. David

3 6

Re: freeradius service doest start
by Baris Genc 17 May '12

17 May '12

> Dear All, > > When i try to start radius service on ubuntu service is fail. How to start > radius service on ubuntu? > > root@123:/etc/init.d# /etc/init.d/freeradius start > * Starting FreeRADIUS daemon freeradius > ...fail! > > root@123:/etc/init.d# /etc/init.d/freeradius reload > * Reloading FreeRADIUS daemon freeradius > * /var/run/freeradius/freeradius.pid not found... > ...done. > > root@123:/# radiusd -X The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Try: apt-get install <selected package> > Is there any person help to me? > Thank you. >

4 6

ntlm_auth in freeradius
by val john 17 May '12

17 May '12

Hi... i need to configure the freeradius with mschap (need to specify the ntlm_auth file path in "modules/mschap and modules/ntlm_auth files) , but i cant find the ntlm_auth file in my OS , is it coming with freeradius or we have to install it separately . Thank you John

5 8

Re: Conditionally passing custom attributes
by Chad Lensert 17 May '12

17 May '12

> Why? 2.1.1 was released almost 4 years ago. This is the version that is supplied with SuSE and needs to be managed via their patch channel, so I am required to use this version. > Well, it should work. It works for me in my testing. I'll continue to troubleshoot. I wasn't sure if there was some global config option or something obvious I might be missing or a bug in this version.

2 1

Unix TimeStamp Based Login
by jomajo 16 May '12

16 May '12

Hello! Maybe somebody know or maybe already implemented , Unix TimeStamp based login? For example if I have "radcheck" table like this: http://freeradius.1045715.n5.nabble.com/file/n5708187/freeradius_unix.png How should Freeradius know, that he need's to look at start_time and end_time field in this table, and let the user to log in just at this specific time slot? I know that I need to change this SQL statement: authorize_check_query = "SELECT id, username, attribute1, value, op1 \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" Thanks if you have a minute to help me figure this out. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Unix-TimeStamp-Based-Login-tp570818… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 27

Post-crash investigations
by Julien Cornuwel 16 May '12

16 May '12

Hi, I setup a cluster (Pacemaker) of two freeradius servers on CentOS 5.8 (freeradius 1.1.3). We use it for 802.1X: our switchs (HP Procurve) send it EAP challenges and it authenticates our users/hosts against an ActiveDirectory domain. It's been running smoothly for a month and stopped working this morning. We switched back to our old server but I want to know what happened before putting the cluster back in production. I'm currently trying to find out what happened but information is sparse: - From the cluster perspective, everything is fine. The daemon is running and no failover event occurred. - From samba, same thing. - In radius.log: nothing. There are client SSL certs errors but they have been there the whole time. - In auth-detail logfile: I can see all received requests. Before _and_ after the problem. However, it doesn't contain the reply :-/ - In detail logfile: Nothing after 7:56, time of the outage. So, I need pointers on two different issues: - I don't have enough information in logs. I realize that the recommended solution is to run the server in debug mode but I'm not sure I can store a month - or more - of such verbose logging. Any way to have more information, except the debug mode ? - I failed to check the whole authentication process both at the cluster level and at the monitoring level (nagios). Tools like NTradPing and check_radius_adv are of little help here because they can only check static accounts declared in radius configuration. They do not exercise the whole chain (Windows client > switch > radius server > ntlm_auth > AD). I tried replaying a successful authentication but it failed (Access-Denied). Any way to perform a 'real' check ? Sorry for the long post and thanks for any idea/pointer you can give me. Regards,

5 8

Re: Specific User Trace and multiple radiusd instant
by 全球无线联盟 16 May '12

16 May '12

Hello everyone, We use below freeradius. It works well. The OS is Linux Enterprise 5.4. Thanks. freeradius2.x86_64 2.1.12-3.el5 installed freeradius2-krb5.x86_64 2.1.12-3.el5 installed freeradius2-ldap.x86_64 2.1.12-3.el5 installed freeradius2-mysql.x86_64 2.1.12-3.el5 installed freeradius2-perl.x86_64 2.1.12-3.el5 installed freeradius2-postgresql.x86_64 2.1.12-3.el5 installed freeradius2-python.x86_64 2.1.12-3.el5 installed freeradius2-unixODBC.x86_64 2.1.12-3.el5 installed freeradius2-utils.x86_64 2.1.12-3.el5 installed We got below two questions recently. 1. We know 'radiusd -X' will run the radius in debuge mode. With large amount user request, the debug information will be massive. It will be difficult to read one specific user authentication process. Can anyone advise how to debug a specific user's access process? 2. We tried to run multiple radiusd at same server while the second failed. Can anyone advise how to configure the server to run multiple radiusd simultaneously？ Thanks! Tom

5 7