- Freeradius-Users - lists.freeradius.org

2 Certs for 2 SSID (802.1x)
by C.F. Yeung 21 May '12

21 May '12

We have 2 SSL Certs for two SSID (802.1x). How can my freeradius server present wifi clients the cert based on SSID? Should I have two eap.conf? Thanks, CF

4 10

Using attibutes
by Emmanuel BILLOT 21 May '12

21 May '12

Hi, Our WIFI access is managed by EAP-TTLS/EAP-PEAP with radius authentication based on LDAP. So users can connect and use Internet, however is possible to limit access (bandwith, connecting time) with Freeradius ? In other words, it seems (maybe i'm wrong) that Freeradius can send attribut with values when answering with Access Accept packet. I guess that clients have to understand it for being effective right ? So when using access point with EAP protocol, i guess native EAP client have to be compatibe with an attribut list ? This behaviour seems to be implemented in captive portal, and attributes can be managed in portal configuration. Is it possible with EAP access (native client or secure w2 like ?) BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 4

Re: PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Bruce Nunn 19 May '12

19 May '12

For my installations I've disabled the EAP cache to make things work better. Only a few users noticed. Does anyone know if the same thing happens In the 3.0 branch? I was planning to put one of my production servers on the 3.0 code this Summer. Alan DeKok <aland(a)deployingradius.com> wrote: >Phil Mayers wrote: >> Am I being dumb / getting something wrong or does the post-auth session >> not get called if PEAP/MSCHAP returns a reject? >> >> It seems to run for successful auths, but not failures. > > That is the case. > >> This is in the context of us not seeing log messages for EAP auth >> failures; I suspect that the client may just "hang up" and let the EAP >> session expire, and since the inner post-auth doesn't run, and the outer >> session expires, I have no logs. > > There was talk about getting it to do Post-Auth-Type Reject in the >inner tunnel. No code yet, tho. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

FreeRadius proxy to MS-NPS for MSCHAPv2 authentication.
by Jan Hugo Prins 19 May '12

19 May '12

Hi, This last week I have been setting up my Aruba environment authenticating users that are in OpenLDAP and all have a Windows Password etc. This installation worked straight out of the box and the part that took most of the time was making a clean setup that I can copy paste to other installations etc and getting to know unlang. So far so good. Now the next question is our partner that is a full M$ shop. They have a Windows ADS environment and all windows users. My first idea was to use proxy.conf to proxy all users with a username of user(a)domain.com to the MS-NPS server on the Windows ADS. Is this going to work with MSCHAPv2 authentication? I would expect so. If this is going to work my next problem is adding some things to access-accept replies. I need to add: Aruba-User-Vlan = <vlanid> Aruba-User-Role = <authenticated-role> The first one is to set the proper VLAN and the second one is to move the user to an authenticated role of this M$-Shop. Can this be done somewhere in the proxy.conf on the proxy-reply? I really don't want to install Samba on the FreeRadius server and make it authenticate to the ADS, this is because it doesn't scale on the long run if you need to authenticate to more then one ADS environment. I also read that their are some issues with the radius packets that are accepted by the MS-NPS server, with the risk that the packets are dropped at the MS-NPS side. Does someone have a overview of what should be in the radius packets and what should not be in them? Thanks a lot, Jan Hugo Prins

3 5

PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Phil Mayers 19 May '12

19 May '12

Am I being dumb / getting something wrong or does the post-auth session not get called if PEAP/MSCHAP returns a reject? It seems to run for successful auths, but not failures. This is in the context of us not seeing log messages for EAP auth failures; I suspect that the client may just "hang up" and let the EAP session expire, and since the inner post-auth doesn't run, and the outer session expires, I have no logs. This is in 2.1.12

3 3

Online Users
by Shawky Skaff 18 May '12

18 May '12

Hi, When viewing the online users and I wish to drop or clear the connection, nothing actually happens. Is there anything that I need to do to get this working? Maybe linking this to my NAS somehow, as if I clear the connection from my NAS, it seems to do the job Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

2 1

Quota in DCCA
by yagizozen 18 May '12

18 May '12

Hello everyone, I am using DCCA in one of the systems. And I know that DCCA grant a quata when a request comes from GGSN. For Example, when a access request come from GGSN, DCCA rejects it depending on the AVPs OR accept the request and sends a predefined QUOTA to the GGSN so that after the user finish that quota, it returns and asks for more quota. When I take a snoop between GGSN and DCCA, I see a grouped AVP called "Multiple Services Credit Control" and inside this grouped AVP, it contains the quota and other information that is send to GGSN with the accept packet. If I implement this grouped AVP to the radius Access-ACCEPT packet, does it work? The GGSN is the same. Also can you help me about creating a GROUPED AVP?? sending a user-defined AVP is easy but how can I group more than one AVPs? Thank you very much. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Quota-in-DCCA-tp5711335.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius unable to read password from LDAP query to win2008 AD
by sonyisda1 17 May '12

17 May '12

Using FreeRadius on Ubuntu 12.04 FreeRadius is communicating with Windows 2008 R2 Active Directory server. I have MS-CHAP authentication working fine. This is used for VPN. I am setting up LDAP authorization and CHAP authentication. This will be used for router login. The router has the radius configuration pointing to FreeRadius box. >From the logs, the LDAP authorization appears to bind correctly but is unable to retrieve a clear password for the user account and thus user cannot be authenticated with CHAP. [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? I believe above indicates that no data is received from LDAP query and no password is retrieved. I have attached relevant debug log output and config files. http://freeradius.1045715.n5.nabble.com/file/n5711532/freeradius_-_x.txt freeradius_-_x.txt output from running freeradius server in debug mode http://freeradius.1045715.n5.nabble.com/file/n5711532/router_connection_att… router_connection_attempt.txt output from connection attempt for router http://freeradius.1045715.n5.nabble.com/file/n5711532/default.txt default.txt /etc/freeradius/sites-available/default http://freeradius.1045715.n5.nabble.com/file/n5711532/inner-tunnel.txt inner-tunnel.txt /etc/freeradius/sites-available/inner-tunnel http://freeradius.1045715.n5.nabble.com/file/n5711532/ldap.txt ldap.txt /etc/freeradius/modules/ldap -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-unable-to-read-password-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Backup and restore FR
by yagizozen 17 May '12

17 May '12

Hello everyone, It can be a little weird to ask this question, if it is I am sorry but is there any way to clone the FR application with everything related to another machine with same OS? If I am using FR on my centos and I want to install FR to another centos with the exactly same configs. Instead of installing FR and coping the configs one by one, is there any way to directly get a backup of FR in my main machine and restore it on the other machine? Also in case of any disaster scenarios, I can simple restore a previously backuped FR with efficient way in a little time. Any suggestions? Thank you -- View this message in context: http://freeradius.1045715.n5.nabble.com/Backup-and-restore-FR-tp5710672.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Conditionally passing custom attributes
by Jeremy Guthrie 17 May '12

17 May '12

Alan, I have asked Chad to ask out here. I have a stringent business requirement to live within a patch channel that is being maintained by SuSE. So while yes, we could compile the latest and greatest, I have to balance that that against the workload and management of a pile of other packages. Relying on the SuSE patch channel solves a ton of issues for me as it relates to effort, tracking security vulnerabilities, and compliance which all roll into cost. I've got hundreds of RADIUS servers out in the field and we rely on it heavily. We're very happy with freeradius. It works very well however we have just found a product that is having some issues we'd like to get to the root of. If it comes down to the release that SuSE's package of it isn't a good one, then we'd talk about internally upgrading freeradius or doing something else with the product we are trying to manage. At this point we have got this one product we need to see if we can get working. If you are looking for more information or other things you'd ask we do before posting to the list, we'd be happy to comply but I cannot afford self-packaging freeradius at this point. :( >Alan DeKok wrote: > > No, you're not. You can upgrade. The server comes with files that >lets you build a Suse RPM. > > There is *no technical reason* why you can't upgrade. The only >reasons are politics, and personal choice. > Alan DeKok. >Chad Lensert wrote: >> This is the version that is supplied with SuSE and needs to be >> managed via their patch channel, so I am required to use this version. -- *Jeremy Guthrie* Technical Architect - Orchestration | *CDW* 5520 Research Park | Madison, WI 53711 Phone: 608.298.1061 | Fax: 608.288.3007 | NOC: 608.298.1102 | Toll Free: 866.202.1807

2 1