- Freeradius-Users - lists.freeradius.org

Prob web wiki.freeradius.org
by Torsten Lehmann 10 May '12

10 May '12

Hallo, http://wiki.freeradius.org/ (or faq) returns: Forbidden regards Torsten

8 11

FreeRadius as proxy with SoH support
by Tobias Berndes 10 May '12

10 May '12

Hello, how can i configure my freeradius server as a proxy to the master radius server in my network, but the freeradius server have to use SoH for Packetfence. Thank you! Tobi

2 1

FreeRadius 2.1.12: radclient without coa
by Treusch Thorsten 10 May '12

10 May '12

Hi there, we have FreeRadius 2.1.12 installed in our lab mostly for testing purpose of our nodes. Now we have started to evaluate CoA on FreeRadius for both scenarios: a) Receive CoA packets from Node b) Send CoA-Requests to node (and analyze CoA-Ack, CoA-Nack Reading through several pages i always found "radclient" with the option "coa" to send/initiate CoA-Packets. And some of my colleagues (development) also use radclient for this purpose. BUT if i look at our radclient (v2.1.12) the coa option is missing there ? Last login: Sat May 5 15:17:27 2012 from dhcp-10-61-100-168.cisco.com [freeradius@sca-radius ~]$ radclient Usage: radclient [options] server[:port] <command> [<secret>] <command> One of auth, acct, status, or disconnect. Is it possible that this coa option was removed with v2.1.12 (or earlier) ? If yes, is there an alternative to send CoA packets from FreeRadius server ? I don't want to send CoA packets as a follow up to Access Request packet, but want to start it from FreeRadius. Many thanks for any helpful feedback, Thorsten

4 4

Minor update glitch in FR 2.1.12 rpm (CentOS/RH)
by up＠3.am 09 May '12

09 May '12

Just an FYI (sorry if this has already been covered): If you update FR via yum in CentOS or RedHat, as is usual practice with RPMs, conf files that have been modified are not overwritten, so the new version is installed with an ".rpmnew" suffix. This works great for most of the config files, but not the modules. For some reason, the .rpmnew module file is loaded instead of the original one: including configuration file /etc/raddb/modules/ldap.rpmnew The original module is there, but not loaded at run time...perhaps because it sees the .rpmnew one first? Fixing it is trivial, of course, once you see what the problem is, but I thought perhaps the rpm maintainers or FR developers might want to be made aware of it.

2 1

Accessing attribute in control list
by Mike 09 May '12

09 May '12

> > Hi guys, > > I am setting an attribute in the auth section of my config . I am able to access the attribute in the same section and preform unlang operations on said attribute, however, i am unable to access the same from the pre-proxy section of my config. The attribute just expands as blank. > > Is this a limitation of the software or is there a way I can access this attribute set in one section from another? > > Small background, originally i wanted to use ldap-group for group checking which turns out not to be possible due to the clients ldap not being configured correctly for groups, they are unwilling to change. So i want to be able to check against a different attribute set manually. > > An example would be appreciated if it is possible. > > > >

2 2

mySQL user wifi authentication error on freeradius
by xadow20 09 May '12

09 May '12

Hi! I'm new to freeradius. My Setup is: Ubuntu Server 10.04 Freeradius 2.1.8 daloRADIUS 0.9-9 When I try to authenticate on AP wireless with a user on /etc/freeradius/users it succedd well. But When I create a user on daloradius it gives the output above, can anyone tell me what i'm doing wrong? Thanks [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - user [peap] Got tunneled request EAP-Message = 0x02070008016e736f server { PEAP: Got tunneled identity of user PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x02070008016e736f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> u -- View this message in context: http://freeradius.1045715.n5.nabble.com/mySQL-user-wifi-authentication-erro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 13

Synchronous + Asynchronous proxying
by mimir 09 May '12

09 May '12

Hello, According to proxy.conf asynchronous configuration is disabled. I want to manage the realms by setting parameter synchronous or asynchronous, means that switch the configuration each other. Asynchronous is needed to queue the accounting packages, retransmission etc. Do you have any comment on this? # In 2.0, the server is always "synchronous", and setting # "synchronous = no" is impossible. This simplifies the # server and increases the stability of the network. # However, it means that the server (i.e. proxy) NEVER # originates packets. It proxies packets ONLY when it receives # a packet or a re-transmission from the NAS. If the NAS never # re-transmits, the proxy never re-transmits, either. This can # affect fail-over, where a packet does *not* fail over to a # second home server.. because the NAS never retransmits the # packet. # # If you need to set "synchronous = no", please send a # message to the list <freeradius-users(a)lists.freeradius.org> # explaining why this feature is vital for your network. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Synchronous-Asynchronous-proxying-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

SNMP capabilities
by mimir 09 May '12

09 May '12

Hello, According to the document, freeradius supports SNMP and can send snmp trap. But, when I check the MIBs, I could not find event based definitions. According to my scenario, I want to send trap, For example 1-) When one of fail-server is dead ( with clear live also) 2-) When one of accounting packet which is proxied to another radius, and we can not get accounting response (with clear) 3-) via unlang and sql or ldap xlat, if query result is null. Is it possible? I appriceate if you refer any document. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/SNMP-capabilities-tp5697299.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Session-Timeout Monitoring from db.daily
by yagizozen 09 May '12

09 May '12

Hello guys, I am using counter module as follows: counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout cache-size = 5000 } All the information of the users that connect and dc, is stored in the db.daily file I suppose. But I can not open the file with notepad and see which user had how many seconds of active sessions. I configured a user to use 1 hour per day. The user used 20 min of his 1 hour limit. Now where can I see that users remaining time to spent during that day?? I am not using regular accounting tables of the FR. I suppose that information is located that db.daily file but I can not see inside of it. Can you help me? Thank you very much -- View this message in context: http://freeradius.1045715.n5.nabble.com/Session-Timeout-Monitoring-from-db-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 11

unlang fails for some strange reason...
by Stefan Winter 09 May '12

09 May '12

Hi, at a client's site, I have to some chopping off parts of User-Name, pretty straightforward, but for some reason it doesn't work (2.1.12): In inner-tunnel, authenticate, MSCHAPv2 for PEAP: authenticate { Auth-Type MS-CHAP { if("%{Stripped-User-Name}" =~ /(....................).*/){ update request { SAMAccountName := "%{1}" } } else { update request { SAMAccountName := "%{Stripped-User-Name}" } } mschap } So, if the Stripped-User-Name is longer than 20 chars, chop it off and store it in SAMAccountName, otherwise, just store the full Stripped-User-Name in SAMAccountName. SAMAccountName is defined in the dictionary as an internal attribute: ATTRIBUTE SAMAccountName 3003 string During run-time, the following strange thing happens... # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ("%{Stripped-User-Name}" =~ /(....................).*/) [mschapv2] expand: %{Stripped-User-Name} -> christian.test [mschapv2] ? Evaluating ("%{Stripped-User-Name}" =~ /(....................).*/) -> FALSE [mschapv2] ++? if ("%{Stripped-User-Name}" =~ /(....................).*/) -> FALSE [mschapv2] ++- entering else else {...} [mschapv2] expand: %{Stripped-User-Name} -> christian.test [mschapv2] +++[request] returns reject [mschapv2] ++- else else returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. So... short User-Name, the else path is taken, Stripped-User-Name expands nicely... and then, the "update request" group returns reject?!? I tried to use update control instead, which fails too, and used a non-internal attribute for that name as well. It just won't work. Is that maybe one of the known quirks in 2.1.12? Would using the current stable branch work better? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 5