- Freeradius-Users - lists.freeradius.org

realm rewrite or alias?
by Beau Sapach 03 May '12

03 May '12

Hello everyone, I've got FreeRADIUS running to proxy requests from a wireless controller to a domain controller (NPS). The realm name is being passed to NPS as the logon domain, which is fine but I'd like to catch a number of different possible realms that users may put into the login and 'rewrite' them to the proper domain name so that the domain controller doesn't reject the login and we get fewer helpdesk calls. After looking through the config files an doing a bit of searching online I still haven't found a way to do that, is it possible? Beau

2 1

sending mail mechanism of radwatch
by 魏景鹏 03 May '12

03 May '12

2 1

Multi-valued LDAP attribute
by Adam Track 02 May '12

02 May '12

Hi All, In a continuation to my previous issue about how to reference an LDAP attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned: ... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" ... The perl module currently has the following code because I can't seem to be able to get any result other than the first, ie "employee", and I really need the other two (possibly more) to do a proper VLAN assignment: while (($att,$val) = each(%RAD_REPLY)){ if ($att =~ 'Person-Type'){ $count++; if ($count == 1){ $one = $val; } else { $two = $val; } } } $RAD_REPLY{'Reply-Message'} = "Total: $count, first: $one, second: $two."; The results are: ... Reply-Message = "Total: 1, first: employee, second: ." ... I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}? If not, where are the other values being stored? I read from the archives that this can be done with 3.X and foreach using unlang, but I'm stuck with 2.1.10 at the moment. Or, do multi-valued attributes need to be defined another way? Thanks, A.

2 5

Re: Very huge Acct-Session-Time
by Alan Buxey 02 May '12

02 May '12

That acct-session-time is just a Unix timestamp. As already said, either the NAS has bugs, in which case, check if it has any available firmware updates, or its incorrectly configured...or replace it, or write lots of funky scripts or sql procedures to handle it. alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

Using rlm_caching: rejects on cached requests
by Jeroen Scheerder 01 May '12

01 May '12

Hi, We have a SSL-VPN client that authenticates in two stages. When using authentication with RSA OTP tokens, the second request is considered to be a replay by the RSA server, and denied for that reason. The authentication itself is handled by proxy through a Freeradius server (2.1.12 with experimental modules). What I'd like to acomplish is: - Cache authentication requests - Uncached or expired requests are passed on to the proxy - Cached authentication requests are handled (within the specified TTL) I've set up caching, and I see some of it working. From the debug output, I see this for the first request: ---- Snip ---- +- entering group authorize {...} [preprocess] expand: %{User-Name} -> js [preprocess] hints: Matched DEFAULT at 80 [preprocess] expand: on2it-%{User-Name}(a)rsa.on2it.net -> on2it-js(a)rsa.on2it.net ++[preprocess] returns ok [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: Searching the database for key 'on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: Could not find the requested key in the database. rlm_caching: Cache Queries: 4, Cache Hits: 0, Hit Ratio: 0.00% […] [then we see the proxy request being handled, successfully] […] +- entering group post-auth {...} ++[exec] returns noop rlm_caching: Found Auth-Type, value: '' [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: VP=Class,VALUE=default_group,length=38,cache record length=39, space left=711 rlm_caching: Storing cache for Key='on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: New value stored successfully. ++[caching] returns ok Sending Access-Accept of id 69 to 127.0.0.1 port 18782 Class = 0x64656661756c745f67726f757000 ---- pinS ---- This all seems more or less plausible, except for "Found Auth-Type, value: ''" For the second request (fired within a few seconds), I see: ---- Snip ---- Executing section authorize from file /root/etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{User-Name} -> js [preprocess] hints: Matched DEFAULT at 80 [preprocess] expand: on2it-%{User-Name}(a)rsa.on2it.net -> on2it-js(a)rsa.on2it.net ++[preprocess] returns ok [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: Searching the database for key 'on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: Key Found. rlm_caching: VP='Class',VALUE='default_group',lenth='14',cache record length='39' rlm_caching: Adding Auth-Type '' rlm_caching: Cache Queries: 5, Cache Hits: 1, Hit Ratio: 20.00% ++[caching] returns ok Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject ---- pinS ---- So I'm getting a Reject for a cached Accept, in effect, and that seems to be due to the Auth-Type. This happens equally for non-proxied requests, i.e. with the following entry in "users": testing Cleartext-Password := "password" User-Name = "%{User-Name}", NAS-IP-Address = "%{NAS-IP-Address}" What am I missing, and what can I do to get cached authentication requests handled? TIA, JS. -- Jeroen Scheerder ON2IT B.V. Steenweg 17 B 4181 AJ WAARDENBURG T: +31 418-653818 | F: +31 418-653716 W: www.on2it.net | E: Jeroen.Scheerder(a)on2it.net Premier Business Partner - IBM | Reseller of the Year 2011 - Palo Alto Networks

3 8

RE2: Log-rotation FeeBSD 8.2
by newuse＠qip.ru 30 Apr '12

30 Apr '12

> You need to HUP the server to get it to re-open the logs. This is > normal daemon behavior. > > Alan DeKok. Thanks, but why I can clean logs via echo command without restart? Could the same behavior be implemented to auto-rotation of FR2 logs?

2 1

Log-rotation FeeBSD 8.2
by newuse＠qip.ru 30 Apr '12

30 Apr '12

Hi all, something strange: I am trying to setup newsyslog to rotate logs of FreeRADIUS 2.1.11 my setup string is looking like [code] /var/log/radius.log freeradius:freeradius 644 7 5 * Z [/code] but after rotation no logs are writing to /var/log/radius.log until restarting freeradius But if I just run echo "" > /var/log/radius.log all logs are clean and writing well What am I doing wrong? -- Best regards, NewUse.

4 4

Restart service of Radius
by Sharad P 30 Apr '12

30 Apr '12

After the changes are made in config files (user.conf), Radius server needs to be restarted. Is there any way that Radius server will fetch the changed configurations without restarting the Radius server? Thanks, Sharad Panicker. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Restart-service-of-Radius-tp5675936… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Maximum limit for clients.
by Sharad P 30 Apr '12

30 Apr '12

Hi, I have been using Radius server downloaded from freeradius.net website from quite a long time. For creating user id and password required for my clients to authenticate with my radius server, I usually configure user id and password using following command in user.conf file present in radius server. <user id> Cleartext-Password := "<password>" My queries are listed below. 1. I wanted to know whether, there is any limit for such configurations? How many user id's and password can be added to the file? 2. If we want to increase the limit, then what are the available options? 3. What is the normal CPU and memory usage of device where Radius server is installed and running? And what is the usage when maximum clients try to authenticate with the Radius. Thanks in advance. Regards, Sharad Panicker. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Maximum-limit-for-clients-tp5675649… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Question: which 3rd party CA for EAP
by Uwe Kastens 30 Apr '12

30 Apr '12

Hi, We are trying to setup eap for different mobile devices. We don't need certificates for each user, we want to authorize againt the radius with username and password only. With self signed certificates its working if the mobile devices installs the root ca certifcate. We tried several 3rd party certificates: StartSSL, united ssl, godaddy, test certificates from thawte. Apple and windows clients are claiming, that the certificate is not trusted. Has anybody a working solution with 3rd party certificates and can tell us which certifcate could be used and what needs to be configured in eap.conf? Kind Regards Uwe

2 1