- Freeradius-Users - lists.freeradius.org

FreeRADIUS 2.1.12 as DHCPd with both static and dynamic IP-MAC accociations via
by newuse＠qip.ru 10 Mar '12

10 Mar '12

Hi all, Again a questions about FR2 as DHCP server with SQL: Is it possible to setup FR as&nbsp; DHCPd on FreeBSD to a given interface or it's IP? Could I use rlm_sqlpool to store MAC-IP associations? I am trying to use an old dial-up&nbsp; module (FreeNIBS) for my WiFi network, all seems to be OK,&nbsp; but there is no DHCP,

2 2

Re: Max-Daily-Session - User session termination
by Alan Buxey 09 Mar '12

09 Mar '12

Set session timer to one hour. Or adjust reauth times on the Cisco alan

3 2

adding additional attribute to dictionary.3pgg2
by lamerson 09 Mar '12

09 Mar '12

Good day folks ! I've installed latest(2.1.12) freeradius. I need to pass '3GPP2-Max-Authorized-Aggr-Bandwidth' and '3GPP2-Inter-User-Priority' attributes in Access-Accept message from AAA to NAS. The default dictionary.3gpp2 that comes with the instalation doesn't have them. So i found and added to config wireshark's updated [wireshark] 2009-07-08 - FreeRadius 2.6.1 dictionary.3gpp2 updated from the 3GPP2 X.S0011-005-D v2.0 spec , wich has needed attributes. but unfortunately debug tells me: rlm_sql: Failed to create the pair: Unknown attribute "Inter-User-Priority" or rlm_sql: Failed to create the pair: Unknown attribute "3GPP2-Max-Authorized-Aggr-Bandwidth" Are there any additional actions i must take to make freeradius recognize additional attributes other than default ones ?? Appriciate, Mikhael. -- View this message in context: http://freeradius.1045715.n5.nabble.com/adding-additional-attribute-to-dict… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Tracing access request chain
by Morris, Andi 09 Mar '12

09 Mar '12

I'm trying to trace an access attempt that occurred today so that I can categorically say to a user that you were successfully connected to our network, or not, whatever the case maybe. However I'm struggling to create a chain of events by going through the logs. I can see by grepping the logs in the radacct folder that the user sent the access-request. The results are in both the auth-detail and the pre-proxy-detail logs. From there I can see in my internal radius servers that the access was accepted, but I cannot find any reference to the user, or the any of the incoming conversation in the outgoing logs like post-proxy, or reply. I was hoping I'd see a reference to the username and Access-Accept or similar. Can someone please help me out by letting me know if there is one common string that will help me trace one request incoming and outgoing? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o'r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

4 4

RE: freeradius + ntlm_auth, broken?
by Andres Septer 09 Mar '12

09 Mar '12

> Check the winbind log files, Did that already. Nothing interesting there, only lines like [2012/03/08 14:32:17.115991, 3] winbindd/winbindd_misc.c:417(winbindd_priv_pipe_dir) [25675]: request location of privileged pipe [2012/03/08 14:32:17.117136, 6] winbindd/winbindd.c:840(winbind_client_request_read) closing socket 26, client exited > and perhaps try using "strace -f -p <freerad.pid> -o log" to > watch process execution. I already did that to get the command line. When I run that line manually I get "login failed". T try to figure out how to capture actual ntlm_auth output from within freerad process. Also, where freeradd gets the values for parameters MS-CHAP-Challenge = 0xd50bd065d4215da9 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000001e7c77d05691cb2822a6670bf0b458e251c4ef170a2c2fff ? Those seem to be wrong. When I use them manually from command line I get "login failed" A.

3 2

How do I stop reading of detail file after a certain threshold is reached
by Vivek Mehrotra 08 Mar '12

08 Mar '12

Hello, We are using Freeradius2 with MySQL at the backend. I understand that the buffered sql takes care of buffering queries. What is the best way to stop querying MySQL altogether and return a negative response, after a certain threshold of processing is reached by the server? Thanks in advance.. vivek

3 6

rlm_perl, aaa, dialup admin
by Fabricio Flores 08 Mar '12

08 Mar '12

Hi... I have a lot of problems configuring freeRadius. First I have a web service and a perl client to obtain users and password from an external database. I used with rlm_perl with an script perl in the authetication func and it works... but i need to implement dialup admin (or daloradius) to account... but i read that dialup admin works with a mysql database.... so... what i need to use to works dialup admin? and what archives i need to edit (users, radiusd.conf, etc) to authentication with rlm_perl and authorize and accounting with mysql? -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

1 0

FreeRadius Logrotate settings for FreeBSD
by Selcuk Yazar 08 Mar '12

08 Mar '12

Hi, we are using FreeRADIUS Version 2.1.12 In FREEBSD v.9. our logrotate settings like below. /var/log/freeradius/radius.log { daily rotate 8 create missingok compress postrotate kill -HUP `cat /var/run/freeradius/freeradius.pid` endscript } after rotate log radius.log file remain 0 lenght what is correnct settings of postrotate section of freeradius ? thanks in advance. -- Selçuk YAZAR

3 2

freeradius + ntlm_auth, broken?
by Andres Septer 08 Mar '12

08 Mar '12

Hello I try to set up AD as freeradius authentication oracle. My system: ohv:/etc/raddb/modules # radiusd -v radiusd: FreeRADIUS Version 2.1.12, for host x86_64-suse-linux-gnu, built on Oct 19 2011 at 13:55 I followed this guidelines http://deployingradius.com/documents/configuration/active_directory.html and everything went great (user logons OK, all the tests decribed in howto went OK) until the last part MS-CHAP + ntlm_auth OK, what happens when I try to authenticate via MS-CHAP ohv:/etc/samba # radtest -t mschap freeradius.test passwordschmassword localhost 0 testing123 Sending Access-Request of id 11 to 127.0.0.1 port 1812 User-Name = "freeradius.test" NAS-IP-Address = 10.128.160.4 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x7c68b9721c3a0b46 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000013e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=11, length=38 MS-CHAP-Error = "\000E=691 R=1" Lets see freeradius log Thu Mar 8 13:42:03 2012 : Info: Found Auth-Type = MSCHAP Thu Mar 8 13:42:03 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Mar 8 13:42:03 2012 : Info: +- entering group MS-CHAP {...} Thu Mar 8 13:42:03 2012 : Info: [mschap] Told to do MS-CHAPv1 with NT-Password Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=freeradius.test Thu Mar 8 13:42:03 2012 : Info: [mschap] No NT-Domain was found in the User-Name. Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: %{mschap:NT-Domain} -> Thu Mar 8 13:42:03 2012 : Info: [mschap] ... expanding second conditional Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --domain=%{%{mschap:NT-Domain}:-LOCAL} -> --domain=LOCAL Thu Mar 8 13:42:03 2012 : Info: [mschap] mschap1: 7c Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=7c68b9721c3a0b46 Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a Thu Mar 8 13:42:03 2012 : Debug: Exec-Program output: Reading winbind reply failed! (0xc0000001) Thu Mar 8 13:42:03 2012 : Debug: Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Thu Mar 8 13:42:03 2012 : Debug: Exec-Program: returned: 1 Thu Mar 8 13:42:03 2012 : Info: [mschap] External script failed. Thu Mar 8 13:42:03 2012 : Info: [mschap] MS-CHAP-Response is incorrect. Thu Mar 8 13:42:03 2012 : Info: ++[mschap] returns reject OK, lets strace this and find the actual command line sent to freeradius and try it out on command line (edited to follow correct syntax!) Command line looks like this: /usr/bin/ntlm_auth "--request-nt-key", "--username=freeradius.test", "--domain=LOCAL", "--challenge=0x7c68b9721c3a0b46", "--nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a" Logon failure (0xc000006d) Wait, what? Let's re-check ntlm_auth --request-nt-key --domain=local --username=freeradius.test --password=passwordschmassword NT_STATUS_OK: Success (0x0) Seems that values for "challenge" and "response" are getting filled incorrectly. I also tried to turn with_ntdomain_hack aprameter on and off, but no avail. Is freeradius at all responsible to fill those parameters or how can I fix this behaviour? Andres Septer Systems Administrator Navirec Software OÜ Tallinn, Estonia http://navirec.com

2 1

High Avaibility
by Anto 08 Mar '12

08 Mar '12

Hello In the coming days I will set up a freeradius server for access control and accounting. I've been looking for information on freeradius and high availability, since my idea is to have two servers in case one fails, continue to operate with the other, but I just found information. So I turn to the list, in case I can recommend someone with experience on stage. I do not know if it is feasible to have a server as master and one slave, when the main falls, the other up the interface. If there is some kind of balancer radius and use both servers, etc.. Any ideas?. Thank you very much. Best regards Anto

5 5