- Freeradius-Users - lists.freeradius.org

RE: Welcome to the "Freeradius-Users" mailing list
by Javier Ruiz Escalante 26 Feb '12

26 Feb '12

Hello, I'm new in Freeradius and I get the same message, although I want to get the data from a Mysql Data base, can someone help me? I don't even know if radius makes the query, can I find out if the sql query has been performed? Below is the debug file: rad_recv: Access-Request packet from host 127.0.0.1 port 48102, id=67, length=61 User-Name = "mysqltest" User-Password = "testsecret" NAS-IP-Address = 192.168.182.1 NAS-Port = 0 Sun Feb 26 21:26:04 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sun Feb 26 21:26:04 2012 : Info: +- entering group authorize {...} Sun Feb 26 21:26:04 2012 : Info: ++[preprocess] returns ok Sun Feb 26 21:26:04 2012 : Info: ++[chap] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[mschap] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[digest] returns noop Sun Feb 26 21:26:04 2012 : Info: [suffix] No '@' in User-Name = "mysqltest", looking up realm NULL Sun Feb 26 21:26:04 2012 : Info: [suffix] No such realm "NULL" Sun Feb 26 21:26:04 2012 : Info: ++[suffix] returns noop Sun Feb 26 21:26:04 2012 : Info: [eap] No EAP-Message, not doing EAP Sun Feb 26 21:26:04 2012 : Info: ++[eap] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[files] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[expiration] returns noop Sun Feb 26 21:26:04 2012 : Info: ++[logintime] returns noop Sun Feb 26 21:26:04 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sun Feb 26 21:26:04 2012 : Info: ++[pap] returns noop Sun Feb 26 21:26:04 2012 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Sun Feb 26 21:26:04 2012 : Info: Failed to authenticate the user. Sun Feb 26 21:26:04 2012 : Info: Using Post-Auth-Type Reject Sun Feb 26 21:26:04 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sun Feb 26 21:26:04 2012 : Info: +- entering group REJECT {...} Sun Feb 26 21:26:04 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> mysqltest Sun Feb 26 21:26:04 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sun Feb 26 21:26:04 2012 : Info: ++[attr_filter.access_reject] returns updated Sun Feb 26 21:26:04 2012 : Info: Delaying reject of request 0 for 1 seconds Sun Feb 26 21:26:04 2012 : Debug: Going to the next request Sun Feb 26 21:26:04 2012 : Debug: Waking up in 0.9 seconds. Sun Feb 26 21:26:05 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 67 to 127.0.0.1 port 48102 Sun Feb 26 21:26:05 2012 : Debug: Waking up in 4.9 seconds. Sun Feb 26 21:26:10 2012 : Info: Cleaning up request 0 ID 67 with timestamp +3 Sun Feb 26 21:26:10 2012 : Info: Ready to process requests. Thank you very much in advane. ;-)) -----Original Message----- From: freeradius-users-bounces+fruiz002=hotmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+fruiz002=hotmail.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: domingo, 26 de febrero de 2012 21:28 To: fruiz002(a)hotmail.com Subject: Welcome to the "Freeradius-Users" mailing list Welcome to the Freeradius-Users(a)lists.freeradius.org mailing list! To post to this list, send your email to: freeradius-users(a)lists.freeradius.org General information about the mailing list is at: http://lists.freeradius.org/mailman/listinfo/freeradius-users If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: http://lists.freeradius.org/mailman/options/freeradius-users/fruiz002%40hotm ail.com You can also make such adjustments via email by sending a message to: Freeradius-Users-request(a)lists.freeradius.org with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: 11071107 Normally, Mailman will remind you of your lists.freeradius.org mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you.

2 1

Oauth2 Google?
by Jesse Crayston 25 Feb '12

25 Feb '12

Hello, I'm wondering if I could get help, or find documentation(even just a draft) on setting up Oauth2 on a freeradius server(omniauth?). I'm looking to use my google apps domain user database, to manage users, and control access through an Untangle captive portal, which is already setup(then probably drop the portal and do EAP, though I'll play to see if I can start with EAP). Also if I'm on the completely wrong/old track, I'm no too worried about changing the plan now. Thanks for the time/sorry for not lurking more before posting, Jesse

2 3

Simultaneous-Use checking
by opti2k4 25 Feb '12

25 Feb '12

Hi, i need little help with this. I have MySQL setup with freeradis, that is working. Now for Simultaneous-Use checking there are no querys to uncomment inside sql.conf by default (installed freeradius over apt-get ). Now i added to sql.conf simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Group checking is disabled. What else i have to do to get this checking started? Thx! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Simultaneous-Use-checking-tp5514541… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

adding radius accounts
by Dom 25 Feb '12

25 Feb '12

Is there a tool/addon to add and remove radius accounts in the users file without modify the file directly. Also can the users file be configured to authenticate based on linux users already existing. Thanks

2 1

Authentication by group and time.
by Listas Angelo 24 Feb '12

24 Feb '12

Freeradius Dear users, good afternoon! I have a radius server using a mysql database authentication by performing login and mac address working very well. Now I need to implement a new plan of authentication where some users can only connect at a certain time of day (eg Monday to Friday from 18:00 to 22:00 pm and throughout the weekend). Looking for something in the documentation found on the "Login-Time" Freeradius but found nothing of how to deploy this in my current configuration structure. Has anyone made this and could give me some idea of how to do? Thank you! Angelo

2 3

Re: Configuring freeradius for MACsec
by Alan Buxey 24 Feb '12

24 Feb '12

Iirc, Cisco macsec/trustsec is implemented with EAP-FASTv2 . Their cute way of tying you into Cisco ACS 5 or ISE alan

2 1

freeradius eap-ttls user/pass + cert
by grub3r 23 Feb '12

23 Feb '12

Hi All, Firstly I wanted to thank freeradius-devs for the tremendous job they are doing. And to the question itself: I had been planning to configure freeradius to be able to authenticate users by username/password from users-file. 1. I followed the readme-file under certs and made ca, server and client certificates MARK: README states that one has to delete index.txt and serial files, but these are needed when creating new certificates, and have to be recreated prior to generating new certificates!? 2. configured ttls/server cert password in eap.conf and everything worked fine. Then I read somewhere that username/password authentication alone is not secure as some information is passed in clear text?! So I decided to add extra protection by using certificates in addition to username/password. That's where problems started. I added "EAP-TLS-Require-Client-Cert = Yes" in "authorize-section" the default-site in sites-enabled. (I also tried to add it to users-file, which didn't work, what does work is DEFAULT EAP-TLS-Require-Client-Cert := Yes) using Fedora 16 as client, I now had to use certificate, I added earlier created client.pem, but server fails to authenticate with message "unknown ca cert", I also tried to use ca.pem, but with negative result. What could the problem be? Please don't reject the question by saying that everything is documented or at least point to the right document. I'll gladly post any config-files/logs on request. regards, Dan. -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-eap-ttls-user-pass-cert-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Re: Configuring freeradius for MACsec
by Matija Levec 23 Feb '12

23 Feb '12

Frankly I have no idea. If I understand correctly EAP-Key-Name / MSK value should be generated somewhere along EAP process when using EAP-TLS or PEAP... I'm also aware that there are very few radius servers that already support that. I was only hoping that FR is one of them. ;) Kind regards, Matija Levec >>> Phil Mayers 02/23/12 6:48 PM >>> On 23/02/12 16:26, Matija Levec wrote: > > What should be configured for radius to also send EAP-Key-Name AVP? AFAIK that is not implemented yet. I've only skimmed them, but AFAIK most AAA servers and EAP methods don't generate EAP-Key-Name yet. I'm not sure what the correct value for this attribute would even *be*. Do you know? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Setting Reply Attributes Based on Time of Day?
by Palmer J.D.F. 23 Feb '12

23 Feb '12

Hello, Is there a function within FR to schedule certain attributes to be returned in the Access-Accept reply? Essentially we return a QoS VSA along with VLAN information on a successful auth, however between certain times of day there is more available bandwidth so to be kind to our users we'd like to return a different QoS level to during these bandwidth abundant periods. Does such a mechanism exist? Many thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP J.D.F.Palmer(a)swan.ac.uk

2 2

RadSec FR3.0 to Radiator: "Received packet will be too large"
by Brian Julin 23 Feb '12

23 Feb '12

Hello again, We're piloting RadSec as a federation server uplink. They use Radiator. When we first attempted to connect we'd get a "Received packet will be too large!" carp from main/tls.c. They checked on their end and say they have no fragment size option for RadSec TLS connections, only for EAP-TLS connections. So we applied the below as a test and it works, but I was wondering as to the wisdom of it... diff --git a/src/main/tls.c b/src/main/tls.c index 10caec4..947409f 100644 --- a/src/main/tls.c +++ b/src/main/tls.c @@ -2709,7 +2709,7 @@ int proxy_tls_recv(rad_listen_t *listener) size_t length; listen_socket_t *sock = listener->data; char buffer[256]; - uint8_t data[1024]; + uint8_t data[2048]; RADIUS_PACKET *packet; RAD_REQUEST_FUNP fun = NULL;

4 8