- Freeradius-Users - lists.freeradius.org

Active Directory with Radius Accounting
by McSparin, Joe 03 Jan '12

03 Jan '12

I have setup FreeRadius to work with Active Directory for User name Authentication. My next step is going to be to start authenticating the MAC address as well. I have setup my sql database and created the required schema. I have uncommented the lines in radiusd.conf and sql.conf and sites-available/default.conf to start doing radius accounting. My access point is pointing the radius server for accounting. Would it be the acme of foolishness on my part to assume that is all I need to do for my radius server to start logging the information from my connecting clients? Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3

Multiple values for reply attributes in radreply
by Christian Thomas 03 Jan '12

03 Jan '12

Hello, I am trying to send back the same attribute in radreply and /or radgroupreply with different values to the NAS example : NAS send a Auth Request. Freeradius accept the request and send back attributes in radreply (or radgroupreply) (via sql table) Problem : sending back the same attributes with different values seems to not be possible. only the first attribute is sent back radreply table (id/username/attribute/op/value) content: 2 toto Cisco-AVPair = h323-ivr-in=Routing:192.168.1.10;expires=30;np_expires=40 3 toto Cisco-AVPair = h323-ivr-in=Routing:192.168.1.20;expires=30;np_expires=40 I tried also without cisco-avpair in the same radreply table: 4 toto h323-ivr-in = Routing:192.168.1.10;expires=30;np_expires=40 5 toto h323-ivr-in = Routing:192.168.1.20;expires=30;np_expires=40 Both case the received attributes on NAS side h323-ivr-in = Routing:192.168.1.10;expires=30;np_expires=40 Before these tests I tried simply the radtest tool for the same user and apparently Freeradius is sending back ONLY the oldest ID from the table radreply and NOT all the IDs matched by the select request. Also tested using USERS file with the same replies : h323-ivr-in = Routing:192.168.1.10;expires=30;np_expires=40, h323-ivr-in = Routing:192.168.1.20;expires=30;np_expires=40, Fall-Through = Yes There is something to do in the configuration to fix /allow that? regards -- Christian Thomas Mobile +55 (48) 8446 3575 Landline +55 (48) 3717 5005 Paris +33 1 8197 9899 USA +1 303 997 3242

2 2

max lenght user name
by Alejandro Gándara 03 Jan '12

03 Jan '12

Hi list, Using radius 2.1.10 Im having problems with lengh of user names. How can i log a user with an username higher than 17. When a User called rchamadoira log into the system. I got error because the real chain is: User-Name = "OPTARE\\rchamadoi" How can i increase thath lenght. Thanks for all. Regards, Alejandro -- *Alejandro Gándara* | System Administrator T/ + 34 986 410 091 (ext) 210 www.optaresolutions.com <http://www.optaresolutions.com> Optare Solutions <http://optarecoolvendor.com>

3 5

pam_ldap and 802.1x environment
by Thorsten Scherf 03 Jan '12

03 Jan '12

Hey, this is a comprehension question. When I have a ldap directory to authenticate users with pam_ldap when they login to their local workstations, how can I secure network access with radius?! I mean, isn't that a chicken egg problem? How would I be able to talk to the ldap server before I sucessfully authenticated against Radius? For sure I do miss something, would be great if somebody could enlighten me. :)

3 8

Radius with Java
by Jeisson Fabian Perez Rodriguez 03 Jan '12

03 Jan '12

Hi, again, I've been trying to connect FreeRadius with an application on Java, but I don't find the correct way. Could somebody tell me something about it?, please!

5 6

FreeRADIUS & Hotspot
by hemant 02 Jan '12

02 Jan '12

Hello Guys, I have Installed Freeradius2 with MYSQL and WEBMIN as DaloRadius. I want to setup the FreeRADIUS for the Login Access To the Mikrotik Routers. I am also Setting up the FreeRADIUS for the HOTSPOT Users-authentication,accounting. Right now i have added a client with /24 network and shared-secret, and created profiles on the daloRADIUS by using the Mikrotik Attributes, I can have READ/FULL/WRITE access to my routers. I am also using the REALMS for the Login & Hotspot Service Differentiations. I created two profiles with different realms as my router. i created users on these profiles one for login access and other only for hotspot access. But i have problem now that my HotSpot Users can also Login to My Router..???? Please help me here guys... I have to Submit the Project with detailed report in 5 days..And i am right now no where near to completing it..?? Please any one ..Reply ASAP ..:) -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-Hotspot-tp5114296p511429… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

LDAP - dynamic membership checking
by Christian Kölpin 01 Jan '12

01 Jan '12

Hello I'am stuck while testing with LDAP an Radius. I'am get Radius to work with user authorisation against LDAP and authentication against kerberos. Even if i set a "simple" membership checking in ./modules/ldap it works fine. My problem is, I have several NAS (Some APs, Switches, VPN-Servers). Depending on the NAS another group-Membership should be checked . For example a user with memberships in "wireless" and "office-vpn" should get access if the request comes from the APs or a specific VPN-Server. Can someone give me a hint, how to setup such a szenario? greetings Raptor 2101

2 2

How to configure redundant radius?
by Christ Schlacta 30 Dec '11

30 Dec '11

I've got a number of devices all of which only have the option for one radius IP address (not hostname!) to be configured. How can I configure this type of device for failover (and optionally balance)? is there some PROPER way to do this? or am I limited to only being able to have one fr server configured for these particular devices?

3 4

Proxy Radius - Deny user based on username preproxy
by Nathan M 30 Dec '11

30 Dec '11

To any freeradius guru, I operate a proxy radius server which proxies requests downstream. A few particular usernames are repeating far more frequently than they should and I have no way to eliminate this upstream. I do need to authenticate the users though and not deny them. The goal would be to authenticate them at the proxy level so it does not send the request downstream at all. Ideally an entry something to the tune of: userx Cleartext-Password := "xxx" Session-Timeout = 604800, Idle-Timeout = 604800, Acct-Interim-Interval = 4084, Fall-Through = No I've reviewed and done dozens of attempts using the preproxy_users, and users file (by trying with files above and below the suffix line in authorize{}); however, none of my attempts have been successful. The lines match when viewing debug; however, by entering anything other than Auth-Type := Reject within the users file, the authentication proceeds on it's merry way to the proxy process downstream. Any advice on a config which will accomplish this? Thanks, N

2 1

Rlm_ippool provides invalid IP
by Arlindo F. Neto 30 Dec '11

30 Dec '11

Hi, When I use a range of addresses greater than one network /24, the ippool provides IP to the client with zero end (eg 192.168.10.0). The IP Pool configuration on radiusd.conf ippool pool1 { range-start = xxx.xxx.36.1 range-stop = xxx.xxx.39.152 netmask = 255.255.255.255 cache-size = 922 session-db = ${raddbdir}/ippool/db.pool1 ip-index = ${raddbdir}/ippool/db.pool1index override = no maximum-timeout = 30 } Nesta configuração, frequentemente o freeradius fornece endereços IPs inválidos, exemplo: xxx.xxx.37.0 xxx.xxx.38.0 xxx.xxx.39.0 Is there any configuration to be done to solve this problem? Regards,

3 4