- Freeradius-Users - lists.freeradius.org

EAP-TLS or EAP-TTLS
by Panagiotis Georgopoulos 07 Nov '11

07 Nov '11

Hello all, I have a policy in my post-auth that calculates a hash function based on the real-identify of the user. The idea is that if the request is EAP-TTLS then I want to use the User-Name property of the inner tunnel, whereas if the request is for EAP-TLS I want to use the BUF-Name (if I've got it correctly). How do I determine in my policy whether we are doing EAP-TLS or EAP-TTLS? Can anyone help with that 'if' I am looking for? Thanks a lot in advance, Panos

2 2

Build RPM
by Victor Guk 07 Nov '11

07 Nov '11

Hi, I want to install freeradius on RHEL5. I downloaded tar.bz2.(version 2.1.12) Run *rpmbuild -ba freeradius.spec*, but get an error: ......... ......... Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 ???????? ?? ?????????????(?) ????(?): /usr/lib/rpm/check-files /var/tmp/freeradius-2.1.12-1-root-root ??????: ?????????(?) ?????????????(?) (?? ?? ???????????(?)) ????(?): /usr/share/man/man1/smbencrypt.1.gz /usr/share/man/man5/checkrad.5.gz /usr/share/man/man8/radconf2xml.8.gz /usr/share/man/man8/radcrypt.8.gz /usr/share/man/man8/radsniff.8.gz /usr/share/man/man8/rlm_dbm_cat.8.gz /usr/share/man/man8/rlm_dbm_parse.8.gz ?????? ?????? ???????: ?????????(?) ?????????????(?) (?? ?? ???????????(?)) ????(?): /usr/share/man/man1/smbencrypt.1.gz /usr/share/man/man5/checkrad.5.gz /usr/share/man/man8/radconf2xml.8.gz /usr/share/man/man8/radcrypt.8.gz /usr/share/man/man8/radsniff.8.gz /usr/share/man/man8/rlm_dbm_cat.8.gz /usr/share/man/man8/rlm_dbm_parse.8.gz What am I doing wrong. What's the problem?

6 12

NAS in sql and returning specific VSAs
by Vincent, Fabien 07 Nov '11

07 Nov '11

Hi all, I have one question about Free Radius and NAS in sql database. I return to the NAS some VSAs depending LDAP User-Group like this : Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits Niveau 3 - Infrastructure & Produits <mailto:fabien.vincent@coreye.fr> fabien.vincent(a)coreye.fr coreye Parc de la Haute Borne 22, rue Hergé 59650 Villeneuve d'Ascq <http://www.pictime.com/> www.pictime.com

1 0

Referencing LDAP attributes in post-auth
by Adam Track 07 Nov '11

07 Nov '11

Hello, I'm sorry for asking such a simple(?) thing, but my lack of understanding is not due to a lack of reading, searching, trial-and-error... I just can't seem to figure out how to reference an ldap attribute in post-auth. Using freeradius 2.1.8, PEAPv0/EAP-MSCHAPv2 with AD for authentication and ldap for authorization works great. As an added functionality, I need to send to the NAS a few extra attributes based on an an ldap attribute "personType". I've added mapping for this attribute, and here's a snippet of the debug output from the authorize section of the virtual server: ... [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user tadam authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ... How do I reference this attribute in a perl script I call from post-auth? It's not in %RAD_REQUEST, %RAD_REPLY, or %RAD_CHECK... Actually, I can't even figure out how to call it from the post-auth section itself.. I've tried different things, but I'm thinking the following should work: update reply{ Reply-Message := "Type: %{reply:Person-Type}." } Yet, I get: ... +- entering group post-auth {...} expand: Type: %{reply:Person-Type}. -> Type: . ++[reply] returns noop ... Is there something else I need to do to make sure the values returned from the ldap module are saved for reference outside the authorization block? A.

4 4

ldap tls in freeradius
by Frank Skovboel 06 Nov '11

06 Nov '11

Hi, I'm trying to authorize users in different AD's (2003 and 2008), but I keep running into an error I can't find any thing on when I google it. For the purpose of the testing I have set the following in the ldap section: require_cert Freeradius tries to connect to the ldap server (2008), the connection fails and I get the following debug output. ============================ DEBUG ======================================= [ldap_CustA] performing user authorization for MyAccount [ldap_CustA] expand: (&(sAMAccountName=%{User-Name})) -> (&(sAMAccountName=MyAccount)) [ldap_CustA] expand: ou=OU1,ou=OU2,dc=domain,dc=local -> ou=OU1,ou=OU2,dc=domain,dc=local [ldap_CustA] ldap_get_conn: Checking Id: 0 [ldap_CustA] ldap_get_conn: Got Id: 0 [ldap_CustA] attempting LDAP reconnection [ldap_CustA] (re)connect to AD-IP-ADDRESS:636, authentication 0 [ldap_CustA] setting TLS mode to 1 [ldap_CustA] setting TLS CACert File to /etc/raddb/certs/ca.pem [ldap_CustA] setting TLS CACert Directory to /etc/raddb/certs/ [ldap_CustA] setting TLS Require Cert to never [ldap_CustA] setting TLS Cert File to /etc/raddb/certs/server.crt [ldap_CustA] setting TLS Key File to /etc/raddb/certs/server.key [ldap_CustA] setting TLS Key File to /etc/raddb/certs/random [ldap_CustA] bind as user(a)domain.local/PASSWORD to 193.47.81.75:636 TLS: could not add the certificate PEM Token #0:server.crt - 0 - error -8192:Unknown code ___f 0. TLS: error: could not initialize moznss security context - error -8192:Unknown code ___f 0 TLS: can't create ssl handle. =========================================================================== ======================= CONFIG SNIP ========================================= tls { start_tls = no cacertfile = /etc/raddb/certs/ca.pem cacertdir = /etc/raddb/certs/ certfile = /etc/raddb/certs/server.crt keyfile = /etc/raddb/certs/server.key randfile = /etc/raddb/certs/random require_cert = "never" } =========================================================================== I'm wondering why the random file is set as a TLS Key, and also what exactly is going wrong since I get the error for the PEM Token? Thank you for your help. -- Thanks for your help Frank

3 6

radiusd goes wrong
by Ivan Matala 05 Nov '11

05 Nov '11

rlm_sql (sql): Connected new DB handle, #79 Module: Instantiated sql (sql) Failed creating PID file /root/radiusd.pid: Permission denied pls help. tnx

5 11

Anybody can confirm this?
by tonimanel 04 Nov '11

04 Nov '11

Hi, I have two servers A and B configured. I have some doubts: I would like to get to copy accounting data (same set of information) from A to B. I have configured this and works fine (copy-acct-to-home-server & proxy.conf), BUT in radacct table of server B, the records have different acctstartime and different acctstoptime from server A. I know that this happens because server B catchs its time and records it (exists a delay - few seconds). In other post, suggest me modify sql queries to get this (I should catch time of packet that send A - Event-Timestamp, and record it). For do this, I have thought in to check "Packet-Src-IP-Address" and if it is equal to B's address, I have to use my query modified. I have a problem, "Event-Timestamp" has the follows format: "Oct 26 2011 13:03:14 CEST" and I want to get yyyy-mm-dd HH:MM:ss (mysql format and current format of freeradius' dates). Do you know how can I do it? I can't believe that I can't do this more easy... Any suggestions? I have to think that I will get it... Thanks and regards! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Anybody-can-confirm-this-tp4939606p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

radiusclient problems
by Miha Zoubek 04 Nov '11

04 Nov '11

Hi, I have installedradiusclient. When I start it for a test I get this: xxx.xxx.xxx.xxx: can't parse AV pair Radiusclientis on different server thatfreeradius. I checked dictionary s and all looks good. Please help me out with this issue. Thank you! BR, Miha

4 10

use pam as authentication medium of FreeRadius
by Ivan Matala 04 Nov '11

04 Nov '11

i have a server A with freeradius installed. is there anyway to use the pam of it to be use as authentication medium of freeradius? (instead of using Auth Type = System, Local, SQL The pam module (http://linuxexplore.wordpress.com/how-tos/pam-with-radius-authentication/) connects to another radius server (Server B), and then returns a reply whether it is valid or invalid. Thanks

2 2

data limit
by Tyron van Greunen 03 Nov '11

03 Nov '11

Hello, I know this question has been asked a few times,i've googled the topic and a few posts have popped up.I'd like to know which methods anyone has used to supply capped or limited data accounts on freeradius,some have created their own scripts or perhaps some have used attributes.I've seen mixed answers and suggestions on how to go about this, and being new to freeradius i would just like to know the general census on which is the favourable/easiest method to go about doing this.At the moment im using daloradius as the frontend. Thanks in advance Tyron

1 0