- Freeradius-Users - lists.freeradius.org

Mac access mixed ldap access same NAS
by Alejandro Gandara 06 Oct '11

06 Oct '11

Hi list, does someone know if Its possible mix MAC auth with ldap AUTH in the same NAS. I mean, I have multiple connection to one NAS but a few users will access through mac address, and others will access trhough auth ldap + passwords. Nowadays Ive configured ldap access but I dont know how to configure freeradius to allow connect a few users(16-20) trhough mac auth. As always thanks you very much for your time and peacence. Regards, Alejandro Gándara Junior System Administrator

3 2

MySQL and FreeRADIUS environment
by tonimanel 06 Oct '11

06 Oct '11

Hi everybody, In my company we are thinking to implement a FreeRADIUS server with MySQL on Linux. We need to duplicate FreeRADIUS service because we think that this is a critical service for us but the authentication process only could be done with the master server(FreeRADIUS and MySQL service, both in only one server). For the other hand, if we want to replicate the data base servers, we would have to synchronize two database servers but we would not know wich would be the best solution, cluster or synchronize. Maybe we will not to need a MySQL cluster service and we will need two servers only. First with master FreeRADIUS service and master MySQL service and the second with slave FreeRADIUS service and slave MySQL service. What do you think about the best solution to implement this environment? I hope your answer. Thank you very much. Regards, -- View this message in context: http://freeradius.1045715.n5.nabble.com/MySQL-and-FreeRADIUS-environment-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 18

Reply-Message in freeradius
by Dagia Dorjsuren 06 Oct '11

06 Oct '11

Hello, How to add Reply-Message in freeradius? anyone advise me pls. For example : I would like to send "Your username or password is wrong" message to NAS if the someone to access to my freeradius via wrong password from that NAS Thanks,

4 4

Re: Rewriting wimax calling-station-id with perl
by James T Mugauri 05 Oct '11

05 Oct '11

Hi, As you are undoubtedly aware, the ubuntu/debian package of freeradius comes without the wimax module (despite having the wimax module) installed. My own attempts to compile/install/build deb package for ubuntu always die with the infamous "undefined reference to `lt_preloaded_symbols'" that apparently has even Alan opting to forsake libtool. Because many people would still like to implement mac authentication on a wimax network, I was wondering whether the c subroutine that does this in the module: /* * Fix Calling-Station-Id. Damn you, WiMAX! */ vp = pairfind(request->packet->vps, PW_CALLING_STATION_ID); if (vp && (vp->length == 6)) { int i; uint8_t buffer[6]; memcpy(buffer, vp->vp_octets, 6); /* * RFC 3580 Section 3.20 says this is the preferred * format. Everyone *SANE* is using this format, * so we fix it here. */ for (i = 0; i < 6; i++) { fr_bin2hex(&buffer[i], &vp->vp_strvalue[i * 3], 1); vp->vp_strvalue[(i * 3) + 2] = '-'; } vp->vp_strvalue[(5*3)+2] = '\0'; vp->length = (5*3)+2; DEBUG2("rlm_wimax: Fixing WiMAX binary Calling-Station-Id to %s", buffer); } can be easily translated to perl to rewrite the calling-station-id (only when it does not meet the standard), as that module works fine and is correctly compiled? If so, would anyone here be able to mash up a few lines of perl code to this end? Please? I, unfortunately am not familiar enough with c to translate the logic behind the code above flawlessly. Hopefully, JamesTM Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley On 10/05/2011 02:10 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: FreeRadius with Eduroam - Accounting (Alan DeKok) > 2. Re: MySQL and FreeRADIUS environment (tonimanel) > 3. Re: FreeRadius with Eduroam - Accounting (Phil Mayers) > 4. Mac access mixed ldap access same NAS (Alejandro Gandara) > 5. Re: MySQL and FreeRADIUS environment (Fajar A. Nugraha) > 6. Re: MySQL and FreeRADIUS environment (tonimanel) > 7. MySQL and FreeRADIUS environment (tonimanel) > 8. Re: MySQL and FreeRADIUS environment (Alan DeKok) > 9. Re: MySQL and FreeRADIUS environment (tonimanel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 05 Oct 2011 12:09:39 +0200 > From: Alan DeKok<aland(a)deployingradius.com> > Subject: Re: FreeRadius with Eduroam - Accounting > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<4E8C2CE3.7000802(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: >> It's a bad way of doing it. At least with replicate every accounting packet has a chance... Using Acct-Delay-Time you'll end up dumping anywhere between 1-15 seconds accounting data for all realms if one realm is unreachable. > <shrug> > > if (Packet-Transmit-Counter> 5) { > ok > } else { > ... proxy ... > } > > If the home server doesn't get it after 5 tries, throw it away. > > In 2.1.10& later, IIRC. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Wed, 5 Oct 2011 03:49:16 -0700 (PDT) > From: tonimanel<antoniofernandez(a)fabergames.com> > Subject: Re: MySQL and FreeRADIUS environment > To: freeradius-users(a)lists.freeradius.org > Message-ID:<1317811756198-4872269.post(a)n5.nabble.com> > Content-Type: text/plain; charset=us-ascii > > My FreeRADIU version is 2.1.10 on Debian. Suggest me update? Or is a valid > verstion to work and implement freeradius replication with radrelay? > > Thanks, > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/MySQL-and-FreeRADIUS-environment-tp… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > ------------------------------ > > Message: 3 > Date: Wed, 05 Oct 2011 11:50:12 +0100 > From: Phil Mayers<p.mayers(a)imperial.ac.uk> > Subject: Re: FreeRadius with Eduroam - Accounting > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4E8C3664.5070000(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 05/10/11 09:56, Arran Cudbard-Bell wrote: >> On 5 Oct 2011, at 10:40, Phil Mayers wrote: >> >>> On 10/05/2011 09:26 AM, Alan DeKok wrote: >>>> Phil Mayers wrote: >>>>> I guess that's ok, in that it stops an unresponsive realm >>>>> blocking other realms, but wouldn't another solution be to add >>>>> a config item to the detail reader to drop packets which are>X >>>>> seconds old? >>>> if (Acct-Delay-Time> 3600) { ok } else { ... do proxy .... } >>> >>> Ah ha! Clever. I had forgotten the detail reader created/updated >>> that attribute. Yay FreeRADIUS! >> It's a bad way of doing it. At least with replicate every accounting >> packet has a chance... Using Acct-Delay-Time you'll end up dumping >> anywhere between 1-15 seconds accounting data for all realms if one >> realm is unreachable. > Whereas with rlm_replicate, you risk dropping arbitrary accounting > packets because there is no retry. There is no ideal solution, because > radius accounting was never designed for the kind of loosely-coupled > federation that is Eduroam. > > For me, since most Eduroam sites don't care about receiving federated > accounting, my primary concern is for my server to carry on functioning, > and that means the detail file should not grow without bound. I don't > really care how that happens - as long as it does. > > > > ------------------------------ > > Message: 4 > Date: Wed, 5 Oct 2011 13:06:33 +0200 > From: Alejandro Gandara<agandara(a)optaresolutions.com> > Subject: Mac access mixed ldap access same NAS > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CAF40+uwJa0dZ-3YNcr=QkRu1NUrL6Lhy77W2RhEPDuNWjtbGkg(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi list, > > does someone know if Its possible mix MAC auth with ldap AUTH in the same > NAS. > > I mean, I have multiple connection to one NAS but a few users will access > through mac address, and others will access trhough auth ldap + passwords. > > Nowadays Ive configured ldap access but I dont know how to configure > freeradius to allow connect a few users(16-20) trhough mac auth. > > As always thanks you very much for your time and peacence. > > Regards, > > Alejandro G?ndara > Junior System Administrator >

3 2

radius dhcp
by Alexandre Chapellon 05 Oct '11

05 Oct '11

Hello, I have a setup where th user initiates DHCP request to the NAS. The NAS then tries to authenticate the user using regular radius requests (basicilly Access-Request with username=macaddr). If authenticated the NAS relay the dhcp request to a dhcp server That works. I want to know if there is any *standardized* way to specify the NAS the DHCP server to relay the DHCP request to, using attributes in the radius Access-Accept? I have found dhcp dictionnary (talking about gateway DHCP to RADIUS) but am not sure it is intended to do that. If not does anybody knows if it's possible with redback xxxSE BRAS? Regards. -- <http://www.horoa.net> Alexandre Chapellon Ingénierie des systèmes open sources et réseaux. Follow me on twitter: @alxgomz <http://www.twitter.com/alxgomz>

2 1

Trying to configure Cisco WLC 5500 for radius auth
by Jefferson Davis 05 Oct '11

05 Oct '11

Hi all, Trying to configure our cisco WLC's to play nice with freeradius... Looking for some pointers to get the two of them talking. Will have windows, linux, and personal devices like smartphones connecting, though I suspect the bulk will be smartphones. I would rather not hand out the PSK to users as I know this will get loose. I have set up a WLAN for this but it does not seem to be talking to freeradius. Will the traffic be coming from the WLC or the designated WLAN for the SSID? Would very much appreciate any pointers. I've got it working as far as authenticating my switches and routers. Saved us probably $10k plus. -- Jefferson K Davis Technology and Information Systems Manager Standard School District 1200 North Chester Ave Bakersfield, CA 93308 661.392.2110 ext 120 (office) 661.392.0681 (fax) http://district.standard.k12.ca.us

2 1

Re: FreeRadius with Eduroam - Accounting
by Alan Buxey 05 Oct '11

05 Oct '11

>Roll on RADSEC. Ha ha ha <cough splutter> coffee everywhere now. Thanks for the laugh.... the uptake of IPv6 and DNSSEC looks absolutely ravenous and rapid compared to that of DNSSEC. I've had a couple of sites ask about it and go no further (they are running RADIUS servers that can do RADSEC without being prerelease/beta) is this the configuration required (minimal) or the prescribed eduroam method of coming on board? I dont know. Maybe its the giant hole in stats caused when the proxies no longer see end site traffic...and the onus on sites to provide stats... either way even with RADSEC , when a site is down or non responsive you'll still have a backup of accounting data for them.... alan

1 0

Re: (No subject)
by Alan Buxey 05 Oct '11

05 Oct '11

ldconfig -v ?? alan -- Message may be brief as it has been sent from my mobile

1 0

(no subject)
by Alex rsm 05 Oct '11

05 Oct '11

Hi, I just installed freeradius 2.1.12 on ubuntu server from src file and got the following error: # radiusd -X radiusd: error while loading shared libraries: libfreeradius-radius-2.1.12.so: cannot open shared object file: No such file or directory Thanks, ASM

2 1

Issue with installation of FreeRadiusServer (2.1.11) on Solaris
by Harish Kumar 05 Oct '11

05 Oct '11

Hi, I am using solaris sparc 5.10 for installation of 2.1.11 version of FreeRadiusServer. My Configure, gmake went fine but at time of "gmake install" getting following error. Can anyone suggest how to fix that error? #gmake install /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/sbin /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/bin /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/etc/raddb /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/share/man /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/var/run/radiusd /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 700 /usr/local/var/log/radius /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 700 /usr/local/var/log/radius/radacct /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/share /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/share/freeradius for i in 1 5 8; do \ /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -d -m 755 /usr/local/share/man/man$i; \ for p in man/man$i/*.$i; do \ /export/home/emsuser/Documents/freeradius-server-2.1.11/install-sh -c -m 644 $p /usr/local/share/man/man$i; \ done \ done gmake[1]: Entering directory `/export/home/emsuser/Documents/freeradius-server-2.1.11' Making install in libltdl... gmake[2]: Entering directory `/export/home/emsuser/Documents/freeradius-server-2.1.11/libltdl' gmake[3]: Entering directory `/export/home/emsuser/Documents/freeradius-server-2.1.11/libltdl' test -z "/usr/local/lib" || /bin/bash /export/home/emsuser/Documents/freeradius-server-2.1.11/libltdl/install-sh -d "/usr/local/lib" /bin/bash ./libtool --mode=install /usr/bin/install -c 'libltdl.la' '/usr/local/lib/libltdl.la' /usr/bin/install -c .libs/libltdl.so.3.1.4 /usr/local/lib/libltdl.so.3.1.4 cp: cannot access /usr/local/lib/libltdl.so.3.1.4 install: cp /usr/local/lib/libltdl.so.3.1.4 .libs/libltdl.so.3.1.4/libltdl.so.3.1.4 failed gmake[3]: *** [install-libLTLIBRARIES] Error 2 gmake[3]: Leaving directory `/export/home/emsuser/Documents/freeradius-server-2.1.11/libltdl' gmake[2]: *** [install-am] Error 2 gmake[2]: Leaving directory `/export/home/emsuser/Documents/freeradius-server-2.1.11/libltdl' gmake[1]: *** [libltdl] Error 2 gmake[1]: Leaving directory `/export/home/emsuser/Documents/freeradius-server-2.1.11' gmake: *** [install] Error 2 Thanks, Harish

3 2