- Freeradius-Users - lists.freeradius.org

SoH and DHCP
by Francois Gaudreault 20 Sep '11

20 Sep '11

Hi, I am trying to make the SoH statements to work using the FreeRADIUS DHCP. However, I have issues to get the SoH values from the NAP client. Maybe someone will be able to help. On the client side, the DHCP NAP policy is set to enabled. Thanks! sites-enabled/dhcp : listen { ipaddr = * port = 67 type = dhcp # interface = eth0 broadcast = yes } dhcp DHCP-Discover { soh update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp DHCP-Request { soh update reply { DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } passwd mac2ip { filename = ${confdir}/mac2ip format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," } The Debug : Received DHCP-Discover of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Hostname = "TestingLaptop" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor DHCP-Vendor = 0xdc00 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} [soh] SoH adding NAP marker to DHCP reply ++[soh] returns ok ++[reply] returns ok ++[reply] returns ok [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Vendor = 0xdc0350414e DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1767. Cleaning up request 1767 ID 1763899400 with timestamp +76404 Going to the next request Ready to process requests. Received DHCP-Request of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Request DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Requested-IP-Address = 10.0.0.245 DHCP-DHCP-Server-Identifier = 10.0.0.243 DHCP-Hostname = "TestingLaptop" DHCP-Client-FQDN = "\000\000\000TestingLaptop.inverse.local" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} ++[soh] returns noop ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Ack of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1768. -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 5

dictionnary file for Motorola RFS series (Symbol)
by Francois Gaudreault 20 Sep '11

20 Sep '11

Hi, I thought it might be useful for some users to add the dictionnary.symbol file below : VENDOR Symbol 388 BEGIN-VENDOR Symbol ATTRIBUTE Symbol-Admin-Role 1 integer VALUE Symbol-Admin-Role Monitor 1 VALUE Symbol-Admin-Role Helpdesk 2 VALUE Symbol-Admin-Role NetworkAdmin 4 VALUE Symbol-Admin-Role SysAdmin 8 VALUE Symbol-Admin-Role WebAdmin 16 VALUE Symbol-Admin-Role SuperUser 32768 ATTRIBUTE Symbol-Current-ESSID 2 string ATTRIBUTE Symbol-Allowed-ESSID 3 string ATTRIBUTE Symbol-WLAN-Index 4 integer ATTRIBUTE Symbol-QoS-Profile 5 integer ATTRIBUTE Symbol-Allowed-Radio 6 string ATTRIBUTE Symbol-Expiry-Date-Time 7 string ATTRIBUTE Symbol-Start-Date-Time 8 string ATTRIBUTE Symbol-Posture-Status 9 string ATTRIBUTE Symbol-Downlink-Limit 10 string ATTRIBUTE Symbol-Uplink-Limit 11 string ATTRIBUTE Symbol-User-Group 12 string ATTRIBUTE Symbol-Login-Source 100 integer VALUE Symbol-Login-Source HTTP 16 VALUE Symbol-Login-Source SSH 32 VALUE Symbol-Login-Source Telnet 64 VALUE Symbol-Login-Source Console 128 VALUE Symbol-Login-Source All 240 -- Francois Gaudreault, ing. jr Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

Re: Freeradius + Fedora-DS + EAP-MSCHAPv2 for WIFI/AP authentication
by Alan Buxey 20 Sep '11

20 Sep '11

You can use LDAP without needing AD or some 3rd party supplicant on the OS , but as already said, you will need to have the password as nthash or cleartext. Read the compatibility matrix alan -- Message may be brief as it has been sent from my mobile

1 0

Telkom DSL confiruration
by Hilton Boyce 20 Sep '11

20 Sep '11

Hi I ma looking for an example to compare of a rad accept request for telkom adsl as All of a sudden I have routers that do not auth and have throuput issues. regards Hilton

1 0

2.1.12 potential problem...
by James J J Hooper 20 Sep '11

20 Sep '11

>> Don't do that. >> >> Instead, don't reject the in the first place. For example: >> >> authorize { >> >> ... >> >> sql >> if (notfound) { >> update control { >> Auth-Type := Accept >> } >> } >> >> } > > Above won't work since: > https://github.com/alandekok/freeradius-server/commit/1a00da32c13fb979e1174… > > -James https://github.com/alandekok/freeradius-server/commit/1a00da In fact this dictionary change breaks other stuff too, e.g. below: [vpieap] Request found, released from the list [vpieap] EAP/mschapv2 [vpieap] processing type mschapv2 [mschapv2] WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/vpi-inner [vpieap] Freeing handler ++[vpieap] returns reject Failed to authenticate the user. and e.g: grep -R 'pairmake("Auth-Type", "' freeradius-server/src/* freeradius-server/src/modules/rlm_chap/rlm_chap.c: pairmake("Auth-Type", "CHAP", T_OP_EQ)); freeradius-server/src/modules/rlm_digest/rlm_digest.c: pairmake("Auth-Type", "DIGEST", T_OP_EQ)); -James

4 10

Freeradius performance problem
by Giuseppe Marocchio 20 Sep '11

20 Sep '11

Hello Guys i have inherited the administration of a radius server, that authenticate 900 PPPoE user on mikrotik box. i've noticed that there is some performance problem, mikrotik box show that "last request RTT" in some cases is up to 1000ms, there is some "resend" request and also some "timeouts", In order to mitigate the problem i've disabled the interim update, and the timeouts are drastically reduced. But exists. i' use mysql back-end, i've checked if there are slow queries but file is empty. ( of course is enabled... ) the server is a dual core Xeon 3.0Ghz with 1 Gb of ram. The SO is debian Linux stable, freeradius is 2.1.10 installed by debian package. Configuration of Thread/server: max_request_time = 30 cleanup_delay = 2 max_requests = 10240 thread pool { start_servers = 20 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } Any ideas? Best Regards, -- Giuseppe Marocchio Tel: (+39) 045.5116192 Fax: (+39) 045.5111197 skype: giuseppe.marocchio

2 1

Authorization help
by Rajkumar balaji 20 Sep '11

20 Sep '11

Hi All, Thanks for helped me to Authenticate with FreeRADIUS. Now I am able to authenticate successfully. Please help me to resole with the following issue, How to get authorize with FreeRADIUS? Where to store the user group details and his permissions? (which file i have to store it) Thanks Regards Rajkumar -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authorization-help-tp4821733p482173… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: redundant FreeRadius Servers
by Alan Buxey 20 Sep '11

20 Sep '11

Just ensure that they have the same config. If you want to use mysql then master/slave replication would be a way of achieving that alan

1 0

redundant FreeRadius Servers
by Simon Langen 20 Sep '11

20 Sep '11

Hello, I need two FreeRadius Servers which have the same data consisted. I'm testing on two Ubuntu 10.4 with freeradius 2.1.8. My Cisco# asks the first and if the first is not available it asks the second. Is there any Information on this topic? I use freeradius with mysql. is mysql-replication a good idea? Best Regards, Simon

1 0

Freeradius Performance
by sekchel lee 19 Sep '11

19 Sep '11

Freeradius Performance My computer Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz RAM 2GB CentOS 5.5 NAS Client pptp and openvpn each NAS user 100 ~ 300 How many NAS Client ? The ? NAS How much bandwidth?

2 1