- Freeradius-Users - lists.freeradius.org

Freeradius capable of url-redirect
by Nathan McDavit-Van Fleet 15 Aug '11

15 Aug '11

Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2. I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access. http://www.cisco.com/en/US/products/ps6366/products_configuration_example091 86a0080956185.shtml Is this handled somehow is Freeradius?

6 12

New VM daloradius for freeradius2 is out - just for your information.
by aceror 12 Aug '11

12 Aug '11

Hi all! just post from Liran Tal (Daloradius) "Hey everyone, The daloRADIUS Virtual Machine and User Guide which I have been working on for so long are finally available on the daloradius.com blog." I just try it. Working for now!! Lets see tomorrow. I still missing paypal, or visa module But is only my opinion...

1 0

Home servers in SQL for CoA Proxy
by Francois Gaudreault 12 Aug '11

12 Aug '11

Hi, Is there a way to list the home servers (so the access switches) into a sql table (like nas table) intead of proxy.conf? My goal here is to proxy the CoA to the NAS without having to manually list all the devices in proxy.conf, and use Proxy-To-Realm = %{NAS-IP-Address}. Thanks -- Francois Gaudreault, ing. jr Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

Config for TLS, TTLS and PEAP and subject validation
by Daniel Bertolo 12 Aug '11

12 Aug '11

Hi I currently run FreeRADIUS 2.1.6 and have a working configuration for EAP-TTLS and PEAP that is used for a WPA2 network. In addition to that, I would like to allow our users to use their user certificate from a public issuer to connect using EAP-TLS. This means that I have to check if the subject contains our organisation. I read in previous threads about checking the subject in the authenticate section: authenticate { Auth-Type eap { eap if (!"%{TLS-Client-Cert-Subject}" =~ /\/O=MyCompany\// ) { reject } } } I have two questions about that: - This would belong in the "outer" request as there is no inner request with EAP-TLS, right? - What happens to requests that don't provide a client certificate (the users who still use EAP-TTLS or PEAP)? In conclusion, is there a way to distinguish between EAP-TLS requests and EAP-TTLS or PEAP requests? And if so, can I use a different server section for EAP-TLS? Thanks for help. Best regards, Daniel

2 2

how to conf VLAN assign,mac-auth-bypass, and redirect url?
by freeradius 12 Aug '11

12 Aug '11

hi all, can anyone show me how to conf VLAN assign,mac-auth-bypass, and redirect url?thank you very much

3 2

dynamic CRL
by Travis Dimmig 11 Aug '11

11 Aug '11

Apologies ahead of time if this information is easily available somewhere else, but everything I found seemed to be a few years out of date. Does freeRadius now have the ability to re-read a certificate revocation list, or does it still require a restart after additions to the CRL? Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

3 3

SSH to use CHAP
by chesschi 11 Aug '11

11 Aug '11

Hello! I try to authenticate ssh users via PAM using FreeRadius. Is it possible to use CHAP for the authentication between radius server and radius client? SSH client -> SSH server <- PAM -> Radius Client <- CHAP-> Radius Server For example, if I specify in radius server to use CHAP auth-type for a particular user, e.g. in users file: sshuser Auth-type := Chap, Cleartext-Password := "xxx" When I use an SSH client to login, the following error is shown in radius server. [chap] rlm_chap: Attribute "CHAP-Password" is required for authentication. So is there a way to actually specify the CHAP-Password in radius client so that it can be authenticated via CHAP? If yes, which file I should modify? Thanks a lot!!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/SSH-to-use-CHAP-tp4685793p4685793.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Freeradius and group membership check
by Vlad Glagolev 11 Aug '11

11 Aug '11

Hello there, I'm here to say that I've found kind of misconfiguration/bug in Freeradius. The version is 2.1.10, and the platform is i386 (i686) OpenBSD. when I try to use group membership check, I see strange behaviour: instead of commas there are symbols (those are in ASCII?) like that: [files] expand: (|(&(objectClass=PosixGroup)(memberUnixUserName=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=PosixGroup)(memberUnixUserName=uid\3dtest\2cou\3dIT\2cou\3dDepartments\2cou\3ddom.tld\2cou\3dDomains\2cou\3dUsers\2cdc\3ddomain\2cdc\3dtld))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtest\2cou\3dIT\2cou\3dDepartments\2cou\3ddom.tld\2cou\3dDomains\2cou\3dUsers\2cdc\3ddomain\2cdc\3dtld))) of course if I use %{User-Name} instead of %{control:Ldap-UserDn} it works well (with simplified search filter, but it's the same with that above): [files] expand: (&(objectClass=posixGroup)(memberUnixUserName=%{User-Name})) -> (&(objectClass=posixGroup)(memberUnixUserName=test)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=tld, with filter (&(cn=disabled)(&(objectClass=posixGroup)(memberUnixUserName=test))) rlm_ldap::ldap_groupcmp: User found in group disabled is this a known behaviour? thanks in advance -- Dont wait to die to find paradise... -- Cheerz, Vlad "Stealth" Glagolev

2 1

SNMP
by David Peterson 11 Aug '11

11 Aug '11

Is SNMP available yet in the latest code? David

2 1

Need your help me get daloradius fully integrated with freeradius
by Mobin Yazarlou 10 Aug '11

10 Aug '11

Hi, This is my first email on freeradius mailing list so I would like to say thanks to freeradius development team and all those who participate in this mailing list. I am using freeradius 2.1.11 on Debian 6.0 to have enough control over pptpd users. Everything is hosted on a single machine and freeradius works fine but I can't use some of the features I see in daloradius 0.9-9 control panel. One of this features is "Max-All-Session" and some other attributes that allow me to limit download/upload bandwidth. I used to following checklist to install and integrate daloradius with freeradius database: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- apt-get install apache2 apt-get install php5 apt-get install php5-mysql apt-get install php-pear apt-get install php5-gd apt-get install php-db wget http://www.xxxxxxxx.com/pptp/daloradius-0.9-9.tar.gz tar -zxvf daloradius-0.9-9.tar.gz mv daloradius-0.9-9 dalo cp -R dalo /var/www chown www-data:www-data /var/www/dalo -R chmod 644 /var/www/dalo/library/daloradius.conf.php mysql -u radius -pPASSWORD radius < /var/www/dalo/contrib/db/mysql-daloradius.sql # Set CONFIG_DB_USER and CONFIG_DB_PASS in daloradius.conf.php nano /var/www/dalo/library/daloradius.conf.php -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- I think this checklist is just a minimum to only get daloradius to work. I would be thankful if you provide a better checklist or letting me know about other things that need to be done. Yesterday I spent about two hours to find out why freeradius fails to authenticate the user when I use "Max-All-Session" attribute. I just googled the error message I could see in "freeradius -X" and found that I have to add "noresetcounter" in the authorize { } section of /sites-enabled/default and uncomment "$INCLUDE sql/mysql/counter.conf" in radiusd.conf. This eliminated the error message and the users that have a "Max-All-Session" attribute can connect but freeradius still let the user to connect even when its time credit is finished. The only attributes that seem to work properly are "Simultaneous-Use" and "Expiration". I don't have any problem with them and they work fine. Actually, I am not sure if it is about daloradius. Please correct me if I am wrong cause I am a web developer and do know just a little about networking, radius server, access server, etc. Thanks in advance. Moby

1 0