- Freeradius-Users - lists.freeradius.org

WiFI
by michel＠casa.co.cu 01 Aug '11

01 Aug '11

Hello I have three Linksys Wireless Routers: WRT160N WRT110 WRT360 - "Now I'm not sure of the model" With them, users connect to my network using WIFI using a password exchange. I would like to change this pattern, I wondered if configuration is possible to perform Authentication, Authorization and Accounting with Freeradius and if I can provide any documentation that details the way as it can get. Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

3 2

session resumption for WPA2-TLS
by Dhinesh gunasekaran 31 Jul '11

31 Jul '11

hi, am using Freeradius 2.1.10 along with wpa_supplicant 0.7.3 and hostapd 0.7.3 on ubuntu lucid 10.04 machines with openssl 1.0.0a in wpa_supplicant and 0.9.8k in freeradius server. i enabled session resumption in the free radius and it works fine for EAP methods -PEAP and TTLS when i hand when i configured for TLS, it seems in the cache it didnt get any values to store and it stops

1 1

selective disabling password logging for proxied users?
by Meike Stone 31 Jul '11

31 Jul '11

Hello, I'm sorry, that I ask again .. We are using the freeradius server with authentication against ldap as "local database" and proxy the realms (IPASS) to authenticate users are not in our database. So is is possible, to disable the password logging only for the proxied request? The local requests are only users who got a temporary voucher. In case of failure, the help desk should use the log to check if the user did use the correct password. But the password for IPASS users password should not be logged. If I disable the password logging in the detail section (suppress {User-Password}), the complete password logging will be disabled. Is it possible, to disable this selective only for proxied users? Thanks for help - Meike

1 0

How to create a new dictionary.brocade
by Wagner Pereira 29 Jul '11

29 Jul '11

Hello, guys. I have new Brocade TurboIron switches and I intend to configure aaa using one external FreeRADIUS server. I noticed that in my FreeRADIUS 2.0.4 there is no dictionary.brocade (see below). My question: is there a specific tool to create a new dictionary OR it is just to vi the file correctly and save it at the right directory? ------------------------ # # dictionary.brocade # VENDOR Brocade 1588 # # attributes # ATTRIBUTE Brocade-Auth-Role 1 string Brocade ATTRIBUTE Brocade-AVPairs1 2 string Brocade ATTRIBUTE Brocade-AVPairs2 3 string Brocade ATTRIBUTE Brocade-AVPairs3 4 string Brocade ATTRIBUTE Brocade-AVPairs4 5 string Brocade ATTRIBUTE Brocade-Passwd-ExpiryDate 6 string Brocade ATTRIBUTE Brocade-Passwd-WarnPeriod 7 string Brocade ------------------------ Regards, -- ### At PoP-SP/RNP, every day is an IPv6 day ### Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fixo. +55 11 3091-8901 Móvel. +55 11 9923-9554 fone@RNP: 10158902

3 2

RE: Unlang issue
by Garber, Neal 29 Jul '11

29 Jul '11

> Try: > > if ((Client-IP-Address == x) || (Client-IP-Address == y)) { > } No joy :-(. For now, I ended up doing: if (Called-Station-Id) { if (Client-IP-Address == "x") { update request { Huntgroup-Name := "zzzz" } } elsif (Client-IP-Address == "y") { update request { Huntgroup-Name := "zzzz" } } } Not as efficient, but it works. I'll retest the old unlang code after I upgrade later this year.

1 0

SQL check in XOR
by Rosario Lumia 29 Jul '11

29 Jul '11

Hi to all, I have more SQL in which check for accounting infos. In my "sites-enabled/default" file I have in my accounting section: {... sql1 sql2 sql3 ... } I notice that in this way the process check if AT LEAST one of above tables "returns ok", but I'd want accounting module returns OK iff exactly ONE of that returns ok. Is there a way to configure in this XOR way? Thanks in advance. Regards -- Rosario L.

2 2

Reuse Customized Attributes
by d.thembiliyagoda＠lancaster.ac.uk 29 Jul '11

29 Jul '11

Hi, I defined an attribute in dictionary file as follows. ATTRIBUTE My-Local-String 3000 string and I used it in policy.conf file to assign value of the EAP -TTLS inner tunnel user name. test1 { update outer.request { My-Local-String := "%{request:User-Name}" } update reply { User-Name := "%{request:User-Name}" } update reply { Auth-Type := "%{control:Auth-Type}" } I called the test1 under the authorize section in inner-tunnel virtual server. I want to re-use this attribute "My-Local-String" in a mysql query. But it doesn't contain any value . It stores an empty value in UserName filed of the table. postauth_query = "INSERT INTO ${cui_uname_table} \ (UserName, CUI, DateTime) \ VALUES \ ('%{My-Local-String}', '%{reply:Chargeable-User-Identity}', SYSDATE())"; I am executing this query under the post-auth section of the default server. Is there any way achieve this ? Champika

1 0

Yet another multiple SSID setup question
by Nick Kartsioukas 29 Jul '11

29 Jul '11

I've been looking through the wiki and staring at the config files and I'm...confused. I've successfully gotten our Cisco WLC to authenticate against ActiveDirectory as well as a Sun LDAP server (just one at a time) via FreeRADIUS for a single test SSID, but now I'm trying to figure out how to split that into conditional checks. Before I go chopping up the existing config files and making a horrible mess of things, I wanted to verify a few things with the wisdom of the list. Okay...let's say I have an SSID for students and an SSID for staff. Students authenticate against LDAP, which stores passwords as salted SHA1 hashes. Staff authenticate against Windows ActiveDirectory. I've found where the WLC sends the SSID to FreeRADIUS, so I can get at that. My question is, how do I set up the EAP-TTLS/PAP session for the Student SSID and the separate PEAP/MSCHAPv2 session for the Staff SSID? Are these configured as different virtual servers? Or just different modules that I call from the users file like so: DEFAULT Auth-Type := student_module, Called-Station-SSID := "student" DEFAULT Auth-Type := staff_module, Called-Station-SSID := "staff" If so how do I set that up, as that would be two different eap.conf setups (wouldn't it)? Am I missing something obvious in the docs? Thanks for taking the time to help me out!

6 13

can policy.conf be used to create an access control list
by michael lamborn 28 Jul '11

28 Jul '11

Hi, I am using version freeRadius 1.1.7. I am trying to create an access control list via radius, to prevent specific PC's/locations from accessing my network. Please see my policy.conf example below. My freeRadius server keeps sending an access-accept, when I try to login in from my office as a test, which has the IP address 10.2.222.35. I don't understand why the server is allowing the login. It seems logical to me the way that I have approached an implementation, but I can't find any specific info from the wiki or in internet searches. So I am not sure if I am still misconfigured or if it just doesn't work for some other reason. Thanks, Mike In policy.conf, I have the following, but it doesn't have any affect ( I do have '$INCLUDE ${confdir}/policy.conf' in my radiusd.conf file): policy { forbid_login_ip_hosts { %{request:Login-IP-Host} =~ /^10.2./ { reject } } }

3 2

Re: Freeradius mysql (problem)
by Chaos Lord 28 Jul '11

28 Jul '11

Hi, i have the exact same problem here with a Linksys access point. The Access list to the AP works fine allowing the client to connect. But the authentication fails. When i enter the client with it's login in the users file like this "myclientuser" Cleartext-Password := "myclientspassword" it works fine. As soon as i try this on the mysql System i do not get the access. The Allowd hosts access still works fine.... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-mysql-problem-tp4638453p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0