- Freeradius-Users - lists.freeradius.org

NAS re-uses the same port and ID
by Konstantin Chekushin 13 Jul '11

13 Jul '11

Hi all! I've found, that our NAS-server sometimes (when it restarts and there are many auth. packets comes to the radius-server) re-uses port and ID in a < 1 second period. (information from tcpdump) That causes " conflicting packet from client". I think, that the NAS works wrong (it must wait a little bit more, then 1 sec. to re-use the port+ID), that's why I wont to find some documentation about it for a bug-report. Thanks a lot.

3 4

rlm_sql and read_groups
by Jacob Dawson 12 Jul '11

12 Jul '11

We're trying to get FreeRADIUS to get at the user info in our Oracle DB, and it does not appear to be respecting the read_groups = yes setting in sql.conf. Forex: [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] ... expanding second conditional [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] expand: %{User-Name:-DEFAULT} -> dawson(a)vt.edu [sql] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> dawson(a)vt.edu [sql] sql_set_user escaped user --> 'dawson(a)vt.edu' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = 'dawson(a)vt.edu' ORDER BY id SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = 'dawson(a)vt.edu' ORDER BY id [sql] User found in radcheck table rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok That's all well and good, and I understand that this is normal behavior if you don't set read_groups to yes, but that's decidedly unhelpful behavior when you also want to confirm group memberships. Here's the related output from when FR loads the sql module: Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/freeradius-2.1.11/etc/raddb/sql.conf sql { driver = "rlm_sql_oracle" server = "<redacted>" port = "<redacted>" login = "<redacted>" password = "<redacted>" radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=<redacted>)(PORT=<redacted>))(CONNECT_DATA=(SID=<redacted>)))" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/freeradius-2.1.11/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Did I miss something, or is this misbehaving? Thanks much, - Jacob M. Dawson

4 13

Re: Wiki - Once upon a time there was documentation
by Nonny Mouse 12 Jul '11

12 Jul '11

I can confirm that some Wiki pages are blank (waiting to be edited). I checked, and they don't appear to be on the to-do list for conversion. Instead, it brings it up as a "Create New Page" dialog. I'm willing to help out with them, but need to create an account and review the stylesheets/directives for Restructured Text/Markdown first. Also, unlike other mailing lists I've used, I can't seem to figure out how to use the web interface to reply within an existing thread (I'm a new user, so I can't respond to the original mail or digest). We are planning to deploy FreeRadius within the next month, so I'm doing my homework first. I appreciate all the resources you do have available so far. http://wiki.freeradius.org/Mac-Auth http://wiki.freeradius.org/%23Is+there+a+way+to+bind+FreeRADIUS+to+a+specif… http://bugs.freeradius.org/show_bug.cgi?id=207 (This is a broken link from http://wiki.freeradius.org/FAQ, which also has some minor grammatical errors I'd be happy to fix). http://wiki.freeradius.org/SNMP http://wiki.freeradius.org/MIB http://wiki.freeradius.org/Framed-IP-Netmask http://wiki.freeradius.org/%23Why+do+Acct-Input-Octets+and+Acct-Output-Octe…

7 8

Local User with multiple passwords (or RegEX passwords) possible?
by Equin Nix 12 Jul '11

12 Jul '11

Hi, I am trying to set up something very basic (at least from my point of view): I would like to have a User with multiple passwords (two actually). How would I do this? I tried the following: *alice Auth-Type=Local, Cleartext-Password := "test1" alice Auth-Type=Local, Cleartext-Password := "test2"* which (of course) did not work. Then *alice Auth-Type=Local, Cleartext-Password := "test1" Fall-Through = Yes alice Auth-Type=Local, Cleartext-Password := "test2"* which (of course) did not work, too. Then I tried some regex, from which, the following do not work: *alice Auth-Type=Local, User-Password =~ "[*]*" alice Auth-Type=Local, User-Password =~ /*/i alice Auth-Type=Local, User-Password =~ "(test1)**" alice Auth-Type=Local, User-Password =~ "[.....]*" ...* How would I make an entry to users to have *alice *log in with "*test1*" OR "*test2*" as password? Best regards

4 8

Tunneled-User-Name
by d.thembiliyagoda＠lancaster.ac.uk 12 Jul '11

12 Jul '11

Hi, I am using EAP-TTLS and MSCHAPv2 to authenticate with FreeRadius server.How can I get the tunnelled User-Name (User-Name used in inner authentication phase) using unlang in FreeRADIUS server? Now I can only get the User-Name used for the outer authentication (ex: anonymous). Best Regards Champika

3 6

Re: Yet another multiple SSID setup question
by Alan Buxey 12 Jul '11

12 Jul '11

Nick, the joy of frees is that you can do this is umpteen different ways. I would recommend that you use unsung unlang to check the ssid in the request and then proxy that request to a different virtual server to deal with in the way you want Alan -- Message may be brief as it has been sent from my mobile ----- Reply message ----- From: "James J J Hooper" <jjj.hooper(a)bristol.ac.uk> Date: Tue, Jul 12, 2011 08:19 Subject: Yet another multiple SSID setup question To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> On 12/07/2011 02:50, Nick Kartsioukas wrote: > I've been looking through the wiki and staring at the config files and > I'm...confused. > I've successfully gotten our Cisco WLC to authenticate against > ActiveDirectory as well as a Sun LDAP server (just one at a time) via > FreeRADIUS for a single test SSID, but now I'm trying to figure out how > to split that into conditional checks. Before I go chopping up the > existing config files and making a horrible mess of things, I wanted to > verify a few things with the wisdom of the list. > > Okay...let's say I have an SSID for students and an SSID for staff. > Students authenticate against LDAP, which stores passwords as salted > SHA1 hashes. Staff authenticate against Windows ActiveDirectory. > I've found where the WLC sends the SSID to FreeRADIUS, so I can get at > that. My question is, how do I set up the EAP-TTLS/PAP session for the > Student SSID and the separate PEAP/MSCHAPv2 session for the Staff SSID? > Are these configured as different virtual servers? Or just different > modules that I call from the users file like so: > DEFAULT Auth-Type := student_module, Called-Station-SSID := "student" > DEFAULT Auth-Type := staff_module, Called-Station-SSID := "staff" > > If so how do I set that up, as that would be two different eap.conf > setups (wouldn't it)? Am I missing something obvious in the docs? > Thanks for taking the time to help me out! If they are different SSIDs on the Cisco WLC, you should be able to assign different radius servers for each SSID. Do that, e.g: ssid1 -> 192.0.2.1:1645 ssid2 -> 192.0.2.1:1812 Then use a different FreeRADIUS virtual server to handle each (i.e. on virtual server listening on port 1812 , and one listening on port 1812). This way you can keep the intricacies of each separate. -James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Default tables
by Luke Hammond 11 Jul '11

11 Jul '11

Sorry if this question is deemed as bein g silly, but i cant find a straight answer for this anywhere.. What are the default tables that are installed with FreeRADIUS when i use MySQL for the database?

3 4

Status of the project
by Alan DeKok 11 Jul '11

11 Jul '11

This email is to keep everyone up to date with respect to the project. As people may have noticed, Arran Cudbard-Bell is now posting messages from the "freeradius.org" domain. Until now, I've been the only person with an address at freeradius.org. Arran is contributing on a number of fronts. He's added code changes, documentation, etc. i.e. his role in the project has recently increased quite a bit. Please welcome Arran as a core contributor to FreeRADIUS. Alan DeKok.

5 4

Re: freeradius
by Arran Cudbard-Bell 11 Jul '11

11 Jul '11

On Jul 11, 2011, at 9:00 PM, Roldanis Pozo Disotuar wrote: > > I understand perfectly, but could see the settings I used in freeradius to see if all is well There are no settings in FreeRADIUS which will make the portslave send the Caller ID. If you want us to check to see if the value is included in the Access-Request packet, post the output of radiusd -X. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter

1 0

Re: freeradius
by Arran Cudbard-Bell 11 Jul '11

11 Jul '11

On Jul 11, 2011, at 8:37 PM, Roldanis Pozo Disotuar wrote: > > you could give me some items to help me solve this problem you could send the freeradius configuration files and portslave for review to see if I make a mistake and solocionarlo > It looks like it should be possible, someone wrote a patch: http://sourceforge.net/tracker/?func=detail&aid=496649&group_id=2501&atid=3… Beyond that i've never used a postslave type NAS before. I'll beat Mr DeKok to it and say that this is a FreeRADIUS mailing list for problems with the FreeRADIUS server. We do not provide support for other projects or products. Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter

1 0