- Freeradius-Users - lists.freeradius.org

I need help and some advice !!!
by striderblue 06 Apr '11

06 Apr '11

about IPv6 on freeradius v.2.1.test9 for ubuntu so this version is support IPv6 right? but I try to test local with IPv6 ::1 it response like this : http://freeradius.1045715.n5.nabble.com/file/n4167834/0bcb3b1056e7d9151be5f… radclient: Failed to find ip address for host ::1: success but radtest ipv4 worked!!! ---------------------------------------------------------------------- at clients.conf I config : client localhost { ipaddr = 127.0.0.1 ipv6addr = :: secret = testing } client ::1 { secret = testing123 shortname = localhost } ---------------------------------------------------------------------- at radiusd.conf I config : listen { type = auth ipaddr = * ipv6addr = :: port = 0 } listen { ipaddr = * ipv6addr = :: port = 0 type = acct } ---------------------------------------------------------------------- so where I missed and do wrong config ? please help thank you very much. golf -- View this message in context: http://freeradius.1045715.n5.nabble.com/I-need-help-and-some-advice-tp41678… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 9

pam radius auth
by Rtz Poknat 06 Apr '11

06 Apr '11

how can i configure pam radius auth http://freeradius.org/pam_radius_auth/ to send accouting updates to the radius server? like every 1 minute pls help

2 1

radutmp
by Rtz Poknat 06 Apr '11

06 Apr '11

hello, radutmp shows blank... pls help me

1 0

How to assign vlan / manage different user groups
by Götz Reinicke - IT-Koordinator 05 Apr '11

05 Apr '11

Hi, may be someone can point me into the right direction: we do have a new wlan - freeradius - ldap setup and want to assign two main usergroups to two main wlans. Each wlan has an own vlan. We use cisco switches and APs and got a wlan controller. So far we do have different SSIDs and all users can access both WLANs with their username/password stored in our ldap. Now we'd like students only to be able to access the students WLAN and employees to access there WLAN. My question: Where is the point to start to configure such a setup? I think, somewhere there must be some sort of check if the user assceesing the e.g. student wlan is in the primary posixgroup student. Or do I have to 'send' the VLAN ID to the network devices? Thanks for any hint and best regards Götz Reinicke -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

2 2

bug
by Rtz Poknat 05 Apr '11

05 Apr '11

hello. I deleted an entry in the database , yet it returns,, and session time is 59000 seconds. i check the openvpn server but no user is connected and it is continously updating the last update in sql table. also, even if i turn off the NAS,, the entry still updates by itself.. (a ghost??) can anyone point out what other factors might causing this update? what files? pls help thanks

3 2

Custom sql post-auth help
by Trey Briggs 05 Apr '11

05 Apr '11

Hi, I'm trying to get similar logging in mysql to what you see with: log { ... auth = yes auth_badpass = yes auth_goodpass = yes } "Login OK: [<user>/<pass>] (from client <client> port 0)" I've found how to log accepts and rejects using the sql module in the post-auth section, but I'm unsure how to insert the client info (name or IP is fine). Here's what I've tried: sql/mysql/dialup.conf postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate, nas_ip, nas_id) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{NAS-Identifier}', \ '%{reply:Packet-Type}', '%S', \ '%{NAS-IP-Address}')" It doesn't appear that the "NAS-IP-Address" has any data at this point in the chain, the debug output shows this as the query run: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, nas_id, reply, authdate, nas_ip) VALUES ( 'XXXXX', 'xxxx', 'YYYYY', 'Access-Accept', '2011-04-04 13:56:33', '') Is there another variable I can use to get the client name/ip inserted into the db? Is this even possible in post-auth? Thanks in advance, -- Trey Briggs

2 1

How to make a NAS(Cisco) send MSCHAP request
by Raheel Itrat 04 Apr '11

04 Apr '11

Hello, To all Cisco guys out there how can I make a NAS(Cisco 2960 switch) to send MSCHAP requests to FR server instead of PAP requests. Thanks, Raheel

2 1

unlang question
by Omer Faruk SEN 04 Apr '11

04 Apr '11

I want to insert Quintum-h323-remote-address value to radacct table at sql/<db>/dialup.conf i have made my modifications but i see entries like h323-remote-address=3D10.241.1.202 which is h323-remote-address=10.241.1.202 but I only want 10.241.1.202 (IP address) My entry at details file: Quintum-h323-remote-address = "h323-remote-address=10.100.250.150" I want 10.100.250.150 PS: I know there is a hack for quintum but for some reason I am forced not to use it. I have looked at unlang but unable to find a solution for that. Regards.

2 1

Re: Strip off the domain part from the User-Name
by Thomas Wunder 04 Apr '11

04 Apr '11

Hi On Friday 25 March 2011 15:42:30 you wrote: > In which case, you *must* enable "with_ntdomain_hack = yes" As you suggested I changed the 'with_ntdomain_hack' option to 'yes' in four different locations (modules/preprocess, modules/mschap, eap.conf, modules/inner-eap) but still it doesn't work. I get the following error message (for a full debug log see attachment) which is new: ++[ldap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [tom1] (from client swtswitch01 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled I'm obviously missing something but I can't seem to find out what it is... Any ideas? Regards Tom

2 8

Creating freeRADIUS extensions (beginner)
by Tiberiu Breana 03 Apr '11

03 Apr '11

Hello. I'm doing my thesis project on advanced authentication techniques. I want to use freeRADIUS to implement extensions regarding one or more of the following: 1)Location-based authentication 2)Prepay codes for timed access 3)QoS parameters (allocate network resources according to the user's services) Do you think these extensions are 'doable' for a beginner? What are the major steps in implementing a new module? From what I've understood so far, I have to create a .c file and add some attributes to the dictionary. Is implementing new message types difficult? (does the finite-state machine need to be modified?) Any advice/information/tips are greatly welcome. Thanks!

2 1