- Freeradius-Users - lists.freeradius.org

FreeRadius between VPN Users and Safeword/RSA Servers
by Hemachandran Nair 16 Mar '11

16 Mar '11

Hi, I need to configure the Free Radius (as proxy) to forward the authentication request to safeword and RSA Servers from AT & T VPN Users based on user@norealm and user@realm condition. Users - VPN - Free Radius - Safeword & RSA Example: User - VPN - Free Radius (no realm, so nostrip) and pass the authentication to safeword servers. User(a)ab.abc.com - VPN - Free Radius (strip realm name) and pass the authentication to RSA servers. How do I configure the Free Radius as a proxy to achieve this. Also I need to configure 2 FreeRadius (as proxy) Server to achive High Availability, can I configure the same on both the servers. If the above is not possible can I use an NPS Radius Proxy to achive this, but in this case where should I place the FreeRadius, between VPN and NPS or between NPS and safeword. My Safeword does not support EAP, so I cannot achieve this by NPS Radius proxy directly forwarding request to safeword. Thank you in advance. Nair

1 0

Status of 2.1.11/OSCP Implementation
by Rudolph Bott 15 Mar '11

15 Mar '11

Hello Alan/Hello List, on Nov 19, 2010 you wrote: Alex Bergmann wrote: > Back in 2004 I've finished my diploma thesis covering OCSP integration > in the EAP/TLS module of freeRADIUS. Unfortunately I never posted the > patch. To get this burden off me, I've dug through the code again, did > some final adjustment and just finished the patch for the v2.1.x branch. This is very useful! > I've added a new subsection inside the eap/tls configuration that makes > it able to set the following settings. (A detailed description can be > found in the patch.) I'll take a look, and make sure it goes in for 2.1.11. > I'm aware that the EAP/TLS module was extended with a verify section > that states OCSP explicitly. Nevertheless I would like to see this > functionality implemented directly into the rlm_eap_tls module. Yes, this is a good option to have. Alan DeKok. Do you already have an estimated release date (besides "when it's done") for 2.1.11? I would love to test out that feature! -- Mit freundlichen Grüßen/With Kind Regards Rudolph Bott

5 6

Can I have 2 virtual servers one in normal mode and the other in proxy mode created?
by Ranjith T 15 Mar '11

15 Mar '11

Hi, can I have 2 virtual servers created with the following set-up, - First virtual server configured as normal RADIUS server. - Second virtual server configured as proxy to external RADIUS server? Can anyone please point to me where I can find it? I had tried the readings from free radius, but could not find it. The sites-available/README section says the following,(and I am confused). 3. Capabilities and limitations The only sub-sections that can appear in a virtual server section are: listen client authorize authenticate post-auth pre-proxy post-proxy preacct accounting session All other configuration parameters (modules, etc.) are global. Thanks Ranjith T

2 1

Set reject in post-auth
by paul smith 15 Mar '11

15 Mar '11

Hi, I've been trying to set reject in the post-auth section if a certain attribute hasn't been set, but it doesn't seem to work (obviously I've messed it up) post-auth { if (!Session-Timeout) { update control { Auth-Type := Reject } } } Am I updating the wrong thing, or is it not possible to perform a reject in the post-auth? thanks, paul

3 4

DH parameter generation hanging
by Riccardo Veraldi 15 Mar '11

15 Mar '11

Hello, freeradius 2.1.10 here on soekris net5501 radiusd: FreeRADIUS Version 2.1.10, for host i386-unknown-openbsd4.9, built on Mar 11 2011 at 11:20:43 the problem is when starting freeradius, it hangs forever when generating DH parameters. Any clue on this problem ? thank you Rick Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/dev/arandom" random_file = "/dev/arandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ...............+.................................................................Child PID 17850 is taking too much time: forcing failure and killing child. ...............................+...................................+........................+.................................+..+...............................................................+..............+....

2 2

SQL Counter Escape String !
by Suman Dash 15 Mar '11

15 Mar '11

Please anyone advice me the way to escape run-time variables in freeradius. I am using STR_TO_DATE and freeradius run-time variable is over-riding the mysql time variables SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives 2012-03-14 21:37:23 in MySQL Whereas in freeradius SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives '14 0 2011 20:001122334455:_ 14 = Current Date 0 = MTU 2011 = Current Year 001122334455 = Calling-Station-ID _ = Speed I have tried escaping as per the thread http://freeradius.1045715.n5.nabble.com/Changing-the-format-of-a-date-attri… But no luck .. My Entire Counter is : query = "SELECT SUM(acctsessiontime) FROM tbl_acct where \ username = 'suman' AND acctstarttime BETWEEN \ (SELECT STR_TO_DATE((SELECT value FROM tbl_check \ WHERE username = 'suman' AND attribute = 'Activation'), '%d %M %Y %H:%i:%s')) \ AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' \ AND attribute = 'Expiration'), '%d %M %Y %H:%i:%s'))" The Above Query Ends Up Showing 14 0 2011 23:001122334455:_ Any help in this matter will be highly appreciated ! Cheers !

3 5

need someone to set up radius
by Matthew 15 Mar '11

15 Mar '11

I / we need someone to set up our radius. Our old 1.0.1 freeradius took a dive. We have just built a ubuntu 10.04 LTS server and install radius on it. We need it to take a handoff from Covad and authenticate our users. Prefer to use Mysql and dialup-admin interface. Will Pay money via paypal or check whichever you prefer. This is a contract position and will pay up to $400.00. You can also call 1-888-510-3614 US/Can, or 480-248-3933 outside there. E-mail is best though. Thank you. Go SuperNet by... The Web OnRamp Networks LLC

1 0

Access Accept vs Tunneled reply
by David Peterson 14 Mar '11

14 Mar '11

I am trying to work out where I would be putting attributes for Access Accept. I am sending the following in a reply: (822) [ttls] Got tunneled reply code 2 WiMAX-Classifer-Direction = Bi-Directional WiMAX-Classifer-Priority = 1 WiMAX-ClassifierID = 1 WiMAX-Downlink-QOS-Id = 1 WiMAX-Uplink-QOS-Id = 1 WiMAX-Transport-Type = Ethernet WiMAX-Direction = Bi-Directional WiMAX-Packet-Data-Flow-Id = 1 WiMAX-QoS-Id = 1 WiMAX-Schedule-Type = Best-Effort WiMAX-Maximum-Sustained-Traffic-Rate = 31457289 WiMAX-VLAN-ID = 192 R3-IF-Name = "vpws" PDFID = 1 MS-CHAP2-Success = 0xc0533d31434143314146453345463545453936444336303741423437383932303738433539 443531373533 MS-MPPE-Recv-Key = 0x7d918cc693141550f2c5b39922ad18da MS-MPPE-Send-Key = 0xe3fb5674a52feb22dee4a8c636909169 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed However, the NAS vendor states that the reply attributes should be sent during this portion of the radius handshake: Sending Access-Accept of id 72 to 172.16.4.2 port 1812 MS-MPPE-Recv-Key = 0x8616d5a2fbb28b308b5ddf419333f8a2a07b79bfbdd679b4161262be7480eb54 MS-MPPE-Send-Key = 0x7f856a84bf226204dc2c4c3f5a25c9d808cb584c1b927dafb1a09ab7a360cfc8 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{sm=1}D8F69CCE1EF580B70933A526924A2D0C" Currently I have the attributes listed as a group reply. How do I send the attributes needed during the access accept packet? David

8 17

String Escape in SQL Counter !
by Suman Dash 14 Mar '11

14 Mar '11

Please anyone advice me the way to escape run-time variables in freeradius. I am using STR_TO_DATE and freeradius run-time variable is over-riding the mysql time variables SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives 2012-03-14 21:37:23 in MySQL Whereas in freeradius SELECT STR_TO_DATE('14 Mar 2012 21:37:23','%d %M %Y %H:%i:%s') gives '14 0 2011 20:001122334455:_ 14 = Current Date 0 = MTU 2011 = Current Year 001122334455 = Calling-Station-ID _ = Speed I have tried escaping as per the thread http://freeradius.1045715.n5.nabble.com/Changing-the-format-of-a-date-attri… But no luck .. My Entire Counter is : query = "SELECT SUM(acctsessiontime) FROM tbl_acct where \ username = 'suman' AND acctstarttime BETWEEN \ (SELECT STR_TO_DATE((SELECT value FROM tbl_check \ WHERE username = 'suman' AND attribute = 'Activation'), '%d %M %Y %H:%i:%s')) \ AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' \ AND attribute = 'Expiration'), '%d %M %Y %H:%i:%s'))" The Above Query Ends Up Showing 14 0 2011 23:001122334455:_ Any help in this matter will be highly appreciated ! Cheers !

1 0

Concurrent Sessions per user
by Moayad Mohammad 14 Mar '11

14 Mar '11

Dear, Is there is a way to control the concurrent sessions per user? Regards,

3 3