- Freeradius-Users - lists.freeradius.org

Re: OT: email fail [was Re: Question on Virtual Servers and inner-tunnel]
by Gary Gatten 26 Jan '11

26 Jan '11

Hmmm, build/use a different email system? Genius! Why didn't I think of that.... ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Wed Jan 26 02:56:23 2011 Subject: OT: email fail [was Re: Question on Virtual Servers and inner-tunnel] Gary Gatten <Ggatten(a)waddell.com> wrote: > > And I don't have control over what our half dozen email processors do > to my email after I send it. > You live in a country that prevents you using any other SMTP server other than the one allocated to you? Unable to get a freebie email address (Gborg) that comes with SMTP submission? Unable to run your own SMTP server and/or buy your own domain. That's a terrible place to live, let me know so I know never to visit. If that's not the case, learn to use a non-(a)waddell.com email address though you undoubtedly have. Cheers -- Alexander Clouter .sigmonster says: Everything ends badly. Otherwise it wouldn't end. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

Did you read the part where I said I was just giving him $hit? OP did, and he got it. And I don't have control over what our half dozen email processors do to my email after I send it. But, just for you I'll see what I can do. Thanks. ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Wed Jan 26 00:49:27 2011 Subject: Re: Question on Virtual Servers and inner-tunnel Gary Gatten <Ggatten(a)waddell.com> wrote: > [-- multipart/alternative, encoding 7bit, 1 lines --] > > [-- text/plain, encoding base64, charset: utf-8, 38 lines --] > > That's a stupid question for someone with so many certs! ;) jus givn ya $hit. > > [snipped] > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > > > [-- text/html, encoding base64, charset: utf-8, 48 lines --] > > [-- text/plain, encoding 7bit, charset: us-ascii, 2 lines --] > ...says the guy sending HTML emails with a retarded 'disclaimer' attached to all outbound email. Before you pick on someone, please learn how to use your email client, it otherwise leaves you looking like a puppy curling one out on the carpet. Cheers -- Alexander Clouter .sigmonster says: Beam me up, Scotty! It ate my phaser! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

That's a stupid question for someone with so many certs! ;) jus givn ya $hit. AKAIK it's not hard coded. In a config file somewhere is probably something like: if request type is 'x' then server inner-tunnel. Its been some time since I looked at the conf files so I can't say for sure which one and where. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:18:57 2011 Subject: Question on Virtual Servers and inner-tunnel Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

4 3

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

You could define new ones, change the existing one, both, etc. Generally speaking the default config just "works" unless you're doing something interesting. I can't say how/what you should do without knowing more about it. And then "I" prolly still can't, but others could. Since you're so self motivated, perhaps you could draft curriculum and tests for an FR cert? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:50:53 2011 Subject: Re: Question on Virtual Servers and inner-tunnel So I guess the follow up question is then, if I want to create multiple virtual servers, I am going to have to find this config file if I want those servers to deal with the inner-tunnel requests or are you suppose to just define another server in the inner-tunnel file if you want a second virtual server that deals with inner-tunnel requests? That was a lot of certs? I have a lot more, those are just the most recent....HeHe... I would attempt a cert in freeradius so I can pick it up faster but I never heard of a class for it much less a certification or training materials... Thanks for the fast response. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE >>> On Tuesday, January 25, 2011 at 3:40 PM, in message <13923_1295998812_4D3F5F5C_13923_216_1_D9B37353831173459FDAA836D3B43499AE519C4B(a)WADPMBXV0.waddell.com>, Gary Gatten <Ggatten(a)waddell.com> wrote: That's a stupid question for someone with so many certs! ;) jus givn ya $hit. AKAIK it's not hard coded. In a config file somewhere is probably something like: if request type is 'x' then server inner-tunnel. Its been some time since I looked at the conf files so I can't say for sure which one and where. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:18:57 2011 Subject: Question on Virtual Servers and inner-tunnel Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

New to the lists
by Tim McNabb 25 Jan '11

25 Jan '11

Hi all. Looking forward to picking your brains regarding FreeRADIUS as I'm kinda new to it. I took over administrative duties for the person who previously took care of our network and I'm trying to work with some of the FreeRADIUS settings and update to a newer version in the process. Current version is 1.0.4 (I know, it ancient), however also in the middle of a CentOS build while hoping to deploy that latest version of FreeRADIUS. I have a curious question though. Since the current version is substantially older than what we're moving to, how will this affect the sql database? Will I be able to install the newest version of FreeRADIUS and just perform a mysql dump from the old server to the new one? Thanks in advance, -Tim

4 5

SQL issue
by David Peterson 25 Jan '11

25 Jan '11

I am having a strange issue with the latest upgrade to the "Stable" version. It appears as though Freeradius is using a username of radius instead of the root user I have configured in sql.conf. Is there another area I should be looking for user name and password configuration? The only changes I made were to the dictionary.wimax and re-compile to move to the newer version. Debug: Tue Jan 25 11:53:38 2011 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius Tue Jan 25 11:53:38 2011 : Error: rlm_sql_mysql: Mysql error 'Access denied for user 'radius'@'localhost' (using password: YES)' David

2 2

Parse error after Freeradius Migration (Ascend binary attribute)
by tobias.gruenewald 25 Jan '11

25 Jan '11

Hello, I am working on migrating from freeradius 1.1.0 (manually compiled) to 2.1.8 (from Ubuntu repository). Right now I am stuck with the parsing of the configuration files. The files are working flawless on the old server but lead to a parsing error on startup on the new. I tried delving into the source code but didn't have the time to really understand all called functions. I'm not sure where the error is, because the formatting of the filter looks quite right to me. I'm pasting the error and the relevant portion of the configuration file, in hope someone sees where my problem is. # cat /var/log/freeradius/radius.log Error: users.smart[11]: Parse error (reply) for entry user: failed to parse Ascend binary attribute: failed to parse Ascend binary attribute: # cat users.smart user User-Password := "password" Service-Type = Framed-User, Framed-Protocol = PPP, Ascend-Assign-IP-Pool = 1, Framed-Netmask = "255.255.255.255", Ascend-Metric = 1, Framed-Routing = None, Ascend-Idle-Limit = 3600, Ascend-Route-IP = Route-IP-Yes, Ascend-Data-Filter = "ip in drop udp dstport = 9", Ascend-Data-Filter = "generic in forward 0 0 0" Regards, Tobias -- View this message in context: http://freeradius.1045715.n5.nabble.com/Parse-error-after-Freeradius-Migrat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

dynamic VLAN assignment w/ mschapv2 against AD and LDAP
by schilling 25 Jan '11

25 Jan '11

Hi All, The group helped me configure the freeradius server to do mschapv2 against ldap w/ ntPassword if user sign on with username(a)foo.edu, and to do mschapv2 against AD w/ ntlm if user just sign on with username. Now I want to go one more step further - passing on some attributes back to NAS. Basically, I want to achieve If (ldap authorization) { if (ldap.employeeStatus = facstaff) { REPLY{'Service-Type'} = "Framed-User"; REPLY{'Tunnel-Type'} = "VLAN"; REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; REPLY{'Tunnel-Private-Group-Id'} = "facstaff"; } else { # no ldap.employeeStatus attribute or ldap.employeeStatus != facstaff REPLY{'Service-Type'} = "Framed-User"; REPLY{'Tunnel-Type'} = "VLAN"; REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; REPLY{'Tunnel-Private-Group-Id'} = "student"; } }else { # ntlm authentication REPLY{'Service-Type'} = "Framed-User"; REPLY{'Tunnel-Type'} = "VLAN"; REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; REPLY{'Tunnel-Private-Group-Id'} = "facstaff"; } What's the easiest way to accomplish this? unlang? perl module? Where to start? Thanks, Schilling from schilling <schilling2006(a)gmail.com> to FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> date Tue, Dec 14, 2010 at 3:14 PM subject Re: One virtual server for MS-chapv2 against AD w/ ntlm_auth, the other one against ldap ntpasswd hash possible? mailed-by gmail.com Got the whole setup working. So basically if users sign on with username(a)foo.edu with eap, they will be sent to ldap w/ ntpassword authorization. If users sign on with username only with eap, they will be sent to active directory w/ ntlm authentication. configuration changes are the following: etc/raddb/proxy.conf add realm foo.edu { } realm NULL { } /etc/raddb/site-enabled/inner-tunnel at the ldap line in authorize section add switch "%{Realm}" { case foo.edu { ldap #see /etc/raddb/module/mschap if ntpassword available, then do not use #NTLM_auth update control { MS-CHAP-Use-NTLM-Auth := NO } case NULL { mschap } } etc/raddb/module/mschap, etc/raddb/module/ntlm are all from integrate with Active Directory howto.

5 11

EAP TTLS: Getting the EMSK key‏
by Daniel 25 Jan '11

25 Jan '11

Hi all, I am new to radius and am using it in for a wimax based EAP TLS/TTLS network. Right now, I have freeradius 1.1.7 already installed and working. What I need is to retrieve the calculated EMSK key (for testing purposes) from the radius server to the NAS. I have managed to get the MSK key, but for some reason I cannot retrieve the EMSK key. What do I need to do? Would upgrading to a newer version of freeradius help? Thanks, Daniel. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TTLS-Getting-the-EMSK-key-tp335… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

rlm_realm module, Realm attr value
by Martin Stanislav 25 Jan '11

25 Jan '11

G'day, FreeRADIUS rlm_realm module feeds the Realm attribute with a configured value that matched the realm as entered by the user. There is one exception. If the matched configured value is a regex, the realm as entered by the user is used to feed the Realm attribute value. There is one more case that could get this exception like treatment. If the configured realm value is "DEFAULT", the realm as entered by the user could be used to feed the Realm attribute value. Attached diff file describes the code change. Alternatively, unlang can be employed to get the details into the Realm attribute. If placed within the authorize section after the realm module instance call (the suffix instance and delimiter = '@' is assumed to be in use in this case): if (Realm == "DEFAULT" && User-Name =~ /(a)(.*)$/) { update request { Realm := "%{1}" } } Kind regards, Martin

4 6