- Freeradius-Users - lists.freeradius.org

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

That's a stupid question for someone with so many certs! ;) jus givn ya $hit. AKAIK it's not hard coded. In a config file somewhere is probably something like: if request type is 'x' then server inner-tunnel. Its been some time since I looked at the conf files so I can't say for sure which one and where. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:18:57 2011 Subject: Question on Virtual Servers and inner-tunnel Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

4 3

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

You could define new ones, change the existing one, both, etc. Generally speaking the default config just "works" unless you're doing something interesting. I can't say how/what you should do without knowing more about it. And then "I" prolly still can't, but others could. Since you're so self motivated, perhaps you could draft curriculum and tests for an FR cert? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:50:53 2011 Subject: Re: Question on Virtual Servers and inner-tunnel So I guess the follow up question is then, if I want to create multiple virtual servers, I am going to have to find this config file if I want those servers to deal with the inner-tunnel requests or are you suppose to just define another server in the inner-tunnel file if you want a second virtual server that deals with inner-tunnel requests? That was a lot of certs? I have a lot more, those are just the most recent....HeHe... I would attempt a cert in freeradius so I can pick it up faster but I never heard of a class for it much less a certification or training materials... Thanks for the fast response. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE >>> On Tuesday, January 25, 2011 at 3:40 PM, in message <13923_1295998812_4D3F5F5C_13923_216_1_D9B37353831173459FDAA836D3B43499AE519C4B(a)WADPMBXV0.waddell.com>, Gary Gatten <Ggatten(a)waddell.com> wrote: That's a stupid question for someone with so many certs! ;) jus givn ya $hit. AKAIK it's not hard coded. In a config file somewhere is probably something like: if request type is 'x' then server inner-tunnel. Its been some time since I looked at the conf files so I can't say for sure which one and where. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:18:57 2011 Subject: Question on Virtual Servers and inner-tunnel Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

New to the lists
by Tim McNabb 25 Jan '11

25 Jan '11

Hi all. Looking forward to picking your brains regarding FreeRADIUS as I'm kinda new to it. I took over administrative duties for the person who previously took care of our network and I'm trying to work with some of the FreeRADIUS settings and update to a newer version in the process. Current version is 1.0.4 (I know, it ancient), however also in the middle of a CentOS build while hoping to deploy that latest version of FreeRADIUS. I have a curious question though. Since the current version is substantially older than what we're moving to, how will this affect the sql database? Will I be able to install the newest version of FreeRADIUS and just perform a mysql dump from the old server to the new one? Thanks in advance, -Tim

4 5

SQL issue
by David Peterson 25 Jan '11

25 Jan '11

I am having a strange issue with the latest upgrade to the "Stable" version. It appears as though Freeradius is using a username of radius instead of the root user I have configured in sql.conf. Is there another area I should be looking for user name and password configuration? The only changes I made were to the dictionary.wimax and re-compile to move to the newer version. Debug: Tue Jan 25 11:53:38 2011 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius Tue Jan 25 11:53:38 2011 : Error: rlm_sql_mysql: Mysql error 'Access denied for user 'radius'@'localhost' (using password: YES)' David

2 2

Parse error after Freeradius Migration (Ascend binary attribute)
by tobias.gruenewald 25 Jan '11

25 Jan '11

Hello, I am working on migrating from freeradius 1.1.0 (manually compiled) to 2.1.8 (from Ubuntu repository). Right now I am stuck with the parsing of the configuration files. The files are working flawless on the old server but lead to a parsing error on startup on the new. I tried delving into the source code but didn't have the time to really understand all called functions. I'm not sure where the error is, because the formatting of the filter looks quite right to me. I'm pasting the error and the relevant portion of the configuration file, in hope someone sees where my problem is. # cat /var/log/freeradius/radius.log Error: users.smart[11]: Parse error (reply) for entry user: failed to parse Ascend binary attribute: failed to parse Ascend binary attribute: # cat users.smart user User-Password := "password" Service-Type = Framed-User, Framed-Protocol = PPP, Ascend-Assign-IP-Pool = 1, Framed-Netmask = "255.255.255.255", Ascend-Metric = 1, Framed-Routing = None, Ascend-Idle-Limit = 3600, Ascend-Route-IP = Route-IP-Yes, Ascend-Data-Filter = "ip in drop udp dstport = 9", Ascend-Data-Filter = "generic in forward 0 0 0" Regards, Tobias -- View this message in context: http://freeradius.1045715.n5.nabble.com/Parse-error-after-Freeradius-Migrat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

dynamic VLAN assignment w/ mschapv2 against AD and LDAP
by schilling 25 Jan '11

25 Jan '11

Hi All, The group helped me configure the freeradius server to do mschapv2 against ldap w/ ntPassword if user sign on with username(a)foo.edu, and to do mschapv2 against AD w/ ntlm if user just sign on with username. Now I want to go one more step further - passing on some attributes back to NAS. Basically, I want to achieve If (ldap authorization) { if (ldap.employeeStatus = facstaff) { REPLY{'Service-Type'} = "Framed-User"; REPLY{'Tunnel-Type'} = "VLAN"; REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; REPLY{'Tunnel-Private-Group-Id'} = "facstaff"; } else { # no ldap.employeeStatus attribute or ldap.employeeStatus != facstaff REPLY{'Service-Type'} = "Framed-User"; REPLY{'Tunnel-Type'} = "VLAN"; REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; REPLY{'Tunnel-Private-Group-Id'} = "student"; } }else { # ntlm authentication REPLY{'Service-Type'} = "Framed-User"; REPLY{'Tunnel-Type'} = "VLAN"; REPLY{'Tunnel-Medium-Type'} = "IEEE-802"; REPLY{'Tunnel-Private-Group-Id'} = "facstaff"; } What's the easiest way to accomplish this? unlang? perl module? Where to start? Thanks, Schilling from schilling <schilling2006(a)gmail.com> to FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> date Tue, Dec 14, 2010 at 3:14 PM subject Re: One virtual server for MS-chapv2 against AD w/ ntlm_auth, the other one against ldap ntpasswd hash possible? mailed-by gmail.com Got the whole setup working. So basically if users sign on with username(a)foo.edu with eap, they will be sent to ldap w/ ntpassword authorization. If users sign on with username only with eap, they will be sent to active directory w/ ntlm authentication. configuration changes are the following: etc/raddb/proxy.conf add realm foo.edu { } realm NULL { } /etc/raddb/site-enabled/inner-tunnel at the ldap line in authorize section add switch "%{Realm}" { case foo.edu { ldap #see /etc/raddb/module/mschap if ntpassword available, then do not use #NTLM_auth update control { MS-CHAP-Use-NTLM-Auth := NO } case NULL { mschap } } etc/raddb/module/mschap, etc/raddb/module/ntlm are all from integrate with Active Directory howto.

5 11

EAP TTLS: Getting the EMSK key‏
by Daniel 25 Jan '11

25 Jan '11

Hi all, I am new to radius and am using it in for a wimax based EAP TLS/TTLS network. Right now, I have freeradius 1.1.7 already installed and working. What I need is to retrieve the calculated EMSK key (for testing purposes) from the radius server to the NAS. I have managed to get the MSK key, but for some reason I cannot retrieve the EMSK key. What do I need to do? Would upgrading to a newer version of freeradius help? Thanks, Daniel. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TTLS-Getting-the-EMSK-key-tp335… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

rlm_realm module, Realm attr value
by Martin Stanislav 25 Jan '11

25 Jan '11

G'day, FreeRADIUS rlm_realm module feeds the Realm attribute with a configured value that matched the realm as entered by the user. There is one exception. If the matched configured value is a regex, the realm as entered by the user is used to feed the Realm attribute value. There is one more case that could get this exception like treatment. If the configured realm value is "DEFAULT", the realm as entered by the user could be used to feed the Realm attribute value. Attached diff file describes the code change. Alternatively, unlang can be employed to get the details into the Realm attribute. If placed within the authorize section after the realm module instance call (the suffix instance and delimiter = '@' is assumed to be in use in this case): if (Realm == "DEFAULT" && User-Name =~ /(a)(.*)$/) { update request { Realm := "%{1}" } } Kind regards, Martin

4 6

Increasing the timeout of LDAP
by JAVIER MAGAZ FERNANDEZ 25 Jan '11

25 Jan '11

Hello, We're working with FreeRADIUS Version 2.1.8, for host sparc-sun-solaris2.10, with PAP authentication against LDAP. It works fine but... from time to time it appears the error in 'radius.log': Error: [ldap] ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. We've tried to increase the value of 'timeout' in modules/ldap, to 10 or 20 (as it appears to be the default). But looking at the debugger's ouput (radiusd -X) it allways says that timeout = 4, and the errors continue appearing. ¿How can we increase the timeout? Best regards.

2 1

2-factor-authentication with freeradius
by Marius.Meisner 25 Jan '11

25 Jan '11

Hi I'm trying to develop a two-factor-authentication with freeradius (if there isn't something compareable). For this I want to use first pap-authentication from freeradius. After that I want radius to ask for a second password and call a script which is sending a otp over an sms-gateway to the users phone. You can imagine the second factor as kind of mobile TAN. The sms-gateway works so far and isn't part of my question. I've found nothing like this in any howto or tutorial so far, instead of eap. Any ideas how to get it to work? Is the part the radius ask for second questions possible with a request-challenge or is ist something completly different? Where could I get further information about syntax used in users-file and client.conf -file to include scripts? Is the way over the files above a possible solution or should I use pam-files? Any ideas where to get more information? any kind of hinds are welcome MM

2 1