- Freeradius-Users - lists.freeradius.org

syntax to discharge my mac Address
by luis ramiro ochoa torres 14 Dec '10

14 Dec '10

hello I have a problem, not what the syntax should I use to insert the mac addresses of users in the users file

3 3

Is there some syntax or rules should I follow?
by luis ramiro ochoa torres 14 Dec '10

14 Dec '10

Description of my Operating system: Ubuntu 9.10 Version 2.1.10. tar.gz of freeradius in the user file and remove some comments to add users, I've put everything you need, just do not know how to declare the MAC addresses to access let me alone with them, apart from the IP Is there some syntax or rules should I follow? What I can do about it? I hope to be concrete and someone can help me

1 0

vs ippoll configuration
by Arne Larsen 13 Dec '10

13 Dec '10

Hi all. I*m new to freeradius and I'm trying to get it working with an pool af ip.addr. Can someone tell me how this works exactly. I can se that the pool is defined n the modules under freeradius2, and the declaration seems straight forward. But when I try to test the config with the radtrest I can't see any address in the responce. steve Cleartext-Password := "testing", Pool-Name := "main_pool" What am I missing here ?? Regards Arne

2 1

Stop after mac auth
by Rob Yamry 13 Dec '10

13 Dec '10

99% of my config authenticates against ldap. There are certain situations (mainly authenticating our old phones) where I need to have mac auth as well. Both methods are authenticating fine. The problem is that I would like for freeradius to not search ldap when the "if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i))" comes back as TRUE. As the config is now (output below), it runs the condition and regardless of the outcome it performs a search against ldap for the mac, which will always fail and causes unnecessary queries. How can I accomplish this? ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^00-24-d6-a6-ce-ce$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> TRUE ++- entering if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) {...} +++[control] returns noop ++- if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) returns noop ++[chap] returns noop [ldap] performing user authorization for 00-24-d6-a6-ce-ce [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> 00-24-d6-a6-ce-ce [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=00-24-d6-a6-ce-ce) [ldap] expand: o=kasd -> o=kasd [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.company.com:389, authentication 0 [ldap] setting TLS CACert File to /etc/raddb/certs/CA.pem [ldap] starting TLS [ldap] bind as cn=radmin,o=org/<password> to ldpa.company.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=org, with filter (cn=00-24-d6-a6-ce-ce) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CSID +- entering group CSID {...} ++? if (Chap-Password) ? Evaluating (Chap-Password) -> FALSE ++? if (Chap-Password) -> FALSE ++- entering else else {...} +++[ok] returns ok ++- else else returns ok Login OK: [00-24-d6-a6-ce-ce] (from client kasd port 0 cli 00-24-d6-a6-ce-ce) +- entering group post-auth {...} ++[ldap] returns noop ++[exec] returns noop ++? if (control:Auth-Type == 'CSID') ? Evaluating (control:Auth-Type == 'CSID') -> TRUE ++? if (control:Auth-Type == 'CSID') -> TRUE ++- entering if (control:Auth-Type == 'CSID') {...} [authorized_macs] expand: %{Calling-Station-ID} -> 00-24-d6-a6-ce-ce [authorized_macs] users: Matched entry 00-24-d6-a6-ce-ce at line 1 +++[authorized_macs.authorize] returns ok +++? if (!ok) ? Evaluating !(ok) -> FALSE +++? if (!ok) -> FALSE ++- if (control:Auth-Type == 'CSID') returns ok Sending Access-Accept of id 65 to 10.1.2.85 port 53168 Reply-Message = "MyLaptop" Service-Type := Call-Check Filter-Id = "Students" Finished request 0.

2 2

Re: ldap - edirectory authentication
by Gary Gatten 13 Dec '10

13 Dec '10

Look in the configure script, or maybe try ./configure --help. Else the config options are probably listed in one of the readme's. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'FreeRadius users mailing list' <freeradius-users(a)lists.freeradius.org> Sent: Fri Dec 10 08:54:18 2010 Subject: RE: ldap - edirectory authentication Not too sure. We've looked thru all the conf's. Where would I look? robert Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 >>> Gary Gatten <Ggatten(a)waddell.com> 12/10/2010 7:37 AM >>> It’s a configure flag no? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Robert Koskey Sent: Friday, December 10, 2010 8:30 AM To: FreeRadius users mailing list Subject: Re: ldap - edirectory authentication We really aren't too sure about that. We just installed it from the media that OpenSuse 11.3 came with. We have noticed the bit about the --with-edir but even when we downloaded and compiled the FR 2.1.10 (latest) we didn't see how we could install with that option. If you know, please shed some light. thanks, Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 >>> Peter Lambrechtsen <plambrechtsen(a)gmail.com> 12/9/2010 3:48 PM >>> You may need to comment out the logintime and pap sections, since this isn't a pap authentication. It seems like the password is being correctly extracted out of eDirectory using Universal Password, but are you sure that's properly configured in the build version of FreeRadius? On Fri, Dec 10, 2010 at 11:40 AM, Robert Koskey <rkoskey(a)rockyview.ab.ca<mailto:rkoskey@rockyview.ab.ca>> wrote: Can anyone help? We are trying to do a ldap authentication from novell's edirectory to an Aruba controller for wireless access. These are the error's we are getting. It used to work perfectly but the original radius server blew up. We installed a new one with the same configuration and it doesn't work. The problem areas are bold'ed. The problem seems to occur after the ldap authentication. I don't think we are entirely clear about the order in which the whole process happens. Any help or suggestions would be greatly appreciated. The set up is: OpenSuse 11.0 FreeRadius 2.0.5 We have tried: OpenSuse 11.3 FreeRadius 2.1.9 (same result) rad_recv: Access-Request packet from host 10.215.10.100 port 34806, id=218, length=199 User-Name = "jordanhkaltenbruner" NAS-IP-Address = 10.200.8.30 NAS-Port = 2 NAS-Identifier = "10.215.10.99" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "78CA39B5D3E5" Called-Station-Id = "000B8661AC58" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x02010018016a6f7264616e686b616c74656e6272756e6572 Aruba-Essid-Name = "SCHS-Student" Aruba-Location-Id = "SpringbankW2-9" Message-Authenticator = 0x4542e9b98b5978ca1ca52b7617910620 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@'<mailto:%27@%27> in User-Name = "jordanhkaltenbruner", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for jordanhkaltenbruner WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=jordanhkaltenbruner) expand: ou=springhigh_lab,o=springhigh -> ou=springhigh_lab,o=springhigh rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.215.0.3:636<http://10.215.0.3:636>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=admin,o=springhigh/???? to 10.215.0.3:636<http://10.215.0.3:636> rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=springhigh_lab,o=springhigh, with filter (uid=jordanhkaltenbruner) rlm_ldap: Added the eDirectory password 51601222 in check items as Cleartext-Password rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jordanhkaltenbruner authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> jordanhkaltenbruner attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 218 to 10.215.10.100 port 34806 Finished request 0. Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed. "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

4 4

Break Stream & disconnecting when use freeradius authentication.
by Robin 13 Dec '10

13 Dec '10

Hi Friends, I find a strange issue. When I only use Mikrotik RouterOS as PPPoE server to authenticate my DSL users, all is ok. But when I add FreeRaiuds as radius server and RouterOS as pppoe server, I find some users of using p2p video on demand will break stream of lost connection. At the time, user has to disconnect the DSL link manually and re-dial to network. When user log in again, about 1-2 minutes, user will break stream of lost connection again. P.S. If user uses download software, the issue will not appear. Is it because I don’t set Freeradius correctly? Thank you. Robin Lu

2 5

Freeradius COA trigger
by Johan Meiring 13 Dec '10

13 Dec '10

Hi, I have a freeradius setup generating COA successfully (when neccesary) after receiving accounting packets. This works well. Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking "disconnect" on a web page. I.e. I want to somehow "trigger" a coa that is not caused by an "update coa {}" block, but by some external trigger. Is this possible in any way? -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

5 7

Новое сообщение
by Vovan 13 Dec '10

13 Dec '10

http://samec.org.ua/

1 0

MySQL connection setup
by Robin 12 Dec '10

12 Dec '10

Hi Friends, There is a configuration in SQL.conf. Num_sql_socks= I would like to know if this value is set to smaller, fx. 20, can it cause breaking stream or disconnecting for DSL users? If I set it to larger, can it cause MySQL problem of “Too many connection”. I can’t find details information about this setting in SQL.conf file. I want to know what policy of setting numbers is. Thank you very much. Robin

3 2

can't login with LDAP username/password
by Kelly Kloen 10 Dec '10

10 Dec '10

hi there, first time here, what i want fix is.. we want to connect with freeradius to a website ( http://breul.swp.nl ) and login with LDAP username and password..( and later with a token ) now i can put in the username kekl and the good for now mypassword ;) but then i get a message cannot login... and the log of freeradius is : Listening on authentication address 192.168.5.16 port 1812 Listening on accounting address * port 1813 Listening on proxy address 192.168.5.16 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.1 port 4693, id=1, length=88 Service-Type = Login-User User-Name = "kekl(a)administratie.net" User-Password = "mypassword" NAS-IP-Address = 192.168.5.16 NAS-Identifier = "radius" NAS-Port-Type = Virtual +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "administratie.net" for User-Name = "kekl(a)administratie.net" rlm_realm: Found realm "administratie.net" rlm_realm: Adding Stripped-User-Name = "kekl" rlm_realm: Adding Realm = "administratie.net" rlm_realm: Proxying request from user kekl to realm administratie.net rlm_realm: Preparing to proxy authentication request to realm "administratie.net" ++[suffix] returns updated rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 44 to 127.0.0.1 port 1812 Service-Type = Login-User User-Name = "kekl" User-Password = "mypassword" NAS-IP-Address = 192.168.5.16 NAS-Identifier = "radius" NAS-Port-Type = Virtual Proxy-State = 0x31 Proxying request 0 to home server 127.0.0.1 port 1812 Sending Access-Request of id 44 to 127.0.0.1 port 1812 Service-Type = Login-User User-Name = "kekl" User-Password = "mypassword" NAS-IP-Address = 192.168.5.16 NAS-Identifier = "radius" NAS-Port-Type = Virtual Proxy-State = 0x31 Going to the next request Waking up in 0.9 seconds. Waking up in 18.9 seconds. Rejecting request 0 due to lack of any response from home server 127.0.0.1 port 1812 There was no response configured: rejecting request 0 Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> kekl(a)administratie.net attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 1 to 192.168.5.1 port 4693 Finished request 0. WARNING: Marking home server 127.0.0.1 port 1812 as zombie (it looks like it is dead). Waking up in 4.9 seconds. Cleaning up request 0 ID 1 with timestamp +649 Ready to process requests. why do can't i login ???? gr kloenie

2 1