- Freeradius-Users - lists.freeradius.org

Question on proxy setting
by 柴崎　昌一 27 Jul '10

27 Jul '10

Hello, We want to re-send Accounting-Request again by using the Proxy server. Because our NAS doesn't send Accounting-Request again. We want to set it to "Synchronous=no". Can I make it to "Synchronous=no"? M.Shibasaki

2 1

Integration Question
by Sallee, Stephen (Jake) 26 Jul '10

26 Jul '10

Does anyone have any experience integrating FreeRADIUS with an FOSS package called PacketFence? If you do, and are willing, please drop me a line. Jake.Sallee(at)umhb(dot)edu. Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

1 0

Disconnect user to turn off windows
by jorge88 26 Jul '10

26 Jul '10

Good afternoon, Someone could help me? When a user need to turn off the computer, you are automatically disconnect the session. Is this possible? Thank you very much Regards Jorge -- View this message in context: http://old.nabble.com/Disconnect-user-to-turn-off-windows-tp29266422p292664… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

SV: Freeradius-Users Digest, Vol 63, Issue 75
by Saleh Abuzid 26 Jul '10

26 Jul '10

Hello, Im resending agian this question with a hope that someone can respond. -----Opprinnelig melding----- Fra: freeradius-users-bounces+saleh.abuzid=hist.no(a)lists.freeradius.org [mailto:freeradius-users-bounces+saleh.abuzid=hist.no@lists.freeradius.org] På vegne av freeradius-users-request(a)lists.freeradius.org Sendt: 20. juli 2010 20:37 Til: freeradius-users(a)lists.freeradius.org Emne: Freeradius-Users Digest, Vol 63, Issue 75 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. proxy everyone (marco perugini) 2. Re: Redirection to the NAS of an external CoA request (newtownz) 3. Re: proxy everyone (Alan DeKok) 4. Re: Redirection to the NAS of an external CoA request (Alan DeKok) 5. Re: Acct-Interim-Interval not working (Alan DeKok) 6. AD groups in user file for dynamic Vlans (Saleh Abuzid) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Jul 2010 19:12:45 +0200 From: marco perugini <m.perugini(a)4it.it> Subject: proxy everyone To: freeradius-users(a)lists.freeradius.org Message-ID: <4C45D90D.2070909(a)4it.it> Content-Type: text/plain; charset=ISO-8859-15; format=flowed hi list! i'm setting up my freeradius architecture with a single proxy and multiple servers; here's my scenario: freeradius server # 1 -> my own server [realm local.net] freeradius server # 2 -> external server [realm ext.net] freeradius proxy -> i know everything about users i proxy towards my server [# 1] but i don't know anything about users i proxy towards external server [# 2]. i would proxy every_username(a)ext.net just to log requests. so this is my question for you: can i use rlm_realm to proxy an entire realm without knowing the usernames just to trace auth/acct requests? or i'm crazy at all? i hope you'll understand my question......... ;) thanks, duffy ------------------------------ Message: 2 Date: Tue, 20 Jul 2010 10:38:32 -0700 (PDT) From: newtownz <jean466(a)sympatico.ca> Subject: Re: Redirection to the NAS of an external CoA request To: freeradius-users(a)lists.freeradius.org Message-ID: <29216134.post(a)talk.nabble.com> Content-Type: text/plain; charset=us-ascii Here are a few lines from my cfg files: In radiusd.conf: proxy_requests = yes $INCLUDE proxy.conf In proxy.conf: #(this is where I want to forward) home_server aruba { type = coa ipaddr = xx.yy.110.148 port = 1812 src_ipaddr = xx.yy.110.128 coa { # Initial retransmit interval: 1..5 irt = 2 # Maximum Retransmit Timeout: 1..30 (0 == no maximum) mrt = 16 # Maximum Retransmit Count: 1..20 (0 == retransmit forever) mrc = 5 # Maximum Retransmit Duration: 5..60 mrd = 30 } secret = testing123 } home_server_pool to_aruba { home_server = aruba } ###Not really sure about the validity of the last 3 lines... And now I'm puzzled as to how to set the Home-server-pool as stated in recv-coa section of coa: recv-coa { # CoA && Disconnect packets can be proxied in the same # way as authentication or accounting packets. # Just set Proxy-To-Realm, or Home-Server-Pool, and the # packets will be proxied. I tried to find the way that it is done for authentication packet and did not succeed. Also I just want to know if my understanding about the whole process of proxying the CoA is right: The default server config file is of no use here, in the coa I have to state somehow that I want the request to be forwarded to the controller and in the proxy.conf file I have to create this controller-server so that freeradius won't complain about an unknown IP address. Jean Alan DeKok-2 wrote: > > newtownz wrote: >> I'm trying to figure out how to send a CoA from freeRadius >> to the NAS. The set-up I have involves two servers and an >> Aruba controller. > > i.e. proxying CoA packets through FreeRADIUS to the NAS. > > While this should work, it's not a deeply tested scenario. > >> In this test set-up the client authenticates locally on the >> freeRadius server. The server listen on port 3799 for a CoA request >> that is generated from another computer, the freeRadius accepts >> the request and sends a ACK to the generator but it does not >> send anything to the NAS, > > Did you configure the server to proxy the CoA request? Look for > "proxy" in raddb/sites-available/coa in 2.1.9. > >> I tried to supply in the request a >> NAS-IP-Address attribute and also tried with Packet-Dst-IP-Address >> with no success. Also tried different things in CoA and Originate-CoA >> with the same results. > > Well.. the "coa" documents exactly what you need to do. Trying random > *undocumented* things won't make it work. > >> The goal I'm trying to reach is to supply the user-name in the >> CoA request that will force the client to silently reconnect and >> in the meantime I will have changed the Access-List accessible to >> the client. > > Use a Disconnect-Request packet to make the client disconnect. > >> 1: Is it possible to send a CoA request to the freeRadius server >> and then have it relay the request to the Aruba controller? > > Yes. This is called "proxying" > >> 2: If it is possible what do I have to put in the configs file >> and where? > > This is documented. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- View this message in context: http://old.nabble.com/Redirection-to-the-NAS-of-an-external-CoA-request-tp2… Sent from the FreeRadius - User mailing list archive at Nabble.com. ------------------------------ Message: 3 Date: Tue, 20 Jul 2010 20:01:29 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: proxy everyone To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C45E479.8020700(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 marco perugini wrote: > so this is my question for you: can i use rlm_realm to proxy an entire > realm without knowing the usernames just to trace auth/acct requests? Yes. That's what realms are for. People have been doing this with RADIUS since 1995 or so. Alan DeKok. ------------------------------ Message: 4 Date: Tue, 20 Jul 2010 20:03:03 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Redirection to the NAS of an external CoA request To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C45E4D7.4010508(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 newtownz wrote: > And now I'm puzzled as to how to set the Home-server-pool > as stated in recv-coa section of coa: recv-coa { ... update control { Home-Server-Pool := to_aruba } ... } > I tried to find the way that it is done for authentication packet > and did not succeed. raddb/proxy.conf documents proxying for Access-Request && Accounting-Request packets. > Also I just want to know if my understanding about the whole > process of proxying the CoA is right: > > The default server config file is of no use here, in the coa > I have to state somehow that I want the request to be forwarded > to the controller and in the proxy.conf file I have to create > this controller-server so that freeradius won't complain about > an unknown IP address. Yes. You have to define WHERE it will be proxied. Since RADIUS uses shared secrets, you have to define the shared secret, too. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 20 Jul 2010 20:26:55 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Acct-Interim-Interval not working To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C45EA6F.2000001(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Bishal wrote: > I am using freeradius 2.1.6 on FreeBSD 7.2 and using rp-pppoe server > 3.10 on gentoo linux. During live session it is not updating > acct-input/ouput-octets. Is the NAS sending packets with those fields? What does debug mode say? > Earlier with mpd pppoe server on freebsd it was > working fine accounting input and output octets were updating every > 5mins as configured in mpd server but now I have migrated my pppoe > server to rp-pppoe and it's not updating account values. Well... this really sounds like an issue with rp-pppoe. Alan DeKok. ------------------------------ Message: 6 Date: Tue, 20 Jul 2010 20:37:09 +0200 From: "Saleh Abuzid" <Saleh.Abuzid(a)hist.no> Subject: AD groups in user file for dynamic Vlans To: <freeradius-users(a)lists.freeradius.org> Message-ID: <0A3AB621FFABE848BCA6FB42DB2E5A13045673(a)EX-VS01.ad.hist.no> Content-Type: text/plain; charset="iso-8859-1" Hello Freeradiususers, I m trying to get freeradius to send vlan id to some group in AD( win 2003), but it seems that radius can not pull out the info. about the groups even that the radius is joined in AD. Radius ignores the group and goes back to the default or preferred Vlan. I m runing the last vers. of FreeRadius, her is my config : DEFAULT Ldap-Group == XXXXXXXXX, NAS-IP-Address == "xxx.xxx.xxx.xxx" Service-Type = Login-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 210, Fall-Through = no When I remove the Ldap-Group then radius can send a req. to vlan 210. Just for info I m abel to pull out info. via wbinfo -g, I wonder if we have to do something in : /etc/freeradius/modules/mschap in last lines: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=AD --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Any sugg. Best regards Saleh Abuzid Gunnerus gate 1 H?gskolen i S?r-Tr?ndlag (HiST) SPO-IKT Avdelingsingeni?r tlf: 73559672 E-mail: Saleh.Abuzid(a)hist.no Saleh Abuzid Gunnerus gate 1 H?gskolen i S?r-Tr?ndlag (HiST) SPO-IKT Avdelingsingeni?r tlf: 73559672 E-mail: Saleh.Abuzid(a)hist.no Saleh Abuzid Gunnerus gate 1 H?gskolen i S?r-Tr?ndlag (HiST) SPO-IKT Avdelingsingeni?r tlf: 73559672 E-mail: Saleh.Abuzid(a)hist.no

2 1

Controlling with Auth-Type a client must use
by Madsen.Jan JMD 26 Jul '10

26 Jul '10

Hello Radius People I'm running freeradius 2.1.8 working great I'm using the radius servers to many different clients, specially Cisco nodes, and some Unix servers. I'm using the module passwd working fine, and I have enabled unix authentication in my default section. Now when a specific client try to send username password to my system the passwd modle is accepting the password fine, but the unix section is rejecting the password ending in a Access-Reject back to client Some debug here Thu Jul 22 13:22:21 2010 : Info: [kmdov3] Added crypt-Password: 'TLw0SiK4QfQxg' to config_items Thu Jul 22 13:22:21 2010 : Info: ++[kmdov3] returns ok ... .. . Thu Jul 22 13:22:21 2010 : Auth: [unix] [jmd]: invalid shell [/usr/bin/bash] Thu Jul 22 13:22:21 2010 : Info: ++[unix] returns reject I do know that the unix module reject because of a invalid shell, and chaning it to a valid shell fix this problem. But what I want to do is to set the client ONLY to use kmdov3 as my authentication and not the Unix one. Is this possible? I have been trying to use the Auth-Type attribute, but can't figure out how to tell that I want to use the kmdov3 authentication type. Best regards Jan Madsen

2 7

How to separate users to different server...
by Spacelee 26 Jul '10

26 Jul '10

Environment: PPTP+PPP+FREERADIUS+MYSQL+LINUX I want to separate users, for example, there are 10 users user1, user2 ... user10 I want user1, user2 ... user5 can only login server1 I want user6.................user10 can only login server2 if user1 login server2, could I sent a login failure? How to finish this task... Thanks... -- Spacelee

2 2

Re: ntlm_auth fails for none domain
by John 26 Jul '10

26 Jul '10

It finally works. Looks the format changed. --domain=%{mschap:NT-Domain:-xjtu} ==> works in freeradius-1.1.x, 2.1.x not works --domain=%{%{mschap:NT-Domain}:-xjtu} ==> works in freeradius-2.1.x, 1.1.x not works --- 10年7月8日，周四, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月8日,周四,下午2:10 Sorry. I did not set the 'xjtu' in the first time. But I set 'xjtu' after that. Pls see the second mail I wrote. I put ntlm_auth line to file 'mschap'. The attached file is my 'mschap' and the related debug info. --- 10年7月5日，周一, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> 写道：发件人: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月5日,周一,下午4:53 Hi, no...you havent added it. look, heres the debug you supplied > It is the related part in configuration file: > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" > > > It is debug info: > [mschap] Told to do MS-CHAPv2 for hhe with NT-Password > [mschap] No NT-Domain was found in the User-Name. > [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain= ^^^^^^^^^^^^^^^^^^^^^^^^^^^ where is xjtu mentioned there? is isnt. WHERE did you put the ntlm_auth line? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

(no subject)
by wadih jalad 25 Jul '10

25 Jul '10

http://jpd0.phenterminetabletspharmacy.com

1 0

FR virtual server question and EAP configuration
by Michal Bruncko 25 Jul '10

25 Jul '10

Hello list I am using FR with WPA2-Enterprise autentification in Wifi environment with this scheme: SSID 1 \ SSID 2 --- AP <-- Trunk --> Ruter <-----> FreeRadius SSID 3 / My goal is to configure different security for different SSID through one freeradius with virtual server feature. My first question is, if it's possible to have different FR server configuration per SSID on single Access Point? AP have its IP address from specific managemenet VLAN (different from any SSID X VLAN). I know, that on freeradius side can be configuration separated by client IP address, but in my scenario, the IP of radius client is same for every VLAN/SSID, but the only distinguished part in communication is "Called-Station-Id" in Access-Request with form: <radio-mac>:<ssid>. Ok, next question which is related a bit to previously one. I have presumted that freeradius cannot distinguishes between requests from different SSID, so I have configured different IP address of Radius server per SSID configuration on AP and all IP addresses are pointed to single radius server and I want to use one virtual server per listen IP address. But how I should to tell FR server, which EAP configuration must apply to which virtual server? Example: SSID 1: Security WPA2-Ent. with EAP-PEAP, for authorized mobile clients SSID 2: Security WPA2-Ent. with EAP-TLS, for persistent wifi computers with installed certificates How can I configure this situation with FR Virtual server feature? Can I simply copy, rename and modify "eap" part from eap.conf to "eap_2" and applying it in athorize/authenticate sections in second virtual server? It is enough? I have looking for any example for this scenario but whithout any success. thanks bruncko

3 3

How to set properly failover ?
by Jevos, Peter 23 Jul '10

23 Jul '10

Hi guys I'm really trying but it's not easy to find somehitng in the documenatiion. I have 2 modules ntlm_auth_vpn1/2 and I like to do failover. I tried this but I was not sucesfull: In the modules I have 2 files, ntlm_auth_vpn1 and ntlm_auth_vpn2 In the sites-available/default I have: # Allow EAP authentication. eap ntlm_auth ntlm_auth_vpn { group { ntlm_auth_vpn1 { reject = 1 ok = return } ntlm_auth_vpn2 { reject = 1 ok = return } } } In my users file is: DEFAULT Auth-Type := ntlm_auth_vpn, Fall-Through = Yes What should be the correct syntax ? Freeradius is great tool , however every step forward is like a childbirth : ) What I'm really missing is what should be placed where. I'd really enjoy the new book . I hope it will be released soon : ) Thanks Pet

3 3