- Freeradius-Users - lists.freeradius.org

Acc-Session-Id Question
by JOE 28 Jun '10

28 Jun '10

Hi all! In radius schema, the RADACCT table specifies that field ACCTSESSIONID is NOT NULL. Actually a have a NAS that not sends this attribute on Accounting Request and the update RADACCT table fails. The question I have is if this attribute is required to comply with RFC or otherwise use is optional. Regards

2 1

can freeradius support l2tp/ipsec?
by Spacelee 28 Jun '10

28 Jun '10

maybe it's not freeradius's problem, but do you have any experience with l2tp/ipsec...I didn't find any solution valuable... -- Spacelee

1 0

howto start one connection and start another one?
by Spacelee 28 Jun '10

28 Jun '10

it seems in dialup.conf, I can't change the settings to automatically stop user's one connection and start another when he dialup on his another system, the simu was set equal to 1 -- Spacelee

2 3

PEAP - AD Disabled
by Nathan McDavit-Van Fleet 27 Jun '10

27 Jun '10

Okay, I've had a working config with the following for the past month. TTLS->LDAP PEAP->AD PEAP->Local Users File After a month running everything perfectly, 3 days ago the "PEAP-AD" portion of the AAA failed. This is for wireless auth. Strangely, I can still auth from the CLI using ntlm_auth and wbinfo. So it appears as if the Samba connection to the AD is fine. Nothing has changed config wise between then and now, and I haven't found any interesting log information. You just get a "Login incorrect" when you try to login via PEAP->AD. Everything else is verified as working. Aside from Freeradius itself, what are the differences between using ntlm_auth via CLI and via Freeradius? Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434

4 4

about simultaneous when using mysql and freeradius
by Spacelee 27 Jun '10

27 Jun '10

i want to limit user's behavior, such as a username can login only once at the same time... 1、modifiy default and inner-tunnel in # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # See "Simultaneous Use Checking Querie" in sql.conf sql } 2、modify dialup.conf in etc/raddb/sql/mysql # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" 3、add a entry to the table radgorucheck INSERT INTO `radgroupcheck` ( `id` , `GroupName` , `Attribute` , `op` , `Value` ) VALUES ( NULL , ’user’, ’Simultaneous-Use’, ’:=’, ’1’ ); 4. update the user "test" to the group "user" i finally tried successfully, but if , i say if the radius server was down suddenly or the user logout improperly(such as he poweroff the computer directly). then the record will still be record in the table as he was still online ...so we need to modify the record, but how to ? can freeradius judge it by itself, or how to judge the user if offline ? -- Spacelee -- Spacelee

4 7

chroot
by Mike Hammett 26 Jun '10

26 Jun '10

I read the appropriate section in radiusd.conf, but I don't know what needs to be in whatever folder I'm pointing the config to. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com

2 1

Help connecting to remote ldap server
by Raymond Norton 25 Jun '10

25 Jun '10

I successfully configured freeradius (version 1.x Ubuntu) to use ldap on a localhost via WPA. I am trying to setup version 2.1 (Ubuntu) to use a remote ldap server now. The module loads fine and I made what I believed were the correct changes to connect to the remote server, but I have missed something. Is there a good doc for ldap authentication on a remote host? Raymond

7 31

EAP issue
by David Peterson 25 Jun '10

25 Jun '10

I am having EAP issues with MSCHAPv2 packets. Does this output point to misconfiguration of FR or a NAS issue or both? Fri Jun 25 10:42:30 2010 : Info: ++[pap] returns noop Fri Jun 25 10:42:30 2010 : Info: Found Auth-Type = MSCHAP Fri Jun 25 10:42:30 2010 : Info: +- entering group MS-CHAP {...} Fri Jun 25 10:42:30 2010 : Info: [mschap] Told to do MS-CHAPv2 for 0010E741540D(a)WiMax.com with NT-Password Fri Jun 25 10:42:30 2010 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Fri Jun 25 10:42:30 2010 : Info: ++[mschap] returns reject Fri Jun 25 10:42:30 2010 : Info: Failed to authenticate the user. } # server inner-tunnel Fri Jun 25 10:42:30 2010 : Info: [ttls] Got tunneled reply code 3 Framed-Filter-Id = "SP=sp1:MSF=msf1;" Session-Timeout = 4200 MS-CHAP-Error = "LE=691 R=1" Fri Jun 25 10:42:30 2010 : Info: [ttls] Got tunneled Access-Reject Fri Jun 25 10:42:30 2010 : Info: [eap] Handler failed in EAP/ttls Fri Jun 25 10:42:30 2010 : Info: [eap] Failed in EAP select Fri Jun 25 10:42:30 2010 : Info: ++[eap] returns invalid David

2 1

EAP-TTLS,SecureW2 issue
by Philippe Schwarz 24 Jun '10

24 Jun '10

Hi, I've built a FR-2.1.3 (with rlm ldap) on OpenBSD, with credentials on a OpenLDAP (2.3.30-5+etch3), using EAP-TTLS. Everything, 's working fine with Iphone,Linux &MacOS. But with Windows (XP, Vista & 7), i'm unable to get the SecureW2 (v3.3.3.) client connecting. 1. Downloaded locally both the CA & Radius .der certificates 2. Installed both of them of local computer. 3. Add both (and also tried only radius cert, or no cert at all) certs to SecureW2. But Always got : "Received an invalid server certificate, please verify your certificate configuration" response from the software. All the steps (in french) : http://www.openbsd-edu.net/index.php/FreeRadius Found almost nothing usable either on the Securew2 website or on the goggled links... If anyone had an idea.. Thanks. -- Lycée Alfred Nobel, Clichy sous Bois http://www.lyceenobel.org

2 1

Am I going to cause a problem with this config setup?
by Tom Leach 24 Jun '10

24 Jun '10

I'm trying to configure Freeradius to use LDAP (which is working), but I need to mix PAP and CHAP. I have a wireless web-auth that uses PAP and is sending the cleartext password (tunneled via TLS) to the LDAP database that contains the encrypted (SSHA) user passwords. I also have switches that only do CHAP but for those, I'm only going to do MAC-auth so I've set up a separate database (same LDAP server, different basedn) that contains cleartext passwords (the MAC address) for each MAC that is authorized for the switch. I know it's not the best access control, but better then none. I've set up 4 ldap modules, two different basedn's on two redundant servers. This appears to work so far, but am I missing something here that's going to cause problems down the line??? Here are the authorize and authenticate sections of default, I haven't removed mschap, suffix, eap, unix or files, but none of them _should_ be used.: authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files redundant-load-balance { ldap-server1-radius ldap-server2-radius } redundant-load-balance { ldap-server1 ldap-server2 } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant-load-balance { ldap-server1 ldap-server2 } } eap }

2 1