- Freeradius-Users - lists.freeradius.org

freeradius running in single server mode?
by Alexandre Chapellon 17 Sep '09

17 Sep '09

I'm running freeradius on debien 5.0 system. I have noticed that freeradius only fork one process whereas it's not running in single server mode: ps aux | grep '^freerad.*\/usr\/sbin\/freeradius' freerad 1930 1.6 3.9 833900 82072 ? Ssl Sep15 25:42 /usr/sbin/freeradius my options for threads pool are set as below: thread pool { start_servers = 5 max_servers = 64 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } I thought I should have 5 freeradius processes forked at startup... Is there something wrong here? regards

2 2

help with freeradius authentication that does not require client-side certificates
by Jon Standley 17 Sep '09

17 Sep '09

Hello, I'm using freeradius 2.1.6 on CentOS 5.3. I'm trying to configure the RADIUS server to authenticate for several clients. I've read that certificate based authentication is more secure as I understand. However, the nature of my wireless network (with users changing on a rather constant basis) does not allow to use client-side certificates that they have to install in order to gain access to the network. I've attempted to read the manuals behind the different types of authentication and how to configure freeradius for them but I've just gotten lost. All I want is a simple challenge-answer system to authenticate the user to the network. It does not have to be via a web portal. Can someone please help me or guide me somewhere with a manual that goes through every step that isn't outdated as the one's I've tried either rely on an older version of freeradius or talk about areas in files that have either changed with freeradius2 or do not exist anymore. I would really appreciate any help and time anyone can spare. I apologize if this is the 10000000000th time you have seen this post. Thank you again. _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. http://clk.atdmt.com/GBL/go/171222985/direct/01/

2 2

Log file differentiation
by Nathan McDavit-Van Fleet 16 Sep '09

16 Sep '09

Is there anyway to have Freeradius log whether a connection is either PEAP or TTLS in the log file? Both of them indicated that it is through a TLS tunnel with no indication of the differences. FYI they are coming through the same NAS server. Nathan

3 2

Freeradius 2.x EAP-PEAP/MSCHAPv2 + LDAP
by Maverick 16 Sep '09

16 Sep '09

Hi, I'm kind of new to radius, and I would like to know if someone can tell me how to configure freeradius so I can authenticate wireless clients (Windows / Linux) but the users and passwords are stored in a openldap database. I've seen some tutorials on the net but they are all for freeradius 1.x

3 2

RE: Using Attributes to differentiate between different EAP types
by Nathan McDavit-Van Fleet 16 Sep '09

16 Sep '09

I'm trying the following code, I've tried most every variation ("request:EAP-Type", "request.EAP-Type","EAP-Type","outer.EAP-Type".) but freeradius does not even parse the configuration. I've tried %{} and just the bare variables (which works for "outer.NAS-IP-Address"). if("%{outer.request:EAP-Type}" == 21) { ldap_wireless } And I get the error /etc/freeradius/sites-enabled/inner-tunnel[131]: Parse error in condition at: "%{outer.request:EAP-Type}" == 21) Does anyone know where this information is accessible from? I'm not able to find any data for what's available in the different inner/outer/request structs (or whatever they might be). Thanks, Nathan Van Fleet

4 8

dynamic-clients help
by Deepak 16 Sep '09

16 Sep '09

Hi, I am using freeradius 2.1.6 in CentOS 5.3 with mysql backend. As a follow up question to my previous posting, I have modified the following in dynamic-clients file. ====================================================== client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 86400 } server dynamic_client_server { authorize { preprocess chap mschap suffix unix sql expiration logintime pap noresetcounter dailycounter monthlycounter accessperiod update control { #FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" #FreeRADIUS-Client-Require-MA = no #FreeRADIUS-Client-Secret = "testing123" #FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}" #FreeRADIUS-Client-NAS-Type = "other" #FreeRADIUS-Client-Virtual-Server = "something" } if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } } ok } } ====================================================== I am not sure if I have to put all the modules as in the default file. I skipped the ========== eap { ok = return } ========== but rest is same as default in authorize section In my "nas" table, I have following: ==================== nasname: 0.0.0.0 shortname: <shortname> type: other ports: 0 secret: <sharedsecret> ==================== My AP have same secret set but still the request is ignored. What are the other things I need to consider? I am trying to authenticate users from NAS somewhere in the internet. Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

5 14

Parenthesis "()" question?
by Deepak 16 Sep '09

16 Sep '09

Hi, Just out of curiosity, I noticed that radius silently ignores the attributes in the group name with parenthesis. For example: =========== If groupname is "My Plan (Gold)", radius ignores the check attributes in this group when authenticating. If groupname is "My Plan Gold", it works fine. =============== Since I am not familiar with inner working of radius, just curious if parenthesis have special meaning. Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

1 0

input to radclient
by Rakotomandimby Mihamina 15 Sep '09

15 Sep '09

Hi all, I made preliminary tests for AUTH with radclient. now, I would like to make some ACCT tests (start, stop) and see if it updates the database. As far as I know, it's about echo "something" | radclient. Beside me is a working old installation I have detailed logs, like [1]: are those looking like what I should feed radcalient with? (I just have to provide the right password) [1]: cat of radacct/hostname/details-`date` [...] Tue Sep 1 15:54:21 2009 Vendor-14559-Attr-8 = 0x312e302e3134 Vendor-14559-Attr-10 = 0x00000000 Acct-Status-Type = Start User-Name = "Supv_logging" Calling-Station-Id = "00-24-2B-60-02-19" NAS-Port-Type = Wireless-802.11 NAS-Port = 7 NAS-Port-Id = "00000007" Framed-IP-Address = 10.150.0.134 Acct-Session-Id = "4a9d194e00000007" NAS-IP-Address = 10.150.0.1 Called-Station-Id = "00-90-0B-10-D0-8D" NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Acct-Unique-Session-Id = "0e888a6b0f97e6e0" Timestamp = 1251809661 Request-Authenticator = Verified Tue Sep 1 15:59:23 2009 Vendor-14559-Attr-8 = 0x312e302e3134 Vendor-14559-Attr-10 = 0x00000000 Acct-Status-Type = Interim-Update User-Name = "Supv_logging" Calling-Station-Id = "00-24-2B-60-02-19" NAS-Port-Type = Wireless-802.11 NAS-Port = 7 NAS-Port-Id = "00000007" Framed-IP-Address = 10.150.0.134 Acct-Session-Id = "4a9d194e00000007" NAS-IP-Address = 10.150.0.1 Called-Station-Id = "00-90-0B-10-D0-8D" NAS-Identifier = "nas01" Acct-Input-Octets = 189943 Acct-Output-Octets = 159669 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 617 Acct-Output-Packets = 856 Acct-Session-Time = 302 WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Acct-Unique-Session-Id = "0e888a6b0f97e6e0" Timestamp = 1251809963 Request-Authenticator = Verified [...] -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

1 1

request for experience with LDAP
by Rakotomandimby Mihamina 15 Sep '09

15 Sep '09

Hi all I am going to make the try to use LDAP with FreeRadius 2 - Just CHAP - No encryption - Clear text password - dialup (with credit --) accounting All on Debian Lenny, packaged only. Has anyone written down his notes for that usage? Would like to share? :-P -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 1

Using Attributes to differentiate between different EAP types
by nmcdavit＠alcor.concordia.ca 15 Sep '09

15 Sep '09

I have configured a Freeradius server to work with PEAP using NTLM_AUTH. Everything worked fine and tested out perfectly. Since then I added a configuration for EAP_TTLS, which really just means I added a configured LDAP module ldap_myconfig into the inner-tunnel. Unfortunately the PEAP connection no longer works, but the TTLS does. PEAP is my default EAP type. So Im pretty sure the simplest fix is to just have a if operator and for something like If(rlm_eap_type == EAP/TTLS) { ldap_myconfig} The only problem is that I have not seen any such attribute for freeradius. I figure there should very well be something akin to that as a run time variable correct? Regards, Nathan Van Fleet

6 8