- Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 49, Issue 87
by Ivan Kalik 20 May '09

20 May '09

> Hi Alan, > > > >> 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > >> to 192.168.1.3) > >> 2. Radius proxy listen on 192.168.1.3 for authentication packet and > >> forwarding them towards two different network (192.168.14.4 and > >> 192.168.24.4) > > > > 192.168.14.4 and 192.168.24.4 are 2 different Radius Servers. > > 192.168.14.4: Radius Server for IPS 1. > > 192.168.24.4: Radius Server for IPS 2. > > > > I need send the packets towards ISP1 using VLAN1 and towards ISP2 using > VLAN2. > And how will you know to which ISP does the user belong to? Normally they enter names like user@ISP1 and user@ISP2. That way you know to which home server to proxy to. Ivan Kalik Kalik Informatika ISP

1 0

Is it possible to share bandwidth or maximum downloaded bytes
by ngwarai zed 20 May '09

20 May '09

I have 3 users and I want to give them 1Mbps/256Kbps bandwidth. They must not have this bandwidth individually but must share it. Is it possible to do with freeRADIUS. If so can you help me on what I have to do. Ngwarai

2 1

RE: Freeradius-Users Digest, Vol 49, Issue 87
by Marco De Magistris 20 May '09

20 May '09

Hi Alan, > 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > to 192.168.1.3) > 2. Radius proxy listen on 192.168.1.3 for authentication packet and > forwarding them towards two different network (192.168.14.4 and > 192.168.24.4) 192.168.14.4 and 192.168.24.4 are 2 different Radius Servers. 192.168.14.4: Radius Server for IPS 1. 192.168.24.4: Radius Server for IPS 2. I need send the packets towards ISP1 using VLAN1 and towards ISP2 using VLAN2. Configured FreeRadius with UDPFROMTO enable. In radius.c source file we notice the following rows : #ifdef WITH_UDPFROMTO /* * Only IPv4 is supported for udpfromto. * * And if they don't specify a source IP address, don't * use udpfromto. */ if ((dst_ipaddr->af == AF_INET) || (src_ipaddr->af != AF_UNSPEC)) { return sendfromto(sockfd, data, data_len, flags, (struct sockaddr *)&src, sizeof_src, (struct sockaddr *)&dst, sizeof_dst); } #else src_ipaddr = src_ipaddr; /* -Wunused */ #endif Can you help me? Thanks Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 10.02 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 87 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: help me: proxing towards 2 different networks (Alan DeKok) 2. Re: Freeradius 2.1.1 and SQLite database (Peter Lambrechtsen) 3. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (John Dennis) 4. Re: question about windows users (Bartosz Chodzinski) 5. Re: question about windows users (Alan DeKok) 6. Re: question about windows users (Bartosz Chodzinski) 7. Re: question about windows users (A.L.M.Buxey(a)lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Tue, 19 May 2009 20:16:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: help me: proxing towards 2 different networks To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A12F783.5080508(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Marco De Magistris wrote: > 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 > to 192.168.1.3) > 2. Radius proxy listen on 192.168.1.3 for authentication packet and > forwarding them towards two different network (192.168.14.4 and > 192.168.24.4) > > Can I configure this scenario using FreeRadius? No. RADIUS doesn't work like that. Why do you want to do this? Alan DeKok. ------------------------------ Message: 2 Date: Wed, 20 May 2009 06:42:29 +1200 From: Peter Lambrechtsen <plambrechtsen(a)gmail.com> Subject: Re: Freeradius 2.1.1 and SQLite database To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <BBCD777E-E215-416D-B199-07C9C87D22BD(a)gmail.com> Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes On 20/05/2009, at 12:00 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > Peter Lambrechtsen wrote: >> Has anyone done any work with FreeRadius 2.1.1 or higher and SQLite >> as >> the backend db. > > Nope. > >> Would love to have it working with sqlite as that is the smallest DB >> footprint of all the supported databases for Free Radius. > > Write the code... submit it back. Will do > > >> Has anyone done work with the sqlite db and give me some pointers on >> the database setup for sqlite, looks like I need to create a file >> called "sqlite_radius_client_database" but not sure what the >> structure >> should be... And google isn't helping much either. > > Apple uses it for their OS X Server system. The clients go into > SQLite, so that their administration system doesn't have to deal with > MySQL, PostgreSQL, or flat-text files. > > The schema is just the normal NAS schema, as with the other SQL > drivers. > > To have it use the "radcheck", "radreply", etc. tables, you'll have > to > define the schemas, create the DB, and define the queries. It > *should* > work, so long as you use the hard-coded DB file name. Ok I will have a go and submit my results back to the users/devel lists depending upon how I get along. The final destination is a single wifi router such as asus 500p which has a usb port that can take stick for local storage to host db with captive portal and wpa for either PEAP or tls logon ssids with web admin backend. All with openwrt. Will let you know how I get along with the freeradius component. > > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Tue, 19 May 2009 19:33:58 -0400 From: John Dennis <jdennis(a)redhat.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1341E6.4070500(a)redhat.com> Content-Type: text/plain; charset=us-ascii Fajar A. Nugraha wrote: > On Sun, May 17, 2009 at 11:33 PM, John Dennis <jdennis(a)redhat.com> wrote: >> We expect to provide an official update to RHEL with a 2.x >> version of FreeRADIUS in the next update cycle which would be RHEL 5.5, > > So how do you plan to provide seamless upgrade for RHEL 5 users? > Is freeradius 1.1.3 config compatible with 2.x? Or do we have to do a > clean install? Please note what Alan said about upgrades across major versions requiring manual configuration. Also, the package will have a different name, rather than freeradius it will be named freeradius2, however (and this is critical) it will conflict at the file level, in other words the both freeradius and freeradius2 cannot be simultaneously installed. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ Message: 4 Date: Wed, 20 May 2009 08:56:25 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: Re: question about windows users To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1f06c2db0905192356k68b35d5ck73c9163d8c8ec5d9(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" >Don't strip the username. Why do you proxy this anyway? Create it as a local realm: I am using basic configuration without changes in config cause: >so..somewhere along the line you are playing with the User-Name attribute...something >which you cannot do with EAP - if you take a standard 2.1.6 install and make the basic changes >to your eap.conf and clients.conf it will work. "make the basic changes to your eap.conf and client.conf it will work" it wont. are all of you had so many troubles with radius or only me has so bad luck I tried to make my first config a year ago, only have succes with eap=md5, after month figting with peap I gave up, now I have some communicates on screen, but answers "basic changes" are really not helpful. my realm example.com was: realm example.com { auth_pool = my_auth_failover } when I changed in proxy.conf it to realm example.com { } radius wont start #freeradius -X ... radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm example.com { } realm LOCAL { } realm NULL { } /etc/freeradius/proxy.conf[498]: home_server "localhost" does not exist

1 0

Freeradius 2.1.1 and SQLite database
by Peter Lambrechtsen 19 May '09

19 May '09

Has anyone done any work with FreeRadius 2.1.1 or higher and SQLite as the backend db. Working on a single router solution with OpenWRT with FreeRadius running PEAP and EAP-TLS auth. Would love to have it working with sqlite as that is the smallest DB footprint of all the supported databases for Free Radius. Has anyone done work with the sqlite db and give me some pointers on the database setup for sqlite, looks like I need to create a file called "sqlite_radius_client_database" but not sure what the structure should be... And google isn't helping much either. Any assistance would be great. Many thanks Peter

2 2

help me: proxing towards 2 different networks
by Marco De Magistris 19 May '09

19 May '09

Hi all, Thanks in advance for your help. Here is our Scenario which is working now: 1. Radius Client sends packets towards Radius Proxy (from 192.168.1.2 to 192.168.1.3) 2. Radius proxy listen on 192.168.1.3 for authentication packet and forwarding them towards two different network (192.168.14.4 and 192.168.24.4) Can I configure this scenario using FreeRadius? The current configuration is: -------------------- First configuration -------------------- Radiusd.conf listen { ipaddr = 192.168.1.2 port = 1812 type = auth interface = eth18 } proxy.conf home_server Server1 { type = auth ipaddr = 192.168.14.4 port = 1812 secret = <SECRET> require_message_authenticator = yes } home_server Server2 { type = auth ipaddr = 192.168.24.4 port = 1812 secret = <SECRET> require_message_authenticator = yes } home_server_pool Serverpool1 { type = fail-over home_server = Server1 } home_server_pool Serverpool2 { type = fail-over home_server = Server2 } realm isp1.com { auth_pool = Serverpool1 } realm isp2.com { auth_pool = Serverpool2 } Results: Expiration of the Timeout -------------------- Second configuration -------------------- Adding in radiusd.conf: listen { ipaddr = 192.168.14.3 port = 1812 type = proxy } Results: The packet is received correctly by Server1, but I can't send any packet towards Server2. -------------------- Latest configuration -------------------- Adding in radiusd.conf: listen { ipaddr = 192.168.14.3 port = 1812 type = proxy } listen { ipaddr = 192.168.24.3 port = 1812 type = proxy } Results: Expiration of the Timeout

2 1

RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap
by François Mehault 19 May '09

19 May '09

Thanks Ivan ! With huntgroup it works perfectly, now I am searching to manage my huntgroup whith ldap, no longer with the file huntgroup. Each users have the primitive radiusHuntgroupName, but I want to define my huntgroup in ldap, is it possible you think ? Regards, Francois -----Message d'origine----- De : Ivan Kalik [mailto:tnt@kalik.net] Envoyé : mardi 19 mai 2009 15:09 À : François Mehault Objet : RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap > Well, I am using checkval to check the attribute NAS-IP-Address, what I > want : I have several users and several NAS, some users allows to > authenticate on some NAS, and others not. I use an openldap database. Each > users have an attribute "radiusCheckItem". I don't know if I am right, if > it's the good way to do what I need, but I am a novice with freeRadisu and > OpenLDAP. Well, if user is going to have only one value for NAS IP, then you don't need checkval - just map appropriate attribute as check item in raddb/ldap.attrmap. If he should be allowed on several devices it might be better to use huntgroups/sqlhuntgroups - as long as there are not too many combinations. Same applies to mac address - if user can use only one there is no need to use checkval. Ivan Kalik Kalik Informatika ISP

1 0

Complete Configuration of freeRadius
by Sanhenra Sinaga 19 May '09

19 May '09

Dear all, I am a students, and i want to implement wireless LAN with MAC based authentication by using freeRadius. I installed freeRadius on Fedora Core 6. I need complete configuration of freeRadius. Thank you

3 2

RFE configure script report
by Damjan 19 May '09

19 May '09

Can the ./configure script be made to report at the end what modules it found it can build. The ./configure output does have this information but it's not easy to follow. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk -- not my mail address, it's a Jabber ID --^ :)

4 4

communication safe ssh <-> NAS <-> FreeRADIUS ?
by François Mehault 19 May '09

19 May '09

Hi, I authenticate on cisco equipments via ssh/telnet. There is no supplicant, so I don't understand in my case and i would like to know if the communication between my cisco equipment and my FreeRadius safe is. I have a secret shared between both. I understand that the communciation between freeradius and the client radius use the protocol Radius. But in my case there is no PEAP, EAP/TLS ... Someone can confirm me please if the communication is safe ? because I afraid to see in the file users my password in clear-text. Is it possible to use md5, ssha ... and how ? Thanks, Regards, François

3 4

RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap
by François Mehault 19 May '09

19 May '09

Well, I am using checkval to check the attribute NAS-IP-Address, what I want : I have several users and several NAS, some users allows to authenticate on some NAS, and others not. I use an openldap database. Each users have an attribute "radiusCheckItem". I don't know if I am right, if it's the good way to do what I need, but I am a novice with freeRadisu and OpenLDAP. -----Message d'origine----- De : Ivan Kalik [mailto:tnt@kalik.net] Envoyé : mardi 19 mai 2009 13:46 À : François Mehault Objet : RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap > [...] > > rlm_checkval: Could not find item named Client-IP-Address in request > rlm_checkval: Could not find attribute named Client-IP-Address in check > pairs > ++[nas-check] returns notfound OK. It can't work since Client-IP-Address is not in the request. Can you remind me: why are you using checkval? Multiple values for NAS IP? Your user entry has only one. Ivan Kalik Kalik Informatika ISP

1 0