- Freeradius-Users - lists.freeradius.org

Re: Cisco Aironet 1130ag dynamic VLAN assignment
by Tom Whitehouse 23 Jan '09

23 Jan '09

> Date: Fri, 23 Jan 2009 11:16:55 -0500 > From: William Graeber <swilly(a)swilly.tk> > Subject: Cisco Aironet 1130ag dynamic VLAN assignment > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <1d7de5e60901230816j64dec24dhe90883e276e48261(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > I have been having trouble recently with getting dynamic VLAN > assignment working on my Cisco AP. Clients are successfully > authenticating with FreeRADIUS. However, they do not seem to be > picking up extra attributes from the "users" file (below is the > relevant portion of it). > > wgraeber NT-Password := "XXX" > Tunnel-Type = VLAN, > Tunnel-Medium-Type = 802, > Tunnel-Private-Group-ID = 100 > Tunnel-Medium-Type = IEEE-802, ^^^^^ This gets looked up in the dictionaries and the corresponding value sent in the message (in this case 6, I believe). Tom

1 0

Pls help: missing Stop accounting packets
by ST Wong (ITSC) 23 Jan '09

23 Jan '09

Hi all, I'm using FreeRadius 2.1.3 on 2 Linux machines with accounting data stored in both radacct file and MySQL database. Recently we found that some 'aged' records have AcctStopTime = NULL. Seems Stop accounting packet for these records are not received. The problem is consistent in both cases - such Stop packets didn't recorded in radacct file and MySQL database. I've no idea whether the stop packet sent to radius server was not recorded, or if stop packet was not sent from AP. As we're using Aruba AP, I wonder if Stop packet will be missed under particular situation, e.g. session timeout, disconnect without proper logout, etc., or if I configured our radius servers incorrectly so that some stop packets are not received or recorded. Meanwhile, I'd also like to know if there is any solution to clean up such orphan records if they can't be avoided. Would anyone please help? Sorry for the newbie question. Thanks a lot. Best Regards, /ST Wong

3 2

FreeRADIUS + MSCHAPv2 + Vista
by Tim Gustafson 23 Jan '09

23 Jan '09

Hi all! I am running FreeRADIUS on FreeBSD 7.1 for my Cisco wireless APs to authenticate against. The clients are using MSCHAPv2 and XP and Mac OSX (as well as several wireless devices like iPhones and so on) are able to authenticate against the WAPs just fine, but Vista is failing. In my log I have: Auth: Login OK: [test] (from client ucsc-60-40 port 0 via TLS tunnel) Auth: Login incorrect: [test/<via Auth-Type = EAP>] (from client foo port 519 cli xxxx.xxxx.xxxx) I Googled for Vista/FreeRADIUS/MSCHAPv2 and found some kerfuffle about there being problems with FreeRADIUS 1.1.3, but I'm running 2.0.5 so I'm assuming that my server is not affected by the 1.1.3 problem. The kerfuffle seemed to be related to a TLS problem, and based on the log entries above, it seems to me that the TLS tunnel is working fine, but the encapsulated packet is not. Incidentally, we also tried on a Windows 7 Beta machine, which experienced the exact same symptoms as the Vista machine. Also, this set-up was working in December and then stopped working somewhere along the way. I'm wondering if perhaps Microsoft release some sort of "fix" since then that actually broke something. And, just to be complete about it, if we point the WAP to an Active Directory RADIUS server the set-up works as-is. Any ideas what might be going on? Tim Gustafson BSOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

4 3

Groups Authentication
by tech.subscriptions＠shepherdhill.biz 23 Jan '09

23 Jan '09

Hi, I am new to FreeRADIUS. We have these groups and I wonder if FreeRADIUS is capable of handling authentication for them with this time frame: 1. EASY - 24hrs access valid or 1 month 2. BUSY - 24hrs access valid for 14 days 3. BUSINESS - 08:00 - 18:00 valid for 1 month 4. RELAX - Monday to Thursday 18:00 - 23:00, Friday (08:00) - Sunday (23:00) Regards, Chris.

2 1

deb of freeradius-server-2.1.3
by Aggelidis Nikos 23 Jan '09

23 Jan '09

hi to all, has anyone managed to make a deb file out of the latest freeradius server? the instractions on the wiki didn't work ,at least for me. I am on Ubuntu 7.10

2 2

pppoe server
by Mailelatamai Halatuituia 23 Jan '09

23 Jan '09

I could'nt setup pppoe server using FreeBSD. Please anyone could help me. I tried several setup but I am not sure how to check whether it is work or not.

3 2

ttls ssl handshake error.
by Sandra H. 22 Jan '09

22 Jan '09

I have created all the certs etc using FR bootstrap and "make client" .. I have made sure my eap.conf info is all correct.. Yest here is what i'm receiving in the logs , thanks for any input rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0007], Certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user.

2 5

Nas-Ip-Address attribute and source IP address of UDP datagram.
by Dmitry V. Krivenok 22 Jan '09

22 Jan '09

Hello! I deal with bad "hand-made" NAS, which doesn't include "Nas-Ip-Address" attribute into the packet. So I can't distinguish packets from different NAS'es. Is there a way to add this attribute (with value of source address of UDP datagram) using standard FreeRadius facilities? We don't use proxies, so this solution seems to be correct. I'm writing my own rlm and I can implement desired functionality if there is no one in FreeRadius. The problem lies in that I can't find the address of client in REQUEST (i.e. auth_req) structure. Comments in "site-enabled/default" say that preprocess module should add "Client-IP-Address" attribute. I printed request->packet->vps, but did't find this attribute in the list. Is source IP address reachable via REQUEST structure passed to authorize callback? -- Sincerely yours, Dmitry V. Krivenok Orange System Co., Ltd. Saint-Petersburg, Russia work phone: +7 812 332-32-40 cellular phone: +7 921 576-70-91 e-mail: krivenok(a)orangesystem.ru web: http://www.orangesystem.ru skype: krivenok_dmitry jabber: krivenok_dmitry(a)jabber.ru icq: 242-526-443

3 4

Re: refresh Session-Timeout in Access-Accept
by bLn 22 Jan '09

22 Jan '09

Marinko Tarlac escribió: > Hi... Can you help me please.... How did you set-up exec module ? In > FR1.1.7 it is enough to add Exec in acct_users and to call script on > Start, Stop and Interim-Update packet but the same trick in fr 2.1.3 > doesn't work (at least for me). > > I really don't know because my script is very simple. It follows different roads (if-then-else) and executes queries in my database depends of the client. I set up in exec module exec { wait = yes program = "/usr/local/freeradius/etc/raddb/pre_script.sh %{User-Name}" input_pairs = request shell_escape = yes output = reply } Regards PS: Thanks Ivan, I can't put my debug now but thanks anyway. I'll put it as soon as possible.

1 0

mysql fail over
by Peter Ellens 22 Jan '09

22 Jan '09

Hi Everyone I've been trying to setup MySQL fail over with freeradius I've followed http://wiki.freeradius.org/SQL_HOWTO#Additional_Snippets But I get weird results. If I stop the first sql server service, freeradius starts to use the second sql server, as expected. But if I stop the entire first server (ie poweroff) freeradius still continues to try and use sql1, hanging... I have tryed this with real servers and with virtual servers, both react the same, if you take down the first sql service it will start to use the second, but if you power off or suspecd the first sql server, radius hangs trying to get to the server. I have tryed freeradius 2.1.0., 2.1.1 and 2.1.3, on redhat enterprise 4 compiled from source. Restarting freeradius it will notice the first sql server is down and use the second sql server. Can anyone confirm this behaviour? Any ideas how to get it working correctly? Secondly, I have been looking into sqlippool and MySQL fail over. We would really like to be able to use a read/write master and read only slave, but it looks to me that the sqlippool needs to be writeable to mark the IP address as used and avoid duplicate IP allocation. Can someone confirm this? Thanks Peter

2 3