- Freeradius-Users - lists.freeradius.org

Asking freeradius for the status
by Michael Schwartzkopff 11 Oct '08

11 Oct '08

Hi, I am just digging into the status server of freeradius. I read man radclient and the comments of status server. But it seems I do nat have the right clue: 1) Copying the example from the man pages of radclient: $ echo "Message-Authenticator = 0x00" | radclient localhost sta tus testing123 results in: Received response ID 137, code 2, length = 20 and not, as described in the manual. What is my error? The logfile of radiusd is: rad_recv: Status-Server packet from host 127.0.0.1 port 32770, id=137, length=38 Message-Authenticator = 0xf068e18b120a18d84d00a1dba1cba97d Sending Access-Accept of id 137 to 127.0.0.1 port 32770 Finished request 0. Cleaning up request 0 ID 137 with timestamp +6 Going to the next request Ready to process requests. 2) How to get other status info from the server? Using the FreeRADIUS-Statistics-Type attribute? How exactly? Please post an example. Thanks for any hints. Sincerely, Michael Schwartzkopff.

2 1

ldap/krb5 auth and access point Authentication methods ?
by FM 11 Oct '08

11 Oct '08

Hello, We are using openldap/kerberos (MIT) and just bought 2 CISCO Aironet 1250. I'd like to use freeradius to auth. our users. I read that freeradius can use openldap and kerberos, so i suppose I will setup these for auth. Most of my Wi-Fi users will be Windows/Mac Os and I'd like to avoid custom installation on the laptops. The question is : Which auth method should I use on the access points ? tx !

3 2

Dialup admin questions
by Frederik.Niedernolte＠Bertelsmann.de 10 Oct '08

10 Oct '08

Does it make it sense to use dialup admin for administration if the freeRADIUS server uses the active directory for authentification? Because I have the following errors in the interface: Warning: asort() expects parameter 1 to be array, null given in /usr/share/freeradius-dialupadmin/htdocs/accounting.php3 on line 47 Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 DEBUG(SQL,MYSQL DRIVER): Query: SELECT COUNT(radacctid) AS res_1,sum(acctsessiontime) AS res_2,sum(acctoutputoctets) AS res_3 FROM radacct WHERE username LIKE '%' AND acctstoptime >= '2008-10-11 00:00:00' AND acctstoptime <= '2008-10-11 23:59:59' ; Database query failed: Table 'radius.radacct' doesn't exist DEBUG(SQL,MYSQL DRIVER): Query: SELECT COUNT(radacctid) AS res_1,sum(acctsessiontime) AS res_2,sum(acctoutputoctets) AS res_3 FROM radacct WHERE username LIKE '%' AND acctstoptime >= '2008-10-03 00:00:00' AND acctstoptime <= '2008-10-03 23:59:59' ; Database query failed: Table 'radius.radacct' doesn't exist How should I fix them? Thanks. F. Niedernolte

3 4

EAP MSK: how is it transported between server and authenticator
by Richard Chan 10 Oct '08

10 Oct '08

Hi all, After an EAP authentication which supports key derivation (MSK) how does freeradius transport the MSK to an NAS(authenticator)? I.e., what kind of attribute is used? (I am assuming that the EAP Server (freeradius) is a separate entity to the NAS; NAS talks to freeradius using RADIUS and acts as EAP proxy between EAP client and freeradius). There is an IETF draft on encrypted RADIUS attributes (which specifically mentions "EAP MSK"): http://www.ietf.org/internet-drafts/draft-zorn-radius-encattr-14.txt but this seems too recent to be actually used in the field (besides including undefined magic numbers). Browsing another RADIUS server document (Cisco Secure ACS), there is a "RADIUS Key Wrap" secret that can be configured. Presumably this is used to send MSKs between server and authenticator, but once again there are no details on how it is actually done. I couldn't find a similar configuration parameter in the freeradius config files, either radiusd.conf ( http://wiki.freeradius.org/Radiusd.conf) or the client side ( http://wiki.freeradius.org/Clients.conf) Googling 'radius key wrap' etc doesn't lead to further enlightenment. Tks! -richard-

4 11

Please Help!
by niel m 10 Oct '08

10 Oct '08

Hello Guys Im new in radius, I am using CentOS 5 in my radius server. Where I can find the scripts in generating various Certificates? This is for my Server-(Access Point)-Client connections. Any help would be appreciated. Thanks, Niel

2 3

Radius reply multivalue VSA question.
by Eric Martell 10 Oct '08

10 Oct '08

Hi, We are defining custom VSA's for our company. We have ldap configured in freeradius which returns back the VSA's. I defined custom VSA in $freeradius/share/freeradius/dictionary.abc ATTRIBUTE rEntitlements 113 string entitlements is multivalue attribute (vARRAY) in LDAP. In the ldap.attrmap it is defined as replyItem rEntitlements entitlements == So after the successful authentication, I am getting the rEntitlements back as Sending Access-Accept of id 50 to 69.74.69.31 port 1814 Session-Timeout = 7200 rEntitlements == "ADMALL" rEntitlements == "STORE" rEntitlements == "WEPG" rEntitlements == "WADM" rEntitlements == "SDNLD" rEntitlements == "WIFILOC1" BUT I am looking for ONLY WIFILOC1 for the NAS. NAS will redirect if WIFILOC1 exists. Can I do regex in the rEntitlements so freeradius ONLY returns rEntitlements = "WIFILOC1" and ignore the rest? Please let me know. Thanks in advance.

2 9

Error in the negotiations
by Martin Silvero 09 Oct '08

09 Oct '08

Is this the issue that you say?: Re: CA.all and CA.certs in Freeradius 2.x<https://lists.freeradius.org/pipermail/freeradius-users/2008-October/msg002…>

2 1

FreeRADIUS and EDUROAM timeout issues
by Peter Eriksson 09 Oct '08

09 Oct '08

How have other EDUROAM sites configured their EDUROAM servers with regard to timeout issues? The default setting seems to be less than optimal since if a remote site have problems with their home RADIUS servers then we risk having our local servers mark the upstream servers as "dead" since it's not receiving answers for a specific 'realm'... I've been using the default values so far: response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 But I wonder if these can be tuned a bit to better work in the EDUROAM environment. Perhaps increase the 'response_window', and lower 'zombie_period' and 'revive_interval' and 'check_interval' values... Best would probably be if FreeRadius kept a separate timeout for each 'server/realm' tuple... What have other sites done? - Peter

4 10

Error in the negotiations
by Martin Silvero 09 Oct '08

09 Oct '08

Any suggestions for this topic guys? thanks!!!

2 1

Ldap group
by Bert Beaudin 09 Oct '08

09 Oct '08

Hello I have ldap working to authencate users to a cisci switch. I now want to limit it to group membership. Any help would be great. Here is what I have in my ldap config for the groups. # Group membership checking. Disabled by default. # groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(object Class=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radius" #compare_check_items = yes # do_xlat = yes #access_attr_used_for_allow = yes Here is waht I see in my logs with radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.12.8.230 port 1645, id=35, length=86 User-Name = "bbeaudin" User-Password = "xxxxxxx^" NAS-Port = 194 NAS-Port-Id = "tty194" NAS-Port-Type = Virtual Calling-Station-Id = "10.12.8.71" NAS-IP-Address = 10.12.8.230 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "bbeaudin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated rlm_ldap: Entering ldap_groupcmp() expand: OU=Employees,DC=yipes,DC=com -> OU=Employees,DC=yipes,DC=com expand: (&(samaccountname=%{user-name})) -> (&(samaccountname=bbeaudin)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dendc1.yipes.com:389, authentication 0 rlm_ldap: bind as bbeaudin(a)yipes.com/xxxxxxxx to dendc1.yipes.com:389 rlm_ldap: waiting for bind result ... request done: ld 0x121a6760 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter (&(samaccountname=bbeaudin)) request done: ld 0x121a6760 msgid 2 rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectC lass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn iqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=radius,dc=yipes,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn iqueNames)(uniquemember=))) request done: ld 0x121a6760 msgid 3 rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Bert Beaudin,OU=IT Staff,OU=Employees,DC=yipes,DC=com, with filter (objectclass=*) request done: ld 0x121a6760 msgid 4 rlm_ldap::ldap_groupcmp: ldap_get_values() failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for bbeaudin expand: (&(samaccountname=%{user-name})) -> (&(samaccountname=bbeaudin)) expand: OU=Employees,DC=yipes,DC=com -> OU=Employees,DC=yipes,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter (&(samaccountname=bbeaudin)) request done: ld 0x121a6760 msgid 5 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns reject Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> bbeaudin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 35 to 10.12.8.230 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 35 with timestamp +9 Ready to process requests. Thanks, Bert Beaudin Systems Administrator RelianceGlobalcom Services, Inc. Office:303-785-6641 Cell:303-478-7789 Fax:415-677-9534 bbeaudin(a)relianceglobalcom.com <mailto:bbeaudin@relianceglobalcom.com> www.relianceglobalcom.com <blocked::http://www.yipes.com/>

2 2