- Freeradius-Users - lists.freeradius.org

Freeradius/Netscreen help
by Mario Carassale 22 Apr '08

22 Apr '08

Hi All i am new to this list, so please understand my funny question :-) I have freeradius running fine and i want to authenticate a netscreen firewall against it. My question is, how can i get user privileges from the radius when a user logs into the firewall? If a set on the firewall to get get privilege from the RADIUS server, the login fails, i suppose this is due to not admin provileges. Thank you for all your help. Mario

5 4

imap + 802.1x password
by Enrico Fanti 22 Apr '08

22 Apr '08

Hi, I'm using freeradius 1.1.7, whith mysql to authenticate imap clients and wireless clients with peap method 8021x. For this to work, I created this user in radcheck table: mysql> select * from radcheck where username='fanti'; +------+----------+----------------+----+---------------+ | id | UserName | Attribute | op | Value | +------+----------+----------------+----+---------------+ | 7386 | fanti | Crypt-Password | := | 6yKjjYeLM2Y1E | | 6658 | fanti | Expiration | == | 1221515700 | | 7387 | fanti | User-Password | := | pippo | +------+----------+----------------+----+---------------+ I add the User-Password for the 8021x authentication (it needs clear text password). If I use the ":=" operator in tw0 password attributes It's OK , or I'm wrong ?? (If I use the "==", only the 8021x authentication it's ok) Thank you enrico

2 2

location of source files in windows freeradius
by sanjeev.kumarroy＠wipro.com 22 Apr '08

22 Apr '08

Hi, I tried installing freeradius 1.1.7 in windows XP machine. Here I am not able to locate the source files as was available in Linux. Can you please guide me by telling if the source file gets installed to some particular directory in windows when we install the freeradius exe. Or is there any website where I can get the source files. Any help is highly appreciated. Thanks The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 6

Q: on attr_filter.accounting_response
by rsg 22 Apr '08

22 Apr '08

Hi, I'm using FR 2.0.2. I require that the Accounting response includes "Reply-Message", Could one simply add Reply-Message =* ANY into ../raddb/attrs.accounting_response file to achieve? .. ------------------------------------------------------------------------------------------- Accounting Section: accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # Return an address to the IP Pool when we see a stop record. # main_pool sqlippool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf #sql # # Instead of sending the query to the SQL server, # write it into a log file. # #sql_log # Cisco VoIP specific bulk accounting #pgsql-voip # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } ------------------------------------------------------ I see that Reply-Message is supressed only Proxy-State is carried by the accounting response excerpt of packet Capture: ------------- Radius Protocol Code: Accounting-Response (5) Packet identifier: 0xd (13) Length: 26 Authenticator: A6D7BFC84BEF5B6A8B1047F4435DAA16 Attribute Value Pairs AVP: l=6 t=Proxy-State(33): 30303064 Proxy-State: 30303064 ----------------- Commenting "attr_filter.accounting_response" from the accounting section has the same effect. What have I done missed in this? Thanks in advance for your help.

2 2

Dialup-Admin Alternatives?
by JaxxMaxx the Elder Druid 22 Apr '08

22 Apr '08

Greetings folks! I'm wondering if there is something else that other folks are using to allow GUI administrative access to FreeRadius w/MySQL-stored user databases. I'm noticing that the Dialup-Admin web interface is leaving a LOT to be desired, and doesn't appear to be keeping up with the rest of the FreeRadius updates. I had to modify some of the .sql schemas, and I'm still getting PHP errors on some of the interface pages. ** Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 ** Does anyone still use this interface with the current 2.0.3 ? What other methods do you use to allow non-SQL savvy administrative folks to add and remove valid usernames for authentication? Basically, this web interface is the last thing standing in my way of fully implementing the newer version of FreeRadius (needed to move to different hardware, supporting a captive portal device on a Wifi network)

2 1

Juniper ERX dictionary
by Giovanni Lovato 21 Apr '08

21 Apr '08

We need to use a dictionary for JunOS 8.2, but the syntax seems to be non-standard and FreeRADIUS can't recognize it: http://pastebin.com/m6916d351 How can I translate that dictionary or make FreeRADIUS recognize it? Thank you, G.L.

2 2

FreeRADIUS + 802.1X wireless rollout questions
by Walter Gould 21 Apr '08

21 Apr '08

List, Our institution (a 4 yr. state college) is planning on implementing a 802.1X wireless network in the coming months. We have a test network in place now and all seems to be working well. We have two FreeRADIUS servers. We followed the "FreeRADIUS Active Directory Integration HOWTO <http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO>" from the wiki to get freeradius talking with our centrally managed AD servers for authentication. We are using freeradius version 2.0.3. The primary server specs are: Intel 2GHz Xeon QC, 2GB installed RAM. The secondary is currently running on a vm. I hope to purchase a piece of hardware similar to the one above to run this on in the near future. Here's where my concerns lie - I am concerned about how many simultaneous authentication requests that a single Freeradius server can handle. I have read the "Testimonials" and the "Why we're #1" pages on the freeradius site - which says there are numerous sites using freeradius to support more than 10,000 or 20,000 users. Our school currently has around 21,000 students on our campus. Of that 21,000 - there is usually around 1000 users logged into our wireless network at any given time, however, that number continually increases. Questions: 1. Do any of you have feedback/thoughts/experience on how our freeradius server may handle the auth. request load given our situation? 2. Do you think that we may need to tweak any of the settings in the radiusd.conf file (max_requests, max_request_time, etc)? 3. Any other advice/suggestions you have or think of would be welcome and appreciated. Thanks, Walter -- Walter Gould Info. Tech. Specialist Office of Information Technology Auburn University, AL

3 3

EAP SIM - fresh RANDs
by sateesh busam 21 Apr '08

21 Apr '08

Hi, Is free radius compliant to RFC 4186? In particular, with respect to section 10.9 which says, The EAP server MUST obtain fresh RANDs for each EAP-SIM full authentication exchange. More specifically, the server MUST consider RANDs it included in AT_RAND to be consumed if the server receives an EAP-Response/SIM/Challenge packet with a valid AT_MAC, or an EAP-Response/SIM/Client-Error with the code "insufficient number of challenges" or "RANDs are not fresh". However, in other cases (if the server does not receive a response to its EAP-Request/SIM/Challenge packet, or if the server receives a response other than the cases listed above), the server does not need to consider the RANDs to be consumed, and the server MAY re-use the RANDs in the AT_RAND attribute of the next full authentication attempt. If compliant, how to configure it to generate fresh RANDs? Thanks, Sateesh Forgot the famous last words? Access your message archive online at http://in.messenger.yahoo.com/webmessengerpromo.php

1 0

$RAD_REPLY - Add multiple pairs issue (rlm_perl)
by Kinetix Tele.com Mailing Lists 21 Apr '08

21 Apr '08

I am using the following command to my authorize function (rlm_perl) : $RAD_REPLY{'Cisco-Command-Code'} = \@final_routing; because I want to add more than one pair in the reply packet. (final_routing is a perl array containing the desired values) These pairs are successfully added to the reply message during the authorization phase, but after the authentication function is being processed those pairs are added again one more time. Note : the only line that I have in my authenticate function is : return RLM_MODULE_OK; (positively authenticate anything) So I end up having twice the pairs I intended to in my reply packet. Has anyone seen this behavior before?

1 1

Re: NAS with dynamic IP
by Jack Murgia 21 Apr '08

21 Apr '08

Alex, Is there a command I can run periodically that would flush the dns cache? I use the NAS table in MySQL rather than clients.conf to register my NAS devices. The only problem with NAS devices on PPOE ADSL links is that a restart of Freeradius server is required in order to pick up the new IP address from DYNDNS.org. Would this problem be solved by a rlm_nsupdate module (scheduled for future release)? I would be willing to donate to the creation of this module. Jack Murgia on 2/26/08 2:31 AM, freeradius-users-request(a)lists.freeradius.org at freeradius-users-request(a)lists.freeradius.org wrote: > Date: Tue, 26 Feb 2008 10:30:59 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: NAS with dynamic IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <47C3DC53.9040703(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Rui Oliveira wrote: >> If anyone want to do the patch i can help with some donations because i >> will use it a lot :) > > Alternatively, you could define the client as a network (e.g. > 192.168/24). See clients.conf for details. > > Alan DeKok.

2 1