- Freeradius-Users - lists.freeradius.org

Virtual-Server attribute matching in users file.
by Matthew Schumacher 15 Apr '08

15 Apr '08

List, I'm getting some config together to implement virtual servers with freeradius 2.0.3 and I need to offer different attributes when the request comes from different servers. I see that there is a Virtual-Server internal attribute so I thought I could do something like this: DEFAULT Virtual-Server == 'dsl' Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1492 DEFAULT Virtual-Server == 'dialup' Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1500 However it's not working. I can see in the debug that it is using the 'dsl' server but I'm not getting any of the attributes. I can set it to use User-Name == 'validuser' and it matches and returns attributes just fine so I'm not thinking it's my config. Also, I'm noticing that the server returns attributes even when the access request is rejected. Anyone know why that is? Thanks, schu

2 2

Re: exec-program-wait problem with freeradius 2.0.3
by Emmanuel Willems 15 Apr '08

15 Apr '08

I added exec in post-auth in sites-enabled/default and sites-enabled/inner-tunnel and it's still no go. Did i miss something? Thankx, Emmanuel Alan DeKok wrote: > Emmanuel Willems wrote: >> > All works well in version 1.1.3 but the script does not get called in >> > version 2.0.3 > > List 'exec' in the "post-auth" section. > > Alan DeKok.

2 1

How do i change the NAS ip address
by johnson elangbam 15 Apr '08

15 Apr '08

hi, I've been configuring free radius 2.0.3, I've configured almost all the files and run successfully for the testing purpose from the localhost by using the "radtest", now I need to implement my radius in the real invironment by putting the NAS ip address, currently my NAS ip address is displayed as 127.0.0.1, I need to change this ip address. Please anybody tell how to change the NAS ip address. Thanks and Regards Elangbam Johnson

2 1

attributes lost
by Marc Boisis-Delavaud 15 Apr '08

15 Apr '08

Hello, When I authenticate in PEAP, my ldap attributes (ex Tunnel-Private- Group-Id) aren't send to the client, why ? Here is my debug: rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusClass as RADIUS attribute Class = 0x4f553d61646d696e3b rlm_ldap: LDAP attribute radiusClass as RADIUS attribute Class = 0x4f553d61646d696e3b rlm_ldap: LDAP attribute radiusTunnelPrivateGroupId as RADIUS attribute Tunnel-Private-Group-Id:0 = "1" rlm_ldap: LDAP attribute radiusTunnelMediumType as RADIUS attribute Tunnel-Medium-Type:0 = IEEE-802 rlm_ldap: LDAP attribute radiusTunnelType as RADIUS attribute Tunnel- Type:0 = VLAN WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user mdelavau authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_prof] returns ok ++- group returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok +- entering group session expand: /opt/freeradius/radium/var/log/radius/radutmp -> /opt/ freeradius/radium/var/log/radius/radutmp expand: %{User-Name} -> mdelavau(a)univ-lr.fr ++[radutmp] returns ok Login OK: [mdelavau(a)univ-lr.fr/<via Auth-Type = EAP>] (from client heros59 port 0) +- entering group post-auth expand: /opt/freeradius/radium/var/log/radius/radacct/%{Client-IP- Address}/reply-detail-%Y%m%d -> /opt/freeradius/radium/var/log/radius/ radacct/10.14.0.59/reply-detail-20080414 rlm_detail: /opt/freeradius/radium/var/log/radius/radacct/%{Client-IP- Address}/reply-detail-%Y%m%d expands to /opt/freeradius/radium/var/log/ radius/radacct/10.14.0.59/reply-detail-20080414 expand: %t -> Mon Apr 14 10:04:29 2008 ++[reply_log] returns ok } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 2 Class = 0x4f553d61646d696e3b Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mdelavau" PEAP: Processing from tunneled session code 0x730f30 2 Class = 0x4f553d61646d696e3b Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mdelavau" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled Sending Access-Challenge of id 233 to 10.14.0.59 port 1645 EAP-Message = 0x010a002b1900170301002091080b47d0c51811b6674b7a649bd231e1f5fea643dd96b28362ea273fe51553 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5e74631eded5f77803ca60988c6d413 Finished request 22. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.14.0.59 port 1645, id=234, length=243 User-Name = "mdelavau(a)univ-lr.fr" Framed-MTU = 1400 Called-Station-Id = "0012.44bd.0b03" Calling-Station-Id = "0019.e304.476e" Cisco-AVPair = "ssid=eduroam" WISPr-Location-Name = "CRI Arpae" Service-Type = Authenticate-Only Message-Authenticator = 0x8cefe9357b38e5f0a52c291945837712 EAP-Message = 0x020a002b19001703010020dc122ffd1ad0290d995b344b65adbda0824e52829616cca6dfb590d9b510b732 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "36654" NAS-Port = 36654 State = 0xe5e74631eded5f77803ca60988c6d413 NAS-IP-Address = 10.14.0.59 NAS-Identifier = "heros59" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "univ-lr.fr" for User-Name = "mdelavau(a)univ-lr.fr " rlm_realm: Found realm "univ-lr.fr" rlm_realm: Adding Stripped-User-Name = "mdelavau" rlm_realm: Proxying request from user mdelavau to realm univ-lr.fr rlm_realm: Adding Realm = "univ-lr.fr" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 43 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Login OK: [mdelavau(a)univ-lr.fr/<via Auth-Type = EAP>] (from client heros59 port 36654 cli 0019.e304.476e) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 234 to 10.14.0.59 port 1645 MS-MPPE-Recv-Key = 0xbf9d41342546813406854e35cabdf79521b33e2c316aff8d599716484cc18c20 MS-MPPE-Send-Key = 0xaff6c3d06041e693b8acb1067d382699f150da706b799e4960ab82be1f25a96a EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mdelavau"

4 7

radiusd not starting
by Dr.Peer-Joachim Koch 15 Apr '08

15 Apr '08

Hi, we updated yesterday one of our server running Novell SLES 9. After the update the "raidusd" (not the sles version, self compiled) did not work correctly (the load was getting higher and higher). Therefore I installed the current version of the freeradius-server (2.0.3) from http://download.opensuse.org/repositories/network:/aaa/ After fixing a few things in the /etd/raddb/users the server is running fine, when I do a radiusd -X also radius -f seem's to work. But neither a radiusd not /etc/init.d/freeradius start is launching the radiusd-Daemon. But I can not see WHY the raidusd is not starting as daemon. Any idea ? -- Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

2 2

Freeradius support IAPP (IEEE 802.11f)?
by Yeray Domínguez 14 Apr '08

14 Apr '08

Hello. I'm doing a tutorial of the RADIUS, IAPP and EAP protocols. I've had using FreeRADIUS to explain the practice part of the tutorial. But I don't know if FreeRADIUS support IAPP. Please, it's very important for me to know it. If the response is 'no', could you recommend me another RADIUS server that support IAPP? Thanks. ______________________________________________ Tu correo también desde el móvil. Descárgate gratis Yahoo! Go. http://es.mobile.yahoo.com

2 1

Proxy request after TLS.
by Andrew Olson 14 Apr '08

14 Apr '08

I'd like to proxy a request to another server after the EAP-TLS handshake is finished. I simply want to do a little more authorization that is already setup on another server. My other server is just a simple RADIUS server and doesn't do EAP, so proxying the EAP message won't work. I guess I'm looking for something like proxy-inner-tunnel configuration that is available for PEAP. Is something like this possible? I tried to add the following block to post-auth: update control { FreeRadius-Proxied-To := blah } It returns noop, though. Thanks, Andrew Olson

2 3

hi
by Hafiz Pussah 14 Apr '08

14 Apr '08

Hi I would really appreciate if u could assist me in helping me with commands while using freeradius. Hope to hear from u positively. Yours, Hafiz ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

FreeRADIUS configuration
by LDAPMAN 14 Apr '08

14 Apr '08

Hi! I have installed freeradius 1.1.6 and dont know how to configure it. My "local networkstructure" looks like this (it is a test) : LAN1 (central) <-> VPN Gateway1 <-> VPN Gateway2 <-> LAN2 VPN is configured. Both LAN have got 2 Windows XP Clients. VPN Gateway: Linux 2.6 Openswan 2.4 I have installed freeradius on Gateway1. wiki.freeradius.org looks fine, but i dont know how to begin. I have written the client IPs with secrets in the clients.conf hmm.. and now? Can anyone help me? -- View this message in context: http://www.nabble.com/FreeRADIUS-configuration-tp16608592p16608592.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

manage virtual_server
by TIQUET, Benoit 14 Apr '08

14 Apr '08

FreeBSD 6.1-RELEASE-p12 freeradius-2.0.3 Hello, I would like to manage several virtual_server based on clients. I tried to follow instructions on http://www.freeradius.org/features/virtual_servers.html but I can not manage the clients section ( : Failed to find clients xx). I tried to put the clients section in clients.conf and radius.conf but it's not better. Could you please give me some more details regarding virtual_servers ? How to manage several virtual servers based on clients , how to link a virtual_server to it's related file in site-enabled. Thanks for your help regards Benoit -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

2 3