- Freeradius-Users - lists.freeradius.org

eap-mschapv2
by indira kolli 18 Jan '08

18 Jan '08

Josh Howlett wrote: ... >> Sending Access-Challenge of id 3 to x.x.x.x port 1812 >> MS-CHAP2-Success = ... >> EAP-Message = ... > That looks like a bug to me. It's a violation of RFC2548: No. The bug is different: EAP-MSCHAPv2 is *not* MS-CHAPv2. The MS-CHAP2-Success attribute has no business being in *any* packet that also contains EAP. I've committed a fix for that to CVS head. >>How and when do I get this fix >> Also does thi fix the reply as type Access-Accept instead of Access-challenge Alan DeKok. - List info/subscribe/unsubscribe? See * http://www.freeradius.org/list/users.html*<http://www.freeradius.org/list/users.html>

2 9

Traffic volume accounting
by Spam Eater 18 Jan '08

18 Jan '08

Hello everyone, I am trying to implement traffic volume accounting in my Radius server. Is it possible to have a counter setup to achieve this? I've tested a lot and it seems freeradius is just ignoring my counter. I have somewhat managed to do some traffic accounting relying on external scripts, but it doesn't work properly. I'd like to know if someone has implemented realtime upload/download limitations and what methods were used. Thank you all!

2 1

Not sending a reply packet from proxy
by Pshem Kowalczyk 18 Jan '08

18 Jan '08

Hi, We have quite extensive proxy step up. With a few dozens of realms and a small army of home servers. Some of those home servers belong to our wholesale customers. Normally devices send packets to to the geographically closest proxy servers, which in turn use the closest (geographically again) home servers. When the proxies don't get reply from the home servers (because for example the link went down) they return a 'Reject' - as expected. Some customers of ours are not entirely happy with that approach as they would like to get those packets answered by a different home servers farm in a different city. Our proxies do not forward packets between cities (mainly for efficiency and manageability reasons), but our devices can fall back to a different proxy farm (in a different city) if the primary IP for that customer (freeradius farm load balanced by a SLB) goes down. Is it possible to discard the packet on the proxy if the home server doesn't reply and let the device to fall back to a different proxy? Currently we use radius 1.1.7, but looking into upgrading it to 2.0.0. kind regards Pshem

2 3

radgroupreply do not read (read_grous directive)
by Arlinelson Fernandes dos Santos 18 Jan '08

18 Jan '08

6 16

Freeradius LDAP at RHEL 5.1
by Renato Gregio de Souza Filho 18 Jan '08

18 Jan '08

Hi all, I'm trying to configure freeradius to authenticate at LDAP Database. I have a poor knowledgement about freeradius and need help :) ... What i need to do to configure correctly my freeradius to authenticate at ldap database? how do i can test it? today i have the following structure at my ldap tree, OU, and user example: ####################################################################### dn: dc=peixotoradius,dc=com,dc=br objectClass: top objectClass: dcObject objectClass: organization o: Peixoto dc: peixotoradius dn: ou=usuarios,dc=peixotoradius,dc=com,dc=br objectClass: top objectClass: organizationalUnit ou: usuarios dn: uid=1015,ou=Usuarios,dc=peixotoradius,dc=com,dc=br uid: 1015 cn: 1015 userPassword: {crypt}$1$1gLC/3mY$aEsZ9ckW6FvyNkUrWDtv0. objectClass: radiusObjectProfile ####################################################################### and at my /etc/raddb/radiusd.conf i have the following at ldap: ####################################################################### prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib64 pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf ldap { server = "localhost" identity = "cn=admin,dc=peixotoradius,dc=com,dc=br" password = My_password basedn = "dc=peixotoradius,dc=com,dc=br" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap timeout = 4 timelimit = 3 net_timeout = 1 } #######################################################################

2 1

radius attributes for cisco ip phone
by Stieven.Struyf＠komatsu.eu 17 Jan '08

17 Jan '08

I have hp procurve 3500yl switches for which i use mac based authentication against radius server. The radius server should assign the vlan's. The pc that hangs behind the phone get the correct vlan, but the phone doesn't. The radius userfile contains this for the phone(for the pc i have the same structure, only different vlan): 001c13d6b06f User-Password == "001c13d6b06f" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-id = "20" The phone doesn't seem to receive an ip. Is there an error in my config? Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 "The question of whether a computer can think is no more interesting than the question of whether a submarine can swim." -- E. W. Dijkstra "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."

5 4

Upgrading from 1.0.2 to 2.0.0 problems
by William 17 Jan '08

17 Jan '08

Greetings, I have looked at the documentation included with the 2.0 distribution for setting up radius 2.0 and I am either blind, or it doesn't have when I am looking for. What I am trying to do is set up my main realm to handle either no realm or deal with the default realm, The problem I am having is that I do not wish to proxy it back to itself to handle the realm (puts it in my log twice, and debug shows it re-submitting it back to itself). Where do I look to solve this? I tried in proxy.conf adding: realm myrealm.com { } and tried, at a different time: realm myrealm.com { auth_pool = my_auth_failover } Trying to use the configuration provided as a template. The first causes user(a)myrealm.com to fail, and the second causes it to re-submit it to the server for authentication. How do I fix this, or where is there some detailed documentation on how to configure this? Thank you Wm

3 7

how can I change freeradius logs in other format?
by Niki Petrov 17 Jan '08

17 Jan '08

I'd like to save my freeradius log(accounting) format in other (an example: table) format. Can I do that, and if YES, how? (OS FreBSD 7.0RC1, freeradius version 1.1.7) Thanks!

2 1

cisco wlse patch
by Marc Boisis-Delavaud 17 Jan '08

17 Jan '08

Hello, Have you a patch for cisco wlse leap authentication, working for freeradius 2.0 ? Thanks

1 0

Conditional Authorize based on SQL-Groups?
by Etienne Pretorius 17 Jan '08

17 Jan '08

Hello list, Is there anyway that I can selectivly execute modules in the authorize sections based upon the SQL-Group the user belongs to. I also need to know where you are suppose to enable the 'read_groups' directive as I do not see the sql query being performed at all. <cut> radius_xlat: 'bob@testing' rlm_sql (sql): sql_set_user escaped user --> 'bob@testing' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bob@testing' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'bob@testing' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: entering group for request 0 rlm_sqlcounter: Entering module authorize code <cut> /etc/freeradius# grep read_groups * sql.conf: read_groups = yes -- Kind Regards Etienne Pretorius

1 0