- Freeradius-Users - lists.freeradius.org

Proxy based on MAC
by King, Michael 04 Feb '07

04 Feb '07

I'd like to proxy user's off to a different RADIUS server based on they're MAC address. Currently, my NAS reports MAC address as Calling-Station-Id = "00-0D-93-EA-89-06" I'd like any user that has a MAC starting with 00-0D-93 (and about 8 more MAC's) to be proxied off to another Radius server. I've come up with a RegEX that matches Mac addresses. (Least I think it's close) Correct me, cause I know I'm gonna get this wrong. (First real try with Regex) (I'm using 3 separart MAC's here) DEFAULT Calling-Station-Id =~ "(00-0D-93-([0-9a-fA-F][0-9a-fA-F]-){1}([0-9a-fA-F][0-9a-fA-F]))|(00-03- 93-([0-9a-fA-F][0-9a-fA-F]-){1}([0-9a-fA-F][0-9a-fA-F]))|(00-05-02-([0-9 a-fA-F][0-9a-fA-F]-){1}([0-9a-fA-F][0-9a-fA-F]))" But where does this go, and what else do I have to configure?

3 4

Problem syncing radius.logs with radrelay
by John Brittain 04 Feb '07

04 Feb '07

Hello All! FR Version: 1.1.3 OS Version: Fedora Core 5 cmd line for radrelay = /usr/bin/radrelay -n rad1_server -a /var/log/radacct -d /etc/raddb detail.relay We've recently switched to FreeRadius from Cistron, and we didn't have this problem with Cistron. So, I'm hoping someone can help. We are running 2 servers with radrelay. When a user gets authenticated on server #1, it logs their "Login OK" in the radius.log file, but does NOT log it on server #2 (and vise versa). So I would like to know if there's a way to have the log files on both servers sync up? And why did it work on Cistron and not with FreeRadius? Thank in advance for any help. --John Brittain <john(a)dncsi.com>

3 4

FreeRADIUS + OpenLDAP for accounting
by Peter Micunek 03 Feb '07

03 Feb '07

Hello everyone, I work for a mobile operator and we have a product (something like proxy) which is able to do so-called "Header Enrichment". A "mobile customer" who is connected over this proxy will have enriched his http header with phone number (MSISDN). A problem is that this proxy know IP address of customer instead of MSISDN and unfortunately cannot use a RADIUS to obtain the MSISDN from another source. This proxy is able to use only the LDAP request with IP of customer and then received the LDAP response from a external LDAP server which contain MSISDN (phone.num). Our network node (GGSN) have info about IP and MSISDN and can send both over RADIUS accounting. So I have to design a Accounting FreeRADIUS server which will store the RADIUS acconting with IP and MSISDN to OpenLDAP. And this "external" OpenLDAP server will provide MSISDN to proxy for "Header Enrichment". Is it appropriate to use FreeRADIUS with OpenLDAP or could you advise me how to combine everything for best performance and design? regards, Peter Micunek

3 6

Re: Freeradius(.net) and Oracle
by Brian Atkins 03 Feb '07

03 Feb '07

OK, so I pulled down the tarball for 1.1.4 from the site and I am in the process of compiling it on Cygwin. Now I am getting an entirely different error: /home/Administrator/freeradius-1.1.4/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I../.. -I/home/Administrator/freeradius-1.1.4/src/include -I/cygdrive/d/oracle/ora92//rdbms/demo -I/cygdrive/d/oracle/ora92//rdbms/public -I/cygdrive/d/oracle/ora92//plsql/public -I/cygdrive/d/oracle/ora92//network/public -I/cygdrive/d/oracle/ora92//oci/include -c sql_oracle.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I../.. -I/home/Administrator/freeradius-1.1.4/src/include -I/cygdrive/d/oracle/ora92//rdbms/demo -I/cygdrive/d/oracle/ora92//rdbms/public -I/cygdrive/d/oracle/ora92//plsql/public -I/cygdrive/d/oracle/ora92//network/public -I/cygdrive/d/oracle/ora92//oci/include -c sql_oracle.c -DPIC -o .libs/sql_oracle.o In file included from sql_oracle.c:28: /home/Administrator/freeradius-1.1.4/src/include/radiusd.h:11:22: *radpaths.h: No such file or directory* sql_oracle.c: In function `sql_select_query': sql_oracle.c:342: warning: dereferencing type-punned pointer will break strict-aliasing rules make: *** [sql_oracle.lo] Error 1 I dug back through the archives and found a reference from version 0.9.0-pre1 (2003) that indicated a bug in automake. I'm using automake (GNU automake) 1.10. Anyone know if this is still a open issue? Another question would be if I re-built Freeradius from the tarball would it make the rlm_sql_oracle module automatically, or do I need to build it separately? Thanks, Brian

2 1

802.1x + freeradius authentication problem
by Ramon Barquier 03 Feb '07

03 Feb '07

Hi all, We are trying to set up an environment with 802.1x + Freeradius for our Wireless net. Our goal is to authenticate Windows XP clients using EAP. Our radius server is bound to an LDAP database. We have tested our users with a "radius-test" tool and everything seems to work fine, but when trying to validate in our 802.1x environment, the radius server rejects the user. In fact, although we get a "authorize returns ok", there seems to be an additional check that claims the user has no password. Any ideas? We attach the radiusd log (hope it helps!). Thanks in advance, rad_recv: Access-Request packet from host **NAS_ IP_ADDRESS** port 1027, id=2, length=187 Message-Authenticator = 0xc40883257068815f1b14f3b80780eeab Service-Type = Framed-User User-Name = "ID_of_USER" Framed-MTU = 1488 State = 0xb32f32ffc94e41b83d5af8f919ee449e Called-Station-Id = "00-12-CF-1A-15-80:Eduroam" Calling-Station-Id = "00-0E-35-FE-1F-6D" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200060319 NAS-IP-Address = 1.0.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/home/radmgr/freeradius/var/log/radius/radacct/158.109.1.15/auth-detail-20070201' rlm_detail: /home/radmgr/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /home/radmgr/freeradius/var/log/radius/radacct/NAS_IP_ADDRESS/auth-detail-20070201 radius_xlat: 'Thu Feb 1 17:06:44 2007' modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ID_of_USER", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: Ignoring NAK with request for unknown EAP type modcall[authorize]: module "eap" returns noop for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for ID_of_USER radius_xlat: '(uid=ID_of_USER)' radius_xlat: 'ou=People,dc=my_org,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=my_org,dc=es, with filter (uid=ID_of_USER) rlm_ldap: Password header not found in password {SSHA}HzNGeJ1eXDD/B9ZOG+QdbpeCGUx1Q+UiMSdLZg== for user ID_of_USER rlm_ldap: Added User-Password = {SSHA}HzNGeJ1eXDD/B9ZOG+QdbpeCGUx1Q+UiMSdLZg== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding LDAP attribute UserClass as RADIUS attribute Filter-Id = GRUPS_INTERES#951#Servei d'InformÃ?tica rlm_ldap: Adding LDAP attribute UserClass as RADIUS attribute Filter-Id = USUARI_PROVES#951#Servei d'InformÃ?tica rlm_ldap: user IP_of_USER authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns ok for request 6 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [ID_of_User/<no User-Password attribute>] (from client NAS_IP_ADDRESS port 1 cli 00-0E-35-FE-1F-6D) Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 5 seconds... --- Walking the entire request list --- Sending Access-Reject of id 2 to NAS_IP_ADDRESS port 1027 Filter-Id = "GRUPS_INTERES#951#Servei d'Inform\303\240tica" Cleaning up request 6 ID 2 with timestamp 45c21014 Cleaning up request 5 ID 1 with timestamp 45c21014 Cleaning up request 4 ID 0 with timestamp 45c21014 Nothing to do. Sleeping until we see a request. -- Ramón Barquier Montalbán Comunicacions Servei d'Informàtica Edifici D Campus de la UAB 08193 Bellaterra. Barcelona Tel. +34 935 811 488 Fax: +34 935 812 094 Ramon.Barquier(a)uab.es www.uab.es/si

4 5

When EAP-AKA can be supported by FreeRADIUS?
by lishuai zhao 03 Feb '07

03 Feb '07

Hi, all In FreeRADIUS, EAP-AKA has not been supported yet, though a EAP-AKA patch for version 1.1.2 can be found in the former lists. EAP-AKA is more and more popular, so I want to know: (1). When EAP-AKA can be offically supported by FreeRADIUS? (2). How does FreeRADIUS support WiMAX? Thank you and best regards! Lishuai.Zhao

5 4

RE: Freeradius-Users Digest, Vol 22, Issue 12
by Stephen Baker 02 Feb '07

02 Feb '07

I did a disk based install of opensuse 10.2 first and was very disappointed with the install process. To much confusion and disk swapping. And just why did I need to download 5 disk when it only used 3 for the install? Debian install was a pleasure. Updating and installing packages seams a bit easer too. I have Freeradius installed on Debian. so if I don't have to go back to square one with a new OS right now I would prefer to stay with it. So where is the best source for a basic config guide? What is "the DOC?" -----Original Message----- From: freeradius-users-request(a)lists.freeradius.org [mailto:freeradius-users-request@lists.freeradius.org] Message: 1 Date: Fri, 2 Feb 2007 17:42:40 +0200 From: Peter Nixon <listuser(a)peternixon.net> ... Thats it... You will need to configure freeradius to do what you want, but it is at this point "working" with the default config. ... Peter Nixon

2 1

The new spud, needs beginner advice, assistance and posibly service.
by Stephen Baker 02 Feb '07

02 Feb '07

I have to set up a Freeradius server ASAP (in less then a week.) I have a basic install of Debian running (using the term loosely.) But then there is this ubuntu 6.10 install CD on my desk calling my name. As a total newbie to Linux what is the best OS flavor to use for Freeradius? Then what is the best path from empty hard drive to working Freeradius server? Is there a list of document for instance? Can someone provide a pre-built image of a server that I could have up and running in 20 minutes? Is there a person how can configure the server for me, say over the weekend? end

2 1

Questions about latest CVS
by 高嵩 02 Feb '07

02 Feb '07

Hi,all I just installed the radiusd on CVS successfully. There are two questions: Does the radiusd server listen on IPv6 address by default?How to use the radclient in Ipv6 ? Regards

3 2

Help, more
by Stephen Baker 02 Feb '07

02 Feb '07

Note was sent to list (freeradius-users(a)lists.freeradius.org) by mistake intended to send to daemon (freeradius-users-request(a)lists.freeradius.org) Thanks to 1. Re: help (Gaddis, Jeremy L.) 3. Re: help (Peter Nixon)

1 0