- Freeradius-Users - lists.freeradius.org

New Thread: EAP for Cisco AP.
by Evan Vittitow 15 Jan '07

15 Jan '07

The next stage of Radius is using it to secure my Wireless network. I'm fairly sure EAP-TLS is Certificate based, and EAP-MD5 has to do with using an MD5 Has as a "Shared Secret" But, I don't completely understand PEAP, and how it relates to MS-CHAP v2. I want to try to use PEAP to secure my network. Here is my current eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } I have eap in authenticate and authorize. What else do I need to do, and are there more dictionaries.

3 6

Is there something available that is comparable to typical release notes for freeradius?
by Ellis, Scott 1 (N-Comptel Inc.) 15 Jan '07

15 Jan '07

I am running Redhat version 3.0 with Freeradius 1.0.1 bundled. I would like to upgrade to Freeradius 1.1.4. Is their documentation available (installation requirements) that I could review that would specify if Freeradius 1.1.4 will run under Redhat version 3.0, etc? Basically, release notes for Freeradius. Thanks, Scott

4 3

Dialup admin help
by Greg Hartung 15 Jan '07

15 Jan '07

I have had FreeRadius and Mysql have been authenticating users for months but now I am trying to get dialup admin working for the first time. The main page loads fine. "Find User" does load a search page but won't return any users and "Show Groups" loads a header with no groups. The rest of the menu items are either a blank white or blank green screen. I am using Mysql and I have configured user,pwd, dbname, etc. in admin.conf and I have run the 4 "create table" scripts. Does it log anywhere? How do I tell if it's hitting the db? Or what should I try next? Thanks! Greg

3 6

redundant use of SQL-Group in "users"
by Phil Mayers 15 Jan '07

15 Jan '07

All, The configurable failover mechanism allows one to say: authorize { redundant { sql1 sql2 } } ...but can one do this: DEFAULT SQL-Group == "BANNED", Auth-Type := Reject ...in a way that will failover between sql1 and sql2? I don't believe so, but just want to check before I do the fallback option (which for various reasons too tedious to go into, is a lot of work for this config).

2 1

RE: Using MySQL and assigning IP-Addresses based onCalling-Station-ID
by Ackbar Joolia 15 Jan '07

15 Jan '07

Phil, Thanks for your reply. I didn’t know about the Fall-Through. I have got a list of static addresses, which I will need to assign through the Framed-IP-Address attribute. This is what I am trying to do: When I receive requests, they all come with the same username and password, but with different Calling-Station-ID. I have to authenticate and differentiate on the calling-station-id, and then assign static IP-Address to these users, based on the calling-station-id. I know it sounds simple, but I can't get it to work or am not getting the logic right. Can you advise please? My model has to work in the way described above i.e. same username and password, and assigning Framed-IP-Address based on the calling-station-id, in MySql. Thanks Al -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalmetering.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalmetering.com@lists.freeradius.org] On Behalf Of Phil Mayers Sent: 15 January 2007 16:32 To: FreeRadius users mailing list Subject: Re: Using MySQL and assigning IP-Addresses based onCalling-Station-ID Ackbar Joolia wrote: > The radcheck table contains an entry for the password. > The radreply table contains a Fall-Through = Yes for the user user1. > The radgroupcheck contains groupnames (coming from the usergroup table) and Calling-Station-Id which I need to authenticate against. > The radgroupreply table contains the replies I want to send to the different groups, which would have been authenticated/differentiated through their calling-station-id. That's not right, and if I'm understanding you correctly you can't do exactly what you want with the current release version of FreeRadius. Fall-Through does nothing on the current release version of FreeRadius - the SQL module merges the user and all the group check items into one, checks them, then puts all the reply items in. Since they're all merged, putting users into >1 group with conflicting check items will fail, as will putting users into >1 group with the same reply items. Also, you would not normally assign IPs to groups - you would assign them to sessions from a pool (see rlm_sqlippool) or statically to users (using Framed-IP-Address in the radreply items) Could you be a bit more specific about what you're trying to do? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

2 1

Using MySQL and assigning IP-Addresses based on Calling-Station-ID
by Ackbar Joolia 15 Jan '07

15 Jan '07

Hi all, I sent an email to the list before, and still haven’t been able to fix my problem. This is what I want to do: I am using MySql to authenticate users. However, I need to authenticate them based on the Calling-Station-ID, and then assign IP-addresses to them, through the Framed-IP-Address attribute. This seems to be a very one to do, but its not working. All users will be having same username (user1) and password. This is the logic I am using: I haven't changed the sql query which comes with FreeRadius. In my usergroup table, I am putting users with the same username, but different groupnames. The radcheck table contains an entry for the password. The radreply table contains a Fall-Through = Yes for the user user1. The radgroupcheck contains groupnames (coming from the usergroup table) and Calling-Station-Id which I need to authenticate against. The radgroupreply table contains the replies I want to send to the different groups, which would have been authenticated/differentiated through their calling-station-id. Is this setup wrong? The replies which are being allocated is for the first groupname that appears in the radgroupreply table, which to me, means that the radgroupcheck is not having any user. Can anyone who has done the above before give me some hints as to what I am doing wrong, or maybe my setup could be wrong? Would the radius server not check the attributes appearing in the request automatically against the ones in the radcheck/radgroupcheck tables, or do I need to modify the sql_query? Thanks AL -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

2 1

Works in debug mode but not service mode
by Foo JH 15 Jan '07

15 Jan '07

Hello all, I'm using the Windows binary distribution of FreeRadius, to receive accounting logs from Cisco routers. Setup-wise, I try to keep it to a minimum; mostly from the FreeRadius tutorials. After the setup, I am able to receive the log posts in debug mode, but not in the Windows Service mode. Is there anything different between the modes, perhaps the security authentication? Hope to get some good help here. Thanks.

1 0

Forward L2TP request to another LNS
by Hemant Arora 15 Jan '07

15 Jan '07

Hi All, I need to forward L2TP requests from Freeradius to another LNS. To explain in more details Two Domain xyz.com and abc.com are the realms for which I am accepting the connections and both are terminating on our LNS1. Forwarded to Radius. >From freeradius I want to forward the requests for xyz.com to LNS2 via Tunnel not via Realmproxy. Is it possible ? If yes please can somebody throw some light on that. I am using Mysql with Freeradius. Thanks hemant

2 1

Daily Accounting - 3 days account?
by liran tal 14 Jan '07

14 Jan '07

Hey everyone, I've seen that there's a Max-All-Session, Daily, Weekly and Monthly even. I need to limit the user for a 3days period. How do I accomplish that? Thank you. Liran.

2 3

My Dictionaries seem corrupted
by Evan Vittitow 14 Jan '07

14 Jan '07

Working Dictionaries requested. Anyone with known working dictioniaries?

4 4