- Freeradius-Users - lists.freeradius.org

huntgroups - doku?
by Michael Messner 19 Sep '06

19 Sep '06

hello mailinglist, in my last mail I got the information to use huntgroups to handle the parameters for different NAS types, but after some research I have not found good documentation of this! Anyone knows some good recources? Here are my new configs, it looks like they are working, but I'm not sure if this is really the correct way: /etc/raddb/huntgroups: enterasys NAS-IP-Address == 141.201.43.115 enterasys NAS-IP-Address == 141.201.43.116 enterasys NAS-IP-Address == 141.201.43.117 cisco NAS-IP-Address == 141.201.43.118 cisco NAS-IP-Address == 141.201.43.119 cisco NAS-IP-Address == 141.201.43.120 one entry in /etc/raddb/users: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys" Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{mschap:NT-Domain} - Domain, there are no restrictions for you in this network", Fall-Through = No DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name := "cisco" Cisco-AVPair == "aironet:admin-capability=write+snmp+ident+firmware+admin", Tunnel-Type:1 = 13, Tunnel-Medium-Type:1 = 6, Tunnel-Private-Group-ID:1 = 1, Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{mschap:NT-Domain} - Domain, there are no restrictions for you in this network", Fall-Through = No is this the correct way? thanks mIke

4 5

different NAS types with different parameters
by Michael Messner 19 Sep '06

19 Sep '06

hey list, we have switches from enterasys and access points from cisco, now we have configured the parameters like this example in the users file: DEFAULT LDAP-Group == "CN=xadmins,CN=users,DC=isalab,DC=local" Filter-ID == "Enterasys:version=1:policy=xadmins", Tunnel-Type:1 = 13, Tunnel-Medium-Type:1 = 6, Tunnel-Private-Group-ID:1 = 1, Reply-Message = "Welcome %u", Fall-Through = No so with this entry the enterasys switch also gets the parameters from the aironet and on the other way the same! is this the right way or is there an other possibility to give the differernt types of NAS different parameters? thanks mIke

3 3

advice
by Michelle Gates 19 Sep '06

19 Sep '06

All, We're migrating from our existing FreeRADIUS/MySQL setup to a new one. The new config is up and running in a different colo site and I'm looking for advice as to how I can overlap the two RADIUS servers temporarily without having two DBs running. Would it be best to have the old RADIUS server write to the new MySQL DB, or rather have the old RADIUS server proxy *all* requests to the new RADIUS server, or any other fabulous ideas you all may have? I'm a bit of a newbie, only been working on this for a bit now... so any/all information would be greatly appreciated! Thanks! -michelle.

1 1

Write access to the wiki
by Graham Beneke 19 Sep '06

19 Sep '06

Is access to the wiki exclusive?? I wanted to start working on a sqlcounter page since the current documentation is rather lacking and I plan to 'journal' my exploits in figuring it out... But I can't seem to find the register link that is referred to.

4 4

ERROR! Proxy listen.c error
by Guilherme Franco 19 Sep '06

19 Sep '06

Indeed, but it's happening, and now, even with ADSL modem, as you can see in the radiusd -X output below: This occurs if user mistypes password or if the realm server is down: rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 User-Name = "user(a)realm.com" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 rlm_realm: Looking up realm "realm.com" for User-Name = "user(a)realm.com" rlm_realm: Found realm "realm.com" rlm_realm: Proxying request from user user to realm realm.com rlm_realm: Adding Realm = "realm.com" rlm_realm: Preparing to proxy authentication request to realm "realm.com" rlm_eap: No EAP-Message, not doing EAP modcall: group authorize returns noop for request 20 Sending Access-Request of id 16 to 192.168.1.2 port 1645 User-Name = "user(a)realm.com" User-Password = "password" NAS-IP-Address = 192.168.1.1 Proxy-State = 0x3231 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 Sending duplicate proxied request to home server 192.168.1.2 port 1645 - ID: 16 Assertion failed in listen.c, line 558 Aborted Thanks. "Guilherme Franco" <guilhermefranco at gmail.com> wrote: > I was worried about this, but when I tested with the user > authenticating from an ADSL modem, there are no problems. > > So, might be just another of ERX's crazy behaviors. Still... it shouldn't kill the server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

first auth needs 20s
by Michael Messner 19 Sep '06

19 Sep '06

hey mailinglist, I have a little prob. with the first login via the radiusserver, it looks like this MS-Active directory -- freeradius 1.1.2 -- cisco or enterasys switch If I restart the radiusd the first try for a login needs about 20 seconds: [root@Xradius ~]# time echo "User-Name = mmessner, User-Password = m1k3" | radclient -c1 -s 127.0.0.1:1645 auth testing123 Received response ID 106, code 2, length = 71 Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "1" Reply-Message = "Welcome mmessner in the - Domain" radclient: received response to request we did not send. Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 real 0m20.285s user 0m0.072s sys 0m0.013s after this time everything goes fast, also the next login attempts! freeradius hangs for this time with the message: radius_xlat: 'CN=Users,DC=isalab,DC=local' radius_xlat: 'sAMAccountName=mmessner' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to labad01:389, authentication 0 If I sniff the packets on the AD-server in this time there are no LDAP requests. any ideas?!? thanks mIke

3 3

assigning different ippools according to huntgroups
by Ami Schieber 19 Sep '06

19 Sep '06

Hi, I have 3 NAS and want to assign Framed-IP-Address from 3 different IP pools according to the NAS the user logs in from. Config below looks fine to me and I can see that the huntgroup is indeed matched but there seems to be a problem with the postauth definition. Please advise, Ami My config has : huntgroups: t1 NAS-IP-Address == 172.16.2.1 t2 NAS-IP-Address == 172.16.3.1 d1 NAS-IP-Address == 172.16.4.1 users: DEFAULT Huntgroup-Name == "t1" Pool-Name := Pool-t1, Fall-Through = No DEFAULT Huntgroup-Name == "t2" Pool-Name := Pool-t2, Fall-Through = No DEFAULT Huntgroup-Name == "d1" Pool-Name := Pool-d1, Fall-Through = No Radiusd.conf: ippool Pool-t1 { range-start = 172.16.2.30 range-stop = 172.16.2.50 netmask = 255.255.255.0 cache-size = 20 session-db = ${raddbdir}/t1db.ippool ip-index = ${raddbdir}/t1db.ipindex } ippool Pool-t2 { range-start = 172.16.3.30 range-stop = 172.16.3.50 netmask = 255.255.255.0 cache-size = 20 session-db = ${raddbdir}/t2db.ippool ip-index = ${raddbdir}/t2db.ipindex } ippool Pool-d1 { range-start = 172.16.4.30 range-stop = 172.16.4.50 netmask = 255.255.255.0 cache-size = 20 session-db = ${raddbdir}/d1db.ippool ip-index = ${raddbdir}/d1db.ipindex } accounting { radutmp # Return an address to the IP Pool when we see a stop record. Pool-t1 Pool-t2 Pool-d1 } post-auth { # Get an address from the IP Pool Pool-t1 Pool-t2 Pool-d1 } log: rad_recv: Access-Request packet from host 172.16.3.1:32802, id=122, length=55 User-Name = "Ami" User-Password = "ami123" NAS-Port = 11 NAS-IP-Address = 172.16.3.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Ami", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry Ami at line 26 users: Matched entry DEFAULT at line 41 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "Pool-t1" returns noop for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "Pool-t2" returns noop for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "Pool-d1" returns noop for request 0 modcall: leaving group post-auth (returns noop) for request 0 Sending Access-Accept of id 122 to 172.16.3.1 port 32802 Finished request 0 radiusd.conf:

2 2

Wireless authentication via LDAP
by Tho Nguyen 19 Sep '06

19 Sep '06

Hello everyone, does any of you get freeradius working with LDAP and AP 1200? Please let me know. I have a hard time to get this system working. If you don't mind, please forward your configuration to me. Thanks, Tho

2 1

Freeradius 1.0.5 WPA/PEAP/LDAP stops answering
by Josep Martí Colomina 19 Sep '06

19 Sep '06

Freeradius 1.0.5 WPA/PEAP/LDAP stops answering, if it has problems of communications with the servant|server LDAP, even to be collapsed. To solve these problems, I have added a couple of daily reinitiation in the crontab. Can anybody suggest any better solution?. -- josep.colominaATgmail.com

1 0

Oracle conf Attached: sqlippool not working
by Guilherme Franco 19 Sep '06

19 Sep '06

Hi Mr. Peter, Like you told me before, you did some cleanups in the sqlippool.conf. Well, I've tried to install todays freeradius CVS, and it installed without the sqlippool module, don't know why. So, I've compiled it manually from freeradius-snapshot-20060918/src/modules/rlm_sqlippool/ OK, but when I run radiusd -X, I got this in the end, regardless of my configuration in sqlippool.conf and radiusd.conf: Module: Loaded SQL IP Pool sqlippool: sql-instance-name = "sql" sqlippool: lease-duration = 86400 sqlippool: pool-name = "" sqlippool: allocate-begin = "BEGIN" sqlippool: allocate-clear = "" sqlippool: allocate-find = "" sqlippool: allocate-update = "" sqlippool: allocate-commit = "COMMIT" sqlippool: allocate-rollback = "ROLLBACK" sqlippool: start-begin = "BEGIN" sqlippool: start-update = "" sqlippool: start-commit = "COMMIT" sqlippool: start-rollback = "ROLLBACK" sqlippool: alive-begin = "BEGIN" sqlippool: alive-update = "" sqlippool: alive-commit = "COMMIT" sqlippool: alive-rollback = "ROLLBACK" sqlippool: stop-begin = "BEGIN" sqlippool: stop-clear = "" sqlippool: stop-commit = "COMMIT" sqlippool: stop-rollback = "ROLLBACK" sqlippool: on-begin = "BEGIN" sqlippool: on-clear = "" sqlippool: on-commit = "COMMIT" sqlippool: on-rollback = "ROLLBACK" sqlippool: off-begin = "BEGIN" sqlippool: off-clear = "" sqlippool: off-commit = "COMMIT" sqlippool: off-rollback = "ROLLBACK" rlm_sqlippool: the 'allocate-clear' statement must be set. My radiusd.conf sqlippool testpool { $INCLUDE ${confdir}/sqlippool.conf sql-server == "x.x.x.x" sql-login == "foo" sql-password == "foo" sql-db == "foo" range-start == 1.1.1.1 range-stop == 1.1.1.100 netmask == 255.255.255.0 lease-duration == 86400 } My DB: CREATE TABLE radippool ( id INT PRIMARY KEY, pool_name VARCHAR(30) NOT NULL, framedipaddress VARCHAR(30) NOT NULL, nasipaddress VARCHAR(30) NOT NULL, nas_port INT NOT NULL, calling_station_id VARCHAR(30) NOT NULL, expiry_time timestamp(0) NOT NULL, username VARCHAR(100) ); with all the sequences, indexes and triggers included It's not even trying to access the Oracle server. What can it be? Thanks!

1 0