- Freeradius-Users - lists.freeradius.org

Timezone support
by Gunther 31 Oct '05

31 Oct '05

I'm using FreeRadius 1.0.5 with MySQL 4.1.10. I am looking for a solution for timezone support over several timezones. There are probably several ways of doing this: 1. Set server with FreeRadius to the particular fixed timezone e.g. GMT 2. Set MySQL to a fixed timezone (my.cnf timezone= ...) 3. others ... Where are timezones used: - System - MySQL - PHP Application - FreeRadius I do not like to change the server timezone as other applications are using the same server. Same thing for setting MySQL to a fixed timezone, which is not my normal timezone, as other applications are using other DBs on the MySQL server. I thought I can use the MySQL session specific timezone settings, but I do not see anyhwere a place where I can set that in FreeRadius. I can set everything in PHP, but when it comes to radacct updates from a NAS ... I only have the MySQL specific timezone. It looks like that FreeRadius is always using the System specific time and does not care about the MySQL timezone settings. My goal: I like to have all radacct date&time in e.g. GMT and then convert in my application to the NAS specific timezone. Right now I can only achieve this by setting the MySQL timezone to GMT and ALL DB's are then in that timezone. Or I run a separate instance of MySQL with different port to do this? Any thoughts? Is there maybe a variable in FreeRadius telling to store time information in another timezone? Do I have to switch from MySQL tp Postgresql ... there are probably many people using FreeRadius with NAS' spreaded over several timezones. Thx!

1 0

freeradius and machine account authentication
by Norbert Wegener 30 Oct '05

30 Oct '05

To restrict access to a lan the network shall be equipped with switches, that are capable of 802.1x authentication on a per port basis. Only client machines with a valid machine account in a central active directory shall get access. As I have never had to do with active directory, I am unsure, whether freeradius is suited to be used for the authentication process. googling around I found the following assertion: FreeRADIUS at this time cannot perform machine account authentications, but it supports proxying them off to another RADIUS server (for example, IAS, or FUNK) see: http://listserv.educause.edu/cgi-bin/wa.exe?A2=ind0505&L=wireless-lan&T=0&F… Is this true? If not, is there any documentation available, that describes the setup? Which credentials are used by that kind of authentication: account names/passwords , certificates,...? Thanks Norbert Wegener

2 3

v 1.05 and %{Cisco-AVPair[ ]}
by Velikanov 30 Oct '05

30 Oct '05

Good day. What must i do to use "%{Cisco-AVPair[ ]}" with FreeRadius v 1.05 Thanks.

3 2

Post authentication Bandwidth control
by Alex M 30 Oct '05

30 Oct '05

How can I use Post authentication to control the user's bandwidth??? Thanks!

1 0

changing "invalid username or password" message - how to do?
by Westweb Tech 29 Oct '05

29 Oct '05

Hi folks - I am in need of a way to get a message to non-paying customers when they try to login. Is it possible to change the "invalid username or password" message to read something else? Or, is it possible using radius to force a dial-in customer to redirect to one web page only (a non-payment notice page?) I can provide more info if needed. I am currently not using freeradius but will use it if this will work somehow. Thanks, AW

1 0

ap telabria and freeradius
by Nurul Faizal M.Shukeri 29 Oct '05

29 Oct '05

Hi. Anyone who has experiences configuring telabria to authenticate with freeradius, plz help me. I'm stuck.

1 0

Accounting and anonymous outer identity in EAP-TTLS
by Damjan 29 Oct '05

29 Oct '05

I've been searching the mail list about this, but haven't found a definitive sollution. The scenario, I'm using WPA2 access points, they are setup to authorize users against my freeradius server. The freeradius server is setup to use a MySQL database, and eap-ttls is configured (and that works ok). My Windows clients connect with the SecureW2 (1) supplicant. The problem is that radius accounting requests have the User-Name = anonymous attribute/value, so I can't separate accounting from different users. I've tried to replace the User-Name in the Access-Accept reply, with this configuration: - I have this in the "users" file: DEFAULT FreeradiusProxiedTo == 127.0.0.1 User-Name := "%{User-Name}", FallThrough = yes BTW I've tried User-Name = "%{User-Name} too. And this is the authorize section in radiusd.conf: authorize { preprocess chap mschap suffix eap files sql } The problem is that the Access-Accept reply from freeradius has two User-Name AV pairs, like this: User-Name := "anonymous" User-Name := "damjan" And the accounting packet has the User-Name = "anonymous" AV pair. Shouldn't the := operator in "user" replace the User-Name = "anonymous", or it doesn't because files is before sql in the authorize section, and my users are in the MySQL database?... and if I put sql before files, that DEFAULT entry will not be triggered, am I right? Can I just remove UserName from the "authorize_reply_query" SELECT in sql.conf? Note however that the same radius instance is used for non-EAP clients too, those clients authenticate through chillispot and use plain and simple PAP. My platform is: slackware linux 10.1 openssl-0.9.7e freeradius-1.0.2 (I'd update if that's a sollution but this system has several radius instances (ports) in production use) (1) http://www.securew2.com/ -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

2 2

Re: FreeRADIUS - 802.1x WPA-TKIP, WPA2-AES settings
by Damjan 28 Oct '05

28 Oct '05

> add to it: forward the DHCPDISCOVER to the DS if no internal table entry > for this MAC is found. yapp, that would be even very easy to integrate. > > but i don't think that _any_ AP does that. Well, an AP that does 802.1x + chillispot is all you need :) You get the accounting, bandwidth shapping and traffic limits for free > >>just for the case: no, it is > >>NOT possible to assign IP addresses by 802.1X; you have to do DHCP after > >>the authentication (yes, it is strange). > > > > > >A clever AP could support this: > >1. Serving DHCP to the wireless netowork only > >2. Getting the Framed-IP-Address from the radius Access-Accept, and > >putting it in a internal table (MAC -> IP) > >3. Serving that exact IP via DHCP when the subsciber asks for a lease. > > > >I don't know of an AP that does that, though. > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

1 0

Upgrading Realms
by Jeffrey Froman 28 Oct '05

28 Oct '05

Hi, I have a working installation of freeradius 0.9, and I am attempting to migrate my configuration to freeradius-1.0.4 on a newer server. Authentication for the local domain is working fine, but there is a problem with way realms are being handled. In huntgroups, I have the following: MyHunt Client-IP-Address == "192.168.1.12", Realm == "star.my.com" and in proxy.conf: realm star.my.com { type = radius authhost = LOCAL accthost = LOCAL } radiusd uses LDAP for authentication, with a filter that includes: (objectClass=%{Huntgroup-Name}) Under freeradius-0.9, when handling a request for user(a)star.my.com, this filter is expanded to: (objectClass=MyHunt) But under 1.0.4 I get: (?=undefined) Any ideas as to why this is happening, or what updates need to be made to my configuration? Thank you, Jeffrey

1 0

rlm_sql module won't compile under Solaris 10
by M.McNeil 28 Oct '05

28 Oct '05

Hello, I'm trying to get FreeRadius 1.0.5 to compile with MySQL / RLM_SQL, under Solaris 10. Configure works just fine, however, after running "make", I get the following: gmake[7]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' Making static in drivers... gmake[8]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' /usr/sfw/bin/gmake -w WHAT_TO_MAKE=static common gmake[9]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' Making static in rlm_sql_iodbc... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making static in rlm_sql_mysql... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none -c sql_mysql.c -o sql_mysql.o gcc: language c99=none not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none sql_mysql.o -o rlm_sql_mysql.a mkdir .libs (cd . && ln -s sql_mysql.lo sql_mysql.o) ar cru rlm_sql_mysql.a sql_mysql.o ar: cannot open sql_mysql.o No such file or directory ar: sql_mysql.o not found gmake[10]: *** [rlm_sql_mysql.a] Error 1 gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[8]: *** [static] Error 2 gmake[8]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[6]: *** [static] Error 2 gmake[6]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/freeradius-1.0.5' *** Error code 2 The following command caused the error: /usr/sfw/bin/gmake WHAT_TO_MAKE=all common make: Fatal error: Command failed for target `all' I dowloaded the binary MySQL package from mysql.com and added /usr/local/mysql to my PATH and LD_LIBRARY_PATH variables. FreeRadius can see the files, however, it will *not* compile the rlm_sql module. I've combed the mailing list archive, but I have yet to find a solution to this problem. Has anyone else experienced this issue ? Best Regards, Mike McNeil Sr. Network Engineer Communications & Network Services University of California Berkeley

1 0