- Freeradius-Users - lists.freeradius.org

How to work with dynamic ips from ippool and static ips for clients?
by Diorges Rocha - Radionet Telecom 09 Jul '16

09 Jul '16

Is there a way to do this in the same datatabase? I would like to work with ippool, but some users need static ip. How to proceed in this case? Thank you -- Diorges Rocha Gerente de TI Tel.: (67) 3451-4035 Cel.: (67) 9938-1105 R. Edson Bezerra, 685 - Centro Itaporã - MS - Brasil CEP 79890-000

2 1

Re: error coovachilli , freeradius, yfi hotspot manager
by José Borges 08 Jul '16

08 Jul '16

>> redir.c: 1023: 98 (Address already in use) IP: 10.1.0.1 Port: 3990 - >> Waiting for retry. Start with that. That usually means chilli hasn't been properly configured yet. I also have this... what is the solution?

2 1

add realm based on NAS-IP
by tirili＠web.de 08 Jul '16

08 Jul '16

Hello list, I just want to add users coming from a specific NAS add a realm. This seems not to be working. Any help is appreciated. These files are modified for testing purposes. DEFAULT NAS-IP-Address == "127.0.0.1" User-Name = "%{User-Name}(a)test.local" DEFAULT NAS-IP-Address == "192.168.1.238" User-Name = "%{User-Name}(a)test.local" I have ./users to identify the user. testuser1(a)test.local Cleartext-Password := "geheim" testuser2 Cleartext-Password := "geheim" When performing a "radtest testuser1(a)test.local geheim 127.0.0.1:1812 0 testing123" this is working. Sending Access-Request Id 146 from 0.0.0.0:43466 to 127.0.0.1:1812 User-Name = 'testuser1(a)test.local' User-Password = 'geheim' NAS-IP-Address = 192.168.1.238 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 146 from 127.0.0.1:1812 to 127.0.0.1:43466 length 20 When performing a "radtest testuser2 geheim 127.0.0.1:1812 0 testing123" this is working as well (but should not, as @test.local should be appended!!) Sending Access-Request Id 25 from 0.0.0.0:45877 to 127.0.0.1:1812 User-Name = 'testuser2' User-Password = 'geheim' NAS-IP-Address = 192.168.1.238 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 25 from 127.0.0.1:1812 to 127.0.0.1:45877 length 20 When performing a "radtest testuser1 geheim 127.0.0.1:1812 0 testing123" I get a reject (but should not, as @test.local should be appended). Sending Access-Request Id 223 from 0.0.0.0:38701 to 127.0.0.1:1812 User-Name = 'testuser1' User-Password = 'geheim' NAS-IP-Address = 192.168.1.238 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Reject Id 223 from 127.0.0.1:1812 to 127.0.0.1:38701 length 20 (0) -: Expected Access-Accept got Access-Reject Attached is full debug output. Any help is appreciated. Best regards, Thomas

2 2

New EAP method: EAP-AKA.
by Alan DeKok 08 Jul '16

08 Jul '16

We' just added EAP-AKA to the v4.0.x branch. This method is similar to EAP-SIM, and is mainly used in the telco industry, especially in WiFi hand-off. This work was sponsored by a telco who wishes to remain anonymous. We have another popular EAP method coming soon, too. The new EAP methods will not be available in version 2.x or version 3.0, as those are stable versions which have no new features. They will be available in the v4.0.x branch, which has other new features which the methods need. Alan DeKok.

5 8

Contextual mapping of LDAP attributes
by Adamczak Krzysztof 07 Jul '16

07 Jul '16

Hey guys, I have another question. Again I haven't found nice solution yet. How can I map different LDAP attribute to the same RADIUS attribute depending on some access request parameters? E.g. in my LDAP I have: - adslVirtualRouterName - xdslVirtualRouterName - xxxVirtualName I'd like to map this LDAP attribute to RADIUS ERX-Virtual-Router-Name depending on e.g. NAS-IP-Address. One solution would be declare some additional variables in /etc/raddb/dictionary and just map it in ldap module update section. But is there better solution? thanks, Krzysztof

5 7

Return or not return
by Franks Andy (IT Technical Architecture Manager) 07 Jul '16

07 Jul '16

Hi all, Another basic question. I feel like a dunce coming here. Oh well, here goes : I'm confused about the correct way to exit processing of a policy/unlang bit of "code". I guess I'm used to treating them like subroutines, but that may be naughty behaviour since I'm not sure return is exactly what I want, in fact I'm fairly sure it isn't, as a way of halting processing of a policy based on condition checks. I found this out the hard way when setting up a nas to do periodic updates and seeing that it was just sending a barrage of start packets and whinging that it couldn't talk to the radius server. The last part of my accounting statement did a check to see if this was an interim-update, and if not, do a return. The outcome was that the radius server exits the accounting bit without sending a response back, which is by design. Anyway, is there a better way of stopping a set of checks etc for a policy or module without using if .. else throughout the policy, and continuing the rest of the authorisation or accounting section? If not, I'll have to end up trying to put the code that has returns in as the last bit of an auth or possibly accounting section or nesting everything up which makes for awkward structure. I've tried using noop, ok or similar, setting the module return default=1 to try and "catch" the return, but it's obviously not supposed to work like that. I have read http://wiki.freeradius.org/config/Fail-over but I'm still struggling to match what I'm after. Thanks Andy

2 2

Accounting interim data delta
by liran kessel 07 Jul '16

07 Jul '16

Hi, we have a radius server installed collecting accounting data from a Cellular network. Currently we receive the Interim update every 30 minutes, and it updates the radacct table correctly . What we need is to be able to know what was the delta of acctinputoctets and acctoutputoctets that was received in this event , in comparison to the data that was already in the DB from the previous notifications. Can I somehow enter this delta into a different table that will show me the usage for each notification? Thanks Liran

2 7

FreeRADIUS 3.0 - Help with understanding op value for cleartext-password
by Ian Hiddleston 06 Jul '16

06 Jul '16

Hi all, I've got my server working ok, one thing that I'm curious about is why the op value for Cleartext-Password is ':=' rather than '==' ? As my google-fu appears to be lacking I figured I might as well ask the question. Thanks, Ian.

4 4

Called-Station-Id
by Манцуров Дмитрий Вячеславович 06 Jul '16

06 Jul '16

Hi All, Tell me, please, how to make so that the montlycounter module in accounting section works only when Called-Station-Id starts with 8 (Called-Station-Id = '8.....')? I think that the need to write something on unlang use a regular expression, but I do not know how to do it correctly. Thanks.

2 1

using SSL certs with EAP-TLS
by Wouter 05 Jul '16

05 Jul '16

Goodday, In my FreeRadius setup for authenticating WiFi devices with EAP-TLS, I use server- and client SSL certificates from CA provider ' X '. I understand that now everyone with knowledge of this fact, can get a client SSL cert (PKCS#12) from this CA provider X and can authenticate with my WPA2 Enterprise network. After reading the following from the README: "In general, you should use self-signed certificates for 802.1x (EAP) authentication. When you list root CAs from other organisations in the "ca_file", you permit them to masquerade as you, to authenticate your users, and to issue client certificates for EAP-TLS." I would like to ask the following question. Is there something I can configure on the server side that only certain CommonName's and/or serial's can be used to authenticate correctly? Next to this question, I wonder why also a username (Benutzername) is asked in iOS when we use EAP-TLS with a certificate? I can fill out this field with whatever string and it authenticates in FreeRadius (when a correct cert is presented of course). screenshot: https://hilfe.uni-paderborn.de/images/thumb/4/4f/Eduroam_iOS7_04.png/250px-… I run version 3.0.11 on Ubuntu 14.04 LTS 64bit. Thank you

4 10