- Freeradius-Users - lists.freeradius.org

Session-Timeout
by Aurélio de Souza Ribeiro Neto 08 Apr '16

08 Apr '16

Helo Again! ;) Now I'm trying to enable session-timeout. I set in MySQL database in radgroupreply table Atrribute Session-Timeout := 86400 and tried to put the same in radreply table, but is not working. Someone can help me? Radacct LOG: Fri Apr 8 15:03:38 2016 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728675 NAS-Port-Type = Ethernet User-Name = "testepppoe" Calling-Station-Id = "F8:1A:67:58:42:E7" Called-Station-Id = "CE - TESTE PPPoE" NAS-Port-Id = "ether2" Acct-Session-Id = "81e00023" Framed-IP-Address = 187.120.201.79 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2016 11:59:42 BRT" Acct-Status-Type = Start NAS-Identifier = "CE - TESTE PPPoE" Acct-Delay-Time = 0 NAS-IP-Address = 172.20.200.2 Acct-Unique-Session-Id = "8b6a5050f5d5ea7e" Timestamp = 1460138618 Thanks Aurelio

2 1

Freeradius dhcp + allow unknown-clients
by Алексей Елиферов 08 Apr '16

08 Apr '16

Hi! We have freeradius v.2.2.9 with dhcp module And it's understand how to give IP-address with MAC or opt82. But if it's a new client, that does not established in mysqldb, how to give IP? In isc-dhcp it is doing by allow unknown-clients and dynamic pool. Does freeradius have anything like it? -- Sincerely yours, Yeliferov A. CTO LLC INTRAFFIC intraffic.ua / 044.200.44.00

4 3

COA to multiple NAS
by Mike 08 Apr '16

08 Apr '16

Hi I've got a scenario where we have multiple NAS devices authenticating their clients via a freeradius server. I want to originate COA requests to the NAS devices from the radius server and I have succeeded for one device by making an entry for a specific NAS in the home-server section of originate-coa. We add and remove NAS devices quite often and don't want to have to reconfigure originate-coa and restart freeradius every time. How we can enable dynamic addition of NAS to send COA requests OR can we send COA to servers without preconfiguring? Currently using & testing Freeradius 2.2.6 but in the process of migrating to 3, latest.

5 10

Proxy Freeradius 3.0.11 remove Message-Authenticator
by LABAT, Xavier 08 Apr '16

08 Apr '16

Hello, We would like to upgrade our proxy RADIUS solution from Freeradius 2.2.6 to Freeradius 3.0.11. We collect and switch PPP authentication/accounting requests to our different customers. One of them reject all authentication request if they are sent with < Message-Authenticator > attribute. We would like to upgrade without asking any changes to our clients. We configure the home_server with option "require_message_authenticator = no" in proxy.conf but < Message-Authenticator > attribute is still present in the proxy request. Alan DeKok said previously : "> I believe Message-Authenticator is now always sent in 3.0, unconditionally. Yes. It's best to always send it. It enables security and debugging checks that are otherwise not possible." Even if it's recommanded, is it possible to remove < Message-Authenticator > attribute in the proxy request ? Regards. Xavier -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

3 3

Multiple instances of custom module
by Richard Levenberg 08 Apr '16

08 Apr '16

I have a custom module that is working perfectly with FreeRADIUS. I am now interested in creating multiple instances of the module for different NAS's that might be connecting via RADIUS. So from what I gather I can use unlang's switch statement in both the authorize and authenticate sections of the config file like so: authorize { . . switch &request:NAS-IP-Address { case "192.168.1.100" { customer1 } case “192.168.1.110” { customer2 } case { reject } } . . } authenticate { . . Auth-Type CUSTOM { switch &request:NAS-IP-Address { case "192.168.1.100" { customer1 } case “192.168.1.110” { customer2 } } } . . } So my questions are 1) is that the correct way to address multiple instances and 2) is the default case of reject in the authorize section the appropriate way to limit things to the defined instances? r

2 1

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 07 Apr '16

07 Apr '16

Thanks Alan, the NAS and Fortigate does RADIUS. The easiest way for me is to configure NAS to forward RADIUS accounting packets to Fortigate. But my freeRadius is not sending Class attributes in Access-Accept to NAS client, thus NAS client isn't sending any Class info to Fortigate. However freeRadius is sending Class attributes in Access-Challenge to NAS !!!. Is there a command to include Class attributes in Access-Accept ?. Eby -------------------------------------------- On Wed, 6/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, 6 April, 2016, 4:39 PM On Apr 6, 2016, at 9:22 AM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > FreeRADIUS Version 2.1.12, Ubuntu 14.04 LTS You should really upgrade. 2.1.12 is many years out of date. > I'm trying to send copy of accounting packets to Fortigate. Is there any official documentation / example for this ?. There is a lot of documentation on proxying. There is no documentation for "how do I configure vendor X product Y firmware Z". If the product does RADIUS, then normal RADIUS configuration will work. If the product doesn't do RADIUS, throw it in the garbage and buy one that does RADIUS. > I'm trying to get "Group" info of authenticated users for providing access to other networks thru RSSO. Doesl the Fortigate documentation say it returns a group in a RADIUS attribute? If not, then it's impossible. > I configured as per the following blog, > https://freeradiustips.wordpress.com/2015/02/17/forward-accounting-packets-… That's better than most, but I'm still amazed at the work people put into *not* reading the documentation that comes with FreeRADIUS. > Fortigate interface is listening for Radius Accounting packets, yet i'm not getting any accounting packets from freeRadius. Not sure i've missed anything vital. Run the server in debugging mode as suggested in the FAQ, "man" pages, web pages, and daily on this list. This is documented. Alan DeKok.

2 1

Implementing Dynamic Interface Group Assignment with Cisco WLC
by Clement Ogedengbe 07 Apr '16

07 Apr '16

Hi, Does anyone have any idea about what attribute to use to return parameter to Cisco WLC for Interface group assignment instead of Tunnel-Private-Group-Id which just returned the VLAN ID. Best Regards Clement -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Stefan Winter Sent: 06 April 2016 08:31 To: freeradius-users(a)lists.freeradius.org Subject: Re: using SSL certs with EAP-TLS Hi, >> No. If your server certificate is from a CA, the client can verify >> that your server is genuine (if the client side is configured >> correctly to actually check CA and server name). > With using client: you mean the RADIUS explanation of client? Like the > Access Point? or the WLAN device, like a smartphone? In this context, I meant the WLAN device. >> Since there's no need to go down that route: don't. Issue client >> certificates from your own self-signed CA, and hand out client certs >> only to your own account holders. Then, no further checks are needed. > Ok, thanks. I will reconsider. It's not that I am too lame to generate > new certs and then import them to a handful devices. It's more that I > like it that the same client cert in iOS can be used for S/MIME and > for auth with WPA2 Enterprise. Ah, well that's a reason for using a commercial CA for the client certs indeed. As others have pointed out, attributes like TLS-Client-Cert-CN can be used to compare the cert name against a list of known-good names. Of course you'll have to manage that list of names yourself in config; on a scale of "handful" that's not a problem I guess. But on a larger scale, it will get bothersome. Greetings, Stefan Winter > >> Yes. There are examples in the shipped tarball of FreeRADIUS for that >> I think. That does not mean that it's the best idea to go down that route. > I'll look into that (I think it has something to do with the by Alan > suggested check_cert_cn). > >> When you write above that you can use whatever string you like then >> probably you didn't try this at a remote hotspot. :-) > Thats correct :D. In fact, last week was the first time I experienced > WPA2 Enterprise and only with one (my own) AP. > > Cheers! > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 3

comprehensive logging
by Anirudh Malhotra 06 Apr '16

06 Apr '16

Hi everyone, I am trying to do comprehensive logging of requests coming to the radius server, so that the administrators can know what user is doing wrong. So i read about linelog and have configured somethings as follows: - I have added a variable in dictionary - # default file authorize section -sql if(ok){ update control { My-Local-String := "sql_selected" } linelog } - # linelog module reference = "messages.%{%{control:My-Local-String}:-default}" messages { sql_selected = "user found in sql for %{User-Name}" } and it works, but I wanted to know is it the correct way to do it. As I want to achieve it in best possible way. if not Is there any other way to do comprehensive logging? BR, Anirudh Malhotra

2 3

EAP-Type in logs
by Anirudh Malhotra 06 Apr '16

06 Apr '16

Hi everyone, I want to get EAP-type printed in my linelogs where does freeradius set it? Or is it set ever? I tried to print a linelog in authorize in inner-tunnel which prints EAP-Type but it comes out empty. Also are there any drawbacks to copy attributes to inner-tunnel? Why is the flag by default set to no? BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 2

Forward Accounting Packets to Fortiage - need help
by Eby Mani 06 Apr '16

06 Apr '16

FreeRADIUS Version 2.1.12, Ubuntu 14.04 LTS I'm trying to send copy of accounting packets to Fortigate. Is there any official documentation / example for this ?. I'm trying to get "Group" info of authenticated users for providing access to other networks thru RSSO. I configured as per the following blog, https://freeradiustips.wordpress.com/2015/02/17/forward-accounting-packets-… Fortigate interface is listening for Radius Accounting packets, yet i'm not getting any accounting packets from freeRadius. Not sure i've missed anything vital. Thanks, Eby

3 2