- Freeradius-Users - lists.freeradius.org

Radius assigned IP for WPA2 Clients.
by Marc Beaumont 31 Dec '15

31 Dec '15

Hi, I'm in process of setting up a Xirrus Wifi access point to authenticate using a Freeradius Server. At the moment, I can get it to authenticate okay, but the client once connected always get it's IP from the DHCP server on the network. Is there a way to force it to use what I put in Framed-IP-Address as a the moment it ignores this? Marc Beaumont Network Admin / Linux Specialist Comms365 Limited e: marc.beaumont(a)comms365.com ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud http://www.intycascade.com/products/symantec/ ______________________________________________________________________

2 2

prepaid volume quota with cisco nas
by riki 31 Dec '15

31 Dec '15

Hello, i am working with Cisco NAS, it supports enforcing volume based quota. On first authorizations, i am expected to send QV value. When user runs out of quota, NAS wants to reauthorize. No problem on NAS side [1]. I am on freeradius-3.0.4 from Centos 7 repositories. Accounting is on PostgresSQL backend, acctinputoctets and acctoutputoctets are updated every 5 minutes. I can use following query for sqlcounter check on last session end expire it hourly: query = "\ SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct \ WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime \ > '%b'" I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes). Counters are cumulative for session so i have identified so far these options: 1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works. 2. i can use a trigger for update on radacct table which will insert delta of old and new value with timestamp to kind of "stats" table and use this one for sqlcounter query, counting data for last 12 5-minute intervals or so. 3. modify radacct table/update query to do the same as point 2. If you have some other ideas, please let me know. >From the future upgrade compatibility point of view, the 2 looks best. [1] http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/isg/configuration/xe-3s/as… Thanks for feedback r.

4 6

home_server status_check and radsec
by Mark Moseley 30 Dec '15

30 Dec '15

I'm still fairly new to freeradius so be gentle :) I'm setting up radsec and I had a question on home_server failover. Since the home_server is by necessity set to 'tcp', radiusd errors out with a message that 'status_check' must be set to 'none', if you try to set it to anything. Does that mean it's not possible to do failover with radsec proxies? I've got a home_server pool set up with two nodes. When I take down the first-listed home_server with tcpdump running, the freeradius on the 'client' side just keeps trying to hit the now-disabled server and never attempts the secondary. Presumably I'm missing something but google is no help so far. I can paste configs but I wanted to see first if it was known to just not be possible. Version is 3.0.4 (on Centos 7.1). The 3.0.4 -> 3.0.10 changelogs didn't have anything promising that sounded like this. Thanks!

2 4

RE: CoA config
by Franks Andy (IT Technical Architecture Manager) 30 Dec '15

30 Dec '15

I'm doing CoAs with FR..? Check out sites-available/originate-coa or radclient docs. Hope that's what you were after.. :-) -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 30 December 2015 14:35 To: FreeRadius users mailing list Subject: Re: CoA config this feature isn't available. -- Jorge Pereira On Wed, Dec 30, 2015 at 5:32 AM, Anirudh Malhotra <8zero2ops(a)gmail.com> wrote: > Can the NAS CoA config be done in NAS sql table? Or do i have to use file > only. > > BR, > Anirudh Malhotra > 8zero2 > Mail: 8zero2.in(a)gmail.com > Facebook: www.facebook.com/8zero2 > Twitter: @8zero2_in > Blog: blog.8zero2.in > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

CoA config
by Anirudh Malhotra 30 Dec '15

30 Dec '15

Can the NAS CoA config be done in NAS sql table? Or do i have to use file only. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 2

Errors authenticating certain users.
by Migo Pod 29 Dec '15

29 Dec '15

Hello List, A few years ago I inherited a FreeRADIUS environment, and it has been more or less trouble free for the whole time. In mid-December, however, we started getting reports of authentication failures from computers that were joined to our Active Directory environment and only those computers. Previously we've been having no issues authenticating people with username. AD\username. and username@realm, but on around the 16th people with the AD\username format started getting authentication failures. We're running RHEL6 with the distro supplied freeradius binary (freeradius-2.2.6-6.el6_7.x86_64) and haven't made any changes to anything besides system updates in over a year, and it has been working perfectly up until now. Here's a relevant log snippet that appears to describe the issue, but I have no idea where to start looking for a solution. +group authorize { ++[preprocess] = ok ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "podia-user", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry DEFAULT at line 50 ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Identity (AD\podia-user) does not match User-Name (podia-user). Authentication failed. [eap] Failed in handler ++[eap] = invalid +} # group authenticate = invalid Thanks in advance for any advice, -mat houser

3 8

MAC authentication using FreeRadius
by Max .M 29 Dec '15

29 Dec '15

Hi everyone, i'm looking in a way to set-up MAC authentication using FreeRadius and MySQL and any help would be much appreciated :) I have a scenario where multiple shops will have guest authenticating and when someone register to their public wi-fi, we want their MAC to be stored in the SQL database and do a check against it using MAC authentication on the Aruba IAPs. I guess I need to find a way to capture the Calling-Station-Id and store it into a table into the database and then I need to do a check against it for every MAC it receives as a "username and password' Right now I can authenticate to my captive portal using FreeRadius + MySQL, I can also enable MAC auth on my IAP and add a user with my phone's MAC address as a username and password and it's working. I'm really looking into a way to automate this :) Thanks a lot

4 8

RE: REG: change in email id
by Danner, Mearl 29 Dec '15

29 Dec '15

http://lists.freeradius.org/mailman/listinfo/freeradius-users Sent from my Android phone using Symantec TouchDown (www.symantec.com)

2 1

REG: change in email id
by Anirudh Malhotra 29 Dec '15

29 Dec '15

Hi, This is probably not the list to ask this question but I want to change my e-mail ID in the list, I have put in a request for my new email ID to be added in the list but its not added yet. Can anybody help? BR, Anirudh Malhotra

1 0

RE : Re: Problem with ldap module invalid variable expansion
by timbaledorion 28 Dec '15

28 Dec '15

According to radiusd output it cimes from the ldap conf file I sent you... But thé % {Striped ..... is replace by %u..... Don t know why ... !!!!! Envoyé depuis mon appareil Samsung -------- Message d'origine -------- De : Alan DeKok <aland(a)deployingradius.com> Date : 28/12/2015 21:26 (GMT+01:00) À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Objet : Re: Problem with ldap module invalid variable expansion On Dec 28, 2015, at 2:53 PM, Orion Timbale <timbaledorion(a)hotmail.com> wrote: > > Here is what i get in my ldap conf files > no %u but something that is more complex and like %{User-Name} Read the debug output to see where the '%u' comes from. You WILL see a '%u' when you start the server via "radiusd -X". And it WILL tell you which file that configuration is read from. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1