- Freeradius-Users - lists.freeradius.org

"Best" authentication mechanisms for Wi-Fi
by Hoggins! 06 May '15

06 May '15

Hello list, We're using FreeRADIUS to authenticate users to access our Wi-Fi. It works very well. The thing is : we use a mechanism that works perfectly for Android and Linux (NetworkManager) clients, but some can't access it, due to limitations. I'm thinking of some Windows flavors here. We store our passwords hashed in a MySQL database, and recommend the users to connect using "WPA2 Enterprise (802.11x) using TTLS method and PAP for phase2. Do you think that we could find a more "universal" combination that even "old" Windows clients would be compatible with ? I know that my vocabulary might sound really "newbie", although we've been running the system for quite some years now, and we had set it up using tutorials and some customization. But reading again the config. files, I can see that I might have to look into the specifics on Windows compatibility in eap.conf file. Anyway, in the meantime, if you have some hints on that, I'll be glad to read them. Best !

5 9

Accounting for cisco aironet
by Sautron Nick 06 May '15

06 May '15

Hello everyone, I have a problem with the accounting of HotSpots aironet cisco. The problem is that the data is fitted into the table "radpostauth" therefore I do not have all the information of accounting. Normally given should be inserted into the table "radacct" I have configured the sql.conf file, and well create the database. Have you ever encountered this problem? How to solve it? Best regards S.Nick

2 1

Getting Simultaneous-Use users to share bandwidth
by Joshua Ocero 05 May '15

05 May '15

Hello, I am using freeradius-server-2.1.0 and have an issue that I need help with. I have a Simultaneous-Use attribute set in radcheck table to 5 to allow for that number of users sharing one username. I have also set WISPr-Bandwidth-Max-Down and WISPr-Bandwidth-Max-Up to 2048000 to cap data usage to that much. However I note is that each simultaneous user is allowed the entire 2048000 bandwidth. How can I configure the server to have all simultaneous users with the same username limited to the same WISPr-Bandwidth-Max-Up/Down value (2048000 in my case)? Thanks.

2 1

Re: Integrate Freeradius with DHCP (Alan DeKok)
by Rui Ribeiro 05 May '15

05 May '15

Hi, As Alan said not simple. It could be very well possible to work it out with unlang, MySql and/or an external script to talk via OMAPI to an ISC BIND. It would be a very ugly hack. Besides that, abandoning immediately an IP in a wireless infra-structure might not be a very good idea for several reasons IMO. Regards, > 1. Re: Integrate Freeradius with DHCP (Alan DeKok) > > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 4 May 2015 08:02:25 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Integrate Freeradius with DHCP > Message-ID: <53EF4299-FB51-4B23-8CBA-E202ED817C8B(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On May 4, 2015, at 12:20 AM, Mohd Alkhaldi <alwaadalhaq(a)gmail.com> wrote: > > We have multiple Radius servers, How can we get Framed-Ip-Address from > > central DHCP server, and release the IP when receive Accounting Stop. > > There's no simple way to do this right now. > > Alan DeKok. > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

Access-Reject based on internet usage?
by Bacsó Márton Károly 05 May '15

05 May '15

Dear FreeRadius users! I work in a secondary school in Hungary. We are trying to achieve complete WiFi coverage in the building with several TP-LINK WA901ND APs (running OpenWRT 14.07). I have successfully installed Freeradius 2.1.12 and Daloradius 0.9-9 on a Raspberry Pi B+. The system works great with many freeradius check attributes, but I have failed to implement any kind of usage limit based on downloads or uploads. The AP sends the neccessary information to the server, because I can see daily/weekly/monthly/total internet usage statistics , but even if a user is over their quota the system gives them Access-Accept message. I know that without any captive portals, I won't be able to work with most of the reply attributes, but that is not I want to achieve. All I want is an Access-Reject message to the AP. (and to make my wish even more simple the 4Gb limit is enough for me) I am really newbie with Linux, so forgive me if I write anything stupid. What I already tried is to follow the way I did with time based logins and add the following lines to these files. ****************************************** *** modules/Counter *** counter maxmonthlydownload { filename = ${db_dir}/db.maxmonthlydownload key = User-Name count-attribute = Acct-Output-Octets reset = monthly counter-name = Monthly-Output-Octets check-name = CS-Output-Octets-Monthly cache-size = 5000 } counter maxmonthlyupload { filename = ${db_dir}/db.maxmonthlyupload key = User-Name count-attribute = Acct-Input-Octets reset = monthly counter-name = Monthly-Input-Octets check-name = CS-Input-Octets-Monthly cache-size = 5000 } *** sql/mysql/counter.conf *** sqlcounter maxmonthlydownloadcounter { counter-name = Monthly-Output-Octets check-name = CS-Output-Octets-Monthly sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter maxmonthlyuploadcounter { counter-name = Monthly-Input-Octets check-name = CS-Input-Octets-Monthly sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } *** sites-available/default *** maxmonthlydownload maxmonthlyupload ****************************************** Unfortunately it doesn't work. When I test the user name in the terminal window it gives Access-Accept, no matter what. What is interesting is that when I add any session time attributes I can see that in the terminal under Access-Accept message, but with Octets there is nothing. Any help would be appreciated! Márton Bacsó Bacsó Márton Károly bacsom(a)hotmail.com M.: +36 20 3315753 http://digilecke.com http://www.bacsomarton.com

1 0

accounting data to syslog
by Munroe Sollog 04 May '15

04 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 15 2014 at 05:01: 25 I have configured the linelog module to use syslog, however accounting data is still being directed to the files /var/radact/<ipaddress>/detail-<date>. Any help would be appreciated. Thanks. I have included my linelog file for reference: linelog { filename = syslog permissions = 0644 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" Access-Request = "Requested access: %{User-Name}" Access-Reject = "Rejected access: %{User-Name}" Access-Challenge = "Sent challenge: %{User-Name}" foo { bar = "Example log. Please ignore" } Accounting-Request { Start = "Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address})" Stop = "Disconnect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) %{Acct-Session-Time} seconds" Alive = "" Accounting-On = "NAS %C (%{NAS-IP-Address}) just came online" Accounting-Off = "NAS %C (%{NAS-IP-Address}) just went offline" unknown = "" } } - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJVR7LeAAoJEPbbZiWCKDVCvEIH/jdMWSBN9TCtMNzi6JdgmDb2 H/8eDa+FbQEqcwwqoo92gCGNTqHjRBLWTDjfsjCigeJkXfiwGCdiYHXs7CYpzbpf ViqHmSviEnn8n/q06DKxznuhqppNmzsZrujwUu3Ih5GSXri7qWFFa4O1qZ3dXZLx K7k4zP12LRcsjIhtXtlWv+g5VIN+QEsxZ6p/UKydM5DhNuSpgwfysvPtyAuil0pL UTc4CJtO6hxiytx/YYDdD5AjuNhjs+JDK5o0eARaASR8bcrjWPiQiBPobluEdz+N LwrML7mfPki3UuMM3di+ZLU19n3u1zrtDako1kBKCdfFLIcsrK9I+w43snSVNao= =2GjL -----END PGP SIGNATURE-----

3 6

Dynamic Realms (3.07)
by Evan Greco 04 May '15

04 May '15

Hi, I am trying to configure a FreeRADIUS server (version 3.07) to "create" dynamic realms on-the-fly. For example, upon receiving an Access-Request, I would like to be able look up the user in a database and proxy the user to another RADIUS server based on what the query returns, but NOT have the proxy server be defined in proxy.conf. From what I can tell, this doesn't currently seem to be possible as I can't run any type of unlang in proxy.conf, since it gets read during server initialization, but I've been wrong before. Has anybody managed to get a similar system up and running? Thanks! -Evan

2 1

Security issues with EAP-PWD
by Alan DeKok 04 May '15

04 May '15

The EAP-PWD module performed insufficient validation on packets received from an EAP peer. This module is not enabled in the default configuration. Administrators must manually enable it for their server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected. These issues were found by Jouni Malinen as part of investigating 2015-4 for HostAP. • The EAP-PWD packet length is not checked before the first byte is dereferenced. A zero-length EAP-PWD packet will cause the module to dereference a NULL pointer, and will cause the server to crash. • The commit message payload length is not validated before the packet is decoded. This can result in a read overflow in the server. • The confirm message payload length is not validated before the packet is decoded. This can result in a read overflow in the server. • A strcpy() was used to pack a C string into an EAP-PWD packet. This would result in an over-run of the destination buffer by one byte.

3 3

Re: Freeradius-Users Digest, Vol 121, Issue 10
by Rui Ribeiro 04 May '15

04 May '15

Obviously I meant ISC DHCP in the previous message. > > > On May 4, 2015, at 12:05 PM, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: > > > > Hi, > > > > As Alan said not simple. It could be very well possible to work it out > with > > unlang, MySql and/or an external script to talk via OMAPI to an ISC BIND. > > It would be a very ugly hack. Besides that, abandoning immediately an IP > in > > a wireless infra-structure might not be a very good idea for several > > reasons IMO. > > There is this... > > https://github.com/Feh/rlm_omapi <https://github.com/Feh/rlm_omapi> > > Code doesn't look awful. > > Might be an idea to bring it into the server. > > -Arran > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Dynamic Realms (3.07)
by Evan Greco 04 May '15

04 May '15

>You're welcome to sponsor development via NetworkRADIUS if you'd like to see it included within a set time frame. Otherwise there's only two core developers (me and Alan DeKok) and it's somewhere in the long list of features we'd like to see implemented. Fair enough. I had assumed as much, but just wanted to hear it from the horse's mouth. I'll consider sponsoring the feature, but for now I think I'll just come up with a hacky way of generating proxy.conf periodically or something to match what is in the database. Thanks for the timely response! -Evan

2 1