- Freeradius-Users - lists.freeradius.org

rlm_graphite?
by Arran Cudbard-Bell 19 Feb '15

19 Feb '15

Just looking at graphite and wondering if anyone thinks a native rlm_graphite module to update counters using accounting data would be useful. One big advantage graphite has advantages over other systems in that it can be used to graph very large numbers of metrics. It could be used to produce traffic graphs for every user on a network for example. The module would implement the pickle protocol, and use a connection pool for TCP Connection caching. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 10

SQL based IP pool
by Fabrizio Fiore Donati 19 Feb '15

19 Feb '15

Hi, we need to user sql ip pool to assign the ip to the customer. About 10000 ip address. I see that i can use two module, Rlm_sqlhpwippool or Rlm_sqlippool which one do you suggest ? any special requirements ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

3 6

Freeradius 3.0.4 authentication to FreeIPA 4.1.2
by Charles Jennings 18 Feb '15

18 Feb '15

Environment: Fedora release 21 (Twenty One) {Linux ipa.socnet.demonet.net 3.18.5-201.fc21.x86_64 #1 SMP Mon Feb 2 21:00:58 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux} radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 19 2015 at 19:42:17 ipa: VERSION: 4.1.2, API_VERSION: 2.109 I am a freeradius noob. I figure if I can get to the point where I can do a test with radtest locally, I can get from there. I cannot find any documentation on the internet that is coherent for me to give me a step-by-step configuration for authenticating radius against FreeIPA. I would prefer (I think) to use the Kerberos portion of FreeIPA as opposed to the OpenLDAP portion - however, I can go either way. I just need a nudge in the configuration of freeradius to freeipa. Any help would be very much appreciated. As a side note, I am authenticating successfully against my IPA infrastructure - I just can't seem to find the information I need to tie freeradius to freeipa. Thanks.

3 4

Re: radwho gives an empty output
by Mert Uzun 18 Feb '15

18 Feb '15

>> To mention my work detailly, on GNS3, I have one c7200 cisco router as >> NAS(for administration access to router only, not to provide an >> internet connection) and a freeradius server on ubuntu server 14.04. I >> configured my NAS to send accounting update per one minute. In >> /var/log/freeradius/radacct/(ip of the nas)/detail-(date), I can read a >> txt file where some accounting infos are written but when I issue >> "radwho" command, I can not see anything but the titles for non-written >> accounting details. > > Read the debug output, and look for the “radutmp” module. What does it > say when the server receives an Accounting-Request? Unfortunately I saw no output by radutmp module. I only saw auth_log outputs that prompting outputs into a txt file (I tried some configurations on detail.log). I think that I may have not noticed a useful information but I have no idea about what it is. However, because I configured my NAS to request accounting logouts, my server send accounting reply when any user log off on the NAS. > >> I also issued freeradius -X command and got "ready to process request", >> my server can properly process authentication requests also. > > The point is to read the output *after* it says “Ready to process > requests”. That tells you what it’s doing when it processes requests. > I read each row after receiving a request. I couldn't see any radutmp module output as I said above. At least I know what I need to focus on now. >> However, I'm not completely unsuccessful to get any output from radwho. >> I had done some configurations on freeradius and managed to get proper >> outputs with radwho on the same topology and system. Unfortunately, my >> server got disfunctioned when I had tried to configure it for active >> directory authentication. I could only recovered it by re-installing >> then I lost and forgot what I did to use radwho. > > You should use “git” for revision control on the raddb directory. It > helps a lot. I should have learned this function before. Due to malfunctions on my computer, I lost whole topology and virtual machines but I will remember this advice in future thank you a lot. > >> I can't remember what I did to get radwho output before I lost whole >> configuration and what I can't notice now. > > If you send Accounting packets which have useful session data in them, > radwho will “just work”. > After reading this, I read my accounting configuration on the NAS. I suspected of a forgotten accounting command. Then I issued some accounting commands to apply "trial&error". Unfortunately, radwho didn't work again. I will continue to search for any missing accounting commands. In general, those details were all caused from the previous topology which I lost completely recently. I will build it up again in a few days. After a short process of adding clients and users, I will read debug details as you recommend and share results. Thanks for your help. -- Mert Uzun Elektrik Mühendisliği Bölümü-2. Sınıf Öğrencisi

1 0

Users file formatting
by Jonathan Gazeley 18 Feb '15

18 Feb '15

Hi list, This is hopefully a simple question. I've been using a simple users file to authenticate a handful of users that don't exist in AD with entries like this, which works: test-account1 Cleartext-Password := "password", MS-CHAP-Use-NTLM-Auth := no I also want to have a couple of test accounts that are restricted to MAC addresses. test-account2 Cleartext-Password := 'password', Calling-Station-Id == "00:11:22:33:44:55", MS-CHAP-Use-NTLM-Auth := no However radius -XC bombs out with "Unexpected trailing comma in check item list for entry test-account2" According to the manpage for the users file, I've formatted it correctly with commas between each check-item. I wondered if MS-CHAP-Use-NTLM-Auth was a reply-item so I tried to move it onto its own line with a tab, but this throws "Parse error (reply) for entry test-account2 (unknown error)" Can anyone advise on how to format users entries like this, and even if it is possible to require specific mac addresses in this way? Thanks, Jonathan

2 3

Weird message from RADIUS running at debug level
by Clement Ogedengbe 18 Feb '15

18 Feb '15

I am running RADIUS ( has embedded ntlm_auth to authenticate to Windows AD) at debug level. The message below gets occasionally displayed on the screen. The serer continues to authenticate users anyway, but wonder if anyone has any idea of what is going on here. Usage: [OPTION...] --helper-protocol=helper protocol to use operate as a stdio-based helper --username=STRING username --domain=STRING domain name --workstation=STRING workstation --challenge=STRING challenge (HEX encoded) --lm-response=STRING LM Response to the challenge (HEX encoded) --nt-response=STRING NT or NTLMv2 Response to the challenge (HEX encoded) --password=STRING User's plaintext password --request-lm-key Retrieve LM session key --request-nt-key Retrieve User (NT) session key --use-cached-creds Use cached credentials if no password is given --diagnostics Perform diagnostics on the authentictaion chain --require-membership-of=STRING Require that a user be a member of this group (either name or SID) for authentication to succeed --pam-winbind-conf=STRING Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required Help options: -?, --help Show this help message --usage Display brief usage message Common samba config: --configfile=CONFIGFILE Use alternate configuration file Common samba options: -V, --version Print version

3 2

Git issue
by David Peterson 18 Feb '15

18 Feb '15

When I try to checkout branch 2.x I get this: root@freeradius:/usr/src# git clone git@github.com:FreeRADIUS/freeradius-server.git Cloning into 'freeradius-server'... Warning: Permanently added the RSA host key for IP address '192.30.252.128' to the list of known hosts. Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. David

2 2

mysql, different tables based on NAS
by Miha 18 Feb '15

18 Feb '15

Hi, it is possible/how to insert based on NAS, accouting requests in different table, database? tnx miha

3 4

radperf sources ?
by Chaigneau, Nicolas 18 Feb '15

18 Feb '15

Hello, I'm interested in radperf, and I would like to know if it's possible to have access to the sources ? Thanks, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

Which version should I install?
by Angel L. Mateo 18 Feb '15

18 Feb '15

Hi, I'm upgrading my freeradius servers (running freeradius 2.2.0 on ubuntu 10.04) to a newer platform. Now that version 3.0.x is out, which version should I install? 3.0.6? or 2.2.6? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

4 4