- Freeradius-Users - lists.freeradius.org

Freeradius and Cisco PPP forwarding
by Olivier CALVANO 26 Jan '15

26 Jan '15

Hi i want create with my cisco router a L2TP/PPP proxy forwarder. I use Freeradius for auth/accounting and want sent by radius the final destination of the tunnel.. Anyone have a configuration sample for freeradius ? thanks Olivier

3 2

checkrad and db based simultaneous use checks
by Bill Schoolfield 26 Jan '15

26 Jan '15

Hello All A client of mine just asked that we limit active sessions per user to 1 (e.g simultaneous use checking). Radutmp was already configured but I disabled it in favor of the checks via the SQL module. Things look to be working but I'm concerned as the radacct table has lots of (possibly old/bogus) records with no stop info that I assume will cause the check to return false negatives. We also configured checkrad and it is working. My question is this: how exactly is checkrad used? Is it used exclusively or in concert with the SQL module checks? Will I need to cleanup the radacct table or will checkrad "save" me? I have reviewed all the documents and configuration I can find but checkrad use is still a bit of a mystery to me. Bill

2 3

wpa2 enterprise separate users
by howtocisco 26 Jan '15

26 Jan '15

Hello! I have a running freeradius server version 2.1.12. Here's how thing are working: 1.Freeradius server is up and running, i have configured it to work with wpa2 enterprise eap-tls 2.Soho routers are configured to connect to freeradius server 3. In clients.conf i have defined multiple client directives ("Router1" and "Router2"), each with it's own public ip and different secret password (these are simple soho routers) 4. In users file i defined couple of users (let them be user "A" and user "B", each having their own certificate for authentication 5.User "A" is supposed to connect to Router1, and user "B" is supposed to connect to to Router2 6.User "A" can connect to Router1 via wifi, but also CAN connect to Router2, and the other way around: user "B" can connect to Router1 and Router2 (this make sense to me according how freeradius works) 7.What i want to achieve is to seperate those users the way, that they can only connect to defined Router (1 or 2, not both at the same time). Is there a way of doing it? Any help would be appreciated.

2 3

Re: Disconnect message!
by Haviaras Kostas 26 Jan '15

26 Jan '15

> Hi > > Which kind of user do you need to disconnect ? Hotspot user ? i user > CoovaChilli and deliver disconnection message on COA port of CoovaChilli > NAS using java application. it works fine. i am sorry if i did not > understand you. > > Thanks / --RM Yes, I am trying to disconnect Hotspot user from Mikrotik! The syntax is the same with the disconnect request ??? Thanks

2 1

using external script in virtual server config
by the2nd＠otpme.org 25 Jan '15

25 Jan '15

Hi list, currently i'm using freeradius-2.2.5 with an external authentication script for clear-text and ntlm requests. the setup is described here: https://www.otpme.org/redmine/projects/otpme/wiki/Freeradius_Example_Config… i have two questions regarding this setup. 1. for clear-text requests i always get "Auth: Invalid user: [heiko.baumann" on authentication failure. for ntlm request an "Auth: Login incorrect" is logged. i was using the script (exec) module before which logged "Auth: Login incorrect" on failure but i liked the idea of having the complete config in the virtual host file. i also tried to call my script from the authenticate section of my vhost but this was not working. 2. is it possible to call the script for ntlm/mschap authentication from the vhost config? currently its called from the mschap module. both are just cosmetic issues but it would be great to have everything in on file. :) also it would be great if someone with good freeradius skills could have a look at the example config because i'm not sure if its the best way to do external authentication with freeradius. regards the2nd

2 7

Change FreeRADIUS Default Port Number
by Russell Mike 23 Jan '15

23 Jan '15

Greetings Experts I often notice attacks on our FreeRADIUS server. To stop these attacks, i am thinking to change the default authentication port from 1812 to something different. 1.) Is it correct thing to do ? 2.) Would it even help ? Stop or reduce fake auth attempts ? 3.) How do we modify the default port to set different port for FreeRADIUS? Thanks / Regards --RM

4 7

Re: Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

> In v3.0.x HEAD we added the capability to send CoAs/DMs directly to a > NAS using the control:Packet-Dst-IP-Address attribute, and to read CoAs > using the detail reader. I am using Freeradius 3.0.4, I must update my version 3.0.6?

2 1

Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

Hello, I have been confused about how to create the disconnect message for a specific user. It is possible to create it from java application? I need some guidance what to read and look ! Sorry for my English! Thanks for your time and attention!

4 3

Re: Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

Thanks both of you for your responses!

1 0

using 2 autenticzation Schemes sql and ldap Ad
by Tal Assa 23 Jan '15

23 Jan '15

Hello friends im a newbie and any help will be appricaiate i would like to add the LDAP (ACTIVE DIRECTORY) Authenticaton Currently im using SQL database with daloradius support Now i would like to add the ldap authentiction . My questions is how to i telll free radius what to check first i hope i raised the question properly Tia Tal --

2 4