- Freeradius-Users - lists.freeradius.org

wpa2 enterprise separate users
by howtocisco 26 Jan '15

26 Jan '15

Hello! I have a running freeradius server version 2.1.12. Here's how thing are working: 1.Freeradius server is up and running, i have configured it to work with wpa2 enterprise eap-tls 2.Soho routers are configured to connect to freeradius server 3. In clients.conf i have defined multiple client directives ("Router1" and "Router2"), each with it's own public ip and different secret password (these are simple soho routers) 4. In users file i defined couple of users (let them be user "A" and user "B", each having their own certificate for authentication 5.User "A" is supposed to connect to Router1, and user "B" is supposed to connect to to Router2 6.User "A" can connect to Router1 via wifi, but also CAN connect to Router2, and the other way around: user "B" can connect to Router1 and Router2 (this make sense to me according how freeradius works) 7.What i want to achieve is to seperate those users the way, that they can only connect to defined Router (1 or 2, not both at the same time). Is there a way of doing it? Any help would be appreciated.

2 3

Re: Disconnect message!
by Haviaras Kostas 26 Jan '15

26 Jan '15

> Hi > > Which kind of user do you need to disconnect ? Hotspot user ? i user > CoovaChilli and deliver disconnection message on COA port of CoovaChilli > NAS using java application. it works fine. i am sorry if i did not > understand you. > > Thanks / --RM Yes, I am trying to disconnect Hotspot user from Mikrotik! The syntax is the same with the disconnect request ??? Thanks

2 1

using external script in virtual server config
by the2nd＠otpme.org 25 Jan '15

25 Jan '15

Hi list, currently i'm using freeradius-2.2.5 with an external authentication script for clear-text and ntlm requests. the setup is described here: https://www.otpme.org/redmine/projects/otpme/wiki/Freeradius_Example_Config… i have two questions regarding this setup. 1. for clear-text requests i always get "Auth: Invalid user: [heiko.baumann" on authentication failure. for ntlm request an "Auth: Login incorrect" is logged. i was using the script (exec) module before which logged "Auth: Login incorrect" on failure but i liked the idea of having the complete config in the virtual host file. i also tried to call my script from the authenticate section of my vhost but this was not working. 2. is it possible to call the script for ntlm/mschap authentication from the vhost config? currently its called from the mschap module. both are just cosmetic issues but it would be great to have everything in on file. :) also it would be great if someone with good freeradius skills could have a look at the example config because i'm not sure if its the best way to do external authentication with freeradius. regards the2nd

2 7

Change FreeRADIUS Default Port Number
by Russell Mike 23 Jan '15

23 Jan '15

Greetings Experts I often notice attacks on our FreeRADIUS server. To stop these attacks, i am thinking to change the default authentication port from 1812 to something different. 1.) Is it correct thing to do ? 2.) Would it even help ? Stop or reduce fake auth attempts ? 3.) How do we modify the default port to set different port for FreeRADIUS? Thanks / Regards --RM

4 7

Re: Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

> In v3.0.x HEAD we added the capability to send CoAs/DMs directly to a > NAS using the control:Packet-Dst-IP-Address attribute, and to read CoAs > using the detail reader. I am using Freeradius 3.0.4, I must update my version 3.0.6?

2 1

Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

Hello, I have been confused about how to create the disconnect message for a specific user. It is possible to create it from java application? I need some guidance what to read and look ! Sorry for my English! Thanks for your time and attention!

4 3

Re: Disconnect message!
by Haviaras Kostas 23 Jan '15

23 Jan '15

Thanks both of you for your responses!

1 0

using 2 autenticzation Schemes sql and ldap Ad
by Tal Assa 23 Jan '15

23 Jan '15

Hello friends im a newbie and any help will be appricaiate i would like to add the LDAP (ACTIVE DIRECTORY) Authenticaton Currently im using SQL database with daloradius support Now i would like to add the ldap authentiction . My questions is how to i telll free radius what to check first i hope i raised the question properly Tia Tal --

2 4

Documentation in HTML form
by Alan DeKok 23 Jan '15

23 Jan '15

The PDF documentation has proved to be popular. We’re getting about 100 unique addresses a day who download (and presumably read) the documentation. In the interest of making it even more accessible, we’ve converted it to HTML, with cross-links. It’s now available at: http://networkradius.com/doc/3.0.7/ We’ll update the documentation every time a new version is released. Want to see which configuration items a module takes, and what they do? No problem! Go read this page: http://networkradius.com/doc/3.0.7/raddb/mods-available/ Or which string expansions are available?. e.g. %{exec:…} http://networkradius.com/doc/3.0.7/raddb/mods-available/expansions.html And a list of “unlang” keywords: http://networkradius.com/doc/3.0.7/unlang/keywords.html As you’ll probably note, the documentation is *not* complete. However, we’re actively working on it. After a large amount of “behind the scenes” work, it’s time to make it public. Making it public means that people get to see the documentation, and we get incentive to keep it up to date. :) The web site has about 100 unique pages. We have another 100 in the pipeline which need reviewing and publishing. Then, there’s probably another 100-200 of new documentation which needs writing. Alan DeKok.

1 0

Configure SQL to timeout requests rather than rejecting if no connections available
by Noah Engelberth 23 Jan '15

23 Jan '15

I am using FreeRADIUS 3.0.4, compiled from source on CentOS 6.5. I'm using the source-compiled version rather than from package because my RADIUS servers need to make a connection to a MS SQL always-on availability group (cluster) that relies on the Microsoft SQL Native Client 11 ODBC driver (which requires a source-compiled version of unix-odbc and thus prevents me from installing the package versions of ODBC & FreeRADIUS). My infrastructure is set up with multiple MikroTik routers as the RADIUS clients, connecting to two FreeRADIUS servers in a round-robin fashion. The MikroTik routers are configured to wait 1500ms for a response from their primary RADIUS server before they re-submit the request. If they make a total of 3 unsuccessful requests with no response (the original + 2 resends) on the primary server, they will re-submit the request to the secondary server. The RADIUS requests are being made to authorize DHCP requests and hotspot sessions. Because of a difference in what reply information (for rate-limit and other similar properties) need to go out based on the two types of requests, we are using realms to route the requests off to an appropriate virtual server. Both virtual servers share the same SQL connection pool (and have different queries they pass). Occasionally, we have a network disruption (intentional or otherwise) that drops multiple hotspot sessions simultaneously, "crushing" the RADIUS server under a sharp spike in request load. The SQL module is configured as follows: pool { start = 15 min = 0 max = 45 spare = 15 uses = 0 lifetime = 0 idle_timeout = 0 } Under the heavy load situation, we're seeing entries in radius.log that there aren't enough spares, it starts opening another, and eventually runs out of connections before it can open enough additional connections (it usually only tries to add 1, maybe 2 new connections total during the course of the spike). Looking through the log of the "master" virtual server that handles the requests and proxies it off to the realm-specific handler (another virtual server on the same physical machine), we're seeing results along the lines of: Auth: Login incorrect (Home Server says so): [<client MAC>@hotspot<realm>] (from client <nas identity> port 16346 cli <client MAC>) The realm-specific virtual server is returning: Auth: Invalid user: [<client MAC>@hotspot<realm>] (from client <nas identity> port 16415 cli <client MAC> via TLS tunnel) Is there a setting change I can make to get the server to just ignore/drop the request if there are no SQL connections available, rather than sending a reject? I'm obviously still tuning my max concurrency limits to minimize the frequency of these spikes, but it would be nice if RADIUS would also help my by generating re-requests that spread out the load and distribute it across both servers, rather than just generating a bunch of rejects that block my customers until someone intervenes and cleans up the rejected sessions. Thank you, Noah Engelberth MetaLINK Technologies

4 11