- Freeradius-Users - lists.freeradius.org

VPMS - reload mac2vlan file
by Keith Olsen 19 Dec '14

19 Dec '14

> > > Hello, > > Looking at using Freeradius as a VMPS solution for a project at work, and need to be able to update the mac2vlan file on a daily basis. > > So far I have only been able to get it to reload by stopping and starting freeradius (/etc/init.d/freeradius stop , /etc/init.d/freeradius start) > > the /etc/init.d/freeradius reload seems to do nothing. > > Am i missing a switch or something? > > Any advice/guidance is much appreciated. > > Thanks! > > Keith > > >

3 2

FreeRadius & ChilliSpot: Chap auth not working
by Alvaro Aneiros Veiga 19 Dec '14

19 Dec '14

Hello, I've asked a question in another forum: http://serverfault.com/q/653228/255461 To avoid duplicating I'll post basic info here. I've configured a captive portal with ChilliSpot, everything was working fine. When a user makes a login, the router send request to the freeradius server. My issue is when I tried to change the accounting to MySQL. I've configured a group to use with al the users wher I added Session-TimeOut and Idle-TimeOut in the *radgroupreply*table. I have also in the *radcheck* table defined the users with their password, something like 'Username', 'Chap-Password', ':=', 'password' > 'Username', 'ClearText-Password', ':=', 'password' I'm executing freeradius debugger and when I try to login with the user, freeradius fails and gives this message: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "garcia" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. I don't understand because there is a password defined in MySQL... Any help would be appreciated.

3 2

Reply-Message attribute
by Frank Wei 19 Dec '14

19 Dec '14

Hi all, The RFC said server can support multiple "Reply-Message" attribute. When I setup multiple "Reply-Message" on the servers "users" file and tried a Authentication request from a NAS. I can only see the first "Reply-Message" returned from the server. Does FreeRadius server support multiple "Reply-Message"? Regards, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

2 1

Firebird
by Osvaldo T Crispim Filho 18 Dec '14

18 Dec '14

Is there any firebird (for freeradius) user here? -- - Osvaldo T Crispim Filho -

1 0

OCSP Stapling with FR
by Philippe MARASSE 18 Dec '14

18 Dec '14

Folks, According to RFC 4366, during TLS handshake, server may send OCSP status along with certificate. Is it possible to do this with Freeradius ? I had an issue with OS X < 10.9.5 using WiFi with EAP-TLS auth : my mac tried to do OCSP on my radius server's certificate before getting internet access... 20s timeout before getting connected ! I think it would be nice to issue OCSP stapling to WiFi clients so they can check the certificate revocation status offline. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

3 2

Help on initial FreeRADIUS setup
by Quinn McLaughlin 17 Dec '14

17 Dec '14

Hi everyone, I’m new to FreeRADIUS and running into multiple issues setting up EAP and MySQL on a new FreeRADIUS install (OS X , Debian to come). I’d love to hire someone experienced with FreeRADIUS for a few hours to help me in the initial setup (via screenshare) and to understand the MySQL table structures, as I need another app to interface there. I’m an experienced coder but new to RADIUS concepts. I’m working with hotspot authentication. Some 1:1 help would save me days of research; thanks for your consideration. Please make sure to reply off-list. Thank you! Quinn McLaughlin

3 2

RE: FreeRadius and WPA2-Enterprise machine authentication - With ActiveDirectory interconnection..
by Franks Andy (RLZ) IT Systems Engineer 17 Dec '14

17 Dec '14

I wouldn't contradict anything others have said about this one, they know their stuff more than me, but we *sort of* do this - user auth using 802.1x plus mac address auth with macs stored in AD. Most wireless controllers I've seen will support 802.1x + MAC , and do it as 2 separate authentication transactions. Some will also let you decide the order the transactions appear in. Mac auth isn't great on its own, but in addition to 802.1x you are authing the user/whole computer with certs and the computer with mac addresses. Just my 2p, possibly off track or wrong practice though! Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Tim Reimers Sent: 11 December 2014 20:17 To: freeradius-users(a)lists.freeradius.org Subject: FreeRadius and WPA2-Enterprise machine authentication - With ActiveDirectory interconnection.. Hi everyone - I'm trying to design something here that I'm sure has been done before, but AFAIK, it crosses through a few different howto documents, and being new to this, I'm just not certain that I have pieced together all the relevant HOWTo docs and not missed a point at which the design won't communicate the needed information. The plan is to authenticate wireless users AND their computers. (so that a user cannot BYOD to the secure network; only laptops joined to the domain will work) I know that WPA2-Enterprise is what I need, to be able to have rotating keys, use Radius for authentication, etc. I know that WPA2-Enterprise requires certificates to validate the machines I already have a Microsoft CA server running in my AD environment, with the GPO needed to push out workstation certificate enrollment and so on, for other applications. My question is - Can FreeRadius (3.0.1) on centos 7 be configured to do the machine authentication using certs from the Microsoft CA server? Meraki is the wireless infrastructure, if that helps. Thanks, Tim - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 10

radiusAuthServAccessRequests - how to get?
by Bilik.AA＠lsrgroup.ru 17 Dec '14

17 Dec '14

Hello everybody! I use freeradius-server-2.2.5 and I need to get info as ’radiusAuthServAccessRequests’ from ’RADIUS-AUTH-SERVER-MIB’ through snmp and I already have ’ RADIUS-AUTH-SERVER-MIB.txt’ in ’/usr/ports/net/freeradius2/work/freeradius-server-2.2.5/mibs/’ but I didn’t find smth about how it can be done, how can I get ’radiusAuthServAccessRequests’ info? Thank you, bigwigs ☺ С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01D01A18.98D04E30]

2 1

radclient -x does not output anything anymore
by Chaigneau, Nicolas 17 Dec '14

17 Dec '14

Hello, Previously, using radclient with -x option we had a trace of the packets and value pairs sent and received, such as: Sending Access-Request Id 16 from 0.0.0.0:59582 to 10.67.106.9:1812 NAS-IP-Address = 172.20.154.213 Calling-Station-Id = '5c-0a-5b-e0-e9-64' (...) Received Access-Accept Id 16 from 10.67.106.9:1812 to 10.67.106.9:59582 length 56 Class = 0x3333363630323536343833 Not anymore. These output came from rad_encode and rad_recv functions, but were removed. How can we check what radclient sends and receives now ? Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 2

How many up un a sql ip pool
by Fabrizio Fiore Donati 16 Dec '14

16 Dec '14

Hi all, we have 3 pppoe access server, now i want to use a centralized ip pool via radius, can freeradius manage an ip pool of about 10000 ip via sql-ip pool ? -- Fabrizio Fiore Donati

2 1