- Freeradius-Users - lists.freeradius.org

Some new dictionaries for FR users
by Fred 01 Sep '14

01 Sep '14

Hi all, Here is some dictionaries currently not fount in freeradius 2.2.5 for following vendors : * Bluecoat (tested OK) * Citrix (tested OK) * Riverbed (not yet) Please note : I don't know if those vendors agree to publish their dictionary with freeradius, but I made this only by googleing, with no particular login. Hope this will be usefull to freeradius users ! # -oat-Group # dictionary.bluecoat # # Blue Coat Vendor Specific Attribute dictionary file for freeradius # # VENDOR BlueCoat 14501 BEGIN-VENDOR BlueCoat ATTRIBUTE Blue-Coat-Group 1 string ATTRIBUTE Blue-Coat-Authorization 2 integer VALUE Blue-Coat-Authorization No-Access 0 VALUE Blue-Coat-Authorization Read-Only-Access 1 VALUE Blue-Coat-Authorization Read-Write-Access 2 END-VENDOR BlueCoat # dictionary.citrix # Created for Citrix Use # # currently only using attribute 14 in this setup. VENDOR Citrix 66 BEGIN-VENDOR Citrix ATTRIBUTE UID 10 integer ATTRIBUTE GID 11 integer ATTRIBUTE Home 12 string ATTRIBUTE Shell 13 string ATTRIBUTE Group-Names 14 string ATTRIBUTE Group-Ids 15 string ATTRIBUTE CTXSUserGroups 16 string END-VENDOR Citrix # dictionary.riverbed # from https://support.riverbed.com/bin/support/static/doc/steelhead/8.5.2/html/sh… VENDOR Riverbed 17163 BEGIN-VENDOR Riverbed ATTRIBUTE Local-User 1 string END-VENDOR Riverbed

4 5

3.x behaviour w.r.t. unused modules
by Phil Mayers 01 Sep '14

01 Sep '14

I've just noticed something odd. If I have a module in mods-enabled but it's not referenced anywhere, FreeRADIUS still seems to load it and perform module instantiation including e.g. setting up connection pools. I don't think 2.x used to do that, or am I imagining it? For us that's undesirable as we use "radiusd -n" and start several processes up, and I don't really want to have multiple mods-enabled just to avoid instantiating e.g. SQL/redis/LDAP connections in server processes that don't reference the module. I can work around it, but am wondering if this is expected?

2 2

raddb/policy.d/canonicalization: toupper instead of tolower?
by Axel Luttgens 01 Sep '14

01 Sep '14

Hello, In rewrite_called_station_id and rewrite_calling_station_id, the MAC address is rewritten by ensuring to have hyphens as separators and by lowercasing the hex digits. Now, according to RFC 3580, the canonical format seems to be "upper case only". In that sense, wouldn't a call to toupper thus be more appropriate? Axel

1 0

Unsubscribe
by Ciprian ARSENIE 31 Aug '14

31 Aug '14

Uns Sent from my iPhone > On 31 Aug 2014, at 13:00, freeradius-users-request(a)lists.freeradius.org wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Not able to receive inner identity in Access-Accept in > EAP-TTLS. (Axel Luttgens) > 2. EAP-MD5: Access-Accept packet in debug log messages > (Axel Luttgens) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 31 Aug 2014 11:23:03 +0200 > From: Axel Luttgens <axel.luttgens(a)skynet.be> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Not able to receive inner identity in Access-Accept in > EAP-TTLS. > Message-ID: <049C2F78-6B5A-46FC-BFC5-8C1E8295B251(a)skynet.be> > Content-Type: text/plain; charset=iso-8859-1 > > Le 30 ao?t 2014 ? 18:28, Axel Luttgens a ?crit : > >> Le 30 ao?t 2014 ? 16:38, Alan DeKok a ?crit : >> >>> Alan DeKok wrote: >>>> Unfortunately, that is how it works. If you read the debug output, >>> >>> I've updated the example inner-tunnel example, >> >> Yes, I noticed that this morning. :-) > > More exactly, I only had seen the next to last change while writing the above. > But the current comment appears to be exactly the one I would have dreamed to write myself. ;-) > > Perhaps could it be worth to enhance the description of use_tunneled_reply as well? > With the current comment, use_tunneled_reply could be understood as a way to convey the inner User-Name only; but, unless I'm wrong, any attribute, even a private one, is liable to be brought to the outer session. > Moreover, the mechanism activated by that setting probably deserves a better emphasis; in particular, I'm thinking at its protocol-awareness you have described in a previous message. > > Regards, > Axel > > > > ------------------------------ > > Message: 2 > Date: Sun, 31 Aug 2014 11:56:28 +0200 > From: Axel Luttgens <axel.luttgens(a)skynet.be> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: EAP-MD5: Access-Accept packet in debug log messages > Message-ID: <97A82F0C-B772-4AD0-AF0C-286603F962D2(a)skynet.be> > Content-Type: text/plain; charset=us-ascii > > Hello, > > While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: > > (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 > (1) EAP-Message = 0x03ad0004 > (1) Message-Authenticator = 0x00000000000000000000000000000000 > (1) User-Name = 'bob' > Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 > EAP-Message = 0x03ad0004 > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = 'bob' > > BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? > > Axel > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 112, Issue 84 > *************************************************

1 0

EAP-MD5: Access-Accept packet in debug log messages
by Axel Luttgens 31 Aug '14

31 Aug '14

Hello, While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 (1) EAP-Message = 0x03ad0004 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) User-Name = 'bob' Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 EAP-Message = 0x03ad0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'bob' BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? Axel

2 1

EAP-MD5: Access-Accept packet in debug log message
by Axel Luttgens 31 Aug '14

31 Aug '14

Hello, While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 (1) EAP-Message = 0x03ad0004 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) User-Name = 'bob' Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 EAP-Message = 0x03ad0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'bob' BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? Axel

1 0

daloradius issue
by Bassem Sossan 30 Aug '14

30 Aug '14

Hi guys, *online users* shows blank green page, it was working smoothly, no changes on configurations, what is the matter?? is there any troubleshoot?? thanks in advanced

1 0

Get account's connection details
by Freddy Campbell 29 Aug '14

29 Aug '14

Hello people, I have a couple of questions to make about the working with FreeRadius. 1. Which are the differences, advantages and disadvantages of the storage of users information whether in files or sql server? 2. How can get user information about their general information, session time, amount of mb downloaded, IP connection and other statistics to show to the user? Thanks in advance. ________________________________________________________________ XII Edicion del Evento Nacional de Informatica para Jovenes. INFOCLUB. Abril. 2015. Ver www.jovenclub.cu ________________________________________________________________ -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est� limpio.

2 1

FreeRadius in Windows - was Sourceforge and FreeRADIUS
by Rui Ribeiro 29 Aug '14

29 Aug '14

Neither to intrude in this sensitive matter, nor wanting to discuss it, I would just like to ask something for the sake of information. You are saying you dont have a Windows version, however I do recall reading some months ago about a Windows paid version too. At the time I *think* it was quite deliberate that it purported to be quite official i.e. your team. If it were not for this email I would not got the slightest idea it was another individual. Regards, > Message: 1 > Date: Thu, 28 Aug 2014 12:49:55 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Sourceforge and FreeRADIUS > Message-ID: <53FF5DB3.9040304(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Someone released a "FreeRADIUS for Windows" on sourceforge. > Initially, he didn't include the source. After some discussion, he put > up a copy of the "tar" file from an official release. > > That isn't good enough. FreeRADIUS does not build or run under > Windows. Any changes made to build on Windows MUST be released publicly. > > In addition, he seems to have added a demand for a serial number. > I've been getting a steady stream of questions from people asking how > they get a serial number for the software. I've had to tell them > they've been cheated. > > All versions of FreeRADIUS will be free to download and use. Always. > Requiring a secondary license or user registration is not allowed. > > I've sent a DMCA notice to Sourceforge, and they've removed the > offending software. It will not be allowed online until it is in > compliance with the GPLv2. > > Alan DeKok. > >

6 5

FreeRadius - ActiveDirectory authentication multiple domains
by Ricardo Esteves 29 Aug '14

29 Aug '14

Hi, I need to setup a radius server in order to authenticate users against ActiveDirectory. But i've got one problem, my activedirectory has multiple domains, for example: company.com branch1.company.com branch2.company.com branch3.company.com Anyone has any idea on the best way to accomplish this task? Multiple LDAP configurations? For example with multiple ldap settings is there anyway to preprocess the autentication request with a script to find which domain the user belongs and then use the corresponding ldap configuration to that domain? Best regards, Ricardo Esteves.

5 10