- Freeradius-Users - lists.freeradius.org

TACACS+ question
by Alan DeKok 15 Apr '14

15 Apr '14

Is anyone interested in TACACS+ support in FreeRADIUS? We're looking at development priorities for the next year. We'd like to know whether or not TACACS+ is of interest. i.e. Are you using it now? If so, would you consider switching to FreeRADIUS for TACACS+? Alan DeKok.

15 15

Default Authorization Level
by Michael Harvey 15 Apr '14

15 Apr '14

I am trying to use freeradius to handle login's into my Adtran gear such as the MX 2820. I can get Authentication to work but I am trying to set up Authorization for the gear. For Default Authorization Level my choices are NONE READ READ/WRITE TEST ADMIN Right now I have it set to Admin but I want to be able to set some users to READ and some to READ/WRITE. As is typical with Adtran their documentation on this is lacking. If anyone has had any experience on this please point me in the right direction.

1 0

Freeradius proxy support
by Ilavajuthy Palanisamy 15 Apr '14

15 Apr '14

Hi, I'm new to Freeradius. I would like to get some pointers and documentation details about setting up Freeradius as proxy. Our requirement is to have a Radius proxy and modify the Access Accept response based on certain criteria. Few questions regarding Freeradius proxy support. Does Freeradius proxy has support for a plugin probably in Java to snoop the Radius request calls? Does Freeradius proxy setup has option to specify which Radius server to pickup based on some attribute value in Access Request? Our requirement is to have multiple Radius Servers for certain groups. This group information will be available in one of the VSA in Access Request. Any help will be really helpful. Thanks, Ila.

4 8

User-Name in the Accounting log is being stripped
by Clement Ogedengbe 15 Apr '14

15 Apr '14

Hello, I am proxying non-local requests to an offshore server for authentication. Authentication process is successful but the reply log shows that User-Name is being stripped for some offshore users. I configured my detail reply_log file with the following: header = "%{Packet-Src-IP-Address} Returned from %{home_server:ipaddr} for User %{User-Name} - %t" The reply log captured shows the records below: The User-Name in the header for the reply_log shows the complete user-name whereas the user-name in the reply log record is being stripped for some reasons. As a result of this, the accounting log is showing the "stripped" user-name instead of the complete user name. Extract of reply log below: 10.255.252.248 Returned from roaming0.ja.net for User user(a)domain.com - Tue Apr 15 10:49:59 2014 Packet-Type = Access-Accept Tunnel-Private-Group-Id:0 = "222" User-Name = user@domain.<mailto:user@domain.> Extract of accounting log below: 10.255.252.248 - Tue Apr 15 10:50:36 2014 User-Name = "user@domain." NAS-Port = 13 NAS-IP-Address = 10.255.252.248 Framed-IP-Address = 172.21.30.255 NAS-Identifier = "XXX_WLC5" Airespace-Wlan-Id = 4 Acct-Session-Id = "534d00ec/ac:22:0b:a2:a2:b8/6564" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=0afffcf800002060534d0098" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "222" Event-Timestamp = "Apr 15 2014 10:50:36 BST" Acct-Status-Type = Start Calling-Station-Id = "172.21.30.255" Called-Station-Id = "10.255.252.248" Acct-Unique-Session-Id = "948506c37df9d95c" Timestamp = 1397555436 Clement

2 5

Re: FreeRADIUS auditory and performance
by Antonio Fernández Pérez 15 Apr '14

15 Apr '14

Thanks for your replies and your advices. I have choosen status virtual server to check some statistics and then, using a small PHP script, write it into database. After that (Even being not enough), I will make some operations to get statistics about the service and its use. Regards, Antonio.

1 0

Is LDAP + EAP Possible For Me?
by Ethan Chrisawn 15 Apr '14

15 Apr '14

I've been searching for a while now, and I can't seem to find a good answer. I have an ldap server and I would like to authenticate my users wirelessly without generating individual client certs for every device. I heard that PEAP doesn't require the manual creation of client certs, but I can't use that with ldap because I can't pass it a cleartext password, right? What other options do I have to accomplish what I'm after?

4 3

FreeRADIUS auditory and performance
by Antonio Fernández Pérez 15 Apr '14

15 Apr '14

Hi everybody, I would like to know how can I do this on my server: Check FreeRADIUS performance and authentication capacity. I have read about radperf but I can't download it from its web page. On the other hand, I would like to know how can I monitor FreeRADIUS with SNMP ( It's very interesting to know how many users are connected, how many requests has received the server ...). I hope your advices. Thanks in advance. Regards, Antonio.

3 2

Question on pam_radius_auth module getting INCORRECT password
by David Li 15 Apr '14

15 Apr '14

Hi, I am new to this. Please let me know if there is a better list to post this question. My system is running RHEL and using a separate FreeRadius server to authenticate ssh user logins. All regular user credentials are stored on the radius server. I have been trying to track down a wired problem. When a user is logging via ssh, the pam_radius_auth module would try to retrieve the password and send it to the radius server. But the password returned by the rad_converse() function is INCORRECT. I have done some searching and found suggestions that there might be something wrong with "other" module that is doing the password checking. My real question is how I can find out which module is the culprit. David

4 3

Re: Freeradius-Users Digest, Vol 108, Issue 64
by Rui Ribeiro 15 Apr '14

15 Apr '14

Yes, of course thanks Allan, just had to confirm there was not any provision in place, although I already suspected what would the answer would be. The point is that I worked for some years in the Internet cable industry and I dearly miss some of the controls there were in place, like the equipment placing leasequeries calls to the DHCP server to confirm the validity of a new IP from a customer, for instance. About SQL, there used to be also a patched DHCP+TFTP package with an eye in the cable industry, called docsis-server. It was also very convenient interesting in that it mapped the isc-dhcp configuration to well, MySQL tables, simplifying a lot the development of glue software for customer provisioning. I used it at least in two sites, until giving up on it because it was too old and stopped being maintained. You might want to have a look at it. Regards, Rui Ribeiro http://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 4 > Date: Mon, 14 Apr 2014 21:16:15 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRADIUS DHCP service vs IP users control > Message-ID: <534C885F.3070309(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > Rui Ribeiro wrote: > > We have noticed that at least in one of our equipments the users can > > gain access with a fixed-ip-address instead of one gotten via our > > DHCP-server. > > That's how DHCP works. If the user doesn't do DHCP, he can use a > static IP of his choosing. > > > Whilst my ISP experience suggest the enforcement of DHCP-only clients > > belongs to the hardware side, since FreeRadius also implements the DHCP > > service, I am curious wether someone managed to enforce this via > > FreeRadius configurations. > > You can't enforce anything with DHCP. Like RADIUS, it just advises > the NAS. If the NAS (or the user) ignores DHCP or RADIUS, there's very > little you can do on the server. > > What you *can* do is use RADIUS accounting packets to double-check > users IP addresses. If the address in the accounting packet was *not* > assigned by DHCP, then you can do something. Complain, issue email, etc. > > And which open source DHCP server lets you write IPs into an SQL > database? Not ISC. FreeRADIUS. :) > > That's why we added DHCP. > > Alan DeKok. > >

1 0

FreeRADIUS DHCP service vs IP users control
by Rui Ribeiro 15 Apr '14

15 Apr '14

Hi, We have noticed that at least in one of our equipments the users can gain access with a fixed-ip-address instead of one gotten via our DHCP-server. Whilst my ISP experience suggest the enforcement of DHCP-only clients belongs to the hardware side, since FreeRadius also implements the DHCP service, I am curious wether someone managed to enforce this via FreeRadius configurations. Regards, Rui Ribeiro

3 2