- Freeradius-Users - lists.freeradius.org

No remote authentication
by Benoit 26 Mar '14

26 Mar '14

Hello, This might have been asked before (and I hope so), but I can't get my freeradius server to respond remote authentications requests. I got the SQL authentication set up and things seem to work in local. radtest works for me with this command: radtest myuser mypass 127.0.0.1 1812 test which would be in my NAS: client 127.0.0.1{ ipaddr = 127.0.0.1 secret = test } -> I see the package accepted from debug mode on server. Now if I want to test through the Internet, using NTRadPing, I am not sure how I should set up my client, I tried (with xx.xx.xx.xx my IP as seen through the Internet): client xx.xx.xx.xx{ ipaddr = xx.xx.xx.xx secret = test } but the server debug mode (server side) does not react at all and stay in the waiting for requests state, while the client gets its requests to timeout. What am I missing? Did I get the IP thing right anyways?

6 10

how to organize groups of users getting access to groups of servers
by Jan-Frode Myklebust 25 Mar '14

25 Mar '14

I want to use freeradius to authenticate different groups of users (from LDAP) to sets of network devices, potentially with different access levels, but have a bit hard time understanding how this is supposed to be configured. Would be nice with some advice.. What I have so far is: # Give ldap group "firewall" super-user privilege on juniper firewalls: DEFAULT Ldap-Group == "cn=firewall,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP Juniper-Local-User-Name := "super-users", # Give ldap group "netadmin" "enable" access on cisco routers: DEFAULT Ldap-Group == "cn=netadmin,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP cisco-avpair = "shell:priv-lvl=15" But this doesn't work for users that are member of both groups, so I need to say that the first rule is limited to a set of juniper devices, and the second is limited to a set of cisco devices. What's the strategy we should use for expressing this? Is it possible without having to specify one rule for each NAS-IP-Address? I.e. being able to do some kind og grouping of clients to match on would be very helpful.. -jf

2 3

Using static library(disable shard library) will make -X fail.
by kids67.tw 25 Mar '14

25 Mar '14

Dear Support, I use 3.0.2 version for below configure: 3.0.2: ./configure --prefix=./bin/LINUX/freeradius --with-shared-libs=no --with-openssl-includes=./openssl/install/LINUX/include --with-openssl-libraries=./openssl/install/LINUX/lib --with-sqlite-lib-dir=./sqlite/install/LINUX/lib --with-sqlite-include-dir=./sqlite/install/LINUX/include I can make and make install successful, but after that I want to run ./radiusd -XC -d ./bin/LINUX/freeradius/etc/raddb/ It will display below fail: radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { ./bin/LINUX/freeradius/etc/raddb//mods-enabled/detail.log[17]: Failed to link to module 'rlm_detail': rlm_detail.so: cannot open shared object file: No such file or directory It means link module fail, but since I already configure without dynamic library, why it still want to link rlm_detail.so? My library path is: ./bin/LINUX/freeradius/lib/ and it only have rlm_*.a and rlm_*.la, don’t have any dynamic library. Does freeradius can not support static library? Please help, thanks. Regards, SAxonTseng

4 4

dhcp static pool getting prefence over sqlippool
by Mahima Kumar 23 Mar '14

23 Mar '14

Hello, So mysqlippool seems to be working fine as i can see in the debug that it is allocating a framed ip address everytymto a user.... But the problem is that the client is getting the ip address i mentioned in the dhcp static file and not the one assigned from the sqlippool. Now i removed the ip address from the dhcp static file but then the client is not getting any ip then. Can anyone help me with this? TIA -- Regards, Mahima Kumar 1365962

2 1

command to monitor radius service is running or not in nagios
by Rishabh.Shukla 21 Mar '14

21 Mar '14

Hello, I have configured and installed radius server but now i wish to monitor the "radius" service in nagios. But i am not getting any success if any body can help or let me know whether there is any command to moinitor that in nagios. i want to know whether the service is running or not Please help me Thanks and regards Rishabh.

2 1

Legacy style generic LDAP attributes
by Arran Cudbard-Bell 21 Mar '14

21 Mar '14

This was not included in 3.0.2 but will be in 3.0.3 The old v2.x.x rlm_ldap module supported generic valuepair attributes. These attributes allowed any attribute to be represented in LDAP without explicitly being added to the radius <-> LDAP attribute map. In 3.x.x this functionality was retained in the form of the 'valuepair_attribute'. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai… Unfortunately this isn't directly backwards compatible with with v2.x.x, as v2.x.x used attributes without list qualifiers, and inferred the attribute list from the attribute mapping type. As an interim measure to ease migration the rlm_ldap module now supports the old style functionality. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai… This will likely be removed in the next major version (unless someone comes up with a compelling reason to keep it) as it's essentially duplicate functionality. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: DHCP Dynamic pool and MAC authentication
by Thomas Bru 21 Mar '14

21 Mar '14

>> I am having the exact same issue. Can anybody assist with this issue. "anybody >> can connect a device on my network and the Freeradius server reply to DHCP >> Discover, assign an IP address using the mysql radipool table but without >> checking if the mac address is in the radcheck table." > Haven't looked at this directly, but it should be pretty easy. I'm > guessing you want to either copy DHCP-Client-Hardware-Address into > Calling-Station-Id, then call sql (with Calling-Station-Id in the > radcheck table), or just all DHCP-Client-Hardware-Address directly > into the radcheck table, then just call sql. > Based on the result code from sql, you probably then want to > update the DHCP-Message-Type to inhibit a reply if the MAC wasn't > found. Hello I successed to install and configure MAC Authentication ans DHCP pool. But at this point, I have done to many thing to explain how we can implement this solution. I hope I will reinstall it the next week and I will give you the solution. But the solution works :) Best Regards Thomas

1 0

DHCP Dynamic pool and MAC authentication
by Thomas Bru 21 Mar '14

21 Mar '14

Hello Everybody This is my first message on this mailing list so I hope I will do everything right. I need your help because I want to implement Freeradius as a DCHP server with an dynamic IP address pool (using radipool mysql table) and MAC authentication. I successed to install and activate DHCP server and dynamic pool but not authenticate. But, actually, my problem is anybody can connect a device on my network and the Freeradius server reply to DHCP Discover, assign an IP address using the mysql radipool table but without checking if the mac address is in the radcheck table. Before the activation of the dynamic IP pool, I can authenticate and if the authentication is OK, I give a static address to the client. The address was stored into the raply table). Now I can't do that with the dynamic pool. Did anybody can help me ? Thanks in advance for your helps and your replies. Best Regards Thomas

4 3

802.1x EAP + Adtran authenticating on same radius server
by Alvin Ramos 20 Mar '14

20 Mar '14

Forgive me, I haven't worked with Radius in many years, I require some help with the following subject: Is it possible to have 802.1x EAP and Adtran to authenticate to freeradius? I've got the 802.1x EAP authenticating to Active Directory, but, when I add in the users file: Default LDAP-Group!="NetworkAdmins", Auth-Type := NTLM I can login to the adtran device, but not to the 802.1x EAP. Should I provide more information? Do anyone have a web site to suggest to help with this matter? [cid:image001.jpg@01CF4448.9CC194A0] Alvin Ramos Linux System Administrator Ph: 803.726.4032 1500 Hampton Street, Suite 101 Columbia, SC 29201

2 1

Upgrading from 2.2.2 to 3.0.1
by Nikolaos Milas 20 Mar '14

20 Mar '14

Hello, Some upgrade questions. I am on CentOS 6.5 and I've built 3.0.1 packages using: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources… I am wondering if it is possible to upgrade 2.2.2 to 3.0.1 (using these rpm packages). Is the configuration (as is working in 2.2.2) compatible (with 3.0.1)? Is 3.0.1 acceptable/proposed for production servers? The server is currently being used for eduroam and macauth (with ldap backend). We are planning to use it for DHCP too. Thanks, Nick

4 7