- Freeradius-Users - lists.freeradius.org

Using static library(disable shard library) will make -X fail.
by kids67.tw 25 Mar '14

25 Mar '14

Dear Support, I use 3.0.2 version for below configure: 3.0.2: ./configure --prefix=./bin/LINUX/freeradius --with-shared-libs=no --with-openssl-includes=./openssl/install/LINUX/include --with-openssl-libraries=./openssl/install/LINUX/lib --with-sqlite-lib-dir=./sqlite/install/LINUX/lib --with-sqlite-include-dir=./sqlite/install/LINUX/include I can make and make install successful, but after that I want to run ./radiusd -XC -d ./bin/LINUX/freeradius/etc/raddb/ It will display below fail: radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { ./bin/LINUX/freeradius/etc/raddb//mods-enabled/detail.log[17]: Failed to link to module 'rlm_detail': rlm_detail.so: cannot open shared object file: No such file or directory It means link module fail, but since I already configure without dynamic library, why it still want to link rlm_detail.so? My library path is: ./bin/LINUX/freeradius/lib/ and it only have rlm_*.a and rlm_*.la, don’t have any dynamic library. Does freeradius can not support static library? Please help, thanks. Regards, SAxonTseng

4 4

dhcp static pool getting prefence over sqlippool
by Mahima Kumar 23 Mar '14

23 Mar '14

Hello, So mysqlippool seems to be working fine as i can see in the debug that it is allocating a framed ip address everytymto a user.... But the problem is that the client is getting the ip address i mentioned in the dhcp static file and not the one assigned from the sqlippool. Now i removed the ip address from the dhcp static file but then the client is not getting any ip then. Can anyone help me with this? TIA -- Regards, Mahima Kumar 1365962

2 1

command to monitor radius service is running or not in nagios
by Rishabh.Shukla 21 Mar '14

21 Mar '14

Hello, I have configured and installed radius server but now i wish to monitor the "radius" service in nagios. But i am not getting any success if any body can help or let me know whether there is any command to moinitor that in nagios. i want to know whether the service is running or not Please help me Thanks and regards Rishabh.

2 1

Legacy style generic LDAP attributes
by Arran Cudbard-Bell 21 Mar '14

21 Mar '14

This was not included in 3.0.2 but will be in 3.0.3 The old v2.x.x rlm_ldap module supported generic valuepair attributes. These attributes allowed any attribute to be represented in LDAP without explicitly being added to the radius <-> LDAP attribute map. In 3.x.x this functionality was retained in the form of the 'valuepair_attribute'. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai… Unfortunately this isn't directly backwards compatible with with v2.x.x, as v2.x.x used attributes without list qualifiers, and inferred the attribute list from the attribute mapping type. As an interim measure to ease migration the rlm_ldap module now supports the old style functionality. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avai… This will likely be removed in the next major version (unless someone comes up with a compelling reason to keep it) as it's essentially duplicate functionality. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: DHCP Dynamic pool and MAC authentication
by Thomas Bru 21 Mar '14

21 Mar '14

>> I am having the exact same issue. Can anybody assist with this issue. "anybody >> can connect a device on my network and the Freeradius server reply to DHCP >> Discover, assign an IP address using the mysql radipool table but without >> checking if the mac address is in the radcheck table." > Haven't looked at this directly, but it should be pretty easy. I'm > guessing you want to either copy DHCP-Client-Hardware-Address into > Calling-Station-Id, then call sql (with Calling-Station-Id in the > radcheck table), or just all DHCP-Client-Hardware-Address directly > into the radcheck table, then just call sql. > Based on the result code from sql, you probably then want to > update the DHCP-Message-Type to inhibit a reply if the MAC wasn't > found. Hello I successed to install and configure MAC Authentication ans DHCP pool. But at this point, I have done to many thing to explain how we can implement this solution. I hope I will reinstall it the next week and I will give you the solution. But the solution works :) Best Regards Thomas

1 0

DHCP Dynamic pool and MAC authentication
by Thomas Bru 21 Mar '14

21 Mar '14

Hello Everybody This is my first message on this mailing list so I hope I will do everything right. I need your help because I want to implement Freeradius as a DCHP server with an dynamic IP address pool (using radipool mysql table) and MAC authentication. I successed to install and activate DHCP server and dynamic pool but not authenticate. But, actually, my problem is anybody can connect a device on my network and the Freeradius server reply to DHCP Discover, assign an IP address using the mysql radipool table but without checking if the mac address is in the radcheck table. Before the activation of the dynamic IP pool, I can authenticate and if the authentication is OK, I give a static address to the client. The address was stored into the raply table). Now I can't do that with the dynamic pool. Did anybody can help me ? Thanks in advance for your helps and your replies. Best Regards Thomas

4 3

802.1x EAP + Adtran authenticating on same radius server
by Alvin Ramos 20 Mar '14

20 Mar '14

Forgive me, I haven't worked with Radius in many years, I require some help with the following subject: Is it possible to have 802.1x EAP and Adtran to authenticate to freeradius? I've got the 802.1x EAP authenticating to Active Directory, but, when I add in the users file: Default LDAP-Group!="NetworkAdmins", Auth-Type := NTLM I can login to the adtran device, but not to the 802.1x EAP. Should I provide more information? Do anyone have a web site to suggest to help with this matter? [cid:image001.jpg@01CF4448.9CC194A0] Alvin Ramos Linux System Administrator Ph: 803.726.4032 1500 Hampton Street, Suite 101 Columbia, SC 29201

2 1

Upgrading from 2.2.2 to 3.0.1
by Nikolaos Milas 20 Mar '14

20 Mar '14

Hello, Some upgrade questions. I am on CentOS 6.5 and I've built 3.0.1 packages using: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources… I am wondering if it is possible to upgrade 2.2.2 to 3.0.1 (using these rpm packages). Is the configuration (as is working in 2.2.2) compatible (with 3.0.1)? Is 3.0.1 acceptable/proposed for production servers? The server is currently being used for eduroam and macauth (with ldap backend). We are planning to use it for DHCP too. Thanks, Nick

4 7

Version 2.2.4 has been released
by Alan DeKok 20 Mar '14

20 Mar '14

The changes from 2.2.3 are minor. Feature improvements * A "panic_action" can be set to have the server dump a gdb log on SEGV or other fatal error. * allow radmin command "set module status <module> <code>" which can be used to forcibly enable/disable modules. Bug Fixes * If the server fails to bind() after fork(), that is now reported to the parent, which exits with an error. * Session / delay times in MySQL are unsigned int. & Use --tag=CC for libtool. Closes #497. Because libtool is too stupid to notice that compiling means compilation. * Fix bug when copying attributes for vendors > 32767 * Fix behaviour on FreeBSD where sending packets from an interface bound to an IP address would fail when the server was built with udpfromto. * Don't fail config check if were listening on an IP which is also a home server. Some deployments have valid reasons to loop packets back to another virtual server. * Use correct port when DHCP relaying. * Set source IP address for DHCP packets from DHCP-Server-IP-Address, or DHCP-DHCP-Server-Identifier, if we're unable to otherwise determine the source IP.

4 6

Assign link-local addresses on authentication/authorization failure
by William C. Chandler 20 Mar '14

20 Mar '14

Hey all, I'm having trouble wrapping my brain around the correct way to do this, if at all possible. Some guidance would be greatly appreciated! I'm looking to assign link-local addresses to clients who fail to authenticate or fail to be authorized for access. I was wondering if this was even possible with radius? Would it be a DHCP-Reject in the post-auth section? Maybe something update reply? I've even thought about creating a new vlan with a dhcp server/scope of 169.254.254.x/24 and just dropping the users there... For more details -- setting up WPA enterprise wifi network, and we require our LDAP users to be part of certain groups to get on ("wirelessfaculty," and "wirelessstudents"). If they fail to authenticate due to bad password it'd be nice to give them a 169.254.0.1 address. Or if they're not in the proper group, a 169.254.0.2. This seems like it'd help us more quickly assess which step caused the hangup. Thanks for any ideas! --William Email correspondence to and from this address may be subject to the North Carolina Public Records law and may be disclosed to third parties by an authorized state official (NCGS. ch. 132). Student educational records are subject to FERPA.

2 1