- Freeradius-Users - lists.freeradius.org

Authentication based on the user groups
by Kitty Chan 11 Mar '14

11 Mar '14

I have setup a Freeradius server to serve as the authentication server for Ruckus Wifi system. The backend directory server is Openldap. I can successfully authenticate users. Now I want to setup two wifi SSID. The "staff" SSID will authenticate to users belonging to the "staff" group in the Openldap directory and the "student" SSID shall authenticate to users belonging to the "student" group. What is the right way to configure this in Freeradius?

3 3

Re: Not trivial configuration of Freeradius as DHCP server
by Vyacheslav Maliev 11 Mar '14

11 Mar '14

Hello! Thanks to all. Configuration example that`s i need, will try it. 2014-03-11 0:46 GMT+04:00 <freeradius-users-request(a)lists.freeradius.org>: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Not trivial configuration of Freeradius as DHCP server > (Tony DeMatteis) > 2. Re: Old school: FreeRADIUS and NIS (Alan DeKok) > 3. Re: Old school: FreeRADIUS and NIS (Alan DeKok) > 4. Re: Old school: FreeRADIUS and NIS (A.L.M.Buxey(a)lboro.ac.uk) > 5. RE: Authorise based on Calling Station ID ? > (Darren Ward (darrward)) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 10 Mar 2014 13:07:37 -0700 > From: Tony DeMatteis <tonyd(a)commspeed.net> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Not trivial configuration of Freeradius as DHCP server > Message-ID: <531E1B89.4040007(a)commspeed.net> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > Hello, > > Took this snippet from what I'm doing which I got from a colleague who > first pulled a working config together. See where you can with this... > > 'dhcp' folder resides in raddb/dhcp and the dhcp-config.txt file is > raddb/sites-available/dhcp > > > > # Main conf - dhcp-config.txt > > server dhcp { > > client any { > ipaddr = 0.0.0.0 > #netmask = 0 > dhcp = yes > } > > listen { > ipaddr = * > port = 67 > type = dhcp > } > > dhcp DHCP-Discover { > update reply { > DHCP-Message-Type = DHCP-Offer > } > > switch "%{DHCP-Gateway-IP-Address}" { > > case 192.168.60.1 { > $INCLUDE dhcp/pool_system1 > } > > case 10.20.0.1 { > $INCLUDE dhcp/pool_system2 > } > > case { > # Do not reply to DHCP requests from subnets > # which we are not authoriative > update reply { > DHCP-Message-Type !* 0 > } > do_not_respond > } > } > > # Global DHCP parameters > $INCLUDE dhcp/global > > dhcp_sqlippool > > if(notfound || noop) { > reject > } > > ok > } > > dhcp DHCP-Request { > update reply { > DHCP-Message-Type = DHCP-Ack > } > > switch "%{DHCP-Gateway-IP-Address}" { > > case 192.168.10.1 { > $INCLUDE dhcp/pool_system1 > } > > case 10.20.0.1 { > $INCLUDE dhcp/pool_system2 > } > > case { > # Do not reply to DHCP requests from subnets > # which we are not authoriative > update reply { > DHCP-Message-Type !* 0 > } > do_not_respond > } > } > > # Global DHCP parameters > $INCLUDE dhcp/global > > dhcp_sqlippool > > if(notfound || noop) { > reject > } > > ok > } > > dhcp DHCP-Inform { > } > > # If there's no named section for the packet type, then the packet > # is processed through this section. > dhcp { > # send a DHCP NAK. > reject > } > } > > # End main conf > > # Global Conf > # ./dhcp/global.conf > update reply { > DHCP-Domain-Name-Server = 8.8.8.8 > DHCP-Domain-Name-Server += 8.8.4.4 > DHCP-Domain-Name = "mydomain.com" > DHCP-DHCP-Server-Identifier = <dhcp-server-ip> > } > > # System 1 devices - Cable Modems > # ./dhcp/pool_system1.conf > if(DHCP-Vendor-Class-Identifier =~ /^docsis[1-2].*$/){ > update control { > Pool-Name := 'system_pool1' > } > } > > # System 2 devices > # ./dhcp/pool_system2.conf > if(DHCP-Vendor-Class-Identifier){ > update reply { > DHCP-Subnet-Mask = 255.255.255.0 > DHCP-Router-Address = 10.20.0.1 > DHCP-Broadcast-Address = 10.20.0.255 > DHCP-IP-Address-Lease-Time = 3600 > } > update control { > Pool-Name := 'system_pool2' > } > } > > > > > On 03/10/2014 12:38 PM, Alan DeKok wrote: > > Vyacheslav Maliev wrote: > >> Hello! I`ve tried to configure my freeradius installation like described > >> here http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation > >> but it`s very simple case for only one subnet. Now we have two networks > >> which needs to get IP by DHCP server. So is there any possibility to > >> configure DHCP scopes for different networks? Thanks! > > Yes. It's not as easy as with a dedicated DHCP server. You'll need > > to split the packets, so that some use subnet A, and some use subnet B. > > Look at the packets (radiusd -X) to see how they're different. Usually > > there will be a gateway IP address different, or perhaps something else. > > > > It's probably best to use groups to assign the network parameters. > > e.g. use the radgroupcheck and radgroupreply tables. For users in group > > A, assign them options for network A, and users in group B should be > > assigned options in network B. > > > > i.e. separate the *common* configuration into group parameters. Thenm > > each user should have only user-specific parameters. e.g. an IP > > address, and a group membership. > > > > For v3.1, we're looking at maybe coming up with DHCP-specific queries > > for SQL. But getting help from other people would be useful, too. > > > > Alan DeKok. > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > >

1 0

RE: Freeradius-Users Digest, Vol 107, Issue 36
by Hangi Christian 11 Mar '14

11 Mar '14

Hi Alan,Thank you for your help. I've already run the radtest command as a regular user using debugging mode and I had this issue : $radclient: dict_init: Couldn't open dictionary "etc/raddb/dictionary" : Permission denied . I want to know how to solve this problem. With regards, Christian. > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 107, Issue 36 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 10 Mar 2014 09:56:18 +0100 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Authentication on the basis of circuit id and not mac address > (Mahima Kumar) > 2. Authorise based on Calling Station ID ? (Darren Ward (darrward)) > 3. Testing an access-request user without the debugging mode > (Hangi Christian) > 4. Re: Testing an access-request user without the debugging mode > (A.L.M.Buxey(a)lboro.ac.uk) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 9 Mar 2014 08:51:51 -0600 > From: Mahima Kumar <mahima(a)ualberta.ca> > To: freeradius-users(a)lists.freeradius.org > Subject: Authentication on the basis of circuit id and not mac address > Message-ID: > <CADOyXPg+1pxy90Dur+Pf6MxmJt3TBUHuo5oyuJvwA_y04uappw(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi , > > I have used an Alcatel router as relay agent which gives the circuit id and > i can see that in the radius debug output, so the client is getting > authenticated on the basis of mac address and is getting the ip address > from the Dhcp server , now i want to authenticate the client based on the > circuit id provided by the relay agent in between, but the radius server > doesn't accept username as circuit id, it only authenticates based on mac > address of the client(i tried changing the users file), so can anyone > please guide me as to what changes i have to make for this to be possible. > > TIA > > > Regards, > Mahima >

2 2

NAS clients ignored...not sure where to go
by Ryan Milton 11 Mar '14

11 Mar '14

3 2

Old school: FreeRADIUS and NIS
by Mark Haney 10 Mar '14

10 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I know it's throwback to the '90s, but my boss wants it done, so I need to do it. I /cannot/ find any documentation on setting up FreeRADIUS with NIS authentication. Does someone have some lying around somewhere? I've googled the Web as well as the Mail Archive and I got precisely two items out of a good 4 hours of searching. 1. I need to set DEFAULT Auth-Type = System 2. The only list post about NIS (from 2002) mentions using rlm_unix....and nothing else. I'm not new to linux, just FreeRADIUS. I'm know it seems silly to set this up using NIS, but we use it in house (for now) and my boss wants it done 'yesterday' and I don't have the time at the moment to migrate everything to LDAP. That's in the works, but he doesn't want to wait for the switch to LDAP before getting this working. Help! - -- Mark Haney Network/Systems Administrator Practichem W: (919) 714-8428 Fedora release 20 (Heisenbug) 3.13.4-200.fc20.x86_64 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTGe2IAAoJEM/YzwEAv6e7ki0H/3l4UG/TBOeNaBPLSmmySgY3 RvnR7G33NzcPTJmwlOQXDnVhUbm0aRo9/ptfw+1ZQBbwxmrfl7j5HaXkoYhyQmxG ZL+uFdRZ26YzTxHq8pGVcvp+XVhHiQcTcKvNspeVEiM1QRgFAT2GBKFiv57etmoz ihKC4+gv699cs3By7474uTYAkWaPVUMeveFnuL81QPMLHE+Z4SDC+i5T2QRDaIz/ AfUWwzZsvJfeInn35Vsx7YLd1JUBoZHNk9l/gC7d7v/HQ7nPEEa2Uv05j7uJXXBW FE9O/Xjryndz4jovy3McR1ldOs+k5vRpxmO+YVebAb/PtMImBp7TVVLQkICsblc= =c6jI -----END PGP SIGNATURE-----

7 20

Not trivial configuration of Freeradius as DHCP server
by Vyacheslav Maliev 10 Mar '14

10 Mar '14

Hello! I`ve tried to configure my freeradius installation like described here http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation but it`s very simple case for only one subnet. Now we have two networks which needs to get IP by DHCP server. So is there any possibility to configure DHCP scopes for different networks? Thanks!

4 3

update : Re: Authentication on the basis of circuit id and not mac address
by Mahima Kumar 10 Mar '14

10 Mar '14

Hello Alan, Thanks for your reply. To be more specific i can tell you my scenario. client---switch---alcatel(dhcp relay agent)---freeradius and dhcp server The dhcp relay agent is generating a circuit id which i can see in the debug output, it is a hex string beginning from 0x as well as the dhcp agent remote id is visible as a hex string. Now i am putting the username format in the alcatel as mac address and i have no problem in authenticating the client from the radius server on the basis of mac address and dhcp server is giving ip address to the client. But my goal is to authenticate my client on the basis of this circuit id which is being generated by the alcatel dhcp relay agent , and hence provide ip address to the client on from the dhcp server. As i change the username format to circuit-id in the alcatel relay agent, the authentication fails as the debug output in alcatel shows the username format implies circuit-id. I am actually implementing the Alcatel Triple Play ESM scenario(alcatel also has IES and VPLS running on it), but instead of a dslam or any other relay agent i have to use the alcatel router only as the dhcp relay agent. Also i would like to know what changes i have to make in the users file or dhcp-static file or default file or radcheck, so as to do the client authentication based on the cirucit id being generated. (I tried to make a few changes but nothing works for me). Goal is : Authentication of client from radius server on the basis of circuit id and assigning ip address to the client from the dhcp server. Thanks in advance. On Mon, Mar 10, 2014 at 10:23 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Authorise based on Calling Station ID ? (Alan DeKok) > 2. Re: Authentication on the basis of circuit id and not mac > address (Alan DeKok) > 3. Re: your mail (A.L.M.Buxey(a)lboro.ac.uk) > 4. Re: Old school: FreeRADIUS and NIS (Mark Haney) > 5. Re: Old school: FreeRADIUS and NIS (Alan DeKok) > 6. Re: Old school: FreeRADIUS and NIS (Phil Mayers) > 7. Re: Old school: FreeRADIUS and NIS (Mark Haney) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 10 Mar 2014 08:10:31 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authorise based on Calling Station ID ? > Message-ID: <531DABB7.50105(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Darren Ward (darrward) wrote: > > The mac address was sent by the wifi controller as the > > calling-station-id but the question is how do I match that field against > > the user to authorise them? > > $ man unlang > > It tells you how to do if/then/else checks. > > Perhaps you have a more specific question? > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Mon, 10 Mar 2014 08:33:25 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Authentication on the basis of circuit id and not mac > address > Message-ID: <531DB115.70109(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Mahima Kumar wrote: > > I have used an Alcatel router as relay agent which gives the circuit id > > and i can see that in the radius debug output, so the client is getting > > authenticated on the basis of mac address and is getting the ip address > > from the Dhcp server , now i want to authenticate the client based on > > the circuit id provided by the relay agent in between, > > First, does the circuit ID show up in a RADIUS packet? If so, what > attribute is it? > > > but the radius > > server doesn't accept username as circuit id, it only authenticates > > based on mac address of the client(i tried changing the users file), so > > can anyone please guide me as to what changes i have to make for this to > > be possible. > > I'm not sure what you're trying to do, so I don't have a good answer > for you. > > What does debug output say? What do you think it *should* say? > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Mon, 10 Mar 2014 13:54:26 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: your mail > Message-ID: <20140310135426.GC3021(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I'd like to install on FreeBSD 9.2 > > FreeRadius2 with MySQL > > which bits of http://wiki.freeradius.org/guide/SQL-HOWTO did you > follow, which bits didnt work? > > alan > > > ------------------------------ > > Message: 4 > Date: Mon, 10 Mar 2014 10:03:55 -0400 > From: Mark Haney <mhaney(a)practichem.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DC64B.4010806(a)practichem.com> > Content-Type: text/plain; charset="ISO-8859-1" > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > On 03/07/14 16:00, Alan DeKok wrote: > > >> The only thing I've changed in the config files is to add the > >> DEFAULT Auth-Type = System at the top of the users file. > > > > Which I don't recommend you do. > > > > Anyawyas, debug mode shows: > > > > ++[unix] returns notfound > > > > Which is pretty definitive. > > Okay, what would recommend then? And the ++[unix] returns notfound is > definitive of /what/? > > Since I'm setting up FreeRADIUS on my NIS master, I don't really need > NIS integration, the user accounts are all in /etc/passwd (and > /etc/shadow) so all I need is radiusd to check for local accounts and > authenticate against them. This /should/ simplify things, but > apparently I'm missing something, and something probably relatively > simple. Question is, what? > > > - -- > Mark Haney > Network/Systems Administrator > Practichem > W: (919) 714-8428 > Fedora release 20 (Heisenbug) 3.13.4-200.fc20.x86_64 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1 > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQEcBAEBAgAGBQJTHcZEAAoJEM/YzwEAv6e7VfIH+gLyCl0i8wJg8yrNRh93PUKG > tuKKRyelWUur6p1Hem/G3LtEBkczbfPw1Mk1mD0McWmrH58lMoFccnFp3KF//QF7 > NNBBrbbtkFLq0gdEUr7vr7ICXDqRKnrSSSh+zjOFZ5DwG4pSjhexqwgRZNw34prg > ddG6qsnVwktztIBuiXI05iWL1yqoTVveiXJCRcoOFMc1cKABt4tYR0y2/7QGmjT2 > DvfvhD3K+pDtO1HLwPOKay9D47AHSsRyvO64d1zfSVokt/7/FLbUuHtoZ9lXK5uH > BjteP//mlE017d848wHF5PzmYXIPQhT3ANQ274TB/Q9wPalhx/7KMd+WN6CvHeA= > =QgVT > -----END PGP SIGNATURE----- > > > > ------------------------------ > > Message: 5 > Date: Mon, 10 Mar 2014 10:21:05 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DCA51.6070309(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Mark Haney wrote: > >> ++[unix] returns notfound > > > >> Which is pretty definitive. > > > > Okay, what would recommend then? And the ++[unix] returns notfound is > > definitive of /what/? > > Uh.... the module looks users up in /etc/passwd. What could > "notfound" possibly mean? > > > Since I'm setting up FreeRADIUS on my NIS master, I don't really need > > NIS integration, the user accounts are all in /etc/passwd (and > > /etc/shadow) so all I need is radiusd to check for local accounts and > > authenticate against them. This /should/ simplify things, but > > apparently I'm missing something, and something probably relatively > > simple. Question is, what? > > The user isn't in /etc/passwd. > > Alan DeKok. > > > ------------------------------ > > Message: 6 > Date: Mon, 10 Mar 2014 14:33:55 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DCD53.9080402(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 10/03/14 14:03, Mark Haney wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > > > > > On 03/07/14 16:00, Alan DeKok wrote: > > > >>> The only thing I've changed in the config files is to add the > >>> DEFAULT Auth-Type = System at the top of the users file. > >> > >> Which I don't recommend you do. > >> > >> Anyawyas, debug mode shows: > >> > >> ++[unix] returns notfound > >> > >> Which is pretty definitive. > > > > Okay, what would recommend then? And the ++[unix] returns notfound is > > definitive of /what/? > > rlm_unix has a flow like this: > > r = getpwnam(username) > if not r: > return NOTFOUND > if not r.passwd or len(r.passwd) < 10: > s = getspnam(username) > if not s: > return NOTFOUND > passwd = s.passwd > else: > passwd = r.passwd > > So, either FreeRADIUS is getting no reply to getpwnam() or it's getting > an empty or "x" value for the password hash at that stage, *then* > calling getspnam() and getting no value. > > My NIS is rusty, but IIRC calling the getspnam() routines under NIS > requires you being root? Most likely this is the problem. > > PAM has a suid-root helper for this; FreeRADIUS doesn't. So one possible > alternative would be to use rlm_pam, and let PAM do the work of getting > at the shadow data. > > > ------------------------------ > > Message: 7 > Date: Mon, 10 Mar 2014 12:23:29 -0400 > From: Mark Haney <mhaney(a)practichem.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Old school: FreeRADIUS and NIS > Message-ID: <531DE701.5090606(a)practichem.com> > Content-Type: text/plain; charset="ISO-8859-1" > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > On 03/10/14 10:33, Phil Mayers wrote: > > > > > rlm_unix has a flow like this: > > > > r = getpwnam(username) if not r: return NOTFOUND if not r.passwd or > > len(r.passwd) < 10: s = getspnam(username) if not s: return > > NOTFOUND passwd = s.passwd else: passwd = r.passwd > > > > So, either FreeRADIUS is getting no reply to getpwnam() or it's > > getting an empty or "x" value for the password hash at that stage, > > *then* calling getspnam() and getting no value. > > > > My NIS is rusty, but IIRC calling the getspnam() routines under > > NIS requires you being root? Most likely this is the problem. > > Le me re-iterate. Since I've installed FreeRADIUS on my NIS master, I > no longer care so much about dealing with NIS. At this stage, it's > simply a matter of getting FR and rlm_unix to see and access my local > user/pwd sitting in /etc/passwd and /etc/shadow. Surely, setting up > Fr for that is not /that/ complicated. So, forget about NIS. That is > not a problem. > > So, now that I have that out of the way, it seems rlm_unix isn't able > to read /etc/shadow. I'm assuming the getspnam(username) call is > trying to read /etc/shadow? If so, how is the best way to fix this? > I read somewhere that rlm_unix didn't need to copy the password files > into a temp file with radwtmp unless there was a specific reason for > it. What exactly is that all about? > > > - -- > Mark Haney > Network/Systems Administrator > Practichem > W: (919) 714-8428 > Fedora release 20 (Heisenbug) 3.13.4-200.fc20.x86_64 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1 > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQEcBAEBAgAGBQJTHeb2AAoJEM/YzwEAv6e7EtsH/1DSyXULTwGN2Y4x/lvq/5cj > OYj585upGm0gZlNTEBjDYF1eJQw+S26bIhbogiaaWElBhnNE43K0iXnlJMxC3rwJ > ZRdoT5dQHufyOAFpDrg0GvR4BsnlSUlRzckBDGdFSsEtHHUtH0UU/ajuKo8JgXxZ > 4smQ1dl9dFY9A9xe7AI7MGMI76QAqTIuTREmEwfPVKl9HSsBHAFr64hzxsUc8TcE > 5GEizfXQv3XvTLsYuDCPRF2SxZr5ZpLi3Yuu/GLlC6Vl88qpNHgbPVf5rKw1NVMl > OhYFHSnz+pzgyAKJBg3Np5xoV1cvDYf0wQ3Kv0i1UwP3SF4r9RvdAPNjyyzjZJc= > =mS2E > -----END PGP SIGNATURE----- > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 107, Issue 38 > ************************************************* > > -- Regards, Mahima Kumar 1365962

2 1

None
by krylov＠ukr.net 10 Mar '14

10 Mar '14

Good day. I'd like to install on FreeBSD 9.2 FreeRadius2 with MySQL # radiusd -X ... rad_recv: Access-Request packet from host 1.2.3.4 port 15191, id=95, length=46 User-Name = "krylov" User-Password = "password" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: -> [sql] Error generating query; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] = fail +} # group authorize = fail Using Post-Auth-Type REJECT WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 95 to 1.2.3.4 port 15191 Waking up in 4.9 seconds. =-=-=-=-=-=-=-=-=-=-=-=-=-=- Radius can't create sql-query Please, help me. May be anybody nows where is examples or howto...

4 3

Authentication on the basis of circuit id and not mac address
by Mahima Kumar 10 Mar '14

10 Mar '14

Hi , I have used an Alcatel router as relay agent which gives the circuit id and i can see that in the radius debug output, so the client is getting authenticated on the basis of mac address and is getting the ip address from the Dhcp server , now i want to authenticate the client based on the circuit id provided by the relay agent in between, but the radius server doesn't accept username as circuit id, it only authenticates based on mac address of the client(i tried changing the users file), so can anyone please guide me as to what changes i have to make for this to be possible. TIA Regards, Mahima

2 1

Testing an access-request user without the debugging mode
by Hangi Christian 10 Mar '14

10 Mar '14

Hello Guys, I am new in Freeradius server and also in linux and I need your help regarding the functionality of the server. I am currently using freeradius version 2.2.3 and my desktop computer is running the CentOS 6.4 linux operating. First of all, I've downloaded the uncompressed freeradius software package (freeradius-server-2.2.3.tar) from the freeradius website: http://www.freeradius.org from source code in the tar format. Then after I had to create a folder using CentOS linux in order to the freeradius server source code package to the folder, uncompressed and installed on the computer. After copied to the folder, I used the tar commands to uncompress the source code package and install it on the computer using #./configure, #make and #make install commands from the INSTALL file of the uncompressed server package. After installed, the configurations files of the RADIUS SERVER were found under /usr/local/etc/raddb directory path. i tested the server on the debugging mode using radiusd -X and at the end of the output i saw this line " Ready to process requests". I have first created a user inside the users file and I did the normal default testing with the debugging mode and the user was accepted. After that i change the clients.conf file putting my shared key and the IP Address of the switch and also configure ssh on the server side I have done the AAA , Radius and SSH configurations on the switch, then I used Putty on another computer to access to the server by putting the IP address of the switch . Is this the right way to access the server ? i ran the debugging mode on the server and try to access using putty on another PC . here is the result i got this : rad_recv: Accounting-Request packet from host 192.168.9.26 port 5001, id=151, length=122 User-Name = "testing" NAS-Identifier = "002389550a92" NAS-Port = 16781313 NAS-Port-Type = Ethernet Calling-Station-Id = "0000-0000-0000" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Session-Id = "1100030205009" Framed-IP-Address = 192.168.9.25 NAS-IP-Address = 192.168.9.26 Event-Timestamp = "Apr 2 2000 12:00:06 ICT" Service-Type = Login-User # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 16781313,NAS-Identifier = "002389550a92",NAS-IP-Address = 192.168.9.26,Acct-Session-Id = "1100030205009",User-Name = "testing"' [acct_unique] Acct-Unique-Session-ID = "6ff6addd9c912e31". ++[acct_unique] = ok [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 192.168.9.26 [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310 [detail] expand: %t -> Mon Mar 10 13:12:05 2014 ++[detail] = ok ++[unix] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 151 to 192.168.9.26 port 5001 Finished request 1. Cleaning up request 1 ID 151 with timestamp +122 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +122 Ready to process requests. then i stopped the debugging mode. and run the server using this commands [root@chris raddb]# service radiusd restart Stopping radiusd: [ OK ] Starting radiusd: [ OK ] on the user's PC side i got access denied and the server does not report on the radius.log file . please help me and also correct me where ever i went wrong. With Regards, Chris

2 1