- Freeradius-Users - lists.freeradius.org

Windows Phone CA verification debugging
by Mathieu Simon 16 Sep '13

16 Sep '13

Hi list While I've been quite successful in making preconfigured profiles and docs for our students on how to make proper proper wireless configuration, I'm encountering some issues with those (yet quite rare) people with Windows Phone 8 (WP8) systems. WP8 devices are yet able to connect without (any) CA or common name verification, but seem to fail when I let them check the CA by choosing it from the device' CA store. (As usual), the client-side error message is not helpful at all (it fails to connect without any error message). On the desktop side one can at least fire up 'netsh ras diagnostics' to trace (P)EAP and CHAP during connection which can help figuring out at least something. But on WP8, well there is no such thing that I've found. Is there anyone on the FR list who already had to mangle a WP8 device? -- Mathieu

2 2

static ip allocation
by Petre Bandac 15 Sep '13

15 Sep '13

hallo I have a rp-pppoe/freeradius/mysql instance running, with ip addresses dynamically allocated from defined pools. I want for some users to have static ip addresses, the same ip at every connect. this can be achieved by manually entering the Framed-IP-Attribute in the radreply table ? or any other settings need to be changed ? Thanks, petre -- Petre Bandac Network Scientist - petre(a)kgb.ro

2 1

Freeradius 2.1.12 Second LDAP Server
by Kevin Bigalke 14 Sep '13

14 Sep '13

Hello, i`m running a Freeradius Server 2.1.12 on a Ubuntu 13.04 VM. The Login with 802.1 works perfectly. I`m using a Windows LDAP Server for the Login and want to add a second LDAP-Server for a Fail Over. I`m following the Tutorials to setup my Freeradius Server: *Click*. I`cant find a suitable Tutorial to adding a second LDAP Server for a Fail Over. Which files are responsible for the integration of a second LDAP server? These are my current Settings: /etc/freeradius/modules/ldap: ldap ldap1 { server = "serv01.xyz.local" basedn = "dc=xyz,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } ldap ldap2 { server = "serv02.xyz.local" basedn = "dc=xyz,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } /etc/samba/smb.conf: [global] workgroup = XYZ dns proxy = no security = ads password server = serv01.xyz.local password server = serv02.xyz.local winbind separator = + /etc/freeradius/sites-enabled/inner-tunnel: authenticate { ntlm_auth … /etc/freeradius/sites-enabled/default: authenticate { ntlm_auth … /etc/freeradius/users: DEFAULT Auth-Type = ntlm_auth Thanks for Help! BeliarsFire

5 7

FreeRadius DHCP against LDAP
by Nikolaos Milas 13 Sep '13

13 Sep '13

Hello, A couple of quick questions. 1. Is DHCP functionality supported against an LDAP Server (in v2.2.0)? 2. If so, is there a planned freeradius ldap schema change (in future versions) to include DHCP-* attributes? Please advise. Thanks, Nick

3 15

Problem with multiple groups
by Volker Lieder 13 Sep '13

13 Sep '13

Hi there, we have a setup running for ppp user on a freeradius/mysql base. We recognized that not all group values are given to the user while the login is running. After some debugging we found out, that freeradius didn't get all information from the database while its inside of the tables. Attached you find our used versions, database setting and a sql debug log from a testing user. Tested on debian 6.0.7, 2.1.10+dfsg-2+squeeze1 and debian 7.1, 2.1.12+dfsg-1.2 mysql> select * from radusergroup where username like 'dsluser%';+-----------------+------------------------------+----------+ | username | groupname | priority | +-----------------+------------------------------+----------+ | dsluser(a)realm.net | Default | 1 | | dsluser(a)realm.net | 5Uhr-Trennung | 2 | | dsluser(a)realm.net | Default_dsl-mobile.de | 1 | | dsluser(a)realm.net | PM_DSL_8000 | 1 | +-----------------+------------------------------+----------+ select * from radgroupreply where groupname='PM_DSL_8000'; +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ | 35 | PM_DSL_8000 | Cisco-AVPair | := | lcp:interface-config=service-policy output PM_DSL_8000_DSCP46_50PROZENT | +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ mysql> select * from radgroupreply where groupname='Default'; +----+-----------+-----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+-----------+-----------------+----+----------------------------------+ | 9 | Default | Framed-Protocol | = | PPP | | 10 | Default | Framed-Routing | = | None | | 11 | Default | Service-Type | = | Framed-User | | 24 | Default | Cisco-AVPair | += | lcp:interface-config=ip mtu 1492 | +----+-----------+-----------------+----+----------------------------------+ mysql> select * from radgroupreply where groupname='5Uhr-Trennung'; +----+----------------+-----------------+----+-----------------+ | id | groupname | attribute | op | value | +----+----------------+-----------------+----+-----------------+ | 2 | 5Uhr-Trennung | Session-Timeout | = | `%{expr:05:00}` | +----+----------------+-----------------+----+-----------------+ mysql> select * from radgroupreply where groupname='Default_dsl-mobile.de'; +----+--------------------------+-----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+--------------------------+-----------------+----+----------------------------------+ | 44 | Default_dsl-mobile.de | Framed-Protocol | = | PPP | | 45 | Default_dsl-mobile.de | Framed-Routing | = | None | | 46 | Default_dsl-mobile.de | Service-Type | = | Framed-User | | 48 | Default_dsl-mobile.de | Cisco-AVPair | += | lcp:interface-config=ip mtu 1448 | +----+--------------------------+-----------------+----+----------------------------------+ Output from "/usr/sbin/freeradius -d /etc/freeradius -X -f" and a new dsl login try: [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dsluser(a)realm.net' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dsluser(a)realm.net' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dsluser(a)realm.net' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'dsluser(a)realm.net' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default' ORDER BY id Invalid operator for item Framed-Protocol: reverting to '==' [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default_dsl-mobile.de' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default_dsl-mobile.de' ORDER BY id Invalid operator for item Framed-Protocol: reverting to '==' [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id [sql] User found in group PM_DSL_8000 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok As you can see, the radius didn't get infos about the group 5Uhr-Trennung and the group PM_DSL_8000 seems to be there two times. It doesn't matter on what position a group is, we can reproduce it with any settings. Any idea or restrictions known, why freeradius won't lookup all groups? Or any hint, what to test? Regards, Volker

1 0

unsubscribe
by Romeo Mihalcea 13 Sep '13

13 Sep '13

unsubscribe

2 1

Building FreeRadius with custom LDAP libraries
by Nikolaos Milas 12 Sep '13

12 Sep '13

Hello, I am trying to use http://www.packetfence.org/downloads/PacketFence/freeradius/freeradius-2.2.… to create custom FreeRadius RPMs for RHEL/CentOS 6. The main aim is to add --with-dhcp compile option which is not included in the standard build. The secondary aim is to build using custom ldap libraries, because we are using LTB OpenLDAP RPM packages (http://ltb-project.org/wiki/download#openldap) The libraries as installed by these RPM packages are in /usr/local/openldap/lib64/ and /usr/local/openldap/include/ In the src.rpm I see: BuildRequires: openldap-devel which I can change to: BuildRequires: openldap-ltb-debuginfo but how can I define custom LDAP libraries? Can I use something like: export CPPFLAGS="${CPPFLAGS} -I/usr/local/openldap/include" export LDFLAGS="${LDFLAGS} -L/usr/local/openldap/lib64" ...as we do for building Dovecot, or CXXFLAGS="${CXXFLAGS} -I/usr/local/openldap/include"; export CXXFLAGS LDFLAGS="${LDFLAGS} -L/usr/local/openldap/lib64 -lldap -llber -R/usr/local/openldap/lib64"; export LDFLAGS ...as we do for building PowerDNS? ( We have found the above for other software after significant effort. I hope it'll be easier with FreeRadius! :-) ) Please advise! Thanks, Nick

4 6

Replicating to multiple servers.
by Cooper, Tom 12 Sep '13

12 Sep '13

Hi all, How can I replicate to more than 1 server? I have set up replication to one host, but when I set up a second host it does not replicate to it. However the first host works perfectly. I am using freeradius-2.2.0-1 This is what I have in my proxy.conf file. home_server ALOTT-SMP { type = acct ipaddr = 192.168.xx.xx port = 1813 secret = xxxxxxxx src_ipaddr = 192.168.xx.xx require_message_authenticator = no response_window = 4 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool ALLOT-SMP { # type = fail-over home_server = ALOTT-SMP } home_server PROCERA-SMP { type = acct ipaddr = 192.168.xx.xx port = 1813 secret = xxxxxxx src_ipaddr = 192.168.xx.xx require_message_authenticator = no response_window = 4 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool PROCERA-SMP { type = fail-over home_server = PROCERA-SMP } realm example.com { authhost = LOCAL accthost = LOCAL type = radius preacct { update control { #Replicate-To-Realm := 'ALLOT-SMP' Proxy-To-Realm := 'ALLOT-SMP' Proxy-To-Realm += 'PROCERA-SMP' } } accounting { replicate } } To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 4

free radius setup
by Swenson, Chris 11 Sep '13

11 Sep '13

I understand a bit more why people were bring up plain text passwords now. My radius server is being presented with peap ms-chapV2 credentials and I want it to receive authentication from my openldap server. It seems that the credentials in this format cannot be digested by openldap and acknowledged. The passwords in my openldap are encrypted as SHA Do I have this right? Is there an alternative. Maybe that FreeRadius 3.0.0 rc1 mentioned in one of the emails the other day? Thanks for your attention

5 9

radclient error
by Mehdi Ravanbakhsh 11 Sep '13

11 Sep '13

Hi All I have this Error when using radclient: radclient: Nothing to send. radclient:: Expected end of line or comma I do not know what is means ? (radclient is run by PlPerl script in my postgresql database engine) Best regards.

2 2