- Freeradius-Users - lists.freeradius.org

User Account Configuration
by Patrick Meyer 20 Aug '13

20 Aug '13

Greetings! I am using Freeradius2 2.2.0 on a pfsense 2.1 RC1 firewall to support authentication for a captive portal. I see that it is possible to expire a user account in Freeradius. I am wondering if I can specify a date and time to make the account effective. For instance, I know I have a user starting in 30 days. Can I configure the account today to enable the user in 30 days? Regards, Patrick

1 0

FreeRADIUS + OpenLDAP + Daloradius
by Mantas Šiurkus 19 Aug '13

19 Aug '13

Hello, I am creating WIFI hotspot on Debian 7. I had configured FreeRADIUS to work with OpenLDAP for users authentication. How I can configure Daloradius for user control? All tutorials that I found, shows how to configure it with mysql, but my users are stored into LDAP (not mysql). Is it possible to configure Daloradius to work when users authenticate wia LDAP?

1 0

Policy to split domain and host
by nicolas.clo＠ricoh-industrie.fr 16 Aug '13

16 Aug '13

Hi list, I'm searching the best way to configure a policy to split the domain and the prefix ' /host' when it is a computer connection. The initial UserName is like this: host/computername.DOMAIN.LOCAL I can already easily split the /host by policy and realm configuration but I don't know how I can do when there is double delimiter in the same UserName ? Thanks for your reply. __________________________________________________________________________ Nicolas CLO Industrial and Network Technician ITS Section RICOH INDUSTRIE FRANCE SAS 144, route de Rouffach, 68920 WETTOLSHEIM Tel: +33 (0) 3 89 20 48 84 nicolas.clo(a)ricoh-industrie.fr | www.ricoh-thermal.com

2 2

FreeRADIUS basic setup for PEAP using example certificates
by Darlington, Andrew 15 Aug '13

15 Aug '13

Hi all I'm trying to setup a very basic test server using FreeRADIUS (running on Ubuntu 12.04) that uses PEAP with the example certificates generated by FreeRADIUS. I keep running into a variety of fairly basic problems. After running freeradius -X I get this error message. Couldn't open /etc/freeradius/acct_users for reading: Permission denied Errors reading /etc/freeradius/acct_users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. I was hoping someone could advise. Thanks PS I'm new to FreeRADIUS and Ubuntu. ________________________________ This e-mail message is confidential and for use by the addressee only. If you are not the intended recipient, you must not use, disclose, copy or forward this transmission. Please return the message to the sender by replying to it and then delete the message from your computer. Sagentia provides e-mail services for both itself and a number of its independent spin-out companies. Sagentia shall not be held liable to any person resulting from the use of any information contained in this e-mail and shall not be liable to any person who acts or omits to do anything in reliance upon it. Sagentia does not accept responsibility for changes made to this message after it was sent. Company Information: Name: Sagentia Limited. Registered Address: Harston Mill, Harston Cambridge CB22 7GG. Registered as a Company in England: 2081960 VAT Number: 432214202. Website hosted by: Sagentia Limited Harston Mill, Harston, Cambridge, UK. CB22 7GG info(a)sagentia.com -- Scanned by iCritical.

4 6

Rejecting realms based on calling client
by David Aldwinckle 15 Aug '13

15 Aug '13

Hello, I have two clients that proxy access requests to me. The realm varies, but the format is always userid(a)realm.whatever<mailto:userid@realm.whatever> Is there a way that I can deny a specific realm when an access request is received from a specific client? I tried adding something to policy.conf but I couldn't get the syntax right: #Prevent secretrealm from logging in off-campus remote_secret_reject if ("%{Realm}" == "secretrealm.ca") && ((Client-Shortname == "proxy-client1") || (Client-Shortname == "proxy-client2"))) { reject } Is there a different way that I should be doing this? Thanks, Dave Dave Aldwinckle Network Support Specialist Information Systems and Technology Phone: (519)-888-4567 ext. 31145 E-Mail: daldwinc(a)uwaterloo.ca<mailto:daldwinc@uwaterloo.ca>

3 5

How to accept RADIUS traffic on multiple interfaces?
by Kurt Hillig 15 Aug '13

15 Aug '13

We're running FreeRadius 2.2.0 on RHEL 6. The servers are working fine with a single active interface (eth0) on each one; but we need to activate a second interface (eth1) on each server - on a different IP subnet - to handle local traffic on that subnet. The interfaces look like this: eth0 Link encap:Ethernet HWaddr 18:03:73:EE:76:96 inet addr:10.10.0.189 Bcast:10.10.0.191 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 eth1 Link encap:Ethernet HWaddr 18:03:73:EE:76:98 inet addr:10.10.95.62 Bcast:10.10.95.127 Mask:255.255.255.128 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 and the routing is correct: Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.10.0.184 0.0.0.0 255.255.255.248 U 0 0 0 eth0 10.10.95.0 0.0.0.0 255.255.255.128 U 0 0 0 eth1 0.0.0.0 10.10.0.185 0.0.0.0 UG 0 0 0 eth0 Iptables is set up to accept incoming traffic from anywhere on UDP ports 1812 and 1813. radiusd.conf includes these "listen" sections (omitting comments): listen { type = auth ipaddr = * port = 1812 interface = eth0 } listen { type = auth ipaddr = * port = 1812 interface = eth1 } listen { type = acct ipaddr = * port = 1813 interface = eth0 } listen { type = acct ipaddr = * port = 1813 interface = eth1 } But radiusd isn't seeing any of the inbound RADIUS traffic on eth1 - tcpdump shows it coming in, but "radiusd -X" shows no indication of this traffic (but is reporting all of the traffic on eth0). Anyone know what I'm missing here? -- Dr. Kurt Hillig UMNet Administration I always tell the (734)647-8778 desk University of Michigan absolute truth, (734)323-2736 cell Ann Arbor, MI 48105-3640 as I see it. khillig(at)umich.edu > Computers were invented to help people waste more time faster <

3 3

Re: How to accept RADIUS traffic on multiple interfaces?
by Matteo Vocale 15 Aug '13

15 Aug '13

Before running radius in debug mode, try iptables -F with root privileges, it disables iptables default rules Phil Mayers <p.mayers(a)imperial.ac.uk> ha scritto: >On 14/08/13 15:07, Kurt Hillig wrote: > >> But radiusd isn't seeing any of the inbound RADIUS traffic on eth1 - >> tcpdump shows it coming in, but "radiusd -X" shows no indication of >> this traffic (but is reporting all of the traffic on eth0). > >If "radiusd -X" isn't reporting *anything*, then it's not reaching >FreeRADIUS, which means some part of the network stack is dropping it. > >If you're sure your iptables are correct, google "linux log martians" >and "linux rp filter". RHEL6 has different defaults to previous RHEL >versions in this regard. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Problem in freeradius 2.1.10, ldap and huntgroups
by ville＠leinonen.org 14 Aug '13

14 Aug '13

Hi, I have installed fr 2.1.10 w openldap and I can authenticate users against ldap. I have also added groups in ldap and allowed ldap module to search groups and it also works fine. Now the problem is that is huntgroups wont work. I need to restrict access to NAS for specific groups. I can see that groups match "rlm_ldap::ldap_groupcmp: User found in group xxxx", huntgroup match wont work. file huntgroups: xxxx NAS-IP-Address == 172.150.0.1 file users: DEFAULT Ldap-Group == "xxxx" Huntgroup-Name == "xxxx" I am very glad for any help and if someone have better solution for this i'm happy to hear it. There is about 600 NAS (sw's and routers) for different customers and we need to provide mgmt access to customers and our NOC staff, so i think we need to use huntgroups w groups and if someone have example for this one I'm very glad for that also. Best regards, Ville Leinonen

3 7

Apple devices can´t authenticate
by Roberto Carna 14 Aug '13

14 Aug '13

Dear, I have installed the Easyhotspot captive portal product which uses the freeradius 2.1.0 service in order to authenticate users. I can authenticate with Windows, Linux and Android devices, but I can't authenticate with Apple devices (iphone and ipad) at all. Is it an intrinsic problem of Freeradius ??? Thanks a lot. Roberto

4 6

Freeradius with DHCP and VLANs
by Fernando Pizarro 14 Aug '13

14 Aug '13

Hi all, I'm using Freeradius version 2.1.12 with MySQL backend and EAP-TLS authentication to serve dynamic VLAN and a DHCP server to leases this IP address. This setup work sucefully but IP address of supplicants doesn't stored in the database. Is there any setup to store IP address of supplicants in the database? How sqlippoll works? does it work as a DHCP server? Is it posible to setup Freeradius with DHCP module to server diferents VLANs? Thanks for all. Fernando

2 2