- Freeradius-Users - lists.freeradius.org

Using DirName from CRLDP extension as search filter
by Joacim Kosonen 08 Jul '13

08 Jul '13

Greetings, novice at freeradius here. I would like to use the ldap module in Freeradius to check certs against CRLS, nothing special there. What I'm wondering is how, if it is in fact possible, can I take the DN provided by the cert to filter the ldap search done by the module. All I really need to filter on is the CN part of the DirName. Example: DirName: C = US, O = XXXXXXX, CN = CRLXXX There are quite a few CRLs on the ldap server and it seems that having more than one result returned results in an ambiguous search and a subsequent failure. Is what I'm looking to do possible? Somewhat related question about CRLs, in my testing I've run across the error "Different CRL scope". It seems that the CRLs have the UsersOnly flag set, but I can still successfully verify that a revoked certificate that fails in this fashion is indeed revoked by using openssl verify. My suspicion is that openssl verify doesn't care about scope, but I haven't found anything that says one or the other. I'm running freeradius 2.1.12 from the debian wheezy repo, openssl 1.0.1e from the same, if this is relevant. Regards, Joacim Kosonen

1 0

pulling dn for User-Profile from ldap
by Martin Kraus 08 Jul '13

08 Jul '13

Hi. I'd like to give users an option to specify which network to connect to using something like helpdesk\username@realm admins\username@realm I was thinking of stripping the network part in hints and saving it in a variable say Preferred-Network and then match on it in users DEFAULT Ldap-Group="%{Preferred-Network}" User-Profile := "%{Profile-DN}" Profile-DN would be matched to seeAlso in ldap.attr and seeAlso would be an attribute containing dn of the radius profile to be used for this group. However when I set it up I didn't see ldap module returning Profile-DN and I couldn't match against it. I guess I'm using the ldap module wrong but I'm not able to figure it out. thanks for any pointers martin

2 2

How to limit the number of active uers
by Thura Hlaing 05 Jul '13

05 Jul '13

Hello guys, I am wondering if there is anyway for freeradius to reject auth requests based on the number of active (connected) users. For example, I would like to limit the number of active (authorized) users to 50 in my radius+CoovaChilli deployment, so that connection speed doesn't become very poor. I am very new freeradius user. So, any hints/suggestions will be highly appreciated. Yours, Thura Hlaing

2 1

Access-challenge timeout on IOS
by Franks Andy (RLZ) IT Systems Engineer 04 Jul '13

04 Jul '13

Hi, I'm experimenting with a system involving an access-challenge to a NAS. It works fine with FR so far on, say, the cisco ipsec vpn client, which waits a long time until timing out waiting for user input. I'd like to also discover how other NAS's behave using this and have found the timeout on a particular cisco 1131 access point to be quite short. Does anyone know if there's a radius attribute I can send that will extend this timeout, or an internal setting that will change the default on the ap? Session-timeout and Idle-timeout are attributes mentioned by the cisco docs but neither of these seem to be what I'm after. Thanks Andy

5 6

RE: Access-challenge timeout on IOS
by Franks Andy (RLZ) IT Systems Engineer 04 Jul '13

04 Jul '13

I'll give it a go. Thanks for the information guys. The cisco attribute list says Session-Timeout : Sets the maximum number of seconds of service to be provided to the user before the session terminates. This attribute value becomes the per-user "absolute timeout." Not that helpful, and why I discarded it as an option which might be useful. Let's see.. Thanks andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 04 July 2013 15:28 To: freeradius-users(a)lists.freeradius.org Subject: Re: Access-challenge timeout on IOS On 04/07/13 14:34, David Mitton wrote: > Quoting Phil Mayers <p.mayers(a)imperial.ac.uk>: > >> On 04/07/13 11:00, Franks Andy (RLZ) IT Systems Engineer wrote: >>> Hi, > .... >> >>> >>> Session-timeout and Idle-timeout are attributes mentioned by the >>> cisco docs but neither of these seem to be what I'm after. >> >> Neither are relevant; they're for established sessions, not timeouts >> in >> *establishing* one. >> - > Actually, that is incorrect Session-Timeout _is_ used to control the > authentication timeout, when in the initial AccReq. I'd quote the > RFC, but I'm not at home. The *-Timeouts in the Acc-Accept control the session. > Hmm, so it does; 5.27 of 2865 and 2.3.2 of 2869. However - does any equipment actually *honour* this? Also, I note the wording is very loose indeed - no MUST. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Problem with CISCO WIRELESS CONTROLLER and RADIUS Authentication
by Alan Buxey 04 Jul '13

04 Jul '13

Those are VSA that you are getting from the NAS. You're WiFi kit is centrally managed so config is pushed from the controller alan

1 0

Problem with CISCO WIRELESS CONTROLLER and RADIUS Authentication
by Gustavo Vieira Oliveira 04 Jul '13

04 Jul '13

Hello! We have a Cisco Wireless Controller 5508 with Aironet 1041 APs. To make the AP authenticate with RADIUS we need to set the following command manually in the AP: - radius-server vsa send Which as explained by cisco does the following: Command Purpose Router(config)# *radius-server vsa send* [*accounting* | *authentication*] Enables the network access server to recognize and use VSAs as defined by RADIUS IETF attribute 26. The thing is, the APs can only authenticate if this command is issued in the AP by cli and we need that the Wireless Controller can pass this configuration to the APs, which it doesn't support. So, anyone know why is it necessary and if there is another alternative or workaround to make it work without it? Nowadays we schedule a script to log in the AP and run the command. Thanks in advance.

4 4

Setting Class attribute by LDAP Groups
by Patrick Gawthorne 04 Jul '13

04 Jul '13

Hello Currently trying to implement a way to get the Ldap-Group used for checking (within acct_users) into the Accounting-Request packet as the Class attribute.. I can get it to send a static variable just fine using; (I'm proxying the account messages) update request { Class = "Some Variable" } However I was looking at doing something on the lines of; update request { Class = "%{Ldap-Group}" } Also tried defining a custom variable within the dictionary file and setting it within acct_users however it expands to nothing in preacct section.. I must be doing something wrong. I did read somewhere if you included the Class variable within the reply in the Access-Accept packet that it would be sent back and used within the accounting messages as well but this hasn't been the case for me. Even if it's just some static variable that I set within the 'acct_users' to get it to send the class attribute; this will achieve my goal. Assuming that the 'users' file and the 'acct_users' file have the same behaviour then why can't I set Class within the 'acct_users' file like I can with 'users' file? Any assistance on this will be greatly appreciated. :) Cheers, Pat This email, together with any attachments, is intended for the named recipient(s) only and may contain privileged and confidential information. If received in error, please inform the sender as quickly as possible and delete this email and any copies from your computer network. If not an intended recipient of this email, you must not copy, distribute or rely on it, and any form of disclosure, modification, distribution and/or publication of this email is prohibited. Unless stated otherwise, this email represents only the views of the sender and not the views of Pacific Lutheran College.

3 2

Using freeradius as proxy for EAP-SIM/EAP-AKA
by Ming-Ching Tiew 04 Jul '13

04 Jul '13

Hi I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ? Assuming brand X radius server has support for EAP-SIM/EAP-AKA, but it's located at the final end of the food chain, and in-between the brand X radius server and the Access point, there are 2 (or more) radius servers which are doing proxying ( and some other non-EAP SIM/EAP AKA work ). Will it work ?

6 7

Stripped-User-Name not set when using nostrip?
by Júlíus Þór Bess Ríkharðsson 03 Jul '13

03 Jul '13

3 8