- Freeradius-Users - lists.freeradius.org

multihomed server on isolated networks
by Lev Bronshtein 29 Mar '13

29 Mar '13

FreeRadius version 2.2.0 OS: RHEL 5.5 Hi Everyone, I have a requirement where a DHCP server should have a leg into a number of isolated networks. Which means that when I set DHCP-DHCP-Server-Identifier as an interface address only one network will find it. My current options include setting up routes on other networks to the respective interfaces, numbering the loopback and again doing the same, however I was hoping that there maybe a configuration option that will set the Server Identifier to be the IP address of the egress interface. Please let me know as to what is currently possible in my scenario. Regards, Lev Bronshtein

2 3

DEFAULT user configuration in users file
by Mehdi Ravanbakhsh 29 Mar '13

29 Mar '13

Hi ALL i need to accept all incoming request and pool name should be "Baduser" even if user not define in sql database .( i change the pool-name if user was define in sql databasen in later steps). I test it ........client by any user and password can connect to NAS and if user was define it work correctly and pool name change to correct one but if user not define pool-name not set to "Basuser". my users file configuration : DEFAULT Auth-Type := Accept DEFAULT Pool-Name = "Baduser" Any Idea ?

1 0

autostarting fr on osx
by Alex Sharaz 29 Mar '13

29 Mar '13

Hi, I'm running FR2.2 on my osX server at home. At the moment I'm just invoking it from the command line. Given that osx comes with FR 2.1.10 preinstalled ( supplied version disabled), what's the best way of auto starting the git built 2.2 version on os x? Replace /usr/sbin/radiusd with a symbolic link to /usr/local/sbin/radiusd or build a different launch daemon config for the new release. Rgds Alex

2 1

rlm_detail alternatives?
by Konstantin Chekushin 29 Mar '13

29 Mar '13

3 2

Trying to do proxy using realm and 2 VS
by Vincent, Fabien 28 Mar '13

28 Mar '13

Hi all, I'm currently working on a fresh FreeRadius 2.x install, in order to separate Radius auth for Administrators (Firewall, Routeurs & Switchs administration) and Customers access (VPN SSL / IPSec). My first try was to rewrite all the config into virtual servers (previously, all was written into radiusd.conf :(). So what I did : [root@server /etc/raddb]$ ll sites-enabled/ total 0 lrwxrwxrwx. 1 root root 33 Mar 19 12:01 administrator -> /etc/raddb/sites-available/administrator lrwxrwxrwx. 1 root root 43 Mar 26 18:16 customer -> /etc/raddb/sites-available/coreye_customers This is my two VS : server administrator { # Authenticate / Authorize listener listen { ipaddr = * port = 1600 type = auth } # Accounting listener listen { ipaddr = * port = 1601 type = acct } [...] server customer { # Authenticate / Authorize listener listen { ipaddr = * port = 1602 type = auth } # Accounting listener listen { ipaddr = * port = 1603 type = acct } [...] And in order to proxy, I want to forward using proxy depending realm (proxy.conf) realm ".*customer$" { virtual_server = customer } realm ".*admin$" { virtual_server = administrator } realm NULL { virtual_server = administrator } But when logging into Radius, it works for VS Administrator (login admin or user@admin), but if I try using login@customer, it's never proxy to virtual server customer. I tried different methods always shown in the mailing list, but no way, it's never working ... Proxy to realm into authorize section : if (Realm == customer) { update control { Proxy-To-Realm := customer } } Not working ... The request is always managed by administrator vs. Always played using dynamic clients example and FreeRADIUS-Client-Virtual-Server = "customer", but not working again. I suspect the problem located in my NAS MySQL table, where "server" column is forced to virtual server "administrator" Is anything I missed to do ? What's the best solution to do this kind of configuration when nas are stored in MySQL DB, and some of the nas clients could be used by different virtual servers ? What the is the best way to have a single radius IP server, and two different virtual servers with two different set of rules ? Thanks in advance for your help ! Fabien VINCENT http://www.coreye.fr<http://www.coreye.fr/>

1 0

New/updated dictionary files for Meru and Trapeze
by John Carter 28 Mar '13

28 Mar '13

Hi, Please find attached a brand-new Meru dictionary file and an updated Trapeze dictionary file (updated based on 2.2.0). Do you want diffs? Regards, John.

2 3

Re : Re: Re : Re: Mode debug
by Billot 28 Mar '13

28 Mar '13

When using raddebug or -x option in startup, i can't see logs like User-Name = "nagios(a)ac-orleans-tours.fr" NAS-IP-Address = 172.21.175.132 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-00:WIFI-ACAD" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" which can be found with -X I tried radiusd -xxxxl /var/log/debug.log, file exists but is as detailled as with debug_level = 2 in radiusd.conf I tried radmin, debug level 4, debug file debug.log and same way. Any idea ? Le 28/03/13, Olivier Beytrison <olivier(a)heliosnet.org> a écrit : > On 28.03.2013 10:31, Billot wrote: > > Ok thanks but is it possible to have it permanently with a config item like > > > > raddbdir = ${sysconfdir}/raddb > > radacctdir = ${logdir}/radacct > > debug_level = 4 > > > > edit your startup script and add -xl /path/to/my/debugfile > add more x for more debugging > Be aware that this file will grow quickly depending on the amount of > request your server handle. > > Olivier > -- > > Olivier Beytrison > Network & Security Engineer, HES-SO Fribourg > Mail: olivier(a)heliosnet.org > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

compile error
by Igor Smitran 28 Mar '13

28 Mar '13

I am not able to compile from git. It ends with error: version.c:71: warning: no previous prototype for 'ssl_version_check' version.c: In function 'ssl_version': version.c:78: error: expected ';' before '}' token gmake[4]: *** [version.lo] Error 1 gmake[4]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server' make: *** [all] Error 2

2 2

Mode debug
by Billot 28 Mar '13

28 Mar '13

Hi, When debugging freeradius config, we use radiusd -X which can offer a lot of useful datas like rad_recv: Access-Request packet from host 172.21.175.132 port 32769, id=166, length=332 User-Name = "nagios(a)ac-orleans-tours.fr" NAS-IP-Address = 172.21.175.132 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-00:WIFI-ACAD" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" but in standard running mode (service radius start), even with debug = 2 set, there is no such detailed log. How can we have such detail logs in running mode ? -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 3

Auth-Type krb5 not recognized by v2.1.12
by Jaap Winius 27 Mar '13

27 Mar '13

Hi folks, Recently my server received an in-place upgrade from Debian squeeze to wheezy (still testing). Along with that, freeradius was upgraded from version 2.1.10 to 2.1.12, but as a result it no longer works. The problem is that I use "DEFAULT Auth-Type = krb5" in /etc/freeradius/ users, and this now leads to an error in the radius.log that prevents freeradius from starting up: Error: /etc/freeradius/users[207]: Parse error (check) for \ entry DEFAULT: Unknown value krb5 for attribute Auth-Type Interestingly, if I use "kerberos" instead of "krb5" for the default auth- type, there is no such error in the radius.log, but I still can't authenticate. Downgrading to 2.1.10 quickly fixes the problem. Is this new behavior intentional, or is it simply a bug? In either case, is there a workaround or a code fix for this, or should I continue to use 2.1.10? Thanks, Jaap

4 7