- Freeradius-Users - lists.freeradius.org

Re: [Help] - How To configure Radius timeout / count retries
by Danny Kurniawan 01 Mar '13

01 Mar '13

Hello, This is what i want to do : "You're asking whether you can configure FreeRADIUS to inform the access point that it should fail over to another server server after a given number of timeouts/retries? " Thanks Danny -- Best Regards, Danny

2 1

[Help] - How To configure Radius timeout / count retries
by Danny Kurniawan 01 Mar '13

01 Mar '13

Hi All, Let say for example in our Wireless AP (access point) we can put 2 Radius server in sequence, radiusA and radiusB. I know the AP will eventually look at the 1st server, and if its not available (let say server is down) then it will go to the 2nd radius server (I only assume this). So is there any way in Radius conf we can set the retries or timeout, so for example after failed for 2 times (no matter what is the error is) it will goes to the other radius server? Thanks Danny -- Best Regards, Danny

2 1

DHCP sqlippool reply values
by Igor Smitran 01 Mar '13

01 Mar '13

I've added two new fields into radippool table that i am using for DHCP dynamic pools. `gateway` varchar(15) NOT NULL DEFAULT '', `netmask` varchar(15) NOT NULL DEFAULT '', in ippool-dhcp.conf i've added new fields: allocate-find = "SELECT framedipaddress,gateway,netmask FROM ${ippool_table} .... I am not able to figure out how to address new fields inside policy.conf. Is it even possible? I need to have two new fields, currently i have: update reply { DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" } I am trying to get two new fields: DHCP-Subnet-Mask DHCP-Gateway-IP-Address I can use perl module to add those two fields but that means that i need two more database queries. Any other way?

3 2

MAC Authentication with FreeRadius
by Bouchra Badri 28 Feb '13

28 Feb '13

Hi, 1 - I was wondering if going through the tuto in wiki.freeradius is necessary to be able to authenticate using the mac address ? For one, that rewrite_calling_station_id generates an error at the run of freeradius, plus I've seen some tutos that say that cisco Mac-auth-Bypass can do the trick... Can you confirm it please? Because it doesn't work either :( 2 - I can probably do it using the vmps and mac2vlan files supplied by FreeRad, but in mac2vlan they say that radiusd.conf shows how to use it in detail, but that's not the case ! So can you please provide a clear tutorial on how to use vmps with freeradius? Thank you !

3 7

Huntgroup Checking
by simonm123 28 Feb '13

28 Feb '13

Am new to freeradius but have it mainly set up just fine. It's a fantastic tool and I'm enjoying using it :) Just one thing I'm struggling with is the huntgroups. I've followed the wiki to the letter and can see the server checking in the debug log. What I basically want to do is restrict users to certain networks, as per the wiki. If their huntgroup-name matches their huntgroup based on nasip, they can get online, otherwise they're rejected. I've put Huntgroup-Name = NetworkA in my radgroupcheck folder. In my radhuntgroup table, I have the nasip and groupname = NetworkA Then, in the authorize section of my default host, I put: update request { Huntgroup-Name := "%{sql:SELECT `groupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name == ''){ reject } All as per the tutorial In my debug log, if there is no match by IP, Huntgroup-Name is blank and the user is rejected. However, if the nasip address match but the name is different, the user is still allowed on. Do I need a more advanced query in the if section and if so,could you please advise what it should be Simon -- View this message in context: http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-tp4950385p495038… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

SSL V3 client certificate error
by Danny Kurniawan 28 Feb '13

28 Feb '13

Hi All, I have some intermittent issue with our Radius auth. OS : SLES 11 Radius 2.1.1 We get the cert from GlobalSign and use it at the 2 Radius server. So Server A and Server B use the same cert. in Server B, ometimes it works fine to authenticate and sometimes its failed but everything fine in Server A. Fri Feb 22 18:31:39 2013 : Auth: Login OK: [sdholakia2] (from client AllWirelessAP port 0 via TLS tunnel) Fri Feb 22 18:31:39 2013 : Auth: Login OK: [sdholakia2] (from client AllWirelessAP port 0 cli A0-88-B4-0F-C3-D8) *Fri Feb 22 18:36:30 2013 : Error: TLS Alert read:fatal:unknown CA Fri Feb 22 18:36:30 2013 : Error: TLS_accept:failed in SSLv3 read client certificate A Fri Feb 22 18:36:30 2013 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Fri Feb 22 18:36:30 2013 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails.* Fri Feb 22 18:36:30 2013 : Auth: Login incorrect: [800200sq] (from client AllWirelessAP port 0 cli A0-88-B4-58-BA-8C) Fri Feb 22 18:37:34 2013 : Auth: Login OK: [800200sq] (from client AllWirelessAP port 0 via TLS tunnel) Fri Feb 22 18:37:34 2013 : Auth: Login OK: [800200sq] (from client AllWirelessAP port 0 cli A0-88-B4-0F-C3-D8) Any idea what should i check for that error? Thanks -- Best Regards, Danny

2 1

Feature requests for FreeRADIUS 3
by Arran Cudbard-Bell 28 Feb '13

28 Feb '13

We expect to release 3.0.0 in the next couple of months. With major releases occurring fairly infrequently, now is a good time to request any features that would break configuration compatiblity with previous releases, or you You can see the current list of feature requests here: https://github.com/FreeRADIUS/freeradius-server/issues?labels=feature+reque… and log any feature requests you have using the same tool. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS dev team - Maintainer Please contribute documentation: http://wiki.freeradius.org

1 0

Proxy configuration question
by bpatil＠ovi.com 27 Feb '13

27 Feb '13

Hello, I have a rudimentary proxy configuration question: I am doing some testing with a Freeradius server in the lab and the setup looks as follows: [Host] --WiFi--- [AP]---[Wireless Cntrlr]-----------[AAA/Freeradius server] Using EAP-TTLS for authentication. My wpa_supplicant config file looks like: ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=admin network={ ssid="mySSID" scan_ssid=1 key_mgmt=WPA-EAP eap=TTLS anonymous_identity="anonymous(a)example.com" ca_cert="/home/testuser/Downloads/ca.pem" phase2="autheap=PAP" identity="daniel" password="daniel" } The RADIUS server gets the Access request and then tries to proxy it to example.com. I dont want the request or authentication to be proxied elsewhere. The authentication needs to happen on the local RADIUS server itself. What am I missing in the config? The server and client certs are all there in /etc/raddb/certs directory. Below is a snippet of the logs that I am seeing on the RADIUS server: Tue Feb 26 17:29:43 2013 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.8 port 34438, id=117, length=234 User-Name = "anonymous(a)example.com" Calling-Station-Id = "00-03-7F-10-51-82" NAS-IP-Address = 192.168.0.8 NAS-Port = 34 Called-Station-Id = "8C-0C-90-15-D1-9C:mySSID" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "8C-0C-90-15-D1-9C" Connect-Info = "CONNECT 802.11a/n" EAP-Message = 0x0201001a01616e6f6e796d6f7573406578616d706c652e636f6d Vendor-25053-Attr-3 = 0x5275636b7573576972656c65737332 Message-Authenticator = 0xfdf3d6097b64d1237a34e27dd120bfec Tue Feb 26 17:29:43 2013 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Feb 26 17:29:43 2013 : Info: +- entering group authorize {...} Tue Feb 26 17:29:43 2013 : Info: ++[preprocess] returns ok Tue Feb 26 17:29:43 2013 : Info: ++[chap] returns noop Tue Feb 26 17:29:43 2013 : Info: ++[mschap] returns noop Tue Feb 26 17:29:43 2013 : Info: ++[digest] returns noop Tue Feb 26 17:29:43 2013 : Info: [suffix] Looking up realm "example.com" for User-Name = "anonymous(a)example.com" Tue Feb 26 17:29:43 2013 : Info: [suffix] Found realm "example.com" Tue Feb 26 17:29:43 2013 : Info: [suffix] Adding Stripped-User-Name = "anonymous" Tue Feb 26 17:29:43 2013 : Info: [suffix] Adding Realm = "example.com" Tue Feb 26 17:29:43 2013 : Info: [suffix] Proxying request from user anonymous to realm example.com Tue Feb 26 17:29:43 2013 : Info: [suffix] Preparing to proxy authentication request to realm "example.com" Tue Feb 26 17:29:43 2013 : Info: ++[suffix] returns updated Tue Feb 26 17:29:43 2013 : Info: [eap] Request is supposed to be proxied to Realm example.com. Not doing EAP. Tue Feb 26 17:29:43 2013 : Info: ++[eap] returns noop Tue Feb 26 17:29:43 2013 : Info: [files] users: Matched entry anonymous at line 207 Tue Feb 26 17:29:43 2013 : Info: ++[files] returns ok Tue Feb 26 17:29:43 2013 : Info: ++[expiration] returns noop Tue Feb 26 17:29:43 2013 : Info: ++[logintime] returns noop Tue Feb 26 17:29:43 2013 : Info: ++[pap] returns noop Tue Feb 26 17:29:43 2013 : Info: WARNING: Empty pre-proxy section. Using default return values. Any help appreciated. -BPa

2 3

rlm_ldap group search filter
by Chris Taylor 27 Feb '13

27 Feb '13

I am have profiles setup for all our users but I am having some trouble with the setting the groupmembership_filter correctly. It will query LDAP successfully but only after it does a failed search first. I have tried using numerous filters including the default one but I cant seem to separate the username by itself which is causing the initial search failure. I read through the rlm_ldap doc a few times but I didn't seem anything that I thought would help. Here is the output from radius -X This is the part where it uses the search filter and fails. [files] users: Matched entry DEFAULT at line 214 [domain1] Entering ldap_groupcmp() [files] expand: ou=radius,o=domain.on.ca,dc=placeholder,dc=ca -> ou=radius,o=domain.on.ca,dc=placeholder,dc=ca [files] expand: (&(objectClass=radiusProfile)(member=%{control:Ldap-UserDn})) -> (&(objectClass=radiusProfile)(member=uid\3d112boy\2cou\3dradius\2co\3ddomain.on.ca\2cdc\3dplaceholder\2cdc\3dca)) [domain1] ldap_get_conn: Checking Id: 0 [domain1] ldap_get_conn: Got Id: 0 [domain1] performing search in ou=radius,o=domain.on.ca,dc=placeholder,dc=ca, with filter (&(cn=residential_profile)(&(objectClass=radiusProfile)(member=uid\3d112boy\2cou\3dradius\2co\3ddomain.on.ca\2cdc\3dplaceholder\2cdc\3dca))) [domain1] object not found It starts a second search and succeeds. [domain1] ldap_release_conn: Release Id: 0 [domain1] ldap_get_conn: Checking Id: 0 [domain1] ldap_get_conn: Got Id: 0 [domain1] performing search in uid=112boy,ou=radius,o=domain.on.ca,dc=palceholder,dc=ca, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group residential_profile [domain1] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 222 ++[files] returns ok My users file looks like this. ldap domain1 { server = " ldap01.placeholder.ca" identity = "username xxx" password = xxxx basedn = "ou=radius,o=domain.on.ca,dc=placeholder,dc=ca" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=posixAccount)(cn=true))" groupname_attribute = cn groupmembership_attribute = radiusGroupName groupmembership_filter = "(&(objectClass=radiusProfile)(member=%{control:Ldap-UserDn}))" #do_xlat = yes #compare_check_items = yes #access_attr_used_for_allow = yes ldap_connections_number = 5 My users file DEFAULT Service-Type == Framed-User, Huntgroup-Name == bras, domain1-Ldap-Group == residential_profile Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:inacl#100=permit tcp any x.x.0.16 0.0.0.15 eq 25", Cisco-AVPair += "ip:inacl#200=deny tcp any any eq 25", Cisco-AVPair += "ip:inacl#300=permit ip any any", Fall-Through = No Any help is apprecaited. Thanks, Chris

1 0

TOP UP Voucher Time / TOP UP User Time
by Russell Mike 27 Feb '13

27 Feb '13

Dear Mr. Alen. D Greetings, Million thanks for developing such software to make life easy. i wish to seek your opinion in one task, Kindly advice. What are the possibilities to TOP UP Voucher time / TOP UP a user time. Kindly share the idea. if you in my position, how would you address this challenge? i am asking because you can think better solution than i would. i am willing to study further. *What i am thinking the following, i am not sure even if it is valid thought / idea* Freeradius check accounting records in "Radacct" table. creating additionaltable in radius database *"TOP_UP_TIME"*. When user click top up icon, if something can transfer all accounting records for that user to "TOP_UP_TIME" table. Freeradius would not know since when the user is logged in because there is no account in "Radacct" table. The next accounting that will reach from NAS to Freeradius would be the first time stamp. Thanks / Regards RM --

1 0