- Freeradius-Users - lists.freeradius.org

Replace NAS-Identifier with Huntgroup
by Lorenzo Milesi 15 Feb '13

15 Feb '13

Hi. I was wondering, is it possible to replace the NAS-Identifier features by playing with Huntgroups? The idea is to have one user which can access in several NAS with customized params, and this is what HG are for. But how to Reject the user, if it has no associated HG? I'm having some troubles in fully understanding HuntGroups, as the wiki pages looks only partial. Is there any other documentation source? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 2

Failed to load wimax module freeradius 2.1.12
by Mollatt Ntini 14 Feb '13

14 Feb '13

Hi, I hope someone can point me in the right direction here. I am trying to build FR version 2.1.12 with the option "--with-experimental-modules" on Debian Linux Squeeze 2.6.32-5-amd64 because I need to build support for Wimax stuff. However I get the following compiling error(s): === checking openssl/hmac.h usability... no checking openssl/hmac.h presence... no checking for openssl/hmac.h... no configure: WARNING: silently not building rlm_wimax. configure: WARNING: FAILURE: rlm_wimax requires: openssl/hmac.h. configure: creating ./config.status config.status: creating Makefile === and however when I launch FR, this is what I get: === /usr/local/etc/raddb/modules/wimax[92]: Failed to link to module 'rlm_wimax': rlm_wimax.so: cannot open shared object file: No such file or directory /usr/local/etc/raddb/sites-enabled/default[122]: Failed to load module "wimax". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. === I am trying to build the FreeRadius package version version 2.1.12 from sources from the official tarball from freeradius.org. I know I am missing something but I have looked almost everywhere and can not get a proper clue to this. Regards,

2 1

Complie error
by David Peterson 14 Feb '13

14 Feb '13

What might I be missing when I get this error: (Version 2.x.x) Making all in rlm_eap_pwd... make[9]: Entering directory `/usr/src/freeradius-server/src/modules/rlm_eap/types/rlm_eap_pwd' make[9]: *** No rule to make target `rlm_eap_pwd.h', needed by `rlm_eap_pwd.c'. Stop.

4 7

User mapping
by ahmed.sajid＠stfc.ac.uk 14 Feb '13

14 Feb '13

Hi All, First of all, I would like to say that the website is very very useful. I have be able to setup pam_radius_auth with Kerberos, just by following the instructions on the website. Now to my question, does anybody know how to setup radius to it can map user to a local user. For example, user's username is 'test' but on the local machine the user should be logged on but with user (let's say) 'steve'. If it helps, I already have LDAP setup for accounts. So, is there a way to get ldap attribute uid and map it to maybe 'name' etc. Or the other way round..? Any help would be appreciated. Best Regards, Ahmed Sajid. -- Scanned by iCritical.

2 4

git question
by David Peterson 14 Feb '13

14 Feb '13

Are we still using git fetch origin v2.1.x:v2.1.x to get v2.2? David

3 2

DHCP question
by David Peterson 14 Feb '13

14 Feb '13

I am trying to design a system with full redundancy. I know I can use FreeRadius proxy and/or multiple front ends with a MySQL master-master for the data. For IP redundancy I can install heartbeat so all of that is fine. My biggest unknown is DHCP. How does the new FreeRadius DHCP server store lease information? Will the design I am creating allow for DHCP failover from one machine to the next. One design caveat, the DHCP request will be Relay with Option 82 (hence the need for heartbeat). Any issues with Option 82 requests? David

2 1

Cisco av-pair for NX-OS and IOS
by Norman Zhang 14 Feb '13

14 Feb '13

Hi, Using freeradius2-2.1.12. I need to setup read-write access for both Cisco NX-OS and IOS devices. I did the following, DEFAULT Group == operator-rw, Auth-Type = System Service-Type = NAS-Prompt-User, cisco-avpair := "shell:roles*\"network-admin vdc-admin priv-lvl=15\"" I can log into both NX-OS and IOS devices; however, IOS devices only permits exec mode not the privileged exec (enable) mode. Not sure if I'm doing something wrong on the syntax. Can someone give me few pointers? Norman

3 2

proxy problem
by Muhammad Nadeem 14 Feb '13

14 Feb '13

Hi, I have configured a proxy server of freeradius, that proxy all the incoming requests to 2 backend freeradius servers.Load balancing and Failover is working great. But problem is that the proxy server is proxying the requests in a serial manner. Thus the time of authenticating a bulk of user is very increasing. Can any body tell me, what's the issue??? Thanks in advance

1 0

freeradius form
by Muhammad Nadeem 14 Feb '13

14 Feb '13

Hi ,, first of all , this lists is awsome, i able to solve many problems through this list.Now come to the point. I wanna implement a Load Balancing and Fail over functionality with freeradius server. Just like many big websites have their web farms (have many servers , and requests are distributed among those, and if a server failed. no problem occur at all). Just like above functionality I want to implement in freeradius. I have used Proxy functionality of freeradius for load balancing and failover. But this decrease the performance a lot. (with direct requests i can authenticate 450 users/sec, but with proxy , only 26 users/sec). so could any one help me to guide me, what should I do???? A guide for begging level will be very appreciated. A bundle of thanks in advance

2 2

anonymous user when proxying
by Hocine M 13 Feb '13

13 Feb '13

Hi, Some user who are proxied (eduroam) are acconted with username = anonymous@realm I don't want to have anonymous user in my database, do i have to reject anonymous users in post-proxy section or there is something to do to force user to use inner identity? here are files : _pre-proxy-detail-20130213 :_ Wed Feb 13 14:03:47 2013 Packet-Type = Access-Request NAS-Port-Id = "AP86/1" Calling-Station-Id = "94-39-E5-B7-CB-51" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" Service-Type = Framed-User EAP-Message = 0x0201001f01616e6f6e796d6f75734073742d616e64726577732e61632e756b User-Name = "anonymous(a)st-andrews.ac.uk" NAS-Port = 25861 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x0393b59dea7efd51d506eb73899531ef Realm = "st-andrews.ac.uk" EAP-Type = Identity Proxy-State = 0x313031 Wed Feb 13 14:03:48 2013 Packet-Type = Access-Request NAS-Port-Id = "AP86/1" Calling-Station-Id = "94-39-E5-B7-CB-51" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" Service-Type = Framed-User User-Name = "anonymous(a)st-andrews.ac.uk" NAS-Port = 25861 State = 0xe5a5ab65e5a7be1056566c4c9fd4c6e8 EAP-Message = 0x020200381500160301002d01000029030193958cf5417b1d83d6a46747e4273b6050850d0a2360fec88d289a1381663830000002000a0100 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x5b389846257ea4135f53a64e6e1c5a48 Realm = "st-andrews.ac.uk" EAP-Type = EAP-TTLS Proxy-State = 0x313032 Wed Feb 13 14:03:48 2013 Packet-Type = Access-Request NAS-Port-Id = "AP86/1" Calling-Station-Id = "94-39-E5-B7-CB-51" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" Service-Type = Framed-User User-Name = "anonymous(a)st-andrews.ac.uk" NAS-Port = 25861 State = 0xe5a5ab65e4a6be1056566c4c9fd4c6e8 EAP-Message = 0x020300061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x33638595ef790cd81017538ba1b1aaca Realm = "st-andrews.ac.uk" EAP-Type = EAP-TTLS Proxy-State = 0x313033 Wed Feb 13 14:03:48 2013 Packet-Type = Access-Request NAS-Port-Id = "AP86/1" Calling-Station-Id = "94-39-E5-B7-CB-51" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" Service-Type = Framed-User User-Name = "anonymous(a)st-andrews.ac.uk" NAS-Port = 25861 State = 0xe5a5ab65e7a1be1056566c4c9fd4c6e8 EAP-Message = 0x0204014415001603010106100001020100543ce46842671b13a26b6cad59606bbe3e16c719ec529a476cad7c24bba97b253fb329f026b315098d3de8579f70193cfec9194b6874fab251539c927a85ef58914e6803758fe652d3f6aa75adb2194f12ed7670d81902cbaed23c93d1f099584e53b0dc7d5b2394cc2354b8681874efa66293cf0c6fa9a900311fb678ca09a4e2b58938f9f0ecc9bf5f2a03a7026b27e883863bf1e2c070716a198a0137441acdca2108707473328f187aefb3304e25fd244a9b799bff15c011f21fe5c4ecc81eff6bcfff66d5bc6ba8af469fc50faa1310e3aa2d395d33ef55c841a54a6e6837403084d77472bb51bca7 EAP-Message = 0x9931b51bda9aa98affffd17d58055fef6e5e84b3371403010001011603010028ddea1f8780c6a9d3720778e46e560fd071eb9f9d57122dba9896f9ceb57a1b2a8362520d84d02749 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x7612d9dc287bd580845d59f08dcfbe34 Realm = "st-andrews.ac.uk" EAP-Type = EAP-TTLS Proxy-State = 0x313034 Wed Feb 13 14:03:48 2013 Packet-Type = Access-Request NAS-Port-Id = "AP86/1" Calling-Station-Id = "94-39-E5-B7-CB-51" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" Service-Type = Framed-User User-Name = "anonymous(a)st-andrews.ac.uk" NAS-Port = 25861 State = 0xe5a5ab65e6a0be1056566c4c9fd4c6e8 EAP-Message = 0x02050053150017030100480e445bd302a42efdfef640de32d514973a61346521acdd65dc5bc693613769788942c27a2d6094dbc6da60622adb4cdf5554289d9f25f984016a59b3644d7f26e6add7c54d1f707a NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Message-Authenticator = 0x7bd5e919aa147bf656ec791de2e403ad Realm = "st-andrews.ac.uk" EAP-Type = EAP-TTLS Proxy-State = 0x313035 Wed Feb 13 14:03:49 2013 Packet-Type = Accounting-Request Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Multi-Session-Id = "SESS-25861-54b752-760627-f3b" Acct-Session-Id = "SESS-25861-54b752-760627-f3b" User-Name = "anonymous(a)st-andrews.ac.uk" Event-Timestamp = "Feb 13 2013 14:03:49 CET" Trapeze-VLAN-Name = "EduExterieurs" Calling-Station-Id = "94-39-E5-B7-CB-51" NAS-Port-Id = "AP86/1" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" NAS-Port = 25861 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Acct-Delay-Time = 0 Acct-Unique-Session-Id = "b99f09261adf3886" Realm = "st-andrews.ac.uk" SQL-User-Name = "anonymous(a)st-andrews.ac.uk" Proxy-State = 0x313036 Wed Feb 13 14:03:49 2013 Packet-Type = Accounting-Request Acct-Status-Type = Interim-Update Acct-Authentic = RADIUS Acct-Multi-Session-Id = "SESS-25861-54b752-760627-f3b" Acct-Session-Id = "SESS-25861-54b752-760627-f3b" User-Name = "anonymous(a)st-andrews.ac.uk" Event-Timestamp = "Feb 13 2013 14:03:49 CET" Trapeze-VLAN-Name = "EduExterieurs" Calling-Station-Id = "94-39-E5-B7-CB-51" NAS-Port-Id = "AP86/1" Called-Station-Id = "00-0B-0E-D2-CD-40:eduroam" NAS-Port = 25861 Framed-IP-Address = 10.56.0.150 Acct-Session-Time = 0 Acct-Output-Octets = 6503 Acct-Input-Octets = 852 Acct-Output-Packets = 33 Acct-Input-Packets = 9 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.58.5 NAS-Identifier = "Trapeze" Acct-Delay-Time = 0 Acct-Unique-Session-Id = "b99f09261adf3886" Realm = "st-andrews.ac.uk" SQL-User-Name = "anonymous(a)st-andrews.ac.uk" Proxy-State = 0x313037 _post-proxy-detail-20130213_: Wed Feb 13 14:03:47 2013 Packet-Type = Access-Challenge EAP-Message = 0x010200061520 Message-Authenticator = 0x5597c09a77425ab825ec3249891e2190 State = 0xe5a5ab65e5a7be1056566c4c9fd4c6e8 Proxy-State = 0x313031 User-Name = "anonymous(a)st-andrews.ac.uk" Wed Feb 13 14:03:48 2013 Packet-Type = Access-Challenge EAP-Message = 0x0103040015c000000426160301002a020000260301511b8f3420e5713350ca0008fb4b0904145906a53e211cb61db1fd571414111800000a0016030103e90b0003e50003e20003df308203db308202c3a0030201020202108d300d06092a864886f70d01010505003081bb310b300906035504061302554b310d300b0603550408130446696665311330110603550407130a537420416e64726577733121301f060355040a1318556e6976657273697479206f6620537420416e647265777331163014060355040b130d492e542e205365727669636573312330210603550403131a4d6173746572205369676e696e6720436572746966696361746531 EAP-Message = 0x28302606092a864886f70d010901161968656c706465736b4073742d616e64726577732e61632e756b301e170d3130303431363134303331335a170d3135303431353134303331335a30818b310b300906035504061302554b310d300b0603550408130446696665311330110603550407130a537420416e64726577733121301f060355040a1318556e6976657273697479206f6620537420416e647265777331143012060355040b130b4954205365727669636573311f301d06035504031316646f7431782e73742d616e64726577732e61632e756b30820122300d06092a864886f70d01010105000382010f003082010a0282010100a42b67c8fe EAP-Message = 0xac898a6ff076b45546f0eadd4054160dab6ff22693f47ff8217e6203e5d73339911bdd652fcdd50bca222bb4f113bba43ca950352911846707d72d007d726db92bff563f146da81c890a1f9e046e3fe5369b755681c093080edbe34427968a577747e49c3306da3da721b3f431325f1da3f651c079f49fc3bca1d76b99ca49373a2b8083be24ec6751148d4406eae859b13e9486e40203b2e870a712b0eb5f461579a46076ad243717d1e8d666848a6026d6dd877a73f581077d02af0c6dc4e03f76645940a5e36ac51a96bc4d8d8758c4e4a3a8b0c82e23d2ca36c096891670743a6a294d0bfb75f85fef1f27c8f2f7b721a937d88a3af4da3bf10203 EAP-Message = 0x010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101003c2109c25dafc3dc5acd8145182e2aab462ff5e5d5fe33c159c890caf25919c18b94b6447f1994ea8360d24d7677befde5db7f288e9379e6193c58e39b76bd14e9460b84885d0f130ae7f0bbe0abf7b54fede8e1d0d76a000730adfe1ac92d5a40ade8367d687554e17ca07780edb8361dc477fe8523721600546eaf0fd6ed4616adc511f35408ce32bc908ac5caf30e09b01232201f86b1c837bcf731a6dfadf2384eaf80ee0aeb6607dabce2e94aabe0e3b9a15a779ca9e3b1bf58efccc4ce7f623169c047773b4c442e6849 EAP-Message = 0x4dc85a6e5d33d2bdb3247c15 Message-Authenticator = 0x65e248512615f7c513c0946bf35d2094 State = 0xe5a5ab65e4a6be1056566c4c9fd4c6e8 Proxy-State = 0x313032 User-Name = "anonymous(a)st-andrews.ac.uk" Wed Feb 13 14:03:48 2013 Packet-Type = Access-Challenge EAP-Message = 0x0104003a1580000004263f3dc8215cb0cd7c8e55b65d99c04451783bdf02bcec5dd8d2aae8f0b200d88a80c0dbbe5d61a016030100040e000000 Message-Authenticator = 0x622409db334bce79661140feed35eb90 State = 0xe5a5ab65e7a1be1056566c4c9fd4c6e8 Proxy-State = 0x313033 User-Name = "anonymous(a)st-andrews.ac.uk" Wed Feb 13 14:03:48 2013 Packet-Type = Access-Challenge EAP-Message = 0x0105003d1580000000331403010001011603010028bc24baaea5a666880bc51e50e5edd318c5984f5fbb499801b149ec4685d4804f164953085d88543f Message-Authenticator = 0x129341e8d29515e6b24d6f4687c8244b State = 0xe5a5ab65e6a0be1056566c4c9fd4c6e8 Proxy-State = 0x313034 User-Name = "anonymous(a)st-andrews.ac.uk" Wed Feb 13 14:03:48 2013 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0x4b2d91740191458acc38de7dcfb4828b37f1fb0e013090b33a84e049e99a85d0 MS-MPPE-Send-Key = 0xa35c6c8f0eabc237d0669b193b03fe04ab71c4491d5f230b2e759bd4b5b652e0 EAP-Message = 0x03050004 Message-Authenticator = 0x471f3cfb0d19035d3ea901137dcb7c57 User-Name = "anonymous(a)st-andrews.ac.uk" Proxy-State = 0x313035 Wed Feb 13 14:03:49 2013 Packet-Type = Accounting-Response Proxy-State = 0x313036 User-Name = "anonymous(a)st-andrews.ac.uk" Wed Feb 13 14:03:49 2013 Packet-Type = Accounting-Response Proxy-State = 0x313037 User-Name = "anonymous(a)st-andrews.ac.uk"

6 5