- Freeradius-Users - lists.freeradius.org

None
by Agent Smith 30 Jan '13

30 Jan '13

http://www.meridamaster.es/components/com_content/contrl.php?c94720h0=3vzsow Agent Smith

1 0

output attributes in free-radius
by Lakshmi Narayana Baliah 30 Jan '13

30 Jan '13

Hi All, How can i define output attributes in free-radius? Any help would be appreciated. Thanks Lakshmi ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

test
by bino＠indoakses-online.com 30 Jan '13

30 Jan '13

My Apologize for this email. I made confirmation days ago but not sure if I can send email to this group Sincerely -bino-

1 0

Throttling of disconnect messages going out from RADIUS server
by ramakrishna 29 Jan '13

29 Jan '13

Hi, I am using FreeRadius 2.2 and I came across a requirement where the Disconnect Requests going out from RADIUS server towards RADIUS Client should be limited to some maximum number n requests per second? Can this be achievable through some configuration in FreeRadius stack or any other way provided by stack? Thanks, -- Best Regards, M.Rama Krishna Prasad,

2 1

rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs
by Glassman, Stephen 29 Jan '13

29 Jan '13

I know this has been talked about before but I cannot find information that is helping me. I have read the sites/manuals about freeradius but must be missing something, probably simple. I am trying to use freeradius for MAC authentication and see in the logs that the MAC address is coming through as the "calling-station-id" but it's not matching up on the checkval portion of things and I am not sure why. Here are the 2 entries that make me believe the data is coming through correctly: rlm_checkval: Item Name: Calling-Station-Id, Value: 00-26-bb-11-b9-9c rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs but it's not finding the attribute. I wasn't sure if I need to edit the attributes and if so, how do I determine what to put and where do I put it? My other idea was this-is there a way to watch what the radius returns in terms of attributes....I am hoping there is just a definition or something somewhere that I need to change for the calling-station-id. Any help would be greatly appreciated! Steve

1 0

Re: Freeradius-Users Digest, Vol 93, Issue 78
by Tzvika Gelber 28 Jan '13

28 Jan '13

My version of 2.1.10 was the one i got when i did the ever so popular sudo apt-get install freeradius, so i guess i need for my distro to get the update in the source files - that's ok as my Freeradius is not connected to the internet. Thank you all for the response. On Mon, Jan 28, 2013 at 11:40 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. move /etc/raddb/users file to mysql (Stefan K?nig) > 2. Re: dialup.conf custom attributes failure in freeradius 2.2 > (A.L.M.Buxey(a)lboro.ac.uk) > 3. Re: upgrading freeradius (Mathieu Simon) > 4. Re: Help Needed !!! FreeRADIUS Integration with MS AD (Pradyumna) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 28 Jan 2013 09:25:00 +0100 > From: Stefan K?nig <montiburns(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: move /etc/raddb/users file to mysql > Message-ID: <510635DC.2080103(a)gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello List, > > I inherited an old freeradius 1.1.8 system which is configured to use a > mysql DB. > So far so good, but now I discovered, that someone also created a > /etc/raddb/users file with some DEFAULT information in it. > The funny thing is, that I have also some DEFAULT information in my DB > in radgroupreply, which is where I think the data from the "users" file > belongs. > As far as I see in our config, the flat files have precedence over SQL. > > I am not very deep into freeradius, so I have some questions which I > hope someone can answer: > > 1) Does the data from the "users" file go into radgroupreply table? > 2) I have a DEFAULT groupname in the DB and in the flat file, will I > have to rename the flat file DEFAULT groupname to something else to > avoid problems? > 3) "op" needs to be "=~" and ":=" for the first to settings and "==" for > all the following? > > For your reference here is the anonymized content of my users file: > > DEFAULT User-Name =~"@example\.net$", > Auth-Type := "Accept" > Context-Name == local, > Tunnel-Domain == 1, > Tunnel-Type == L2TP, > Tunnel-Medium-Type == IP, > Tunnel-Client-Endpoint == xxx.xxx.xxx.xxx, > Tunnel-Server-Endpoint == yyy.xxx.xxx.xxx, > Tunnel-Password == password, > Tunnel-Assignment-Id == zzz.xxx.xxx.xxx, > Tunnel-Function == 1, > Tunnel-Local-Name == EXAMPLE.NET > > > Thanks for any help or hints! > > > regards > Stefan > > > ------------------------------ > > Message: 2 > Date: Mon, 28 Jan 2013 09:03:32 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: dialup.conf custom attributes failure in freeradius 2.2 > Message-ID: <20130128090332.GF28146(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > Hi, I need some help with inserting custom attributes to MySQL > server. It > > seems that version 2.2 broke it, at least on my server... When I > revert > > back to 2.1 it immediately starts to work with same config files. > > Below are config files and traces for both versions. > > > > Any idea? > > yes, you dont seem to have 3GPP-IMSI in your dictionary file. thus the > string > expansion fails as per > > > > [sql] WARNING: Unknown module "3GPP-IMSI" in string expansion "%', > > > thats my first guess anyway! ;-) > > alan > > > ------------------------------ > > Message: 3 > Date: Mon, 28 Jan 2013 10:12:21 +0100 > From: Mathieu Simon <mathieu.sim(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: upgrading freeradius > Message-ID: <510640F5.6000009(a)gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Am 27.01.2013 21:52, schrieb A.L.M.Buxey(a)lboro.ac.uk: > > Hi, > > > >> 2.1.10 is the version delivered by your distribution - and contains > >> backported security bugfixes released until 2.2.0. In terms of security, > >> your version is fine. > > why? why do that? why not simple release 2.2.0 - you are CONFUSING your > users > > and CONFUSING those people who support them. > > > > if it says 2.1.10 then one can only ASSUME that its 2.1.10 > Yes, somewhat true, but that's how a couple of distribution consider > 'stable' releases: > Stick with a version of a software and backport (bug and) security > updates to this version. > (and only update the version of a package at new distro release) > > Enterprise distributions or commercial unix often do much heavier > backporting than > what Debian/Ubuntu do, just to deliver the very same version during the > period of time > the package is bundled with a release of their distro/software. > > You have to outweight the advantages vs. disadvantages like breaking > support from > your distributor, in this case Canonical. But I agree that asking on > this list is likely yield > the answer "upgrade first" in case of problems. > > A Ubuntu PPA can be a very good thing - but you have to trust a third > party. > That said, I really like PPAs when the packagers do good work and care > about > updating the packages - thanks Fajar for maintaining this repository! > > -- Mathieu > > > ------------------------------ > > Message: 4 > Date: Mon, 28 Jan 2013 15:10:14 +0530 > From: Pradyumna <neomatrixgem(a)gmail.com> > To: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Help Needed !!! FreeRADIUS Integration with MS AD > Message-ID: <E751B5FB-B309-402E-8C4E-6D77FE3958AB(a)gmail.com> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > Am not able to see my authorization happening because I don't see the > value-attr or reply message. Please help. Logs attached. > rad_recv: Access-Request packet from host 192.168.0.2 port 39662, id=92, > length=62 > User-Name = "radiustest" > User-Password = "password@123" > NAS-IP-Address = 192.168.0.2 > NAS-Port = 1812 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > [auth_log] expand: > /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> > /var/log/radius/radacct/192.168.0.2/auth-detail-20130128 > [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > expands to /var/log/radius/radacct/192.168.0.2/auth-detail-20130128 > [auth_log] expand: %t -> Mon Jan 28 10:12:16 2013 > ++[auth_log] returns ok > [ldap] performing user authorization for radiustest > [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" > for details > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> radiustest > [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> > (&(sAMAccountName=radiustest)) > [ldap] expand: cn=users,dc=example,dc=com -> cn=users,dc=example,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in cn=users,dc=example,dc=com, with filter > (&(sAMAccountName=radiustest)) > [ldap] looking for check items in directory... > [ldap] looking for reply items in directory... > WARNING: No "known good" password was found in LDAP. Are you sure that > the user is configured correctly? > [ldap] Setting Auth-Type = ldap > [ldap] user radiustest authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[digest] returns noop > [suffix] No '@' in User-Name = "radiustest", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [ldap] performing user authorization for radiustest > [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" > for details > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> radiustest > [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> > (&(sAMAccountName=radiustest)) > [ldap] expand: cn=users,dc=example,dc=com -> cn=users,dc=example,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in cn=users,dc=example,dc=com, with filter > (&(sAMAccountName=radiustest)) > [ldap] looking for check items in directory... > [ldap] looking for reply items in directory... > WARNING: No "known good" password was found in LDAP. Are you sure that > the user is configured correctly? > [ldap] user radiustest authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > Found Auth-Type = ldap > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group LDAP {...} > [ldap] login attempt by "radiustest" with password "password@123" > [ldap] user DN: CN=radiustest,CN=Users,DC=example,DC=com > [ldap] (re)connect to 192.168.0.3:389, authentication 1 > [ldap] bind as CN=radiustest,CN=Users,DC=example,DC=com/password@123 to > 192.168.0.3:389 > [ldap] waiting for bind result ... > [ldap] Bind was successful > [ldap] user radiustest authenticated succesfully > ++[ldap] returns ok > # Executing section post-auth from file /etc/raddb/sites-enabled/default > +- entering group post-auth {...} > ++[exec] returns noop > Sending Access-Accept of id 92 to 192.168.0.2 port 39662 > Finished request 2. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 2 ID 92 with timestamp +88 > Ready to process requests. > > Regards, > /Neo > Sent from my iPhone > > On 25-Jan-2013, at 3:32 AM, A.L.M.Buxey(a)lboro.ac.uk wrote: > > > Hi, > > > >> Do you mean the below in the "users" file? > >> > >> cisco Auth-Type := LDAP > >> > >> Service-Type = Administrative-User, > >> cisco-avpair = "shell:priv-lvl=15" > > > > no. > > > > cisco Auth-Type := LDAP > > Service-Type = Administrative-User, > > cisco-avpair = "shell:priv-lvl=15" > > > > > > (see all the examples in the users file) > > > > alan >

1 0

dialup.conf custom attributes failure in freeradius 2.2
by Miha Petkovsek 28 Jan '13

28 Jan '13

Hi, I need some help with inserting custom attributes to MySQL server. It seems that version 2.2 broke it, at least on my server… When I revert back to 2.1 it immediately starts to work with same config files. Below are config files and traces for both versions. Any idea? thanks, brm ---------------------- Relevant part of dialup.conf (modified to include custom attributes): accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ imsi, imei, ms_timezone, \ rat_type, user_location_info, realm, \ nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{3GPP-IMSI}', '%{3GGP-IMEISV}', '%{3GPP-MS-TimeZone}', \ '%{3GPP-RAT-type}', '%{3GPP-User-Location-Info}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0')" Slightly modified dictionary.3gpp file to include custom attributes: # new attributes ATTRIBUTE 3GGP-IMEISV 20 string ATTRIBUTE 3GPP-RAT-type 21 byte ATTRIBUTE 3GPP-User-Location-Info 22 octets ATTRIBUTE 3GPP-MS-TimeZone 23 integer has_tag # set RAT-TYPE VALUE 3GPP-RAT-Type Reserved 0 VALUE 3GPP-RAT-Type UTRAN 1 VALUE 3GPP-RAT-Type GERAN 2 VALUE 3GPP-RAT-Type WLAN 3 VALUE 3GPP-RAT-Type GAN 4 VALUE 3GPP-RAT-Type HSPA-Evolution 5 VALUE 3GPP-RAT-Type IEEE-802-16e 101 VALUE 3GPP-RAT-Type 3GPP2-eHRPD 102 VALUE 3GPP-RAT-Type 3GPP2-HRPD 103 VALUE 3GPP-RAT-Type 3GPP2-1xRTT 104 VALUE 3GPP-RAT-Type 3GPP-EPS 105 This is the accounting start record from debug mode: rad_recv: Accounting-Request packet from host xxxxxxxx port 54002, id=50, length=375 Acct-Status-Type = Start Event-Timestamp = "Jan 26 2013 18:20:08 CET" Framed-IP-Address = xxxxxxx Called-Station-Id = "xxxxxx" Calling-Station-Id = "xxxxxxx" NAS-IP-Address = xxxxxxx NAS-Identifier = "xxxxxxx" Service-Type = Framed-User NAS-Port-Type = Virtual Acct-Session-Id = "5BB9DD25a7846fd9" 3GPP-IMSI = "xxxxxxx" 3GPP-IMSI-MCC-MNC = "xxxxxxx" 3GPP-NSAPI = "5" 3GGP-IMEISV = "xxxxxxx" 3GPP-RAT-type = UTRAN 3GPP-User-Location-Info = 0x0192f307000a79be 3GPP-Charging-ID = 2810474457 3GPP-PDP-Type = IP 3GPP-Selection-Mode = "0" Error on version 2.2: ... +- entering group accounting {...} [sql] expand: %{Calling-Station-Id} -> xxxxxxxx [sql] sql_set_user escaped user --> 'xxxxxxxxx' [sql] WARNING: Unknown module "3GPP-IMSI" in string expansion "%', '%{3GGP-IMEISV}', '%{3GPP-MS-TimeZone}', '%{3GPP-RAT-type}', '%{3GPP-User-Location-Info}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0')" [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 24 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, imsi, imei, ms_timezone, rat_type, user_location_info, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('5BB9DD25a7846393', 'b158b29df3a9d9e4', 'xxxxxxxxx', ' rlm_sql_mysql: MYSQL check_error: 1064 received [sql] Couldn't insert SQL accounting START record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1 Success on version 2.1: … +- entering group accounting {...} [sql] expand: %{Calling-Station-Id} -> XXXXXXXXXXX [sql] sql_set_user escaped user --> 'XXXXXXXXXXX' [sql] expand: %{Acct-Delay-Time} -> [sql] ... expanding second conditional [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, imsi, imei, ms_timezone, rat_type, user_location_info, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{3GPP-IMSI}', '%{3GGP-IMEISV}', '%{3GPP-MS-TimeZone}', '%{3GPP-RAT-type}', '%{3GPP-User-Location-Info}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NU [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 24 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, imsi, imei, ms_timezone, rat_type, user_location_info, sgsnipaddress, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('5BB9DD25a7846fd9', '03de33c93bd3a02b', 'XXXXXXXXXXX', 'XXXXXXXXXXX', 'XXXXXXXXXXX', '0x04fc', 'UTRAN', '0x0192f307000a79be', '', 'XXXXXXXXXXX', '', 'Virtual', '2013-01-26 18:20:06', NULL, '0', '', '', '', '0', '0', 'XXXXXXXXXXX', 'XXXXXXXXXXX', '', 'Framed-User', 'GPRS-PDP-Context', 'XXXXXXXXXXX', '0', '0') rlm_sql (sql): Released sql socket id: 24 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> ++[attr_filter.accounting_response] returns noop Sending Accounting-Response of id 50 to XXXXXXXXXXX port 54002 Finished request 0.

4 6

move /etc/raddb/users file to mysql
by Stefan König 28 Jan '13

28 Jan '13

Hello List, I inherited an old freeradius 1.1.8 system which is configured to use a mysql DB. So far so good, but now I discovered, that someone also created a /etc/raddb/users file with some DEFAULT information in it. The funny thing is, that I have also some DEFAULT information in my DB in radgroupreply, which is where I think the data from the "users" file belongs. As far as I see in our config, the flat files have precedence over SQL. I am not very deep into freeradius, so I have some questions which I hope someone can answer: 1) Does the data from the "users" file go into radgroupreply table? 2) I have a DEFAULT groupname in the DB and in the flat file, will I have to rename the flat file DEFAULT groupname to something else to avoid problems? 3) "op" needs to be "=~" and ":=" for the first to settings and "==" for all the following? For your reference here is the anonymized content of my users file: DEFAULT User-Name =~"@example\.net$", Auth-Type := "Accept" Context-Name == local, Tunnel-Domain == 1, Tunnel-Type == L2TP, Tunnel-Medium-Type == IP, Tunnel-Client-Endpoint == xxx.xxx.xxx.xxx, Tunnel-Server-Endpoint == yyy.xxx.xxx.xxx, Tunnel-Password == password, Tunnel-Assignment-Id == zzz.xxx.xxx.xxx, Tunnel-Function == 1, Tunnel-Local-Name == EXAMPLE.NET Thanks for any help or hints! regards Stefan

2 1

Thoughts on a FreeRadius setup with OpenLDAP and Kerberos serving Windows and Ubuntu Clients
by Nicola Volpini 28 Jan '13

28 Jan '13

Hi everyone, I've been assigned the exciting task to setup a wired 802.1x environment to manage the access to our office infrastructure. I'm currently gathering all the possible informations to plan and deploy the solution since it's the first time I approach 802.1x and FreeRadius. I'm reading Freeradius beginner's guide by Dirk Van Der Walt and experimenting a bit with a freshly installed Ubuntu 12.04 freeradius server. Since I'm still in the planning phase I'd like to correctly understand which possibilities I have to deploy this of setup according to the needs of my company. This would be the list of requirements, my thoughts will follow: 1. user authentication and authorisation against our OpenLDAP directory, which is currently setup to store passwords with a SASL mechanism (the pass is hashed, and Apache Directory Studio shows the value of the UserPassword attribute of each user as "SASL hashed password". This note is important, see further on) 2. Switchport dynamic VLAN assignment on the Cisco Catalyst switches depending on the gidNumber of the user 3. Multiplatform support (Windows 7, Ubuntu 10.04, Ubuntu 12.04) 4. FreeRadius server certificate validation (no client certificates used) and 802.1x authentication by providing user/pass My concerns and thoughts, point by point: 1. From what I had the opportunity to read in the FreeRadius configuration files, using LDAP as a password store is not possible when having hashed passwords. Yet, when I test the password validation via radtest the software succeeds and gives me an accept-accept. Intentionally mistyping the pass gives a reject. What am I doing wrong? Is the radtest tool using some other mechanism then MSCHAPv2? 2. this appears to be fairly easy to achieve by configuring the users file with one line per LDAP group like "DEFAULT LdapGroup == xxx" to return the "Tunnel-private-group-ID [81]" VDA depending on the match... or maybe in some other place of the config via ulang? I still need to understand how it works 3. and 4. Both of these points, together with our infrastructure not being ready yet for client certificates validation, led me to the conclusion that PEAPv0/EAP-MSCHAPv2 could be the way to go... but point 1 would invalidate this assumption. Is my reasoning correct? I'm still at a very early stage of the planning and a bit confused. Thanks for your help! Nicola -- Nicola Volpini The information in this email is confidential and may be legally privileged. If you are not the intended recipient, you must not read, use or disseminate that information and upon reception, permanently delete the original and destroy any copies. Although this email and any attachments are believed to be free of any virus or any other defect which might affect any computer or IT system into which they are received and opened, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by Kambi for any loss or damage arising in any way from receipt or use thereof.

2 2

mac address format
by François Dagorn 28 Jan '13

28 Jan '13

Hello all, I'm running FreeRADIUS Version 2.1.5 (installed in 2009) configured to use Mac auth. Runs well indeed, but a brand new Cisco wireless controler is a bit disturbing i.e. Calling-Station mac address is not as usual. Following is my mac-authorized file : 062f68c7dcc2 Auth-type := Accept, User-Password == "062f68c7dcc2" ..... but now the stations controlled by the new Cisco appears as follows 06:2f:68:c7:dc:c2 So my first idea was to duplicate entries in the authorized file included within my conf, unfortunantely it does not run. So, is there a simple way to force radiusd to accept different mac address format ? Sorry if this is a FAQ, of course I've not changed anything within my conf since 2009 ! Any help would be appreciated. Cheers! -- François Dagorn Universite de Rennes France

4 3