- Freeradius-Users - lists.freeradius.org

Enforcing use of Eap-TLS or PEAP
by kjonca＠o2.pl 24 Dec '12

24 Dec '12

I try to set up radius authentication in my WiFi network. I want to have: 1. one user (samsung phone) should be authenticated with PEAP 2. others should be authenticated with EAP-TLS. Naive approach is to use Auth-Type but its treated as "misuse" at http://deployingradius.com/documents/configuration/auth_type.html But example is only for ms-chap, and I don't know which attribute(?) use to force PEAP /EAP-TLS Any help? Am I missing something? KJ -- http://blogdebart.pl/2009/12/22/mamy-chorych-dzieci/ QOTD: "It's been real and it's been fun, but it hasn't been real fun."

2 1

Re:Re: Is there a way to renew pptp user information of a user connected mikrotik?
by 조명산 24 Dec '12

24 Dec '12

2 1

Is there a way to renew pptp user information of a user connected mikrotik?
by 조명산 24 Dec '12

24 Dec '12

2 1

Where To Replace '%S' with '${sqlmod-inst}'
by Prabhpal S. Mavi 23 Dec '12

23 Dec '12

Hi FreeRadius List, After installing configuring the server. Almost everything worked just fine. Version: freeradius-2.1.12-4.el6_3.x86_64 radiusd -X 1.) WARNING: Please replace '%{%k}' with '${key}' 2.) WARNING: Please replace '%S' with '${sqlmod-inst}' Replaced '%{%k}' with '${key}'AND No-1 Warning Gone Away. But there is no %S in the query or in entire counter.conf.' i have also checked related files did not find %S anywhere. 1.) "/etc/raddb/radiusd.conf" 2.) "/etc/raddb/clients.conf" 3.) "/etc/raddb/sql.conf 4.) "/etc/raddb/dictionary" 5.) "/etc/raddb/modules/counter" 6.) "/etc/raddb/sql/mysql/counter.conf" 7.) "/etc/raddb/sites-available/default" Should i ignore the warning? i am sure that someone would have come across this warning. Is any one know the solution? i am not enough to reach to the root. Please help guys, i need your help. Thanks / Thanks / Thanks

1 0

WARNING: Please replace '%S' with '${sqlmod-inst}'
by Prabhpal S. Mavi 22 Dec '12

22 Dec '12

Hi List what does this means? i do not see any %S in query. WARNING: Please replace '%S' with '${sqlmod-inst}' rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime) FROM radacct WHERE username='User-Name' AND acctstarttime > FROM_UNIXTIME('0')' [noresetcounter] expand: SELECT SUM(acctsessiontime) FROM radacct WHERE username='User-Name' AND acctstarttime > FROM_UNIXTIME('0') -> SELECT SUM(acctsessiontime) FROM radacct WHERE username='User-Name' AND acctstarttime > FROM_UNIXTIME('0') WARNING: Please replace '%S' with '${sqlmod-inst}' Thanks

2 1

Re: Issue with Kerberos
by Alan Buxey 21 Dec '12

21 Dec '12

You can sort out the host key file if you want. PAP gives a warning because it hasnt been given a plain text password to test/verify....that's okay as you don't need it...and it does tell you things MAY fail. Alan

1 0

session attribute Freeradius freeradius-utils-2.1.12
by Prabhpal S. Mavi 21 Dec '12

21 Dec '12

Greetings, can someone assist me to know how to identify that if my freeradiud is including session time-out attribute in reply from "radius -X". if i execute "radius -X" i get the following related to session time-out, 1.) INTERVAL (%{%{Acct-Session-Time}:-0} 2.) %{Acct-Session-Time}', does this mean it includes the attribute. if i am sure i can focus in NAS side because session time-out is not working with me. i am bit confuse where is the problem. thanks for attending it. freeradius-2.1.12-4.el6_3.x86_64 freeradius-utils-2.1.12-4.el6_3.x86_64 Regards

2 1

Re: freeradius query on password encryption and decryption
by Alan Buxey 21 Dec '12

21 Dec '12

Yes. All clients will have a place where the shared secret is configured EVEN if the target is the locahost (that doesn't change the spec!) Check the seagull docs and XML profile Alan

1 0

Need Help - Problem Working With Session Time Out
by Prabhpal S. Mavi 21 Dec '12

21 Dec '12

Hi Dear List Members, Radius do not send session timeout attribute in result user do not log off after time expired. Can anyone help please? what i have done. enabled cunters.sql in "radius.conf & sql.sonf" my counters. sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" } radiusd -X INTERVAL (%{%{Acct-Session-Time}:-0} Thanks

1 0

Sub-TLVs how to have the same kind of descriptor twice
by Sven Tantau 21 Dec '12

21 Dec '12

Hello, I am running version 3.0.0 and have a question about sub-tlvs: I am looking at: WiMAX-QoS-Descriptor as it is defined in dictionary.wimax.alvarion (the standard dictionary.wimax does not get included/is commented out) This is the situation: My reply has to contain two QoS profiles. testingstuff(a)internet.ao Cleartext-Password := "sven" Alvarion-R3-IF-Name+=cpe_mgnt_sg, Alvarion-PDFID+=1, WiMAX-Packet-Data-Flow-Id+=1, WiMAX-Direction+=3, WiMAX-Transport-Type+=1, WiMAX-Uplink-QOS-Id+=2, WiMAX-Downlink-QOS-Id+=3, WiMAX-ClassifierID+=1, WiMAX-Classifier-Priority+=2, WiMAX-Classifier-Direction+=3, WiMAX-IP-TOS-DSCP-Range-and-Mask+=0x1818FF, WiMAX-QoS-Id+=2, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000, WiMAX-QoS-Id+=3, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000 I checked the debug output and could see this: Alvarion-R3-IF-Name += "cpe_mgnt_sg" 01 0d 63 70 65 5f 6d 67 6e 74 5f 73 67 ..(skipped some attributes).. WiMAX-Uplink-QOS-Id += 2 07 03 02 WiMAX-Downlink-QOS-Id += 3 08 03 03 WiMAX-ClassifierID += 1 01 03 01 WiMAX-Classifier-Priority += 2 02 03 02 WiMAX-Classifier-Direction += Bi-Directional 04 03 03 WiMAX-IP-TOS-DSCP-Range-and-Mask += 0x1818ff 07 05 18 18 ff WiMAX-Classifier = ... 0b 10 01 03 01 02 03 02 04 03 03 07 05 18 18 ff WiMAX-Packet-Flow-Descriptor = ... 1a 29 000060b5 (24757) 1c 23 00 01 04 00 01 04 03 03 06 03 01 07 03 02 08 03 03 0b 10 01 03 01 02 03 02 04 03 03 07 05 18 18 ff WiMAX-QoS-Id += 2 01 03 02 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Id += 3 01 03 03 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Descriptor = ... 1a 27 000060b5 (24757) 1d 21 00 01 03 02 04 03 02 05 03 01 06 06 00 01 f4 00 01 03 03 04 03 02 05 03 01 06 06 00 01 f4 00 You can see that the 2 QoS profiles are both contained in the created WiMAX-QoS-Descriptor. What I need is to have two WiMAX-QoS-Descriptors. One for each QoS definition. I can archive that by putting another attribute between the QoS attributes: xnewstuff(a)internet.ao Cleartext-Password := "sven" Alvarion-R3-IF-Name+=cpe_mgnt_sg, ...(skipped some attributes)... WiMAX-QoS-Id+=2, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000, added-> Acct-Interim-Interval+=60, WiMAX-QoS-Id+=3, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000 The debug output now looks like this: (and is pretty close to what I expect) Alvarion-R3-IF-Name += "cpe_mgnt_sg" 01 0d 63 70 65 5f 6d 67 6e 74 5f 73 67 ...(some attributes skipped).... WiMAX-QoS-Id += 2 01 03 02 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Descriptor = ... 1a 18 000060b5 (24757) 1d 12 00 01 03 02 04 03 02 05 03 01 06 06 00 01 f4 00 Acct-Interim-Interval += 60 55 06 00 00 00 3c WiMAX-QoS-Id += 3 01 03 03 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Descriptor = ... 1a 18 000060b5 (24757) 1d 12 00 01 03 03 04 03 02 05 03 01 06 06 00 01 f4 00 Somehow the freeradius now sees that the first QoS flow is finished and creates the WiMAX-QoS-Descriptor out of the values. Then it puts in the newly introduced value (Acct-Interim-Interval+=60). And at the end it created the second WiMAX-QoS-Descriptor out of the definition for the second QoS flow. In case it is not clear: I would like to have the two QoS flows to create two WiMAX-QoS-Descriptors, instead of one that combines the two. How does freeradius know when a 'sub-TLV' definition is finished? What am I missing? I hope that this request is somehow understandable. Please let me know in case you need further clarification or if you want me to include more information or debug output. Thanks for your good work. Best regards, Sven -- Internet Technologies Angola / Systems Department Tel: +244 (227) 286 000 / (924) 770 290 / (924) 770 291 Skype: internet-technologies-angola Mobile: +244 931 696413 Mail: sven(a)internet.ao

3 6