- Freeradius-Users - lists.freeradius.org

handling win domain name in username
by Crne We 27 Sep '12

27 Sep '12

Environmnet: Freeradius with PAP on Windows Username: domain\user1 password: ******* Looks like the Freeradius doesn't seem to like the windows domain name as part of username? Just plain username without a backslash works fine.

3 5

How to force users file parsing when returning proxied reply to add per-user AV-Pairs
by Gianni Costanzi 26 Sep '12

26 Sep '12

Hi, I've configured a freeradius server A (version 1.1.3) to proxy request for a specifix realm XYZ to another radius server B. Then, from the online docs, I understood that when A receives the reply from B it should go through its users file and if it finds a match it should add the specified AV-Pairs, like Service-Type (which is the one I need), to the reply it returns to the client that wants to authenticate a user: http://www.gnu.org/software/radius/manual/html_node/Proxy-Service.html#SEC16 Should it do this automatically or do I need to specify something in the realm definition? Second question: I've specified in the realm definition on radius A to remove the @XYZ suffix (strip) when it passes the request to radius B.. Then, when radius A looks into its own users file to append AV-Pairs to the answer, does it look for the stripped user or the user+realm? Thank you in advance for any help. PS: I know that this version may be old, but I can not easily update it at present time. -- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi(a)gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------

2 3

Reporting from logs
by Leal, Paulo 26 Sep '12

26 Sep '12

Hi guys, We are new to eduroam and we are using FreeRadius for authentication and connection to national proxies. Just wondering what kind of reporting you have managed to get out from the FreeRadius logs, we wanted some user friendly reports with user numbers, success and failed attempts, what realms were used and numbers, even possibly bandwidth consumed per user. Daily, weekly and monthly reports. Would be grateful to find out what everyone is using to achieve this and if someone has some sample reports would be great. Cheers Paulo Paulo Leal Senior Network Analyst Enterprise Technology Services City University London Tel: 020 7040 8186 Got an IT problem? - please visit: www.city.ac.uk/itservicedesk<http://www.city.ac.uk/itservicedesk>

5 9

segmentation fault eap2 in freeradius
by arnauld ndefo 26 Sep '12

26 Sep '12

Hi, I tried to recompile freeradius raising option O2 in CFLAGS. I followed the following steps: . / configure - with-experimental-modules - with-rlm_eap2 Make.inc edit and remove 'O2' in CFLAGS make clean make make install My server started without error (radiusd_out file) When my openpana client sent an authenticator mesage ,I had a segmentation fault, and I always value optimized out in the gdb trace (gdb-radiuslog1). I don't understand why the different librairies related to the rlm_eap2 module in /usr/local/lib are not up to date when i rebuild the servers. The date still stay the old one. rwxr-xr-x 1 root root 44318 2012-09-18 04:31 rlm_eap2-2.2.0.so lrwxrwxrwx 1 root root 17 2012-09-18 04:31 rlm_eap2.so -> rlm_eap2-2.2.0.so -rwxr-xr-x 1 root root 872 2012-09-18 04:31 rlm_eap2.la -rw-r--r-- 1 root root 45698 2012-09-18 04:31 rlm_eap2.a lrwxrwxrwx 1 root root 11 2012-09-18 04:31 rlm_eap2-2.2.0.la -> rlm_eap2.la How can i resolve this issue? Thanks. PS: Freeradius commit 02567cf3c5aa758d7153c0bd7020e27a5067f7c3 Author: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Date: Tue Sep 18 14:15:14 2012 +0100

3 2

Dynamic realm+home_server_pool from LDAP/SQL
by Wilco Baan Hofman 25 Sep '12

25 Sep '12

Hi, I'm looking through the code and documentation of freeradius now to see if it is possible to use freeradius with a backend database for realms. For clients this can be fixed with dynamic clients and overwriting attributes.. but for realms this does not seem possible. Did I miss something? I'm looking to implement this if it's not there, in what way can I do this where my patches would be accepted (assuming clean code obviously)? Regards, Wilco Baan Hofman

3 4

pam_radius requires setting Auth-Type ?
by NdK 24 Sep '12

24 Sep '12

Hello all. We just added pam_radius to our vpn host, to authenticate vpn users throught our (working) RADIUS server. IIUC pam_radius is sending a PAP message: Access-Request packet from host 192.168.130.61 port 9327, id=233, length=99 User-Name = "STUDENTI\\studente.fittizio" User-Password = "my-cleartext-password" NAS-IP-Address = 130.136.152.6 NAS-Identifier = "openvpn" NAS-Port = 8302 NAS-Port-Type = Virtual Service-Type = Authenticate-Only But if I don't add (in users file) a line like: DEFAULT NAS-Identifier == "openvpn", Auth-Type := PAP FR complains: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user IIUC, Auth-Type should never be set manually, so I'm quite sure I'm missing something... Could you please point me in the right direction? Tks. BYtE, Diego.

4 8

Re: adding operator-name to play nice with eduroam
by Alan Buxey 24 Sep '12

24 Sep '12

....and if you are performing attribute filtering on inbound/outbound proxied requests (as you should be...its best practice) then you need to add Operator-Name to the relevant 'attrs' files for post-proxy and pre-proxy Alan eduroam UK -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

adding operator-name to play nice with eduroam
by Brian Gold 24 Sep '12

24 Sep '12

Hi all, We've been up and running with Eduroam for a few months now without any major issues. It was just pointed out to me that we should be sending operator-name along with our proxy requests for better logging and easier troubleshooting if we do experience problems down the line. I believe I've got things set up now to send our operator-name along with the proxied requests by adding the following to our pre-proxy section in sites-enabled/inner-tunnel update proxy-request { Operator-Name := "1simons-rock.edu" } But I would also like to be capturing operator-name on incoming proxy requests. I can't seem to find any documentation as to where I would configure this though. Any suggestions? Brian Gold System Administrator Bard College at Simon's Rock

3 3

Errors while executing 'freeradius -X' command
by Madhu Sudhana Rao 24 Sep '12

24 Sep '12

Hi, I installed freeradius on my ubuntu linux system. I copied my key/certificates to the the location /etc/freeradius/madhu_certs and configured eap.conf accordingly. When I ran freeradius -X command it is giving the errors. Attached my outputs to this mail for reference. Can any one help me please? -- Thanks & Regards... Madhu

4 6

"retry_count" and "retry_delay" configuration in "proxy.conf"
by Arka Sharma 24 Sep '12

24 Sep '12

Hi, I am using freeradius-2.1.11 and I have a requirement like I am a proxy free radius server which communicate to a remote PPS with PPAC and PPAQ. Now my question is that how can I identify that it responded back successfully or not.I mean I have a condition like if it doesn't respond back then I have to perform some task in the code.Now I have written the comments for "zombie_period","response_ window" etc in "proxy.conf" file.My observation for radius debug log is that it sends 3 proxy request within 5 min interval before marking the remote server as dead.Actually I have configured an unreachable ip in proxy.conf.Now I was doing hit and trial by changing the parameter values but no such changes I found in radius debug log.I have old style realm configuration in proxy.conf that is "accthost = <ip> authhost = <ip>" in realm element.I tried with different values of retry_count and retry_delay both in "proxy server " element and "realm" element.And my observation is apart from the value 1 in "retry_count" all other configuration works same way sends 3 proxy request in 5 min interval then mark the proxy server as dead.Any help will be highly appreciated. Thanks and Regards, Arka

2 2