- Freeradius-Users - lists.freeradius.org

brief window of opportunity to log in via windows
by Brian Gold 28 Aug '12

28 Aug '12

Hi all, I've got freeradius 2.1.10 running PEAP/MS-CHAP. Everything seems to be working fine, but we've noticed a bit of an issue with our Windows clients. It seems that after selecting our SSID for the first time, they are prompted for their username & password. Once those are entered they get a prompt to accept our certificate and then they are in. It seems though that they must enter their username & password fairly quickly. If they don't enter them within about 30 seconds, the connection times out and they have to start over again. Is there something on the radius end of things that I can do to adjust this timeout? Brian Gold System Administrator Bard College at Simon's Rock

2 1

Postpaid configuration for all
by Murat K 28 Aug '12

28 Aug '12

> Dear All, > > I have all my users postpaid. How can I configure freeradius that all of them are postpaid? I heard there is a centralbase parameter that should be postpaid but I could not find how to do it. > > Best regards, > Murat > > "May the Force be with you." > Han Solo (Star Wars)

3 5

Users on the multiple APs
by Dagia Dorjsuren 28 Aug '12

28 Aug '12

Hello, Does anyone know that how to configure the wifi chillispot users by each NAS? For example : There are "testuser" wifi chillispot user and three Wifi zones which are AP1, AP2 and AP3. That AP{1-2} are nas-identifier. AP1 has 10.10.10.1, AP2 has 10.10.10.2 and AP3 has 10.10.10.3 ip address. That "testuser" must be available for AP1 and AP2 wifi zones. But, that user must be unavailable for AP3 wifi zone. How will do it?

3 5

Reg: GGSN support NAS and Freeradius.
by Malla Reddy Sama 27 Aug '12

27 Aug '12

Dear, I need clearification on freeradius and NAS (Coovachilli) with GGSN. It is possible to connect the NAS and FR to GGSN, NAS contact the FR through GGSN and NAS in between the internet and GGSN. I have some doubt especially on whether GGSN supports Coovachilli or not..? Please clearifiy my doubt .. Thanks & Best Regards, Malla.

1 0

Re: Radius "MONITOR" option
by Alan Buxey 25 Aug '12

25 Aug '12

Ask them when they are going to implement status-server Alan

1 0

Radius "MONITOR" option
by Ethan Whitt 25 Aug '12

25 Aug '12

Hello, I am being asked by my server load balancing vendor to send a "MONITOR" health-check, which should respond with "MONITOR" back. Does anyone know if Free Radius supports this option/ability? Regards, Ethan

4 5

redundant load balancing and mschap
by McNutt, Justin M. 25 Aug '12

25 Aug '12

Grrr... This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one listed in /etc/samba/smb.conf (which may be a coincidence). I set up several mschap instances like so: mschap mschap1 { ... ntlm_auth -s /etc/samba/radius.smb1.conf } mschap mschap2 { ... ntlm_auth -s /etc/samba/radius.smb2.conf } mschap mschap3 { ... ntlm_auth -s /etc/samba/radius.smb3.conf } I also disabled all PAP, CHAP, and references to "mschap" in all virtual servers listed in sites-enabled. There is currently no "mschap { ... }" section in modules/mschap. Added this to sites-enabled/campus-inner-tunnel where "mschap" was before: redundant-load-balance { mschap1 mschap2 mschap3 } Authentication *works*, but all authentications go to the same DC (the one specified in "mschap2"). Running "radiusd -X" shows that all mschap1/2/3 instances are being called, and no authentication *attempts* are being sent to the other two domain controllers. (1 and 3 aren't failing. They just aren't *tried*.) Am I going about this all the wrong way? Is this a known limitation in Samba? Is there something about ntlm_auth that always references /etc/samba/smb.conf, regardless of the -s option? Comments and criticisms welcome. --J

4 7

Re: non-blocking radius client
by Alan DeKok 24 Aug '12

24 Aug '12

al so wrote: > you will pay the price for sure.. Threats are rude. You've not only been banned from the list, but your threats are now on permanent record in the list archives. Anyone wanting to know who you really are just has to search for your email address. > On Fri, Aug 24, 2012 at 12:50 PM, al so <volkswak(a)gmail.com > <mailto:volkswak@gmail.com>> wrote: > > just go eat some shit > > > On Fri, Aug 24, 2012 at 12:49 PM, Alan DeKok > <aland(a)deployingradius.com <mailto:aland@deployingradius.com>> wrote: > > al so wrote: > > looks like you need to find some decent job.. > > Congratulations. You've been unsubscribed from the > freeradius-users > list. You've also been banned from every subscribing again. > > Alan DeKok. > > >

1 0

non-blocking radius client
by al so 24 Aug '12

24 Aug '12

> > I am trying to write my own Radius client using Java + Netty in a > non-blocking IO fashion. > > Is there a sample code I can look at or reuse? Obviously, trying not to > reinvent the wheel here. > > Also, any suggestion on RADIUS servers that I can install and test my > RADIUS client against? > Not much info out there to compare various implementations.

3 3

redundant-load-balance
by McNutt, Justin M. 24 Aug '12

24 Aug '12

>From 'man unlang' I see this: redundant-load-balance { ldap1 # 50%, unless ldap2 is down, then 100% ldap2 # 50%, unless ldap1 is down, then 100% } I clearly don't know what I'm doing when it comes to defining these "modules". If I have just "ldap" in there, it works. raddb/modules/ldap exists and is configured correctly. However, when I do this in my raddb/sites-enabled/FOO: authorize { ... redundant-load-balance { ldap1 ldap2 ldap3 } ... } I get the following errors from "radiusd -XC": /etc/raddb/sites-enabled/campus-main[179]: Failed to load module "ldap1". /etc/raddb/sites-enabled/campus-main[179]: Failed to parse "ldap1" entry. /etc/raddb/sites-enabled/campus-main[70]: Errors parsing authorize section. I tried copying modules/ldap to modules/ldap1, but that didn't work. Also changed the ldap { ... } in modules/ldap1 to ldap1 { ... }. No help there. This must be some syntactical aliasing that I haven't set up. What am I missing? For now, ldap1, ldap2, and ldap3 can all be identical (for testing). As it happens, they point to ldap.missouri.edu at the moment, which is itself a DNS round robin. My plan is that if it fails on the first attempt, it should attempt at least two more times, likely hitting different real servers before actually failing. Thoughts? Thanks! --J

4 5