- Freeradius-Users - lists.freeradius.org

Re: SMSotpd, Something goes wrong :(
by Thomas Glanzmann 24 Aug '12

24 Aug '12

Hello Joël, > I've adjusted some paths and other little things. > Freeradius is up > smsotpd is up > I've populated the berkeley db with my identifiant don't use the smsotpd, use the rlm_perl which is a complete different setup. The mininimal config you find in the README in the corresponding directory. > Use of uninitialized value $type in hash element at ./pap_challenge_request.pl line 51. this happens, when you have a way to old Authen::Radius module. On which distribution are you? > Additionaly i suppose that i will need to change values regarding my > corporate active directory. Could you point me out where it's needed ? No, rlm_perl expects the username already writen as username@REALM. > it is possible to test the first stage "krb5" with radtest ? huh !! I > think it could be possible to answer to this question by myself .. ;o) Yes, it is. See the rlm_perl/README file. Cheers, Thomas

1 0

Ussing many MAC Address wih one user
by Andres Gomez Ruiz 24 Aug '12

24 Aug '12

Hi everybody!! Im using freeradius in a simple way (freeradius + MySQL). I have some users attached to some groups... it works fine!! The groups have some simple attributes like "Max-All-Session" in radgroupcheck table. Now I need to limit the users to some MAC Address. I mean, I have the User "AAAA" and I need use it only with these MAC Address: 00:23:8B:7F:47:DD 00:23:8B:7F:AA:BB 00:23:8B:7F:CC:EE I'm using the atributte Calling-Station-Id in the radcheck table, like this: AAAA Calling-Station-Id == 00:23:8B:7F:47:DD It works fine, but just for only one MAC address, If I put 2 or more MAC address It doesnt work. What can I do in order to enable some MAC Address attached to users in mysql database? (not only one?) Thanks !! -- * **Andres Gomez*

2 2

Accounting pakets on layer 2
by Andreas Meyer 24 Aug '12

24 Aug '12

Hello! Excuse me please, if this is the wrong list for my question! If I have an AccessPoint working on layer 2 like the ALL0278, how are accounting pakets generated and sent to the radius-server on port 1813. Which application is responsible for generating those pakets? Thank you! Andreas

3 3

[ANN] rlm_cache
by Arran Cudbard-Bell 23 Aug '12

23 Aug '12

Hi All, A new module has been added to V2.1.x and 3.0 HEADs called rlm_cache (written by Alan DeKok). This provides an in-memory (volatile) cache, that can store and retrieve attribute values for control, request and reply lists (at some point the 3.0 version will be able to handle all lists). This is definitely not a cure for slow or unstable databases/directories, but may help for some temporary outages, and has additional uses for things like accounting stream de-duplication/ratelimiting, and query/congestion reduction. I've added some basic documentation here: http://wiki.freeradius.org/Rlm_cache, and there's more in the default module configuration file. Post on the list if you can think of any additional features you'd like to see added. -Arran

1 0

$INCLUDE ignored by freeradius
by Krzysztof Grobelak 23 Aug '12

23 Aug '12

Hello all, It seems that the $INCLUDE <filename> command is ignored by freeradius during authentication. I have three groups of users in three different files and those three files are added to the main users file in raddb directory using $INCLUDE users.group1 $INCLUDE users.group2 $INCLUDE users.group3 but for some reason during authentication freeradius just looks up the main users file and ignores the $INCLUDE command which results in REJECT being sent. I think that i simply missed a configuration step as this setup was working before i did the upgade to the MASTER version from git. Thanks in advance Kris http://www.livelinx.tv/ NEW! See our Ka Uplink Van at IBC in Amsterdam; Stand OE 117, September 7-11, 2012

5 22

Re: Re: "+=" allowed in attrs ??
by Joachim Brauer 23 Aug '12

23 Aug '12

Hi Arran > When you get the response? > post-proxy { > files.authorize > } works like a charm -- thx alot !!! Regards, Joachim (JoB) Brauer

1 0

Re: Re: "+=" allowed in attrs ??
by Joachim Brauer 23 Aug '12

23 Aug '12

Hi > You shouldn't be using the attribute filter to add attributes, that's what the > users file is there for? Hmmm I tried that but it didn t work so I went over to try via attrs.... Dumb question: How can I have the "files" directive being processed after having proxied an incoming auth request? I seem to be unable to find the answer on this -- so I m glad for any pointers. My apologies if this is a silly question.... Regards, Joachim (JoB) Brauer

3 3

Re: Challenge/Response and rlm_example, I'm trying too ...
by Thomas Glanzmann 23 Aug '12

23 Aug '12

Hello Joël, > I'm trying to develop my own two-factor-authentication with > freeradius. the fastest way to do that is to grab http://thomas.glanzmann.de/smsotpd.2012-08-16.tar.bz2 and modify the rlm_perl implementation. That is very straight forward. > But it is not so clear for me to set up smotp both c and perl version! > So, is it possible to receive some advice, configuration files and > code snippets to help me. I'll make a video ready which shows howto setup FreeRadius with smsotp from scratch and send it to you. For you example I developed this radius module for use with VMware View (when it was still a private beta) and now using it in production for 1500 users with Citrix Netscaler. Cheers, Thomas

1 0

"+=" allowed in attrs ??
by Joachim Brauer 23 Aug '12

23 Aug '12

Hi I have set up a virtual server with authenticate { Auth-Type MS-CHAP { update control { Proxy-To-Realm := "emea_radius_servers" } } } post-auth { attr_filter.boa-NX-fwruleuser } } and the attr.filter looks like # Joachim Brauer "blah(a)blah.de" cisco-avpair := "ip:inacl#0=permit ip any 10.1.0.0 255.255.255.224", cisco-avpair += "ip:inacl#1=permit ip any 10.2.0.0 255.255.255.224", cisco-avpair += "ip:inacl#2=deny ip any any" However when debugging I see that the 1st cisco-avpair line is processed and sent to the NAS and the following 2 lines are NOT sent by freeradius My question now: is += not allowed in attrs ? or am I doing s.th. wrong here ? Purpose is to enrich the RADIUS response with per user cisco-avpair values.... freeradius version is 2.1.12 on RHEL 6. Thanks for any help. Regards, Joachim (JoB) Brauer

2 1

dictionary.mikrotik patch
by Scott Lambert 22 Aug '12

22 Aug '12

Add Mikrotik attributes 16 - 22. Not sure I got the types correct. I only need MikroTik-Address-List. Haven't used the rest. http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client#MikroTik_Specific_RADIUS… -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

4 5