Hello everyone again! Well as you may understand from the Subject I have a question about how clients.conf works. I´ve read the documentation in the file about how to add a client but when i tired to add another client it stoped working. I will try to explain how I have setup the network. I have one radius server connected to a Netgear wired switch, from that switch I have a AP(Mikrotik) connected. What I am trying to do is to add the Mikrotik into the clients.conf file but when I do i get an error at startup(dont remember the error message). Right now im instead using client 192.168.118.0/24{ } which accepts all NASes in the subnet. What i wrote in clients.conf before i changed to include a whole subnet is: client Netgear{ ipaddr = x.x.x.x netmask = 24 secret = xxxxxx require_message_authentication = no } client Mikrotik { ipaddr = x.x.x.x netmask = 24 secret = xxxxxxx require_message_authentication = no } What I am wondering about is if I have done a correct setup when trying to add several stand alone clients? Best regards/ Peter
From: freeradius-users-request@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 55, Issue 52 To: freeradius-users@lists.freeradius.org Date: Thu, 12 Nov 2009 08:43:56 +0100
Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] (Ivan Kalik) 2. Re: I need some help with freeradius 2.0.4 (Wagner Pereira) 3. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] (Wagner Pereira) 4. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] (tnt@kalik.net) 5. SSL renegotiation ? (John) 6. Re: FreeRadius with 3COM (Guk Victor) 7. Microsoft: SmardCard or Certificate Auth (swatzy)
----------------------------------------------------------------------
Message: 1 Date: Wed, 11 Nov 2009 19:30:35 +0000 From: Ivan Kalik <tnt@kalik.net> Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4AFB10DB.7040106@kalik.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Wagner Pereira wrote:
Dear colleagues,
I am introducing now a new information. Below is what is declared into my IOS - Cisco 6500. Is this correct?
Why don't you just read the cisco wiki page.
Ivan Kalik Kalik Informatika ISP
------------------------------
Message: 2 Date: Wed, 11 Nov 2009 17:42:15 -0200 From: Wagner Pereira <wpereira@pop-sp.rnp.br> Subject: Re: I need some help with freeradius 2.0.4 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4AFB1397.9000002@pop-sp.rnp.br> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Ok, Ivan. I guess I removed that HTML craps now : )
Below is my new radgroupreply:
mysql> select * from radgroupreply; +----+-----------+---------------+----+-----------------------+------+ | id | groupname | attribute | op | value | Prio | +----+-----------+---------------+----+-----------------------+------+ | 3 | pop-sp | Service-Type | := | NAS-Prompt-User | | | 5 | reject | reply-message | := | Autentica??o recusada | NULL | +----+-----------+---------------+----+-----------------------+------+ 2 rows in set (0.00 sec)
Hugs,
--
Wagner Pereira
PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo http://www.pop-sp.rnp.br (11) 3091-8902
tnt@kalik.net escreveu:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
Enough with that HTML!!!! It produces extraordinary ammount of crap as you can see:
I did what you recommended (I guess). See below:<br>
No, you didn't. But getting closer.
| 1 | pop-sp | Framed-Compression | := | Van-Jacobson-TCP-IP
Remove *all* Framed attributes.
| 3 | pop-sp | Service-Type | := | NAS-Prompt | | <br>
That should be NAS-Prompt-User.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
Message: 3 Date: Wed, 11 Nov 2009 17:57:18 -0200 From: Wagner Pereira <wpereira@pop-sp.rnp.br> Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4AFB171E.4010105@pop-sp.rnp.br> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Ivan,
I already read the Cisco wiki page and I implemented what they recommend, but it's not working yet.
--
Wagner Pereira
PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo http://www.pop-sp.rnp.br (11) 3091-8902
Ivan Kalik escreveu:
Wagner Pereira wrote:
Dear colleagues,
I am introducing now a new information. Below is what is declared into my IOS - Cisco 6500. Is this correct?
Why don't you just read the cisco wiki page.
Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
Message: 4 Date: Wed, 11 Nov 2009 22:01:33 -0000 (UTC) From: tnt@kalik.net Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Message-ID: <49743.87.194.16.13.1257976893.squirrel@www.kalik.net> Content-Type: text/plain;charset=iso-8859-1
I already read the Cisco wiki page and I implemented what they recommend, but it's not working yet.
Does the debug now show Nas-Prompt-User in Access-Accept packet? If it does - it's some problem on the router - debug ip ssh.
Ivan Kalik Kalik Informatika ISP
------------------------------
Message: 5 Date: Thu, 12 Nov 2009 11:01:44 +0800 (CST) From: John <elmer_radius@yahoo.com.cn> Subject: SSL renegotiation ? To: freeradius-users@lists.freeradius.org Message-ID: <145589.77590.qm@web15706.mail.cnb.yahoo.com> Content-Type: text/plain; charset="utf-8"
Hi, I found??a new man-in-the-middle attack with SSL.? http://www.sslshopper.com/article-ssl-and-tls-renegotiation-vulnerability-di... ? I am afraid if freeRADIUS use SSL renegotiation?? The freeRADIUS version is 1.1.6. We use EAP-TLS and the backend OpenLDAP server with TLS connection.? Does??freeRADIUS use SSL renegotiation ? ? Thanks. John
___________________________________________________________ ????????????????? http://card.mail.cn.yahoo.com/
Hi, I started the radiusd with -X. Is this part of the output means or not there is DHCP support? radiusd: #### Loading Virtual Servers #### server dhcp { modules { } # modules } # server WARNING: Server dhcp is empty, and will do nothing!
kako@zhnet.hu wrote:
I started the radiusd with -X. Is this part of the output means or not there is DHCP support?
It means you didn't read the sample configuration file in raddb/sites-available/dhcp
radiusd: #### Loading Virtual Servers #### server dhcp { modules { } # modules
You CANNOT put the "modules" section into a "server" section. Nothing in the documentation or examples says that it is possible. Alan DeKok.
2009. 11. 12, csütörtök keltezéssel 12.00-kor Alan DeKok ezt írta:
radiusd: #### Loading Virtual Servers #### server dhcp { modules { } # modules
You CANNOT put the "modules" section into a "server" section. Nothing in the documentation or examples says that it is possible.
I just enabled the dhcp file from sites-available directory, without modifications. I haven't found any info about how can I make it work, and was just trying.
Kassai Istvan wrote:
I just enabled the dhcp file from sites-available directory, without modifications. I haven't found any info about how can I make it work, and was just trying.
What does that mean? Did you run the server in debugging mode, as suggested EVERYWHERE? Alan DeKok.
2009. 11. 14, szombat keltezéssel 10.28-kor Alan DeKok ezt írta:
Kassai Istvan wrote:
I just enabled the dhcp file from sites-available directory, without modifications. I haven't found any info about how can I make it work, and was just trying.
What does that mean?
Did you run the server in debugging mode, as suggested EVERYWHERE?
what does what mean? I use the radius for accounting purposes, and would like to enable dhcp. Put a symlink into sites-enabled directory to the dhcp, and was running the radiusd with -X, and was waiting what happens. I don't waiting anybody to solve my problem, it would be enough if anybody send me a link to an understandable doc, handscript, sample, or anything can help me. thanks
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Kassai Istvan wrote:
Did you run the server in debugging mode, as suggested EVERYWHERE?
what does what mean? I use the radius for accounting purposes, and would like to enable dhcp. Put a symlink into sites-enabled directory to the dhcp, and was running the radiusd with -X, and was waiting what happens.
Uh... the point of running it in debugging mode is to: a) READ the output b) send it test packets You appeared to done none of that.
I don't waiting anybody to solve my problem, it would be enough if anybody send me a link to an understandable doc, handscript, sample, or anything can help me.
1) Does the debug output say it's listening on a DHCP interface? 2) Did you send it test packets? 3) Did you read sites-available/dhcp? I encourage people to do a *little* bit of work for yourself, rather than waiting for things to happen. http://www.youtube.com/watch?v=pQHX-SjgQvQ Alan DeKok.
hello, I was recompiled the freeradius (2.1.7) with dhcp support. Enabled the dhcp support and is listening on proper port and interface ********************************* listen { type = "dhcp" ipaddr = * port = 67 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on dhcp interface eth0 address * port 67 as server dhcp Listening on proxy address * port 1814 Ready to process requests. ********************************* But! When I set up an ip address in the "sites-enabled/dhcp" DHCP-Request section, I can see it in the debug log (rad.log), as DHCP-Your-IP-Address, but the client isn't gets it. If I would like to get it through the mac2ip module (rad1.log), it is always 0.0.0.0 There is a mac2ip text file in the usr/local/etc/raddb dir, with this content: 08:00:27:27:8F:E1,192.168.5.55 The machine I use as DHCP client previously got an IP address from another DHCP server, but for the time of trying I always disconnect that from the network.
Kassai Istvan wrote:
When I set up an ip address in the "sites-enabled/dhcp" DHCP-Request section, I can see it in the debug log (rad.log), as DHCP-Your-IP-Address, but the client isn't gets it.
The debug log shows that the "mac2ip" module isn't finding the MAC: ... ++[mac2ip] returns notfound ... So... what are the contents of the file? Alan DeKok.
2009. 11. 15, vasárnap keltezéssel 16.58-kor Alan DeKok ezt írta:
Kassai Istvan wrote:
When I set up an ip address in the "sites-enabled/dhcp" DHCP-Request section, I can see it in the debug log (rad.log), as DHCP-Your-IP-Address, but the client isn't gets it.
The debug log shows that the "mac2ip" module isn't finding the MAC:
... ++[mac2ip] returns notfound ...
So... what are the contents of the file?
As I wrote:
There is a mac2ip text file in the usr/local/etc/raddb dir, with this content:
08:00:27:27:8F:E1,192.168.5.55
Kassai Istvan wrote:
As I wrote:
There is a mac2ip text file in the usr/local/etc/raddb dir, with this content:
08:00:27:27:8F:E1,192.168.5.55
I'm not sure what's going wrong, then. It works for me... I suggest simply editing the sites-available/dhcp file directly. Hard-code the assignment of an IP address, and see if that works. Alan DeKok.
2009. 11. 15, vasárnap keltezéssel 21.03-kor Alan DeKok ezt írta:
Kassai Istvan wrote:
As I wrote:
There is a mac2ip text file in the usr/local/etc/raddb dir, with this content:
08:00:27:27:8F:E1,192.168.5.55
I'm not sure what's going wrong, then. It works for me...
I suggest simply editing the sites-available/dhcp file directly. Hard-code the assignment of an IP address, and see if that works. I edited that at the DHCP-Request section like this:
dhcp DHCP-Request { update reply { DHCP-Message-Type=DHCP-Ack } update reply { DHCP-Domain-Name-Server=127.0.0.1 DHCP-Domain-Name-Server=127.0.0.2 DHCP-Subnet-Mask=255.255.255.0 DHCP-Router-Address=10.10.10.254 DHCP-IP-Address-Lease-Time=86400 DHCP-DHCP-Server-Identifier=10.10.10.254 DHCP-Your-IP-Address=10.10.10.10 } #mac2ip ok } I can see in the log, the assigned client ip (rad.log), but somehow the client doesn't use it. I think I done wrong something, but what? But it is only the first step. The next must be to assign addresses from an sql database :-( As I think it will be a little harder work.
Kassai Istvan wrote:
I can see in the log, the assigned client ip (rad.log), but somehow the client doesn't use it. I think I done wrong something, but what?
I don't know. Try using tcpdump on the client && server to see where the packets are going.
But it is only the first step. The next must be to assign addresses from an sql database :-( As I think it will be a little harder work.
That isn't done yet. Alan DeKok.
Hi,
Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating mac2ip passwd mac2ip { filename = "/usr/local/etc/raddb/mac2ip" format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no
that last line of output there looks like something isnt quite right with the file contents or format alan
Hi,
Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating mac2ip passwd mac2ip { filename = "/usr/local/etc/raddb/mac2ip" format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no
that last line of output there looks like something isnt quite right with the file contents or format
This is the only line in the /usr/local/etc/raddb/mac2ip file: (By myself it must be OK) 08:00:27:27:8F:E1,192.168.5.55 kako
Peter Carlstedt wrote:
I have one radius server connected to a Netgear wired switch, from that switch I have a AP(Mikrotik) connected. What I am trying to do is to add the Mikrotik into the clients.conf file but when I do i get an error at startup(dont remember the error message).
If you can't be bothered to post the real error, why would anyone spend the time to help you? Asking questions on a public forum involves some simple etiquette. i.e. being willing to doo a *tiny* bit of work for yourself. And editing your email to remove 100's of lines of garbage. Alan DeKok.
Alan DeKok <aland@deployingradius.com> wrote:
Asking questions on a public forum involves some simple etiquette. i.e. being willing to doo a *tiny* bit of work for yourself. And editing your email to remove 100's of lines of garbage.
Might be too complicated and sit more at the bottom end of the list of "things to do" but any chance of configuring the mailing list mangler to reject messages where the Reference header has the Message-ID of the FreeRADIUS digests? For those that use a threaded sort on our email/NNTP clients it really is a sad thing to see...on the plus side the SNR will go up :) Cheers -- Alexander Clouter .sigmonster says: I've Been Moved!
participants (6)
-
Alan Buxey -
Alan DeKok -
Alexander Clouter -
kako＠zhnet.hu -
Kassai Istvan
-
Peter Carlstedt