October 2005 - Freeradius-Users - lists.freeradius.org

RE: PID variable
by Jamal Taweel 09 Oct '05

09 Oct '05

Why you didn't install the related daemon to tools instead of this? BR, Jamal Taweel -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Abdul Lateef Sent: Wednesday, October 05, 2005 11:16 AM To: freeradius-users(a)lists.freeradius.org Subject: PID variable Hi all, How i can retrive the current pid value of freeradius in Shell script. I wanted to create one shell script to run in linux corn commond. because our database is very slow and always radius is going to crashed when it receives more than 1000 request. so my script will check if the radius is crashed it will start automatically using cron. Is anyone have good logic to auto restart radius when it will be crashed? -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ************************************************************************************* The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ************************************************************************************* PALTEL E-Safety System scanned this email and found NO viruses, vandals or malicious content. ************************************************************************************* Should you need any information or clarifications regarding this system, please do not hesitate to contact our team at the IP Dep. <esafety(a)paltel.net>. *************************************************************************************

1 0

effort required to create passwd DB nsswitch lookup using AAA server..
by Raj 08 Oct '05

08 Oct '05

Currently, there's LDAP lookup support for passwd DB in nsswitch.conf. I don't think similar service exist for AAA server lookup for passwd DB in nsswitch. How much effort is required to accomplish this. Any pointers are apprecaited... --- Raj <mutthuraj(a)yahoo.com> wrote: > If I have a Radius client setup on a RHEL 4.0 linux > with pam_auth_radius module > active for telnet/ssh service, do I need to create > a > linux user (with no passwd) that > is same as the Radius user for this authentication > to > work? > This is assuming "sufficient" control flag for > pam_radius_auth as the very first > entry in the related service files under /etc/pam.d > dir. > > > Basically, I don't want to create a user account on > AAA client machine but only on AAA server. Is there > a > way I can accomplish this using pam_auth_radius and > nsswitch.conf ? i.e if there's a way to specify AAA > server lookup for passwd DB in nsswitch.conf? > > > > __________________________________ > Yahoo! Mail - PC Magazine Editors' Choice 2005 > http://mail.yahoo.com > __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

FreeRADIUS expert NEEDED in NYC for a quick project
by Casey Sung 08 Oct '05

08 Oct '05

Hello FR experts. I need someone to setup and preconfigure a FreeRADIUS server from scratch for me. Overview of what I accomplished: Give registered authenticated users network access in private network setting. User must log in. Web tool for administrator to register new users for above. Setup multi-cast VPN for remote user access to a server Give guest users free wireless internet access for browsing only (simple web registration required) A way to specify bandwidth for each user or group of users. Soneone in NYC preferred If you have deep experience in FreeRADIUS and network security please send CV to csung(a)corporatepark.net with your $$ fee estimate. Thank you. Casey Sung Grace Corporate Park

1 0

DATE_SUB (rlm_perl)
by Abdul Lateef 08 Oct '05

08 Oct '05

Hi all, I was inserting start and stop time using rlm_perl example.pl file. But i am doing some mistake. i modified the following code for start date, but not working. DATE_SUB('CURDATE()',INTERVAL ($RAD_REQUEST{'Acct-Session-Time:-0'} + $RAD_REQUEST{'Acct-Delay-Time:-0'}) SECOND) Can anyone suggest me what is the right code to insert start date and time? this is the error what i am getting. /raddb/MaxTime.pl , func = accounting exit status= DBD::mysql::st execute failed: You have an error in your SQL syntax near '+ ) SECOND),.............. -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

Post Accounting
by Devrim Seral 08 Oct '05

08 Oct '05

Thanks for reply Paolo, But i wonder that can i use both sql accounting and acctusersfile same time? And i i do how? Thanks.. devrim I do some post-proccesing for accounting and I do it through the exec module. I call at the end of accounting section one instance of the exec module wich calls a script wich does some post-processing, updates some tables and distinguish processing between Start/Alive/Stop. ----- Original Message ----- From: Devrim Seral To: freeradius-users at lists.freeradius.org <http://lists.freeradius.org/mailman/listinfo/freeradius-users> Sent: Friday, October 07, 2005 6:04 PM Subject: Post Accounting Hi freeradius community! I want to do something with freeradius but i haven't find any information how to do that. The problem is I want to run SQL query after accounting stop request with in sql module. I found that sql module have postauth_query feature. So i want same functionality but after accounting stop request.. Is there any way to do it? (Note that i don't want to use SQL trigger) Thanks for your responses devrim ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Grab caller id and insert into radcheck how to
by Jonathan De Graeve 08 Oct '05

08 Oct '05

You should use: IF NOT EXISTS -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Shane Hart Verzonden: vrijdag 7 oktober 2005 13:22 Aan: FreeRadius users mailing list Onderwerp: Grab caller id and insert into radcheck how to Hi all, I an attempting to add an additional attribute upon the first login for user accounts and I am a bit lost. The way I am testing this is with postauth query. postauth_query = "INSERT into ${authcheck_table} (id, UserName, Attribute, op, value) values('', '%{SQL-User-Name}', 'Calling-Station-Id', '==', '%{Calling-Station-Id}' )" This works great but it adds a new record every time the user successfully authenticates. Not a problem really but there are also users I don't need to lock to a caller id. I tried using postauth_query = "UPDATE in various ways but I just can't get my head around it. If I manually create an entry in radcheck for a user with the attribute "Calling-Station-Id" and a "NULL" value, then the user can't login obviously. Does anybody have any ideas how to have this attribute somehow dynamically created when the user first logs in if they are a member of a group and ultimately not create it if the record already exists? Any ideas or pointers greatly appreciated. Thanks Shane - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

about pam_radius_auth.so module and creating user accounts on AAA client..
by Raj 07 Oct '05

07 Oct '05

If I have a Radius client setup on a RHEL 4.0 linux with pam_auth_radius module active for telnet/ssh service, do I need to create a linux user (with no passwd) that is same as the Radius user for this authentication to work? This is assuming "sufficient" control flag for pam_radius_auth as the very first entry in the related service files under /etc/pam.d dir. Basically, I don't want to create a user account on AAA client machine but only on AAA server. Is there a way I can accomplish this using pam_auth_radius and nsswitch.conf ? i.e if there's a way to specify AAA server lookup for passwd DB in nsswitch.conf? __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Post Accounting
by Devrim Seral 07 Oct '05

07 Oct '05

Hi freeradius community! I want to do something with freeradius but i haven't find any information how to do that. The problem is I want to run SQL query after accounting stop request with in sql module. I found that sql module have postauth_query feature. So i want same functionality but after accounting stop request.. Is there any way to do it? (Note that i don't want to use SQL trigger) Thanks for your responses devrim

2 1

best practice for combination freeradius -- active directory?
by ho 07 Oct '05

07 Oct '05

Hi all, i need some more ideas for doing a good, stable and easy to use connection between freeradius and Active Directory. first of all a little bit of our configuration and history: i've set up a freeradius server for authentication/authorization/accounting of dsl-dial-in user on a cisco asa. it works very well: - local (Auth-type = system) authentication on a linux box - authorisation (especially cisco acl's) - mysql-db -- accounting (this is my favourite feature!!!!!) a new requirement was given to make a connection between the asa and our central authentication: Active Directory. AD is a must in our company. first there were many thoughts in my brain, then i decided to use a NIS-Master-Client combination to do this stuff (it was the easiest way for me to implement). -> freeradius-server is the NIS-client, so Auth-Type = system still remains -> the AD-Servers have installed MS SFU (Services for Unix) with a NIS-Master Server. Everything works well ... but the procedure to get the AD-Users into the SFU-NIS-Master-Server seems to be a little bit tricky, particularly the password stuff (it must be changed in the AD at the first time it was brought into SFU although it was synchronized !!??) I think, this is a solution for 1-100 Users, but not for 2000 and this is our aim. a LDAP-Server is not planned in our company. So now my questions: ---------------------------- - has anybody implemented a similar system? - what could be a alternative/better way to make a connection between freeradius and the AD-Servers only for password-authentication? Authorization and Accounting still remains on the linux-box - I've heard from our AD-God's ;-) that kerberos is used in the AD-system and that it could be a way? ---> has anybody tried this? I would be glad for any idea or hints. Thank you.

3 2

Re: newbie install problem
by Lefteris St 07 Oct '05

07 Oct '05

>I have RedHat ES4 and I downloaded FreeRadius-1.0.5. >unzipped it and >did >./configure >make >make install > >It didn't seem to complain, but I can't run it. I can't >find the >radiusd >file. And after server startup I don't see any radius >daemon running. >How do >I run it? The radiusd binary should be in the /usr/local/sbin folder. If not, something went wrong during compile/installation. Check the output again. It may help if you redirect it to a file (like make > make_output.txt). You can also check configure.log. Lefteris, __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

3 3