October 2005 - Freeradius-Users - lists.freeradius.org

Add Attribute into Accounting-Response packet ?
by Yurij Korik 07 Oct '05

07 Oct '05

Hi. Forgive for my bad english. When RADIUS got an update accounting packet (PW_STATUS_ALIVE), i need create and add pair (for example "Session-timeout") into request->reply->vps (module rlm_sql). I write apropriate code into rlm_sql.c alivepair = paircreate(PW_SESSION_TIMEOUT, PW_TYPE_INTEGER); alivepair->lvalue = sesstout; pairadd(&request->reply->vps, alivepair); It's need to dynamically change Session-timeout depend by user trafic. Is possible sothat this attributes was sended with Accounting-Response packet to NAS ?

2 1

freeradis with other library then opnssl
by Sudhananda 07 Oct '05

07 Oct '05

Hi, I have got a supplicant which does not use openssl library. does my supplicant works with freeradius server? Does the certifiactes generated using openssl work with this? Thanks, Sudhananda This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message.Global Edge Software Ltd has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Global Edge Software Ltd reserves the right to monitor and review the content of all messages sent to or from this e-mail address

1 0

RE: SQL Integration
by Jonathan De Graeve 07 Oct '05

07 Oct '05

>1. It is possible with to get free radius to failed logins to the sql >database, as well as logging to another table that a successful login >occurred yes >2 is it possible to populate the utmp / wtmp files into a database as well >instead of a flat file? Yes >Thanks all in advance No problem J.

2 1

Which Operating System is best for freeRADIUS
by Gunther 07 Oct '05

07 Oct '05

Building my FR server, I have the choice of a number of operating system for my FreeRADIUS server. Anybody with a suggestion which operating system is best suited for FR? I like to run FR on a VPS (virtual private server) using one of the following OS: - FreeBSD 4.9 (jail) - FreeBSD 5.2 (jail) - Fedora 2 (virtuozza) - Redhat AS3 (virtuozza) - Redhat 9.0 (virtuozza) - CentOS 4.0 (virtuozza) Thanks! Gunther

6 8

RE: RE: access for 24 hours after first login?
by Jonathan De Graeve 07 Oct '05

07 Oct '05

>how is the actual comparision of the calculated value in "query" done, does >it >mean, that the value returned by "query" has to be smaller than the one >referred to by "check-name" (in your example Max-Secs-Passed)? It works quite simple If ( (Max-Secs-Passed - All-Secs-Passed > 0) => allow access >what does the line "sqlmod-inst = sql" mean (in >/usr/share/doc/freeradius/rlm_sqlcounter there is also the value "sqlcc3", >what >does this do?) It are the defined SQL instances in sql.conf >what about the following: > >SELECT TO_DAYS(NOW()) - TO_DAYS(AcctStartTime) from radacct WHERE UserName >= >'%(%k)' LIMIT 1; This query works but I don't use it because of the rounding it gives me... >would this mean that a user can login until 23:59 after logged in the first >time >that day? Yes, since he doesn't look at the hour/minutes/seconds...

1 0

SQL Integration
by Damien Croarken 07 Oct '05

07 Oct '05

Hi All Im having a play with freeradius, with the hopes of moving from an existing commercial version and I have 2 questions 1. It is possible with to get free radius to failed logins to the sql database, as well as logging to another table that a successful login occurred 2 is it possible to populate the utmp / wtmp files into a database as well instead of a flat file? Thanks all in advance Damien

1 0

newbie install problem
by J.P. Fischer 06 Oct '05

06 Oct '05

I have RedHat ES4 and I downloaded FreeRadius-1.0.5. unzipped it and did ./configure make make install It didn't seem to complain, but I can't run it. I can't find the radiusd file. And after server startup I don't see any radius daemon running. How do I run it?

1 0

RE: RE: access for 24 hours after first login?
by Jonathan De Graeve 06 Oct '05

06 Oct '05

>It doesn't work on postgresql v7.4.6 that I tried it on.. howver, I used > >"SELECT now() - AcctStartTime FROM radacct WHERE UserName = '%{%k}' >LIMIT 1;" > Be carefull with this!!!!! "SELECT now() - AcctStartTime Secs FROM radacct WHERE UserName = '%{k}' LIMIT 1;" Gives for example with username 'test': +-----------+ | Secs | +-----------+ | 684042112 | +-----------+ Recalculated in days: 7917,1540740740740740740740740741 days.... Is NOT the same as: "SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) Secs FROM radacct WHERE UserName = '%{%k}' LIMIT 1" Gives for example with username 'test': +----------+ | Secs | +----------+ | 17119330 | +----------+ Recalculated in days: 198,14039351851851851851851851852 198days is the correct calculation... So as you can see, it isn't the same, at least in MySQL, don't know with other databases. So before you you begin: think, try and check your things. J.

1 0

Using freeradius and 802.1x for dynamic VLAN on Cisco 2950
by HOWLETT C DsicEmi 06 Oct '05

06 Oct '05

Hi Everyone, Dave, Are you sure the command aaa authentication network default group radius is valid on 2950 switches ? I am running Version 12.1(22)EA5, which was the last stable image in july and "network" is not available as aaa authentication option. If anyone has met any success with dynamic VLAN assignment on Cisco 29502 with FreeRadius. I am interested ! Here is how my user is declared: Client_Arpege Auth-Type := EAP Service-Type = Framed-User, Reply-Message = "Authentification OK - Bienvenue sur le RCSG", Tunnel-Type = :1:VLAN, Tunnel-Medium-Type = :1:6, Tunnel-Private-Group-ID = :1:140 :1: are used to give tags a value of 1, 6 is interprested by FreeRadius as IEEE-802. I have checked with Ethereal and the paquet sent seems OK. I think the problem comes from the switch. Here is the configuration file: ! version 12.1 no service pad service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption ! hostname Switch802_1x ! aaa new-model aaa authentication login default group radius local aaa authentication dot1x default group radius aaa authorization exec default group radius if-authenticated aaa accounting dot1x default start-stop group radius enable password ******** ! username admin secret 5 $1$IqQs$tJ9S4pfeDfZR42vlaFrbQ1 ip subnet-zero ! ! spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id dot1x system-auth-control ! ! ! ! interface FastEthernet0/1 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/2 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/3 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/4 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/5 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/6 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/7 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/8 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/9 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/10 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/11 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/12 switchport access vlan 141 switchport mode access switchport port-security switchport port-security mac-address sticky switchport port-security mac-address sticky 0001.e6a7.09d8 spanning-tree portfast ! interface FastEthernet0/13 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/14 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/15 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/16 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/17 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/18 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/19 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/20 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/21 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/22 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/23 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/24 switchport trunk native vlan 136 switchport mode trunk ! interface GigabitEthernet0/1 ! interface GigabitEthernet0/2 ! interface Vlan1 no ip address no ip route-cache shutdown ! interface Vlan136 ip address XX.XX.XX.XX 255.255.255.0 no ip route-cache ! ip default-gateway YY.YY.YY.YY ip http server logging trap notifications logging facility local6 logging ZZ.ZZ.ZZ.ZZ radius-server host ZZ.ZZ.ZZ.ZZ auth-port 1812 acct-port 1813 key testing123 radius-server retransmit 3 ! line con 0 exec-timeout 0 0 password ******** line vty 0 4 exec-timeout 0 0 password ******** line vty 5 15 exec-timeout 0 0 password ******** ! ! end The Client is connected to port 0/23 which is dot1x enabled. It is authenticated (interface is up and logs in Freeradius prove that it's OK) BUT interface 0/23 remains in vlan 1, whereas it should be switched to vlan 140. Switch802_1x#sh vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/18, Fa0/19, Fa0/20, Fa0/21 Fa0/22, Fa0/23, Gi0/1, Gi0/2 136 reseau_PFT-DEF active Fa0/1, Fa0/2, Fa0/3, Fa0/4 140 VLAN0140 active 141 VLAN0141 active Fa0/12 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup If anyone can help me... I am losing hope ;-( Claire, claire.howlett(a)socgen.com ======================================================= Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. La SOCIETE GENERALE et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ======================================================= This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorized use or dissemination is prohibited. E-mails are susceptible to alteration. Neither SOCIETE GENERALE nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. =======================================================

2 1

Fedora DS
by K. Suresh 06 Oct '05

06 Oct '05

Has anyone tried FedoraDS with FreeRadius? Thanks. Suresh

2 1