October 2005 - Freeradius-Users - lists.freeradius.org

add a realm to a User-Name if no realm
by Lewis Bergman 06 Oct '05

06 Oct '05

I am in need of rewriting a username in a request to include a domain. Basically, if a user comes in as "user" add the realm "@dom.com" so it is checked as "user(a)dom.com". I found this in the archives which seems to be close. http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg15228.… I presume the solution above would go in the users file. I need to be able to do this differently per client. Is this possible? So I added DEFAULT User-Name !~ "@", User-Name := "%{User-Name}(a)dom.com" but that fails to yeild the result I was looking for. I see from the debug that it is matched users: Matched entry DEFAULT at line 223 But that user isn't in the users file, they are all in MySQL. As a result, do I need that in the sql.conf or one of the preprocess files? I did add the user to the user file but authentication still failed. I have also studied variables.txt but seem unable to make this work. I even tried making my own preprocess file. I didn't expect it to work and I wasn't dissappointed. Any help appreciated. -- Lewis Bergman Texas Communications 4309 Maple ST. Abilene, TX 79602 325-691-3301

3 4

Setup questions- client & user secrets
by Padmanabhan Ramaswamy 06 Oct '05

06 Oct '05

Hi. I'm fairly new to the RADIUS stuff. I'm trying to setup FreeRadius 1.0.1 as a failover (secondary) server on a remote network. I've RadTest-ed and NTRadPing-ed the basic installation and it seems to work fine. My current RADIUS server is a commercial product running on a Win 2k machine (local network). Exporting the clients & users data from this server for use in the FreeRadius server gave me encrypted secrets for both clients & users. The secret strings I get are all 264 characters long. I tried using these as-is in 'clients.conf' and the 'users' files. FreeRadius won't even start with these. Should I be using these encrypted secrets in the clients.conf & users files at all or should I ask for the cleartext secrets from the NAS clients and use those instead? I'm using plain PPP (NAS clients' requirement). Does that mean I can use PAP and CHAP authentication or PAP only? Thanks.

2 1

Using freeradius and 802.1x for dynamic VLAN on Cisco
by HOWLETT C DsicEmi 06 Oct '05

06 Oct '05

Hi Everyone, I finally worked it out ! I was missing aaa authorization network default group radius in the config file. FYI, switchport access vlan dynamic is not valid when dot1x is enabled. What makes dynamic VLAN assignment possible is the above command (aaa....) Claire ======================================================= Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. La SOCIETE GENERALE et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ======================================================= This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorized use or dissemination is prohibited. E-mails are susceptible to alteration. Neither SOCIETE GENERALE nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. =======================================================

1 0

RE: access for 24 hours after first login?
by Jonathan De Graeve 06 Oct '05

06 Oct '05

This is how I do this Use SQLcounter module Put this in sqlcounter.conf (expecting that sqlcounter is already configged in the radiusd.conf) sqlcounter validity { counter-name = All-Secs-Passed check-name = Max-Secs-Passed sqlmod-inst = sql key = User-Name reset = never query = "SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) secs_passed_since_start FROM radacct WHERE UserName = '%{%k}' LIMIT 1" Create in the config dictionary file an attribute of Max-Secs-Passed For example: #ATTRIBUTE My-Local-String 3000 string #ATTRIBUTE My-Local-IPAddr 3001 ipaddr #ATTRIBUTE My-Local-Integer 3002 integer ATTRIBUTE Max-Secs-Passed 3000 integer In radiusd.conf: Authorize {} section: Put this: validity The Max-Secs-Passed var is defined in seconds. So if you want a user only to be able to logon in the first 24hours after his first logon, Max-Secs-Passed should be set to 86400 (60secs * 60minutes * 24) Hope this helps the question I think many people will have. You could use other check or counter-names, its just an example.... You also could combine this with volume limits, max total session time etc... Kind Regards -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Markus Krause Verzonden: donderdag 6 oktober 2005 12:57 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Re: access for 24 hours after first login? Zitat von Alan DeKok <aland(a)ox.org>: > Markus Krause <krause(a)biochem.mpg.de> wrote: > > i set up freeradius succesfully for authentification against pam and users > file > > :-) > > Please don't use "authentification". It's "authentication". sorry for my poor english, it's not my mother-tongue ... > > now i want to enhance the functionality about the following feature: > > setting up several predefined (guest) accounts with a generated username > and > > password. this account should be valid from the first time it is used > (first > > login) for 24 hours (or even better until 23:59 that day). > > rlm_counter. Set it for 24 hours of access, and "reset=never". i read about this, but does this not mean that the user has an online time of 24 hours (or whatever i set in Max-All-Session-Time), so he can login until he has been active for 24 hours in sum? thanks in advance for your help! markus > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Accounting query is sleeping
by Abdul Lateef 06 Oct '05

06 Oct '05

Hi all, Can you tell me why all query of accounting start and stop (INSERT and UPTADE) are sleeping in mysql database. For authentication and authorization I am using rlm_perl in side the example.pl file I am doing more queries but it is working well. It means the problem is not in my DB, I think I am doing some wrong configuration in sql.conf. Please let me know how I can make fast speed? -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com ______________________________________________________ Yahoo! for Good Donate to the Hurricane Katrina relief effort. http://store.yahoo.com/redcross-donate3/

1 0

access for 24 hours after first login?
by Markus Krause 06 Oct '05

06 Oct '05

hello list, i set up freeradius succesfully for authentification against pam and users file :-) now i want to enhance the functionality about the following feature: setting up several predefined (guest) accounts with a generated username and password. this account should be valid from the first time it is used (first login) for 24 hours (or even better until 23:59 that day). this is intended for our daily visitors and guests or for conference members, the idea is to give them a username/password pair to be used just that day without much administration effort. (just generate a list of lets say 100 accounts and if they have been used just create new ones). (how) can this be realized using freeradius? has anyone set up a similar (or even better ;-) ) solution for this aim? (one-day passwords valid after first login) thanks for any help and hints! regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Re: question on dialup_admin
by Kostas Kalevras 06 Oct '05

06 Oct '05

On Thu, 6 Oct 2005, radius.unime(a)email.it wrote: > Ok, > I have successfuly stored in mysql the lod data. > > But the Calling-Station-Id and Called-Station-Id aren't stored. This > attributes are present in the access_request and access_response packet but > not in the accounting_packet. It's possible to store this data also? > > Thanks, > Felice If they are not present in the accounting packets there's not much you can do. Try making your NAS send them. -- Kostas Kalevras Network Operations Center kkalev(a)noc.ntua.gr National Technical University of Athens, Greece Work Phone: +30 210 7721861 'Go back to the shadow' Gandalf

1 0

RE: Using freeradius and 802.1x for dynamic VLAN on Cisco 2950
by Øystein Gåsdal 06 Oct '05

06 Oct '05

I think you need to apply this command to the port: switchport access vlan dynamic - Øystein Gåsdal _____ From: HOWLETT C DsicEmi [mailto:Claire.Howlett@socgen.com] Sent: 6. oktober 2005 10:54 To: freeradius-users(a)lists.freeradius.org Subject: Using freeradius and 802.1x for dynamic VLAN on Cisco 2950 Hi Everyone, Dave, Are you sure the command aaa authentication network default group radius is valid on 2950 switches ? I am running Version 12.1(22)EA5, which was the last stable image in july and "network" is not available as aaa authentication option. If anyone has met any success with dynamic VLAN assignment on Cisco 29502 with FreeRadius. I am interested ! Here is how my user is declared: Client_Arpege Auth-Type := EAP Service-Type = Framed-User, Reply-Message = "Authentification OK - Bienvenue sur le RCSG", Tunnel-Type = :1:VLAN, Tunnel-Medium-Type = :1:6, Tunnel-Private-Group-ID = :1:140 :1: are used to give tags a value of 1, 6 is interprested by FreeRadius as IEEE-802. I have checked with Ethereal and the paquet sent seems OK. I think the problem comes from the switch. Here is the configuration file: ! version 12.1 no service pad service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption ! hostname Switch802_1x ! aaa new-model aaa authentication login default group radius local aaa authentication dot1x default group radius aaa authorization exec default group radius if-authenticated aaa accounting dot1x default start-stop group radius enable password ******** ! username admin secret 5 $1$IqQs$tJ9S4pfeDfZR42vlaFrbQ1 ip subnet-zero ! ! spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id dot1x system-auth-control ! ! ! ! interface FastEthernet0/1 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/2 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/3 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/4 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/5 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/6 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/7 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/8 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/9 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/10 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/11 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/12 switchport access vlan 141 switchport mode access switchport port-security switchport port-security mac-address sticky switchport port-security mac-address sticky 0001.e6a7.09d8 spanning-tree portfast ! interface FastEthernet0/13 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/14 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/15 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/16 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/17 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/18 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/19 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/20 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/21 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/22 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/23 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/24 switchport trunk native vlan 136 switchport mode trunk ! interface GigabitEthernet0/1 ! interface GigabitEthernet0/2 ! interface Vlan1 no ip address no ip route-cache shutdown ! interface Vlan136 ip address XX.XX.XX.XX 255.255.255.0 no ip route-cache ! ip default-gateway YY.YY.YY.YY ip http server logging trap notifications logging facility local6 logging ZZ.ZZ.ZZ.ZZ radius-server host ZZ.ZZ.ZZ.ZZ auth-port 1812 acct-port 1813 key testing123 radius-server retransmit 3 ! line con 0 exec-timeout 0 0 password ******** line vty 0 4 exec-timeout 0 0 password ******** line vty 5 15 exec-timeout 0 0 password ******** ! ! end The Client is connected to port 0/23 which is dot1x enabled. It is authenticated (interface is up and logs in Freeradius prove that it's OK) BUT interface 0/23 remains in vlan 1, whereas it should be switched to vlan 140. Switch802_1x#sh vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/18, Fa0/19, Fa0/20, Fa0/21 Fa0/22, Fa0/23, Gi0/1, Gi0/2 136 reseau_PFT-DEF active Fa0/1, Fa0/2, Fa0/3, Fa0/4 140 VLAN0140 active 141 VLAN0141 active Fa0/12 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup If anyone can help me... I am losing hope ;-( Claire, claire.howlett(a)socgen.com ======================================================= Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. La SOCIETE GENERALE et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ======================================================= This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorized use or dissemination is prohibited. E-mails are susceptible to alteration. Neither SOCIETE GENERALE nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. =======================================================

1 0

request->proxy & request->proxy_reply
by Massimiliano Liccardo 06 Oct '05

06 Oct '05

hi folks, I should write a module that strips/modifies AV pairs from a proxy reply according to the AV pairs prior sent into the originated request. My doubt is: the AV request->proxy are still valid during post-proxy stage of a rlm_module? -- Massimiliano Liccardo (maX) <liccardo(a)acmesolutions.it> jid:coccolesto@jabber.org sip:maX@macchese.no-ip.org GnuPG public key available on wwwkeys.eu.pgp.net Key ID: D01F1CAD Key fingerprint: 992D 91B7 9682 9735 12C9 402D AD3F E4BB D01F 1CAD "la velocità induce all'oblio, la lentezza al ricordo"

3 2

Re: question on dialup_admin
by radius.unime＠email.it 06 Oct '05

06 Oct '05

--------- Original Message -------- Da: Kostas Kalevras <kkalev(a)noc.ntua.gr> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Oggetto: Re: question on dialup_admin Data: 04/10/05 16:36 > > > On Mon, 3 Oct 2005, radius.unime(a)email.it wrote: > > > Hello! > > > > I have a question on dialup_admin: > > > > I have configured freeradius to authorization by LDAP and authentication by > > EAP and it works fine. > > > > Now I want to log the activity of my users with dialup_admin, > > > > it's necessary that I use sql for authentication and authorization? or I can > > use EAP and LDAP again and dialup_admin only for log? > > dialupadmin will use sql to read accounting data and sql OR ldap to read user > data. So u only need to point dialupadmin to ldap to read your user profiles > and to sql to read the accounting information. > > Hope this helps > > > > > If yes, I must add the entry in the database (mysql) for any user that can > > access to my network? > > > > excuse me for my bad english... > > Thanks, > > > > Felice > > -- > > Email.it, the professional e-mail, gratis per te: http://www.email.it/f > > > > Sponsor: > > Occhialeria.it > > Scopri le migliori marche a prezzi imbattibili > > Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=879&d=20051003 > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > -- > Kostas Kalevras Network Operations Center > kkalev(a)noc.ntua.gr National Technical University of Athens, Greece > Work Phone: +30 210 7721861 > 'Go back to the shadow' Gandalf Ok, I have successfuly stored in mysql the lod data. But the Calling-Station-Id and Called-Station-Id aren't stored. This attributes are present in the access_request and access_response packet but not in the accounting_packet. It's possible to store this data also? Thanks, Felice -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Email.it Phone Card: chiami in tutto il mondo a tariffe imbattibili da tutti i telefoni fissi e cellulari! Clicca e scopri come Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=2686&d=20051006

1 0