October 2005 - Freeradius-Users - lists.freeradius.org

RE: adding a stop packet
by Michael Markstaller 25 Oct '05

25 Oct '05

I'm running something like this from crontab: UPDATE radacct SET AcctStopTime = FROM_UNIXTIME(unix_timestamp(AcctStartTime) + AcctSessionTime), AcctTerminateCause = 'NoStopRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)), AcctSessionTime = AcctSessionTime + 300 WHERE AcctStopTime = '' AND (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)) > 3660 AND AcctSessiontime > 0 ; UPDATE radacct SET AcctStopTime = AcctStartTime, AcctTerminateCause = 'NoStop-AliveRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime))) WHERE AcctStopTime = '' AND AcctSessionTime = 0 AND (unix_timestamp(now()) - unix_timestamp(AcctStartTime)) > 86400 ; /* Purge failed attempts */ DELETE FROM radacct WHERE AcctStopTime > 0 AND AcctSessionTime = 0 AND AcctStopTime <= DATE_SUB(CURDATE(),INTERVAL 7 DAY); Michael > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Chuck > Sent: Tuesday, October 25, 2005 8:30 PM > To: freeradius-users(a)lists.freeradius.org > Subject: adding a stop packet > > > We are using freeradius with mysql. Is there some kind of > script to easily add > a fake stop date/time to a user when one gets missed? > Currently I am looking > them up in the accounting table and manually editing the > entry. Would like to > find something that just takes username as input and creates > a stop based on > current date/time. We don't use the accounting for anything > other than > getting usage reports so if a few users are incorrect , no matter. > > This happens frequently ( several times a week) that we don't > get stop packets > from our upstream. Then when users attempt a login, > simultaneous use check > item kicks in and denies them. They claim there is nothing > they can do about > it. > > -- > > Chuck > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: SUSPENSION OF ACCOUNT
by Jonathan De Graeve 25 Oct '05

25 Oct '05

>I don't think it's possible with the module sqlcounter. You have >to change the value of the attribute Expiration when the account >is renewed. Its possible with Expiration AND/OR Sqlcounter J.

3 3

FreeRadius with NTLM
by Jaygopal Upadhyay 25 Oct '05

25 Oct '05

Hello, I have a Wireless Access Point which support radius. I want to install and configure FreeRadius to authenticate against NT 4.0 (Primary Domain Controller), so that only authenticated users gain access via the Wireless Access Point. Samba on the linux machine where FreeRadius is installed is able to authenticate NT users. Can anyone provide me with steps on how to configure FreeRadius to use samba and allow access to WI-FI to valid domain users? Regards, Jaygopal. "The information contained in this message and the attachments (if any) may be privileged and confidential and protected from disclosure. You are hereby notified that any unauthorized use, dissemination, distribution or copying of this communication, review, retransmission, or taking of any action based upon this information, by persons or entities other than the intended recipient, is strictly prohibited. If you are not the intended recipient or an employee or agent responsible for delivering this message, and have received this communication in error, please notify us immediately by replying to the message and kindly delete the original message, attachments, if any, and all its copies from your computer system. Thank you for your cooperation."

2 1

RE: counter with Session Octet Limit
by Jonathan De Graeve 25 Oct '05

25 Oct '05

When I tried todo this a while ago I encountered a limit of 4GB in the sqlcounter module. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Ilia Chipitsine Verzonden: dinsdag 25 oktober 2005 8:40 Aan: edvin.seferovic(a)kolp.at; FreeRadius users mailing list Onderwerp: Re: counter with Session Octet Limit I did the same thing by: 1) adding "quota" script to authorize section, it just calculates how many bytes (if any) can be downloaded 2) patching VPN server in order to understand passed parameter > Hello, > > > > I am using freeRadius 1.0.2, and I would like to limit weekly bandwidth for > my VPN ( pptp ) users. So Ive changed the example counter part in my > radiusd.conf > > > > counter weekly_traffic { > > filename = ${raddbdir}/db.weekly > > key = User-Name > > count-attribute = Acct-Input-Octets > > reset = weekly > > counter-name = Weekly-Traffic > > check-name = Max-Weekly-Traffic > > allowed-servicetype = Framed-User > > } > > > > The counter works for it self - It checks the Max-Weekly-Traffic attribute > in my ldap tree for a specific user, calculates the rest, but then it tries > to add Session-Timeout attribute to Access-Accept packet. This is not > working / attribute is not being added, and besides - it is the wrong > attribute. Is it possible for the counter module to add the value, which is > usualy added as Session-Timeout, as Session-Octets-Limit? > > > > Regards, > > > > Edvin Seferovic > > > > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 4

Profiles Text File
by Global Net, LLC 25 Oct '05

25 Oct '05

Hello, I am new to the freeradius and am use to VOPRadius for several years My problem in migrating is that VOPRadius used a profiles.txt file to add certain items to a user login detail. items are called in the users logon text file as one of the items. username=billy password=1234 profile="smtpfilter" This way one can call a global item for several users How can I accomplish this with freeradius? Here are a couple of items from the old vopradius tab demented profiles.txt so you will have an idea what I am doing if unfamilar with what vopradius did, that i need to adapt around Profile="smtpfilter" Ascend-Data-Filter="ip in forward tcp est" Ascend-Data-Filter="ip in forward dstip 68.22.89.5/32" Ascend-Data-Filter="ip in forward dstip 65.174.134.5/32" Ascend-Data-Filter="ip in forward dstip 64.79.161.16/32" Ascend-Data-Filter="ip in forward dstip 204.17.24.53/32" Ascend-Data-Filter="ip in forward dstip 204.13.240.5/32" Ascend-Data-Filter="ip in forward dstip 63.110.140.0/24" Ascend-Data-Filter="ip in forward dstip 162.42.148.0/24" Ascend-Data-Filter="ip in forward dstip 162.42.195.0/24" Ascend-Data-Filter="ip in drop tcp dstport = 25" Ascend-Data-Filter="ip in forward" Profile="ISDNFramed" Service-Type = Framed-User Framed-Protocol = PPP Port-Limit = 2 Analog-Access = FALSE Digital-Access = TRUE

2 1

Multiple instances
by Mike Chamberlain 25 Oct '05

25 Oct '05

Hello there. This is probably a stupid question, but how do I run multiple instances of radiusd on the same machine, listening on different ports? I have two configuration directories: /usr/local/etc/raddb /usr/local/etc/raddb2 which specify ports 1812 and 1813 respectively, so I thought I'd be able to issue the following commands: radiusd -d /usr/local/etc/raddb radiusd -d /usr/local/etc/raddb2 This doesn't seem to work however, as the second command seems to have no effect, ie. I see the first radiusd process running but never the second. Can anyone help please? Thanks, Mike

3 3

Issue an Access Challenge to retry password
by Stefan A. 25 Oct '05

25 Oct '05

I thought something like the following should work: At the end of the user file: DEFAULT Auth-Type := Challenge, State != "first retry" Reply-Message = "Please retry your Password:", State = "first retry" DEFAULT Auth-Type := Reject Reply-Message = "Sorry, no access." Unfortunately it did not :-( Rg. Stefan > -----Original Message----- > From: Stefan A. [mailto:lists@saitc.de] > Sent: Tuesday, October 25, 2005 10:59 AM > To: 'FreeRadius users mailing list' > Subject: Issue an Access Challenge to retry password > > > > Gurus, > > I want to give the user a second chance to type his password > correctly by using a radius challenge. > I'm not sure how to do this and did not find anything about > this in the documentation nor in my stored email of this list. > > What should happen: > > The user tries to authenticate using his User-Name and Password. > The user makes a typo in the password. > The RADIUS Server will send an RADIUS Challenge, having a > Reply-Message 'Good Morning. Please retry your Password!' > The user retries... This time using the right password > The User will be granted access. > > How would I configure this in the user file? > > Any help or advice to a related part of the documentation > will be appreciated. > > Thank you. > Stefan >

1 0

Limiting Authentication Request on wrong password
by Fabio 25 Oct '05

25 Oct '05

Hi, is there an option to limit the number of Authentication Request of a user, if she uses a wrong password for x times? Thanks, Fabio

2 1

(no subject)
by Fabio 25 Oct '05

25 Oct '05

Hi, is there an option to limit the number of Authentication Request of a user, if she uses a wrong password for x times? Thanks, Fabio

1 0

AW: SUSPENSION OF ACCOUNT
by Marc.Werner＠t-systems.com 25 Oct '05

25 Oct '05

Hi, Perhaps you can write a shellscript which edits /etc/raddb/users ...it's just an idea. Cheers Marc -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von maruna Gesendet: Dienstag, 25. Oktober 2005 10:48 An: 'FreeRadius users mailing list' Betreff: SUSPENSION OF ACCOUNT Thank you all, I use FreeRadius v 1.0.5 with postgresql 7.3.4 on redhat Linux ES3 and its been working well. However, I want to create accounts where these accounts will be suspended after let say a month and this suspension continue until the account is renewed manually. Can someone give me idea of how this could be achieved? Thank you, goksie

1 0