November 2006 - Freeradius-Users - lists.freeradius.org

Filtering strange character sequences out of usernames
by Barry A Byrne 21 Nov '06

21 Nov '06

Hello The user names arriving at Freeradius from the server has strange character sequences in them. For instance, the user's realm starts with =3D28 Is there a way of filtering out or converting these sequences to something human-readable? Thank you Barry Barry A Byrne Network Applications and Public Services Cable & Wireless Direct Dial: +44 (0) 1344 812046 Mobile: +44 (0) 7900 164 620 Switchboard: +44 (0) 20 7206 5555 <http://www.cw.com/> www.cw.com

2 1

LDAP and SQL
by Tobias Hug 21 Nov '06

21 Nov '06

I'm authenticating wireless users with freeradius against an os x ldap server. This works all well. But I also want to check if the device (mac address) is allowed to connect. How do I configure Freeradius to Authenticate Users against ldap and check the mac address in an SQL-Database? Thanks Tobias

2 1

distinction between users on different AP (talking to the same radius server)
by liran tal 21 Nov '06

21 Nov '06

Hey everyone, I was just wondering for your opinion on this issue- I want to spread several access points in different locations (they all talk to a central radius) and then i want to distinct one location from another for example user foo can login from either location but id like to make the distinction from which ap he got connected from... whats the best way to do that? I was thinking of one method which is to configure in each AP a different subnet mask for the DHCP allocations and then make the distinction based on that but I'm looking for a more elegant way. Thanks guys, Liran.

3 5

Re: huntgroups question
by Michael Mitchell 21 Nov '06

21 Nov '06

Frank Cusack wrote: > On November 21, 2006 8:48:30 AM +1100 Michael Mitchell wrote: > >> >> dial Client-IP-Address =~ 192.168.1..* >> dsl Client-IP-Address =~ 192.168.2..* > > > > warning, the first of those captures 100 /24's, the second 56 /24's. > Ahh yes, so it does. Thanks for pointing that out Frank! But the example still stands, you can do regular expressions in the huntgroups file - just be careful with your regular expressions. :) cheers, Mike

1 0

Re: huntgroups question
by Michael Mitchell 20 Nov '06

20 Nov '06

Alexandru Dincov wrote: > knows if there are any limitations in huntgroups size? Are there other > solutions to have huntgroups functionality (access control based on > NAS-IP-Address or Client-IP-Address) using IP address ranges? Hi Alex, You can do regular expression matches in the huntgroups file. For example: dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..* Maybe that can get you close to what you want? Oh and by the way, these types of questions should be asked on the FreeRADIUS Users list. cheers, Mike

2 1

multiple entries with same user name in radcheck table
by Sri 20 Nov '06

20 Nov '06

Hi List, Happy Thanks Giving, I need to add two users with same name, from different NASes/stations. I added the two groups for them in usergroup and corresponding entries in radcheck and radreply tables. So they look like this: usergroup: ----------------------------------- 1 Ronrobert dialup 2 Ronrobert conference ----------------------------------- radcheck ---------------------------------------- 1 Ronrobert Password == value 2 Ronrobert Password == value2 ---------------------------------------- radreply --------------------------------------------- 1 Ronrobert Reply-Message := value1 2 Ronrobert Reply-Message := value2 . . . ---------------------------------------------- But the authentication failed for both users as FR not able identify which user to consider? Can anybody pls tell me any way to address this problem? Thanks in advance. ____________________________________________________________________________________ Sponsored Link $200,000 mortgage for $660/ mo - 30/15 yr fixed, reduce debt - http://yahoo.ratemarketplace.com

1 0

Re: huntgroups question
by Alan DeKok 20 Nov '06

20 Nov '06

Frank Cusack wrote: ... >> dial Client-IP-Address =~ 192.168.1..* >> dsl Client-IP-Address =~ 192.168.2..* > > warning, the first of those captures 100 /24's, the second 56 /24's. dial Client-IP-Address =~ '192\.168\.1\..*' The backslashes can make a big difference. And note the single quotes, too. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Help needed on FreeRadius SQLCounter
by sagar.patil＠bt.com 20 Nov '06

20 Nov '06

Hi All, I have got sqlcounters working with mysql database. I want to sell 15 mins, 30 mins, 1 hour, 2 hour vouchers and I want Freeradius to lock all users who even use 1 min of their voucher time every 24 hours. The vouchers are valid only for 24 hours after logging into network first time. The current options for reset= never & daily which don't work for me. Daily= Will reset midnight and allow user to login next day Never = Will allow user to use time forever until he exceeds "session-timeout" value. Thanks, Sagar

3 2

huntgroups question
by Alexandru Dincov 20 Nov '06

20 Nov '06

Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks, Alex

2 1

RLM Perl cache problem?
by david.suarezdelis＠telefonica.es 20 Nov '06

20 Nov '06

Greetings, I have freeradius 1.3.0 running on GNU/Linux 3.1 using rlm_perl with ithreads without problem (and it works nicely, well done!). The authenticate() sub returns a "Framed-Ip-Address" and a "Framed-Ip-Netmask" through the %RAD_REPLY hash, and, sometimes (when the NAS is adecuate, and depending on user, group and so on), a "Class" attribute as well. I have observed that once I have returned a Class attribute, though, it keeps getting sent by FreeRadius even when my authenticate() sub is not assigning to it. The behavior is like if it was cached somewhere... If I restart FreeRadius, though, the attribute is not sent, until I send one, and then it starts being sent again, even if I modify the data so it's not sent (my own traces and the rlm_perl traces: "adding AV pair..." confirm that Class is not being assigned). I have tried to delete() the %RAD_REPLY hash keys when the function gets called, so I always start with a fresh one, but it's not working either. Before doing further testing, though, undefining the keys values, and so on, I'd like to ask if anyone is having this behavior, if it's the expected one, and how can I correct it (because connections are rejected by the NAS when Class is assigned when it shouldn't). Thanks for you help, david PS- aditionally, is there an updated rlm_perl manual specifying what section it loads is for, and how to use the shared memory to set up db pools and cached results for making things easier before each forking? thanks! ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

2 1