April 2006 - Freeradius-Users - lists.freeradius.org

external ldap with cisco-avpair
by Nuno Reis 28 Apr '06

28 Apr '06

Hi, I use freeradius for wireless authentication, for several ssids. I have the following config on the users.config: USER User-Password == "******" Service-Type = Shell-User, cisco-avpair = "shell:priv-lvl=15", cisco-avpair+= "ssid=wifi1", cisco-avpair+= "ssid=wifi2", cisco-avpair+= "ssid=wifi3" This config permits a single sign-on solution, using the same database for wireless authencation and administrative rights. Now I want to make a integration with an external ldap, for example, active directory, however I dont have a clue how to preserve the cisco-avpairs. Should be the ldap to send it to the freeradius on every authentication request? -- View this message in context: http://www.nabble.com/external-ldap-with-cisco-avpair-t1525517.html#a4143540 Sent from the FreeRadius - User forum at Nabble.com.

2 1

Re: prepaid cards
by Sean 28 Apr '06

28 Apr '06

Hi Morder, Why don't you create a page that allows your users to change their username and password themselves. This would be very easy to do with PHP. For example a user logs on to your site with his PIN code and password and you present him/her with an option to change his details. By the way if your users are using cell/mobile phones you could add to the security by sending an SMS message that includes a confirmation code that they would need to complete the update. Regards, Sean http://swarmhotspots.com > Thanks Yves but i tried phpmyprepaid and it is a hackof dialup admin and not > realy stable , what i want is a way to let the user to be able to change his > pin code to a username for example : from 15478855 -> mark password :Zx43ed > -> stealit > > pin and password are stored in the database > > any ideas? > thanks > On 4/27/06, YvesDM <ydmlog(a)gmail.com> wrote: > > > > > > > > On 4/27/06, Mordor Networks <mordor.networks(a)gmail.com> wrote: > > > > > Hi > > i want to make prepaid system for my dialup users ex: username : 15789546 > > password 123456 > > How i can make freeradius change the pin code to a valid username in my > > database ? > > i use mysql as a backend for my radius > > ppp/pppoe > > and dialup admin > > thank u > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > Well there is something out there called phpmyprepaid which is made for > > that purpose. > > I have no experience with it, but maybe you can give it a try. > > > > Yves > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > >

2 1

dual-streaming interim accounting for high volume
by Tariq Rashid 28 Apr '06

28 Apr '06

hi, under high load, we are familiar with the usual problem of dropped accounting packets. this leads to retires and timeouts and possible "marked dead", either by the NAS or intermediate radius proxies. this problem is particularly pronounced when a proxy used to sent traffic to multiple home servers, one of which is slow/unresponsive. this can lead to that proxy as being seen as "dead" by many NASes. a solution would be to split the accounting radius flow, such that the proxy or other freeradius server replies immediately with an acknowledgement to the NAS, and then forwards the packet onto the target home server, not necessariy waiting for a response. a more intelligent approach may fast reply with cached replies such that rejects can be effective. illustrated: 1. [NAS] ---> acct ---> [proxy] 2. [NAS] <--- acct <--- [proxy] ----> acct ---> [target radius server] is this possible, or likely to be possible with freeradius? i know about a mechanism which uses a second process to tail the radius accounting log files, but this is fragile and prone to inconsistencies. tariq

2 1

send detail log to syslog server?
by Maqbool Hashim 28 Apr '06

28 Apr '06

Hi, Is it possible to get freeradius to send detail log data to a syslog server? Thanks

2 1

mysql replication vs. radrelay
by Olaf Schäfer 28 Apr '06

28 Apr '06

hello, I have a redundant radius server setup with two radius servers. On each of the servers freeradius 1.1.1 and mysql is running. If the primary server goes down the AC falls back to the secondary server. To keep the databases (except the radacct table) synchronised I use MySQL replication. But I'm not sure which is the best way to replicate the accounting information: using radrelay or mysql-replication, too? Besides the man page for radrelay says "The functions of radrelay have been added to radiusd". I couldn't find any documentation about this feature. Any hints? regards, olaf -- Olaf Schäfer <olaf.schaefer(a)gmx.com>

6 15

prepaid cards
by Mordor Networks 28 Apr '06

28 Apr '06

Hi i want to make prepaid system for my dialup users ex: username : 15789546 password 123456 How i can make freeradius change the pin code to a valid username in my database ? i use mysql as a backend for my radius ppp/pppoe and dialup admin thank u

3 3

freeradius and 2 ldap servers
by Terry J Fike Jr 28 Apr '06

28 Apr '06

Okay, i'm probably being a little dense here but just wanted to check i'm understanding this correctly. if i'm running 2 ldap servers; in the users file, do i need a default entry for each ldap server? for example: moving from a line like this with a single ldap server: DEFAULT Huntgroup-Name == People, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=People,dc=mtaonline,dc=net` Fall-Through = no to two lines like this: DEFAULT Huntgroup-Name == People, Ldap_primary-Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=People,dc=mtaonline,dc=net` Fall-Through = no DEFAULT Huntgroup-Name == People, Ldap_secondary-Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=People,dc=mtaonline,dc=net` Fall-Through = no assuming your ldap instatiations are ldap_primary and ldap_secondary respectively. thanks in advance t- -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

wiki config examples
by Lewis Bergman 27 Apr '06

27 Apr '06

http://wiki.freeradius.org/index.php/Examples The above link is something I added to the wiki the other night. I put just a couple of meager configs in there. It seems most questions are about config so I thought if we loaded that up just maybe the same questions wouldn't be asked over and over or at least we can say, "see the wiki". -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-3301 Cell 325-439-0533 fax 325-695-6841

1 0

EAP-TLS Computercertfikate First Request failes second successfull??? DHCP renew after User-Authorisation wount work??
by Krämer Armin 27 Apr '06

27 Apr '06

Hi, im still trying to get to work EAP-TLS on my LAN with Computer AND Client Certifikates. OK the certificates work fine now. Here a little scenario of what I did. Freeradius Version out from Debian Stable with TLS Patch (version must be 0.7 or something like that) Kofigured EAP-TLS(working) OpenLDAP as Userbackend to set the VLAN-ID TinyCA generated CA and Certifikates My final state should be that te machine boots up,authenticate with machine zertifikate against freeradius and openldap, getting vlan id from ldap, getting thrown into an default vlan where a dc an dhcp server is present, getting a ip from the subnet of this vlan. Then the User logs onto the domain Reautheticate with User Certifikate, getting new an final VLAN-ID from LDAP for this User, getting thrown into this vlan, requesting for an new IP from DHCP for this VLAN. OK the whole scenario is working with 2 issuses: First time the machine authenticates to freeradius the authentication fails, then it takes nearly 30 seconds till a second reauthentication is invoked and the the machine authentication is successful ???(How can this be??) I read about this should be an issue from XP-Client. How can I solve this??? The second thing is that I have to set this (HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global\Suppl icantMode) Key to the value of 3 causing XP to reauthentifikate with the User Certifikate again after logon. Otherwise the machine does no reauthentifikation with the usercertificate. My Problem ist that after the Usercertifikate is accepted and the user is thrown into his final vlan no new dhcp request ist invoked??? If I manually reauthentifikate the port over the Switch Administration the Machine requests an new IP from DHCP and all seems to be fine. But I have to do this manually and that issn really practical. Would be nice if anyone has got an idea for my problem? Maybe an newer Freeradius fixes this problems??? Any experiences about that?? Thanks Armin

1 0

FreeRADIUS and SIP-AVP
by Helge Waastad 27 Apr '06

27 Apr '06

Hi, I was just wondering if it is possible to return an attribute more than once in a RADIUS reply? I.e, for OpenSER I for instance would like to return: SIP-AVP="rpid:1234567" SIP-AVP="voicemail:8888888" I've tried to use rlm_perl and script to add SIP-AVP more than once, but FreeRADIUS only uses one. br hw -- Helge Waastad Senior Konsulent Smartnet

3 3