May 2006 - Freeradius-Users - lists.freeradius.org

Storing in SQL, repeat Attributes
by Jackie Lau 02 May '06

02 May '06

Hi, I having a problem storing repeated Attributes in to a Microsoft Sql Database. My Start record gets logged like this: Acct-Status-Type = Start NAS-IP-Address = 127.0.0.254 NAS-Port = 5060 Acct-Session-Id = "D747CE74-A671-4C07-B583-EB44CA534966(a)10.10.1.139" Session-Ingress-CallId = "D747CE74-A671-4C07-B583-EB44CA534966(a)10.10.1.139" Session-Egress-CallId = "D747CE74-A671-4C07-B583-EB44CA534966(a)10.10.1.139" Session-Protocol-Type = "SIP" Calling-Station-Id = "Test" Called-Station-Id = "<sip:XXXXXXXXXX@127.102.0.117>" h323-setup-time = "18:01:42.091 UTC APR 28 2006" h323-connect-time = "18:01:42.119 UTC APR 28 2006" Session-Egress-Realm = "b11" Session-Ingress-Realm = "p11" FlowID = "localhost:65616" FlowType = "PCMA" Flow-In-Realm = "p11" Flow-In-Src-Addr = 0.0.0.0 Flow-In-Src-Port = 0 Flow-In-Dst-Addr = 10.2.35.117 Flow-In-Dst-Port = 49232 Flow-Out-Realm = "b11" Flow-Out-Src-Addr = 10.2.19.117 Flow-Out-Src-Port = 49232 Flow-Out-Dst-Addr = 0.0.0.0 Flow-Out-Dst-Port = 0 FlowID = "localhost:65617" FlowType = "PCMA" Flow-In-Realm = "b11" Flow-In-Src-Addr = 0.0.0.0 Flow-In-Src-Port = 0 Flow-In-Dst-Addr = 10.2.19.117 Flow-In-Dst-Port = 49232 Flow-Out-Realm = "p11" Flow-Out-Src-Addr = 10.2.35.117 Flow-Out-Src-Port = 49232 Flow-Out-Dst-Addr = 10.10.1.139 Flow-Out-Dst-Port = 49228 Client-IP-Address = 10.1.0.33 Acct-Unique-Session-Id = "bfbfead8e14980c1" Timestamp = 1146246538 Notice how the FlowID attribute is logged twice but have different values How do I reference the second occurance of FlowID i.e %{FlowID} in my SQL statement in my mssql.conf? I created two new columns in my sql database called FlowID1 and FlowID2. accounting_update_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, FlowID1, FlowID2) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{FlowID}', '%{FlowID}')"

2 1

RE: on the right track?
by Galloway, David Mr KRS 02 May '06

02 May '06

I just worked this out yesterday. Best way for me (I found) was to create two groups (one is pubnet-dialup the other is pubnet-extend) I set this in the /etc/raddb/users file # Authentication for pubnet-dialup group DEFAULT Auth-Type = System, Group == "pubnet-dialup" Fall-Through = 1 # authentication for pubnet-extend group DEFAULT Auth-Type = System, Group == "pubnet-extend" Fall-Through = 1 # Defaults for all framed connections. # # sets timeout for group "pubnet-dialup" DEFAULT Service-Type == Framed-User, Group == "pubnet-dialup" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 14400, Idle-Timeout = 1800, Fall-Through = Yes # Sets timeout for group "pubnet-extend" DEFAULT Service-Type == Framed-User, Group == "pubnet-extend" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 28800, Idle-Timeout = 1800, Fall-Through = Yes I authenticate against two groups. Then set the timeouts per each group (first is for 4 hours, second 8). Hope that helps. Regards, David Galloway Public Networks Administration KRS IT Network Operations Help Desk (805) 355-2444 Direct (805) 355-4512 -----Original Message----- From: freeradius-users-bounces+david.l.galloway=us.army.mil(a)lists.freeradius.org [mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradi us.org] On Behalf Of mbjohn(a)duke.edu Sent: Thursday, February 23, 2006 3:43 AM To: freeradius-users(a)lists.freeradius.org Subject: on the right track? Hello all! I've tried to search the web and the archives for an answer to this question and didn't come up with anything, so I hope I'm not duplicating a question that's already been answered. Currently, where I work, we run two modem pools. One pool is limited to certain users who are allowed to connect up to 8 hrs at a time. The other pool is for general users who are given 15 min to quickly check email or search for something on the web (fwiw, they're allowed to reconnect after their time is up....). As broadband has become more available, less and less users are using the modem pool. We still have a handful of people from both groups who are still using it. So, in the interest to provide the service for the people still using it while not paying for unused lines, we're trying to consolidate things. We have a Cisco AS5300 terminal server that already uses freeradius w/ kerberos to authenticate users. We would like to take that a step further and use freeradius to limit usage time based on the user name (certain users are allowed 8hrs while all others are given 15min). Looking over the config files in /etc/raddb, it appears the attrs file is just what I need to use. Would I be able to use a combination of huntgroups and the attrs file to accomplish what I need? I know in the documentation for the "fisp" entry, it talks about not having a Fall-Through entry. Does that mean it CANNOT have a Fall-Through entry, or that the given example does not? Am I on the right track with this, or should I look elsewhere? Thanks for your help! Brian - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

default vlan for ldap users
by Nuno Reis 02 May '06

02 May '06

Hi, Is there any way to make freeradius assign a vlan to any user that was authenticated using active directory database? Something like, freeradius asks active directory for user authenticity, and if accepted, freeradius forwards always the same tunnel-pvt-group-id to NAS. Thanks, Nuno Reis -- View this message in context: http://www.nabble.com/default-vlan-for-ldap-users-t1538508.html#a4179753 Sent from the FreeRadius - User forum at Nabble.com.

3 2

newbie authorization question
by Marisa Brandt 02 May '06

02 May '06

I have what I think is probably an ultra-basic question: I'm authenticating users via ldap; everything appears to be working perfectly. However, I'd like to restrict access to all users, EXCEPT for a few select groups. I'm clearly missing something really obvious, because I can't seem to figure out how to do that. Can someone help me out? Thanks very much, Marisa

2 1

eap-sim question
by Steven Krausman 02 May '06

02 May '06

I'm trying to configure a DEFAULT user setting to perform EAP-SIM. The default user setting is: DEFAULT: Auth-Type := EAP, EAP-Type := SIM, EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 When I run the freeRadius server, I get the following output: Rlm_eap: EAP Identity Rlm_eap: processing type sim Can not initial sim, no RAND1 attribute Where should the RAND1 attribute be configured? Thanks, Steve

1 0

c module
by kamanashisroy 02 May '06

02 May '06

Please tell me, how can i write a module of my own in c. Also, tell me how can i compile it and use with freeradius(also say the config file changes) -- View this message in context: http://www.nabble.com/c-module-t1532707.html#a4163751 Sent from the FreeRadius - User forum at Nabble.com.

2 1

Re: c module
by yao guoxian 02 May '06

02 May '06

>Please tell me, how can i write a module of my own in c. >Also, tell me how can i compile it and use with freeradius(also say the config file changes) I think you should edit and compile your own program code and get the final executable file, e.g your_own.exe. Then edit radiusd.conf , add your own 'exec' section such as : exec echo { wait = yes program = "/your_own.exe_path/your_own.exe %{argu1} %{augu2} ..." input_pairs = request output_pairs = reply } Finally, recomplie Freeradius.

1 0

New PHP for interface
by JasonN 01 May '06

01 May '06

I've have a set of new code for the PHP web-based interface to control users, specifically in relation to the MySQL and FreeRADIUS combo. These features are complete: add user[s] remove user[s] disable user[s] check user[s] password It is however clean PHP with straightforward readable code and is PHP4/5 compliant. Anyone interested in working on this new approach, please let me know. It's simple, nothing fancy, no frames, etc. in the HTML. And, it already works for the basic necessary features. I would like to see a few people code up some additional features. It works right now, as is, for most ISP needs. -- Please address your interest directly to me: imjasonn(a)gmail.com, so you don't get filtered to my FreeRADIUS box. You'll get quicker attention, since I don't read this list every day. -- Jason A. Nunnelley ---------------------------------------- http://www.jasonn.com/

4 4

FreeRADIUS, MySQL and usergroups
by Michael Schwartzkopff 01 May '06

01 May '06

Hi, I want to built a RADIUS system with a MySQL database to authenticate / authorize users. One group of the users should be allowed to use the internet and an other group shoud be allowed to use the RAS server to dial in. Of course some of the users can use both. Can I use user groups in MySQL and let FreeRADIUS ask for a membership in that group? How can I do this with FreeRADIUS / MySQL? Any hints are welcome. Thanks. Additionally: I read that SQUID can use a lot of AAA possibilities. I think PAM and the pam_radius module is the best solution. Any other suggestions? Thanks again. Sincerely, -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

1 0