August 2006 - Freeradius-Users - lists.freeradius.org

Passing Radius attribute to Cisco 7304
by John Williams 15 Aug '06

15 Aug '06

Hi all We’ve just upgraded to a Cisco 7304 from a Cisco 7204 and are seeing some problems -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.10.9/417 - Release Date: 11/08/2006

2 5

AAA Authentication in PIX using Freeradius
by ajay raut 15 Aug '06

15 Aug '06

Hi, I have implemented freeradius for PIX525 as a authentication server. Radius is running fine in authenticating users, who wants the console access of PIX. In AAA Authentication i have configured FALLTHROUGH for RADIUS as a LOCAL Database means whenever RADIUS service goes down authentication of PIX will taken care by Local database of PIX. That is also working fine except one problem, At the time of testing FALLTHROUGH , I stopped Radius service and try to authenticate PIX using Local Database that worked fine but when i again started the RADIUS service PIX is still taking authentication from LOCAL database. After 10 min. PIX succefully falling back on RADIUS for authentication that means there is atleast 10 min. of delay to again start the Authentciation from RADIUS in PIX. I have tried different IOS of PIX for this, still it is giving the same problem that means IOS of PIX is not the problem inthis case. Any input from the members of this list will be helpful for me as it is my last ray of hope now........ Thanks & Regards, Ajay --------------------------------- Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates starting at 1¢/min.

2 1

access reject replies
by Hasan Ovuc 15 Aug '06

15 Aug '06

Hello Members, I am using FR-1.0.1, unixODBC 2.2.11, Sybase ODBC-12_5 drivers on FC5. I have problem version of FR because of I couldn't upgrade it. New versions of FR does not send cisco attributes in access reject replies. I can only work with FR-1.0.1. I want to the attribute Cisco AVPair += -1 in access reject reply like below sample. Has anyone any thought ? Related setting in my sql.conf; authorize_reply_query = "EXEC ra_authentication_reply '%{SQL-User-Name}', '%{User-Password}', '%{Called-Station-Id}'" Return of Sample Query SQL> EXEC ra_authentication_reply 'A02165554149', '1', '' +------------+-------------------------------+-------------------------- ---------------+-----------------------------------------+---------+ | | | query_attribute | query_value | query_op| +------------+-------------------------------+-------------------------- ---------------+-----------------------------------------+---------+ | -1 | A02165554149 | Cisco-AVPair | h323-return-code=1 | += | +------------+-------------------------------+-------------------------- ---------------+-----------------------------------------+---------+ SQLRowCount returns 0 1 rows fetched SQL> Thank you, Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

4 3

Authorisation chaining
by Héctor Alberto Ortiz Barrón 15 Aug '06

15 Aug '06

(Hopefully this one will go through) Hi, I've been playing around with FreeRadius for a bit and was wondering if it is possible to have an authorisation chain, something like: My first Auth method is using certificates, if this method fails, try to auth using login/passwd with mysql, and if this second method fails, try using a script of my own, and if this very last method fails, then reject the client. By separate parts it works. I have one radiusd.conf file for certificates, another one for mysql and a last one for my script. The problem comes when I try to merge those methods. Right now I'm experimenting with MySQL + MySCRipt, then I provide random user/passwd in order to cause MySQL auth to fail and to grant access through my script. MySQL says "user not found", my script says "ok" and eap says "nope" and rejects. Is there a way to do this? Thanks in advance Cheers Hector

1 0

Limiting Bandwidth Usage !?!?
by Calode 15 Aug '06

15 Aug '06

1 0

Re: Does Freeradius support IAPP (802.11f)??
by David Mitton 15 Aug '06

15 Aug '06

IEEE 802.11f was a Recommended Practice (not a Standard) issued by IEEE Standards Association, 802.11 group. I know it was deprecated due to reading minutes of recent meetings, accessible to participants. They are the ones that maintain it's status. They have websites, but none dedicated to it in particular. http://standards.ieee.org/ http://grouper.ieee.org/groups/802/11/ You'll have to ask them, for "official" word. Dave. ----- Original Message ----- From: "zhu yunwu" To: "FreeRadius users mailing list" Subject: Re: Does Freeradius support IAPP (802.11f)?? Date: Mon, 14 Aug 2006 15:52:33 +0800 On 8/11/06, David Mitton <david(a)mitton.com> wrote: >One should be aware that 802.11f has been deprecated by the IEEE. >To use it requires support in all your Access Points and the RADIUS >server(s). Thank you very much. This information is very important for me. But would you please tell me where you get it or know about it? I want to get more detail informatioin about it from official website. (Woodland) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: read_groups in cvs
by Duane Cox 14 Aug '06

14 Aug '06

> > On the todo list for Monday, if additional debug output is needed. > > I wouldn't have asked for it if I didn't need it... > <debug radiusd -X> rad_recv: Access-Request packet from host 10.0.0.11 port 1145, id=104, length=56 User-Name = "dcox(a)illicom.net" User-Password = "XXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_realm: Looking up realm "illicom.net" for User-Name = "dcox(a)illicom.net" rlm_realm: Found realm "illicom.net" rlm_realm: Adding Stripped-User-Name = "dcox" rlm_realm: Proxying request from user dcox to realm illicom.net rlm_realm: Adding Realm = "illicom.net" rlm_realm: Authentication realm is LOCAL. rlm_realm: Request already proxied. Ignoring. radius_xlat: 'dcox' radius_xlat: 'dcox' rlm_sql (sql): sql_set_user escaped user --> 'dcox' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'select id, username, attribute, value, op from radcheck where username = 'dcox' order by id' rlm_sql (sql): User found in radcheck table radius_xlat: 'select id, username, attribute, value, op from radreply where username = 'dcox' order by id' rlm_sql (sql): Released sql socket id: 7 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1 rlm_pap: login attempt with password eldon rlm_pap: Using clear text password. rlm_pap: User authenticated succesfully modcall: group PAP returns ok for request 1 Login OK: [dcox(a)illicom.net] (from client webclient port 0) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'dcox' rlm_sql (sql): sql_set_user escaped user --> 'dcox' radius_xlat: Running registered xlat function of module config for string 'client[%{Packet-Src-IP-Address}].shortname' radius_xlat: 'client[10.0.0.11]' radius_xlat: 'exec radpostauth 'dcox(a)illicom.net', 'XXX', 'Access-Accept', '10.0.0.11', '', '', '', '', '', 'webclient'' rlm_sql (sql) in sql_postauth: query is exec radpostauth 'dcox(a)illicom.net', 'XXX', 'Access-Accept', '10.0.0.11', '', '', '', '', '', 'webclient' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 104 to 10.0.0.11 port 1145 Service-Type = Authenticate-Only Session-Timeout = 86400 Finished request 1 Going to the next request > > > But I am using a recent (-7 days ago) cvs checkout of 2.0.0pre0 > > > > I don't have any debug output right now, but it's rather obvious to > > me that the server doesn't process the radcheckgroup / > > radreplygroup in rlm_sql unless the fall-through = yes is found in > > the radreply for the user, which contradicts the docs (3d) as > > posted below. > > That's all well and good, but I need the debug output to see *what* > the server is doing for/to you and *why* its doing it, especially if > you want *me* to fix it... > > > > Meanwhile, I have set the fall-through = yes during the radreply > > for now to get it to process the groups... > > Make sure your debug output is *without* having "Fall-Through" set in > radreply. done as requested. > > > --Mike

1 0

assign a value to an attribute via a script
by Philippe Bacquaert 14 Aug '06

14 Aug '06

Hello, I'm searching how to use a script to modify the value of an attribute. When I try the example of radiusd.conf : Attribute-Name = `%{echo:/path/to/program args}` In my test I try to use a script to assign an IP address to the Attribute Framed-IP-Address : Framed-IP-Address = `%{dhcp:/etc/raddb/test %{User-Name} %{NAS-IP-Address}}` I've added this in the accounting module with the same result as I want to fic this value in the attribute Framed-IP-Address during the time of an active accounting session. I've created an exec module : exec dhcp { wait = yes input_pairs = request output_pairs = reply packet_type = Access-Accept } I get an error message when I try to start : ERROR: Cannot find a configuration entry for module "Framed-IP-Address". The rest of the radiusd.conf configuration is pointing to a MySQL database and works well. I've tested successfully the script itself alone in the echo module configuration : program = "/var/log/radius/test %{User-Name} %{NAS-IP-Address}" What am I doing wrong ? Is something missing ? Sincerely, Philippe BACQUAERT Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34 /mn) ; tél : 08 92 68 13 50 (0,34/mn)

3 2

Managing connection on Freeradius
by Nataniel Klug 14 Aug '06

14 Aug '06

Hello all, I am quite new to freeradius and I am with a doubt. I have a PPPoE-Server that authenticate the users into my FreeRadius server. The problem is that if a client, by some reason, get lost of connection the freeradius mantain the log about that connection and, if the client try to connect again, it say that siomultaneos use is not allowed. So I have to delete radutmp and radwtmp, restart radius, and lost the track of connections. There is any tool to make it easier? Or some configuration that if there is no package coming from the cliente for 60 seconds it will disconect the client? Att, Nataniel Klug

3 5

Freeradius and prepaid extension
by deborah malka 14 Aug '06

14 Aug '06

Hello all, I have heard about Freeradius, that it is a very powerfull server. Thank you to all for the work you have done !! I need a Radius server to perform prepaid VOIP telephony. For that the server must implement the RFCs 2865, 2866, 3539, and the extension for Prepaid follows the specifications : X.S0011-005-C and X.S0011-006-C. Does Freeradius implements all this ? I need these informations, because I have to install a platform demo, so if someone can help me ... thank you so much by advance. Deborah ================= Déborah Malka --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

6 11