September 2006 - Freeradius-Users - lists.freeradius.org

Deny user based on MAC-address
by Torkel Mathisen 02 Oct '06

02 Oct '06

Hi, How can I deny a user from freeradius based on the MAC-address on the PC? I use users file only. Do I need MAC Authentication for that ? Regards, Torkel

3 2

help with undocumented attributes
by Andrew Long 02 Oct '06

02 Oct '06

Hello freeradius-users, I am working with an inherited system (freeradius 0.9.0 on RH). The system is running but as a new user/admin I am having trouble getting info on the actual setup. I do 'rpm -qv freeradius' and it returns freeradius is not installed, yet it IS. /usr/local/etc/raddb is populated, as is /usr/local/share/freeradius. How can I get info on the running version? Also, I am having trouble finding info on attributes that do not seem to be documented which limit some of our user's sessions. Examples are 'Max-Acct-Age', 'Max-Daily-Session', and 'Check-Login-Day'. I need to get a better understanding of how this session management is done. Good documentation on the web seems hard to come by. Any help most appreciated. -- Regards, Andrew Long

4 5

prevent roaming configuration question
by isidoros 02 Oct '06

02 Oct '06

Hello everybody, I have a configuration question. How would I have to set up the following configuration NAS1 with users X,Y,Z NAS2 with users A,B,C one central radius server Goal: users X,Y,Z should only be authenticated on NAS1 and not on NAS2 or any other nas users A,B,C should only be authenticated on NAS2 and not on NAS1 or any other nas etc My best guess would be tho tweak the auth_query in the sql.conf any idea's thanks

2 7

rlm_perl behaviour
by Garber, Neal 02 Oct '06

02 Oct '06

When I call a perl module via rlm_perl and don't undef %RAD_CHECK and %RAD_REPLY before exiting, rlm_perl duplicates some attributes contained within the hashes. For instance: At entry to rlm_perl instance: $RAD_CHECK{'Ldap-Group'} is an ARRAY: (GroupA, GroupB) After exiting the script, "Added pair Ldap-Group..." messages appear in debug output. If I call another perl script to dump the %RAD_CHECK hash, it shows: $RAD_CHECK{'Ldap-Group' } is an ARRAY: (GroupA, GroupB, GroupA, GroupB) If I "undef %RAD_CHECK" before exiting from the first perl module, the values are not duplicated. I did some analysis of the sequence of events and I believe this is what's happening: - rlm_ldap creates the Ldap-Group attributes on the check list with operator T_OP_CMP_EQ during authorize (Ldap-Group is a checkItem in my ldap.attrmap) - upon return from the perl script, rlm_perl calls pairmove to move the attributes from the RAD_CHECK, RAD_REPLY and RAD_PROXY_REPLY hashes back to the respective pairlist. - pairmove adds attributes to the destination list for operator T_OP_CMP_EQ (takes default case) which creates duplicates Is this expected behaviour of rlm_perl? If so, can it be put on the "to do" list for rlm_perl documentation updates (or is it there already and I missed it)? Also, this seems to imply that it's not possible to change or remove, at least, some types of check or reply attributes from within rlm_perl? Also, the wiki for rlm_perl states that it passes configuration pairs in %RAD_CONFIG. I don't believe this is true (the hash is empty and I checked the source for 1.1.2, 1.1.3 and the latest snapshot and it doesn't create that hash). Is this a feature that is "in the works" or is the wiki incorrect? I can supply debug output, radiusd.conf and scripts if necessary.. Thanks.

2 1

repeat until success?
by Proft, Michael 30 Sep '06

30 Sep '06

Hi, is it possible to configure freeradius to do something like "repeat until success". Im trying to authenticate local users at the same system freeradius is running on and I proxy requests to another radius server. I want to do this _without_ using realms. So if asking for local user and no success I want to continue proxying requests to another radius server. Is this possible in some way? Thanks for any advice Michael

4 6

Re:Re: Questions about latest CVS
by 高嵩 30 Sep '06

30 Sep '06

Hi,all >> Does the radiusd server listen on IPv6 address by default? >No. You have to configure it. Could you tell me how to configure it listen on IPv6 address? >> How to use the radclient in Ipv6 ? >Send the request to an IPv6 address? Yes,send the request to the Radius server listening on IPv6 address. Thank you very much.

2 1

Small Linux- Minimal Instalation
by opaniagu＠yahoo.com.ar 30 Sep '06

30 Sep '06

Hi, some body know same samall linux distro, for instante, one that a keep and start on usb pendrive only with freeradius? I want to use it, like as router distros (they are very small). Thanks __________________________________________________ Preguntá. Respondé. Descubrí. Todo lo que querías saber, y lo que ni imaginabas, está en Yahoo! Respuestas (Beta). ¡Probalo ya! http://www.yahoo.com.ar/respuestas

1 0

Re: Accounting Stopped
by sean＠swarmhotspots.com 29 Sep '06

29 Sep '06

Hi Alan, Thanks for taking the time to respond. I've already fixed the problem. It only took a bit of lateral thinking. The ADSL modem wasn't exchanging any information on port 1813. For the life of me I can't understand how it could re-boot and only loose a bit of it's setup. It would have been much better if it had lost everything. I wasted the best part of a week testing syslogd, reinstalling FreeRadius, MySQL and setting up a new test server. Anyway, once again thanks. I really appreciate the time and effort you take to give support to end users. Regards, Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Login-Time and Session-Time Conflict
by Adam Tybor 29 Sep '06

29 Sep '06

We are using both Login-Time and Session-Time attributes with a rlm_sql configuration and the Login-Time attribute is always overriding the Session-Time. Meaning that if the Session-Time attribute value is less than the timeSpan difference of the Login-Time, the Login-Time timespan difference is still returned as the Session-Time value. I remember reading somewhere that in cases of both attributes being used, the most restrictive should be returned, however this is not happening. Can someone confirm what the real implementation is? We are running freeradius 1.1.1 on a Gentoo linux platform. BTW -- If this is the desired functionality does anyone know a way to get our desired functionality of the smallest Session-Time being used instead of Login-Time? Thank you, Adam

2 3

VSA and other attributes in Access-Accept
by Mohammed Petiwala 29 Sep '06

29 Sep '06

Hi: Could anyone please provide me some advice on my question below. Currently I am seeing VSAs in my reply messages from freeRADIUS being passed in Access-Accept, Access-Challenge. I would like to limit certain VSAs to only Accepts, or Challenge. Is this possible - because according to the RFCs for 3GPP/3GPP2 only some of them are possible in certain type of responses. Thx. Regards, Mohammed. Date: Thu, 30 Mar 2006 14:06:02 -0800 (PST) From: Mohammed Petiwala <mhpetiwala(a)yahoo.com> Subject: VSA and other attributes in Access-Accept To: freeradius-users(a)lists.freeradius.org Hi: First thanks to the freeRADIUS team - this is one of the most flexibile and powerful AAA available... I've 2 questions: 1. I've set up my clients to authenticate using EAP-TTLS with MSCHAPv2 as the inner authentication protocol. This works fine with the wpa_suppicant with intel 2200b/g as well as the Cisco Aironet 350. I've created my own dictionary file with VSAs that are useful for my NAS once Access-Accept is returned. The 'users' file has the VSAs Attrib = Value listed after each user entry and I do see the attributes being returned correctly on Access-Accept. My question is (please correct me if I am wrong) - I see the VSAs being returned during the intermediate Access-Challenge messages too even before authentication is complete. Is this the normal behavior, is there a way to setup the freeRADIUS server so that the VSAs are only returned on Access-Accept and not during the Access-Challenge. The NAS does ignore the VSAs in any case during the challenge - but would be good if there was a way to limit the message size for the Access-Challenge messages (only if this is valid from RADIUS RFC perspective - if someone could clarify). 2. How can I set users in the 'users' file (an example would be very helpful if someone can send) so that some users are only allowed to authenticate using EAP-TTLS while others are only allowed to use PEAP. Once I create an entry into the users file (and both authentications are EAP types) - the user can authenticate using any eap type - I would like to limit this per user. Is it possible?? Thx. Regards, Mohammed. --------------------------------- All-new Yahoo! Mail - Fire up a more powerful email and get things done faster.

1 0