December 2008 - Freeradius-Users - lists.freeradius.org

Sending Accounting Response
by Padam J Singh 17 Dec '08

17 Dec '08

3 9

FreeRADIUS + WiMAX + Authentication
by Kristoffer Milligan 17 Dec '08

17 Dec '08

Hello I'm trying to set up FreeRADIUS as a AAA for an Alvaristar ASN gateway. My current setup is this: CPE (Client) <-> WiMAX radiolink <-> Basestation <-> ASN GW <-> AAA Traffic is successfully traveling from one end to the other, and authentication is seemingly correct, but the CPE still doesn't connect for some reason. At this url is the logfile of the AAA server start, and the connection process: http://multigan.com/log.txt To me, it seems that the login is successful. What does raise a question though, is this line: Info: [wimax] No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys. Is this correct behavior, or ? Also, any ideas to why the CPE doesn't associate after (apparently) receiving a valid login? Sincerely, Kristoffer Milligan

2 2

Radrelay
by lreeves 17 Dec '08

17 Dec '08

I found FreeRadius 2.1.1 very easy to setup for authentication however, I am experiencing problems in setting up the accounting with 2 servers. Radrelay was very simple and although I have found lots of information on the radrelay function built in to FreeRadius, I have not been able to get it working. Is there a shortcut, Howto or instructions on what files need to be changed to get the detail files to match on 2 servers? Thanks Larry Reeves lreeves(a)heartoftn.net

5 6

Working config file for data counter.
by Marcel Grandemange 16 Dec '08

16 Dec '08

Good Day. I am still struggling to get a working solution with freeradius and mysql as backend. What im trying to do simply is have the radius server use data counters instead of time counters. I want to limit a users collective data to amounts of 1gb,2gb,3gb, all the way up. And it must be resset on the first of the month. I have tried many versions of freeradius with many different queries and methods and there is ALWAYS something that doesn't seem to work properly. With Freeradius 2.1.3 I cannot use anything above 4gb, although I followed instructions on wiki to the tee for overcoming the wrapping problem. (wiki was outdated, but still tried) With 1.1.7 I think it was I would simply get arratic responses. Sometimes worked fine with up to 8gb tested, the next month it wouldn't. 2gb limits would also only sometimes work. The only one that was consistant was the 1gb option. Now ive tried so many methods, versions , tricks and wiki's and docs.. It's been years and still I cannot get it working correctly. There is a bit of a lack of docs on what I would like to do and ive come to the conclusion that if I could see someone elses working config for this sort of setup I could deduce where im going wrong. Thank You!

2 1

Re: FreeRADIUS vs Aradial RADIUS
by Aldo Zavala 16 Dec '08

16 Dec '08

Thanks for the input Alan, definitely I am sure FreeRADIUS is much better...what can be better than thousand of users, open source, free, and feature rich as itself... I apologize to all for the Subject of my inquiry, I wanted somebody to have tested Aradial and FreeRADIUS and tell me how professional can be this "Aradial". I am like scared because I am about to deploy a RADIUS AAA server in my network, and I was looking into commercial options... such as: Huawei: $500,000 DLLS (yes... DAMN!) Juniper: $100,000 DLLS ( !!! )... and here is FreeRADIUS... but I have no idea how to configure it... it like scares me because there are no manual to tell me step by step how to configure it to fit my needs and to feet my equipment.... I am in a cellular network (CDMA2000), I need to create two domains in AAA, one for EVDO and other internet services, the other for MMSC services, In order to have the capability of adding different subscribers in AAA under different domains, that way we can bill MMS and EVDO as separate services. I downloaded the FreeRADIUS mysql port in one FreeBSD box, I have no idea how to start configuring it there are many .conf files, and each config file is huge..., you told me in another reply that I have to configure FreeRADIUS to respond with the correct attributes that are needed by the PDSN, how can I know that? The Huawei PDSN documentation I have only tells how to configure the NAS with the "Huawei AAA" and dont say much about attributes.... can please tell what you mean with "attributes that are needed by PDSN?" what are those attributes and what they does? This is the relevant part of the PDSN config that I think is related to RADIUS: [conf] # interface Piif3/0/0 ip address 192.168.1.2 255.255.255.255 # interface Rpif3/0/0 ip address 192.168.1.1 255.255.255.255 # a11 enable pcf 192.168.0.200 192.168.1.1 256 skey 1234567891234567 # construct domain huawei domain enable domain AAAclientsig 1 domain address-group huawei 0 0 10.0.0.51 50 domain dns huawei 0 209.145.204.26 bip 209.145.204.20 # charge enable weekday 6 1 weekday 5 0 weekday 4 0 weekday 3 0 weekday 2 0 weekday 1 0 weekday 0 1 # [/conf] Thanks, Aldo Zavala Mobile (760) 556-5050 GTalk: aldo.zavala(a)gmail.com ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Mon, 15 Dec 2008 13:08:36 -0700 Subject: Freeradius-Users Digest, Vol 44, Issue 82 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Attributes Bandwidth in radgrouprepy table (tnt(a)kalik.net) > 2. Re: MAC Auth (new problem) (tnt(a)kalik.net) > 3. Re: calling-station-id filtering with checkval (tnt(a)kalik.net) > 4. Re: calling-station-id filtering with checkval (tnt(a)kalik.net) > 5. Re: MAC Auth (new problem) (Nataniel Klug) > 6. Re: FreeRADIUS vs Aradial RADIUS (Alan DeKok) > 7. Re: Somewhat OT: Captive portal on acess points instead > complex?supplicant at level end user? (Alexander Clouter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 Dec 2008 19:36:48 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Attributes Bandwidth in radgrouprepy table > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <Y0HT6pSa.1229366208.9737470.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >[sql] expand: SELECT id, username, attribute, value, op FROM radcheck > >WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, > >attribute, value, op FROM radcheck WHERE username = > >'pepe(a)dominio.com' ORDER BY id > >WARNING: Found User-Password == "...". > >WARNING: Are you sure you don't mean Cleartext-Password? > >WARNING: See "man rlm_pap" for more information. > > Fix that. > > >[sql] User found in radcheck table > >rlm_sql (sql): Released sql socket id: 4 > >++[sql] returns ok > > > > And what happened to authorize_reply_query? It would be helpful to see > part of the server startup debug where sql module is instatiated. > > Ivan Kalik > Kalik Informatika ISP > > >It's checking the query in radcheck but not in radgroupreply. And I've > >tested the query in dialup.conf and seems correct > > > > authorize_group_reply_query = "SELECT ${groupreply_table}.id, > >${groupreply_table}.GroupName,${groupreply_table}.Attribute, > >${groupreply_table}.Value,${groupreply_table}.op FROM > >${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username > >= '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = > >${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id" > > > >Thanks in advance > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > Message: 2 > Date: Mon, 15 Dec 2008 19:45:40 +0100 > From: <tnt(a)kalik.net> > Subject: Re: MAC Auth (new problem) > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <hGU36snT.1229366740.7674820.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >Ready to process requests. > >rad_recv: Access-Request packet from host 172.30.0.165 port 6001, id=3, > >length=69 > > User-Name = "00:19:79:0F:98:3D" > > User-Password = "cnett1298" > > NAS-IP-Address = 172.30.0.165 > > NAS-Port = 0 > >server proxim { > >+- entering group authorize {...} > >++[preprocess] returns ok > >[suffix] No '@' in User-Name = "00:19:79:0F:98:3D", looking up realm NULL > >[suffix] No such realm "NULL" > >++[suffix] returns noop > >[sql_ap2000] expand: %{User-Name} -> 00:19:79:0F:98:3D > >[sql_ap2000] sql_set_user escaped user --> '00:19:79:0F:98:3D' > >rlm_sql (sql_ap2000): Reserving sql socket id: 4 > >[sql_ap2000] expand: SELECT id, username, attribute, value, > >op FROM radcheck WHERE value = > >'%{SQL-User-Name}' ORDER BY id -> SELECT id, username, > >attribute, value, op FROM radcheck WHERE value = > >'00:19:79:0F:98:3D' ORDER BY id > >[sql_ap2000] expand: SELECT groupname FROM > >usergroup WHERE username = '%{SQL-User-Name}' ORDER > >BY priority -> SELECT groupname FROM usergroup WHERE > >username = '00:19:79:0F:98:3D' ORDER BY priority > >rlm_sql (sql_ap2000): Released sql socket id: 4 > >[sql_ap2000] User 00:19:79:0F:98:3D not found > >++[sql_ap2000] returns notfound > >++[expiration] returns noop > >++[logintime] returns noop > >[pap] WARNING! No "known good" password found for the user. > >Authentication may fail because of this. > >++[pap] returns noop > >No authenticate method (Auth-Type) configuration found for the request: > >Rejecting the user > >Failed to authenticate the user. > >Login incorrect: [00:19:79:0F:98:3D/cnett1298] (from client ap2000 port 0) > >} # server proxim > >Delaying reject of request 0 for 1 seconds > >Going to the next request > >Waking up in 0.9 seconds. > >Sending delayed reject for request 0 > >Sending Access-Reject of id 3 to 172.30.0.165 port 6001 > >Waking up in 4.9 seconds. > >Cleaning up request 0 ID 3 with timestamp +29 > >Ready to process requests. > > > > This user (MAC) exists and its in radcheck like this: > > > >mysql> SELECT * FROM radcheck WHERE Username="marmatec"; > >+------+----------+--------------------+----+-------------------+--------+------+ > >| id | UserName | Attribute | op | Value | numero > >| obs | > >+------+----------+--------------------+----+-------------------+--------+------+ > >| 796 | marmatec | Cleartext-Password | := | 654321 | 00923 > >| | > >| 1886 | marmatec | Calling-Station-Id | == | 00:19:79:0F:98:3D | 00923 > >| NULL | > >+------+----------+--------------------+----+-------------------+--------+------+ > > > > On mysql/sql/ap2000.conf (copy of dialup.conf file) I just changed > >this on authorize section: > > > > WHERE value = '%{SQL-User-Name}' \ > > > > I really don't know how to make this work. Can someone help me? > > > Lets try again: put the mac address in to the radcheck table as UserName > field. Without that mac authentication is not going to work. If your > "adminstartion system" has something against it, throw it away and > write another one youself. Or use dialup admin (comes with the server) > or something like daloRadius. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 3 > Date: Mon, 15 Dec 2008 20:01:15 +0100 > From: <tnt(a)kalik.net> > Subject: Re: calling-station-id filtering with checkval > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <2XjDGByZ.1229367675.3010030.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > Look again. Hint: have a look at you radcheck entry and the one in the > document. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 15/12/2008, "Justin A. Williams " <justin(a)justinawilliams.com> > pi?e: > > >Alan, > > > >Honestly I have read this document but I do not see what i need to do. > > > > > > > > > > > > > >On Mon, Dec 15, 2008 at 1:37 AM, Alan DeKok > <aland(a)deployingradius.com>wrote: > > > >> Justin A. Williams wrote: > >> > I see that the mac address from the calling-station-id but then it will > >> > not login with the user. > >> > If i delete the row 26 with calling-station-id it will permit that user > >> > to login. > >> > >> Read doc/rlm_sql. This is explained. > >> > >> Alan DeKok. > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > > > >-- > >Justin A Williams > > > > > > > > ------------------------------ > > Message: 4 > Date: Mon, 15 Dec 2008 20:07:43 +0100 > From: <tnt(a)kalik.net> > Subject: Re: calling-station-id filtering with checkval > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <LgWmJbfe.1229368063.8923830.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > PS. You don't need checkval in inner-tunnel or you should copy request > attributes into the tunnel as well (see eap.conf, peap section). > > Ivan Kalik > Kalik Informatika ISP > > Dana 15/12/2008, "Justin A. Williams " <justin(a)justinawilliams.com> > pi?e: > > >Alan, > > > >Honestly I have read this document but I do not see what i need to do. > > > > > > > > > > > > > >On Mon, Dec 15, 2008 at 1:37 AM, Alan DeKok > <aland(a)deployingradius.com>wrote: > > > >> Justin A. Williams wrote: > >> > I see that the mac address from the calling-station-id but then it will > >> > not login with the user. > >> > If i delete the row 26 with calling-station-id it will permit that user > >> > to login. > >> > >> Read doc/rlm_sql. This is explained. > >> > >> Alan DeKok. > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > > > >-- > >Justin A Williams > > > > > > > > ------------------------------ > > Message: 5 > Date: Mon, 15 Dec 2008 17:30:06 -0200 > From: Nataniel Klug <nata(a)cnett.com.br> > Subject: Re: MAC Auth (new problem) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4946B03E.1000001(a)cnett.com.br> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > Ivan, > > I can just throw it away... and I still need this to work. There should > be someway to make this happens... > > tnt(a)kalik.net escreveu: > > > > Lets try again: put the mac address in to the radcheck table as UserName > > field. Without that mac authentication is not going to work. If your > > "adminstartion system" has something against it, throw it away and > > write another one youself. Or use dialup admin (comes with the server) > > or something like daloRadius. > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > -- > Att, > > NATANIEL KLUG > nata(a)cnett.com.br > > LEIA O DIA-A-DIA DO NATA > http://nataklug.blogspot.com/ > > Cyber Nett - Internet Banda Larga > www.cnett.com.br > (42) 3635-2957 > Rua Diogo Pinto, 1046, Centro > Laranjeiras do Sul - PR > Brasil - 85301-290 > > "... tamb?m os s?bios possuem cora??o tang?vel e podem, por vezes, usar da > ci?ncia como meio de demonstrar impress?es sentimentais de que muitos n?o os > julgam suscet?veis." > Visconde de Taunay > >

3 2

RE: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 16 Dec '08

16 Dec '08

The best solution I can think of that I want to mimic is SecureMyWiFi from WiTopia, a hosted radius service (www.witopia.net) Their service works just like I want. > > Are you saying it would work, FreeRADIUS would respond to the > individual > > sites? > > Yes. This is how *any* networking protocol works. Would the server see request from just coming from the Internet IPs or individual APs...meaning would I have to list each location's Internet IP in the client.conf file? I want to be able to list each AP IP individually, tagged with the domain it belongs to. > >> of course, you could really freak things out by using > >> VPN tunnels from the inside networks of each site direct to > >> the FreeRADIUS box - but if all your sites use the same range > >> of addresses then the server wouldnt have a clue at all of which > >> tunnel to send the reply down! > > > > Why would I want to VPN to the server? > > So that your RADIUS packets aren't sent over the Internet in the > clear. Gotcha, I need to read more about this. > >> with latest version 2.x of FreeRADIUS you can have dynamic clients > >> etc which can select the correct shared secrets depending on > >> special DB lookups etc - but thats not a choice for you currently. > > > > Yes I read about this, and I'll be upgrading soon and moving to > Linux. When > > writing the DB lookups, can I use the User-Name attribute pulled from > the > > requests? > > No. Only the source IP address. Then I'm not sure how I would pull the correct shared secrets...unless it all works per internet IP rather than per AP. > > This will I think let me search for shared secret based on both > > the RadiusClient IP and the domain....the other server I tried > couldn't do > > this. I would also consider using the MAC address of the AP instead > or in > > addition to the domain. > > I don't think that's necessary. The source IP address should be good > enough. Same as above. Thanks, Eric

1 0

RE: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 16 Dec '08

16 Dec '08

Thanks for your reply. > > I'm not exactly sure. How does a RADIUS server work over the > Internet? I'm > > not connecting the radius clients onto the same LAN. If a radius > request > > comes in from the internet, would the server send responses to the > Internet > > IP that it received it from (which I think would work for my case) or > would > > it send to the radius client IP? > > > > Here's what I'm trying to do: > > Host a radius server on the Internet...for PEAP 802.1X (WPA- > enterprise). > > Each AP at the different offices would be set with the Internet IP > address > > of where the radius server is running, along with a shared secret. > There > > would likely be APs set to the same IP address, that's why I'm asking > about > > all this. > > i'm having a quick stab in the dark here - I'm guessing > that your APs will have local non routed addresses on their > LAN - eg 192.168.x.x or 172.16.x.x etc Yes, that's correct. > - in this case, they > will appear to the FreeRADIUS server as originating from the > IP address of your real outside world gateway/NAT box. therefore > each of your sites will be presented to the FreeRADIUS server > as different IP addresses. Are you saying it would work, FreeRADIUS would respond to the individual sites? > of course, you could really freak things out by using > VPN tunnels from the inside networks of each site direct to > the FreeRADIUS box - but if all your sites use the same range > of addresses then the server wouldnt have a clue at all of which > tunnel to send the reply down! Why would I want to VPN to the server? > with latest version 2.x of FreeRADIUS you can have dynamic clients > etc which can select the correct shared secrets depending on > special DB lookups etc - but thats not a choice for you currently. Yes I read about this, and I'll be upgrading soon and moving to Linux. When writing the DB lookups, can I use the User-Name attribute pulled from the requests? This will I think let me search for shared secret based on both the RadiusClient IP and the domain....the other server I tried couldn't do this. I would also consider using the MAC address of the AP instead or in addition to the domain. Thanks!

2 1

post check
by lreeves 16 Dec '08

16 Dec '08

test Larry Reeves lreeves(a)heartoftn.net

1 0

MAC Auth (new problem)
by Nataniel Klug 16 Dec '08

16 Dec '08

Hello all, A new problem on my Radius tryout... Now I cant authorize my MAC clients. This is how it gets into my server: Listening on authentication address 172.30.0.27 port 1812 as server ppp Listening on accounting address 172.30.0.27 port 1813 as server ppp Listening on authentication address 172.30.0.27 port 1814 as server proxim Ready to process requests. rad_recv: Access-Request packet from host 172.30.0.165 port 6001, id=3, length=69 User-Name = "00:19:79:0F:98:3D" User-Password = "cnett1298" NAS-IP-Address = 172.30.0.165 NAS-Port = 0 server proxim { +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "00:19:79:0F:98:3D", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql_ap2000] expand: %{User-Name} -> 00:19:79:0F:98:3D [sql_ap2000] sql_set_user escaped user --> '00:19:79:0F:98:3D' rlm_sql (sql_ap2000): Reserving sql socket id: 4 [sql_ap2000] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE value = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE value = '00:19:79:0F:98:3D' ORDER BY id [sql_ap2000] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = '00:19:79:0F:98:3D' ORDER BY priority rlm_sql (sql_ap2000): Released sql socket id: 4 [sql_ap2000] User 00:19:79:0F:98:3D not found ++[sql_ap2000] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [00:19:79:0F:98:3D/cnett1298] (from client ap2000 port 0) } # server proxim Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 3 to 172.30.0.165 port 6001 Waking up in 4.9 seconds. Cleaning up request 0 ID 3 with timestamp +29 Ready to process requests. This user (MAC) exists and its in radcheck like this: mysql> SELECT * FROM radcheck WHERE Username="marmatec"; +------+----------+--------------------+----+-------------------+--------+------+ | id | UserName | Attribute | op | Value | numero | obs | +------+----------+--------------------+----+-------------------+--------+------+ | 796 | marmatec | Cleartext-Password | := | 654321 | 00923 | | | 1886 | marmatec | Calling-Station-Id | == | 00:19:79:0F:98:3D | 00923 | NULL | +------+----------+--------------------+----+-------------------+--------+------+ On mysql/sql/ap2000.conf (copy of dialup.conf file) I just changed this on authorize section: WHERE value = '%{SQL-User-Name}' \ I really don't know how to make this work. Can someone help me? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

5 24

Problem returning default reply "Filter-ID" for Enterasys gear
by Kent Nasveschuk 16 Dec '08

16 Dec '08

Hello, I'm trying to set up MAC and 802.1x authentication and have a couple of questions. For right now I'm just working on the MAC authentication. Here's some info on my system: CentOS 5.2 [root@radius01 freeradius-1.1.3]# radiusd -v radiusd: FreeRADIUS Version 1.1.3, for host x86_64-redhat-linux-gnu, built on May 10 2007 at 12:24:01 Connecting on backend to OpenLDAP 2.3.39. Although in the production environment I will be running a replica on the radius server for testing I'm using a test LDAP server that I can modify at will. MAC addresses live in: ou=Devices,ou=Network,dc=mbl,dc=edu typical entry: dn: cn=00-0C-F1-94-2A-9D,ou=Devices,ou=Network,dc=mbl,dc=edu cn: 00-0C-F1-94-2A-9D userPassword:: c25rUnN3bQ== radiusCheckItem: 35452 radiusExpiration: 2030123100:00:00 description: SSH gateway objectClass: device objectClass: ieee802Device objectClass: radiusprofile objectClass: simpleSecurityObject objectClass: top macAddress: 00:0C:F1:94:2A:9D radiusFilterId: Enterasys:version=1:policy=F-Servers What I want to do is if a lookup in LDAP fails return ACCEPT and the string "radiusFilterId: Enterasys:version=1:policy=D-Unregistered" where a policy will be applied on the port that is associated wit "D-Unregistered". ############################ radiusd.conf ####################### ... modules { ldap devices { server = "x.x.x.x" identity = "cn=radiusd,ou=users,dc=mbl,dc=edu" password = supersecretpassword basedn = "ou=devices,ou=network,dc=mbl,dc=edu" filter = "(cn=%{User-Name})" start_tls = no tls_mode = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = "{clear}" password_attribute = userPassword timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no access_attr = "radiusFilterId" } ldap 802_1x { server = "x.x.x.x" identity = "cn=radiusd,ou=users,dc=mbl,dc=edu" password = supersecretpassword basedn = "ou=users,dc=mbl,dc=edu" filter = "(cn=%{User-Name})" start_tls = no tls_mode = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = "{clear}" password_attribute = userPassword timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no access_attr = "networkProfile" } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } pap { encryption_scheme = md5 auto_header = no } chap { authtype = CHAP } preprocess { huntgroups = ${confdir}/huntgroups #hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users #acctusersfile = ${confdir}/acct_users compat = no #use old style users } # regular detail files detail detail1 { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 dirperm = 0755 } # temp detail file to replicate to accountrad detail detail2 { detailfile= ${radacctdir}/detail-combined detailperm = 0600 dirperm = 0755 locking = yes } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module current has no configuration. expr { } } instantiate { expr } authorize { preprocess Autz-Type LDAP1 { devices } Autz-Type LDAP2 { 802_1x chap mschap eap } files } authenticate { authtype PAP { pap } authtype CHAP { chap } authtype MS-CHAP { mschap } authtype LDAP1 { devices } authtype LDAP2 { 802_1x } eap } preacct { preprocess files } accounting { acct_unique detail1 detail2 #radutmp #sradutmp } ############################ users ####################### DEFAULT Client-IP-Address == "172.x.x.1", Auth-Type := LDAP1, Autz-Type:= LDAP1, Auth-Type := ACCEPT, Filter-Id := "Enterasys:version=1:policy=D-Unregistered" DEFAULT Client-IP-Address == "172.x.x.2", Auth-Type := LDAP2, Autz-Type:= LDAP2 DEFAULT Autz-Type = LDAP1, Auth-Type := ACCEPT ############################ clients.conf ####################### client 127.0.0.1 { secret = testing123 shortname = localhost nastype = other # localhost isn't usually a NAS... } client 172.x.x.3 { secret = yetanotherpassword shortname = NagiosMonitoring } client 172.x.x.1 { secret = anotherpassword shortname = DFE-CORE } client 172.x.x.2 { secret = anotherpassword shortname = ROAMABOUT8400 } I'm testing from the 172.x.x.3, client. Currently I can get a MAC address to authenticate and reply with the the correct "radiusFilterID" in LDAP. I can also get an unknown MAC address to return an ACCEPT but I can't get it to return a default "Filter-ID". Putting the return string "Filter-Id := "Enterasys:version=1:policy=D-Unregistered" in the users file doesn't seem to work. I'll work on the 802.1x when I get the above working, but I want to use the sambaLMpassword or sambaNTpassword hashes that are already in the LDAP directory versus clear text userPassword for 802.1x. Thanks for your help. Kent L. Nasveschuk Systems Administrator Office 508 289-7263 Cell 508 524-7263 ---------------------------- Marine Biological Laboratory 7 MBL St. Woods Hole, MA 02543

1 0