August 2009 - Freeradius-Users - lists.freeradius.org

Re: Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

>>>Map the attributes in ldap.attrmap. >> >> Thanks for the prompt reply. I have put something in there: >> replyItem My-Email mail >> >> and I've tried things like %{My-Email} ... but that didn't work. > >If you have defined My-Email in freeradius then it will be %{reply:My-Email}. In my dictionary, I have: ATTRIBUTE My-Email 3010 string I can now do Reply-Message += "%{reply:My-Email}" in a post-auth section and it works. However if I change (in ldap.attrmap) mail to dn, the Reply-Message contains "". Should it be possible to read the dn in this same way? >> Can you suggest a suitable way to use this? > >replyItem Reply-Message mail > >You can add += at the end if you might be sending more messages. If I do: replyItem Reply-Message mail Then it works, however if I put the += after it, it doesn't appear. In this specific case, this is the first place Reply-Message is given a value, so appending isn't necessary, however in future cases(when not using Reply-Message) it might be useful to be able to do this. Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

>> To being with I'd like to put 'mail' or 'ou' into the Reply-Message >> attribute - does anyone have any suggestions? (This is the first time I'm >> using LDAP, so please go easy if I've missed something obvious). > >Map the attributes in ldap.attrmap. Thanks for the prompt reply. I have put something in there: replyItem My-Email mail and I've tried things like %{My-Email} ... but that didn't work. I've looked through the docs at http://wiki.freeradius.org/Rlm_ldap but that didn't help. Can you suggest a suitable way to use this? Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

Hi all, I'm using Freeradius 2.1.6 talking to an LDAP server. I am able to do basic LDAP authentication and everything is fine from that point of view. What I am trying to do is retrieve some additional values from the LDAP server, I'm sure it should be a simple thing to do but I can't work out how to do it. e.g. running ldapsearch -h ldap.server -x -b"ou=auth,dc=uni,dc=co,dc=uk" "(uid=a3)" returns dn: uid=a3,ou=people,ou=auth,dc=uni,dc=co,dc=uk ou: My Department mail: email(a)example.com To being with I'd like to put 'mail' or 'ou' into the Reply-Message attribute - does anyone have any suggestions? (This is the first time I'm using LDAP, so please go easy if I've missed something obvious). Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

How to handle multiple NAS's, auth requirements, etc.
by Gary Gatten 21 Aug '09

21 Aug '09

Hello, so for the BASIC question! First, is there any docs that explain the concepts of how all the various pieces of FR tie together? I've read a bunch of stuff and am making some headway, but some of the architecture and process flow still escapes me. If I can gain a better understanding of the internals I could probably resolve most of my own questions and better contribute to the community as well! Now, the question: We have various environments that need to authenticate and authorize using FR: VPN connections with something like (if member of "VPNGroup" then permit, else deny); vty login to network gear with (if member of "NetEngGroup" then permit, else deny); and 802.1x with dynamic VLAN assignment. I plan to use ntlm_auth for all of these to hit AD on the backend. The problem I'm having is grasping how I can do this? Do I need separate instances of FR? A bunch of "if then/else" clauses somewhere? How does FR know what type of auth is required? Am I making this more complicated than it really is? TIA for the help! In the mean time I'll keep reading and playing! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

3 3

Re: MS 8021.x PEAP failing - new info...
by Gary Gatten 21 Aug '09

21 Aug '09

I've tried MANY different confs, including those in docs and suggested here. I have new debug output that leads me to believe its a bug in the Xsupplicant. Ill post that output after lunch. And ill try Alans conf again. BUT, if my conf was wrong why does it work when I manually enter the exact same info as the Xsupplicant is supposed to pull from the GINA / windows login? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Fri Aug 21 11:14:05 2009 Subject: RE: MS 8021.x PEAP failing - new info... > Check this out... I entered the Domain Name manually and it worked! > So, now I have no freaking clue... I thought it was something with the > "//" in the DomainName//UserName - but doesn't look like it. > > Here's some debug output. I snipped all the stuff before this output - > from what I can tell it's exactly the same, but I guess I'll save it to > a file and diff it to make sure. In the mean time: > > ** Here's using Windows logon info automatically, NOT working ** > You haven't modified the ntlm_auth line in mschap module the way Alan suggested (and is also mentioned above the line in mschap module). Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: your mail
by Irina 21 Aug '09

21 Aug '09

Hello Allan, Thank you for your reply. >>ensure your netmask etc are correct :-)) I hope so. I was giving it like this (IP address plus slash 29: 10.1.1.112/29) My trouble was I did not know if I could use 10.1.1.112/29 as nasname. Thank you all. Cheers Irina ============== Hi, > Hello, > > Could someone let me know if I can insert a new NAS in the following > format > > insert into nas values('','xx.xx.xx.112/29','shortname',....) you can use sucha netmask to cover a range....but they'll all then use the same secret and be identified by the same shortname. ...jyst ensure your netmask etc are correct :-) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 8

radius server 2.1.6 not storing data in radacct table..help
by shivashankar 21 Aug '09

21 Aug '09

hi, I have installed freeradius2.1.6 recently. Radius server was started successfully. But when i sent a packet using NTRadping its stored in file but not writing in oracle. when i run radiusd-X --few lines here ---------- [sql] expand: %{User-Name} -> free [sql] sql_set_user escaped user --> 'free' [sql] expand: INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAu rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_oracle: execute query failed in sql_query: ORA-01400: cannot insert NULL into ("RADIUSUSER"."RADACCT"."GROUPNAME") rlm_sql_oracle: OCI_SERVER_NORMAL [sql] Couldn't insert SQL accounting START record - ORA-01400: cannot insert NULL into ("RADIUSUSER"."RADACCT"."GROUPNAME") [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details in radacct table we have GROUPNAME is not null.. i entered data in all tables except radgroupcheck table. i need to enter ....data in this table also. plz help me. -- View this message in context: http://www.nabble.com/radius-server-2.1.6-not-storing-data-in-radacct-table… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: NAS IPs
by Irina 21 Aug '09

21 Aug '09

Hello Johan and everyone else. Thank you very much Johan for your short answer. Some posts have confused me even more than I was when posted to the list. I was blaming on my English, could be I was asking it a wrong way. Anyway, thank you all again. I am pretty sure you know what you are talking about :-)) Irina ============== Gary Gatten wrote: > If I understand you correctly I respectfully submit you are > incorrect. When using VLSM / classless masks to define a NETWORK, you > are correct (I havent checked the math just assuming you are > correct). However, when defining ACL type stuff, the proposed /29 > would be perfectly OK. That said, Im speaking strictly of my > experience with routers, firewalls, etc. If FR supports this I cant say for sure. > > > > ---------------------------------------------------------------------- > -- > > > you can not to use /29 for 8 IPs because 3 bits have exactly 8 > combination ,..x000 is the network and ...x111 is the difusion ,then > really you have 6 IPs with /29, you need /28 16 combinations minus > two,min 14 IPs for 8 numbers. > I think we should stop the TCPIP training. This is the freeradius list. The user wants to know if /29 can be used. The answer is yes. -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: NAS IPs
by Gary Gatten 21 Aug '09

21 Aug '09

Agreed. Since the OP was presented with conflicting info I simply provided a little "training" to let the OP know that I actually know WTF I'm talking about (sometimes) and that /29 will work. When all else fails, try it and see what happens! ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Fri Aug 21 02:15:31 2009 Subject: Re: NAS IPs Gary Gatten wrote: > If I understand you correctly – I respectfully submit you are > incorrect. When using VLSM / classless masks to define a NETWORK, you > are correct (I haven’t checked the math – just assuming you are > correct). However, when defining ACL type stuff, the proposed /29 would > be perfectly OK. That said, I’m speaking strictly of my experience with > routers, firewalls, etc. If FR supports this I can’t say for sure. > > > > ------------------------------------------------------------------------ > > > you can not to use /29 for 8 IPs because 3 bits have exactly 8 > combination ,..x000 is the network and ...x111 is the difusion ,then > really you have 6 IPs with /29, you need /28 16 combinations minus > two,min 14 IPs for 8 numbers. > I think we should stop the TCPIP training. This is the freeradius list. The user wants to know if /29 can be used. The answer is yes. -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

RE: NAS IPs
by Magui 21 Aug '09

21 Aug '09

escuse me, you are correct .is only to range, for 8 IPs is OK, then the network for this (stuff /29) must be >= /27.the signification of /x in VLSM and ACL type stuff is the same ,no changes in the x first bits. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

1 0