August 2009 - Freeradius-Users - lists.freeradius.org

Using user-defined variables in %{sql: } clause?
by George 21 Aug '09

21 Aug '09

I am using FR v2.1.6. I tried to use clause like `%{sql: SELECT ...}`. But length of SQL-query is so large for using as field of SQL-table. And I thought that I can create variable like myquery = "SELECT ..." as entry of configuration file, and to use this as `%{sql:${myquery}}`. But it didn't work. I looked into log: [sql] expand: ${myquery} -> {myquery} rlm_sql_postgresql: Status: PGRES_FATAL_ERROR What's wrong?

1 0

Re:NAS IPs
by Magui 21 Aug '09

21 Aug '09

you can not to use /29 for 8 IPs because 3 bits have exactly 8 combination ,..x000 is the network and ...x111 is the difusion ,then really you have 6 IPs with /29, you need /28 16 combinations minus two,min 14 IPs for 8 numbers. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

3 2

Re: MAX-Monthly-Traffic V2 Post
by Neville 20 Aug '09

20 Aug '09

Hi Alex, > You are expecting an interim update to send session-timeout to your nas > so it disconnect your user? > If so, two things seems incorrect to me. > > 1- You're measuring traffic volume and want disconnection to set > based on time (session-timout)... a bit tricky isn't it? So VERY True, Too many late nights and I really do appreciate your input as this gave me food for thought and I now have EVERYTHING Working. Both for Traffic & Session USAGE. For Usage, I still had to use Max-Monthly-Traffic as a Check := and based on sqlcounter calc, do a Reply = Sessions-Octets-Limit = XXXXXX on the Access-Accept as this is supported by the ppp 2.4.4 NAS. What I would like to know now, is how I can use sqlcounter to do a Month Calculation based on the date of the account being registered and NOT the Calander Month? Anyone? > 2- I think the attribute "Session-Timeout" cannot be found in > interim-updates packets (maybe I'm wrong), rfc 2869 specify that: "It > is envisioned that an Interim Accounting record (with Acct-Status-Type = > Interim-Update (3)) would contain all of the attributes normally found > in an Accounting Stop message with the exception of the > Acct-Term-Cause attribute." > > What you would need is an attribute known by your nas and representing > remaining traffic. That attrbute should be sent at acct-start time and > would trigger a disconnection from the NAS when traffic limit is > reached. If such a attribute does not exists for your NAS, you should > take a look at CoA server. > Maybe someone have better idea...? > > Le mercredi 19 ao?t 2009 ? 15:56 +0100, Neville a ?crit : > Cheers Nev ================ CentOS 5.3 pptpd 1.3.4 / ppp 2.4.4 freeradius2 2.1.6 radiusclient-ng 0.5.6 daloRadius 0.9-8-SVN ================

2 2

Re: MS 8021.x PEAP failing
by Gary Gatten 20 Aug '09

20 Aug '09

Yup, that line is there. Much of the doc online is WAY out of date, so I'm wondering if by actually RTFM first I broke something? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'FreeRadius users mailing list' <freeradius-users(a)lists.freeradius.org> Sent: Thu Aug 20 14:09:31 2009 Subject: RE: MS 8021.x PEAP failing > I've been playing around with conf/module files trying to strip the > DOMAIN out of my login request - but no luck! Have you tried "with_ntdomain_hack = yes" in the mschap module config? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 2

Kerberos Hardware Pre_auth
by Larry Ross 20 Aug '09

20 Aug '09

Good Morning All; I am looking for direction into correcting an issue with FR 2.X authenticating against a Krb5 directory with Hardware Pre-Auth enabled. Currently I am not finding any luck in getting this off the ground. Thank you Larry Ross Network Operations University California Davis http://www-noc.ucdavis.edu lfross(a)ucdavis.edu<mailto:lfross@ucdavis.edu>

2 1

freeradius with oracle
by shivashankar 20 Aug '09

20 Aug '09

hi , when i run radiusd -X facing below problem. Could not link driver rlm_sql_oracle: ld.so.1: radiusd: fatal: rlm_sql_oracle.so Make sure it (and all its dependent libraries!) are in the search path of your s /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[161]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section Errors initializing modules when i do googlin i found ========= $ vi src/modules/rlm_sql/drivers/rlm_sql_oracle/Makefile Set TARGET = rlm_sql_oracle, and edit the CFLAGS && LDFLAGS lines to ave the appropriate values: -I/opt/oracle/instantclient_11_1/sdk/include, and -L /opt/oracle/instantclient_11_1/ -loracle (?) After than, cd to the directory, and type "make". Alan DeKok ===================== but i don;t have instantclient_11_1/sdk/include directry struction in opt/oracle. plz help -- View this message in context: http://www.nabble.com/freeradius-with-oracle-tp25059683p25059683.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

(no subject)
by Irina 20 Aug '09

20 Aug '09

Hello, Could someone let me know if I can insert a new NAS in the following format insert into nas values('','xx.xx.xx.112/29','shortname',....) Or do I have to insert each IP individually insert into nas values('','xx.xx.xx.112','shortname',....) insert into nas values('','xx.xx.xx.113','shortname',....) etc... Thank you for your help in advance. Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== Hello, Sorry the same message (I posted yesterday) was posted today again. My emaiil program acted up. I will try to re-phrase of what I need I was given a set of new NASes (that I need to allow as 'NASNAME' in 'nas' table in MySQL) in the following format xx.xx.xx.112/29 xx.xx.xx.232/29 I am not sure if I can use it as it is in 'nas' table as 'nasname'. Or, do I have to enter each NAS IP individually? Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== ----- Original Message ----- From: Irina To: freeradius-users(a)lists.freeradius.org Sent: Monday, August 17, 2009 10:54 AM Subject: NAS IPs Hello, I need to allow a block of 8 IP addresses in nasname column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina =========================== ________________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Re: buffered_sql and detail module
by ramesh p 20 Aug '09

20 Aug '09

Got it. I was specifying detail file path incorrect and it's not finding it.one more question regarding this. sites-available/default have preprocess section. and same section in sites-enabled/buffered-sql present. Does preprocess section in buffered-sql needs to be commented out? Thanks. > > Message: 4 > Date: Thu, 20 Aug 2009 09:23:06 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: buffered_sql and detail module > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090820082306.GA5581(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I'm using the following configuration but it's not working. > ^^^^^^^^^^^^^^^^^^ > > whats not working? whats the symptoms? wheres the radiusd -X ? > > alan > > > ------------------------------ >

2 1

(no subject)
by Irina 20 Aug '09

20 Aug '09

Hello Gary, thank you very much for your reply. No, not the wildcards. Few IPs within the same class. I was not sure if I could use /29. Thanks again. Irina =================== If you're asking if you can use classless masks to represent a block of IP's, yes you can. If you're asking if you can use "wildcards" in the IP addresses - I don't know... I doubt it. -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Irina Sent: Thursday, August 20, 2009 9:52 AM To: freeradius-users(a)lists.freeradius.org Subject: Hello, Could someone let me know if I can insert a new NAS in the following format insert into nas values('','xx.xx.xx.112/29','shortname',....) Or do I have to insert each IP individually insert into nas values('','xx.xx.xx.112','shortname',....) insert into nas values('','xx.xx.xx.113','shortname',....) etc... Thank you for your help in advance. Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== Hello, Sorry the same message (I posted yesterday) was posted today again. My emaiil program acted up. I will try to re-phrase of what I need I was given a set of new NASes (that I need to allow as 'NASNAME' in 'nas' table in MySQL) in the following format xx.xx.xx.112/29 xx.xx.xx.232/29 I am not sure if I can use it as it is in 'nas' table as 'nasname'. Or, do I have to enter each NAS IP individually? Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== ----- Original Message ----- From: Irina To: freeradius-users(a)lists.freeradius.org Sent: Monday, August 17, 2009 10:54 AM Subject: NAS IPs Hello, I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina =========================== ________________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius and Cisco
by Rokkhan 20 Aug '09

20 Aug '09

HelloI I have been testing with my freeradius and cisco devices, such as switches, firewalls, acces points, ... Now, I´m able to configure users validation through freeradius with Access Points and Peap. Get shell acces to cisco devices and establish the level privilege of them with freeradius. And configure dot1x interfaces on switches to validate users and configure ports on diferent VLAN through Freeradius. I want to know if there is anything more that can be managed, with Freeradius, on Cisco devices. I want to explore all the options that freeradius brings to us. Thanks in advance.

1 0