August 2009 - Freeradius-Users - lists.freeradius.org

radreply and proxied packet questions
by mikoi 26 Aug '09

26 Aug '09

Hi. I have an installation with Freeradius and MySQL and have a few question. 1. Values in radreply seem to be ignored from the reply to AAA-client when proxying packets? Is this by design or have i configured something wrong? 2. Is it possible to do this in the post-proxy section of /sites-enabled/default? If Access-accept is received from backend server, return per user values from radreply table If Access-reject is received, reject the user and send no attributes. If the above is possible, can someone give me an example of how this is to be configured? how the if, then, else should/could look like? Thanks in advance. /Mika -- View this message in context: http://www.nabble.com/radreply-and-proxied-packet-questions-tp25147932p2514… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Freradius and And Cisco CSS
by Rokkhan 26 Aug '09

26 Aug '09

Does anyone knows who could I configure a Cisco CSS to load balance freeradius packets?

1 0

XP client can not authenticate in Radius Server - HELP ME PLEASE!!!!!!!!!!!!!
by Hilton Guaraldi 25 Aug '09

25 Aug '09

Hi ALL!!!!!!!!!!!!!!!!!!!!!!! I did more then 20 openssl commands in order to issue a CA for tests... Howto in http://www.linuxjournal.com/node/8095/print and http://www.linuxjournal.com/node/8151/print. I DID ALL THE COMMANDS!!! XP client do not authenticate :-( Do I need users file??? What the correct sintaxe for login guaraldi and password mudar123? I defined users file like: guaraldi Auth-Type := EAP, Cleartext-Password == "mudar123" CA defined in OPENSSL!!! Radius server stop displaying "can not get issuer certificate" and "unknow CA" Server certificate signed!!! Client certificate defined!!! XP with cacert.pem and client_cert.p12!!!!!!!!!!!! I did not use ca.der .... XP Config with EAP to Smartcard or other certificates TLS and so on... AP with WPA/TKIP with 802.1x to 192.168.0.254 port 1812. OK!!! It works... Why XP do not authenticate with radius??? Guaraldi

4 6

Re: Freeradius and Cisco
by Nicholas Cappelletti 25 Aug '09

25 Aug '09

Hello Rokkhan, I was curious if you could send me the configuration you have on your Cisco AP's for telnet/ssh access? I'm having some trouble with mine, but I'm able to authentication my routers and switches just fine. I would ask the mailing lists, but they sometimes aren't very helpful. ;) --Nick ----- Original Message ----- From: "Rokkhan" <rokkhan(a)gmail.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Thursday, August 20, 2009 9:44:38 AM GMT -05:00 US/Canada Eastern Subject: Freeradius and Cisco HelloI I have been testing with my freeradius and cisco devices, such as switches, firewalls, acces points, ... Now, I´m able to configure users validation through freeradius with Access Points and Peap. Get shell acces to cisco devices and establish the level privilege of them with freeradius. And configure dot1x interfaces on switches to validate users and configure ports on diferent VLAN through Freeradius. I want to know if there is anything more that can be managed, with Freeradius, on Cisco devices. I want to explore all the options that freeradius brings to us. Thanks in advance. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

virtual servers => 2 different user files
by kisteorg google 25 Aug '09

25 Aug '09

Hello list, I would like to use one freeradius for 2 different NAS-groups. Therefore I need two different users files, one for each instance. I tried to make the module configuration per virtual server, which seems not to be working. Does anybody has a trick to get this working? BR Uwe

5 7

Re: groupcmp fails during tunneled request
by Matthieu Lazaro 25 Aug '09

25 Aug '09

1 0

How to use large SQL-query for %{sql:} clause?
by George Koulyabin 25 Aug '09

25 Aug '09

Hello. I am using FR v2.1.6. I am needing to generate values of reply attributes via SQL. I am using `%{sql:SQL-query}` clause. I am inserting attribute/value pairs into radreply table, where value - `%{sql:}`-clause. But I had got complex and large queries. I don't want to increase size of fields of SQL-table. How I can solve this problem?

2 2

How to control users traffic ?
by Eric 25 Aug '09

25 Aug '09

Hi, Which is conventional way for checking online users traffic volume and disconnecting who reach to the limit of every user in freeradius: 1- using acct-interim packets to update output or input octets in sql and if user reach to the max of its accounting permission disconnect him/her.(Is there any patch to do this ?) 2- freeradius sends Session-Octets-Limit to the NAS and NAS can does this? 3- using billing softwares such as nibs . 4-other ways?

6 15

check username and password
by shivashankar 25 Aug '09

25 Aug '09

hi how to check username and password in rlm_wipromodule(user-define) module. plz help -- View this message in context: http://www.nabble.com/check-username-and-password-tp25114745p25114745.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Dynamic VLAN attribute in LDAP or AD?
by Gary Gatten 25 Aug '09

25 Aug '09

Hello, thanks for taking the time to read this. And thanks in advance for the prompt replies! I've read nearly all the docs and How To's I could find and none of them (so far) address this. If I find an answer I'll be more than happy to draft a How To as I would suspect this a desired solution. So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users! Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN. If that's not possible, I COULD do it at the user level, but again kinda a hassle to maintain. Any thoughts / opinions would be GREATLY appreciated! In the mean time I'll keep reading! PS: The How To's have helped a LOT so far just getting to the point I'm at! Without them it would've taken me 10x longer! <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

6 10