May 2010 - Freeradius-Users - lists.freeradius.org

foreach attribute array
by Aaron Paetznick 07 May '10

07 May '10

I'm having some trouble working with attribute arrays. My Cisco NASes don't seem to always want to send their Cisco-AVPair attribute in the same order, so I can't be sure I want to reference %{Cisco-AVPair[0]}, or %{Cisco-AVPair[1]}, or other positions. So far, I've worked around this by doing things like this: if ("%{Cisco-AVPair[0]}" =~ /^client-mac-address=(.+)$/ || "%{Cisco-AVPair[1]}" =~ /^client-mac-address=(.+)$/) { update request { Client-MAC-Address := "%{1}" } } I also have other Cisco-AVPairs that I'm checking, and they are also not always coming in a guaranteed order. Is there a way to do a each, while, for, or foreach on an attribute array? Thanks! --Aaron

2 3

framedipaddress
by Paweł Pogorzelski 07 May '10

07 May '10

Hi, I have question relating to accounting packets. I have database with default freeradius schema where radius collecting data from controller to radacct table. Which parameter is resposible for user ip address ? framedipaddress? I have meru networks controller. Fields in raddacct table (those with stars are collecting) *radacctid *acctsessionid *acctuniqueid *username groupname *realm *nasipaddress *nasportid *nasporttype *acctstarttime *acctstoptime *acctsessiontime *acctauthentic *connectinfo_start *connectinfo_stop *acctinputoctets *acctoutputoctets *calledstationid *callingstationid *acctterminatecause servicetype framedprotocol framedipaddress *acctstartdelay *acctstopdelay *xascendsessionsvrkey Thanks in advance -- Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

2 1

forward accoutning packets to another radius
by Athiqur Rahman 07 May '10

07 May '10

I am using FreeRadius 2.1.8 on Centos 5. Currently my NAS is sending accouting packets to my Radius which is storing it in the mysql database. What I want to know is how do i get my Radius to forward those accounting packets to another Radius server. Ideally i want to dump accounting into my own database and forward to another server as well Do I use the proxy.conf file? In the proxy.conf file I can see that there is home_server localhost realm already there. Do I create something similar to that only give it the the details of the other Radius?

2 4

Radius freeze
by Tokie 07 May '10

07 May '10

Hi everyone, I'm using FreeRADIUS Version 1.1.7 with Mysql. I use for Hotspot system. All works fine, but after around one day without activity, the radius server don't answer. Therefore, if I restart (/etc/init.d/freeradius restart), all works ok!! I monitor with the command "ps" and just restart result: # ps ax | grep freeradius 26118 ? Ssl 0:00 /usr/sbin/freeradius Immediately after the connection of a hotspot's user: # ps ax | grep freeradius 26118 ? Ssl 0:00 /usr/sbin/freeradius 26158 ? Z 0:00 [freeradius] <defunct> What does this mean *_/[freeradius] <defunct>/_*? If hotspot's user disconnect, nothing changes!! Could you help me??

3 4

variety of errors in the case of unsuccessful authentication
by gorec2005 gorec2005 07 May '10

07 May '10

Hi! Help please: I'm using MPD as a NAS server and would like to return to the client a variety of errors in the case of unsuccessful authentication example: 646 The account is not permitted to log on at this time of day. 647 The account is disabled. 648 The password has expired. 649 The account does not have Remote Access permission. no matter what mistakes I did not send - the radius always returns 691 Access denied because username and / or password is invalid on the domain. SY gorec

1 0

Tee accounting via detail
by Pavel Levshin 07 May '10

07 May '10

Hello. I have to copy our accounting flow to multiple destinations. It can be done with multiple detail files and multiple detail readers, each proxying to one destination. But there are problems: 1. Detail reader can process one request from the file at a time. So, if we have relatively slow (in terms of round-trip-time, like satellite) link, then we cannot process packets at any reasonable speed. If RTT is 0.5s, then we cannot relay more than 2 requests per second. It is horribly slow. Did I miss something? 2. Most of our accounting traffic should be delivered in realtime. Delay in transmission is much worse than some degree of loss. Now, one undelivered request may block complete detail file for some time. 3. Even when detail reader has not been blocked, it may stuck for poll_interval seconds when processing of detail.work has been finished. Even when new detail file exists. 4. Some of the destinations may not reply at all (RADIUS sniffers behave so). We would be happy to send them a copy of each accounting request and forget it immediately. Is it possible? -- Pavel Levshin

3 2

Freeradius and Database backend use cases
by Natr Brazell 07 May '10

07 May '10

I'm looking for some useful information on integrating freeradius with a database backend (or vice-versa). Specifically: 1) What functions are able to use a database? a. User profile mapping such as nate.whoami mapping to a Juniper-Local-User-Name = "whoever" b. radius auditing such as data typically found in the radacct dir by NAS IP? I'm trying to centralize the auditing logs of multiple radius servers and looking for useful references. Thanks, Nate

2 1

value of an attribute in a user
by Felix Antonio Díaz Riverón 07 May '10

07 May '10

Hello comunity, I hve a question When a user belong to two different grups and each grup hasth same attribute but with different value. to get that user value in this attribute? regards felix Participe en la 15 ConvenciÃ³n CientÃfica de IngenierÃa y Arquitectura, del 29 de noviembre al 3 de diciembre de 2010 La IngenierÃa y la Arquitectura por un Futuro Sustentable Palacio de Convenciones, La Habana, Cuba http://www.cujae.edu.cu/eventos/convencion

2 1

Link users to location for authentication
by Brent Wilkinson 07 May '10

07 May '10

Hello, Just starting to get into setting up a radius server with mysql and I am trying to figure out a couple things that I haven't been able to find answers to yet I am setting up a radius server to handle all my wireless hotspot locations. Each location will have unique username and passwords that shouldn't be shared with each other. Can someone point me to what I need to look at to determine how to setup a user that can only be used when it comes from a specific hotspot server. I am not sure if I should use nas or groups or both. Thanks Brent Wilkinson

3 2

What does a good example look like
by Huckle Berry 06 May '10

06 May '10

Hello again, I have a few questions that may or may not be related to each other. First, I know radtest works fine for testing the basic functions of freeradius (i.e. it will authenticate with no encryption) but I would like to know if radtest can be used to test authentication using one of the various types of encryptions and protocols. Question two has to do with said protocols. Is there a clear and concise page that will define all of the protocols (PEAP, EAP, TLS, TTLS, MSCHAP, MSCHAPv2, LEAP, WPA(1/2)-PSK, etc) how they differ from each other and what exactly happens during the authentication process. Illustrations would be nice. Question three: I have come to conclude that some protocols are the same thing with different names, can anyone clarify which protocols are the same or are at least compatible, and which are different? Lastly, what does a successful authentication look like for each type of protocol. What should I be looking for in my freeradius output, and what can I compare it too. Possibly if I saw where stuff was going haywire I could determine for myself what the issue is. ~Huckle Berry

3 3