May 2010 - Freeradius-Users - lists.freeradius.org

freeradius certificate noob doubt
by shirkavand 26 May '10

26 May '10

Hi There, Ok i am following the next tutorial in order to use certificates+freeRadius: http://deployingradius.com/documents/configuration/eap.html After executing: $ cd /etc/raddb/certs $ make Do i have to copy/paste any of the files created to the supplicant to make it work? Cheers

2 3

..::Hunt Groups::..
by Alfonso Alejandro Reyes Jiménez 26 May '10

26 May '10

Hi, I'm trying to restrict access to several users to an specific service (some users can access only our cisco devices and some others only the juniper devices) as far as we know we can use huntgroups for that. The thing is that there's no information about them, only if you are working with a database. Right now we can't install a database to work with the radius server because we don't own it. Do you have a tutorial, book or something that can help us with that configuration?? Thanks in advance. Alfonso.

4 6

Re: execute programme when receiving account packet
by Alan DeKok 25 May '10

25 May '10

Toure Mamadou wrote: > The program is execute but only for access-request. > Regards. See the 'accounting' section of raddb/sites-available/default

2 1

RE: execute programme when receiving account packet
by Toure Mamadou 25 May '10

25 May '10

Hi i've try exec { wait = yes program = "/bin/sh /opt/mytest %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes output = none } The program is execute but only for access-request. Regards. -----Message d'origine----- De : freeradius-users-bounces+mamadou.toure=vipnet.ci(a)lists.freeradius.org [mailto:freeradius-users-bounces+mamadou.toure=vipnet.ci@lists.freeradius.or g] De la part de Toure Mamadou Envoyé : lundi 24 mai 2010 22:06 À : freeradius-users(a)lists.freeradius.org Objet : execute programme when receiving account packet Hi, All i'd like to execute an external program when receiving an Accounting-Request. I've try exec ipoque { wait = yes program = "/bin/sh /opt/mytest %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes output = none packet_type = Accounting-Request } But the program is not execute even if I comment packet_type = Accounting-Request line (#packet_type = Accounting-Request). Can someone help me please. Regards. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

configuring proxy base on eap-type
by Fred MAISON 25 May '10

25 May '10

Hello freeradius-users, Is there any way to proxy freeradius unsupported eap-type to an external radius ? I have a working setup using inner-tunnel. If I understand correctly, in this case, inner-eap are tunneled to localhost on port 1814 by default. My goal is to have eap-juac (Juniper/Funk Software) tunneled to a Juniper UAC device. I try to avoid my actual proxy setup where a specific real is tunneled to UAC. The problem is that end-users can bypass UAC proxying by simply changing their domain identity ... Best regards Fred MAISON

3 6

radius connection and vrf
by Arjun Prasad 25 May '10

25 May '10

Hi, Can any body explain with example the meaning of "binding radius connection to a particular vrf". in what scenario it will be useful. Thanks, Arjun Prasad

1 0

about how to return some attributes only in Access-Accept packet
by weiwei fang 25 May '10

25 May '10

Hello, all! I want some attributes only sent back to users in Access-Accept packet, but won't appear in Access-Challenge packet? How could I do? Now I just add the attribute in MySQL database, however, it is also contained in Access-Challenge packet. Thanks a lot for your kindly help!

2 1

Re : What is the Class attribute for?
by Alexandre Chapellon 25 May '10

25 May '10

Yes, the attribute you need to return Back to your NAS, might be vendor specific (take a look at the dictionnaries). Sending this Attr in Access-Accept, should do the trick but I suggest you still use accounting cause It's always helpfull, and because It's one A in AAA! Sent from my HTC. ----- Reply message ----- De : "weiwei fang" <fangvv(a)gmail.com> Date : Lun, mai 24, 2010 15:09 Objet : Re : What is the Class attribute for? Pour : "Arran Cudbard-Bell" <a.cudbardb(a)gmail.com> Cc : "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org>

1 0

FreeRadius pre 2.1.9 logging behavior
by reedho＠gmail.com 25 May '10

25 May '10

Dear Users, We are in the process migrating our production server running 2.1.3 version and testing the pre 2.1.9. All running well so far except the logging output generated by radiusd. We set logging to stderr or stdout, when started with debug_level = 0, no log generated except the first "starting virtual server..." line, but when first started with debug_level > 0 and set back to 0 with radmin, the log show normal output as seen on the production server. This behavior not seen when logging to files or syslog, only when set to stdout/stderr. So, my best guess after looking the source is that logging to stdout/err does not go to same processing flow as the others. I have searching for this issue but still no luck, do I miss something? Thanks n best regards, --- Ridho

3 2

Decode + sign
by Ahmed Munir 25 May '10

25 May '10

Hi, I want to know how can I decode + sign in radius? Because in radcheck table the username I enlisted is +911234567789, when I want to register on this number the output I'm getting is listed down below; [sql] expand: %{Stripped-User-Name} -> +911234567789 [sql] sql_set_user escaped user --> '+911234567789' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM rad_check WHERE username = '%{SQL-User-Name}' -> SELECT id, name, attribute, secret, op FROM rad_check WHERE username = '=2B911234567789' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '=2B911234567789' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User +911234567789 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. The SQL is converting + sign to 2B, that is why I can't get registered to radius. Please advise how can I resolve this issue. -- Regards, Ahmed Munir

2 1