October 2011 - Freeradius-Users - lists.freeradius.org

radius/diameter
by Alexandre Chapellon 13 Oct '11

13 Oct '11

Even the subject is clearly of topic... sorry about that :) We are in the process of changing our billing system. As far as I can tell most vendors of "billingware" (such sage highdeal etc...), et least the one we have met, now prefer using diameter interfaces over radius. It seems even more true when it comes to telco specialists. Unfortunately a lot of our network devices do not supports diameter right now (untill we change them). Does networkradius, also have experience in deploying diameter? Does the free implementation of diameter are reliable or proven (may be you have your own)? And at least is it possible to build some kind of gateway between radius and diameter? Bests regards. -- <http://www.horoa.net> Alexandre Chapellon Ingénierie des systèmes open sources et réseaux. Follow me on twitter: @alxgomz <http://www.twitter.com/alxgomz>

2 1

SQL IP Pool Not Accepting Redundant SQL
by Det Det 12 Oct '11

12 Oct '11

Hi, How to make sqlippool accept redundant SQL as below? sqlippool { sql-instance-name = "redundant_sql" ippool_table = "radippool" ... } radiusd.conf ... redundant redundant_sql { sql1 sql2 } ... if I use sql-instance-name = "sql1" or sql-instance-name = "sql2", it works. But then, I'd like to do redundancy. sql-instance-name = "sql1 sql2" or sql-instance-name = "sql1, sql2" also does not work. Thanks! Det

2 3

Authorization with Client PAM Library
by Evan Huus 12 Oct '11

12 Oct '11

Hi all, I am in the process of integrating RADIUS support for authentication and authorization into SSH login for a server running Linux. The authentication part has been very simple thanks to the pam_radius_auth PAM module (I'm using the latest version: 1.3.17). Authorization has not been as simple. We run a custom local daemon which actively manages permissions for the box. The RADIUS server (not under our control) returns authorization data in Vendor-Specific Attributes of the Access-Accept message. Our daemon needs to be made aware of whatever VSAs are inside the Access-Accept message so that it can adjust the user's permissions accordingly. The problem is that pam_radius_auth (to the best of my knowledge) silently ignores any VSAs in the messages it receives. This makes sense from its perspective, since PAM is purely for authentication. The best solution I've come up with has pam_radius_auth forwarding the Access-Accept messages to a configurable port on the local machine. Our daemon can then listen on that port and extract the data it needs. This solution is very ugly, and I'm hoping that there's a better way I'm just not aware of. Any suggestions or information you can provide are very much appreciated. Thanks, Evan

3 3

prepaid billing
by Student University 12 Oct '11

12 Oct '11

Hi, i have cisco nas configured for prepaid billing (100% working configuration with both cisco SESM & cisco CAR ) , but for freeradius side i didn't find any document , can please point me from where i can start ,,, Thanks in advance ,,, Lily

3 3

Locked account
by Maurice James 12 Oct '11

12 Oct '11

How do I get freeradius to deny access based on the ldap attribute nsAccountLock = true? <http://g.bfbcs.com/175/pc_Lt%20Loooootz.png> Description: pc_Lt Loooootz

2 1

Trying to solve a Simultaneous-Use problem
by Nataniel Klug 11 Oct '11

11 Oct '11

Hello all, I am trying to solve a problem about Simultaneous-Use, not in the code because its working, but inside my network layout. I have two different NAS the can authenticate the same client for PPPoE, something like this: [ internet ] ---+ NAS01 +--- [ client ] ----| NAS02 |---- So the client can be connected to any of those 2 NAS for different reasons and when I have a problem, like a power surge, in one of the NAS I got the connection stopped because the NAS that turned down is not sending any accounting packets to the radius. Its ok when I use only one NAS but I am using 2 for backup in cases like a power surge or a hard shutdown of the machine. If the simultaneous-use work so the client cannot connect to NAS02 (assuming that NAS01 has been turned down) until NAS01 is powered on and send account-stop to the radius. So, my question is: how can I use Simultaneous-Use in this scenario? Should I make a script that test if the NAS is online every 10 seconds and if not list all clients connect and stop that connections? Should this work? Is there anyone with the same scenario that can share the solution for the problem? -- Descrição: 20110500 - EMAIL-SIGN - CAPADescrição: 20110500 - EMAIL-SIGN - nata

4 8

From inner to outer
by Roland Hedberg 11 Oct '11

11 Oct '11

Hi! I have the following problem. A module I have written uses the inner tunnel User-Name to find information about the user from an outside source. This user information must be returned in the outer tunnel. Is this doable ? I can think of two ways of doing this: 1) The module while running in the inner tunnel context puts the inner User-Name somewhere where the module when running in the outer tunnel context can pick it up and do the external source lookup. 2) Do the external source lookup in the inner tunnel context and then put the found information somewhere where the module while running in the outer tunnel context can find it. I'd prefer the later. -- Roland

3 2

Re: Local Auth if Proxy Auth fails ---OR--- Proxy Auth if Local Auth fails
by "Яцко Эллад Генна дьевич (ngs)" 11 Oct '11

11 Oct '11

Hello! Is it possuble to use another Auth-mechanism if primary Auth failed? The below is what I meant: 1) NAS -> FreeRADIUS: User/Password 2) FreeRADIUS - Does User exist in Local DB? 3) If "yes" - Access-Acept! 4) If "no" - Are any Proxies configured? FreeRADIUS -> Proxy: User/Password 5) Proxy answers, FreeRADIUS translates the answer further to NAS. Kind regards, Ellad Yatsko

3 9

about Simultaneous-Use and Multiple NAS
by Dagia Dorjsuren 10 Oct '11

10 Oct '11

Hello, Anyone advise me for my below problem pls. How to configure simultaneous login count for each NAS? for example : there is one account and 2 NAS like NAS1 and NAS2. That account's total simultaneous login count is 2. So, there is that account's first simultaneous login must be from NAS1 and second simultaneous login must be from NAS2. Thanks,

2 1

Re: Dynamic Attributes Based on NAS Type !
by Alan DeKok 09 Oct '11

09 Oct '11

Stefan A. wrote: > I never talked about sending policies to the NAS. That *was* the subject of conversation. If you're not going to talk about that, start a new thread. > The question was, what would be the recommendation, if the RADIUS client is > a RADIUS Proxy server (..in between the original NAS and my FR...) > In that case, "%{client:nas_type}" won't work, because it would always be > the same (... proxy server....) Uh... the "nas_type" field is whatever you want. Put in "nas_type = proxy" for a proxy server. You can then key off of that, and send *no* NAS-specific attributes back. > Would one use "%{NAS-ID}" instead of "%{client:nas_type}"? No. The NAS-Identifier is created by the NAS, which may be 2-3 hops away from the proxy. Alan DeKok.

2 1