October 2011 - Freeradius-Users - lists.freeradius.org

Dynamic Attributes Based on NAS Type !
by Suman Dash 09 Oct '11

09 Oct '11

Hi Everyone ... Currently i am planning to integrate freeradius with different NAS like Chillispot , Cisco etc and enable roaming users so that they can log in from any of the NAS. As the reply items are different with different NAS , i am looking for ideas how to enable a single user to roam and connect from different NAS. In my case i think static reply items are not possible per user wise or per groupwise so my question is what trick can be used to achieve the same. I had not tried anything as i have no clue on the same so some highlights on the approach will be a good starting point for me. Cheers Suman

5 6

Re: Dynamic Attributes Based on NAS Type !
by Alan DeKok 09 Oct '11

09 Oct '11

Stefan A. wrote: > What would you recommend to do, if your client is a proxy server? NAS-ID? No. Don't send policies back. You don't control the NAS. So you have no business sending it NAS-specific policies. > Nice idea, as long as a NAS vendor does not introduce another or additional way(/attribute) to do things in never NAS OS Versions. > In that case you would possible get in trouble if you have both NAS OS versions in your network and feed them with mixed attributes. > Starent did this in the past, where they had a bunch of QoS attributes in one Version and a single Attribute (177) to handle them all at once in never versions. Yes, well, NAS vendors have been known for doing weird things. Hence RFC 6158. Alan DeKok.

2 1

Re: Dynamic Attributes Based on NAS Type !
by Alan DeKok 09 Oct '11

09 Oct '11

Stefan A. wrote: > If you read it ‚one of the ideas of having different virtual servers is > separation of policies for different NASses’ you are right. > > Suman was asking on how to send several NASses into the same policy. The simplest way to do it is to set *generic* policies, and then re-write them in post-auth. For example, define a "Policy-Name" attribute in the dictionary, and set it somewhere in the "authorize" section. Then: post-auth { ... if ("%{client:nas_type}" == "foo") { // map policies for client foo } elsif ("%{client:nas_type}" == "bar") { // map policies for client bar } ... } The underlying issue is that different NAS vendors have defined different attributes for the same functionality. An even simpler solution is to just return all of the VSAs to each NAS. As was said earlier, each NAS will ignore the ones it doesn't understand, and apply the ones it does. Alan DeKok.

3 2

Re: Dynamic Attributes Based on NAS Type !
by Suman Dash 09 Oct '11

09 Oct '11

To be specific , I am concerned about the QoS VSA's . For Example. Mikrotik NAS - Mikrotik-Rate-Limit Chillispot - Chillispot-Max-UP , Chillispot-Max-Down Cisco - Cisco-Policy-UP , Cisco-Policy-Down Now if the user logged from different NAS's the VSA will differ so it is not possible to have a single entry in radgroupreply or radreply pertaining to a kind of NAS. I guess that this is not an out of the box feature in freeradius , instead i need to use some kind of custom script in Post-Auth section which will check the NAS Type and reply out the correct VSA's I am looking for a unique identifier from NAS by which freeradius can understand what type of NAS it is. I tried it and it seems that i have no control on the Access-Request sent by NAS to freeradius. The only idea which currently comes into my mind is to use nas.type value in DB but incase the NAS Type is incorrectly specified reply attributes will go nuts . So any idea if there are any unique identifiers ? Regards Suman On Sat, Oct 8, 2011 at 9:40 PM, Stefan A. <a.freeradius(a)premit.de> wrote: > ** ** > > Suman,**** > > As you did not say anything about the exact attributes, you will send to > the NAC, here is how we do this:**** > > ** ** > > we are also using different NAS and have to reply with different VSAs for > setting up the QOS.**** > > We use the “existence of a specific VSAs” (specified per NAS type) in the > request to select the VSAs to be used in responses.**** > > ** ** > > e.g: if we found the Starent Networks VSA ‘SN-Service-Type’ in the request, > we reply with ‘SN-QOS-Profile’ to set up QoS**** > > This is save, as we won’t see any Starent VSAs in Cisco or Chillispot > NASses.**** > > ** ** > > To make this flexible, we have set up our own VSA to configure users QOS, > which is then translated into the specific reply attributes for the NAS, the > user is currently using.**** > > ** ** > > Regards**** > > Stefan**** > > ** ** > > *From:* freeradius-users-bounces+a.freeradius= > premit.de(a)lists.freeradius.org [mailto: > freeradius-users-bounces+a.freeradius=premit.de(a)lists.freeradius.org] *On > Behalf Of *Suman Dash > *Sent:* Saturday, October 08, 2011 4:40 PM > *To:* FreeRadius users mailing list > *Subject:* Dynamic Attributes Based on NAS Type !**** > > ** ** > > Hi Everyone ... Currently i am planning to integrate freeradius with > different NAS like Chillispot , Cisco etc and enable roaming users so that > they can log in from any of the NAS. > > As the reply items are different with different NAS , i am looking for > ideas how to enable a single user to roam and connect from different NAS. > > In my case i think static reply items are not possible per user wise or per > groupwise so my question is what trick can be used to achieve the same. > > I had not tried anything as i have no clue on the same so some highlights > on the approach will be a good starting point for me. > > Cheers > Suman > > **** > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

3 2

canceling/redirecting realm in pre-proxy ?
by Robert Roll 07 Oct '11

07 Oct '11

There seems to be some comments about being able to "cancel" a proxy in the pre-proxy section.. # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. What I really want to do is test some variables (unlang) and based on the outcome, I want to actually handle the request locally rather than proxy. Maybe this is obvious, but I am not seeing it ? Thanks, Robert

3 6

git.freeradius.org
by James J J Hooper 07 Oct '11

07 Oct '11

Hi Alan et al, I'm having trouble getting FR by git (was previously working): $ grep url .git/config url = git://git.freeradius.org/freeradius-server.git $ git pull origin v2.1.x:v2.1.x fatal: The remote end hung up unexpectedly Is there an issue with git.freeradius.org? (Is anyone else having the same issue?) ... or is it just me? -James

3 2

Re: Rewriting wimax calling-station-id with perl
by James T. Mugauri 07 Oct '11

07 Oct '11

Hi, All Thanks a bunch for this. I have tested both the ubuntu and CentOS/RedHat variants successfully on separate machines, integrated with postgresql. (The mysql was a typo incited by a previous install of freeradius-mysql). Ironically, i also managed to build deb packages from the 2.1.12 git source separately which included wimax, mysql and postgresql modules. Thanks, in particular, to Fajar for taking the time to update the ppa. Cheers, JamesTM Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley On 10/07/2011 10:13 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Of course there are. In RHEL5 the package is called freeradius2 and is > prebuilt with wimax an mysql. The current version is 2.1.7, but if you > wait a little while for the 5.8 update the latest 2.1.12 will be available. > -- John Dennis <jdennis(a)redhat.com> On 10/07/2011 10:13 AM, freeradius-users-request(a)lists.freeradius.org wrote: > I've updated the package on > https://launchpad.net/~freeradius/+archive/stable (the update is > Natty-only for now), which adds freeradius-experimental package. It > has rlm_wimax, rlm_sql_sqlite, rlm_caching, and more. If you're still > having problem compiling yourself and don't mind using unsupported > ppa, you can use that. > > -- Fajar

1 0

Authentication with different port and users
by Alan Kong 07 Oct '11

07 Oct '11

Hi, I used to have freeradius(old version) installed on Solaris and have 2 separate processes listening on port 1812 and 1645. They authenticate 2 groups of different users. I upgraded and installed freeradius 2.1.11 on CentOS 5.6. According to radiusd.conf, I could get freeradius listen on different ports. Can I config the ports authenticate different groups of users using "/etc/passwd"? Thank you. Regards Alan

2 1

Debug mode doesn't start
by andreapepa 07 Oct '11

07 Oct '11

http://freeradius.1045715.n5.nabble.com/file/n4879265/proxy.conf proxy.conf hi all, After some modification to the proxy.conf freeradius doesn't start anymore terminating without errors or messages what is going wrong?: root@host:/etc/freeradius# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/postgresql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 512000 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server rad161auth { ipaddr = 172.25.200.161 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool f3_auth_pool { home_server = rad161auth } home_server rad161acct { ipaddr = 172.25.200.161 port = 1813 type = "acct" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool f3_acct_pool { home_server = rad161acct } realm testrealm.it { auth_pool = f3_auth_pool acct_pool = f3_acct_pool } home_server_pool my_auth_failover { type = fail-over home_server = localhost } root@host:/etc/freeradius# -- View this message in context: http://freeradius.1045715.n5.nabble.com/Debug-mode-doesn-t-start-tp4879265p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Re: Rewriting wimax calling-station-id with perl
by James T. Mugauri 06 Oct '11

06 Oct '11

Hi, Apologies for the late response. Our mail system went down at a terrible time! > From: Johan Meiring<jmeiring(a)pcservices.co.za> > Subject: Re: Rewriting wimax calling-station-id with perl > Which version of debian do you need packages for? I am trying to install it on ubuntu 11.04 server. If there are rpm packages suitable for CentOS 5.x prebuilt with wimax and mysql, i would take that! With respect to Alan's observation: > But why worry about a "deb" package? Just install it from source. > That works. > Alan DeKok. Installing from source also dies when I make with the same libtool error on my ubuntu server 11.04 install. I know i have to add 'rlm_wimax' to src/modules/stable to have it compile, but the Make fails with or without this entry. Adding the suggestive -DIE_LIBTOOL_DIE to CFLAGS makes no difference Regards JamesTM

3 3