July 2011 - Freeradius-Users - lists.freeradius.org

SQL check in XOR
by Rosario Lumia 29 Jul '11

29 Jul '11

Hi to all, I have more SQL in which check for accounting infos. In my "sites-enabled/default" file I have in my accounting section: {... sql1 sql2 sql3 ... } I notice that in this way the process check if AT LEAST one of above tables "returns ok", but I'd want accounting module returns OK iff exactly ONE of that returns ok. Is there a way to configure in this XOR way? Thanks in advance. Regards -- Rosario L.

2 2

Reuse Customized Attributes
by d.thembiliyagoda＠lancaster.ac.uk 29 Jul '11

29 Jul '11

Hi, I defined an attribute in dictionary file as follows. ATTRIBUTE My-Local-String 3000 string and I used it in policy.conf file to assign value of the EAP -TTLS inner tunnel user name. test1 { update outer.request { My-Local-String := "%{request:User-Name}" } update reply { User-Name := "%{request:User-Name}" } update reply { Auth-Type := "%{control:Auth-Type}" } I called the test1 under the authorize section in inner-tunnel virtual server. I want to re-use this attribute "My-Local-String" in a mysql query. But it doesn't contain any value . It stores an empty value in UserName filed of the table. postauth_query = "INSERT INTO ${cui_uname_table} \ (UserName, CUI, DateTime) \ VALUES \ ('%{My-Local-String}', '%{reply:Chargeable-User-Identity}', SYSDATE())"; I am executing this query under the post-auth section of the default server. Is there any way achieve this ? Champika

1 0

Yet another multiple SSID setup question
by Nick Kartsioukas 29 Jul '11

29 Jul '11

I've been looking through the wiki and staring at the config files and I'm...confused. I've successfully gotten our Cisco WLC to authenticate against ActiveDirectory as well as a Sun LDAP server (just one at a time) via FreeRADIUS for a single test SSID, but now I'm trying to figure out how to split that into conditional checks. Before I go chopping up the existing config files and making a horrible mess of things, I wanted to verify a few things with the wisdom of the list. Okay...let's say I have an SSID for students and an SSID for staff. Students authenticate against LDAP, which stores passwords as salted SHA1 hashes. Staff authenticate against Windows ActiveDirectory. I've found where the WLC sends the SSID to FreeRADIUS, so I can get at that. My question is, how do I set up the EAP-TTLS/PAP session for the Student SSID and the separate PEAP/MSCHAPv2 session for the Staff SSID? Are these configured as different virtual servers? Or just different modules that I call from the users file like so: DEFAULT Auth-Type := student_module, Called-Station-SSID := "student" DEFAULT Auth-Type := staff_module, Called-Station-SSID := "staff" If so how do I set that up, as that would be two different eap.conf setups (wouldn't it)? Am I missing something obvious in the docs? Thanks for taking the time to help me out!

6 13

can policy.conf be used to create an access control list
by michael lamborn 28 Jul '11

28 Jul '11

Hi, I am using version freeRadius 1.1.7. I am trying to create an access control list via radius, to prevent specific PC's/locations from accessing my network. Please see my policy.conf example below. My freeRadius server keeps sending an access-accept, when I try to login in from my office as a test, which has the IP address 10.2.222.35. I don't understand why the server is allowing the login. It seems logical to me the way that I have approached an implementation, but I can't find any specific info from the wiki or in internet searches. So I am not sure if I am still misconfigured or if it just doesn't work for some other reason. Thanks, Mike In policy.conf, I have the following, but it doesn't have any affect ( I do have '$INCLUDE ${confdir}/policy.conf' in my radiusd.conf file): policy { forbid_login_ip_hosts { %{request:Login-IP-Host} =~ /^10.2./ { reject } } }

3 2

Re: Freeradius mysql (problem)
by Chaos Lord 28 Jul '11

28 Jul '11

Hi, i have the exact same problem here with a Linksys access point. The Access list to the AP works fine allowing the client to connect. But the authentication fails. When i enter the client with it's login in the users file like this "myclientuser" Cleartext-Password := "myclientspassword" it works fine. As soon as i try this on the mysql System i do not get the access. The Allowd hosts access still works fine.... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-mysql-problem-tp4638453p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

chilli + freeradius + opendirectory
by Massimiliano Tommasi 28 Jul '11

28 Jul '11

Hi, I'm moving step by step to get my system working... My architecture is: WEB.CLIENT<--->CHILLI(captive.portal)<--->FREERADIUS<--->OPENLDAP My problem now is between chilli and opendirectory THRU freeradius. Chilli supports chap or pap. I'm not able to use chap because, it's not compatible with openldap and I get as message error that I need a text-plain password. I'm not sure that using pap, it could be working. If I'm right, I'm able to convert the password to plain-text after chilli and before radius..., or am I wronging? Is there a way, I can authenticate my users from web-interface on opendirectory thru FREERADIUS? The other way could be kerberos but, if i have well understood, I'll get the same problem. Give me some help, please. Regards, Max

2 4

Unlang issue
by Garber, Neal 28 Jul '11

28 Jul '11

I'm running FR 2.1.6 (I know - I plan to upgrade later this year). Is there anything wrong syntactically with the following code or is this a bug that was fixed since 2.1.6? if (Client-IP-Address == "172.20.16.28" || Client-IP-Address == "172.20.204.10")) { update request { Huntgroup-Name := "GlobalRoaming" } } # # If NAS is an autonomous AP, get SSID from Cisco-AVPair # if (Huntgroup-Name == "EEProdAP" || \ Huntgroup-Name == "EETestAP") { if (Cisco-AVPair =~ /ssid=(.*)/) { update request { SSID-Name = "%{1}" } } } I ask because the first if statement only works if the Client-IP-Address matches the first address listed (172.20.16.28). I would expect that it would evaluate to true if Client-IP-Address matches either of the addresses. Here's a snippet of debug output that illustrates the problem - it doesn't appear to finish the logical or comparison: Info: ++? if (Called-Station-Id && (Client-IP-Address == "172.20.16.28" || Client-IP-Address == "172.20.204.10")) Info: ? Evaluating (Called-Station-Id ) -> TRUE Info: expand: %{Client-IP-Address} -> 172.20.204.10 Info: ++? if (Huntgroup-Name == "EEProdAP" || Huntgroup-Name == "EETestAP") Info: (Attribute Huntgroup-Name was not found) When I switch the order of the addresses for the logical or, I see the following in debug (it does the comparison and returns TRUE): Info: ++? if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) Info: ? Evaluating (Called-Station-Id ) -> TRUE Info: expand: %{Client-IP-Address} -> 172.20.204.10 Info: ?? Evaluating (Client-IP-Address == "172.20.204.10" ) -> TRUE Info: ?? Skipping (Client-IP-Address == "172.20.16.28") Info: ++? if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) -> TRUE Info: ++- entering if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) {...} Info: +++[request] returns ok Info: ++- if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) returns ok Info: ++? if (Huntgroup-Name == "EEProdAP" || Huntgroup-Name == "EETestAP") Info: ? Evaluating (Huntgroup-Name == "EEProdAP" ) -> FALSE Info: ? Evaluating (Huntgroup-Name == "EETestAP") -> FALSE Info: ++? if (Huntgroup-Name == "EEProdAP" || Huntgroup-Name == "EETestAP") -> FALSE

3 4

[mysql+freeradius]add attribute for freeradius
by gary 28 Jul '11

28 Jul '11

Hi All I would like to create radcheck table and new attribute as below. How do I configure the freeradius server to recognize and send the attribute value? ------------------------------------------------------------------------------ id | username | attribute | op | value | ------------------------------------------------------------------------------ 10000 | gary | Expiration | := | 30 Aug 2012 12:00:00| ------------------------------------------------------------------------------- 10001 | gary | Cleartext-Password | := | 12345678 | ------------------------------------------------------------------------------ 10002 | gary | Download-Stream | := | 1000000 | ------------------------------------------------------------------------------ 10003 | gary | Upload-Stream | := | 512000 | ------------------------------------------------------------------------------ Best Regards Gary

2 2

Re: help:[freeradius+mysql]destination unreachable(host administratively prohibited)
by Harry Hoffman 28 Jul '11

28 Jul '11

4 7

rlm_sql don't re-connect after mysql failure
by Jean Carlos Oliveira Guandalini 27 Jul '11

27 Jul '11

Hi, I'm using freeradius-2.1.11 and i have problem with mysql connection. If MySQL server goes down, the freeradius don't reconnect until he be restarted. logfile like this, but the mysql server is UP again: rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql: Connected new DB handle, #0 rlm_sql : failed after re-connect *** this error repeats until I go restart freeradius Thanks Jean

1 0