September 2011 - Freeradius-Users - lists.freeradius.org

Version 2.1.12 has been released
by Alan DeKok 04 Oct '11

04 Oct '11

After some delay, and after a few last-minute fixes, we've managed to release Version 2.1.12. The full changelog is as follows: FreeRADIUS 2.1.12 Fri 30 Sept 2011 16:57:38 CEST, urgency=medium Feature improvements * Updates to dictionary.erx, dictionary.siemens, dictionary.starent, dictionary.starent.vsa1, dictionary.zyxel, added dictionary.symbol * Added support for PCRE from Phil Mayers * Configurable file permission in rlm_linelog * Added "relaxed" option to rlm_attr_filter. This copies attributes if at least one match occurred. * Added documentation on dynamic clients. See raddb/modules/dynamic_clients. * Added support for elliptical curve cryptography. See ecdh_curve in raddb/eap.conf. * Added support for 802.1X MIBs in checkrad * Added support for %{rand:...}, which generates a uniformly distributed number between 0 and the number you specify. * Created "man" pages for all installed commands, and documented options for all commands. Patch from John Dennis. * Allow radsniff to decode encrypted VSAs and CoA packets. Patch from Bjorn Mork. * Always send Message-Authenticator in radtest. Patch from John Dennis. radclient continues to be more flexible. * Updated Oracle schema and queries * Added SecurID module. See src/modules/rlm_securid/README Bug fixes * Fix memory leak in rlm_detail * Fix "failed to insert event" * Allow virtual servers to be reloaded on HUP. It no longer complains about duplicate virtual servers. * Fix %{string:...} expansion * Fix "server closed socket" loop in radmin * Set ownership of control socket when starting up * Always allow root to connect to control socket, even if "uid" is set. They're root. They can already do anything. * Save all attributes in Access-Accept when proxying inner-tunnel EAP-MSCHAPv2 * Fixes for DHCP relaying. * Check certificate validity when using OCSP. * Updated Oracle "configure" script * Fixed typos in dictionary.alvarion * WARNING on potential proxy loop. * Be more aggressive about clearing old requests from the internal queue * Don't open network sockets when using -C

3 3

Using DB instead of radutmp for simultaneous-use tracking
by Det Det 04 Oct '11

04 Oct '11

Hi there, In the accounting section, radutmp is used for tracking simultaneous-use. Is there a way to use DB::radacct table instead to check for simultaneous-use? thanks, det

2 3

Radius client redundance
by oleaweel 03 Oct '11

03 Oct '11

Hi, We have configured EAP-PEAP with freeradius, and forward MS-CHAP-V2 request to a Microsoft NPS server. This works fine, but we now want to implement one more Microsoft NPS server, so how do we define a second radius client. So that if the first one fails, it will automatically try the next ? We have configured the following: clients.conf client merucontroller01 { ipaddr = xxx.xxx.xxx.1 secret = secretkey nastype = other require_message_authenticator = no } proxy.conf realm DEFAULT { authhost = xxx.xxx.xxx.1:1812 accthost = xxx.xxx.xxx.1:1813 secret = secretkey } So could i just add another ip here xxx.xxx.xxx.2 in both ? Thanks for reply. Regards Ole -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-client-redundance-tp4822209p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

"authentication" sub in perl
by Alex rsm 03 Oct '11

03 Oct '11

Hi, I am trying to call an external perl function within "authentication" sub" - functions are uncommented in modules/perl file ... func_authenticate = authenticate func_authorize = authorize ... - subs are modified in /raddb/example.pl sub authenticate{ print "TEST1\n"; } sub authenticate { print "TEST2\n"; /usr/local/etc/raddb/test.pl; } When freeradius receives a REQUEST, only "authenticate" sub is called and not "authenticate" sub. How can I enable "authenticate" to be called when a REQUEST is arrived? Here is the debug log: ali@lab-openser01:~$ sudo radiusd -X FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Sep 29 2011 at 14:33:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default.orig main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.10.10.31 { require_message_authenticator = no secret = "testing123" shortname = "ba20-seansdesk" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /usr/local/etc/raddb/modules/perl perl { module = "/usr/local/etc/raddb/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 41951 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.31 port 50032, id=27, length=169 User-Name = "ali" NAS-IP-Address = 10.10.10.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000801616c69 Message-Authenticator = 0x95bea57fa05d627496b0475c57d1b6a8 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ali", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry ali at line 207 ++[files] returns ok TEST1 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x95bea57fa05d627496b0475c57d1b6a8 rlm_perl: Added pair User-Name = ali rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x0200000801616c69 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 10.10.10.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Cleartext-Password = abc123 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 27 to 10.10.10.31 port 50032 EAP-Message = 0x0101001604107e5377146691b447d19cd03c54d1c0fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbb8cb579bb8db14c50324b609a9d0c10 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.31 port 50032, id=28, length=185 User-Name = "ali" NAS-IP-Address = 10.10.10.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xbb8cb579bb8db14c50324b609a9d0c10 Message-Authenticator = 0x7aa56761fec9870d04367ba196e039b4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ali", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry ali at line 207 ++[files] returns ok TEST1 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair State = 0xbb8cb579bb8db14c50324b609a9d0c10 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x7aa56761fec9870d04367ba196e039b4 rlm_perl: Added pair User-Name = ali rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x020100060319 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = NAK rlm_perl: Added pair NAS-IP-Address = 10.10.10.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Cleartext-Password = abc123 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type PEAP [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ali attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 28 to 10.10.10.31 port 50032 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 27 with timestamp +29 Waking up in 1.0 seconds. Cleaning up request 1 ID 28 with timestamp +29 Ready to process requests. Thanks, ASM

4 11

Using unlang to customize Tunnel-Medium-Type for 3com switches
by Stanisław Kamiński 30 Sep '11

30 Sep '11

Hi, my problem: I use RADA on 2 lines of 3com switches: - those with ComWare 5 expect Radius to return Tunnel-Medium-Type = "IEEE-802" - those with ComWare 3 expect Tunnel-Medium-Type = "802" Of course, in users, I can use only one of those values, as follows: f0-0f-de-ad-f0-01 Cleartext-Password := "f0-0f-de-ad-f0-01" Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id := 3, Tunnel-Type = VLAN Fortunately, after switching Radius mode on Comware3 switches to "extended", they started to introduce themselves: rad_recv: Access-Request packet from host 172.23.30.70 port 41201, id=97, length=130 User-Name = "f0-0f-de-ad-f0-01" User-Password = "f0-0f-de-ad-f0-01" NAS-IP-Address = 172.23.30.210 NAS-Identifier = "deadbeef1e02" NAS-Port = 16867329 NAS-Port-Id = "unit=1;subslot=0;port=22;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "f00f-dead-f001" 3Com-Connect_Id = 9 3Com-Product-ID = "4200G" 3Com-NAS-Startup-Timestamp = 954636905 I can see 3Com-Product-ID = "4200G", and I would like to change Tunnel-Medium-Type to 802 if I see it. After looking at unlang man page - explains the basics, but show no examples; radiusd.conf - still no examples; and googling - some examples, but I counted 4 of them (maybe I searched the wrong way, but see for yourself what does "unlang examples" yield) I decided to write here for help. From what I read, I should add the condition in "post-auth" section. As I understand it, it should look like this: if ( "%{request:3Com-Product-ID}" == "4200G" ) { update reply { Tunnel-Medium-Type = "802" } } is that about right? (and yes, I should find that by myself, only explanation is that test system setup would take ~3-4 hrs and I can't do testing on production - whereas I count on you being able to tell right from wrong in about ~5 sec). Thanks in advance, Stan

4 3

missing "rlm_perl.so" in the built from src file
by Alex rsm 30 Sep '11

30 Sep '11

Hi, I built a fresh freeradius on a ubuntu server from source files. When I add perl module and start the freeradiusin the debug mode, it is asking for "rlm_perl.so" that can not find it. It seems the make file does not create the shared lib file for perl module. Is there any change should be made in Makefile to create "rlm_perl.so" file? Thanks, ASM

2 1

Fwd: MySQL and FreeRADIUS environment.
by Antonio Fernández Pérez 30 Sep '11

30 Sep '11

Hi everybody, In my company we are thinking to implement a FreeRADIUS server with MySQL on Linux. We need to duplicate FreeRADIUS service because we think that this is a critical service for us but the authentication process only could be done with the master server(FreeRADIUS and MySQL service, both in only one server). For the other hand, if we want to replicate the data base servers, we would have to synchronize two database servers but we would not know wich would be the best solution, cluster or synchronize. Maybe we will not to need a MySQL cluster service and we will need two servers only. First with master FreeRADIUS service and master MySQL service and the second with slave FreeRADIUS service and slave MySQL service. What do you think about the best solution to implement this environment? I hope your answer. Thank you very much. Regards, -- *Antonio Manuel Fernández Pérez* Ingeniero Técnico Informático Dpto. Informático Fabergames S.L. TLF:966261111 / FAX:966551801 www.fabergames.com Fabergames respeta su privacidad<http://www.fabergames.com/index.php/component/content/article/57/1-politica…> * * * ADVERTENCIA LEGAL * * * Le informamos, como destinatario de este mensaje, que el correo electrónico y las comunicaciones por medio de Internet no permiten asegurar ni garantizar la confidencialidad de los mensajes transmitidos, así como tampoco su integridad o su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad alguna por tales circunstancias. Si no consintiese en la utilización del correo electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de manera exclusiva, a su destinatario y contiene información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por la ley. En caso de haber recibido este mensaje por error, le rogamos que, de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley.

3 2

rlm_perl
by Alex rsm 30 Sep '11

30 Sep '11

Hi, How can I configure Freeradius to call example.pl perl script in the rlm_perl module? i.e., I want the perl script to be called when Freeradius receives a request. Thanks, ASM

5 7

avoiding ldap access in authorize
by Fred 30 Sep '11

30 Sep '11

Hi all, When using ldap with freeradius, radiusGroupName attributes can be retrived during execution of ldap module. groupname_attribute = "radiusGroupName" groupmembership_filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=radiusProfile))" groupmembership_attribute = "radiusGroupName" On debug, we can see : [ldap.nsslab] userPassword -> Password-With-Header == "{SSHA}MLRh2CQVi/UeANla4BjafYcB47FlMzRt" [ldap.nsslab] sambaNtPassword -> NT-Password == 0x3841414442424130303546464439454435354434374332433332434641303433 [ldap.nsslab] sambaLmPassword -> LM-Password == 0x3238353536413643394433433936434244373437433744423436454232453738 [ldap.nsslab] radiusGroupName -> Ldap-Group == "AdminRW" [ldap.nsslab] radiusGroupName -> Ldap-Group == "wifi" [ldap.nsslab] radiusGroupName -> Ldap-Group == "wifipartners" [ldap.nsslab] radiusGroupName -> Ldap-Group == "VpnSSL" If I want to test those values, i used to to something like : if ( Ldap-Group == "AdminRW ) { do something } This makes a new ldap access to be done by the server for an array attribute which has already been retrieved by server. Is there any other way to check those (already retrieved values) without making a new ldap call because of Ldap-Group == "xxx" conditional ? Best regards, Fred

2 1

2.1.12 bug/change in behaviour - un-named server {} blocks no longer work?
by Phil Mayers 30 Sep '11

30 Sep '11

All, For a long time, I have had a config with this: sites-enabled/foo: listen { ... } server { authorize { .. } } sites-enabled/oldfoo: client xxx { virtual_server = oldfoo } server oldfoo { authorize { .. } } That is, an un-named virtual server {} block with the config in it, and an older block which certain clients are hard-coded to. 2.1.12 seems to not process this config; it seems to completely ignore the un-named virtual server config: server { # from file /etc/raddb/macauth.conf modules { } # modules } # server ...and thus nothing works. AFAICT this is a change from 2.1.10/11 (although I was always running a "pre-release" i.e. a known-good commit) Removing the un-named: server { } enclosing blocks makes everything work again. I haven't had time to hunt down the commit which might have changed this, but just a heads-up.

4 4