March 2012 - Freeradius-Users - lists.freeradius.org

custom AVPs from LDAP in AccessAccept packet
by Stefano Zanmarchi 12 Mar '12

12 Mar '12

hi, we have a central radius server (LDAP user store) talking to a department radius server connected to an AP. I can't change the LDAP, so I can't use the radiusprofile objectclass. I'd like to configure the central radius server to send custom AVPs fetched from the LDAP to the department radius server. The department radius server (which is proxying AccessRequests to the central radius server) will then unlang these custom AVPs contained in the AccessAccept packet to set the appropriate VLAN Id. I've mapped ldap attributes in the ldap.attrmap of the central radius server (eg: replyItem Campus-Usage-Right diritto8021x) but am now a bit confused on how to go on. Should I now define a custom dictionary file that that the central radius server and the department radius server must share? Or should I rather add entries in /etc/raddb/dictionary of the central radius server (eg ATTRIBUTE Campus-Usage-Right 1 string)? Thank you very much in advance for your help, Stefano

1 0

HP-Command-String in sql accounting
by Marc Boisis-Delavaud 12 Mar '12

12 Mar '12

Hello, I've enabled command accounting of my HP procure switches. The information is sent to radius : rad_recv: Accounting-Request packet from host 10.10.0.138 port 1274, id=79, length=128 Acct-Session-Id = "002800000016" Acct-Status-Type = Interim-Update Service-Type = NAS-Prompt-User Acct-Authentic = RADIUS User-Name = "toto" NAS-IP-Address = 10.10.0.138 NAS-Identifier = "sw" NAS-Port-Type = Virtual Calling-Station-Id = "10.1.11.61" HP-Command-String = "show running-config" Acct-Delay-Time = 0 But the HP-Command-String is not present in the radacct table, is it possible to have it ? thanks

3 2

Re: Freeradius-Users Digest, Vol 83, Issue 43
by pamela pomary 12 Mar '12

12 Mar '12

Thank you Fajar, it works. i included sqlcounter.conf in module section of radiusd.conf. Then I inserted into radcheck a user with the attributes User-Password:="password" Service-Type:="Framed-User" Max-Daily-Session:="240" Debug logs. rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user student, check_item=240, counter=242 modcall[authorize]: module "dailycounter" returns reject for request 15 modcall: leaving group authorize (returns reject) for request 15 Invalid user (rlm_sqlcounter: Maximum hourly usage time reached): [student] (from client C2960_NOC_LAN1 port 50009 cli 00-1E-33-D5-7A-68) Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.5.4:1645, id=81, length=197 Sending Access-Reject of id 81 to 10.1.5.4 port 1645 Reply-Message = "Your maximum hourly usage time has been reached" Once again thank you Pamela Pomary ICTD University of Ghana Email: ppomary(a)gmail.com

1 0

about multiple nas
by Dagia Dorjsuren 12 Mar '12

12 Mar '12

Hello all, Does anyone know how to configure the users on the multiple nas/clients in freeradius? for example : my nas type (client type) is chillispot access points. my first nas ip address is 192.168.1.1 my second nas ip address is 192.168.1.2 my third nas ip address is 192.168.1.3 "bot" user must be valid from these NASs/Clients. So, I inserted below rows in radcheck table. But it is not working. Username | Attribute | op | value | | dagia | NAS-IP-Address | == | 192.168.1.1|192.168.1.2|192.168.1.3 | Anyone help me pls?

1 0

Multiple sql accounting queries
by Joe Holden 11 Mar '12

11 Mar '12

Hi guys, I'm looking into the best way to implement multiple sql queries for accounting... what is the "proper" way of doing this (besides evil sql magic), can I define another sql instance? How do I go about mapping queries to that etc? Thanks, Joe

2 2

RE: freeradius + ntlm_auth, broken? SOLVED!
by Andres Septer 10 Mar '12

10 Mar '12

So I finally got the idea, whats wrong. Tehre were missing premissions. I tried to run ntlm_auth under radiusd user and got same error as in logs. Reading winbind reply failed! (0xc0000001) Adding rediusd to winbind group solved the problem. A.

1 0

RE: freeradius + ntlm_auth, broken?
by Andres Septer 10 Mar '12

10 Mar '12

OK, I found out at least one mistake I made: when using command line, grabbed from strace output I forgot to remove commas: SO, this line gives /usr/bin/ntlm_auth "--request-nt-key", "--username=freeradius.test", "--domain=LOCAL", "--challenge=0x7c68b9721c3a0b46", "--nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a" Logon failure (0xc000006d) And corrected command line gives /usr/bin/ntlm_auth --request-nt-key --username=freeradius.test --domain=LOCAL --challenge=0x7c68b9721c3a0b46 --nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a NT_KEY: 9BBCFC30D5E235BBEC00B013372B14E4 Whitch is, I suppose, correct answer. Why it does not work inside freeradius still remains mystery to me. A.

1 0

RE: freeradius + ntlm_auth, broken?
by Andres Septer 10 Mar '12

10 Mar '12

> which version of samba are you running? versions 3.2 - 3.5 have b0rked return things - > fixed in latest 3.6 - on the command line things work okay but when a program is using the > return values they are wrong (or something to that affect. cant recall all the details > but the recomendation is 3.0.x (RHEL5 classic) or 3.6 (new distro). the mailing list > logs are filled with previous discussion. I have samba 3.6.1 I would like to read previous discussions but google search return broken links (404). https://www.google.com/search?q=ntlm_auth%20site%3Ahttp%3A%2F%2Flists.freer… A.

1 0

FreeRADIUS 2.1.12 as DHCPd with both static and dynamic IP-MAC accociations via
by newuse＠qip.ru 10 Mar '12

10 Mar '12

Hi all, Again a questions about FR2 as DHCP server with SQL: Is it possible to setup FR as&nbsp; DHCPd on FreeBSD to a given interface or it's IP? Could I use rlm_sqlpool to store MAC-IP associations? I am trying to use an old dial-up&nbsp; module (FreeNIBS) for my WiFi network, all seems to be OK,&nbsp; but there is no DHCP,

2 2

Re: Max-Daily-Session - User session termination
by Alan Buxey 09 Mar '12

09 Mar '12

Set session timer to one hour. Or adjust reauth times on the Cisco alan

3 2