May 2012 - Freeradius-Users - lists.freeradius.org

Sql radgroupcheck match airespace-wlan-id
by Paolo Barbato 14 May '12

14 May '12

I suppose to have sort out this……but I want reject user "paolo" when coming from airespace-wlan-id = 5 radcheck 9 paolo Expiration := 15 May 2012 8 paolo Cleartext-Password := paolo radusergroup paolo rfxguest 0 radgroupcheck 4 rfxguest Airespace-Wlan-Id := 5 radgoupreply 1 rfxguest Auth-Type := Reject radius -X …. Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "xxxxxx" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" ….. [peap] Using saved attributes from the original Access-Accept Auth-Type := Reject Session-Timeout = 48445 User-Name = "paolo" [eap] Freeing handler ++[eap] returns ok Login OK: [paolo] (from client private-network-1 port 1 cli 00-24-36-b6-3a-22) EAP-PEAP tunnel reply attribute return Auth-Type = Reject but paolo is authenticated. Any details to look into to debug this ? Thanks fro any reply, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 4

Accounting-Response disable
by peterpz 12 May '12

12 May '12

Hello Guys, I'm trying to configure my FreeRadius.net 1.1.7-r0.0.2, but am failing all the time. My goal is to receive accounting-requests from one of proxy servers in our network and save them in the log file. This is done succesfully, I added new client to the clients.conf file. The issue is that FreeRadius is responding to each packet (Accounting-Response). This was not welcome by proxy administrator, who does not want to receive anything from me. But I cannot configure FreeRadius to not send that packets. When in the radiusd.conf I will comment "detail" line from "accounting" module the Accounting-Responses are not send (super!), but also logging is disabled (sic!). How to disable reponses but without disabling logging? Remember, I have 1.1.7 (installed on Windows system). I will appreciate any help, because I already spent whole day on this issue! Best Regards, Peter -- View this message in context: http://freeradius.1045715.n5.nabble.com/Accounting-Response-disable-tp57069… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

max_request
by Luo, Frank Y.F. Mr. 12 May '12

12 May '12

So there is this setting max_request that the server keeps track of. The question is how i can find the current active request that the server keeps track of. My experience is the sever silently drops the connection if max_request is reached. So I want to find out more info about the current status of the server. Thanks Frank

3 8

Ldap attribute in pre-proxy possible?
by Mike 11 May '12

11 May '12

Hello, Is it possible store and access an ldap attribute in pre-proxy? 1. Attribute defined in dictionary 2. Attribute mapped in ldap.attrmap 2. Trying to access using: pre-proxy { If (%{reply:attributename} == "cookies" { update proxy-reply { Whatever = "cookies" }} } the problem is the attribute is expanding to nothing. This does work in the auth section but i need to update the proxy msg. What am i doing wrong?

2 1

logintime attribute - most specific time
by jomajo 11 May '12

11 May '12

Hello. I found an old example here how to set logintime attributes , http://www.gnu.org/software/radius/manual/html_node/radius_236.html . But maybe you know how to set logintime for the specific day of month / month / year ? Etc. this attribute says that user can login at this time : 2012/04/17/1700-1800 Thank you for the information! -- View this message in context: http://freeradius.1045715.n5.nabble.com/logintime-attribute-most-specific-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

Re: ssh authentication failed problem use freeradius & pam_radius
by 小牧 11 May '12

11 May '12

Hello,Alan. Thank you for you response. Alan wrote: > This is an issue with PAM on the client machine. Some other module is doing password checking. When the password check fails, it re-sets the password to "INCORRECT". That password is then sent to the pam_radius module. Go fix the client so that the PAM modules don't change the password. My /etc/pam.d/sshd file contains the following settings: -bash-3.2# cat sshd #%PAM-1.0 auth sufficient pam_radius_auth.so debug auth include system-auth account sufficient pam_radius_auth.so account required pam_nologin.so account include system-auth password sufficient pam_radius_auth.so password include system-auth session sufficient pam_radius_auth.so session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so

2 1

ntlm and mysql
by Paolo Barbato 11 May '12

11 May '12

On a test deployment I've both mysql and ntlm (AD) configured. If I use EAP no problem to authenticate users on both backend. But…in the process to use a Cisco WLC captive portal I've verified that only sql works. If I add in users DEFAULT Auth-Type = ntlm_auth, then also AD users are authenticated, but not mysql ones. radiusd -X reports in this case: ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = ntlm_auth Instead in absence of DEFAULT Auth-Type = ntlm_auth in users, I logs : ==== rad_recv: Access-Request packet from host 150.178.3.53 port 55249, id=114, length=77 User-Name = "barbato" User-Password = "xxxxxxxxxxx" NAS-IP-Address = 150.178.33.105 NAS-Port = 1 Message-Authenticator = 0x122864a655b86ac6d24c76e360fac328 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "barbato", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "barbato" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> barbato [sql] sql_set_user escaped user --> 'barbato' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'barbato' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'barbato' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User barbato not found ++[sql] returns notfound ++? if (ok) ? Evaluating (ok) -> FALSE ++? if (ok) -> FALSE ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [barbato] (from client rfxnet1 port 1) Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> barbato attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated === radtest behave the same. So it's seems I miss something somewhere….any suggestion from the list ? Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 2

Volume Limit per user monthly
by yagizozen 11 May '12

11 May '12

Hello Guys, I am crazy about this freeradius and thank all of the developers who work for freeradius application. It is great that you are doing such an open source application for everyone who needs. I am reading everything that I found about anything related to FR. And I have a question :) Firstly let me tell that, if the answer of my question that I am going to ask is located in some doc or another place in documentation just link the doc name and I will read it if I did not so I do not consume your time. First of all, the GGSN (NAS), that FR is communication is a Huawei system. I manage to succeed limiting a user usage per day (with respect to session time) with the use of session-timeout AVP that is located in the ACCESS-ACCEPT packet sent to my huawei GGSN and GGSN understand that and try to reauthenticate after that value. But the thing that I want is to limit the volume of the usage of a user in a month with the use of the Acct-Input-Octets and Acct-Output-Octets AVPs. But I am having trouble with impelemnting this. I guess I need to generate a counter and this counter should count the Input and Output Octets located in the accounting section and if it is over the limit that I defined in the users file. Thank you inadvance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Volume-Limit-per-user-monthly-tp568… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 7

freeradius GUI
by mimir 11 May '12

11 May '12

Do you know any other application that provides GUI for freeradius? I checked daloradius but it is not supported most of features. For example, I want to monitor freeradius alarms via GUI. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-GUI-tp5700219.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

wiki problems...
by Paolo Barbato 11 May '12

11 May '12

accessing http://wiki.freeradius.org return forbidden ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

4 11