August 2012 - Freeradius-Users - lists.freeradius.org

Re: Best way to cope with multiple SSIDs and MAC auth
by Alan Buxey 22 Aug '12

22 Aug '12

radiusd -X alan

1 0

RE: Best way to cope with multiple SSIDs and MAC auth
by Franks Andy (RLZ) IT Systems Engineer 21 Aug '12

21 Aug '12

Hi - thanks for the reply I have a relatively new version of IOS and I can't see the attribute coming through, either on freeradius or using the "debug radius" command on the AP. I wonder if it's something you have to set in the AP that's non default. As an aside, I wonder if there's an internal freeradius attribute that can tell me the port number that an auth request comes through on? If I use the radtest program, I see the NAS-Port being set to 1812, but the Aps don't do this - the NAS-Port attribute is often a random number, not the destination port number.. -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of alan buxey Sent: 21 August 2012 22:21 To: FreeRadius users mailing list Subject: Re: Best way to cope with multiple SSIDs and MAC auth Hi, > Because I am not aware that the cisco IOS can send an “SSID” attribute to > the radius server (if someone knows how to do this PLEASE tell > me!), I yes, it does - the attribute will depend on model and IOS version - but if you run the server in full debug mode then you will see the attribute arrive in the access-request - with the SSID you are looking for present. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Best way to cope with multiple SSIDs and MAC auth
by Franks Andy (RLZ) IT Systems Engineer 21 Aug '12

21 Aug '12

Hi again, Thanks for everyone's input on the last question I asked today. I have another : we are running cisco 1100/1200 series Aps with multiple SSIDs. Depending on ldap groups users are assigned a VLAN which corresponds to the internal or DMZ based network. The issue is that if a user is in both groups, I either have to assign a "most important" one or do something else. With some devices I'd like the opportunity to join either vlan. Because I am not aware that the cisco IOS can send an "SSID" attribute to the radius server (if someone knows how to do this PLEASE tell me!), I need to either send the authentication request to another radius server and proxy from there so that all the traffic appears from one ip address, or choose a different port and create a separate virtual server that listens on that port and contains perhaps a different files section, perhaps users_ssid or something that has separate rules. Anybody got any bright ideas or opinions which would be best? Thanks Andy

2 1

OpenDirectory VLAN Assignment by Group
by Theparanoidone Theparanoidone 21 Aug '12

21 Aug '12

Greetings~ Previously using radius, we were able to assign VLAN based upon group membership using the following syntax in /etc/raddb/users : DEFAULT Group-Name == "testgroup" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = "100", Fall-Through = no Now with FreeRADIUS Version 2.1.12, we are unable to make the above syntax work anymore. After some reading, we stumbled upon a someone with a similar issue who claimed that you now have to place the post-auth section of /etc/raddb/sites-enabled/default ... we had to make some modifications to the syntax as well: update reply { Tunnel-Private-Group-Id = 100 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Preference = 0x000000 } While the above syntax does appear to properly assign the VLAN ... we are unable to match this against the Group-Name field (so the following does not work): if(Group-Name == "testgroup") { update reply { Tunnel-Private-Group-Id = 100 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Preference = 0x000000 } } We are able to get the if syntax to expand upon User-Name like the following (just Group-Name doesn't work): if(User-Name == "testuser") { update reply { Tunnel-Private-Group-Id = 100 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Preference = 0x000000 } } However ... we appear unable to get any variable to expand that relates to group. (we have tried Group Group-Name Ldap-Group LDAP-Group gid group all without success). It would be ideal to base VLAN membership off of group as opposed to individual user. Questions: 1) Is there a way to echo out *all* variables that radiusd -X has access to at the time of testing so we can perhaps see what field contains the valid group on? 2) Does anyone know what the variable for groups we should be using is? 3) Is there documentation that covers the change in syntax as I described above? (... I'm sure just not finding it but I have been looking) (This is on the latest version of Apple's deployment of freeradius that relies on OpenDirectory) (We will try and contact Apple as well... but I'm imaging this request will be beyond their capabilities... echoing out all variables may get us a solution faster???) Thank you in advance for any advice or pointers to relevant documentation.

4 8

Little "problem" with sqlippool
by Antonio Modesto 21 Aug '12

21 Aug '12

Hi, I'm testing sqlippool, so far it's working well, but I'm with a exception that I haven't thought about it before. We use radius to authenticate the clients on wireless access points and with PPPoE, and now I started using sqlippool to dynamically distribute the IP's and BGP to announce the routes through the NAS'es. The problem is that radius allocates a IP for the client when he associates to an access point, (the wireless authentication is done with the MAC Address as the UserName and Password) and another IP when he connects on PPPoE, of course the IP allocated for the MAC is not used, but the record stays on the radippool table, and cannot be allocated to another user. Is there a way to do a regex or something like that before selecting a pool for the client? Thanks.

3 4

user groups in ldap
by Aqdas Muneer 21 Aug '12

21 Aug '12

Hello, I have setup freeradius with ldap lookup to authentication Cisco shell access. As if now i have 2 groups setup in the ldap database. One is for network admins who have full access to every device. The second group is for support staff that only have read access to all the devices, but within this group are some individuals who need full access to some devices. I'm trying to figure out what will be the best way to implement this? Do i create another group in ldap and make them members of that group (not sure if this will work because if one group is matched the searched will be stopped in the users file)? Do i use unlang to modify the accept-accpet based on username and NAS-ip? i trying to keep this as hands off as possible when it comes to management in the long run. If anyone has any experience dealing with such an issues, your advice will be greatly appreciated. Thanks in advance for you help. Aqdas

1 0

Re: MOTP-AS + Freeradius startup problem
by Бедняков Алексей 21 Aug '12

21 Aug '12

1 0

Question about SQLcounter and reject sessions
by Andres Gomez Ruiz 21 Aug '12

21 Aug '12

Hi everybody!! I have been using Freeradius as AAA of some wireless hotspots and it works great!! After reading the Rlm_sqlcounter wiki page I started to use it, and it also works great. This is the code of my sqlcounters: sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctsessiontime) FROM radacct WHERE \ username='%{%k}' AND acctstarttime > FROM_UNIXTIME('%b')" } sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT (UNIX_TIMESTAMP( NOW() ) - IFNULL(UNIX_TIMESTAMP(acctst$ } Everything works fine, but now I have a question about the dailycounter: I have some users that I need to reject their sessions at midnight, because of that Im using the dailycounter... but I need that user can't login again (the user is valid only 1 day). In this moment the user can login again the next day. How can I do to invalid the user after midnight? An example of an user: radcheck table username: user1 User-Password :="" radusergroup table username: user1 groupname: 1day radusergroup table groupname: 1day Max-Daily-Session := 12000 Thanks a lot!! * **Andres Gomez*

2 2

RE: Recording post auth sql data
by Franks Andy (RLZ) IT Systems Engineer 21 Aug '12

21 Aug '12

Ok, schoolboy error there! Thanks guys. Whilst on the subject, is it possible (in theory) to write different INSERT statements dependent on, for example, whether the post-auth section is based on having accepted or rejected the user. The sql modules named in the default virtual server file link through to a single post-auth section in dialup.conf with the insert statement, but is there any way of telling the module to link to a different insert statement? Or does all that not make any sense!? Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Matthew Newton Sent: 21 August 2012 14:21 To: FreeRadius users mailing list Subject: Re: Recording post auth sql data On Tue, Aug 21, 2012 at 01:33:00PM +0100, Franks Andy (RLZ) IT Systems Engineer wrote: > got into yet. I'd quite like to record the attribute ClientShortname as > referred to by the clients.conf file, but expansion of > '%{request:Client-Short-Name}' didn't seem to work - blank string. Looking at dictionary.freeradius.internal (and xlat.c) - try %{Client-Shortname}. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Recording post auth sql data
by Franks Andy (RLZ) IT Systems Engineer 21 Aug '12

21 Aug '12

Hi, Hope this is a quick request for someone to answer, been googling and can't find the reply. I've altered the post-auth sql recording data a bit from the standard schema - I wanted to record some of the details of the request packet without relying on the NAS to do "proper" accounting, which I haven't got into yet. I'd quite like to record the attribute ClientShortname as referred to by the clients.conf file, but expansion of '%{request:Client-Short-Name}' didn't seem to work - blank string. Can I do this? Sometimes the "Nas-Identifier" attribute reported by the NAS isn't all that useful and the local definition in the clients file would be better. Thanks Andy

4 3