April 2013 - Freeradius-Users - lists.freeradius.org

Re: Setting different IDLE-TIMEOUTS based on IP Address
by Alan Buxey 17 Apr '13

17 Apr '13

Use any one of the clients.conf methods that were mentioned yesterday with some unlang and this would be working already. I seem to recall that huntgroups might be going the way if the dodo(?) It doesn't do regex methods because its older... pre 1.0 code alan

1 0

FreeRADIUS using InnoDB.
by Antonio Fernández Pérez 17 Apr '13

17 Apr '13

Hi everybody, Are there any problem known about FreeRADIUS use with InnoDB as engine of MySQL? I know that FreeRADIUS has been developed for using MyISAM as engine but I think that could improve FreeRADIUS' performance. Any ideas? Thanks everybody. Best regards, Antonio Fernández.

3 2

Volume Control
by Russell Mike 17 Apr '13

17 Apr '13

Dear Alan D. What Freeraidus is using currently as to keep track. Is it 64bit or 32bit. Thanks / Regards

3 6

Trimming character of variables within configuration files
by P. Manton 17 Apr '13

17 Apr '13

Is there a way I could trim a variable (such as a password variable) within a configuration file. I saw a few examples manipulating variables using unlang here: http://freeradius.org/radiusd/man/unlang.html#lbAB but could not find anything about trimming variables. For example I have the following /etc/freeradius/ntlm_auth # # For testing ntlm_auth authentication with PAP. # # If you have problems with authentication failing, even when the # password is good, it may be a bug in Samba: # # https://bugzilla.samba.org/show_bug.cgi?id=6563 # exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=TEST.DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } The password variable input initially has an authentication code appended to the password and hence needs to be trimmed of the password variable so it authenticates with AD correctly. So e.g. the input password is: 'testing123456' - but needs to be trimmed to 'testing'

5 9

Setting different IDLE-TIMEOUTS based on IP Address
by John Giordano 16 Apr '13

16 Apr '13

Hi, So I have done a fair amount of RTFM'ing and search engining but am stumped. Perhaps someone on this list has successfully done what we are trying to do: Have our FreeRADIUS Server assign a different IDLE-TIMEOUT Value based on what IP Address is contacting the RADIUS server. OS: CentOS 5.8 FreeRADIUS Version: 2-2.1.12-4.el5_8 We have FreeRADIUS working fine (it has been a rock in fact and is running under Daniel Bernstein's daemontools). We just need to add this functionality as some of our network gear needs to have a different IDLE TIMEOUT than others. Is this possible? Thanks much, Jg

1 0

unsubscribe
by Julson, Jim 16 Apr '13

16 Apr '13

Jim C. Julson Sr. Network & Systems Administrator C 208.995.3297 jjulson(a)marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com/symposium-spring-2013.pdf> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.

1 0

Freeradius +LDAP + Samba integrates to Active Derectory
by John 15 Apr '13

15 Apr '13

Hi all, We deploy freeradius integrated to Active Directory, but the AD enabled "Require signing" option (see the attachement). net join is OK after we set "LDAP SASL wrapping" to 'sign'. But LDAP search failed. Is there a way to let LDAP search work? Can someone show me some reference or guide? Thanks, John

2 2

EAP-SIM simulation, how does Freeradius calculate MAC value in AT_MAC attribute
by Tabibel Sami 13 Apr '13

13 Apr '13

Hi, I am working on the implementation of an EAP-SIM supplicant, when i send to freeradius a EAP-Response/SIM/Start packet i receive as expected an EAP-Resquest/SIM/Challenge with AT_RAND (RAND value was specified in users file [2]) and AT_MAC, after this I should calculate MAC value and test if this value matches witch AT_MAC value sent by freeradius. my question is how freeradius calculate MAC value in AT_MAC atribute ? or from wich source freeradius fill MAC value in the AT_MAC attribute ? [2]: my eap-sim user is set in users file as below : 1262074920549791 Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0x39900000000000000000000000000000, EAP-Sim-SRES1 = 0x30112233, EAP-Sim-KC1 = 0x445566778899AABB, EAP-Sim-Rand2 = 0x31000000000000000000000000000000, EAP-Sim-SRES2 = 0x31112233, EAP-Sim-KC2 = 0x445566778899AABB, EAP-Sim-Rand3 = 0x32000000000000000000000000000000, EAP-Sim-SRES3 = 0x32112233, EAP-Sim-KC3 = 0x445566778899AABB Thank you in advance, Best regards. -- Sami

1 0

Re: Re: Freeradius 3 & LDAP Generic Attributes
by Nicholas Lemberger 12 Apr '13

12 Apr '13

The ldap.attrmap syntax in FR2 was: checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem Basically the ldap attributes radiusCheckItem & radiusReplyItem contained FR attr/value pairs which were then added to the corresponding attribute list in FR (e.g. in LDAP radiusReplyItem could be "Primary-DNS-Server := 1.1.1.1"). They wouldn't necessarily need to be distinct check/reply attributes in the new rlm_ldap... it could work more like unlang where an LDAP attribute value could be "control:Disabled := true", and where if the list: portion is omitted it would default to reply. No matter how this happens, there's probably going to need to be a special case syntax made in the rlm_ldap attribute mapping... Best Regards, -Nick

2 2

how can detect the cues of reject
by Mehdi Ravanbakhsh 12 Apr '13

12 Apr '13

how we can detect cues of reject in any section of default(site enable) ? do we have any internal attribute or any source that can be use for determine cues of rejecting user ? best regards.

2 2