November 2016 - Freeradius-Users - lists.freeradius.org

TLS Cache
by Adam Bishop 17 Nov '16

17 Nov '16

Using 3.0.x is it possible to simply test for a resumed/cached session in post-auth? I think I can do it by setting an attribute in the outer virtual server, then checking to see if the inner virtual server modified it or not, but that seems hacky. The end goal is that I'd like to include a value in the linelog config so that I can monitor the effectiveness of the cache, so it gets noticed if a change breaks it. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

1 0

using groupname in accounting/authorize in deafult
by firing neurons 17 Nov '16

17 Nov '16

Hi, TL;DR: read last 5 lines. I want to use the groupname of the user for which the NAS has sent Access/Accouting-Request or Interim update in a sql query (via xlat) in default. I have tired groupname='%{Group}' groupname='%{Sql-Group}' (this should be the one i think) groupname='%{Group-name}' but it always resolves to '' (empty) like the attributes doesn't exist. doing Tmp-String-0 := "%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}" will set Tmp-String-0 to the groupname but when i try to use it in another query like groupname='%{Tmp-String-0}', it resovles to '' (empty). Basically I want this to happen: for two groups named abc and abc_ex with the same attribute name having diffrent vaules of said attribute: groupname = '%{Sql-Group}_Ex' resolves to groupname = abc_ex and groupname = '%{Sql-Group}' resolves to groupname = abc Regards, FN

1 0

Skip policy check if there is no outer request
by Adam Bishop 16 Nov '16

16 Nov '16

I'm using the 'filter_inner_identity' policy to check if a user is trying to do nasty things with their outer/inner id's. However, it has the side effect of preventing me from doing such things. I can whitelist the NAI easily enough, but for this situation I can rely on there not being an outer request (I'm poking the inner-tunnel port directly with radclient). Can I test for the existence of an outer request using unlang? Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 2

Temporary accounts
by Zsolt 16 Nov '16

16 Nov '16

Hi all! Can I set up users accounts in v3.x which expire after some specified time after login? (If yes, how?)

4 7

different answers depending on the time
by Marcin 16 Nov '16

16 Nov '16

Hi Now my configuration responses to NAS with Mikrotik-Rate-Limit regardless of the time and get data from database. I'd like to speed up speed depending on time and when client will connect between 23 and 11 I'd like to multiply his speed. I can create another column for night speeds in database. In freeradius configuration i can create another section, similar to present, which will get data from night speeds is there any solution to configure freeradius to different answer depending on time? something like this, depending on condition? if ( time between 11 and 23){ normal_speeds } else { night_speeds } -- Pozdrawiam Marcin / nicraM

3 6

framed-pool
by Zubair Ayub 16 Nov '16

16 Nov '16

i was using mikrotik routers and using framed pool attribute now i move to cisco want to remove framed pool attribute. any help because when i remove this attribute my user stop connecting.

2 1

Escaping * in ldap filters
by Peter Lambrechtsen 15 Nov '16

15 Nov '16

Running 3.0.x head from a few months ago. I'm trying to have a ldap search filter that if I don't have an existing VSA set then default to a * filter = "(&(SIID=%{Alc-Subsc-ID-Str})(Line=%{%{LineID}:-*}))" That in theory should mean if I don't have a LineID included in the request then I would return * instead, but it keeps on getting escaped. (0) ldap.id: EXPAND (&(SIID=%{Alc-Subsc-ID-Str})(Line=%{%{Line}:-*})) (0) ldap.id: --> (&(tcnzFixedBUASIID=V_1999999)(Line=\2a)) (0) ldap.id: Performing search in "ou=Fixed,o=Identities" with filter "(&(SIID=V_1999999)(Line=\2a))", scope "sub" (0) ldap.id: Waiting for search result... (0) ldap.id: Search returned no results If I just have a filter set to * then it's fine; filter = "(&(SIID=%{Alc-Subsc-ID-Str})(Line=*))" Any way to stop the * from being escaped?

2 2

simultaneous-use not working
by Zubair Ayub 15 Nov '16

15 Nov '16

simultaneous-use attribute not working in radcheck as well as radgroupcheck . my user connecting multiple time . thanks regards zubair ayub

3 4

Referring to module-specific information in post-auth
by Stefan Paetow 15 Nov '16

15 Nov '16

Hi, Another question for you... I don't really want to duplicate the LDAP server and Base DN information into the ldap xlats, but I can't seem to be able to pull that information in from the ldap module. I was expecting ${modules.ldap.server} to work, or ${modules:ldap.server}, or ${modules:ldap:server}, but neither work... Have you got any suggestions how I can do this? :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 5

eap-tls + postgresql
by kjonca＠o2.pl 14 Nov '16

14 Nov '16

I have some devices/users authenticated with eap-tls. I have "users" file and everything work. (ie. user which are in "users" file got authenticated, rest - not) I want to migrate to sql database, and I probably missed something - every example tells about user,atribute,op,value in radcheck/radreply - but in my users file I have no attributes (except DEFAUL) I tried to play with radusergroup but with no success - it is completely ignored and regardless of presence user name access is granted only on certificate. I think I missing something. KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html Samsung Wave to badziewie ...

4 7