- Freeradius-Users - lists.freeradius.org

Problem with sql entry
by Miha Zoubek 20 Dec '11

20 Dec '11

Hi, please help me out why I am getting two entries in mysql table (radacct) for outgoing call. If the call is answered I get two entries and one entry if the call is not answered (this is ok). Reason that I am asking this is that I do not see that my NAS is sending two start packet and to stop packet for answered call (you can see below). Please help me out understand why radius add two entries for stop packet if only one is send from NAS. 1. Call is not answered. 3126.504593 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=192, l=265) 3126.506361 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=192, l=20) 3128.512626 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Access-Request(1) (id=193, l=61) 3128.514192 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Access-Accept(2) (id=193, l=20) 3135.215365 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=194, l=362) 3135.217317 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=194, l=20) 2. Call is answered. 3142.992787 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=195, l=265) 3142.994570 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=195, l=20) 3145.001503 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Access-Request(1) (id=196, l=61) 3145.003161 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Access-Accept(2) (id=196, l=20) 3154.440904 xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy RADIUS Accounting-Request(4) (id=197, l=401) 3154.443202 yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx RADIUS Accounting-Response(5) (id=197, l=20) Bellow I am pasting only radius log for answered call. rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 48752, id=198, length=265 Acct-Status-Type = Start Acct-Session-Id = "d446d20a-6d1c-4ffd-9b59-1aedbf63b74c" User-Name = "123456789" Freeswitch-Src = "123456789" Freeswitch-CLID = "123456789" Freeswitch-Dst = "051357952" Freeswitch-Dialplan = "XML" Framed-IP-Address = zzz.zzz.zzz.zzz Freeswitch-Context = "default" Freeswitch-Ani = "123456789" Freeswitch-Source = "mod_sofia" Freeswitch-Callstartdate = "2011-12-20T09:49:22.535428+0100" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xxx.xxx.xxx.xxx,NAS-IP-Address = xxx.xxx.xxx.xxx,Acct-Session-Id = "d446d20a-6d1c-4ffd-9b59-1aedbf63b74c",User-Name = "123456789"' [acct_unique] Acct-Unique-Session-ID = "01f7930c1c838911". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "123456789", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> xxx.xxx.xxx.xxx [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] expand: %t -> Tue Dec 20 09:49:38 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> 123456789 ++[radutmp] returns ok [sql] expand: %{User-Name} -> 123456789 [sql] sql_set_user escaped user --> '123456789' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 123456789 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 198 to xxx.xxx.xxx.xxx port 48752 Finished request 48. Cleaning up request 48 ID 198 with timestamp +5699 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 46971, id=199, length=61 User-Name = "123456789" User-Password = "1234" NAS-Port = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "123456789", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 123456789 [sql] sql_set_user escaped user --> '123456789' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '123456789' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '123456789' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '123456789' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "1234" [pap] Using clear text password "1234" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 199 to xxx.xxx.xxx.xxx port 46971 Finished request 49. Going to the next request Waking up in 4.9 seconds. Cleaning up request 49 ID 199 with timestamp +5701 Ready to process requests. rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 35569, id=200, length=401 Acct-Status-Type = Stop Acct-Session-Id = "68507972-f9d9-46c7-bf22-59020602ffe2" Freeswitch-Hangupcause = Normal-Clearing User-Name = "123456789" Freeswitch-Src = "123456789" Freeswitch-CLID = "Extension 123456789" Freeswitch-Dst = "38651357952" Freeswitch-Dialplan = "XML" Framed-IP-Address = yyy.yyy.yyy.yyy Freeswitch-Context = "default" Freeswitch-Ani = "123456789" Freeswitch-Source = "mod_sofia" Freeswitch-Billusec = 3089990 Freeswitch-Callstartdate = "2011-12-20T09:49:24.552424+0100" Freeswitch-Callanswerdate = "2011-12-20T09:49:30.669405+0100" Freeswitch-Callenddate = "2011-12-20T09:49:33.759395+0100" Acct-Session-Time = 3 Freeswitch-Signalbond = "outbound" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xxx.xxx.xxx.xxx,NAS-IP-Address = xxx.xxx.xxx.xxx,Acct-Session-Id = "68507972-f9d9-46c7-bf22-59020602ffe2",User-Name = "123456789"' [acct_unique] Acct-Unique-Session-ID = "a2fd914fe7c27b9c". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "123456789", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> xxx.xxx.xxx.xxx [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/detail-20111220 [detail] expand: %t -> Tue Dec 20 09:49:49 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> 123456789 rlm_radutmp: Logout entry for NAS xxx.xxx.xxx.xxx port 0 has wrong ID ++[radutmp] returns ok [sql] expand: %{User-Name} -> 123456789 [sql] sql_set_user escaped user --> '123456789' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstarttime = '%{Freeswitch-Callanswerdate}', acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstarttime = '2011-12-20T09:49:30.669405=2B0100', acctstoptime = '2011-12-20 09:49:49', acctsessiontime = '3', acctinputoctets = '0' << rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: %{Acct-Session-Time} -> 3 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Inpu rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 123456789 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 200 to xxx.xxx.xxx.xxx port 35569 Finished request 50. Cleaning up request 50 ID 200 with timestamp +5710 Going to the next request Ready to process requests. -- Best regards / Lep Pozdrav Miha Zoubek Softnet d.o.o.

2 2

VSA's and local dictionary
by Andrew Long 20 Dec '11

20 Dec '11

Greetings, I am running freeradius-server-2.1.8-0 on CentOS 5.6 and am setting up some new NAS, Nomadix AG3100. Every so often, when running in debug, the server reports "Invalid packet code 4 sent to authentication port from client AG3100 port 1032 : IGNORED". After searching past threads, I understand there is no way to know what is being sent short of sniffing the packets. As I'm not doing much with accounting, I'm not terribly concerned, but it did prompt me to take a look at the dictionaries in /usr/share/freeradius. Sure enough, there is a Nomadix dictionary file, but it lists only 13 attributes (content below), while the vendor supplied list includes 6 additional VSA's. I read in the dictionary man page that "The dictionaries in /usr/local/share SHOULD NOT be edited", while "If you need to add new attributes, please edit the /etc/raddb/dictionary file". So, the question is, will the following entry in /etc/raddb/dictionary correctly add the "new" attributes? I have not entered the types yet, waiting on the OEM for some clarification. #ATTRIBUTE name number type [vendor|options] ATTRIBUTE Nomadix-Qos-Policy 14 [type] Nomadix ATTRIBUTE Nomadix-SMTP-Redirect 17 [type] Nomadix ATTRIBUTE Nomadix-Centralized-Mgmt 18 [type] Nomadix ATTRIBUTE Nomadix-Group-Bw-Policy-ID 19 [type] Nomadix ATTRIBUTE Nomadix-Group-Max-up 20 [type] Nomadix ATTRIBUTE Nomadix-Group-Max-Down 21 [type] Nomadix Thank you for any help. - Andrew Long Here is the existing dictionary... # FILE: /usr/share/freeradius/dictionary.nomadix # -*- text -*- # # Version: $Id$ # VENDOR Nomadix 3309 # BEGIN-VENDOR Nomadix ATTRIBUTE Nomadix-Bw-Up 1 integer ATTRIBUTE Nomadix-Bw-Down 2 integer ATTRIBUTE Nomadix-URL-Redirection 3 string ATTRIBUTE Nomadix-IP-Upsell 4 integer ATTRIBUTE Nomadix-Expiration 5 string ATTRIBUTE Nomadix-Subnet 6 string ATTRIBUTE Nomadix-MaxBytesUp 7 integer ATTRIBUTE Nomadix-MaxBytesDown 8 integer ATTRIBUTE Nomadix-EndofSession 9 integer ATTRIBUTE Nomadix-Logoff-URL 10 string ATTRIBUTE Nomadix-Net-VLAN 11 integer ATTRIBUTE Nomadix-Config-URL 12 string ATTRIBUTE Nomadix-Goodbye-URL 13 string VALUE Nomadix-IP-Upsell PrivatePool 0 VALUE Nomadix-IP-Upsell PublicPool 1 END-VENDOR Nomadix ############# END FILE #############

2 2

VLAN attribution in an eduroam setting - proxied users
by Rui Ribeiro 20 Dec '11

20 Dec '11

Good morning list, I´ve been setting up a freeradius to operate in the eduroam environment. At the moment my problem is the VLAN attribution that is done depending on the Windows domain of the user, or if it is in roaming from another institution. I´ve solved the VLAN based in the Windows domain, using in the /etc/freeradius/users file the following directives. DEFAULT Ldap-Group == "ISCTE" Service-Type = "Framed-User", Reply-Message = "Eduroam ISCTE", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "211" DEFAULT Ldap-Group == "Alunos" Service-Type = "Framed-User", Reply-Message = "Eduroam Alunos", Framed-MTU = 1300, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "212" As for the VLAN attribution wether the user is a roaming user (i.e. goes to a proxy to be authenticated), I have done several tries, without sucess. Haven't managed to do it through the users file above;my last attemp was trying to setting them up in the /etc/freeradius/attrs file with attr_filter.post-proxy, however it seems to interfere with the AEP/password negotiation. The setup is as follows, and I would like to ask for an alternative of where to insert the roaming VLAN. post-proxy { post_proxy_log attr_filter.post-proxy # here <--------------------------- Post-Proxy-Type Fail { detail } } and then the attrs file: DEFAULT EAP-Message =* ANY, User-NAme =* ANY, MS-MPPE-Send-Key =* ANY, MS-MPPE-Recv-Key =* ANY, Message-Authenticator =* ANY, State =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Session-Timeout =* ANY, Idle-Timeout =* ANY, MS-CHAP-MPPE-Keys =* ANY, Service-Type := "Framed-User", Reply-Message := "Eduroam Roaming", Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-Id := "216", Framed-MTU := 1300, Framed-Filter-ID =* ANY Regards, Rui Ribeiro

2 1

sqlippool IP conflict problem
by Коньков Евгений 20 Dec '11

20 Dec '11

Hi, FreeRadius. while frame IP address to user there are three stage in sqlippool clear find update clear stage - clear info about expired framed IP (JUST CLEAR!) so *new* connected user have a chance get IP address of *current* online user whose IP address is expired. This will cause IP conflict. does radius make any signal to nitify this situation? or is it possible to frame other IP address to *current* online user? or at least drop *current* online user? -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 6

PATCH: fixing log messages in rlm_sqlippool
by Коньков Евгений 20 Dec '11

20 Dec '11

rlm_sqlippool.c if ((data->allocate_find == NULL) ||. (strlen(data->allocate_find) == 0)) { - radlog(L_ERR, "rlm_sqlippool: the 'allocate_find' statement must be set."); + radlog(L_ERR, "rlm_sqlippool: the 'allocate-find' statement must be set."); sqlippool_detach(data); return -1; } if ((data->allocate_update == NULL) || (strlen(data->allocate_update) == 0)) { - radlog(L_ERR, "rlm_sqlippool: the 'allocate_update' statement must be set."); + radlog(L_ERR, "rlm_sqlippool: the 'allocate-update' statement must be set."); sqlippool_detach(data); return -1; }

1 0

Hi
by Jeisson Fabian Perez Rodriguez 20 Dec '11

20 Dec '11

Hi, I have a problem with freeradius! I installed it, and the server is running nice but when I try to connect to this server from another terminal, the server stop suddenly and in the window appears segment fault somebody can help me, please!

3 8

FreeRadius Authentication using Active Directory
by McSparin, Joe 19 Dec '11

19 Dec '11

I have followed several tutorials for setting up Active Directory with FreeRadius. When I run the ntlm_auth from the command line I get a success message however when I run the radtest with the username and password I get a Access-Reject. I am using FreeRadius 1.8 and I have included the message I get from radiusd -X. Any input would be greatly appreciated. rad_recv: Access-Request packet from host 10.1.174.126:3421, id=26, length=49 User-Name = "testuser" User-Password = "testpassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "jmcsparin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3

Cisco WLC + freeradius
by LEONARDO FELL 19 Dec '11

19 Dec '11

I'm trying to configure dynamics wlans using Cisco WLC + freeradius, but I have some issues. I modified the ldap.attrmap, including the attributes: replyItem Tunnel-Type radiusTunnelType replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId However, when a try to connect, the freeradius replies a "0" (ex: Tunnel-Private-Group-Id:0) after the attribute, as you can see below: Sending Access-Accept of id 146 to 10.1.0.161 port 32768 Tunnel-Private-Group-Id:0 = "85" Tunnel-Medium-Type:0 = 802 Tunnel-Type:0 = VLAN Filter-Id = "Enterasys:version=1:policy=Aluno" MS-MPPE-Recv-Key = 0xcfcf3c464de734110cda4f22dc1ed36c2e7e5c629861059036e61fb5e98d104b MS-MPPE-Send-Key = 0x8115583c24b0c533eca2417e1a82e092bd908417dee2cecdeb3b89d857f4634f EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "leofell" I think it may the problem and I'd like to know why it happens.. Thanks! -- Leonardo Fell Setor de Redes - NTI Centro Universitário UNIVATES Fundação Vale do Taquari de Educação e Desenvolvimento Social - FUVATES Telefone: (51)37147000 Ramal 5809 www.univates.br

3 5

port 1813
by Selcuk Yazar 19 Dec '11

19 Dec '11

Hi, we have FreeRADIUS Version 2.1.12 on freebsd, in proxy.conf we have settings ; home_server localhost { type = auth+acct port = 1812 ... } but when i looked up with netstat- n freeradius doen't listen port 1813 . what is the problem ? thanks in advance. -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 1

Re: Referencing LDAP attributes in post-auth
by Adam Track 19 Dec '11

19 Dec '11

>Full debug please. > >Broadly speaking the approach you're trying should work. Most likely >there's some subtlety which the partial debug doesn't show. > >One obvious question: you have defined "Person-Type" in a dictionary >somewhere, haven't you? e.g. in raddb/dictionary: > >ATTRIBUTEPerson-Type3099string > >Also, the usual "upgrade 2.1.8 is a bit old" note goes here ;o) I recently saw another question along the same lines as this, so decided to give this another go... Am now running 2.1.10, and yes, Person-Type is defined in dictionary and ldap.attrmap. I've also defined in dictionary the following in hopes of passing on the value of Person-Type to this attribute: ATTRIBUTE Person-Group 3001 string For the (outer) virtual server, in the authorize block I have the following: ... ldap update control { Person-Group = "%{reply:Person-Type}" } ... In post-auth: ... update reply { Reply-Message := "You are %{control:Person-Group}." } ... I still cannot figure out how to pass this value from authorize to post-auth. BTW, this is a multi-valued attribute, so what I'm really trying to do is to call a perl script in post-auth to iterate through all possible values, and set vlan based on whether a particular value exists, thus shouldn't be done within authroize. Debug attached (I hope).. can't seem to post with it on here due to 100KB limit. A.

3 8