- Freeradius-Users - lists.freeradius.org

selective disabling password logging for proxied users?
by Meike Stone 31 Jul '11

31 Jul '11

Hello, I'm sorry, that I ask again .. We are using the freeradius server with authentication against ldap as "local database" and proxy the realms (IPASS) to authenticate users are not in our database. So is is possible, to disable the password logging only for the proxied request? The local requests are only users who got a temporary voucher. In case of failure, the help desk should use the log to check if the user did use the correct password. But the password for IPASS users password should not be logged. If I disable the password logging in the detail section (suppress {User-Password}), the complete password logging will be disabled. Is it possible, to disable this selective only for proxied users? Thanks for help - Meike

1 0

How to create a new dictionary.brocade
by Wagner Pereira 29 Jul '11

29 Jul '11

Hello, guys. I have new Brocade TurboIron switches and I intend to configure aaa using one external FreeRADIUS server. I noticed that in my FreeRADIUS 2.0.4 there is no dictionary.brocade (see below). My question: is there a specific tool to create a new dictionary OR it is just to vi the file correctly and save it at the right directory? ------------------------ # # dictionary.brocade # VENDOR Brocade 1588 # # attributes # ATTRIBUTE Brocade-Auth-Role 1 string Brocade ATTRIBUTE Brocade-AVPairs1 2 string Brocade ATTRIBUTE Brocade-AVPairs2 3 string Brocade ATTRIBUTE Brocade-AVPairs3 4 string Brocade ATTRIBUTE Brocade-AVPairs4 5 string Brocade ATTRIBUTE Brocade-Passwd-ExpiryDate 6 string Brocade ATTRIBUTE Brocade-Passwd-WarnPeriod 7 string Brocade ------------------------ Regards, -- ### At PoP-SP/RNP, every day is an IPv6 day ### Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fixo. +55 11 3091-8901 Móvel. +55 11 9923-9554 fone@RNP: 10158902

3 2

RE: Unlang issue
by Garber, Neal 29 Jul '11

29 Jul '11

> Try: > > if ((Client-IP-Address == x) || (Client-IP-Address == y)) { > } No joy :-(. For now, I ended up doing: if (Called-Station-Id) { if (Client-IP-Address == "x") { update request { Huntgroup-Name := "zzzz" } } elsif (Client-IP-Address == "y") { update request { Huntgroup-Name := "zzzz" } } } Not as efficient, but it works. I'll retest the old unlang code after I upgrade later this year.

1 0

SQL check in XOR
by Rosario Lumia 29 Jul '11

29 Jul '11

Hi to all, I have more SQL in which check for accounting infos. In my "sites-enabled/default" file I have in my accounting section: {... sql1 sql2 sql3 ... } I notice that in this way the process check if AT LEAST one of above tables "returns ok", but I'd want accounting module returns OK iff exactly ONE of that returns ok. Is there a way to configure in this XOR way? Thanks in advance. Regards -- Rosario L.

2 2

Reuse Customized Attributes
by d.thembiliyagoda＠lancaster.ac.uk 29 Jul '11

29 Jul '11

Hi, I defined an attribute in dictionary file as follows. ATTRIBUTE My-Local-String 3000 string and I used it in policy.conf file to assign value of the EAP -TTLS inner tunnel user name. test1 { update outer.request { My-Local-String := "%{request:User-Name}" } update reply { User-Name := "%{request:User-Name}" } update reply { Auth-Type := "%{control:Auth-Type}" } I called the test1 under the authorize section in inner-tunnel virtual server. I want to re-use this attribute "My-Local-String" in a mysql query. But it doesn't contain any value . It stores an empty value in UserName filed of the table. postauth_query = "INSERT INTO ${cui_uname_table} \ (UserName, CUI, DateTime) \ VALUES \ ('%{My-Local-String}', '%{reply:Chargeable-User-Identity}', SYSDATE())"; I am executing this query under the post-auth section of the default server. Is there any way achieve this ? Champika

1 0

Yet another multiple SSID setup question
by Nick Kartsioukas 29 Jul '11

29 Jul '11

I've been looking through the wiki and staring at the config files and I'm...confused. I've successfully gotten our Cisco WLC to authenticate against ActiveDirectory as well as a Sun LDAP server (just one at a time) via FreeRADIUS for a single test SSID, but now I'm trying to figure out how to split that into conditional checks. Before I go chopping up the existing config files and making a horrible mess of things, I wanted to verify a few things with the wisdom of the list. Okay...let's say I have an SSID for students and an SSID for staff. Students authenticate against LDAP, which stores passwords as salted SHA1 hashes. Staff authenticate against Windows ActiveDirectory. I've found where the WLC sends the SSID to FreeRADIUS, so I can get at that. My question is, how do I set up the EAP-TTLS/PAP session for the Student SSID and the separate PEAP/MSCHAPv2 session for the Staff SSID? Are these configured as different virtual servers? Or just different modules that I call from the users file like so: DEFAULT Auth-Type := student_module, Called-Station-SSID := "student" DEFAULT Auth-Type := staff_module, Called-Station-SSID := "staff" If so how do I set that up, as that would be two different eap.conf setups (wouldn't it)? Am I missing something obvious in the docs? Thanks for taking the time to help me out!

6 13

can policy.conf be used to create an access control list
by michael lamborn 28 Jul '11

28 Jul '11

Hi, I am using version freeRadius 1.1.7. I am trying to create an access control list via radius, to prevent specific PC's/locations from accessing my network. Please see my policy.conf example below. My freeRadius server keeps sending an access-accept, when I try to login in from my office as a test, which has the IP address 10.2.222.35. I don't understand why the server is allowing the login. It seems logical to me the way that I have approached an implementation, but I can't find any specific info from the wiki or in internet searches. So I am not sure if I am still misconfigured or if it just doesn't work for some other reason. Thanks, Mike In policy.conf, I have the following, but it doesn't have any affect ( I do have '$INCLUDE ${confdir}/policy.conf' in my radiusd.conf file): policy { forbid_login_ip_hosts { %{request:Login-IP-Host} =~ /^10.2./ { reject } } }

3 2

Re: Freeradius mysql (problem)
by Chaos Lord 28 Jul '11

28 Jul '11

Hi, i have the exact same problem here with a Linksys access point. The Access list to the AP works fine allowing the client to connect. But the authentication fails. When i enter the client with it's login in the users file like this "myclientuser" Cleartext-Password := "myclientspassword" it works fine. As soon as i try this on the mysql System i do not get the access. The Allowd hosts access still works fine.... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-mysql-problem-tp4638453p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

chilli + freeradius + opendirectory
by Massimiliano Tommasi 28 Jul '11

28 Jul '11

Hi, I'm moving step by step to get my system working... My architecture is: WEB.CLIENT<--->CHILLI(captive.portal)<--->FREERADIUS<--->OPENLDAP My problem now is between chilli and opendirectory THRU freeradius. Chilli supports chap or pap. I'm not able to use chap because, it's not compatible with openldap and I get as message error that I need a text-plain password. I'm not sure that using pap, it could be working. If I'm right, I'm able to convert the password to plain-text after chilli and before radius..., or am I wronging? Is there a way, I can authenticate my users from web-interface on opendirectory thru FREERADIUS? The other way could be kerberos but, if i have well understood, I'll get the same problem. Give me some help, please. Regards, Max

2 4

Unlang issue
by Garber, Neal 28 Jul '11

28 Jul '11

I'm running FR 2.1.6 (I know - I plan to upgrade later this year). Is there anything wrong syntactically with the following code or is this a bug that was fixed since 2.1.6? if (Client-IP-Address == "172.20.16.28" || Client-IP-Address == "172.20.204.10")) { update request { Huntgroup-Name := "GlobalRoaming" } } # # If NAS is an autonomous AP, get SSID from Cisco-AVPair # if (Huntgroup-Name == "EEProdAP" || \ Huntgroup-Name == "EETestAP") { if (Cisco-AVPair =~ /ssid=(.*)/) { update request { SSID-Name = "%{1}" } } } I ask because the first if statement only works if the Client-IP-Address matches the first address listed (172.20.16.28). I would expect that it would evaluate to true if Client-IP-Address matches either of the addresses. Here's a snippet of debug output that illustrates the problem - it doesn't appear to finish the logical or comparison: Info: ++? if (Called-Station-Id && (Client-IP-Address == "172.20.16.28" || Client-IP-Address == "172.20.204.10")) Info: ? Evaluating (Called-Station-Id ) -> TRUE Info: expand: %{Client-IP-Address} -> 172.20.204.10 Info: ++? if (Huntgroup-Name == "EEProdAP" || Huntgroup-Name == "EETestAP") Info: (Attribute Huntgroup-Name was not found) When I switch the order of the addresses for the logical or, I see the following in debug (it does the comparison and returns TRUE): Info: ++? if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) Info: ? Evaluating (Called-Station-Id ) -> TRUE Info: expand: %{Client-IP-Address} -> 172.20.204.10 Info: ?? Evaluating (Client-IP-Address == "172.20.204.10" ) -> TRUE Info: ?? Skipping (Client-IP-Address == "172.20.16.28") Info: ++? if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) -> TRUE Info: ++- entering if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) {...} Info: +++[request] returns ok Info: ++- if (Called-Station-Id && (Client-IP-Address == "172.20.204.10" || Client-IP-Address == "172.20.16.28")) returns ok Info: ++? if (Huntgroup-Name == "EEProdAP" || Huntgroup-Name == "EETestAP") Info: ? Evaluating (Huntgroup-Name == "EEProdAP" ) -> FALSE Info: ? Evaluating (Huntgroup-Name == "EETestAP") -> FALSE Info: ++? if (Huntgroup-Name == "EEProdAP" || Huntgroup-Name == "EETestAP") -> FALSE

3 4