- Freeradius-Users - lists.freeradius.org

Attribute not passing to NAS?
by Rob Yamry 02 Dec '10

02 Dec '10

I have a Enterasys HiPath controller that Im trying to pass an attribute to throw the user into the correct policy upon authentication. I talked with their support and they say to set the Filter-Id attribute to the name of the policy set on the controller. I did, but it doenst seem to pass. In the debug for radius I get this: [peap] Got tunneled reply RADIUS code 2 Filter-Id = "Faculty" EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ktest" and it goes on to: Cleaning up request 18 ID 109 with timestamp +12 User-Name = "ktest" NAS-IP-Address = 127.0.4.1 NAS-Port = 222 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:24:d6:a6:ce:ce" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP09" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "Students" Siemens-Topology = "TopoStudents" Siemens-Ingress-Rate = "Unlimited" Siemens-Egress-Rate = "Unlimited" I use LDAP (via eDirectory) on the backend and authentication is working fine. It pulls the correct value for the Filter-Id attribute, but it doesnt seem to take effect. The Siemens-xxx attributes are coming from the controller and you can see based on the Siemens-Policy = "Students" attribute that the student policy is still applying - not the Faculty policy as is defined in the Filter-Id attribute. I have also tried to set the Siemens-Policy attribute on the user but that did not work either. Am I missing something in the config to have this value sent back to the NAS? FreeRadius 2.1.8

2 6

where to MAC addresses?
by Gilberto Uriostegui García 02 Dec '10

02 Dec '10

Description: Windos Vista OS With an implementation of Oracle VM VirtualBox virtual machine Ubuntu 9.10 with a server radiusd aser nesesito filtration equipment through this server The question is ... Where I have to put the MAC addresses of the users? so that only they can enter their MAC I hope my question and be concise and can help me Thanks Friends ...

2 1

validation of MAC addresses
by aLeJaNdRo Figueroa 02 Dec '10

02 Dec '10

Hello I have installed on my computer a virtual machine which has installed the Ubuntu OS 2.1.10, install freeradius and I have it running. I have doubts about the MAC addresses I know they are validated and are discharged sen Directory users and clients But how to do it My question is how they are validated and high MAC addresses

1 0

mac address validation
by Jorge L. Herrera 02 Dec '10

02 Dec '10

Hi ... my name is Jorge I have a virtual machine with Ubuntu operating system and installed freeradius, I validate mac address. I know how high the addresses given in the file mac users? and validated as mac addresses? your help will be very important !!!!!

1 0

mac address validation
by Jorge L. Herrera 02 Dec '10

02 Dec '10

Hi ... my name is Jorge I have a virtual machine with Ubuntu operating system and installed freeradius, I validate mac address. I know how high the addresses given in the file mac users. and As validate mac address your help will be very important !!!!!

1 0

(no subject)
by Zoet Omar Zepeda 02 Dec '10

02 Dec '10

HELLO!!!! COULD TELL ME TO syntax to add client in freeradius and could tell me to sintax to add user in freeradius

1 0

Informacio
by Horacio Andrade Zepeda FELIZZZZZZ 02 Dec '10

02 Dec '10

Hi I am newbie at this help please Description O. System Windos Vista With 1 application of Oracle VM VirtualBox Virtual Machine O. System Ubuntu 10.10 with a server radiusd aser nesesito mac filtering equipment through this server Well my question is if the users file I register users with their password to be linia file that I register the MAC addresses Well I hope and I can help because it is very important to me as it is for a practice School Thanks

1 1

Re: use existing sql table for user-password
by Brian Candler 02 Dec '10

02 Dec '10

> > But for radcheck, i need to add attribute and value fields as i see. > > How can i check just username and password from one table, and check other > > attributes (AuthType etc) from another?? > > Write an SQL function. Or use the group functionality. That is, use authorize_check_query authorize_reply_query to get the password, and group_membership_query authorize_group_check_query authorize_group_reply_query to get the attributes from another table. In group_membership_query you map the username to some other key, but you can just map it to the username again if you wish. But if this is MySQL, as Alan says it may be easier (and is certainly more flexible) to put your logic into stored procedures. Then use authorize_check_query = "call getCheck('%{User-Name}');" authorize_reply_query = "call getReply('%{User-Name}');" Regards, Brian.

2 1

redundant LDAP-Group
by Alexander Clouter 02 Dec '10

02 Dec '10

Hi, I know this has been covered in the archives, and the news is generally not good, but my users file currently looks like: ---- DEFAULT NAS-Identifier == switch, Huntgroup-Name == allied-telesis, ldap_login1-LDAP-Group == it-switch-admin Service-Type = Administrative-User DEFAULT NAS-Identifier == switch, Huntgroup-Name == allied-telesis, ldap_login2-LDAP-Group == it-switch-admin Service-Type = Administrative-User DEFAULT NAS-Identifier == switch, Huntgroup-Name == cisco, NAS-Port-Type == Virtual, ldap_login1-LDAP-Group == it-switch-admin Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT NAS-Identifier == switch, Huntgroup-Name == cisco, NAS-Port-Type == Virtual, ldap_login2-LDAP-Group == it-switch-admin Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" DEFAULT NAS-Identifier == switch, Auth-Type := Reject ---- In my global configuration I have: ---- instantiate { ldap_login1 ldap_login2 redundant-load-balance ldap-login { ldap_login1 ldap_login2 } ldap_lanwarden1 ldap_lanwarden2 redundant-load-balance ldap-lanwarden { ldap_lanwarden1 ldap_lanwarden2 } } ---- It would be really nice to fold those duplicate LDAP-Group lines into 'ldap_login-LDAP-Group', however alas FreeRADIUS does not love me: ---- /etc/freeradius/LOCAL/users-login[1]: Parse error (check) for entry DEFAULT: Invalid octet string "it-switch-admin" for attribute name "ldap_login-LDAP-Group" Errors reading /etc/freeradius/LOCAL/users-login /etc/freeradius/LOCAL/modules.conf[1]: Instantiation failed for module "files-login" /etc/freeradius/sites-enabled/login[72]: Failed to load module "files-login". /etc/freeradius/sites-enabled/login[35]: Errors parsing authorize section. ---- This 'redundant' LDAP-Group problem often crops up, unfortunately it is way above my head to resolve. Another "moon-on-a-stick" feature is that I have two sets of LDAP servers configured[1], in my authorise section I have: ---- authorize { ... ldap-login if (!ok) { reject } files ... } ---- If I instead simply use 'LDAP-Group' in the users file, 'ldap-lanwarden' is invoked (rather than me expecting a contination of the last used LDAP server)... Is this a bug or a 'feature'? Cheers [1] ldap_login[12] -> ldap_login, ldap_lanwarden[12] -> ldap_lanwarden -- Alexander Clouter .sigmonster says: An idea is not responsible for the people who believe in it.

3 6

Accounting and Acct-Delay-Time in MySQL
by Stefan Winter 02 Dec '10

02 Dec '10

Hello, the default queries for mysql log Acct-Delay-Time into the columns acctstartdelay and acctstopdelay, respectively. They leave the timestamps for acctstarttime and acctstoptime at %S. For a non-zero delay, this means that a database reader needs to do math to get the start and stop times. It is rather unintuitive that a database user needs to calculate the *actual* event times manually by substracting the values. This is something that MySQL can easily do on its own at INSERT or UPDATE. Is there a specific reason why the two are kept separate? If not, I'll merrily volunteer to update the default query set to do so; I'll do this for my deployment's custom queries anyway. This would also make the two columns for delay time obsolete. Any thoughts on this? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4