- Freeradius-Users - lists.freeradius.org

username@domain
by zouzou 10 Nov '10

10 Nov '10

Hello, I have two users: test1 and test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling it , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/username-domain-tp3258786p3258786.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

LDAP Groups
by Hugh Blandford 10 Nov '10

10 Nov '10

Dear All, I have been experimenting with using FreeRADIUS and LDAP, trying to get some understanding of how groups are handled. I have left things in the configuration files mostly as standard, except uncommenting the LDAP sections but am obviously not understanding how things are supposed to work. I can place an LDAP group name in the users file and then have my LDAP user checked against it and return the relevant attributes. eg (following someone's helpful example) DEFAULT Ldap-Group == flat10000, User-Profile := "uid=flat10000,ou=profiles,ou=radius,ou=wl,dc=example,dc=org" Fall-Through = yes DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk.", Fall-Through = no However, I was hoping to not use the users file. I was hoping that: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName would mean you could add the attribute radiusGroupName to a user's entry and it would then look up the relevant GroupofNames and add those attributes to the return items. However, when I add radiusGroupName to a user's entry I don't see any groupname lookups in the debug at all. Sorry if I have failed to understand something basic. What I actually want to do is might not be solved best by LDAP groups. Most of our customers are in different VRFs and this, the loopback address and DNS servers etc are returned. Rather than store this information under each user I would like to have template that I refer to. However, at the same time, having 50+ default entries didn't seem the right way to do it either. Thanks for your patience. Hugh Blandford -- Hugh Blandford Island Internet ph 1300 130 428 mb 0412 016 875

5 7

EAP-AKA patch
by dfds fds 10 Nov '10

10 Nov '10

Hi , I searched web via google , but i am not able to find the patch for AKA support for free radiusAll are pointing to http://bugs.freeradius.org/show_bug.cgi?id=386but this is no longer exists , did anybody have the patch? please send me the patch.

1 0

LDAP Frontend with Support for RADIUS Schema
by Holger Rauch 09 Nov '10

09 Nov '10

Hi, I would like to use FreeRADIUS on either Debian or FreeBSD stable for VPN user authentication. Authentication should be based on the following information: a) username+MIT Kerberos password b) MAC address of the machine c) OTP generated by e.g. a Yubikey device d) (possibly) a client certificate or a public/private key pair (either created by SSH or GPG) (The combination of b) and d) would uniquely identify the machine; the combination of a) and c) would uniquely identify the user). I would like to store this information in LDAP DIT (served by OpenLDAP). Up to now, I've only used OpenLDAP for POSIX+Samba account info und MIT Kerberos related data. My questions are: - Is there any current documentation for such a (or a quite similar) scenario? Up to now, one documentation I found was http://vuksan.com/linux/dot1x/802-1x-LDAP.html but this one is related to MAC authentication for WLAN setups - Are there any web frontends and/or GUI frontends offering support for the RADIUS schema? Thanks in advance for any info and kind regards, Holger

3 3

Re: Accounting Log
by Breuer Nicolas 09 Nov '10

09 Nov '10

Breuer Nicolas wrote: > > Accounting-01 thinks that stop packet with zero session length is an error > and tried to connect to Accounting-02 sql server. > > Is it the correct behaviour ? Yes. see doc/configurable_failover for how to change redundant groups. Alan DeKok. Alan, I know that this is the correct behaviour concerning redundant groups but for me a Stop with zero session length isn't a SQL issue that needs to go on secondary SQL servers. Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

2 1

redundant SQL / WARNING: Unknown module "sql" in string expansion
by Tom Teeuwen 09 Nov '10

09 Nov '10

Hello, I configured my freeradius with redundant SQL config: In sql.conf: Sql sql1 { .... ..... .... } Sql sql2 { ...... ..... ...... } Radiusd.conf: Redundant sql { Sql1 Sql2 } And in my default site config: Authorize { .... ... .... .... Sql ... ... } Now I want to do some extra SQL-queries within my authorize section. I used something like if ("%{sql:select ........ I receive the following error: WARNING: Unknown module "sql" in string expansion "%{sql:select Without the redundant module it works perfectly :) Kind regards, Tom

2 3

Setting group membership
by inetjunkmail 09 Nov '10

09 Nov '10

I know I'm missing something obvious but I'm stuck here so I apologize in advance for the silly question. I'm using freeradius 2.1.7. I'm using the "files" option for all processes but I want to use user groups so I can reference them in my huntgroups definitions as groups of users permitted to authentication to that group of devices. I tried modifying the etc_group module and the group is correctly determined but it takes place after the huntgroup decision making process done by "preprocessing" so the match condition for the huntgroup fails. I then inserted the module before "preprocessing" in my sites-available/default file and the group is correctly determined prior to preprocessing but it doesn't seem to match the test condition. Snippets of config are below. Any guidance would be appreciated. modules/My-Group-Name ----- passwd My-Group-Name { filename = /etc/raddb/group format = "=My-Group-Name:*,User-Name" hashsize = 50 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } ----- dictionary ----- ATTRIBUTE My-Group-Name 3000 string ----- group ----- telecom:test1 hg1admin:test2 huntgroups ----- hg1 NAS-IP-Address =~ "^10\.69\.1\..*" My-Group-Name == telecom, My-Group-Name == hg1admin, ----- users ----- test1 Cleartext-Password := "password1" test2 Cleartext-Password := "password2" ----- I've inserted the My-Group-Name module at various locations within sites-available/default with no luck. Again, ant guidance would be appreciated.

1 0

Authentication by domain of company
by zouzou 09 Nov '10

09 Nov '10

Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

(Fwd) (Fwd) Re: Accounting Log
by Breuer Nicolas 08 Nov '10

08 Nov '10

Hello Alexandre, Just in that case, if you not send the STOP in case Sess time =0 The Session will stay opened in the accounting table. and never be closed.... ------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: (Fwd) Re: Accounting Log Send reply to: Nicolas.Breuer(a)BelCenter.biz Date sent: Mon, 08 Nov 2010 23:00:40 +0100 From: Alexandre Chapellon <alexandre.chapellon(a)mana.pf> I have the very same behaviour here on my FR2.1.6 setup with PGSQL accoutning. It produce noisy logs but nothing unacceptable. You can change this by not doing accouting for Stop Accounting packet that show up null session-time: in your acccouting section: if (Acct-Status-Type == Stop && Session-Time != 0) { sql_accounting_module_name } Maybe relying on Session-Time is not a good idea. Try finding out another relevant attribute. Cdt Nice idea, i will try :) Attachments: C:\Users\Nico\AppData\Local\Temp\WPM$2D83.PM$ ------- End of forwarded message ------- Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

2 1

Problems with the mailing list?????
by michel＠casa.co.cu 08 Nov '10

08 Nov '10

Hello Gentlemen, there are problems on the list and everyone is on vacation or just moved to see activity on the list? I repeat my previous message, only this time I'm more brief I created a group in mysql and I've assigned certain attributes, one of them and is giving me problems is Idle-Timeout, which has a value of 900 seconds and the user is disconnected before time indicated. Because I want the user to be disconnected if after spending 10 ~ 15 minutes does not show any activity. not before that time. mysql> SELECT * FROM `radgroupreply` ; +----+----------------+--------------------+----+---------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+---------------------+ | 1 | Desarrollo | Service-Type | = | Framed-User | | 2 | Desarrollo | Framed-Protocol | = | PPP | | 3 | Desarrollo | Framed-MTU | = | 1500 | | 4 | Desarrollo | Framed-Compression | = | Van-Jacobsen-TCP-IP | | 5 | Desarrollo | Framed-IP-Netmask | = | 255.255.255.0 | | 6 | Desarrollo | Idle-Timeout | := | 900 | +----+----------------+--------------------+----+---------------------+ here you can see the user disconnected prematurely rad_recv: Accounting-Request packet from host 172.19.19.10 port 17979, id=197, length=170 NAS-IP-Address = 172.19.19.10 NAS-Identifier = "Access Server" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 10.71.53.214 User-Name = "carlos" NAS-Port = 447 NAS-Port-Type = Async Called-Station-Id = "60110" Calling-Station-Id = "78382547" Acct-Status-Type = Stop Acct-Session-Id = "0130000425" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Acct-Input-Octets = 47429 Acct-Output-Octets = 4377 Acct-Input-Packets = 66 Acct-Output-Packets = 57 Acct-Session-Time = 95 Acct-Terminate-Cause = Idle-Timeout Could be problems with the operator that I am implementing???? Thanks ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

4 3