- Freeradius-Users - lists.freeradius.org

How to use Freeradius with traffic limit?
by RaidenII 29 Jun '10

29 Jun '10

Hi, I'm running Freeradius 2.1+Postgresql 8.4.4+OpenVPN on Ubuntu 9.10 x86. It runs smoothly now, however, I want to know that if there is any way to limit per user's traffic, like 10G/month, and disconnect/reject their connection when the limitation has reached. It seems the the column AcctInputOctets and AcctOutputOctets is responsible for traffic calculation, how should I limit user's traffic by using these two? Thanks in advance. -- View this message in context: http://old.nabble.com/How-to-use-Freeradius-with-traffic-limit--tp28809968p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 11

users rights seperations
by Ömer Tuğrul 29 Jun '10

29 Jun '10

Hi, my freeradius version is 2.1.4 I have network devices that I authenticate the network managers to console these devices with radius server based on users file. Now I need to use 802.1x authentication for wireless APs based on ldap authentication. My question is; How can I seperate network management authentication and internet access authentication rights? I mean, I don't want that some ldap users to console my network devices. I just want to allow them to authenticate internet access and some ldap users may console to devices. firstly, I heard that i could use clients.conf file with virtual-server parameter (and sites-enabled/virtual_server_ name...); but then I could only use the authenticator-device for one method if I got it right. I am confused there. I am sorry if i am not clear, please let me know...

2 1

Regular expression in postauth section
by JOE 29 Jun '10

29 Jun '10

Hi all Is possible to add a regular expression to the postauth section as follows?: Post-Auth-Type REJECT { if(%{User-Name}=="test") { ok } else { attr_filter.access_reject sql } } Regards!

3 3

Wimax TLV definitions
by Ricardo Larrañaga 29 Jun '10

29 Jun '10

Hello everyone. I have a question about TLV definitions on Freeradius dictionaries. From what i understand from the standard, the Type field for TLV can be up to two bytes. But when i tried to define a tlv bigger than 255 i get an error when Freeradius tries to read the dictionary: Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary.wimax[190]: sub-tlv's cannot have value > 255 Is this a non supported length or am i misinterpreting the standard? if it is just unsupported, is there any plan to support tlv>255? Thanks

2 3

what's the value of Max-All-Session could be
by Spacelee 29 Jun '10

29 Jun '10

1 day ? one day ? 3600? what's the unit? -- Spacelee

2 2

Re: Re: Invalid Attributes
by Moayad Mohammad 28 Jun '10

28 Jun '10

Thanks for your response, I want to upload new dictionary for wichrous system, because wichorus has their own standard dictionary and wimax dictionary doesn't work with wichorus ASN-GW Regards, -----Original Message----- From: freeradius-users-bounces+mmohammad=thebluezone.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mmohammad=thebluezone.com@lists.freeradius. org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, June 21, 2010 3:42 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 62, Issue 87 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Invalid Attributes (Moayad Mohammad) 2. Re: Invalid Attributes (Alan DeKok) 3. Re: checkval and != op (Alan DeKok) 4. Re: checkval and != op (Christian Zoffoli) ---------------------------------------------------------------------- Message: 1 Date: Mon, 21 Jun 2010 14:35:13 +0300 From: "Moayad Mohammad" <mmohammad(a)thebluezone.com> Subject: Invalid Attributes To: <freeradius-users(a)lists.freeradius.org> Message-ID: <006b01cb1135$d228f6f0$767ae4d0$@com> Content-Type: text/plain; charset="us-ascii" Hi to all, I have to add wichorus dictionary for WiMAX, but in this dictionary some attributes are invalid to freeradius. for example: parent_attr and subtype values. In the below sample of the dictionary: VENDOR Wimax 24757 BEGIN-VENDOR Wimax ATTRIBUTE Wimax-Capability 1 octets ATTRIBUTE Wimax-Capability-Release 1 string parent_attr=Wimax-Capability subtype=1 ATTRIBUTE Wimax-Capability-Accounting 1 octets parent_attr=Wimax-Capability subtype=2 ATTRIBUTE Wimax-Capability-Hotlining 1 octets parent_attr=Wimax-Capability subtype=3 ATTRIBUTE Wimax-Capability-Idle-Mode-Notification 1 octets parent_attr=Wimax-Capability subtype=4 What I should to do? Regards,

2 1

How to return Acct-Response to any Acct-Request?
by WWF 28 Jun '10

28 Jun '10

Hello, all! I use Fr 2.19 for WiMAX system. Since the system is a private network, no accouting is needed. However, the vendor of AGW told us that "However, even though AAA ignores all kinds of accounting messages according to operator’s policy, AAA should send response message for each accounting request message from ASN-GW. If the accounting response message is not received from AAA, ASN-GW will re-send the accounting request message." Actually, we only need AA and without the last A, i.e., accouting. But I need to handle for the requests. How could I do?

2 1

PAP with LDAP and PEAP/MSCHANPv2 with ntlm_auth
by Neil Prockter 28 Jun '10

28 Jun '10

Hello I have a working config for PAP with LDAP against AD and a working config for PEAP/MSCHANPv2 with ntlm_auth. I need the server to do both but when I combine the configs one thing or another breaks. Does anyone have such a setup working or know if it is possible/impossible. Would it be simpler to use a virtual server for one or the other? Thanks, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

2 4

Specifying sql instance to use for huntgroup group lookup
by Doug Warner 28 Jun '10

28 Jun '10

I am specifying an Sql-Group required for one of my huntgroups and am finding that when looking up the group info from my database that the wrong sql instance is being used. I have an "sql_read" instance that's specified to be used in my authorize section, but when the Sql-Group is evaluated for the huntgroup my "sql_write" sql instance is used instead. Is there a way to specify which sql instance should be used in this situation? -Doug

2 3

pam_auth_radius - fallback with localifdown?
by Martin Richard 28 Jun '10

28 Jun '10

Hello, First off - if you think this doesnt belong here, just don't reply instead of being caustic. I'm asking only because it both concerns pam and the pam_radius_auth module (especially the localifdown option). And I think it could be of interest to others. I'll be asking the pam-linux crowd too.. I'm trying to setup PAM auth with pam_radius_auth to use the Radius server's answer as final, unless there's no answer at all. This is what I tried under linux: ----8<-----/etc/pam.d/sshd----------- auth required /lib/security/$ISA/pam_env.so auth [success=done new_authtok_reqd=done ignore=ignore default=die] pam_radius_auth.so localifdown debug auth sufficient /lib/security/$ISA/pam_unix.so debug audit likeauth nullok auth required /lib/security/$ISA/pam_deny.so auth required pam_nologin.so ----8<---------------------------------------- My thinking was as follow: - If we get a success, we're done. Permit entry, but don't continue down the stack to prevent local auth via pam_unix - If we get a failure, we're done, too. Deny entry, and don't continue down the stack since it serves no purpose. (I don't want to get down to pam_unix: don't want an extra prompt, passwords could be different, etc. If the radius server is up, its the only authority I want.) Both these conditions should be covered with "done" and "die" in the extended flags. What I'm next interested in is if we don't have an answer from the radius server, via "localifdown" we should make the module return PAM_IGNORE. Thus having ignore=ignore in the extended flag. Thing is, it doesn't work... If I mess up /etc/raddb/server to change the key, the host entry or whatever to make sure I can't reach the radius server, I don't seem to be going down the stack.. I just get denied access and have no trace at all in the logs. I do not think pam_radius_auth is behaving wrongly - looking at the code is simple enough, I do get "All RADIUS servers failed to respond" in the SYSLOG, so it should clearly be returning PAM_IGNORE as documented. I'm wondering if anybody has tried such a setup ? Pointers and constructive comments appreciated. Martin Richard

2 4