- Freeradius-Users - lists.freeradius.org

Regular expression in postauth section
by JOE 29 Jun '10

29 Jun '10

Hi all Is possible to add a regular expression to the postauth section as follows?: Post-Auth-Type REJECT { if(%{User-Name}=="test") { ok } else { attr_filter.access_reject sql } } Regards!

3 3

Wimax TLV definitions
by Ricardo Larrañaga 29 Jun '10

29 Jun '10

Hello everyone. I have a question about TLV definitions on Freeradius dictionaries. From what i understand from the standard, the Type field for TLV can be up to two bytes. But when i tried to define a tlv bigger than 255 i get an error when Freeradius tries to read the dictionary: Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary.wimax[190]: sub-tlv's cannot have value > 255 Is this a non supported length or am i misinterpreting the standard? if it is just unsupported, is there any plan to support tlv>255? Thanks

2 3

what's the value of Max-All-Session could be
by Spacelee 29 Jun '10

29 Jun '10

1 day ? one day ? 3600? what's the unit? -- Spacelee

2 2

Re: Re: Invalid Attributes
by Moayad Mohammad 28 Jun '10

28 Jun '10

Thanks for your response, I want to upload new dictionary for wichrous system, because wichorus has their own standard dictionary and wimax dictionary doesn't work with wichorus ASN-GW Regards, -----Original Message----- From: freeradius-users-bounces+mmohammad=thebluezone.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mmohammad=thebluezone.com@lists.freeradius. org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, June 21, 2010 3:42 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 62, Issue 87 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Invalid Attributes (Moayad Mohammad) 2. Re: Invalid Attributes (Alan DeKok) 3. Re: checkval and != op (Alan DeKok) 4. Re: checkval and != op (Christian Zoffoli) ---------------------------------------------------------------------- Message: 1 Date: Mon, 21 Jun 2010 14:35:13 +0300 From: "Moayad Mohammad" <mmohammad(a)thebluezone.com> Subject: Invalid Attributes To: <freeradius-users(a)lists.freeradius.org> Message-ID: <006b01cb1135$d228f6f0$767ae4d0$@com> Content-Type: text/plain; charset="us-ascii" Hi to all, I have to add wichorus dictionary for WiMAX, but in this dictionary some attributes are invalid to freeradius. for example: parent_attr and subtype values. In the below sample of the dictionary: VENDOR Wimax 24757 BEGIN-VENDOR Wimax ATTRIBUTE Wimax-Capability 1 octets ATTRIBUTE Wimax-Capability-Release 1 string parent_attr=Wimax-Capability subtype=1 ATTRIBUTE Wimax-Capability-Accounting 1 octets parent_attr=Wimax-Capability subtype=2 ATTRIBUTE Wimax-Capability-Hotlining 1 octets parent_attr=Wimax-Capability subtype=3 ATTRIBUTE Wimax-Capability-Idle-Mode-Notification 1 octets parent_attr=Wimax-Capability subtype=4 What I should to do? Regards,

2 1

How to return Acct-Response to any Acct-Request?
by WWF 28 Jun '10

28 Jun '10

Hello, all! I use Fr 2.19 for WiMAX system. Since the system is a private network, no accouting is needed. However, the vendor of AGW told us that "However, even though AAA ignores all kinds of accounting messages according to operator’s policy, AAA should send response message for each accounting request message from ASN-GW. If the accounting response message is not received from AAA, ASN-GW will re-send the accounting request message." Actually, we only need AA and without the last A, i.e., accouting. But I need to handle for the requests. How could I do?

2 1

PAP with LDAP and PEAP/MSCHANPv2 with ntlm_auth
by Neil Prockter 28 Jun '10

28 Jun '10

Hello I have a working config for PAP with LDAP against AD and a working config for PEAP/MSCHANPv2 with ntlm_auth. I need the server to do both but when I combine the configs one thing or another breaks. Does anyone have such a setup working or know if it is possible/impossible. Would it be simpler to use a virtual server for one or the other? Thanks, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

2 4

Specifying sql instance to use for huntgroup group lookup
by Doug Warner 28 Jun '10

28 Jun '10

I am specifying an Sql-Group required for one of my huntgroups and am finding that when looking up the group info from my database that the wrong sql instance is being used. I have an "sql_read" instance that's specified to be used in my authorize section, but when the Sql-Group is evaluated for the huntgroup my "sql_write" sql instance is used instead. Is there a way to specify which sql instance should be used in this situation? -Doug

2 3

pam_auth_radius - fallback with localifdown?
by Martin Richard 28 Jun '10

28 Jun '10

Hello, First off - if you think this doesnt belong here, just don't reply instead of being caustic. I'm asking only because it both concerns pam and the pam_radius_auth module (especially the localifdown option). And I think it could be of interest to others. I'll be asking the pam-linux crowd too.. I'm trying to setup PAM auth with pam_radius_auth to use the Radius server's answer as final, unless there's no answer at all. This is what I tried under linux: ----8<-----/etc/pam.d/sshd----------- auth required /lib/security/$ISA/pam_env.so auth [success=done new_authtok_reqd=done ignore=ignore default=die] pam_radius_auth.so localifdown debug auth sufficient /lib/security/$ISA/pam_unix.so debug audit likeauth nullok auth required /lib/security/$ISA/pam_deny.so auth required pam_nologin.so ----8<---------------------------------------- My thinking was as follow: - If we get a success, we're done. Permit entry, but don't continue down the stack to prevent local auth via pam_unix - If we get a failure, we're done, too. Deny entry, and don't continue down the stack since it serves no purpose. (I don't want to get down to pam_unix: don't want an extra prompt, passwords could be different, etc. If the radius server is up, its the only authority I want.) Both these conditions should be covered with "done" and "die" in the extended flags. What I'm next interested in is if we don't have an answer from the radius server, via "localifdown" we should make the module return PAM_IGNORE. Thus having ignore=ignore in the extended flag. Thing is, it doesn't work... If I mess up /etc/raddb/server to change the key, the host entry or whatever to make sure I can't reach the radius server, I don't seem to be going down the stack.. I just get denied access and have no trace at all in the logs. I do not think pam_radius_auth is behaving wrongly - looking at the code is simple enough, I do get "All RADIUS servers failed to respond" in the SYSLOG, so it should clearly be returning PAM_IGNORE as documented. I'm wondering if anybody has tried such a setup ? Pointers and constructive comments appreciated. Martin Richard

2 4

EAP-TLS: restricting CA certificate use to a subset of identities
by Edgar Fuß 28 Jun '10

28 Jun '10

Whein using EAP-TLS, is there any sane way of restricting the use of a CA Certificate to a subset of the possible identities? I.e., is it possible to configure a single FreeRADIUS 2 server to accept users @foo.my.domain only if their Certificates are signed with CA-Cert.foo and users @bar.my.domain only if theirs are signed with CA-Cert.bar? It looks a bit tough because (if I got it right) eap.conf doesn't use unlang and no information whatsoever from the CA Certificate used for verification is available as an attribute. Alternatively, is it possible to log the name of the CA certificate on successful login? So that even if the logged user identity is user(a)foo.my.domain the log shows that the user cert was actually issued by bar.my.domain. Thanks for any hints.

2 3

Invalid NT-key issue
by John 28 Jun '10

28 Jun '10

Hi all, We are using freeRADIUS (1.1.6) + samba (3.3.3) talk to multiple ADs. Sometimes ntlm_auth got invalid NT-key. It should be a samba issue. Which samba version is good? I googled this issue, Someone has the same problem https://bugzilla.samba.org/show_bug.cgi?id=6563 HJ

2 1