- Freeradius-Users - lists.freeradius.org

Re: Send Accounting from any point in configuration
by Alan DeKok 14 Jun '10

14 Jun '10

Stefan A. wrote: > I want to send RADIUS Accounting Messages to another RADIUS Server, > depending on some contents of a Packet. > > 'a Packet' in this context might be an Access or an Accounting Packet. The Access-Request && Accounting-Request packets are handled independently. If you want to change accounting behavior based on authentication packets, you will need to store information in database. > The intended Flow: > > Packet comes in ... > - for Access type, check if user might be authenticated > - if OK, try to decide to send an Accounting packet to a Server on some > attributes (in my case, VSA from downstream RADIUS Proxy Server) Do you mean *create* an accounting packet, or forward *later* accounting packets for that session? > - (possibly) don't care about the answer > - for Access type: accept/reject to Client > - for Accounting type: ACK to Client > > > As far as I understood, the proxy module does > - (only) proxy based on realm > - in proxy module, normal local Logfiles won't be used That's not true. You can proxy based on anything you want. See raddb/proxy.conf for documentation. You can proxy *and* log to detail files. Alan DeKok.

2 1

Some questions about freeradius for WiMAX
by WWF 14 Jun '10

14 Jun '10

Hi,all! I have several questions about fr 2.19 for WiMAX systems. 1. My network is a private network and does not need accounting.Then if I reply access accept with "Accounting-capabilities = 0", whether the ms can know about it and won't send accounting packets to my freeradius? 2. How to set values for these attributes: WiMAX-AAA-Session-ID = ? WiMAX-HA-RK-SPI = ? WiMAX-HA-RK-Lifetime = ? 3. How to add support for the "Error-Cause" attribute defined in rfc 3576. It seems no code for it in current implementation of 2.1.9 fr. 4. What the "disconnect request message" for? (for accounting?) I found in wiki that current implementation does not support this message. Thanks for your relpy. 2010-06-08

3 2

The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c
by 李立明 14 Jun '10

14 Jun '10

Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help ----------------

2 1

Re: Problem running 'radiusd -X'
by Zhouhuai Shen 13 Jun '10

13 Jun '10

Hi, >>> I have a problem running the 'radiusd -X'. The error messages are as the following: >>default new install from source? the EAP part needs some certs being made.....see >>this bit: >>> make_cert_command = "/etc/raddb/certs/bootstrap" >>this runs /etc/raddb/certs/bootstrap script to make some temporary basic/fake >>certs for testing. perhaps the user/group that radiusd is being run as cannot >>run the script. >>run the script manually and see what happens I have manually run the script, looks better. But when I run the 'radiusd -X' again, other errors appear: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Can you please advise me again what's the problem? Cheers, Henry _________________________________________________________________ Want to be a Space Travel Agent? If it exists, you'll find it on SEEK http://clk.atdmt.com/NMN/go/157639089/direct/01/

2 1

Conditions for executing module
by Mindaugas Riauba 13 Jun '10

13 Jun '10

Hello, FR 2.1.9 and novice in FR module programming. :) How to define some conditions in users/acct_users file when to use our module? It is quite heavy and we'd like to avoid its execution in as many cases as possible. I tried such configuration in users. Idea comes from http://freeradius.org/radiusd/doc/Autz-Type DEFAULT Auth-Type := Ourclient, Calling-Station-Id == "333" DEFAULT Auth-Type := Accept And adding this to sites-enabled/default: Auth-Type Ourclient { ourclient } But rlm_files complains about unknown value for Auth-Type. Should I just define this new Auth-Type in dictionary (then which range of values is for local use?) or there is more elegant solution? Regards, Mindaugas

2 2

Re: Freeradius-Users Digest, Vol 62, Issue 56
by lenard.smith＠gmail.com 12 Jun '10

12 Jun '10

Help Sent from my BlackBerry® by Boost Mobile -----Original Message----- From: freeradius-users-request(a)lists.freeradius.org Date: Sat, 12 Jun 2010 12:00:12 To: <freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 62, Issue 56 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c ( ??? ) ---------------------------------------------------------------------- Message: 1 Date: Sat, 12 Jun 2010 16:43:51 +0800 From: " ??? " <09120560(a)bjtu.edu.cn> Subject: The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c To: freeradius-users(a)lists.freeradius.org Message-ID: <MAVUSEBQQPRYQOASLDHPTQUMPLHW.09120560(a)bjtu.edu.cn> Content-Type: text/plain; charset="gb2312" Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help.

1 0

The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c
by 李立明 12 Jun '10

12 Jun '10

Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help.

1 0

attribute name manipulation
by Alexandre Chapellon 12 Jun '10

12 Jun '10

Hello, I want to remove some attribute from my access-accept messages regardless the value of this attribute. I tough I could use the "!*" but the wiki says it's not usable as a reply item. Further more "!*" is not present in unlang(5) if I try to use it freeradius says config file have a syntax error. How can i remove an attribute from the reply message (regardless of its value)? Additionnally I'd like to rename some attribute returned by the radreply query.... is there anything specific for this job or is it adding new attribute with the value of the previous one and then deleting the previous one? Regards. -- Alexandre Chapellon <alexandre.chapellon(a)mana.pf> Mana SAS

2 1

AD Auth - problem with some chars in user's DN
by Nelson Vale 12 Jun '10

12 Jun '10

Hi all, I've recently found a problem authenticating some users in AD (2003) when the user's Distinguish Names have one or more of the following characters: " ' ` (double quotes, apostrophe or grave accent), using freeradius 2.0.2 and 2.1.9 versions: "... [ldap] login attempt by "johndoe" with password "test123;" [ldap] user DN: CN=John "The Man" Doe,OU=students,DC=domain,DC=localal [ldap] (re)connect to 192.168.0.73:389:389, authentication 1 [ldap] bind as CN=John "The Man" Doe,OU=students,DC=domain,DC=localal/test123; to 192.168.0.73:389:389 [ldap] waiting for bind result ... [ldap] Bind failed with invalid credentials ..." ( the correct DN for this user is "CN=John "The Man" Doe,OU=students,DC=domain,DC=local" ) The rlm_ldap module is performing the user authentication using a DN that as two more characters as it should be (the "al" in the end), and the number of these extra characters is the same as the number of the occurrences of the characters described above. The characters that cause this problem are the ones from the src/lib/valuepair.c pairparsevalue() function (PW_TYPE_STRING type), and if they are removed from there the authentication will be processed successfully ( I know, if they are there there must be some reason ). I've managed to fix this in rlm_ldap by quoting the characters in the vp_user_dn->vp_strvalue, but I'm not sure if this will fix all the problems that can arise from this. Have anyone ever had such a problem? I know that it's a little unusual to have these characters in user's names but AD allows it ... Thx, Nelson Vale

2 4

howto use the attribute of "Access-Period"
by Spacelee 12 Jun '10

12 Jun '10

I set the value to 3600, but it says [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "3600" for attribute name "Access-Period" -- Spacelee

2 1