- Freeradius-Users - lists.freeradius.org

dynamic VLANs for many switches
by PENZ Robert 10 Jun '10

10 Jun '10

Hi! We've a quite big network and I want to assign VLANs dynamically based on the MAC address, as backend I want to uses a SQL database. My problem now is that the VLAN IDs on different access switch stacks (used Layer2 switches) are different for the same network area, e.g. on switch1 vlan 123 is used for printers and on switch2 vlan124 is used for printers. The reason for this is the Layer3 switch (which we use as a distribution switch of the building) needs to be part of all VLANs and we can't use one VLAN for a building as the subnet would get too big. A other requirement is that a device can roam between different access switches(=floors and buildings), so the VLAN the switch port should get set needs to be different, based on which switch is making the request. This problem is easily solvable if I can use VLAN names in Tunnel-Private-Group-ID tags, as I would set the name always e.g. to printervlan. But in RFC 3580 is written: Note that the VLANID is 12-bits, taking a value between 1 and 4094, inclusive. Since the Tunnel-Private-Group-ID is of type String as defined in [RFC2868], for use with IEEE 802.1X, the VLANID integer value is encoded as a string. So what is the recommended solution if I can use only the numerical IDs. Thx for your help! Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

2 3

oracle and stored procedure error
by Omer Faruk Sen 10 Jun '10

10 Jun '10

Hi, We are trying to use oracle as a backend but we are having problems. For example here is my radiusd -X output: [sql] expand: EXEC ra_authentication_check '%{SQL-User-Name}', '%{User-Password}' -> EXEC ra_authentication_check '8008', '1111' rlm_sql_oracle: query failed in sql_select_query: ORA-24333: zero iteration count >From sqlplus I can run EXEC ra_authentication_check '8008', '1111' without error on the same machine and with the same user defined in sql.conf but when radiusd runs that query I get ORA-24333: zero iteration count error. If some one here in this list have an idea about that and kindly share his/her opinion about this I will really appreciate that. Regards.

1 0

how to use radacct...
by Arjun Prasad 10 Jun '10

10 Jun '10

Hi All, Can anybody explain with example that, how to use radacct command. I compiled freeradius-client code and got the radacct executable. What is the prerequisite to execute this command. What command line arguments we need to pass with this command to send a Accounting-Request. Please explaing with example. Thanks & Regards Arjun prasad

1 0

Custom dns servers.
by Nadir Aliyev 10 Jun '10

10 Jun '10

Hello, I want set dns servers from freeradius server for some user groups. (with guest ACL user's i want set custom dns, for redirecting all queries to one server) How can I realize this? It is possible to set dns server for virtual-template from freeradius? I use cisco nas. Thanks to all.

2 1

problem with radtest + dictionary + Authen::Radius (perl)
by Ana Gallardo 10 Jun '10

10 Jun '10

Hello, I'm working with Freeradius 2.1.8 and I have created my vendor dictionary. I need to use Authen::Radius (perl). This package needs 'vendor' declaration in every 'ATTRIBUTE' line in vendor dictionaries. Following man RADIUS dictionary file http://freeradius.org/radiusd/man/dictionary.html *ATTRIBUTE name number type [vendor|options]* that is possible. But when I use radtest, I have this problem: $ radtest user@realm pass radius 0 claveClient radclient: dict_init: /usr/share/freeradius/dictionary.XXX: unknown option "XXX" Thank you and sorry for my english ____________________ Ana Gallardo Gómez ____________________

2 6

Question about configurable module fail-over
by Ana Gallardo 10 Jun '10

10 Jun '10

Hello, I have Freeradius 2.1.8. I want to return an error code if my freeradius can't contact with the backend. Here is my authorize section: authorize { . . . switch "%{Realm}" { case 'temp.unex.es' { sql { fail = 1 } if (!fail && ("%D" < "%{control:Expiration-Init}")) { update reply { Codigo-Reject := Cuenta-Inactiva } reject } } case 'unex.es' { ldap { fail = 1 } } case { update reply { Codigo-Reject := Error-Dominio } reject } } if (fail) { update reply { Codigo-Reject := Imposible-Contactar-Backend } reject } expiration { userlock = 1 } if (userlock) { update reply { Codigo-Reject := Cuenta-Expirada } } pap } My problem is when Freeradius can't contact ldap. Here is my debug info: rad_recv: Access-Request packet from host X.X.X.X port 48454, id=116, length=56 User-Name = "usuario(a)unex.es" User-Password = "1631" server rinuex { . . . ++- entering switch %{Realm} {...} +++- entering case unex.es {...} [ldap] performing user authorization for usuario [ldap] expand: %{Stripped-User-Name} -> usuario [ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=usuario) [ldap] expand: ou=saser,dc=unex,dc=es -> ou=saser,dc=unex,dc=es [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to X.X.X.X, authentication 0 [ldap] bind as cn=... [ldap] waiting for bind result ... [ldap] LDAP login failed: check identity, password settings in ldap section of radiusd.conf [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++++[ldap] returns fail +++- case unex.es returns fail ++- switch %{Realm} returns fail } # server rinuex Using Post-Auth-Type Reject +- entering group REJECT {...} ++[reply] returns noop ++? if ("%{reply:Codigo-Reject}") expand: %{reply:Codigo-Reject} -> Credenciales-Erroneas ? Evaluating ("%{reply:Codigo-Reject}") -> TRUE ++? if ("%{reply:Codigo-Reject}") -> TRUE ++- entering if ("%{reply:Codigo-Reject}") {...} +++- if ("%{reply:Codigo-Reject}") returns noop ++- group REJECT returns noop [sql] expand: %{Stripped-User-Name} -> usuario [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> usuario [sql] sql_set_user escaped user --> 'usuario' [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject) VALUES ( '%{User-Name}', LOWER('%{Calling-Station-Id}'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject) VALUES ( 'usuario(a)unex.es', LOWER(''), 'CAU2', 'Access-Reject', NOW(), 'Credenciales-Erroneas') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject) VALUES ( 'usuario @unex.es', LOWER(''), 'CAU2', 'Access-Reject', NOW(), 'Credenciales-Erroneas') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> usuario(a)unex.es attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 116 to X.X.X.X port 48454 Codigo-Reject = Credenciales-Erroneas I need help. Thank you and sorry for y english. -- ____________________ Ana Gallardo Gómez ____________________

2 1

FreeRadius MYSQL tables
by Natr Brazell 10 Jun '10

10 Jun '10

All, I've set up FR2 to log acct data to mysql and that appears to be working. I'm curious about how to enable the logging of specific attributes that are being sent by the NAS. Specifically: rad_recv: Accounting-Request packet from host x.x.x.120 port 51637, id=50, length=95 Acct-Status-Type = Interim-Update Acct-Session-Id = "C2594B9A71DB" Acct-Delay-Time = 0 User-Name = "joe.bobuser" NAS-Identifier = "M20" Juniper-Interactive-Command = "run start shell " NAS-IP-Address = x.x.x.120 +- entering group preacct {...} As you can see in the Accounting-Request packet above There is a NAS-Identifier and a Juniper-Interactive-Command entry. Those attributes are not being logged (nor do I think I'd want them) in my radacct file. Is there a way to have radius automatically populate an accountingactivity table (history file if you will)? Or this there a manual way say in postauth to send those attributes to a mysql table via script when an Accounting-Request packet is received. The above attributes are being sent and are logged in my detail-`date` log file in /var/log/radius/radacct/IP_OF_NAS directory. Thanks, N

7 11

FR 2.1.9 Compiling error
by RaidenII 10 Jun '10

10 Jun '10

(cd .libs && gcc -DIE_LIBTOOL_DIE -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/tony/freeradius-server-2.1.9/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -lssl -lcrypto -ldl .libs/modules.o: In function `setup_modules': /home/tony/freeradius-server-2.1.9/src/main/modules.c:1358: undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' collect2: ld returned 1 exit status make[4]: *** [radiusd] Error 1 make[4]: Leaving directory `/home/tony/freeradius-server-2.1.9/src/main' make[3]: *** [main] Error 2 make[3]: Leaving directory `/home/tony/freeradius-server-2.1.9/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/tony/freeradius-server-2.1.9/src' make[1]: *** [src] Error 2 make[1]: Leaving directory `/home/tony/freeradius-server-2.1.9' make: *** [all] Error 2 Added -DIE_LIBTOOL_DIE to CFLAGS, still has this error. -- View this message in context: http://old.nabble.com/FR-2.1.9-Compiling-error-tp28838167p28838167.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

rlm_krb5 and Active Directory
by David Nelson 09 Jun '10

09 Jun '10

I'm having difficulties getting rlm_krb5 to authenticate to Active Directory. The AD server is Windows 2003 R2. The freeradius server is FreeBSD 8.0-RELEASE-p2 with freeradius-2.1.9 and heimdal-1.0.1 installed. The appropriate freeradius heimdal build switches were used when building all this (built using FreeBSD ports). I've got the freeradius service principal setup and I've been able to test it using kinit, klist, etc. This uses, of course, the same keytab that rlm_krb5 is configured to use. When I try to test all this in debug mode with radtest I get this: Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: Parsed name is: XXXXXXX(a)SKOKIE.LIB.IL.US rlm_krb5: failed verify_user: Unknown error -1765328377 (XXXXXXX(a)SKOKIE.LIB.IL.US ) ++[krb5] returns reject Does anybody have any ideas what I've done wrong or how I can go about debugging this further? Thanks Dave Nelson Skokie Public Library

1 0

Mail to list being bounced
by Natr Brazell 09 Jun '10

09 Jun '10

Why are some of my messages getting bounced by the list? Gmail sometimes sends me back messages saying that it tried in vain to send out and was refused by the recipient? N

2 1