- Freeradius-Users - lists.freeradius.org

Freeradius, custom vars and sql queries in sites-enabled/dhcp
by Wingman 02 Jun '10

02 Jun '10

Hello I'm using freeradius 2.1.9 Trying to setup dhcp server. There is no problem with dhcp + rlm_perl. But i want to speed up the server - do all the things with dhcp+rlm_sql. But i'm complicated doing this. For example, i need to parse several conditions, regarding to sql queries results. I'm confusing in how to use custom vars and custom sql queries in sites-enabled/dhcp ? i.e. i need somthing like this pseudocode: dhcp DHCP-Discover { ......... sql MYVAR := "%{sql: select blahblahblah}" ......... if(myvar >= xxx) { MYVAR2 := "%{sql:select blah blah2 blah3}" } } My question is how to do all this correct? =) Thx for help -- BRGS, Ilya A. Masandilov IP-Home.Net

2 2

EAP + LDAP
by Juergen Koller 02 Jun '10

02 Jun '10

Hi, I am trying to set up freeradius 2.1.8 to authorize an user using LDAP and to authenticate him using EAP. Every user in the LDAP-database and a valid EAP-certificate should get access. If not in the LDAP-database the user should be rejected. If I only use EAP for authentication and authorazation every thing is ok. I am trying this by using a DEFAULT Autz-Type := LDAP1 in the users file. freeradius checks now for authorization against the LDAP-database and gets back if the user exists or not (according to the debug output). But the user will not be rejected, if not in the LDAP-database. Perhaps I did not read the right document file right now. Perhaps Autz-Type is the totaly wrong approach. Any hints? Thanks, Juergen -- email: koller(a)idmt.fraunhofer.de gilb: Fraunhofer-IDMT, Ehrenbergstrasse 31, 98693 Ilmenau Tel.: +49 3677 467-340 Fax: +49 3677 467-4340 GSM: +49 175 183 5160

2 2

Re: Freeradius, custom vars and sql queries in sites-enabled/dhcp
by Wingman 02 Jun '10

02 Jun '10

Great, thx, Alan! I've allready written most functionality with rlm_perl, now will try to move it to native freeradius. > Wingman wrote: >> For example, i need to parse several conditions, regarding to sql queries results. I'm confusing in how to use custom vars and custom sql queries in sites-enabled/dhcp ? >> i.e. i need somthing like this pseudocode: >> >> dhcp DHCP-Discover { >> >> ......... >> sql >> MYVAR := "%{sql: select blahblahblah}" > See "man unlang". You need to put the attribute into an "update" section. > And you can't specify random names for "variables". They aren't > variables, they are attributes with pre-defined types. See > raddb/dictionary. > Alan DeKok. BRGS, Ilya A. Masandilov IP-Home.Net

1 0

Qugestion about Vendor-Specific Attr in EAP TTLS
by WWF 02 Jun '10

02 Jun '10

Hello, all! I use fr 2.1.9 on ubuntu 10.04, installed from source code. Use mysql as database. Now I add a VSA in radreply, then, if a user passes the auth, the VSA will be returned back to NAS. I find that for other auth types like PAP/EAPMD5/EAPTLS, this VSA VALUE is returned in ACCESS-ACCEPT packet. But when I use EAPTTLS, the VSA value is returned in the two ACCESS-CHALLENGE but not in the ACCESS-ACCEPT packet. I don't know if it is ok?

2 1

Time based usage
by tyllerd 01 Jun '10

01 Jun '10

Hi My company has purchased a radius server for our hotpspot solution. What I am trying to in my free time is put together freeradius to do what out current server does plus small things here and there that would make our lives a little better. What I am struggling with are time based cards. I have used the sqlcounters in freeradius and have tried to use the noresetcounter counter and would set it to, lets say 3600 seconds, this works except it leaves me with two issues. 1 being that when the user logs in and has Max-All-Session set to 3600, he can continue to surf until he logs off, if he tries to log in again (assuming he has reached or passed 3600 seconds) he cannot log in. My question is, is it possible to actaully disconnect him once he has reached his Max-All-Session? 2 is how would I go about checking how much time a user has used or still has available to him? I apologies if it sounds like I am trying to be spoon fed, I just need some sort of point in the correct direction as I think this is completely the incorrect way to go about doing this. Regards, T -- View this message in context: http://old.nabble.com/Time-based-usage-tp28745711p28745711.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Checking ldap-group in post-auth instead of users file ?
by Fred MAISON 01 Jun '10

01 Jun '10

Hello all, I encounter difficulties to check for a radiusgroupname via LDAP by not using file /etc/raddb/users, as this seems to be difficult to avoid ldap checks for anonymous identities if default config is modified. I must service eap-peap and eap-ttls with mschapv2. How can i make checks on ldap radiusgroupnale without using the user file ? I have not been able to place somthing like this in the post-auth section of inner-tunnel ... if ( "%{control:Ldap-Group}" == "wireless" ) { noop } else { reject } I trie to replace this in users : # for proxy.conf to work : DEFAULT Realm == "myreal.com" reply-Message += "real is %{Realm}" DEFAULT Auth-Type == EAP, EAP-Type == Cisco-LEAP, Ldap-Group == wireless reply-Message = "Cisco-LEAP match in users : EAP-Type%{EAP-Type}" DEFAULT Auth-Type == EAP, EAP-Type == Generic-Token-Card, Ldap-Group == wireless reply-Message = "match in users : EAP-Type:%{EAP-Type}" DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Ldap-Group == wireless reply-Message += "in %{Virtual-Server}, proxy %{FreeRADIUS-proxied-To}, EAP-Type:%{EAP-Type}" DEFAULT Auth-Type == EAP reply-Message += "in users : EAP-Type:%{EAP-Type}" DEFAULT Auth-Type := Reject Reply-Message += "Please call the helpdesk."

3 5

Re: Your maximum never usage time has been reached
by freeradius＠moorhouse.net.nz 01 Jun '10

01 Jun '10

Thanks Alan >the easyhotsort people have leveraged, from what i can see, chillispot >and FreeRADIUS for their solution. as such, they are the ones who are >first in line to fix things....I dont see why the volunteers in FreeRADIUS >should deal with the random logic and code from a 3rd party solution. Fair call. >> This only occurs for users where the check-name attribute is >> "Max-All-MB". If there is no check for this attribute then the user can >are you checking the the attribute EXISTS - in which case it will always >be the case unless is only exists if another system make it so (from reading >accounting) or is is supposed to be a comparison with a value. If I create a user where the attribute does NOT exist then I can authenticate but cannot keep the user to the total data allowance (see below as why this is required). If I create a user where the attribute does exist then after the accounting record is created in the radacct table then subsequent attempts to authenticate fail. Maybe it's time to read the source code for the counter module :( >sorry, dont care for captive portals - I'm all about 802.1X and proper systems >and dont beleive that customers should be limited to small amounts of data >allowance - its 2010.... 1998 have called and want their business model back. Yeah - I'd rather provide an unlimited data allowance too but in this case it is not possible. I've taken on the task (as a volunteer) to provide a hotspot for a community group's conference and the only broadband access we have at the venue is via a 3G mobile service (limited to 3GB in a month) :( Additional data is priced at $100/GB !! David

3 3

Active Directory as PKI
by Nikita Koshikov 01 Jun '10

01 Jun '10

Hello freeradius users/admins, I'm trying to implement EAP-TLS authorization with freeradius and Active Directory Certificates Service, but I'm stuck here... With keys/certificates, generated with freeradius makefile(/etc/raddb/certs) everything is working fine. Here is the hierarchy of keys generated by freeradius: Ca.crt(+ca.key) || server.crt(+servers.key) //issuer ca.crt || client1.crt client2.crt ..... //issuer server.crt Apart from this scheme, Active Directory stores certificates in a way: Ca.crt(key in AD and cannot used by freeradius) || sub_ca.crt(key in AD and cannot used by freeradius) //issuer ca.crt || server.crt(+key) //issuer sub_ca.crt (this is for private_key_file and certificate_file in freeradius config) || client1.crt client2.crt ..... //issuer sub_ca.crt I'm concatenate ca.crt file with sub_ca.crt, openssl verify produces "OK". # openssl verify -CAfile ca.crt clent.crt clent.crt: OK But trying to authenticate from client I got error - unknown_ca. I have attached full debug log. client(wpa_supplient) -> wifi-access(linksys with dd-wrt) -> server(freeradius-2.1.7) wpa_supplient.conf: network={ ssid="work" proto=RSN key_mgmt=WPA-EAP pairwise=CCMP eap=TLS identity="radius" ca_cert="/home/work/ca.crt" client_cert="/home/work/wifi_client.crt" private_key="/home/work/wifi_client.key" private_key_passwd="" priority=1 } freeradius relevant section: tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/win/server.key" //generated from sub_ca certificate_file = "/etc/raddb/certs/win/server.crt" //generated from sub_ca CA_file = "/etc/raddb/certs/win/ca.crt" //concatenated ca.crt + sub_ca.crt from windows store dh_file = "/etc/raddb/certs/dh" //generated by makefile random_file = "/etc/raddb/certs/random" //generated by makefile fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Note: Server.crt and client.crt has all necessary extensions(OIDs) - TLS Web Server Authentication and TLS Web Client Authentication My question - is it able to organize such scheme - freeradius + windows certificate center? Is client.crt MUST be issued by server.crt or they both MAY be issued by higher level ca, like Active Directory does? If this has been discussed before - please, point me in right direction.

1 1

Using the NAS table for Huntgroup-Name
by Bjørn Mork 01 Jun '10

01 Jun '10

I thought I might share a configuration part that has proven useful for us... Based on the howto at http://wiki.freeradius.org/SQL_Huntgroup_HOWTO , we found that we might as well add the huntgroup name to the NAS table when adding new NASes. No need to maintain two separate tables with the NAS ip address as key... So we added a huntgroup field to the 'nas' sql table and do update request { Huntgroup-Name := "%{sql:select huntgroup from nas where nasname=\"%{NAS-IP-Address}\"}" } in the authorize section. Not that this changes much, but at least it prevents the huntgroup SQL lookup from failing due to missing NAS's Bjørn

1 0

Re:Re: How long is the nas-table cached by freeradius?
by Rameshbabu Ragothaman 01 Jun '10

01 Jun '10

Is this fix available now ? (freeradius server to read the change in nas-table without restart) Thanks. Evert Meulie <evert(a)witelcom.com> wrote: > Just wondering about the following: If a change is made in the nas-table of the radius-db, how long does it take for the freeradius daemon to start using this updated info? > Or is the nas-table only read at freeradius (re)start? It's only read at re-start. It could be fixed, but it's not a high priority. Alan DeKok.

4 3