- Freeradius-Users - lists.freeradius.org

Re: Selective Update of User-Name
by Gary Gatten 27 Aug '09

27 Aug '09

I don't know specifics, but pretty much any change will require an FR restart; kill -1 .... With the perl and python modules you can do pretty much anything, but I think you could also do this with "unlang". I recall reading examples of this, did you check the files in the "doc" dir? Wish I could help more, but I just started with FR and have issues of my own to get working :) ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thu Aug 27 08:27:47 2009 Subject: Selective Update of User-Name Hi Guys This email tries to ask my question in a different way, to last time. I need to Rewrite the User-Name of individual accounts to add a realm, this would need to reliable up to at least 10000 users. Does any one have any ideas on how this might be done, in a way that can be updated with out restarting Freeradius ? We do have some python code running in this proxy which might be able to help. Thanks Mike O'Connor - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: Rewrite domain
by David Rodríguez Fernández 27 Aug '09

27 Aug '09

Thank you very much. Work fine! Большое спасибо. 2009/8/27 Ivan Kalik <tnt(a)kalik.net>: >> That is my ntlm_auth: >> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key >> --domain=%{mschap:NT-DOMAIN} --username=%{mschap:User-Name} >> --challenge=%{mschap:Challenge:-00} >> --nt-response=%{mschap:NT-Response:-00}" >> >> What i can change to fix that? > > --domain=%{%{mschap:NT-DOMAIN}:-WINDOWSDOMAIN} > > I think that's correct expansion syntax. > > Ivan Kalik > Kalik Informatika ISP > >

1 0

Proxy-To-Realm and Users File
by Mike O'Connor 27 Aug '09

27 Aug '09

Hi All Using freeradius 2.1.4 the following works if I user the hints file. DEFAULT Called-Station-Id == "splns357" User-Name := "%{User-Name}(a)mb.webshield.net.au" The user is proxied to the correct server and the user is correctly set. I now need to proxy based on the User-Name which in this case will always be a telephone number (Mobile Broadband SIM's) I had added the following to the users file (which I hope to change to the fast users later) 61466004163 Proxy-To-Realm := "mb.webshield.net.au" User-Name := "%{User-Name}(a)mb.webshield.net.au" This proxies the user to the next server but does not rewrite the username, I've also tried a couple of other in this file but none seem to work. rad_recv: Access-Request packet from host 118.67.209.51 port 56036, id=1, length=92 Framed-Protocol = PPP User-Name = "61466004163" User-Password = "password" Calling-Station-Id = "61466004163" Called-Station-Id = "splns357" Service-Type = Framed-User NAS-IP-Address = 118.67.208.51 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/118.67.209.51/auth-detail-20090827 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/118.67.209.51/auth-detail-20090827 [auth_log] expand: %t -> Thu Aug 27 09:40:24 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "61466004163", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry 61466004163 at line 1 [files] expand: %{User-Name}(a)mb.webshield.net.au -> 61466004163(a)mb.webshield.net.au ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop 2009-08-27T09:40:24.327336: Verbose: RLM_PYTHON: handling Authorize request... ++[python] returns ok +- entering group pre-proxy {...} [attr_filter.pre-proxy] expand: %{Realm} -> mb.webshield.net.au ++[attr_filter.pre-proxy] returns noop Sending Access-Request of id 250 to 118.67.209.21 port 1812 Framed-Protocol = PPP User-Name = "61466004163" User-Password = "password" Calling-Station-Id = "61466004163" Called-Station-Id = "splns357" Service-Type = Framed-User NAS-IP-Address = 118.67.208.51 Proxy-State = 0x31 Proxying request 0 to home server 118.67.209.21 port 1812 Sending Access-Request of id 250 to 118.67.209.21 port 1812 Framed-Protocol = PPP User-Name = "61466004163" User-Password = "password" Calling-Station-Id = "61466004163" Called-Station-Id = "splns357" Service-Type = Framed-User NAS-IP-Address = 118.67.208.51 Proxy-State = 0x31 Going to the next request Waking up in 0.9 seconds. Waking up in 13.0 seconds. rad_recv: Access-Reject packet from host 118.67.209.21 port 1812, id=250, length=23 Proxy-State = 0x31 Thanks All Mike

2 2

rlm_sqlcounter: Some strangenesses.
by George Koulyabin 27 Aug '09

27 Aug '09

Hi. I am running FR v2.1.6. I am needing to generate some quota for users. This quota must be replied via attribute Cisco-Control-Info. I tryed to do this by different ways. I was interested by rlm_sqlcounter, as simple and powerful method of calculating of counters. I built test counter: sqlcounter noresetoutputoctetscounter { counter-name = Max-All-Output-Octets check-name = Max-All-Output reply-name = Cisco-Control-Info #reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = "SELECT COALESCE(SUM(AcctOutputOctets), 0) \ FROM radacct \ WHERE UserName = '%{%k}' AND (CiscoServiceInfo = '' OR CiscoServiceInfo IS NULL)" } I inserted Max-All-Output attribute/value pair into radcheck and added 'noresetoutputoctetscounter' into authorize section. a.) I set Max-All-Output to 100000000 and used Session-Timeout as reply-name when first experiment was. Result of query was 60842094 for all experiments. I had got true result for this case. b.) I increased value of Max-All-Output to 700000000 and had got 700486142. But this value is greater then value of check-name (Max-All-Output). c.) Reply-name was replaced with Cisco-Control-Info by me. Cisco-Control-Info has type of string and Session-Timeout has type of integer. When I looked into log I found that "rlm_sqlcounter: Sent Reply-Item for user guest, Type=Cisco-Control-Info, value=700486142". But reply-list went with empty Cisco-Control-Info: 'Cisco-Control-Info = ""'. Where can I find information about restrictions of rlm_sqlcounter?

1 1

Failed install of freeradius2-2.1.6-2.el5.i386
by Steven Sprague 26 Aug '09

26 Aug '09

Today I tried to install freeradius2-2.1.6-2.el5.i386 and ran into a dependencies problem I could not solve. After downloading support for SQL and all required dependencies I started my install and got this message - Missing libltdl.so.3. I am running Linux rhel 2.6.18-8.el5 and wonder now where on my software disks (I have searched) is this file? Is this file part of some other software required to run freeradius2-2.1.6-2.el5.i386? Suggestions ? Thanks Steven -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 3

Logging client IP address
by Ian Chard 26 Aug '09

26 Aug '09

Hi, I'm experimenting with using freeradius 2.0.4 to authenticate administrative access to network equipment. If I deploy it then I'll end up with well over a hundred clients, so I'd like to describe the entire address range in a single 'client' block. I also want to have a syslogged record of each login attempt, which I can do, but I can't figure out how to log the client's IP address without having to specify every client individually in freeradius's config. As it is, I just get Login OK: [username] (from client big-netblock port 0) Is there a way around this without having to maintain a huge list of clients? Thanks - Ian -- Ian Chard, Senior Unix and Network Gorilla | E: ian.chard(a)sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 242287

3 5

radreply and proxied packet questions
by mikoi 26 Aug '09

26 Aug '09

Hi. I have an installation with Freeradius and MySQL and have a few question. 1. Values in radreply seem to be ignored from the reply to AAA-client when proxying packets? Is this by design or have i configured something wrong? 2. Is it possible to do this in the post-proxy section of /sites-enabled/default? If Access-accept is received from backend server, return per user values from radreply table If Access-reject is received, reject the user and send no attributes. If the above is possible, can someone give me an example of how this is to be configured? how the if, then, else should/could look like? Thanks in advance. /Mika -- View this message in context: http://www.nabble.com/radreply-and-proxied-packet-questions-tp25147932p2514… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Freradius and And Cisco CSS
by Rokkhan 26 Aug '09

26 Aug '09

Does anyone knows who could I configure a Cisco CSS to load balance freeradius packets?

1 0

XP client can not authenticate in Radius Server - HELP ME PLEASE!!!!!!!!!!!!!
by Hilton Guaraldi 25 Aug '09

25 Aug '09

Hi ALL!!!!!!!!!!!!!!!!!!!!!!! I did more then 20 openssl commands in order to issue a CA for tests... Howto in http://www.linuxjournal.com/node/8095/print and http://www.linuxjournal.com/node/8151/print. I DID ALL THE COMMANDS!!! XP client do not authenticate :-( Do I need users file??? What the correct sintaxe for login guaraldi and password mudar123? I defined users file like: guaraldi Auth-Type := EAP, Cleartext-Password == "mudar123" CA defined in OPENSSL!!! Radius server stop displaying "can not get issuer certificate" and "unknow CA" Server certificate signed!!! Client certificate defined!!! XP with cacert.pem and client_cert.p12!!!!!!!!!!!! I did not use ca.der .... XP Config with EAP to Smartcard or other certificates TLS and so on... AP with WPA/TKIP with 802.1x to 192.168.0.254 port 1812. OK!!! It works... Why XP do not authenticate with radius??? Guaraldi

4 6

Re: Freeradius and Cisco
by Nicholas Cappelletti 25 Aug '09

25 Aug '09

Hello Rokkhan, I was curious if you could send me the configuration you have on your Cisco AP's for telnet/ssh access? I'm having some trouble with mine, but I'm able to authentication my routers and switches just fine. I would ask the mailing lists, but they sometimes aren't very helpful. ;) --Nick ----- Original Message ----- From: "Rokkhan" <rokkhan(a)gmail.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Thursday, August 20, 2009 9:44:38 AM GMT -05:00 US/Canada Eastern Subject: Freeradius and Cisco HelloI I have been testing with my freeradius and cisco devices, such as switches, firewalls, acces points, ... Now, I´m able to configure users validation through freeradius with Access Points and Peap. Get shell acces to cisco devices and establish the level privilege of them with freeradius. And configure dot1x interfaces on switches to validate users and configure ports on diferent VLAN through Freeradius. I want to know if there is anything more that can be managed, with Freeradius, on Cisco devices. I want to explore all the options that freeradius brings to us. Thanks in advance. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2