- Freeradius-Users - lists.freeradius.org

virtual servers => 2 different user files
by kisteorg google 25 Aug '09

25 Aug '09

Hello list, I would like to use one freeradius for 2 different NAS-groups. Therefore I need two different users files, one for each instance. I tried to make the module configuration per virtual server, which seems not to be working. Does anybody has a trick to get this working? BR Uwe

5 7

Re: groupcmp fails during tunneled request
by Matthieu Lazaro 25 Aug '09

25 Aug '09

1 0

How to use large SQL-query for %{sql:} clause?
by George Koulyabin 25 Aug '09

25 Aug '09

Hello. I am using FR v2.1.6. I am needing to generate values of reply attributes via SQL. I am using `%{sql:SQL-query}` clause. I am inserting attribute/value pairs into radreply table, where value - `%{sql:}`-clause. But I had got complex and large queries. I don't want to increase size of fields of SQL-table. How I can solve this problem?

2 2

How to control users traffic ?
by Eric 25 Aug '09

25 Aug '09

Hi, Which is conventional way for checking online users traffic volume and disconnecting who reach to the limit of every user in freeradius: 1- using acct-interim packets to update output or input octets in sql and if user reach to the max of its accounting permission disconnect him/her.(Is there any patch to do this ?) 2- freeradius sends Session-Octets-Limit to the NAS and NAS can does this? 3- using billing softwares such as nibs . 4-other ways?

6 15

check username and password
by shivashankar 25 Aug '09

25 Aug '09

hi how to check username and password in rlm_wipromodule(user-define) module. plz help -- View this message in context: http://www.nabble.com/check-username-and-password-tp25114745p25114745.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Dynamic VLAN attribute in LDAP or AD?
by Gary Gatten 25 Aug '09

25 Aug '09

Hello, thanks for taking the time to read this. And thanks in advance for the prompt replies! I've read nearly all the docs and How To's I could find and none of them (so far) address this. If I find an answer I'll be more than happy to draft a How To as I would suspect this a desired solution. So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users! Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN. If that's not possible, I COULD do it at the user level, but again kinda a hassle to maintain. Any thoughts / opinions would be GREATLY appreciated! In the mean time I'll keep reading! PS: The How To's have helped a LOT so far just getting to the point I'm at! Without them it would've taken me 10x longer! <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

6 10

nested groups
by Nicolas.CLEMENTZ＠uha.fr 25 Aug '09

25 Aug '09

Hi, Is-it possible to search users on nested groups. For example : User1 is in group Group1, User2 is in group Group2, Group1 and Group2 are in group Group12 The users config : ... DEFAULT ldap-iut-Ldap-Group == "Group12" Tunnel-Medium-Type:1 = 6, Tunnel-Type:1 = 13, Tunnel-Private-Group-ID:1 = 636, Fall-Through = Yes ... Freeradius Server : 2.1.7 (git) Ldap server : Active directory 2008 Thanks Nicolas Clementz Université de Haute Alsace

1 0

files: How to choose SQL entry for users?
by George 25 Aug '09

25 Aug '09

Hi I am running FreeRADIUS v2.1.6. Problem is found when SQL works in 'users'. sql.conf: sql sql_auth { Some auth-queries... } sql sql_acct { Some acct-queries... } radiusd.conf: authorize { files sql_auth } users: DEFAULT SQL-Group == 'Group1' ... But files chooses sql_acct (alphabetic first) as sql entry. How to choose sql_auth?

4 8

RE: LDAP MSCHAP error
by Ivan Kalik 24 Aug '09

24 Aug '09

> Also any ideas as to how I may insert the variable from perl would be > nice. Read rlm_perl documentation. Ivan Kalik Kalik Informatika ISP

1 0

Re: Dynamic VLAN attribute in LDAP or AD?
by Gary Gatten 24 Aug '09

24 Aug '09

Agreed. I didn't know if I could do some group checking with ntlm_auth, more accurately get a list of groups a user belongs to? If I used FQDN I could prolly parse out the info I need from the user name as well: gary.neteng.waddell.... Ill try LDAP - good learning experience! ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Aug 24 15:48:40 2009 Subject: RE: Dynamic VLAN attribute in LDAP or AD? > Interesting... I'm assuming I could use existing LDAP attribs and remap > them as needed? Ie: "Fax Number" could be mapped to Tunnel ID? > Extending the schema is like getting teeth pulled. Resist the temptation and extend the schema now instead of later. When you need the Fax Number, what will you do? If you don't want to tackle LDAP, you could write a script to generate a separate file of unlang if-then blocks and pull it into the FR conf file with an $INCLUDE statement. > Also, no way to do this with NTLM auth is there? No. NTLM_auth is an authentication tool that returns 0 or 1 depending on the correctness of a password. This is an authorization question - what kind of access will the authenticated user be given? > -----Original Message----- > From: Jason Alderfer [mailto:jha2@emu.edu] > Sent: Monday, August 24, 2009 2:10 PM > To: Gary Gatten > Subject: RE: Dynamic VLAN attribute in LDAP or AD? > > >> So, by looking at this more carefully I'll have to do a bunch of >> if/else's or cases? What if for instance I have 500 > departments/groups >> - 500 different vlans? I'll have to test each one? >> >> I guess what I was hoping to do was something like: >> >> Get attribute "n" for user y (where n = a value used for >> Tunnel-Private-Group-Id" > > You will need to extend your LDAP schema to include the attributes > needed > for the VLAN and make sure they are properties of the objects that you > want them to apply to. > > Then you will need to add these attributes to the FR ldap.attrmap file, > e.g. > > replyItem Tunnel-Type radiusTunnelType > replyItem Tunnel-Medium-Type radiusTunnelMediumType > replyItem Tunnel-Private-Group-Id > radiusTunnelPrivateGroupId > > Now the LDAP module should be able to set these attributes automatically > for each request if you enable it in the authorize or post-auth section. > > Jason - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1