- Freeradius-Users - lists.freeradius.org

how to define ACL like things in RADIUS
by Parashar Singh 15 May '09

15 May '09

Hi I have configure Radius server with LDAP authentication, for performing AAA for Cisco Routers and Firwalls. Currently all users created in LDAP are getting equal priviledge of accessing all devices (NAS) configured with AAA. I want to allow a set of users to let access some devices (say only few routers) while to allow other set of users with access permission of all devices (including Routers and Firwalls). I am aware of following: root Auth-Type := Reject Reply-Message = "Your account has been disabled." which deny all access to user root. But I want some modification, i.e. root user will able to authenticate to only two NAS, 192.168.1.178 & 192.168.1.179. Pls suggest some solution. Please guide me and help me to implement above scenario. Thanks

3 2

freeradius packets thresholds | help
by ramesh p 15 May '09

15 May '09

Hi All, Does anybody have an idea , how many transactions the FreeRADIUS server can handle on a per second, minute, and hourly basis. Thanks in advance. Thanks, Rams.

4 6

Re: how to limiting user bandwidth by quota..
by Nizar Zulmi 15 May '09

15 May '09

i try to do bandwidth quota limitation like thisfirst i define the sqlcounter with attribut from ChilliSpot-Max-All-Total-Octets =====start code=========== sqlcounter batasquota { counter-name = Max-All-MB check-name = Max-All-MB reply-name = ChilliSpot-Max-Total-Octets key = User-Name reset = never query = "SELECT SUM(acctinputoctets+acctoutputoctets) from radacct WHERE UserName='%{%k}'" sqlmod-inst = sql } ====end code=== then i defined the sqlcounter name in instantiate and authorize section.when i restart my radius server, the server cannot identify the attribut ChilliSpot-Max-Total-Octets, i try to find out and i know it because the attribute is not listed in dictionary, i do add the dictionary.chillispot to freeradius dictionary like this =============start code==================== # See the 'man' page for 'dictionary' for information on # the format of the dictionary files. # # If you want to add entries to the dictionary file, # which are NOT going to be placed in a RADIUS packet, # add them here. The numbers you pick should be between # 3000 and 4000. # #ATTRIBUTE My-Local-String 3000 string #ATTRIBUTE My-Local-IPAddr 3001 ipaddr #ATTRIBUTE My-Local-Integer 3002 integer ATTRIBUTE ChilliSpot-Max-Input-Octets 1 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Output-Octets 2 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Total-Octets 3 integer ChilliSpot =======================end code=================i restart my radius server i found this on restart ========================start code==================Fri May 15 16:24:50 2009 : Info: Starting - reading configuration files ... Fri May 15 16:24:50 2009 : Error: Errors reading radiusd.conf =======================end code================== then i try to view debug and got this message=========================start code==============read_config_files: reading dictionary Errors reading dictionary: dict_init: /etc/freeradius/dictionary[33]: unknown vendor ChilliSpot Errors reading radiusd.conf ===========================end code====================== unknown vendor..?? please help me for this...clue please, so much appreciate for any reply..regard --- On Thu, 5/14/09, Ivan Kalik <tnt(a)kalik.net> wrote: From: Ivan Kalik <tnt(a)kalik.net> Subject: Re: how to limiting user bandwidth by quota.. To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, May 14, 2009, 4:54 PM > thank you ahmed..which script??is that script belongs to freeradius or.. > iam using chillispot, as alan sugest me there is no specified attribute to > do limiting bandwidth by quota,.do you know what type attribut of > chillispot can do this??or you can give simple or detailed tutorial to do > so please.. > ChilliSpot has attributes for input, output and total octets. Have a look in the dictionary.chillispot and in ChilliSpot documentation.You replace Session-Timeout with ChilliSpot attribute and alter counter query to count octets and not session time. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

--- On Fri, 5/15/09, Johan Meiring <jmeiring(a)pcservices.co.za> wrote: > > Update using the Accounting Reply. > > All my business logic is inside a perl script using > rpm_perl. > (It's basically the only freeradius module I invoke). > Which means for every accounting request, radius server will invoke rpm_perl module ? Because freeradius is so flexible, I am wondering which is the optimal method, and here are some of the possibilities :- 1. Just invoke a perl module, and reply ( like what you did ). 2. Do database checking in radiusd via %{sql:....}, and do reply inside radiusd. 3. The database checking converted into a database store procedure and then do rely inside radiusd. :)

1 0

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

--- On Fri, 5/15/09, Ming-Ching Tiew <mctiew(a)yahoo.com> wrote: > > > > Do you update it via a new connection or you update it > via the same accounting connection ? If the later, could > you share how do you do it ? > Ignore this, I got the answer already. Thank you for your post. Regards.

2 1

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

From: Johan Meiring <jmeiring(a)pcservices.co.za> > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > I for one use it quite extensively, and it works very > well! > > Without it you cannot safely allow dual logins. > > (e.g. if a user with 100MB left, logs in twice at the same > time, he will get 200MB) > Do you update it via a new connection or you update it via the same accounting connection ? If the later, could you share how do you do it ? Rgds.

2 1

Help Regarding Freeradius Server Inactivity and client access
by pushpraj nimbalkar 15 May '09

15 May '09

Hello All, I have working Freeradius(freeradius-2.1.3-1.fc10.i386) server with Mysql and chillispot. I just want to know what should happen when user is authenticated and after few time freeradius server stops working(due to any reason). In my case user stays on-line even though freeradius server is not working. For e.g. user A connects to my network radius server authenticates to user and after authentication say after 5 minutes radius server stopped working but user A still accessing internet as long as possible. I think if server stops working client should be disconnected. Regards, Pushpraj N.

3 3

Re: update disconnect
by mctiew＠yahoo.com 15 May '09

15 May '09

--- On Thu, 5/14/09, Alan DeKok <aland(a)deployingradius.com> wrote: > > > Though the exec method works but I have to open up the > port, which means > > the firewall thinks that's a separate connection, > which is lousy. > > Well... it *is* a separate connection. The > Disconnect-Request packet > is sent from a *new* source port to the disconnect port of > the client. > In the case of doing an "update disconnect" instead of exec, does it use the destination port of the accounting packet as the source, or it is also using a new source port ? > > And why do you think that something happening > *second* is logged > before something happening *first*? > Because the log seems to say there was a MYSQL error, no fields and SQL query did not succeed and so on.

2 1

Re: User in multiple groups with different login time
by Pramada Batchu 15 May '09

15 May '09

Can you give an example of script? Also how should the script be invoked? Thanks, Pramada >> I am trying to assign one user to multiple groups and each group has a >> different login time. Is it possible to check the user against each >> group's login time and allow access if anyone of them matches. > >No. Login-Time can't be used like that. You will have to write a script >that checks if the user is allowed to log in. > >Ivan Kalik >Kalik Informatika ISP

2 1

Need sanity check: steps to setting up certificate enrollment for dot1x/PEAP/Active Directory
by john 14 May '09

14 May '09

Hi all, I need help thinking my deployment plans through. I hope folks on the list will help me clarify my thinking. I intend to setup .1X access control on our LAN via freeradius. Here's what this would look like. Windows 2003 Standard Ed/Active Directory <=>Winbind/Samba <=>Freeradius <=> NAS <=> <PEAP/MSCHAPV2> <=>Windows XP/sp2 work stations. I'd like to enforce network access by making freeradius check for host certificates (by using 'EAP-TLS-Require-Client-Cert = Yes' under the PEAP section in eap.conf). So that only computers with valid host certs AND domain credentials will be allowed port access via the NAS to the LAN. My understanding is that best practice says that each computer cert should be unique. I think I could use two approaches to creating certs, and getting them to the client. Here's the two alternatives I think would work: Scenerio # 1 For 300 host machines on LAN 1. from the /certs directory use the MAKE scripts to generate a unique client.pem using the FQDN of each host. 2. copy and install host cert (fqdn.pem) and ca.der to each windows xp/sp2 client This would all be done by hand e.g. we would need to sit down at every host and install the cert. If this general outline is correct which file on freeradius would we remove if we wished to revoke a hosts certificate? If I am way off base here, I'd love to get corrected. Is there anyway to automate this procedure in our LAN environment other than scenario #2 below? Scenario #2 In order to auto-magically distribute unique computer certs to Windows 2003 domain members I understand that Windows 2003 Enterprise Edition has the ability to create a template certs and roll a unique cert for each host joined to the domain. And also to push the customized cert to each domain members via GPO. However, we don't currently run Win2k3 Enterprise edition but we would consider buying it if we thought that it would save us a lot of time for installation and future management of certs. Using this approach I think we would need to do the following. 1. from the /certs directory use 'make server.csr' to create a Certificate Signing request which we would then import to our Active Directory CA. 2. We would need to follow the steps outlined here http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-October/msg… to get our server cert which we generated on Freeradius signed by the Active Directory CA. 3. We could then import that signed cert into AD for automatic distribution and enrollment per http://www.wicked-styles.com/bitsandpieces/articles/enterprise_wi-fi_securi… I hope folks can help fill in the missing pieces here and also let me know which approach makes sense given the number of clients we have and the environment I've outline above. Has anyone had any experience with either scenario? Is there a better way than the ones I've outlined? Thanks very much! John

2 4