- Freeradius-Users - lists.freeradius.org

Re: how to limiting user bandwidth by quota..
by Nizar Zulmi 15 May '09

15 May '09

i try to do bandwidth quota limitation like thisfirst i define the sqlcounter with attribut from ChilliSpot-Max-All-Total-Octets =====start code=========== sqlcounter batasquota { counter-name = Max-All-MB check-name = Max-All-MB reply-name = ChilliSpot-Max-Total-Octets key = User-Name reset = never query = "SELECT SUM(acctinputoctets+acctoutputoctets) from radacct WHERE UserName='%{%k}'" sqlmod-inst = sql } ====end code=== then i defined the sqlcounter name in instantiate and authorize section.when i restart my radius server, the server cannot identify the attribut ChilliSpot-Max-Total-Octets, i try to find out and i know it because the attribute is not listed in dictionary, i do add the dictionary.chillispot to freeradius dictionary like this =============start code==================== # See the 'man' page for 'dictionary' for information on # the format of the dictionary files. # # If you want to add entries to the dictionary file, # which are NOT going to be placed in a RADIUS packet, # add them here. The numbers you pick should be between # 3000 and 4000. # #ATTRIBUTE My-Local-String 3000 string #ATTRIBUTE My-Local-IPAddr 3001 ipaddr #ATTRIBUTE My-Local-Integer 3002 integer ATTRIBUTE ChilliSpot-Max-Input-Octets 1 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Output-Octets 2 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Total-Octets 3 integer ChilliSpot =======================end code=================i restart my radius server i found this on restart ========================start code==================Fri May 15 16:24:50 2009 : Info: Starting - reading configuration files ... Fri May 15 16:24:50 2009 : Error: Errors reading radiusd.conf =======================end code================== then i try to view debug and got this message=========================start code==============read_config_files: reading dictionary Errors reading dictionary: dict_init: /etc/freeradius/dictionary[33]: unknown vendor ChilliSpot Errors reading radiusd.conf ===========================end code====================== unknown vendor..?? please help me for this...clue please, so much appreciate for any reply..regard --- On Thu, 5/14/09, Ivan Kalik <tnt(a)kalik.net> wrote: From: Ivan Kalik <tnt(a)kalik.net> Subject: Re: how to limiting user bandwidth by quota.. To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, May 14, 2009, 4:54 PM > thank you ahmed..which script??is that script belongs to freeradius or.. > iam using chillispot, as alan sugest me there is no specified attribute to > do limiting bandwidth by quota,.do you know what type attribut of > chillispot can do this??or you can give simple or detailed tutorial to do > so please.. > ChilliSpot has attributes for input, output and total octets. Have a look in the dictionary.chillispot and in ChilliSpot documentation.You replace Session-Timeout with ChilliSpot attribute and alter counter query to count octets and not session time. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

--- On Fri, 5/15/09, Johan Meiring <jmeiring(a)pcservices.co.za> wrote: > > Update using the Accounting Reply. > > All my business logic is inside a perl script using > rpm_perl. > (It's basically the only freeradius module I invoke). > Which means for every accounting request, radius server will invoke rpm_perl module ? Because freeradius is so flexible, I am wondering which is the optimal method, and here are some of the possibilities :- 1. Just invoke a perl module, and reply ( like what you did ). 2. Do database checking in radiusd via %{sql:....}, and do reply inside radiusd. 3. The database checking converted into a database store procedure and then do rely inside radiusd. :)

1 0

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

--- On Fri, 5/15/09, Ming-Ching Tiew <mctiew(a)yahoo.com> wrote: > > > > Do you update it via a new connection or you update it > via the same accounting connection ? If the later, could > you share how do you do it ? > Ignore this, I got the answer already. Thank you for your post. Regards.

2 1

Re: CoovaChilli - 'acctupdate'
by Ming-Ching Tiew 15 May '09

15 May '09

From: Johan Meiring <jmeiring(a)pcservices.co.za> > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > I for one use it quite extensively, and it works very > well! > > Without it you cannot safely allow dual logins. > > (e.g. if a user with 100MB left, logs in twice at the same > time, he will get 200MB) > Do you update it via a new connection or you update it via the same accounting connection ? If the later, could you share how do you do it ? Rgds.

2 1

Help Regarding Freeradius Server Inactivity and client access
by pushpraj nimbalkar 15 May '09

15 May '09

Hello All, I have working Freeradius(freeradius-2.1.3-1.fc10.i386) server with Mysql and chillispot. I just want to know what should happen when user is authenticated and after few time freeradius server stops working(due to any reason). In my case user stays on-line even though freeradius server is not working. For e.g. user A connects to my network radius server authenticates to user and after authentication say after 5 minutes radius server stopped working but user A still accessing internet as long as possible. I think if server stops working client should be disconnected. Regards, Pushpraj N.

3 3

Re: update disconnect
by mctiew＠yahoo.com 15 May '09

15 May '09

--- On Thu, 5/14/09, Alan DeKok <aland(a)deployingradius.com> wrote: > > > Though the exec method works but I have to open up the > port, which means > > the firewall thinks that's a separate connection, > which is lousy. > > Well... it *is* a separate connection. The > Disconnect-Request packet > is sent from a *new* source port to the disconnect port of > the client. > In the case of doing an "update disconnect" instead of exec, does it use the destination port of the accounting packet as the source, or it is also using a new source port ? > > And why do you think that something happening > *second* is logged > before something happening *first*? > Because the log seems to say there was a MYSQL error, no fields and SQL query did not succeed and so on.

2 1

Re: User in multiple groups with different login time
by Pramada Batchu 15 May '09

15 May '09

Can you give an example of script? Also how should the script be invoked? Thanks, Pramada >> I am trying to assign one user to multiple groups and each group has a >> different login time. Is it possible to check the user against each >> group's login time and allow access if anyone of them matches. > >No. Login-Time can't be used like that. You will have to write a script >that checks if the user is allowed to log in. > >Ivan Kalik >Kalik Informatika ISP

2 1

Need sanity check: steps to setting up certificate enrollment for dot1x/PEAP/Active Directory
by john 14 May '09

14 May '09

Hi all, I need help thinking my deployment plans through. I hope folks on the list will help me clarify my thinking. I intend to setup .1X access control on our LAN via freeradius. Here's what this would look like. Windows 2003 Standard Ed/Active Directory <=>Winbind/Samba <=>Freeradius <=> NAS <=> <PEAP/MSCHAPV2> <=>Windows XP/sp2 work stations. I'd like to enforce network access by making freeradius check for host certificates (by using 'EAP-TLS-Require-Client-Cert = Yes' under the PEAP section in eap.conf). So that only computers with valid host certs AND domain credentials will be allowed port access via the NAS to the LAN. My understanding is that best practice says that each computer cert should be unique. I think I could use two approaches to creating certs, and getting them to the client. Here's the two alternatives I think would work: Scenerio # 1 For 300 host machines on LAN 1. from the /certs directory use the MAKE scripts to generate a unique client.pem using the FQDN of each host. 2. copy and install host cert (fqdn.pem) and ca.der to each windows xp/sp2 client This would all be done by hand e.g. we would need to sit down at every host and install the cert. If this general outline is correct which file on freeradius would we remove if we wished to revoke a hosts certificate? If I am way off base here, I'd love to get corrected. Is there anyway to automate this procedure in our LAN environment other than scenario #2 below? Scenario #2 In order to auto-magically distribute unique computer certs to Windows 2003 domain members I understand that Windows 2003 Enterprise Edition has the ability to create a template certs and roll a unique cert for each host joined to the domain. And also to push the customized cert to each domain members via GPO. However, we don't currently run Win2k3 Enterprise edition but we would consider buying it if we thought that it would save us a lot of time for installation and future management of certs. Using this approach I think we would need to do the following. 1. from the /certs directory use 'make server.csr' to create a Certificate Signing request which we would then import to our Active Directory CA. 2. We would need to follow the steps outlined here http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-October/msg… to get our server cert which we generated on Freeradius signed by the Active Directory CA. 3. We could then import that signed cert into AD for automatic distribution and enrollment per http://www.wicked-styles.com/bitsandpieces/articles/enterprise_wi-fi_securi… I hope folks can help fill in the missing pieces here and also let me know which approach makes sense given the number of clients we have and the environment I've outline above. Has anyone had any experience with either scenario? Is there a better way than the ones I've outlined? Thanks very much! John

2 4

radius help
by jon jon 14 May '09

14 May '09

I have am using slackware 12.1 and installed freeradius version 2.1.5. I have read the Install and the Readme me file. I am trying the radtest program out and I start the radius server in debugging mode in one virtual screen and do a "radtest test test localhost 0 testing123" from another virtual screen, I get a access reject of my packets. So the good thing is that my radius server is receiving the packets. Now I move on to see if I create a user called bob in the users file. I put this at the top of the file: bob Cleartext-Password := "hello" and run radtest again using "radtest bob hello localhost 0 testing123" and still get access reject message. So I know that my server is up and running, but the user is being rejected because of the password not matching, right?

3 4

help on OpenSUSE installation
by mx5450 14 May '09

14 May '09

Team, I'm trying to set up freeradius 2.1.4 in a AMD 64 X2 system with an OpenSUSE 11.1 (x86_64.iso) OS. I must tell you that I'm new to Linux and Freeradius. According to the instructions on freeradius.org/radiusd/install I can either: 1. Get a pre-installed binary package (Peter Nixon) 2. get the FreeRADIUS tarball When I try to get the binary package (http://download.opensuse.org/repositories/network:/aaa/openSUSE_11.1/) I get a list of files/folders which I dont know what to do with them: i586/ network:aaa.repo repodata/ src/ x86_64/ As I got stuck, I tried to "build it" (? new term to me), by placing the tarball in usr/src/packages/SOURCES; extracting the freeradius.spec and placing it in usr/src/packages/SPECS. Then I run from the terminal prompt: rpmbuild -ba usr/src/packages/SPECS/ freeradius.spec However I got the message: marcos@win-219e0010bba:~> rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: db-devel is needed by freeradius-server-2.1.4-0.x86_64 e2fsprogs-devel is needed by freeradius-server-2.1.4-0.x86_64 gcc-c++ is needed by freeradius-server-2.1.4-0.x86_64 gdbm-devel is needed by freeradius-server-2.1.4-0.x86_64 gettext-devel is needed by freeradius-server-2.1.4-0.x86_64 glibc-devel is needed by freeradius-server-2.1.4-0.x86_64 libtool is needed by freeradius-server-2.1.4-0.x86_64 ncurses-devel is needed by freeradius-server-2.1.4-0.x86_64 openldap2-devel is needed by freeradius-server-2.1.4-0.x86_64 openssl-devel is needed by freeradius-server-2.1.4-0.x86_64 pam-devel is needed by freeradius-server-2.1.4-0.x86_64 postgresql-devel is needed by freeradius-server-2.1.4-0.x86_64 python-devel is needed by freeradius-server-2.1.4-0.x86_64 unixODBC-devel is needed by freeradius-server-2.1.4-0.x86_64 zlib-devel is needed by freeradius-server-2.1.4-0.x86_64 apache2-devel is needed by freeradius-server-2.1.4-0.x86_64 cyrus-sasl-devel is needed by freeradius-server-2.1.4-0.x86_64 krb5-devel is needed by freeradius-server-2.1.4-0.x86_64 libapr1-devel is needed by freeradius-server-2.1.4-0.x86_64 libmysqlclient-devel is needed by freeradius-server-2.1.4-0.x86_64 marcos@win-219e0010bba:~> I read about this and regarding the dependencies it seems that some "features" are not installed and that I need the OpenSUSE disk to load them from the YAST. However I can not seem to find what the "sh: apxs2-prefork: command not found" message is about or how to fix that. I'm stuck again. Could you help with this? Thanks in advance

3 2