- Freeradius-Users - lists.freeradius.org

RE: NAS table
by Nizar Zulmi 17 Apr '09

17 Apr '09

dearl list all..don't know how to thanks to you to reply my email and answer my quest. and sorry for to much question.:Di've run this commandradiusd -X but it return this The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius * xtradiusTry: apt-get install <selected package i read freeradius documentation to do debug in ubuntu, and i try this command but i freeradius -X and return this messagefreeradius -XStarting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: /etc/freeradius/proxy.confConfig: including file: /etc/freeradius/clients.confConfig: including file: /etc/freeradius/snmp.confConfig: including file: /etc/freeradius/eap.confConfig: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0read_config_files: reading dictionaryread_config_files: reading naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clients this message after i comment out this inf clients.conf#client 127.0.0.1 {# secret = passwordradius# shortname = localhost# nastype = other # localhost isn't usually a NAS... # } but if i uncomment that then i run freeradius -X it return this message main: debug_level = 0read_config_files: reading dictionaryread_config_files: reading naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clientsread_config_files: reading realmsradiusd: entering modules setupModule: Library search path is /usr/lib/freeradiusModule: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)"rlm_exec: Wait=yes but no output defined. Did you mean output=none?Module: Instantiated exec (exec)Module: Loaded exprModule: Instantiated expr (expr)Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yesModule: Instantiated pap (pap)Module: Loaded CHAPModule: Instantiated chap (chap)Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)"Module: Instantiated mschap (mschap)Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600Module: Instantiated unix (unix)Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = norlm_eap: Loaded and initialized type md5rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP"rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = norlm_eap: Loaded and initialized type mschapv2Module: Instantiated eap (eap)Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = noModule: Instantiated preprocess (preprocess)Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = noModule: Instantiated realm (suffix)Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "jOeLya" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/freeradius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER B Y id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER B Y id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.Group Name,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroup check,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.Grou pName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.Group Name,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroup reply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.Grou pName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessio nTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause=' %{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSession Time=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTim e <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{ Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Addr ess}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUni queId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, Acc tSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctet s, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddre ss, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '% {SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Ty pe}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) S ECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Se rvice-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId , UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStop Time, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctI nputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCa use, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay ) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', ' 0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}' , '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Frame d-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', Acc tStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIP Address = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessi onTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctO utputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Ca use}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info} ' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' A ND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqu eId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctS topTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, Ac ctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminat eCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDe lay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name} ', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB( '%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Inpu t-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station- Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Fra med-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName=' %{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddr ess, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct W HERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) va lues ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Typ e}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01 23456789.-_: /"rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to root@localhost:/radiusrlm_sql (sql): starting 0rlm_sql (sql): Attempting to connect rlm_sql_mysql #0rlm_sql_mysql: Starting connect to MySQL server for #0rlm_sql (sql): Connected new DB handle, #0rlm_sql (sql): starting 1rlm_sql (sql): Attempting to connect rlm_sql_mysql #1rlm_sql_mysql: Starting connect to MySQL server for #1rlm_sql (sql): Connected new DB handle, #1rlm_sql (sql): starting 2rlm_sql (sql): Attempting to connect rlm_sql_mysql #2rlm_sql_mysql: Starting connect to MySQL server for #2rlm_sql (sql): Connected new DB handle, #2rlm_sql (sql): starting 3rlm_sql (sql): Attempting to connect rlm_sql_mysql #3rlm_sql_mysql: Starting connect to MySQL server for #3rlm_sql (sql): Connected new DB handle, #3rlm_sql (sql): starting 4rlm_sql (sql): Attempting to connect rlm_sql_mysql #4rlm_sql_mysql: Starting connect to MySQL server for #4rlm_sql (sql): Connected new DB handle, #4rlm_sql (sql): - generate_sql_clientsrlm_sql (sql): Query: SELECT * FROM nasrlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=passwordr adiusrlm_sql (sql): Adding client 127.0.0.1 (localhost) to clients listrlm_sql (sql): Released sql socket id: 4Module: Instantiated sql (sql)Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port"Module: Instantiated acct_unique (acct_unique)Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no"Module: Instantiated files (files)Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-% Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = noModule: Instantiated detail (detail)Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yesModule: Instantiated radutmp (radutmp)Listening on authentication *:1812Listening on accounting *:1813Ready to process requests. whats really wrong...still cannot read NAS from nas table on radius..was it? really apreciate your answer. Nizar --- On Thu, 4/16/09, Ivan Kalik <tnt(a)kalik.net> wrote: From: Ivan Kalik <tnt(a)kalik.net> Subject: RE: NAS table To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Date: Thursday, April 16, 2009, 4:02 AM this is result of freeradius -X reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf It's not. It's a result of HUP. Now post what you were told. Ivan Kalik Kalik Informatika ISP -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Mikrotik radius-mac-authentication
by Adi_T 17 Apr '09

17 Apr '09

I'm using Freeradius to control the access to my Mikrotik APs. In the radius database I've put at the radcheck table all the mac-addresses of my clients. When I put accept as a value, the clients connects immediately, but when I put reject the clients that are connected do not disconnect. I have to disable radius-mac-authentication at the security profile of the wireless interface and enable it again so that the connected clients that are declared as rejected disconnect from the APs and do not reconnect again. Is there anything I can do to automatically block even the connected clients when I put reject as a value Thanks in advance Adi -- View this message in context: http://www.nabble.com/Mikrotik-radius-mac-authentication-tp23077135p2307713… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRADIUS 2 Installation failed on ubuntu hardy
by Khan 17 Apr '09

17 Apr '09

Hello everyone, I am new to VoIP, its my first time installing FR on my server. I followed the instructions and first installed dependencies and then FR. My installation process and other steps i took can be found on this link: http://voiprookie.blogspot.com/ I tried to install it several time but no luck, first I used aptitude which installed the 1.x version so i removed it and then I used synaptic to install that didn't work, finally i took manual approach and installed it as posted on the link above. However during installation I have seen many warnings, I tried to capture the screen dump which can be found at this link: http://pastebin.com/f1d50a81 Obviously it didn't install right but i have no clue where to go from here, could anyone please help me guide to the right procedure. The version on other information are posted on my bloggspot link. Does installing, removing, and re-installing several times screwed up my server and now it wouldn't let me install ? Please help!!! Thanks ya'all in advance... Khan

4 3

problev with radius
by Волошин Вячеслав 17 Apr '09

17 Apr '09

radiusd -v: radiusd: FreeRADIUS Version 1.0.4, for host , built on Jun 19 2005 at 14:01:31 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Has this error, when client connected in radius server: In /var/log/radius/radius.log Fri Apr 17 09:25:50 2009 : Error: Discarding duplicate request from client gnugk:48117 - ID: 126 due to unfinished request 229 Fri Apr 17 09:26:22 2009 : Auth: Login OK: [4413] (from client gnugk port 0 cli 4413) Fri Apr 17 09:33:32 2009 : Error: Discarding duplicate request from client st17-gw:1232 - ID: 15 due to unfinished request 235 Fri Apr 17 09:33:34 2009 : Error: Discarding duplicate request from client st17-gw:1232 - ID: 15 due to unfinished request 235 Fri Apr 17 09:33:40 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 16 due to unfinished request 236 Fri Apr 17 09:33:42 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 16 due to unfinished request 236 Fri Apr 17 09:33:51 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 17 due to unfinished request 237 Fri Apr 17 09:33:53 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 17 due to unfinished request 237 Fri Apr 17 09:34:17 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 206 due to unfinished request 238 Fri Apr 17 09:34:20 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 206 due to unfinished request 238 Fri Apr 17 09:35:22 2009 : Error: Dropping conflicting packet from client st17-gw:1233 - ID: 18 due to unfinished request 239 Fri Apr 17 09:35:24 2009 : Error: Dropping conflicting packet from client st17-gw:1233 - ID: 18 due to unfinished request 239 Fri Apr 17 09:35:35 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 207 due to unfinished request 240 Fri Apr 17 09:35:38 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 207 due to unfinished request 240 Fri Apr 17 09:36:36 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 19 due to unfinished request 241 Fri Apr 17 09:36:38 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 19 due to unfinished request 241 Fri Apr 17 09:36:42 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 20 due to unfinished request 242 Fri Apr 17 09:36:44 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 20 due to unfinished request 242 Fri Apr 17 09:36:49 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 21 due to unfinished request 243 Fri Apr 17 09:36:51 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 21 due to unfinished request 243 Fri Apr 17 09:37:05 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 22 due to unfinished request 244 Fri Apr 17 09:37:07 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 22 due to unfinished request 244 when the reboot radiusd, auth and accounting req normal processing: Fri Apr 17 09:51:53 2009 : Error: Discarding duplicate request from client st17-gw:1258 - ID: 74 due to unfinished request 303 Fri Apr 17 09:51:54 2009 : Error: Discarding duplicate request from client st17-gw:1259 - ID: 75 due to unfinished request 304 Fri Apr 17 09:52:01 2009 : Error: Discarding duplicate request from client st17-gw:1260 - ID: 76 due to unfinished request 305 Fri Apr 17 09:52:05 2009 : Info: Ready to process requests. Fri Apr 17 09:52:09 2009 : Auth: Login OK: [miracle] (from client st17-gw port 367362 cli 00:14:A4:46:73:26) Fri Apr 17 09:52:12 2009 : Auth: Login OK: [stepanov] (from client st17-gw port 367363 cli 00:0E:A6:3A:A5:4E) Fri Apr 17 09:52:13 2009 : Auth: Login OK: [260130] (from client rep-hsgw01 port 2151678103 cli 00:1F:C6:A6:F9:A6) What this mean this error? Formula+ LTD, т.(8617) 61-02-01 ф.(8617) 61-34-16 м.(918) 634-7550 voloshin(a)maks.net www.formulaplus.ru

2 1

Help with LDAP groupOfNames?
by Jason Antman 16 Apr '09

16 Apr '09

I just upgraded to FreeRadius 2.1.1, as per some off-list advice, but still am having issues with this... I've Googled and read docs to no avail, probably as I don't know much of anything about Radius at all - and just need this (seemingly relatively simple) thing. I'm running FreeRADIUS 2.1.1 (SuSE package) and OpenLDAP 2.3.19. I have an access point that will do captive portal, but only via RADIUS, not via LDAP natively. I already have an LDAP server running, so I just added a new groupOfNames called "WirelessUsers". Basically, *all* I want RADIUS to do is check the username and password, and assuming they are correct, either allow or deny based on whether the user is a member of "WirelessUsers". According to radtest, I have it working with LDAP, but it allows everyone with a valid username and password access, regardless of the WirelessUsers group - and I'm not seeing anything related to that group in the LDAP logs or anything related to groups at all in `radiusd -f -X`. I can't seem to find anything concrete online for freeradius1 relating to groupOfNames, so I've just been trying random things that I found online (for raddb/users) hoping one would work. RELEVANT CONFIGS (only relevant portions, comments removed) raddb/sites-enabled/default: authorize { ldap } authenticate { Auth-Type LDAP { ldap } } raddb/modules/ldap: ldap { server = "127.0.0.1" basedn = "dc=example,dc=com" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no #access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = "cn" #groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-\ UserDn}))) groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{check:LDAP-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{\ check:LDAP-UserDn}))) groupmembership_attribute = WirelessUsers #groupmembership_attribute = "memberof" timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } raddb/users: #DEFAULT Auth-Type = LDAP # Fall-Through = yes # #DEFAULT Ldap-Group != "wireless", Auth-Type := Reject # # # # # #DEFAULT Ldap-Group != "cn=WirelessUsers,ou=groups,dc=midlandparkambulance,dc=com", Auth-Type := Reject # #DEFAULT Auth-Type := LDAP # # # DEFAULT Ldap-Group == WirelessUsers DEFAULT Auth-Type := Reject (For users, I've tried each of the pairs of commented-out lines, as per different things I found online.) I'm sure this is horribly simple, but I just can't seem to figure it out from the docs or from extensive googling. Thanks for any help, Jason Antman

2 2

Re: Pharmacy Online Sale 70% OFF!
by VIAGRA � Pfizer Inc. 16 Apr '09

16 Apr '09

About this mailing: You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice. ©2009 Microsoft | Unsubscribe at http://niceswell.com | More news at http://niceswell.com | Prvacy at http://niceswell.com Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

1 0

Tagged attributes problem and rlm_perl in FreeRADIUS 2.1.4
by Alexandr Kovalenko 16 Apr '09

16 Apr '09

Hello! I've already asked about the very same problem with tagged attributes and rlm_perl in FreeRADIUS 1.1.7, and Ivan Kalik <tnt(a)kalik.net> told me that he tested it on 2.1.4, so I've upgraded to new version: FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.1, built on Apr 16 2009 at 10:42:09 But the problem persist. But now it became even worse, it does not authorize even for the first time. Log file attached. If I uncomment $RAD_REPLY{'ERX-Service-Activate:2'} = "deny" line in code radiusd just dies. When it is commented radiusd returns attributes ERX-Service-Activate and ERX-Service-Statistics without tag. Thanks in advance for help. Code snippet of my rlm_perl authorize( ) function: if (($RAD_REQUEST{'User-Name'} eq 'admin') and ($RAD_REQUEST{'User-Password'} eq 'test')) { %RAD_REPLY = undef; $RAD_REPLY{'ERX-Service-Activate:1'} = "telesys"; $RAD_REPLY{'ERX-Service-Statistics:1'}[0] = "time-volume"; $RAD_REPLY{'ERX-Qos-Parameters'}[0] = "internet_tr_value 2097152"; $RAD_REPLY{'ERX-Qos-Parameters'}[1] = "internet_tr_value_in 2097152"; # $RAD_REPLY{'ERX-Service-Activate:2'} = "deny"; $RAD_REPLY{'ERX-Qos-Profile-Name'} = "SP_Tele_Internet"; $RAD_REPLY{'Framed-IP-Address'} = '10.0.112.2'; $RAD_REPLY{'Framed-IP-Netmask'}= "255.255.255.255"; $RAD_REPLY{'ERX-Primary-DNS'} = "77.91.190.21"; $RAD_REPLY{'ERX-Secondary-DNS'} = "77.91.190.24"; return RLM_MODULE_OK; } else { return RLM_MODULE_REJECT; }; -- Alexandr Kovalenko http://uafug.org.ua/

2 4

priority in radcheck and radgroupcheck
by Oguzhan Kayhan 16 Apr '09

16 Apr '09

Hi, I have a simultaneous-use information belongs to a users radgropcheck.. What i want is, if i enter a value to users radcheck, it should bypass the radgroupcheck value..how it is possible?? For now, whatever i make the simultaneous use value for user, it uses the default settings from the radgroupcheck.

2 3

strange for me
by Tseveendorj 16 Apr '09

16 Apr '09

Hello, I configured bandwidth shape in FreeRADIUS's MySQL with following in radgroupreply table Cisco-AVPair := ip:sub-policy-Out=256Kbps but today I defined Pool-Name attribute in radcheck table tseveen Pool-Name := pool the problem is when I defined Pool-Name attribute then bandwidth shape doesn't work. I can download something 1.2Mbps How do I define both bandwidth shape and Pool ? Really appreciate for any help. Sincerely, Tseveen

2 3

Re: Dynamically set password_attribute
by James Devine 16 Apr '09

16 Apr '09

Being able to verify the mac against the ldap database is the best scenario, the mysql database we are using for accounting only. I added: DEFAULT User-Name =~ "([0-9a-fA-F]{2}:){5}[0-9a-fA-F]" Auth-Type := Accept to the users file, but I am still see it setting auth type to ldap after authorization: Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: waiting for bind result ... Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: Bind was successful Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: performing search in dc=gwis, with filter (&(macaddress=00:1f:3a:21:62:f8)(aaaenable=1)) Thu Apr 16 13:59:32 2009 : Info: [ldap] looking for check items in directory... Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: aaasimultaneoususe -> Simultaneous-Use == 1 Thu Apr 16 13:59:32 2009 : Info: [ldap] looking for reply items in directory... Thu Apr 16 13:59:32 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Thu Apr 16 13:59:32 2009 : Info: [ldap] Setting Auth-Type = LDAP On Wed, Apr 15, 2009 at 5:06 PM, Kenneth Grady <klg(a)lanl.gov> wrote: > If you don't want LDAP to authenticate your mac addresses you need to > set the Auth-Type before it gets set to ldap. > You can do that a number of ways (I use #3) > > 1) try macs in the users file > 00:1f:3a:21:62:f8 ClearText-Password := "00:1f:3a:21:62:f8" > or > DEFAULT User-Name =~ > > "^00:1f:3a:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]$", > Auth-Type := Accept > > 2) or add mac addresses in your mysql database > INSERT INTO radcheck VALUES > (null,"${MAC-Address}","ClearText-Password",":=","${MAC-Address}"); > or > INSERT INTO radcheck VALUES > (null,"${MAC-Address}","Auth-Type",":=","Accept"); > > 3) a combination of put the DEFAULT and all MAC-Addresses in the mysql > database and don't have ldap set the Auth-Type > INSERT INTO radgroupcheck values (null,"DEFAULT","Auth-Type",":=","LDAP"); > INSERT INTO radusergroup VALUES ("DEFAULT","DEFAULT",1); > INSERT INTO radgroupcheck values (null,"MAC","Auth-Type",":=","Accept"); > #for each MAC you want to accept replace the 00: with your mac addresses > INSERT INTO radusergroup VALUES ("00:00:00:00:00:00","MAC",1); > DELETE FROM radusergroup where username ="00:00:00:00:00:00"; > and in modules/ldap > ldap { > ... > set_auth_type = no > } >

2 1