- Freeradius-Users - lists.freeradius.org

PEAP-EAP-MD5 failure with freeradius-2.1.1
by Prasad Parab 20 Nov '08

20 Nov '08

Dear All, Kndly help with the following setup: SETUP; wifi client (Windows-XPservice pack 2) <-----------------> AP <-----------------------> freeradius-2.1.1 on red hat fedora-9 auth type:PEAP-EAP-MD5 wpa-enterprise (external Radius Server) user: client password :test123 I trying to use WPA-Enterprise using PEAP,EAP-MD5 as authentication type and freeradius-2.1.1 as external radius server. It fails to authenticate. Attached are the log files and wireshark captures from the freeradius-2.1.1. Regards Prasad

3 8

Fwd: Re:Re: Fail to disable the Simultanous-use, somebody help me.
by Alexandre Chapellon 20 Nov '08

20 Nov '08

It seems like your NAS sends accounting Stop for the previous session (nas-port is different) after receiving the response of of the accounting Start (for the new session)... this would show your NAS ask the radius to notice a disconnection hit has decided... I don't know how netscreen works, but neither Access-Accept nor Accouting request have any Framed-IP-Address or anything ppp related... looks strange to me. This can mean that whereas established the vpn connection doesn't work (you can easily test this) or netscreen is managing ip allocation by its ow, and so you should take a look at its config to see if it's able to offer different IP addresses for one login at the same time (If it tries to give every body the same address, no doubt it won't work unless it disconnects the previous session)... Or you can ask freeradius to handle ip allocation, depending on your config

1 0

free RADIUS client + CHAP + PAM
by Vinay 20 Nov '08

20 Nov '08

Hi there There are a lot of places on the net which talk about how PAM cannot work with CHAP on the RADIUS server. Will an implementation of freeRADIUS client with CHAP and PAM(pam_radius_auth) module work? Please point me to the appropriate link. Thanks -Vinay

1 0

Fail to disable the Simultanous-use, somebody help me.
by dgluoyun 20 Nov '08

20 Nov '08

Hi, I've set up a freeradius server for Netscreen VPN with Mysql 5.0.22 and freeradius 2.0.5, and radiusd service is runing well, I can connect the VPN, and everything seems to be ok. But we have a unique need to allow more than 1 pc to login the VPN with the same username at the same time. So the Problem is ---only 1 pc can login, if another pc login with the same username, the previous connection will logout automaticly. This sounds kind of strange 'cause I use no simultaneous-use limitation, and the Netscreen share-limit has been set upto 1000. I tried the following ways to solve this problem, but failed. 1. I stop the freeradius acct port (1813) listen, I thought this might stop the acct information feed back to netscreen (NAS). But it turn out to be that nobody can login. 2. I setup simul-use control with sql query, and I create a usergroup in mysql, join the username into this group, and set the Simultaneous-Use as 5 in radgroupcheck table for this group. But only 1 person can login. 3. I Doubt That whether the radutmp limit the login, then i comment everything about radutmp in radiusd.conf, default.conf etc. But the things turn out to be the same. Then I stop the sql simul-query, but hte same. One strange thing: no matter what simul-query ( sql or radutmp) I use, both the radlast and the radacct table log the session. I'm wondering: Besides sql and radutmp, something is doing the simul-use verify job? So i don't know where i've done wrong. Hope someone can help out. here is the radiusd -X result: [root@localhost ~]# radiusd -X FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Aug 22 2008 at 16:32:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.249.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "123456" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = "" accounting_stop_query_alt = "" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Thanks in advance Lorens

1 0

free RADIUS client + CHAP + PAM
by Vinay 20 Nov '08

20 Nov '08

Hi there There are a lot of places on the net which talk about how PAM cannot work with CHAP on the RADIUS server. Will an implementation of freeRADIUS client with CHAP and PAM(pam_radius_auth) module work? Please point me to the appropriate link. Thanks -Vinay

1 0

logging to stdout
by richard lucassen 19 Nov '08

19 Nov '08

I have already asked this question a few years ago, but it still seems to be impossible to log to stdout using Ubuntu's Freeradius-1.1.7 (I have worked around it by using a fifo) Am I overlooking something or is logging to stdout still an issue with 1.1.7? (for several reasons I'd like to stay with the original Ubuntu version) R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+

2 2

ldap (sambaNtPassword) + peap-mschapV2 + freeradius : step by step question
by FM 19 Nov '08

19 Nov '08

Hello, I am trying to add a Wifi AP (aironet 1250). I am trying to use PEAP/MSCHAPV2 and SAMBA SambaNTpassword (LDAP Back-end). I read a lot of the question about the subject on the ML and cannot figure out all the steps. So here are all the steps I did : On the AP : I configured our radius server as the server manager. It thinks it is ok because the radius SRV receive request from it. for the AP I added a entry in clients.conf : client 192.168.4.8 { ipaddr = 192.168.4.8 shortname = wifi01 secret = mypassword } I edited the /modules/ldap : ldap { server = "localhost" identity = "cn=manager,dc=lan,dc=lexum,dc=pri" password = manager_password basedn = "dc=lan,dc=lexum,dc=pri" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=sambaSamAccount)" password_attribute = NT-Password I edited the ldap.attrmap (to map NT-Pasword to sambaNtPassword) : #checkItem LM-Password lmPassword #checkItem NT-Password ntPassword checkItem LM-Password sambaLmPassword checkItem NT-Password sambaNtPassword I DID NOT touch radiusd.conf I DID NOT touch /etc/raddb/sites-enabled/default I know that I need to enable ldap somewhere but ... where :D I will not post the result of -X because I know I need other config. Regards, FM

3 2

Re: ssh cleartext-password "? INCORRECT" (Alan DeKok)
by David Ly 19 Nov '08

19 Nov '08

------------------------------ > Message: 4 > Date: Wed, 19 Nov 2008 10:49:06 -0600 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: ssh cleartext-password "? INCORRECT" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <49244382.5090801(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > David Ly wrote: > >> Here is the relavent part of the log from radiusd -X >> Using 'radtest steve testing localhost 10 testing123' >> > > You've done some *very* weird editing or reformatting of the log. > That makes it more difficult to understand. > > >> Using 'ssh steve@localhost' password: testing >> >> rad_recv: Access-Request packet from host 127.0.0.1 port 26561, id=106, >> length=83 User-Name = >> "steve" >> User-Password = "\010\n\r\177INCORRECT" **** >> > > Ah, yes. That's a PAM feature, I think. Or maybe SSH. It replaces > the password the user entered with that string. Why? Damned if I know. > > I'd suggest asking the PAM people how to configure the system so that > it doesn't mangle the password. > > In any case, this is what the RADIUS server receives, so there is > *nothing* you can do to the RADIUS server to solve the problem. > > And the PAM RADIUS module doesn't do this stupid rewriting. So > there's nothing you can do to that module, either. > > Alan DeKok. > > > I manged to find the problem, as you said, it WASNT the server but rather the PAM module that was causing this. It required a local user account (set with a blank password). As to why it needs that, I have no idea, but thats that. Thanks for the help, and I hope that others who come across this can avoid the grueling two days of troubleshooting and tinkering. Once agian thanks to all. Cheers David Ly

1 0

Re: How to filter accountings based on the value of a VSA attribute
by cris miyata 19 Nov '08

19 Nov '08

Thanks a lot Alexandre! It worked perfectly! Cheers, Cristina Miyata ---------[ Received Mail Content ]---------- Subject : Re: How to filter accountings based on the value of a VSA attribute Date : Wed, 19 Nov 2008 09:31:08 -1000 >From : Alexandre Chapellon <alexandre.chapellon(a)mana.pf> To : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Having more details about your conf would help but anyway "unlang" can do this (man unlang). if (attribute == "value") { update control { Proxy-To-Realm := "realm" } } P.S: this cannot be done in proxy.conf file..... Le 19.11.2008 08:55, cris miyata a écrit : > Dear FreeRADIUS users, > > > > We configured FreeRADIUS to send accounting to 2 different servers, but for one of them I want to send only the accountings that have a VSA attribute equal to a give value. > > > > Does anyone know how to do this configuration? > > > > Thanks in advance. > > > > Regards, > > > Cristina Miyata > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

How to filter accountings based on the value of a VSA attribute
by cris miyata 19 Nov '08

19 Nov '08

Dear FreeRADIUS users, We configured FreeRADIUS to send accounting to 2 different servers, but for one of them I want to send only the accountings that have a VSA attribute equal to a give value. Does anyone know how to do this configuration? Thanks in advance. Regards, Cristina Miyata

2 1