- Freeradius-Users - lists.freeradius.org

Unlang SQL
by Breuer Nicolas 28 Apr '08

28 Apr '08

Hello, I'm using an unlang into my post-auth section using the module sql3 (based on sql module but with a different database) if ("%{sql3:Select type from XXX where username='%{User-Name}' }" == "22") { } but the function is not working unless i declare the sql3 module before the unlang. Is it normal ? The problem was also the sql3 module call the sql module with the radacct logging and it's not very clean to call once more this file to just use an unlang function... Breuer Nicolas Content & Marketing Manager. Network Supervisor. BELCENTER ISP & PORTALS Avenue Henri Conscience, 94 B -1140 Bruxelles Tél. :+32 2 243 0 243 Fax :+32 2 243 0 244 Mobile :+32 486 50 27 87 E-Mail : Nicolas.Breuer(a)Belcenter.biz http://www.BelCenter.be | http://www.BelCenter.net http://www.BelCenter.lu | http://www.BelCenter.nl

2 1

Dear freeradius-users@list.xs4all.nl April 87% 0FF
by VIAGRA � Official Site 28 Apr '08

28 Apr '08

1 0

Key problem
by xiningtom_1986 26 Apr '08

26 Apr '08

Hello!I add a new eap type and I konw that there is a session key that needs to be sent to the client through the AP.Do you know how to generate the key?Where should I add the code,in the rlm_eap.c or rlm_eap_XXX?Thank you! Xiningtom_1986

3 4

Deny/Allow access between clients
by Julian Stöver 26 Apr '08

26 Apr '08

Hi, I would like to know if its possible to deny/allow traffic between clients or groups. I've already searched for a solution but I just found out how to limit some ports for a user. Thanks for you help. bye julian

2 1

Have some questions - new to FreeRadius
by thekat 25 Apr '08

25 Apr '08

Greetings all.. Overview Our local network folks have a FirePass VPN to allow external access to an application. We are needing to setup a Radius server to authenticate to the FirePass VPN appliance. Testing. I have FreeRadius 1.1.7 set up on a zone on a Solaris 10 box and have begun testing.. This zone will only do this one task.. (Packages installed from SunFreeware - Blastwave FreeRadius package is 1.01) - Going through the output from /local/sbin/radiusd -X - Tested with radtest test test localhost 0 testing123 One error - Although this might be normal Output Sending Access-Request of id 169 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=169, length=20 --------------- I am also reading the entire radiusd.conf file to get familiar with the settings. Per the FAQ it *looks* like I need to use CHAP for authentication but have currently not gotten any farther than that. Sent an email to F5 (makers of FirePass) requesting information as to what protocol the "Radius" setting is expecting.. If anyone has any input if this combination will work,

3 8

Re: Start at boot Freeradius
by Gustavo Chavelas 25 Apr '08

25 Apr '08

Yes, radiusd its in /etc/init.d -----Mensaje original----- De: freeradius-users-bounces+gchavelas=bfmx.com.mx(a)lists.freeradius.org [mailto:freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org] En nombre de freeradius-users-request(a)lists.freeradius.org Enviado el: Viernes, 25 de Abril de 2008 11:57 a.m. Para: freeradius-users(a)lists.freeradius.org Asunto: Freeradius-Users Digest, Vol 36, Issue 161 Message: 2 Date: Fri, 25 Apr 2008 16:27:34 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Start at boot Freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080425152734.GA4491(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > When I try to add my FR at BOOT from my Linux with chkconfig, it's sends and > follow error: > # service radiusd does not support chkconfig have you put the radiusd init script into eg /etc/init.d/ ? alan

2 1

Radius-based windows authentication
by Mike Perdide 25 Apr '08

25 Apr '08

Hello, I'm working on VLAN assignement with FreeRadius, with windows XP users. The FreeRadius server is using openLdap, and works overs EAP-TTLS. The goal of my work is for the users to be on different Vlans depending on their status. The radius part is working fine, since the switch sets the right vlan when the user gives his login and password. My question was : is it possible to authenticate via radius at the windows login screen ? For now, it is using the samba database, but if I want to set up a dynamic vlan assignement, the network needs to be up before the samba partitions are mounted. Thanks !

4 7

Start at boot Freeradius
by Gustavo Chavelas 25 Apr '08

25 Apr '08

Hello again to all. I'm very happy why my FR it's working fine again and I have Vista support too. Thank a lot of Alan Dekok, I was installed the 1.7 version. Later I will try to upgrade, but at this moment it's all. FR is the best. Now, mmmm, I have maybe a fool question but I need help again. When I try to add my FR at BOOT from my Linux with chkconfig, it's sends and follow error: # service radiusd does not support chkconfig If I run manually # radiusd <- alone or with -X -A, etc it work fine. How can I to add FR at boot? Thanks for your answers to all. Gustavo.

3 2

Accounting logs
by Sergio Belkin 25 Apr '08

25 Apr '08

I see any detail-%Y%m%d log files but only auth-detail-%Y%m%d files. What am I doing wrong? My config files: radiusd.conf: prefix = /usr/local-2.0.2 exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = 190.125.213.5 port = 0 } listen { ipaddr = 190.125.213.5 port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 190 reject_delay = 1 status_server = yes } proxy_requests = no $INCLUDE proxy.conf $INCLUDE clients.conf snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { radwtmp = ${logdir}/radwtmp } $INCLUDE eap.conf mschap { } ldap { server = "ldap.cadorna.biz identity = "cn=freeradius,ou=applications,dc=cadorna,dc=biz" port = 636 password = jejeje0essoleplop basedn = "ou=people,dc=cadorna,dc=biz" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile = /etc/raddb-2.0.2/cacert.pem randfile = /dev/urandom require_cert = "allow" } access_attr = "radiusAllowed" dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } realm IPASS { format = prefix delimiter = "/" } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" } realm ntdomain { format = prefix delimiter = "\\" } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" suppress { User-Password } } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d suppress { User-Password } } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter attr_filter.post-proxy { attrsfile = ${confdir}/attrs } attr_filter attr_filter.pre-proxy { attrsfile = ${confdir}/attrs.pre-proxy } attr_filter attr_filter.access_reject { key = %{User-Name} attrsfile = ${confdir}/attrs.access_reject } attr_filter attr_filter.accounting_response { key = %{User-Name} attrsfile = ${confdir}/attrs.accounting_response } counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } $INCLUDE sql/mysql/counter.conf always fail { rcode = fail } always reject { rcode = reject } always noop { rcode = noop } always handled { rcode = handled } always updated { rcode = updated } always notfound { rcode = notfound } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } expiration { reply-message = "Password Has Expired\r\n" } logintime { reply-message = "You are calling outside your allowed timespan\r\n" minimum-timeout = 60 } exec { wait = yes input_pairs = request shell_escape = yes output = none } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } policy { filename = ${confdir}/policy.txt } } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ EOF acct_users: DEFAULT Ldap-UserDN = `uid=%{User-Name},ou=people,dc=cadorna,dc=biz` EOF sites-enabled/default: authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } EOF thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 2

RE: MAC Authentication and
by Ivan Kalik 25 Apr '08

25 Apr '08

>Another interesting point is: do I right understand that I need to restart >freeradius every time when I correct users file? Is is complicated for me, >what is other way? Maybe store MAC's in LDAP or SQL database? > >Alexey > Yes, if you store details in users file you will need to restart for new entries to take effect. If you store them in sql or ldap you can manage them independantly of freeradius. Ivan Kalik Kalik Informatika ISP

1 0