- Freeradius-Users - lists.freeradius.org

RE: How to triger an application after a authentication done
by Josh Howlett 26 Oct '07

26 Oct '07

rlm_exec See radiusd.conf for examples. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of ram > Sent: 26 October 2007 07:50 > To: FreeRadius users mailing list > Subject: How to triger an application after a authentication done > > Hi > > iam trying to make some iptables rules to trigger after > authentication done with Radius Server > > here is my setup > > user--------BRAS------Freeradius---Gateway > Router(Linux+iptables)--Internet > > when the user intiate pppoe with BRAS, bras send the request to Radius > > Radius checks the authentication and send to the user for the > authorisation. > when use authenticated and authorised. and same time i want > to trigger the script to open a Iptable rules and his > bandwidth with TC > > can some one give me suggestion > > how can i achieve this ? > > ram > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

1 0

Stripping Username (EAP-TLS)
by s3b0＠gmx.de 26 Oct '07

26 Oct '07

Hi everyone, i am using Freeradius 1.1.7 on Suse Linux Enterprise 10. I try to authenticate user with EAP-TLS. Everything worked fine, until i activated the check of cert_cn. eap.conf: ------------------- # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # check_cert_cn = %{User-Name} ------------------- The problem is, that the username looks like "host/cl00006" but the cn is "cl00006". How can i strip the username? Thanks for your help. Kind regards Sebastian -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

2 1

rlm_sqlcounter and user realms
by Carlos A. Carnero Delgado 26 Oct '07

26 Oct '07

Hello, I'm trying to set rlm_sqlcounter up so that I can check for a monthly use quota. Everything works, except the checks. The NAS present the user names with a realm, which I'm processing (thus, user@realm becomes user.) Using SQL for accounting and such is working marvelous. Now, when I configured/activated rlm_sqlcounter as per the instructions at http://wiki.freeradius.org/Rlm_sqlcounter it will not work because the SQL checks are using the pre-processed user name: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}' will use 'user@realm' instead of just 'user'. My question is, how can I modify this query definition (and the others from sqlcounter.conf) so that they really check against the stripped user name. Thanks a lot, Carlos. -- <nick> grah windows just crashed again, unstable crap. <yukito> Windows isn't unstable, it's just spontaneous.

2 1

Re: Access-Reject in a php script
by manIP 25 Oct '07

25 Oct '07

Hi, I have put exit(2) but as Patric said, freeradius thinks that the script failed and does not respond to the access-request. In the client side, there is a server time out...I don't know if that server time out is assumed as an Access-Reject? May be the problem comes from PHP and I could use the UNIX system() function send back the code 2. Please, if you have a better solution, I would be very grateful! Cheers. Khalid Alan DeKok wrote: > > Patric wrote: > >> But when you exit(2) in PHP, freeradius thinks that the script failed > >> and does not respond to the access-request... > > > > It delays the Access-Reject. See the debug output. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > Ah is that what happens! That delay was causing the access requests time > out, and it appeared from the NAS point of view that it was getting no > response... > > Thanks Alan > > -- > > Q: I want to be a sysadmin. What should I do? > > A: Seek professional help. > > ---------------------------------------------------------------------- > Finally - A spam blocker that actually works. > http://www.bluebottle.com/tag/4 >

3 2

Sqlippool & debian - sql_get_socket unresolved symbol
by Francesco Cristofori 25 Oct '07

25 Oct '07

Hi all, I know the topic has been discussed about a year ago, but I'd like to know if it's going to be solved. I know that Alan said it's not a FR issue (http://lists.cistron.nl/pipermail/freeradius-users/2006-October/057588. html), but many people says that turning on RTLD_GLOBAL is a security weakness, so perhaps it's overall good to fix the code to make it work even with RTLD_GLOBAL turned off. What do you think? Regards, Francesco.

2 1

Are SHA-256 certificates supported?
by hannu.lammi＠wipsl.com 25 Oct '07

25 Oct '07

Hi, I need to set up a RADIUS server that accepts certificates which use SHA-256 as signature algorithm (OID sha256WithRSAEncryption). I have set up a FreeRADIUS 2.0.0-pre2 server to see if this would work out of the box. After verifying that EAP-TLS authentication works with SHA-1 certificates I switched to SHA-256 certificate that was created with OpenSSL 0.9.8b, the same that FreeRADIUS was compiled against. Here's a snippet of the log I got from my SHA-256 test: ===== --> verify error:num=7:certificate signature failure rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm ===== It would seem there's a problem somewhere. It may very well be in the client I'm using. So, I'd like to know if FreeRADIUS supports SHA-256 certificates? If it doesn't, is the support for them planned? thanks in advance, - Hannu

2 4

FR-2.0.0-pre2 - doubled sql accounting
by Tomasz Zieleniewski 25 Oct '07

25 Oct '07

Hi, I have the home_server configuration which points to my localhost. So the scenario is the following that when I receive the Accounting-Request with the user name of the form user@domain I check the realm for particular domain and strip the user name and proxy it again to my home_server localhost - partcular realm have the pool which points to the localhost home_server Problem is that there each accounting request is accounted twice. First time when request gets to freeradius and second after it enters again after proxing it through home_server pool. What can I do about it. How can I disable such behavior?? I know that I can do it by setting particular as local without specifying the acctpool - but i still would like to use the pool. Can I somehow disable the first or the second accounting, what is the right way to do it?? Thank you for any help Regards Tomasz

2 1

Access-Reject in a php script
by manIP 25 Oct '07

25 Oct '07

Hi all! I am using a script for the authentication and it is working well. I can send a list of attributes without any problem. Now I want to send an "Access-Reject" if the authentication fails but I do not know how...I would be very grateful if someone could tell me how to do so. herein is a test script: #!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo "Session-Timeout:=100"; else echo "Access-Reject"; //NOT WORKING!!!!!! ?> Thanks a lot for your assistance Khalid :)

4 5

Number of requests for Free radius
by Anoop 25 Oct '07

25 Oct '07

Hi I am using free radisu 1.1.7 and eap tls authentication.I would like to know the maximum number of users/ authentication requests that it can handle? Regards Anoop -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Thursday, October 25, 2007 11:02 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 30, Issue 91 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Access-Reject in a php script (manIP) 2. FR-2.0.0-pre2 - virtual server configuration problem - how to use client and listen (Tomasz Zieleniewski) 3. Re: Access-Reject in a php script (Alan DeKok) 4. FR-2.0.0-pre2 - doubled sql accounting (Tomasz Zieleniewski) 5. Re: FR-2.0.0-pre2 - virtual server configuration problem - how to use client and listen (Alan DeKok) 6. Re: Access-Reject in a php script (A.L.M.Buxey(a)lboro.ac.uk) 7. Re: AW: AW: Newbie Question o.O (Sebastian Wild) 8. Re: AW: AW: Newbie Question o.O (Andy Billington) 9. Fw: FreeRadius Server: Installation problem (j v) ---------------------------------------------------------------------- Message: 1 Date: Wed, 24 Oct 2007 17:34:09 +0200 From: manIP <manvoip(a)gmail.com> Subject: Access-Reject in a php script To: freeradius-users(a)lists.freeradius.org Message-ID: <f90cb76b0710240834t4b984356s3ce45d2ec2677692(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi all! I am using a script for the authentication and it is working well. I can send a list of attributes without any problem. Now I want to send an "Access-Reject" if the authentication fails but I do not know how...I would be very grateful if someone could tell me how to do so. herein is a test script: #!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo "Session-Timeout:=100"; else echo "Access-Reject"; //NOT WORKING!!!!!! ?> Thanks a lot for your assistance Khalid :)

2 1

Fw: FreeRadius Server: Installation problem
by j v 25 Oct '07

25 Oct '07

Please guide from where to get these tools libtool is needed by freeradius-1.1.6-0.i586 libtool-ltdl-devel is needed by freeradius-1.1.6-0.i586 ----- Forwarded Message ---- From: j v <mr_developer_india(a)yahoo.co.in> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, 24 October, 2007 11:16:47 AM Subject: FreeRadius Server: Installation problem Hey all, > > I am trying to install 1.1.6. When i try to make the SUSE Linux Package > and run the rpm build command then an error message comes which reads: > freeRadius 1.1.5.gz file not present. > > Please guide. > > Now you can chat without downloading messenger. Click here to know how. -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Chat on a cool, new interface. No download required. Go to http://in.messenger.yahoo.com/webmessengerpromo.php - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0