- Freeradius-Users - lists.freeradius.org

limited hours per user
by hadi golestani 26 Oct '07

26 Oct '07

Hi, I'm using freeRadius with poptop and it's logging all accounting issues well, but how can I add some rules to restrict people , e.g. how to restrict a group of users to only connect 2 hours per day? tnx

2 1

Re: Access-Reject in a php script
by manIP 26 Oct '07

26 Oct '07

Hi all, Thanks again! I've tried to put return(2) and it does not work because my client receives an Access-Accept. If I let exit(2), the server does not send anything so the client fall in time out. The user will not have access but he will make many attempts as long as he does not receive an Access-Reject packet. Furthermore, he needs to know what is going on... BTW, I'm using the "NTRadPing Test Utility" client. hereunder is the output debug: Module: Instantiated realm (suffix) exec: wait = yes exec: program = "/home/authentication.php" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "Access-Request" Module: Instantiated exec (myauth) Module: Instantiated files (files) exec: wait = yes exec: program = "/home/accounting.php" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "Accounting-Request" Module: Instantiated exec (myacct) rad_recv: Access-Request packet from host x.x.x.x:2658, id=49, length=58 User-Name = "xxx" User-Password = "xxx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "xxx" for User-Name = "xxx" rlm_realm: No such realm "xxxx" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 Exec-Program output: Exec-Program: returned: 2 rlm_exec (myauth): External script failed modcall[authorize]: module "myauth" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host xxxxx, id=49, length=58 Discarding duplicate request from client xxxx - ID: 49 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 49 with timestamp 4721d900 Nothing to do. Sleeping until we see a request. Thank you very much anyway! Patric wrote: > > Something just occurred to me that I dont think I tried before. > > What happens if instead of doing an > > > > exit(2); > > > > you do a > > > > return(2); > > > > This way your script will still exit clean, so freeradius wont pick it > > up as a script failure, but hopefully will still get the result? > > No. If the script succeeds, the output is either a text message, or > RADIUS attributes that go into an Access-Accept. > > If the script fails, the server sends an Access-Reject. > > Stop playing games with PHP and post the output of "radiusd -X". I'll > bet money that the solution is right there in the debug output. > > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 30, Issue 97 > ************************************************ >

2 1

How to triger an application after a authentication done
by ram 26 Oct '07

26 Oct '07

Hi iam trying to make some iptables rules to trigger after authentication done with Radius Server here is my setup user--------BRAS------Freeradius---Gateway Router(Linux+iptables)--Internet when the user intiate pppoe with BRAS, bras send the request to Radius Radius checks the authentication and send to the user for the authorisation. when use authenticated and authorised. and same time i want to trigger the script to open a Iptable rules and his bandwidth with TC can some one give me suggestion how can i achieve this ? ram

2 2

Re: Access-Reject in a php script (manIP)
by Sean Bracken 26 Oct '07

26 Oct '07

Hi, I have a working PHP script that may help. You can load it from http://swarmhotspots.com/bb.php.txt The sript is designed to reply to Chillispot authentication requests but should be easy to modify for other NAS's. Hope it helps. Regards, Sean Bracken http://swarmhotspots.com

1 0

Re: Access-Reject in a php script
by manIP 26 Oct '07

26 Oct '07

Hi everyone! Thank your for your answers... Alan, Patric has totally right. I've set the reject_delay to "0" and the result was the same. I really don't want to touch to the source code and I am sure we can find another way 1) if there is a server timeout, is it assumed as an Access-reject (or does the user will be given access ?) 2) for instance, executing a script from another language which exit 2 from PHP...I tried it with a sh script and it does not work 3) If I reply with a Session-Timeout := 0...may be it will be the same effect (I know it is not clean but I have no other choice 4) If the previous solutions do not work, I will probably have to change the code...so Patric, I think the name of the file has changed: it is rlm_exec.c instead of exec.c. Also, After compiling it, could you give some hints to uninstall the previous version and to install the new version properly. Thank you for your comprehension. Khalid ps:Sorry, I sent that email twice but the "Subject" of the previous one was wrong. > manIP wrote: > > Hi, > > > > I have put exit(2) but as Patric said, freeradius thinks that the script > > failed and does not respond to the access-request. In the client side, > > there is a server time out...I don't know if that server time out is > > assumed as an Access-Reject? > > No it does not assume an access-reject - it registers it as no response, > which is undesirable. > > As Alan said : "It delays the Access-Reject. See the debug output." > I tried setting "reject_delay = 0" in the radius.conf but that did not > help. > > > May be the problem comes from PHP and I could use the UNIX system() > > function send back the code 2. > > I believe that this specific scenario only occurs with PHP as I said > before, because of the way it sends its status codes (in the exit call). > I don't know how else to do it, which is why I changed the code for my > use... > > -- > > Q: I want to be a sysadmin. What should I do? > > A: Seek professional help. > >

3 5

Cisco NAS Password problem
by John Morris 26 Oct '07

26 Oct '07

Hello: I am new to using Freeradius, and I am using Freeradius 1.1.6 that comes with Ubuntu Server 7.10 I have set up Freeradius with MySQL as the backend database. I set up one of my Cisco 3550 switches to use Radius as the login method. This worked fine, authentication was running through freeradius. All of my Cisco switches are running the same IOS version, and all configured similarly (only port information is different). I then added a second switch to the freeradius client configuration (nas table), and encountered a problem. The password was being rejected. So I ran Freeradius -X so I could see what was going on. On the good password attempt (first switch added) I see something like this: rad_recv: Access-Request packet from host 192.168.x.x:1645, id=9, length=80 NAS-IP-Address = 192.168.x.x NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "username" Calling-Station-Id = "192.168.x.y" User-Password = "decodedpassword" On the failed password attempt (second and now third switch in the list) I see something like this: rad_recv: Access-Request packet from host 192.168.x.z:1645, id=1, length=80 NAS-IP-Address = 192.168.x.z NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "username" Calling-Station-Id = "192.168.x.y" User-Password = "r\306\324\333M\014\247\022\363\216K\257`\315#]" The password doesnt appear to get decoded before processing of the auth packet occurs. All of the entries in the nas table include the same NAS type. I've gone thru my configs several times, and I'm not sure what I am missing. Does anyone out there have any ideas? Regards John

4 6

Re: Freeradius-Users Digest, Vol 30, Issue 94
by manIP 26 Oct '07

26 Oct '07

Hi everyone! Thank your for your answers... Alan, Patric has totally right. I've set the reject_delay to "0" and the result was the same. I really don't want to touch to the source code and I am sure we can find another way 1) if there is a server timeout, is it assumed as an Access-reject (or does the user will be given access ?) 2) for instance, executing a script from another language which exit 2 from PHP...I tried it with a sh script and it does not work 3) If I reply with a Session-Timeout := 0...may be it will be the same effect (I know it is not clean but I have no other choice 4) If the previous solutions do not work, I will probably have to change the code...so Patric, I think the name of the file has changed: it is rlm_exec.c instead of exec.c. Also, After compiling it, could you give some hints to uninstall the previous version and to install the new version properly. Thank you for your comprehension. Khalid > > Hi, > > > > I have put exit(2) but as Patric said, freeradius thinks that the script > > failed and does not respond to the access-request. In the client side, > > there is a server time out...I don't know if that server time out is > > assumed as an Access-Reject? > > No it does not assume an access-reject - it registers it as no response, > which is undesirable. > > As Alan said : "It delays the Access-Reject. See the debug output." > I tried setting "reject_delay = 0" in the radius.conf but that did not > help. > > > May be the problem comes from PHP and I could use the UNIX system() > > function send back the code 2. > > I believe that this specific scenario only occurs with PHP as I said > before, because of the way it sends its status codes (in the exit call). > I don't know how else to do it, which is why I changed the code for my > use... > > -- > > Q: I want to be a sysadmin. What should I do? > > A: Seek professional help. >

1 0

RE: How to triger an application after a authentication done
by Josh Howlett 26 Oct '07

26 Oct '07

rlm_exec See radiusd.conf for examples. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of ram > Sent: 26 October 2007 07:50 > To: FreeRadius users mailing list > Subject: How to triger an application after a authentication done > > Hi > > iam trying to make some iptables rules to trigger after > authentication done with Radius Server > > here is my setup > > user--------BRAS------Freeradius---Gateway > Router(Linux+iptables)--Internet > > when the user intiate pppoe with BRAS, bras send the request to Radius > > Radius checks the authentication and send to the user for the > authorisation. > when use authenticated and authorised. and same time i want > to trigger the script to open a Iptable rules and his > bandwidth with TC > > can some one give me suggestion > > how can i achieve this ? > > ram > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

1 0

Stripping Username (EAP-TLS)
by s3b0＠gmx.de 26 Oct '07

26 Oct '07

Hi everyone, i am using Freeradius 1.1.7 on Suse Linux Enterprise 10. I try to authenticate user with EAP-TLS. Everything worked fine, until i activated the check of cert_cn. eap.conf: ------------------- # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # check_cert_cn = %{User-Name} ------------------- The problem is, that the username looks like "host/cl00006" but the cn is "cl00006". How can i strip the username? Thanks for your help. Kind regards Sebastian -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

2 1

rlm_sqlcounter and user realms
by Carlos A. Carnero Delgado 26 Oct '07

26 Oct '07

Hello, I'm trying to set rlm_sqlcounter up so that I can check for a monthly use quota. Everything works, except the checks. The NAS present the user names with a realm, which I'm processing (thus, user@realm becomes user.) Using SQL for accounting and such is working marvelous. Now, when I configured/activated rlm_sqlcounter as per the instructions at http://wiki.freeradius.org/Rlm_sqlcounter it will not work because the SQL checks are using the pre-processed user name: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}' will use 'user@realm' instead of just 'user'. My question is, how can I modify this query definition (and the others from sqlcounter.conf) so that they really check against the stripped user name. Thanks a lot, Carlos. -- <nick> grah windows just crashed again, unstable crap. <yukito> Windows isn't unstable, it's just spontaneous.

2 1