- Freeradius-Users - lists.freeradius.org

Nas Type
by Roberto Greiner 03 Aug '07

03 Aug '07

Hi, I was starting to look at checkrad, and found (based on http://www.freeradius.org/radiusd/doc/Simultaneous-Use) that using "other" as the NAS-type will actually check only radutmp instead of looking at the actual NAS. Now, Could someone point me what would be the proper NAS type to use for each of the devices below(or the proper reference document to use)? I'm using the following NASes in my network: Monowall pfSense (3Com) Total Control PopTop (in Linux) What I want to do is to use checkrad as one of the steps to make sure that whoever appears as logged is really logged in, because I'm trying to use Simultaneous-use check, and some of the above (notably monowall) doesn't seem to be clearing properly sometimes. Thank you very much, Roberto Greiner -- ----------------------------------------------------- Marcos Roberto Greiner The optimists believe we are in the best of worlds The pessimists are afraid that this is true Murphy -----------------------------------------------------

4 7

Re : Linux RADIUS and Active Directory
by Eshun Benjamin 03 Aug '07

03 Aug '07

http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : inelec communication <inelec_communication(a)yahoo.fr> À : freeradius-users(a)lists.freeradius.org Envoyé le : Jeudi, 2 Août 2007, 13h34mn 03s Objet : Linux RADIUS and Active Directory I am trying to setup a Fedora Linux server to authenticate wireless users. I would like to use my AD server to get user information and use the RADIUS just for authentication on the wireless part of our network. Any suggestions or any documment that guide me to do that? best regards Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Help: How to set VLAN by Tunnel-Private-Group-Id for user or group?
by Hangjun He 03 Aug '07

03 Aug '07

Hi, We use peap + AP + fr + AD to authenticate user. Now It can work. But I need to get VLAN from freeradius for different user or group. How should I do?? Please give me some advice, Thanks. I saw below debug info from maillist, from these info I guess freeradius can set VLAN for user or group. Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1:1645, id=38, length=149 User-Name = "DOMAIN\\testuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-19-AA-2C-8F-03" Calling-Station-Id = "00-08-74-46-2A-A5" EAP-Message = 0x0202001601434f5250524f4f545c7467646f72686531 Message-Authenticator = 0x9bc11b6f6182f53f6428ad12c48d8f10 NAS-Port = 50001 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.1.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: EAP packet type response id 2 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 38 to 192.168.1.1 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "vlanX" EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67c75e29c6b4d8d32c662ce2d154d277 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --------------------------------- 雅虎免费邮箱3.5G容量，20M附件！

2 3

Linux RADIUS and Active Directory
by inelec communication 03 Aug '07

03 Aug '07

I am trying to setup a Fedora Linux server to authenticate wireless users. I would like to use my AD server to get user information and use the RADIUS just for authentication on the wireless part of our network. Any suggestions or any documment that guide me to do that? best regards --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

RE: Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 02 Aug '07

02 Aug '07

Hi Claudiu, Thanks for your response. Thu, 2 Aug 2007 03:10:24 +0300, you wrote: >How does your INSERT look like? >AFAIK, in logs you get something like > h323-remote-address = "h323-remote-address=re.mo.te.ip" >You should use the %{h323-remote-address} variable That is in fact the variable that I am using in my insert and update statements but it still doesn't work. See below: accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctSt artTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType,FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Cisco-NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}','', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{h323-remote-address}', '%{Framed-Protocol}', '%{h323-remote-address}', '0')" It appears twice here because I tried putting it in two different columns. Regards Timothy.

3 2

billing & freeradius
by zahra bahar 02 Aug '07

02 Aug '07

Hi, I want to use freeraidus in billing. what module do this ? how could I do this? Is there any document for using freeradius for billing? thanks --------------------------------- Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search.

3 2

how to change reply message.(Password has expired)
by Marwan Sultan 02 Aug '07

02 Aug '07

Hello All, Im on freeradius Latest, and FreeBSD, ChilliSpot. When an account of my users expires, and he tries to log in again, the HotSpotlogin script will reply with a message says "Password Has Expired" How would I change this to "Account has Expired" I guess its somewhere in freeradius, Please correct me if im wrong. Thank you in advance. Marwan _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

2 1

PEAP, switch, FR and MS-AD as user profile and vlan storage
by Hangjun He 02 Aug '07

02 Aug '07

Hi, I would like to know if I can use FreeRADIUS for: PEAP, switch, FR and MS-Active Directory as user profile and vlan storage If so, can someone please shed some light/pointers ? Any info is highly appreciated. Thank you. --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！

2 2

Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 02 Aug '07

02 Aug '07

Hello, Let me start off by saying I am new to this list and not very accomplished in freeradius administration. I am running a freeradius-1.1.0-19.6 setup to gather VoIP accounting information from a Cisco AS5350 router and insert this information into a mysql-5.0.18-16 database. The OS is SuSE Linux 10.1. I am having trouble populating the MySQL database with a certain attribute 'h323-remote-address'. A tail of the radius logs shows me that this attribute is being received by radius. It however does not appear in the database. I have tried altering the mysql statements in sql.conf to insert the value of this attribute in a field that was previously being populated with something else - to ensure that the sql statement is correct - (of the same type - i.e. varchar(32)) but that field stops being populated after the changes. I have also tried it with a field that was previously not being populated, with no success. The value is supposed to be an IP address. Could someone please help me? Thanks and regards, Timothy

3 2

proxy by Called-Station-ID problem
by Brian 01 Aug '07

01 Aug '07

I've got proxy working based on Called-Station-ID by adding the following to the users file: DEFAULT Called-Station-Id == "1234567890", Proxy-To-Realm := "somerealm.com" Fall-Through = No and in the proxy.conf: realm somerealm.com { type = radius authhost = 1.2.3.4:1645 accthost = 1.2.3.4:1646 secret = SeCrEtPaSsWoRd ldflag = round_robin } This works, the user dials in with just a username and password, it gets proxied off to the remote radius server who doesn't want to see the realm. All is good. The problem is that in my radacct table (and in the detail files) I'm not getting the realm unless the user is using user@realm in their log in. Any help would be greatly appreciated. Running Freeradius 1.1.6 -- Brian <brian(a)lonestarsupport.com>

1 0