- Freeradius-Users - lists.freeradius.org

Wrong Realm in the detail files
by Rio Yang 09 May '07

09 May '07

Hi, Recently, I found the wrong realm in the detail files. This log is captured from detail file. Tue May 8 17:46:41 2007 Class = 0x417074696c6f313a313a31383030 User-Name = "ABC/950160(a)def.org" Acct-Status-Type = Start Acct-Session-Id = "464046fecc9c08a5" Acct-Delay-Time = 0 Acct-Authentic = RADIUS Framed-IP-Address = <Encrypted> NAS-IP-Address = <Encrypted> NAS-Port-Type = Wireless-802.11 Event-Timestamp = "May 8 2007 17:46:41 CST" NAS-Identifier = "NAS" Vendor-13209-Attr-9 = 0x5157464e484150433037 Called-Station-Id = <Encrypted> Calling-Station-Id = <Encrypted> Vendor-13209-Attr-1 = 0x5177617265507562537461726275636b73 NAS-Port-Id = "NAS-Port" WISPr-Location-ID = <Encrypted> WISPr-Location-Name = <Encrypted> Proxy-State = 0x30 Client-IP-Address = <Encrypted> Acct-Unique-Session-Id = "26719654223287c6" Stripped-User-Name = "ABC/950160" Realm = "def.org" Freeradius-Proxied-To = <Encrypted> Timestamp = 1178617601 I configured two realm in proxy.conf. One is realm "ABC" (prefix mode), and another is "def.org" (suffix mode). In my thinking, when request come into radius, prefix will work first then suffix. (configured in radius.conf) In this case, I should have a realm value "ABC" and Stripped-User-Name value "950160(a)def.org". But I got the realm value "def.org" and Stripped-User-Name value "ABC/950160". Is it a bug ? or some configuration I missed. PS. I'm using freeradius-1.1.2. Thanks. Rio

2 2

Access-Accept Packet and Attribute 29
by nicolaskarp＠free.fr 09 May '07

09 May '07

Hello Everybody, I must use the attribute : "29 : Termination-Action" with an access-accept packet. How could I do this ? My Huawei device uses this attribute to allow a user to manage the switch with a specific level. Thank you for your assistance ! Best regards, Nicolas.

2 1

How to use `checkItem' in file `ldap.attrmap'
by wj 09 May '07

09 May '07

What's the meaning of `checkItem'? How to use it?

2 1

Re: eap-tls authentication with free radius 1.1.5
by anoop_c＠sifycorp.com 09 May '07

09 May '07

Quoting freeradius-users-request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body \'help\' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than \"Re: Contents of Freeradius-Users digest...\" > > > Today\'s Topics: Hi Alan I stil havn\'t get the exact problem.Earlier i was using freeradius-snapshot-20021028 .For eap-tls i made changes in radiusd.conf,clients.conf and users file. With 1.1.5 version i didn;t change radiusd.conf. Pls tell me what are the configuration required in the radiusd.conf,eap.conf,clients.conf and users file. Anoop > > 1. Re: FreeRadius crash (Alan DeKok) > 2. Re: IP billing with freeradius (tnt(a)kalik.co.yu) > 3. Re: IP billing with freeradius (Alexander V. Klepikov) > 4. Re: eap-tls authentication with free radius 1.1.5 (Alan > DeKok) (anoop_c(a)sifycorp.com) > 5. Re: eap-tls authentication with free radius 1.1.5 (Alan > DeKok) (anoop_c(a)sifycorp.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 08 May 2007 09:49:56 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: FreeRadius crash > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <46402BA4.7090805(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Doug Hardie wrote: > > FreeRadius 1.1.2 on FreeBSD 6.1 using libpthread. > > Upgrade to 1.1.6. It has a lot of fixes that may help. > > It looks like it\'s crashing when starting a new child thread. That > may be a pthread issue in the underlying libraries. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 2 > Date: Tue, 08 May 2007 09:38:19 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: IP billing with freeradius > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <CLwKM75d.1178613499.9866420.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > This is nothing to do with radius. Use netflow. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 8/5/2007, \"satish patel\" <linuxtrap(a)yahoo.co.in> pi?e: > > >thnks for reply dear > > > > But my requiremnt is a bit different means i explain u in > depth i have datacenter in data center many customers and we are giving > ip pool to our customer and terminate that pool on 6500 cisco core > switch so i want bandwidth counter on that port wheather all customer > server connected so that i can billing of that perticuler port means how > much upload and how much download traffic of that port then i can > genrate bill of that port it is not possible i can genrate traffic uage > of verey servers so that i want to genrate traffic counter of that > single cisco switch port you got it my point it is possibel through mrtg > but i want counter values so it is possible with freeradius > > > >tnt(a)kalik.co.yu wrote: If you are using sql accounting then make a > sqlcounter that counts octets > >and send Auth-Type Reject if counter is over 10GB. > > > >Ivan Kalik > >Kalik Informatika ISP > > > >Dana 7/5/2007, \"satish patel\" > > pi?e: > > > >>Dear Sir > >> > >> I am working in data center so i need ip base > billing means which ip address useing how much bandwidth means i give 10 > GB data transfer to my one customer and 10GB data transfer reached then > i got mesge or i can block the port of server what ever this is example > so it is possible can i accouting of data transfer through my core > switch ?? > >> > >> > >>Reghards > >> > >>Satish Patel > >> > >> > >>$ cat ~/satish/url.txt > >> > >>System administrator ( Data Center ) > >> > >>please visit this site > >> > >>http://linux.tulipit.com > >> > >>--------------------------------- > >> Office firewalls, cyber cafes, college labs, don\'t allow you to > download CHAT? Here\'s a solution! > >> > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > >$ cat ~/satish/url.txt > > > >System administrator ( Data Center ) > > > >please visit this site > > > >http://linux.tulipit.com > > > >--------------------------------- > > Office firewalls, cyber cafes, college labs, don\'t allow you to > download CHAT? Here\'s a solution! > > > > > > ------------------------------ > > Message: 3 > Date: Tue, 8 May 2007 11:55:01 +0300 > From: \"Alexander V. Klepikov\" <klepikov_a(a)up.ua> > Subject: Re: IP billing with freeradius > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <00db01c7914e$908413c0$0301010a@klepikova> > Content-Type: text/plain; format=flowed; charset=\"iso-8859-2\"; > reply-type=original > > Hello, tnt(a)kalik.co.yu! > You wrote on Tue, 08 May 2007 09:38:19 +0100: > > t> This is nothing to do with radius. Use netflow. > > What about dot1x auth + accounting? Though it may be not so good for > servers. > > With best regards, Alexander V. Klepikov. E-mail: klepikov_a(a)up.ua > > > > ------------------------------ > > Message: 4 > Date: Tue, 08 May 2007 15:27:49 +0600 (IST) > From: anoop_c(a)sifycorp.com > Subject: Re: eap-tls authentication with free radius 1.1.5 (Alan > DeKok) > To: freeradius-users(a)lists.freeradius.org, > freeradius-users-request(a)lists.freeradius.org > Cc: freeradius-users(a)lists.freeradius.org > Message-ID: <1178618269.4640499db1808(a)mail.sifycorp.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi > i didn\'t get the exact problem. I have gone through eap.conf. > Pls make little bit clear abt the problem > > Anoop > > freeradius-users-request(a)lists.freeradius.org: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body \'help\' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than \"Re: Contents of Freeradius-Users digest...\" > > > > > > Today\'s Topics: > > > > 1. Re: MySQL and postauth_query (George Embrey) > > 2. Re: FreeRadius crash (A.L.M.Buxey(a)lboro.ac.uk) > > 3. Re: MySQL and postauth_query (Peter Nixon) > > 4. Re: rlm_sqlippool in freeradius 1.1.6 (Peter Nixon) > > 5. Re: IP billing with freeradius (satish patel) > > 6. Re: IP billing with freeradius (Peter Nixon) > > 7. Re: eap-tls authentication with free radius 1.1.5 (Alan DeKok) > > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 08 May 2007 14:38:39 +1000 > > From: George Embrey <george(a)vmail.net.au> > > Subject: Re: MySQL and postauth_query > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <463FFECF.7080101(a)vmail.net.au> > > Content-Type: text/plain; charset=\"us-ascii\" > > > > Hugh Messenger wrote: > > > > >George Embrey <george(a)vmail.net.au> says: > > > > > > > > >>Queries to Windows MySQL servers from Linux Systems often fail > unless > > >>the lower_case_table_names parameter is set to 0 in the my.ini file > > in > > >>the MySQL directory. > > >> > > >> > > > > > >I\'m familiar with that issue, and I checked all the table case-ness. > > > The > > >problem seems to be with providing an empty string (\'\') as the > value > > for an > > >auto-incrementing integer primary index. > > > > > > > > Yes that is true \'\' or empty strings are not nulls or integers... I > > suggest replacing the \'\' with the word null, this will sort out the > > issue based on the query you specified. > > > > >The problem with setting lower_case_table_names to 0 is that I could > > end up > > >blowing away my MyISAM tables elsewhere in that server, as per the > > warning > > >the service control gives, if I moof a query on those and use the > > \"wrong\" > > >case: > > > > > > > > > > > I would rename the MyISAM tables using phpmyadmin or using SQL and > sort > > out the Database to run case sensitive in the first place like the > ANSI > > standard. > > > > Or much better still mysqldump the entire MySQL server into a file > > \"textfilename.sql\", sort out the table names etc... using a good > text > > editor, place a drop table if exists before each create table entry, > > save the file then run mysql -uroot -p < \"textfilename.sql\" to > recreate > > all of the databases including data with tablenames in the correct > > case... > > > > Maybe I am just too fussy... > > > > >\"You have forced lower_case_table_names to 0 through a command-line > > option, > > >even though your file system \'E:MySQLData\' is case insensitive. > > This > > >means that you can corrupt a MyISAM table by accessing it with > > different > > >cases. You should consider changing lower_case_table_names to 1 or > 2\" > > > > > > > > > > > Only if you live in an all windows world... \"Compatability is a > bitch > > it > > demands the use of standards, the little things which M$ don\'t > adhere > > to > > very well\" ;-) > > > > >It\'s working fine with my modifie query, so I\'m just going to put > this > > down > > >to \"a 5.x thing\" and live with my change. Compared to the > wholesale > > hack > > >and slash job I\'ve had to do on the sqlippool queries to get them > to > > work, > > >it\'s no Big Whoop, LOL! > > > > > >But thanks for the suggestion, I appreciate your time. > > > > > > -- hugh > > > > > >- > > >List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > > > > George Embrey > > CEO / Senior Systems Architect. > > Vmail Internet Services Pty Ltd. > > 318 Shoal Point Road > > Shoal Point QLD 4750 > > Australia > >

2 1

Re: Machine-Authentication against SaMBa account in LDAP Directory
by Christian Hohmann 09 May '07

09 May '07

Hi members, @Joe: I use Version 3.0.22-13 of Samba. But I think the "username" that windows sends for Authentication with host account is controlled by the windows client. There I use a Win XP with SP2. @Phil: Thanks, this solution works great. So I can eliminate the second Request to the radius-Service caused by the Local-realm of the ntdomain "host/". @Jacob: It seems to be a good work around, but it would increase the calls to LDAP directory, so i decided to use Phils suggestion. I solved the problem using the mschap module in the filter line of the LDAP paragraph that Phil suggested. Thanks a lot for your hints, simply great! Best regards - Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

timeouts through a firewall?
by Matt Ashfield 09 May '07

09 May '07

Hi All We are seeing the following error: Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Our radius server talks to our LDAP server through a firewall. I'm wondering if this has to do with the session lifetime setting on the firewall? If there are no authentications taking place (we're in testing mode, and it was at least 2-3 hours between client authentications), then I guess this connection/session could be timed out by the firewall? I just want to know if that makes sense before approaching the firewall guys and asking to increase the timeout. Thanks Matt mda(a)unb.ca

4 3

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 09 May '07

09 May '07

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" identity = "cn=Directory Manager" password = 1223 basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

Machine-Authentication against SaMBa account in LDAP Directory
by Christian Hohmann 09 May '07

09 May '07

Hi members, I have a problem with the name of hosts. Here is the situation: I have an LDAP Directory which is filled by samba-Deamon, for example with hosts that are added to my domain. Samba signs every host-account with a "$" at the end. If my laptop would be named christian, the entry created by SaMBa in LDAP is "christian$" Now I configured host authentication of windows Machines with freeradius. Windows machines are configured to answer with their host account and password. The windows machine christian answeres with the string "host/christian" als Username. I configured realm with proxy to cut away host/. So the current Username is "christian". The username in LDAP is "christian$" and so I added a $ sign in the following line of the radiusd.conf Change the line from : filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" to: filter = "(uid=%{Stripped-User-Name:-%{User-Name}}$)" This adds a $ sign to every User ID at the end. I can do authentication for all Hosts authenticate with their host account. The problem is, that I have no possibility to authenticate with a username that has no $ as last character. This is the case for all users exept host accounts. Do you have a hint for me, how I could add the $ sign at the end of hostnames, but not for "normal users"? Best regards Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

4 3

Re: dyndns.org domain in Clients.conf
by AS Alex 08 May '07

08 May '07

Yes i have enabled hostname_lookups but nothing. For VPN...can be an idea but without vpn it's possibile to realize what i need?? ----- Original Message ----- From: "Milan Holub" <holub(a)thenet.ch> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 04, 2007 11:29 AM Subject: Re: dyndns.org domain in Clients.conf > Hi, > > just a guess: > > Ensure that you have following line radiusd.conf: > hostname_lookups = yes > > Milan Holub > holub (at) thenet (dot) ch > > -------------------------------------- > TheNet-Internet Services AG, > im Bernertechnopark, Morgenstr. 129 > CH-3018, Bern, Switzerland > 031 998 4333, Fax 031 998 4330 > http://www.thenet.ch > http://wlan.thenet.ch > -------------------------------------- > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 6

Proxy.conf regex
by Joseph 08 May '07

08 May '07

Is it possible to use wild card domains in proxy.conf? Or does regex support have to be enabled somewhere or can it be enabled? regards, Joseph

7 13