- Freeradius-Users - lists.freeradius.org

[how] installing
by Martin Budi 23 Apr '07

23 Apr '07

any body can help me how to install and configure RADIUS on CentOS thanks before

2 1

suggestions for multiple vlans in hundreds of switches
by Matt Ashfield 22 Apr '07

22 Apr '07

Hi, We'd like to use FR to assign users on our wired network to one of 30 different vlans on campus, based on an LDAP field. Currently, we are doing this with huntgroups. Namely, we create a huntgroup for the NAS (in our case, a network switch), and then in the users file, we put the following: DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == staff User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=176, Tunnel-Type=VLAN, Fall-Through = no DEFAULT Huntgroup-Name == mySWITCH1, Ldap-Group == student User-Name=`%{User-Name}`, Tunnel-Private-Group-Id=177, Tunnel-Type=VLAN, Fall-Through = no And so on...for other groups of user like faculty, admin, etc.. This seems to work. The issue is scale. I have would conceivably have to have a huntgroup definition in the huntgroups file for each NAS. And if I wanted 30 vlans, I'd have to have 30 definitions like the ones above in my users file for EACH one of my NAS's. I'm sure there's a simpler way of doing things that I'm missing. Any advice is appreciated. Thanks Matt mda(a)unb.ca

8 20

Size Limitations on clients.conf
by Alexander Papenburg 22 Apr '07

22 Apr '07

Hi, iam just wondering if there are any "size" limitations on the clients.conf file. Background is: The current file consist of many /24 net-ranges and is currently 22k big ;) For the past days I recognised some strange activities but unfortunately only saw the following in the log: ..... Auth: Login incorrect (Home Server says so): [aaliyah] (from client INET-X.X.X.X/16 port 2 cli A.B.C.D) ..... Obviously A.B.C.D tries a Word-List-Attack on one device in the range but I can't figure out on which one without going into debugging mode. So I hacked a quick and dirty perl script which generate a clients.conf with single ip's which is about 17M big ^^ Is there a better way? Thanks, Alex

3 3

Blocking Interim-Update Accounting-Requests
by Jakob Hirsch 22 Apr '07

22 Apr '07

Hi, is it possible to filter out accounting requests with an Acct-Status-Type of Interim-Update? rlm_attr_filter works obviously only when we are a proxy, and rlm_files with this acct_users changed nothing: DEFAULT Acct-Status-Type == Interim-Update, Auth-Type := Reject DEFAULT Acct-Status-Type == Start, Auth-Type := Accept DEFAULT Acct-Status-Type == Stop, Auth-Type := Accept I guess it's just not possible to handle acct-requests that way... Anybody with an idea? Otherwise I'll have to add that to our logging module. TIA.

2 2

dictionary question
by Jackson Jerry-NPC637 21 Apr '07

21 Apr '07

I'm a freeradius newbie so bear with me. Two questions/issues: 1. I've installed version 1.1.6, but have some dictionary files that are/were setup for Freeradius 1.1.3. I've seen from the README/faq that the dictionary files have changed post 1.1.3 & am wondering what I need to do/change to incooperate my 1.1.3 dictionary files to work with Freeradius 1.1.6? It looks like most of the 1.1.3 dict. files are duplicated in 1.1.6, but notice I have a couple (company specific) dictionary files that I need to use with freeradius 1.1.6? 2. Probably not a big deal (just curious), but was wondering what exactly changed with the dictionary files between freeradius 1.1.3 & 1.1.6. I see an error like "values can only be Interger types", but am not sure what this means. Hopefully this is just a quick/short answer. Thanks, Jerry

2 1

restricting users access to clients?
by Matt Ashfield 20 Apr '07

20 Apr '07

Hi, We're using FreeRadius to authenticating our wireless users (who's credentials are stored in LDAP). But we'd also like to use it to authenticate a select few users who need access to our networking gear. Our networking gear is setup to do this, but I'm not sure how to set this up in FreeRadius. I would assume that you'd specify in the clients.conf section which users are allowed access to that device, but in looking at the documentation for clients.conf, that doesn't seem to be the case. Any links/advice is appreciated. Thanks Matt mda(a)unb.ca

3 5

How to use FreeRADIUS proxy to set an attribute value only if not provided by end RADIUS server ?
by John Butala 20 Apr '07

20 Apr '07

We would like to use FreeRADIUS (acting as a proxy server) to set the Primary-DNS-Server and Secondary-DNS-server attributes in the auth response to the RADIUS client only if these attributes are not provied by the end RADIUS server (which we don't control). Is there anyway to do this without making a FreeRADIUS source code change ? Thanks much, John Butala Senior Staff Engineer Qwest

2 1

rlm_sql: %{sql:<long query>} - length limit
by Milan Holub 20 Apr '07

20 Apr '07

Hi Alan and others, using cvs head from yesterday... I have some query in radgroupcheck for some custom attribute defined in dictionary: dictionary: # test_query ATTRIBUTE test_query 3014 string select * from radgroupcheck where id=67; +----+-----------+------------+----+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------+----+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 67 | hotzone | test_query | := | `%{sql:select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='%{NAS-IP-Address}' and nas.ports='%{NAS-Port}') or nasid is null) and batchid=(select batchid from card where username='%{SQL-User-Name}') and charge_planid=charge_plan.id and zoneid=zone.id order by nasid desc limit 1}` | +----+-----------+------------+----+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ I wanted to use the value of test_query attribute later in rlm_perl module(as I do it for my other attributes configured from DB). My approach is to fetch all neccesary data into "custom" attributes and in rlm_perl I'm doing just simple "decissions" based on custom attributes. I do not want to connect from within perl to database to fetch those values(new DB connections, using other perl modules, performance hit...) My problem: - it looks like Value field in radgroupcheck is limited by 253 characters ==> I did: mysql> alter table radgroupcheck modify column Value varchar(1024); but still the possible length of string to be xlated is limited by MAX_STRING_LEN rather than by MAX_QUERY_LEN... rlm_sql (sql): User found in group hotzone radius_xlat: 'SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'hotzone' ORDER BY id' radius_xlat: Running registered xlat function of module sql for string 'select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='%{NAS-IP-Address}' and nas.ports='%{NAS-Port}') or nasid is null) and batchid=(sel' rlm_sql (sql): - sql_xlat radius_xlat: 'pexcmp' rlm_sql (sql): sql_set_user escaped user --> 'pexcmp' radius_xlat: 'select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='193.247.122.178' and nas.ports='5280') or nasid is null) and batchid=(sel' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): database query error, select charge, charge_plan.name as 'charge_plan', zone.name as zone from charge_plan, zone, zone_definition where (nasid=(select nas.id from nas where nas.nasname='193.247.122.178' and nas.ports='5280') or nasid is null) and batchid=(sel: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 rlm_sql (sql): Released sql socket id: 2 I did not test yet but I think the string length limit is common for all %{sql:} dynamic strings(not only for those in [rad|group][check|reply] tables.). Is there a way how to specify more complex(longer) sql queries in freeradius configuration? Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

RE: Grouping after Kerberos 5 authentication accepted?
by Jason Chan 20 Apr '07

20 Apr '07

Thank you Alan. I read the documentations and now I'm able to use Kerberos and MySQL along with FreeRadius. Thank you for your help. However, I'm stuck in the last part of the project which is to reply the accept request along with assigned attributes. For example, Kerberos successfully authenticate admin/admin (yes I don't use MySQL for authentication), and FreeRadius knows this user has permission to access. Now, in the postauth part, FreeRadius searches the radreply table in its MySQL database for the proper attributes that this particular user has, say Service-Type = Administrative-User. I store these attribute information in radreply table and leave other tables empty. So, I edited the postauth_query in sql.conf: postauth_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" I can't get the 'Service-Type = Administrative-User' in the accept-reply package. Am I missing something here? Any help would be appreciated. Regards, Jason -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Thursday, April 19, 2007 10:27 AM To: jchan2(a)utm.utoronto.ca Subject: Re: Grouping after Kerberos 5 authentication accepted? Jason Chan wrote: > You are correct, the grouping isn't come from Kerberos. I'm going to > build a mysql database in the FreeRadius server to handle all the > grouping/permissions. What fields do I need for the database? I > searched on the FreeRadius website and I can't find any information > related to SQL See the "doc" directory. There are schemas and examples. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.446 / Virus Database: 269.5.4/768 - Release Date: 4/19/2007 5:32 AM

2 2

rlm_perl: perl 5.6 & segmentation fault when reloaded
by Milan Holub 20 Apr '07

20 Apr '07

Hi all, I'm using cvs head on debian woody(historical reasons). I'm using rlm_perl module with perl 5.6: `dpkg -l '*perl*'` ... ii libperl-dev 5.6.1-8.9 ii libperl5.6 5.6.1-8.9 ii libsnmp-perl 4.2.3-2 ... This version of perl is without ithreads and does not support multiplicity. I experienced following behaviour when sending HUP to radius process: Program received signal SIGSEGV, Segmentation fault. 0x404525dd in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.6 (gdb) bt #0 0x404525dd in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.6 #1 0x4044d347 in perl_get_cv () from /usr/lib/libperl.so.5.6 #2 0x4044d4b6 in perl_call_pv () from /usr/lib/libperl.so.5.6 #3 0x4042a030 in _init () from /usr/lib/freeradius/rlm_perl-2.0.0-pre0.so #4 0x08055e12 in free_mainconfig () #5 0x0804eec5 in cf_pair_free () #6 0x0804f1fc in cf_section_free () #7 0x0804f21b in cf_section_free () #8 0x0804f21b in cf_section_free () #9 0x080558c4 in read_mainconfig () #10 0x08058ee2 in main () #11 0x4024714f in __libc_start_main () from /lib/libc.so.6 Problem was localized to detach section of perl module and here is a dummy patch(do not call custom detach function as I do not need it...) Index: src/modules/rlm_perl/rlm_perl.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_perl/rlm_perl.c,v retrieving revision 1.51 diff -u -r1.51 rlm_perl.c --- src/modules/rlm_perl/rlm_perl.c 17 Apr 2007 16:08:00 -0000 1.51 +++ src/modules/rlm_perl/rlm_perl.c 19 Apr 2007 07:47:51 -0000 @@ -1258,6 +1258,7 @@ { dTHXa(inst->perl); #endif /* USE_ITHREADS */ +#if 0 PERL_SET_CONTEXT(inst->perl); { dSP; ENTER; SAVETMPS; @@ -1276,6 +1277,7 @@ FREETMPS; LEAVE; } +#endif #ifdef USE_ITHREADS } #endif Hope this can help someone... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2