- Freeradius-Users - lists.freeradius.org

Radius Packet Simulator
by khursheed Ahmed 04 Apr '07

04 Apr '07

Hi All I need a RADIUS Packet simulator, which could simulate RADIUS packet for me, If is there any Plz tell me, As I needed it bcz I m developing a Translation Agent which could translate (convert) RADIS packet in to Diameter Packet. Is there any Idea Plz help me Khursheed Ahmed QAU >From: freeradius-users-request(a)lists.freeradius.org >Reply-To: freeradius-users(a)lists.freeradius.org >To: freeradius-users(a)lists.freeradius.org >Subject: Freeradius-Users Digest, Vol 24, Issue 3 >Date: Mon, 02 Apr 2007 07:59:28 +0200 > >Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > >To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users >or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > >You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Freeradius-Users digest..." > > >Today's Topics: > > 1. Re: Attributes (Shawn Mitchell) > 2. Re: passing Calling-Station-ID (Adil Azmi Bikarbass) > 3. Re: Freeradius-Users Digest, Vol 24, Issue 2 (Arran Cudbard-Bell) > 4. RE: Attributes [unclas] (Ranner, Frank MR) > 5. Re: Attributes [unclas] (Shawn Mitchell) > 6. RE: Anyone using dd-wrt for AP? (Aren Chua) > 7. EAP-AKA patch for Freeradius 1.1.2 (awaneesh kumar) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Sun, 01 Apr 2007 16:45:22 -0500 >From: Shawn Mitchell <shawnm(a)iodamedia.net> >Subject: Re: Attributes >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <461027F2.3020605(a)iodamedia.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Ok, here's what I'm doing: > >DEFAULT Client-IP-Address == xx.xx.xx.xx > Ascend-Data-Filter = "ip in forward tcp est", > Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24", > Ascend-Data-Filter = "ip in drop tcp dstport = 25", > Ascend-Data-Filter = "ip in forward", > Fall-Through = Yes > >I turned on logging of reply's, but all I'm seeing it send is: > >Sun Apr 1 16:31:21 2007 > Ascend-Data-Filter = "ip in forward tcp est" > >I put this into the 'users' file btw. > > > >Alan DeKok wrote: > > Shawn Mitchell wrote: > > > >> Where can I say "If client is 'x', then also send these attributes to > >> users being authenticated..."? > >> > > > > In the "users" file. > > > > DEFAULT Client-IP-Address == 1.2.3.4 > > Reply-Message = "You're coming from 1.2.3.4" > > > > Alan DeKok. > > -- > > http://deployingradius.com - The web site of the book > > http://deployingradius.com/blog/ - The blog > > - > > List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > > > > >------------------------------ > >Message: 2 >Date: Sun, 01 Apr 2007 22:59:14 +0000 >From: Adil Azmi Bikarbass <adil(a)mtds.com> >Subject: Re: passing Calling-Station-ID >To: Alan DeKok <aland(a)deployingradius.com> >Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <46103942.2070008(a)mtds.com> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Hello All, > >Do i need to create a whole DB for only one filed that i will pass from >one NAS to another? > >Knowing that my Freeradius is running on Solaris 10 which DB you suggest >to use? > >Thank you > > >Alan DeKok a ?crit : > > Adil Azmi Bikarbass wrote: > > > >> The issue is that we want the second NAS to get the calling-station-ID > >> from the "someuser" session on Radius > >> > > > > To do... what? > > > > > >> is there a way we can have this to work and pass this attribute from >one > >> session to another? > >> > > > > Sure. Store the Calling-Station-Id in a database when you receive it > > from the first NAS, then pull it out of the DB, and send it to the > > second NAS. > > > > Alan DeKok. > > -- > > http://deployingradius.com - The web site of the book > > http://deployingradius.com/blog/ - The blog > > > > > >-- >|-Adil Bikarbass >|-IT Manager, MTDS >|-tel +212.3.767.4861 >|-fax +212.3.767.4863 >|-gsm +212.6.139. 4541 >|-14, rue 16 novembre >|-Rabat, Kingdom of Morocco > > > >------------------------------ > >Message: 3 >Date: Mon, 02 Apr 2007 00:00:43 +0100 >From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> >Subject: Re: Freeradius-Users Digest, Vol 24, Issue 2 >To: freeradius-users(a)lists.freeradius.org >Message-ID: <4610399B.6010008(a)sussex.ac.uk> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > >> Does anyone have a draft list of which clients actually support the > >> Reply-Message and by which methods they can recieve them? > >> > > > > All clients will accept it. Very few will do anything useful with it. > > > > > >> The reason why I ask , it during initial tests (using chap) the built >in > >> windows CHAP supplicant would display the reply-messages being sent >back > >> from the server. > >> Now we've moved on from CHAP to using EAP and the windows supplicant no > >> longer displays the messages. > >> > > > > Yes. > > > > > >> Am I right in assuming that with EAP attributes from the access-accept > >> packet only get to the NAS and that the NAS will strip out of the EAP > >> message > >> and pass it on to the supplicant and thats all the supplicant will ever >get? > >> > > > > Yes. > > > > > >> In which case, although the Reply-Message attribute is also supported >in > >> PoD the client will never actually recieve it when using EAP ? > >> > > > > Yes. > > > > Alan DeKok. > > >Ahh, Thanks for clearing that up ! > >Don't suppose EAP supports encoding the equivalent of a Reply-Message ? > >P.S Well done for understanding my poorly punctuated morning ramblings :) > >Arran > > > >------------------------------ > >Message: 4 >Date: Mon, 2 Apr 2007 11:14:47 +1000 >From: "Ranner, Frank MR" <Frank.Ranner(a)defence.gov.au> >Subject: RE: Attributes [unclas] >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: > <3497E314EE23D54EACE26B5CFFD896980A6125(a)drnrxm01.drn.mil.au> >Content-Type: text/plain; charset="US-ASCII" > >Use the += operator, eg Ascend-Data-Filter += "ip in forward dstip >xx.xx.xx.0/24", to append to >a multi-valued list. > >FR > > > -----Original Message----- > > From: > > freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.fre > > eradius.org > > [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@l > > ists.freeradius.org] On Behalf Of Shawn Mitchell > > Sent: Monday, 2 April 2007 07:45 > > To: FreeRadius users mailing list > > Subject: Re: Attributes > > > > Ok, here's what I'm doing: > > > > DEFAULT Client-IP-Address == xx.xx.xx.xx > > Ascend-Data-Filter = "ip in forward tcp est", > > Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24", > > Ascend-Data-Filter = "ip in drop tcp dstport = 25", > > Ascend-Data-Filter = "ip in forward", > > Fall-Through = Yes > > > > I turned on logging of reply's, but all I'm seeing it send is: > > > > Sun Apr 1 16:31:21 2007 > > Ascend-Data-Filter = "ip in forward tcp est" > > > > I put this into the 'users' file btw. > > > > > > > > Alan DeKok wrote: > > > Shawn Mitchell wrote: > > > > > >> Where can I say "If client is 'x', then also send these > > attributes to > > >> users being authenticated..."? > > >> > > > > > > In the "users" file. > > > > > > DEFAULT Client-IP-Address == 1.2.3.4 > > > Reply-Message = "You're coming from 1.2.3.4" > > > > > > Alan DeKok. > > > -- > > > http://deployingradius.com - The web site of the book > > > http://deployingradius.com/blog/ - The blog > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > >------------------------------ > >Message: 5 >Date: Sun, 01 Apr 2007 20:44:05 -0500 >From: Shawn Mitchell <shawnm(a)iodamedia.net> >Subject: Re: Attributes [unclas] >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <46105FE5.3090904(a)iodamedia.net> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Thanks! > >That seems to have fixed it > >radtest blarg blarg localhost 111 testing123 > >Sending Access-Request of id 145 to 127.0.0.1:1812 > User-Name = "blarg" > User-Password = "blarg" > NAS-IP-Address = xxxxxxxxxxxxxx > NAS-Port = 111 >rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=145, length=180 > Ascend-Data-Filter = "ip in forward tcp est" > Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24 0" > Ascend-Data-Filter = "ip in drop tcp dstport = 25" > Ascend-Data-Filter = "ip in forward 0" > > >Ranner, Frank MR wrote: > > Use the += operator, eg Ascend-Data-Filter += "ip in forward dstip > > xx.xx.xx.0/24", to append to > > a multi-valued list. > > > > FR > > > > > >> -----Original Message----- > >> From: > >> freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.fre > >> eradius.org > >> [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@l > >> ists.freeradius.org] On Behalf Of Shawn Mitchell > >> Sent: Monday, 2 April 2007 07:45 > >> To: FreeRadius users mailing list > >> Subject: Re: Attributes > >> > >> Ok, here's what I'm doing: > >> > >> DEFAULT Client-IP-Address == xx.xx.xx.xx > >> Ascend-Data-Filter = "ip in forward tcp est", > >> Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24", > >> Ascend-Data-Filter = "ip in drop tcp dstport = 25", > >> Ascend-Data-Filter = "ip in forward", > >> Fall-Through = Yes > >> > >> I turned on logging of reply's, but all I'm seeing it send is: > >> > >> Sun Apr 1 16:31:21 2007 > >> Ascend-Data-Filter = "ip in forward tcp est" > >> > >> I put this into the 'users' file btw. > >> > >> > >> > >> Alan DeKok wrote: > >> > >>> Shawn Mitchell wrote: > >>> > >>> > >>>> Where can I say "If client is 'x', then also send these > >>>> > >> attributes to > >> > >>>> users being authenticated..."? > >>>> > >>>> > >>> In the "users" file. > >>> > >>> DEFAULT Client-IP-Address == 1.2.3.4 > >>> Reply-Message = "You're coming from 1.2.3.4" > >>> > >>> Alan DeKok. > >>> -- > >>> http://deployingradius.com - The web site of the book > >>> http://deployingradius.com/blog/ - The blog > >>> - > >>> List info/subscribe/unsubscribe? See > >>> http://www.freeradius.org/list/users.html > >>> > >>> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > >> > > > > - > > List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > > > > >------------------------------ > >Message: 6 >Date: Mon, 2 Apr 2007 03:03:25 +0000 >From: Aren Chua <cclian18(a)hotmail.com> >Subject: RE: Anyone using dd-wrt for AP? >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <BAY130-W126EC141C8DD048BA432ECCC600(a)phx.gbl> >Content-Type: text/plain; charset="iso-8859-1" > > >Ian Truelsen > >you can try the hotspot(chillispot) under DD-WRT firmware to configure your >AP to authenticate against the radius server. >Regards, >Aren Chua> Date: Sun, 1 Apr 2007 10:16:25 +0200> From: >aland(a)deployingradius.com> To: freeradius-users(a)lists.freeradius.org> >Subject: Re: Anyone using dd-wrt for AP?> > Ian Truelsen wrote:> >> > >Hopefully that is not the case. The freeradius server is on an external> > >machine. I am trying to get the AP to authenticate against that server,> > >but I am having trouble sorting out how to get it to do this.> > There >should be a RADIUS server configuration. But you'll have to> enable 802.1x >authentication, too.> > Alan DeKok.> --> http://deployingradius.com - The >web site of the book> http://deployingradius.com/blog/ - The blog> - > List >info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >_________________________________________________________________ >Your friends are close to you.?Keep them that way. >http://spaces.live.com/signup.aspx >

5 4

LDAP search scope directive?
by Martin Pauly 03 Apr '07

03 Apr '07

Hi, my current problem has already been discussed on this list -- here's a snippet from Nov 2004: "Ron Wahler" <ron(a)rovingplanet.com> asked: > > It seems that one of our customers has a database in which it does > > Have duplicate users names, they were asking the following question: > > > > "Would also like to know how LDAP handles duplicate user names (if the > > baseDN was set to O=ACME instead of OU=Users,O=ACME)" > > > > If the basedn Is at the higher level there may be duplicates. Kostas Kalevras <kkalev(a)noc.ntua.gr> replied: > Do you mean that there may be: > > uid=user,o=acme and uid=user,ou=users,o=acme ? > > If that is the case the solution is simple: > > ldap ldap1{ > basedn = "o=acme" > scope = "one" > } > ldap ldap2{ > basedn = "ou=users,o=acme" > scope = "sub" > } > > authorize{ > ldap1 > ldap2 > } > > authenticate{ > ldap1 > } > > The only problem is that a scope directive does not exist yet. Adding one > will not be hard though if it is needed. If that is what is needed please > open a bug request in bugs.freeradius.org. Due to a reorganization of our LDAP tree, we will need to duplicate our 15.000+ account entries in a new, separate subtree, located below the old one. During migration (which will hopefully run overnight, but certainly take severeal hours), services should be kept running as good as possible. So I'm going to face exactly the situation described above. To make the LDAP search result unique, > ldap ldap1{ > basedn = "o=acme" > scope = "one" would do the job for me. Has such a directive been implemented? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 1

RE: Freeradius-Users Digest, Vol 24, Issue 5
by khursheed Ahmed 03 Apr '07

03 Apr '07

Hi Jan like Radtest, But radtest is used for the test of Radius installation Could it will give me AVPs of Radius so that may I convert them for Diameter packets thnx >From: freeradius-users-request(a)lists.freeradius.org >Reply-To: freeradius-users(a)lists.freeradius.org >To: freeradius-users(a)lists.freeradius.org >Subject: Freeradius-Users Digest, Vol 24, Issue 5 >Date: Mon, 02 Apr 2007 11:15:13 +0200 > >Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > >To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users >or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > >You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Freeradius-Users digest..." > > >Today's Topics: > > 1. Re: Radius Packet Simulator (Jan Mulders) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Mon, 2 Apr 2007 10:15:03 +0100 >From: "Jan Mulders" <lastchancehotel(a)gmail.com> >Subject: Re: Radius Packet Simulator >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: > <2dae841b0704020215v35e5c076y3b4922c3202a24eb(a)mail.gmail.com> >Content-Type: text/plain; charset="iso-8859-1" > >like Radtest, you mean? > >Jan > >On 02/04/07, khursheed Ahmed <khursheedahmedqau(a)hotmail.com> wrote: > > > > > > > > Hi All > > > > I need a RADIUS Packet simulator, which could simulate RADIUS packet > > for > > me, > > If is there any Plz tell me, > > As I needed it bcz I m developing a Translation Agent which could > > translate > > (convert) > > RADIS packet in to Diameter Packet. > > > > Is there any Idea Plz help me > > > > > > Khursheed Ahmed QAU > > > > > > > > > > >From: freeradius-users-request(a)lists.freeradius.org > > >Reply-To: freeradius-users(a)lists.freeradius.org > > >To: freeradius-users(a)lists.freeradius.org > > >Subject: Freeradius-Users Digest, Vol 24, Issue 3 > > >Date: Mon, 02 Apr 2007 07:59:28 +0200 > > > > > >Send Freeradius-Users mailing list submissions to > > > freeradius-users(a)lists.freeradius.org > > > > > >To subscribe or unsubscribe via the World Wide Web, visit > > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > >or, via email, send a message with subject or body 'help' to > > > freeradius-users-request(a)lists.freeradius.org > > > > > >You can reach the person managing the list at > > > freeradius-users-owner(a)lists.freeradius.org > > > > > >When replying, please edit your Subject line so it is more specific > > >than "Re: Contents of Freeradius-Users digest..." > > > > > > > > >Today's Topics: > > > > > > 1. Re: Attributes (Shawn Mitchell) > > > 2. Re: passing Calling-Station-ID (Adil Azmi Bikarbass) > > > 3. Re: Freeradius-Users Digest, Vol 24, Issue 2 (Arran >Cudbard-Bell) > > > 4. RE: Attributes [unclas] (Ranner, Frank MR) > > > 5. Re: Attributes [unclas] (Shawn Mitchell) > > > 6. RE: Anyone using dd-wrt for AP? (Aren Chua) > > > 7. EAP-AKA patch for Freeradius 1.1.2 (awaneesh kumar) > > > > > > > > >---------------------------------------------------------------------- > > > > > >Message: 1 > > >Date: Sun, 01 Apr 2007 16:45:22 -0500 > > >From: Shawn Mitchell <shawnm(a)iodamedia.net> > > >Subject: Re: Attributes > > >To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > >Message-ID: <461027F2.3020605(a)iodamedia.net> > > >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > > >Ok, here's what I'm doing: > > > > > >DEFAULT Client-IP-Address == xx.xx.xx.xx > > > Ascend-Data-Filter = "ip in forward tcp est", > > > Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24", > > > Ascend-Data-Filter = "ip in drop tcp dstport = 25", > > > Ascend-Data-Filter = "ip in forward", > > > Fall-Through = Yes > > > > > >I turned on logging of reply's, but all I'm seeing it send is: > > > > > >Sun Apr 1 16:31:21 2007 > > > Ascend-Data-Filter = "ip in forward tcp est" > > > > > >I put this into the 'users' file btw. > > > > > > > > > > > >Alan DeKok wrote: > > > > Shawn Mitchell wrote: > > > > > > > >> Where can I say "If client is 'x', then also send these attributes >to > > > >> users being authenticated..."? > > > >> > > > > > > > > In the "users" file. > > > > > > > > DEFAULT Client-IP-Address == 1.2.3.4 > > > > Reply-Message = "You're coming from 1.2.3.4" > > > > > > > > Alan DeKok. > > > > -- > > > > http://deployingradius.com - The web site of the book > > > > http://deployingradius.com/blog/ - The blog > > > > - > > > > List info/subscribe/unsubscribe? See > > >http://www.freeradius.org/list/users.html > > > > > > > > > > > > > > > >------------------------------ > > > > > >Message: 2 > > >Date: Sun, 01 Apr 2007 22:59:14 +0000 > > >From: Adil Azmi Bikarbass <adil(a)mtds.com> > > >Subject: Re: passing Calling-Station-ID > > >To: Alan DeKok <aland(a)deployingradius.com> > > >Cc: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > >Message-ID: <46103942.2070008(a)mtds.com> > > >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > > >Hello All, > > > > > >Do i need to create a whole DB for only one filed that i will pass from > > >one NAS to another? > > > > > >Knowing that my Freeradius is running on Solaris 10 which DB you >suggest > > >to use? > > > > > >Thank you > > > > > > > > >Alan DeKok a ?crit : > > > > Adil Azmi Bikarbass wrote: > > > > > > > >> The issue is that we want the second NAS to get the > > calling-station-ID > > > >> from the "someuser" session on Radius > > > >> > > > > > > > > To do... what? > > > > > > > > > > > >> is there a way we can have this to work and pass this attribute >from > > >one > > > >> session to another? > > > >> > > > > > > > > Sure. Store the Calling-Station-Id in a database when you receive > > it > > > > from the first NAS, then pull it out of the DB, and send it to the > > > > second NAS. > > > > > > > > Alan DeKok. > > > > -- > > > > http://deployingradius.com - The web site of the book > > > > http://deployingradius.com/blog/ - The blog > > > > > > > > > > > > > >-- > > >|-Adil Bikarbass > > >|-IT Manager, MTDS > > >|-tel +212.3.767.4861 > > >|-fax +212.3.767.4863 > > >|-gsm +212.6.139. 4541 > > >|-14, rue 16 novembre > > >|-Rabat, Kingdom of Morocco > > > > > > > > > > > >------------------------------ > > > > > >Message: 3 > > >Date: Mon, 02 Apr 2007 00:00:43 +0100 > > >From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > > >Subject: Re: Freeradius-Users Digest, Vol 24, Issue 2 > > >To: freeradius-users(a)lists.freeradius.org > > >Message-ID: <4610399B.6010008(a)sussex.ac.uk> > > >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > > > > > > >> Does anyone have a draft list of which clients actually support the > > > >> Reply-Message and by which methods they can recieve them? > > > >> > > > > > > > > All clients will accept it. Very few will do anything useful with > > it. > > > > > > > > > > > >> The reason why I ask , it during initial tests (using chap) the >built > > >in > > > >> windows CHAP supplicant would display the reply-messages being sent > > >back > > > >> from the server. > > > >> Now we've moved on from CHAP to using EAP and the windows >supplicant > > no > > > >> longer displays the messages. > > > >> > > > > > > > > Yes. > > > > > > > > > > > >> Am I right in assuming that with EAP attributes from the > > access-accept > > > >> packet only get to the NAS and that the NAS will strip out of the >EAP > > > >> message > > > >> and pass it on to the supplicant and thats all the supplicant will > > ever > > >get? > > > >> > > > > > > > > Yes. > > > > > > > > > > > >> In which case, although the Reply-Message attribute is also >supported > > >in > > > >> PoD the client will never actually recieve it when using EAP ? > > > >> > > > > > > > > Yes. > > > > > > > > Alan DeKok. > > > > > > >Ahh, Thanks for clearing that up ! > > > > > >Don't suppose EAP supports encoding the equivalent of a Reply-Message ? > > > > > >P.S Well done for understanding my poorly punctuated morning ramblings >:) > > > > > >Arran > > > > > > > > > > > >------------------------------ > > > > > >Message: 4 > > >Date: Mon, 2 Apr 2007 11:14:47 +1000 > > >From: "Ranner, Frank MR" <Frank.Ranner(a)defence.gov.au> > > >Subject: RE: Attributes [unclas] > > >To: "FreeRadius users mailing list" > > > <freeradius-users(a)lists.freeradius.org> > > >Message-ID: > > > <3497E314EE23D54EACE26B5CFFD896980A6125(a)drnrxm01.drn.mil.au> > > >Content-Type: text/plain; charset="US-ASCII" > > > > > >Use the += operator, eg Ascend-Data-Filter += "ip in forward dstip > > >xx.xx.xx.0/24", to append to > > >a multi-valued list. > > > > > >FR > > > > > > > -----Original Message----- > > > > From: > > > > freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.fre > > > > eradius.org > > > > [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@l > > > > ists.freeradius.org] On Behalf Of Shawn Mitchell > > > > Sent: Monday, 2 April 2007 07:45 > > > > To: FreeRadius users mailing list > > > > Subject: Re: Attributes > > > > > > > > Ok, here's what I'm doing: > > > > > > > > DEFAULT Client-IP-Address == xx.xx.xx.xx > > > > Ascend-Data-Filter = "ip in forward tcp est", > > > > Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24", > > > > Ascend-Data-Filter = "ip in drop tcp dstport = 25", > > > > Ascend-Data-Filter = "ip in forward", > > > > Fall-Through = Yes > > > > > > > > I turned on logging of reply's, but all I'm seeing it send is: > > > > > > > > Sun Apr 1 16:31:21 2007 > > > > Ascend-Data-Filter = "ip in forward tcp est" > > > > > > > > I put this into the 'users' file btw. > > > > > > > > > > > > > > > > Alan DeKok wrote: > > > > > Shawn Mitchell wrote: > > > > > > > > > >> Where can I say "If client is 'x', then also send these > > > > attributes to > > > > >> users being authenticated..."? > > > > >> > > > > > > > > > > In the "users" file. > > > > > > > > > > DEFAULT Client-IP-Address == 1.2.3.4 > > > > > Reply-Message = "You're coming from 1.2.3.4" > > > > > > > > > > Alan DeKok. > > > > > -- > > > > > http://deployingradius.com - The web site of the book > > > > > http://deployingradius.com/blog/ - The blog > > > > > - > > > > > List info/subscribe/unsubscribe? See > > > > > http://www.freeradius.org/list/users.html > > > > > > > > > > > > > - > > > > List info/subscribe/unsubscribe? See > > > > http://www.freeradius.org/list/users.html > > > > > > > > > > > > > > > >------------------------------ > > > > > >Message: 5 > > >Date: Sun, 01 Apr 2007 20:44:05 -0500 > > >From: Shawn Mitchell <shawnm(a)iodamedia.net> > > >Subject: Re: Attributes [unclas] > > >To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > >Message-ID: <46105FE5.3090904(a)iodamedia.net> > > >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > > >Thanks! > > > > > >That seems to have fixed it > > > > > >radtest blarg blarg localhost 111 testing123 > > > > > >Sending Access-Request of id 145 to 127.0.0.1:1812 > > > User-Name = "blarg" > > > User-Password = "blarg" > > > NAS-IP-Address = xxxxxxxxxxxxxx > > > NAS-Port = 111 > > >rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=145, > > length=180 > > > Ascend-Data-Filter = "ip in forward tcp est" > > > Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24 0" > > > Ascend-Data-Filter = "ip in drop tcp dstport = 25" > > > Ascend-Data-Filter = "ip in forward 0" > > > > > > > > >Ranner, Frank MR wrote: > > > > Use the += operator, eg Ascend-Data-Filter += "ip in forward dstip > > > > xx.xx.xx.0/24", to append to > > > > a multi-valued list. > > > > > > > > FR > > > > > > > > > > > >> -----Original Message----- > > > >> From: > > > >> freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.fre > > > >> eradius.org > > > >> [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@l > > > >> ists.freeradius.org] On Behalf Of Shawn Mitchell > > > >> Sent: Monday, 2 April 2007 07:45 > > > >> To: FreeRadius users mailing list > > > >> Subject: Re: Attributes > > > >> > > > >> Ok, here's what I'm doing: > > > >> > > > >> DEFAULT Client-IP-Address == xx.xx.xx.xx > > > >> Ascend-Data-Filter = "ip in forward tcp est", > > > >> Ascend-Data-Filter = "ip in forward dstip xx.xx.xx.0/24", > > > >> Ascend-Data-Filter = "ip in drop tcp dstport = 25", > > > >> Ascend-Data-Filter = "ip in forward", > > > >> Fall-Through = Yes > > > >> > > > >> I turned on logging of reply's, but all I'm seeing it send is: > > > >> > > > >> Sun Apr 1 16:31:21 2007 > > > >> Ascend-Data-Filter = "ip in forward tcp est" > > > >> > > > >> I put this into the 'users' file btw. > > > >> > > > >> > > > >> > > > >> Alan DeKok wrote: > > > >> > > > >>> Shawn Mitchell wrote: > > > >>> > > > >>> > > > >>>> Where can I say "If client is 'x', then also send these > > > >>>> > > > >> attributes to > > > >> > > > >>>> users being authenticated..."? > > > >>>> > > > >>>> > > > >>> In the "users" file. > > > >>> > > > >>> DEFAULT Client-IP-Address == 1.2.3.4 > > > >>> Reply-Message = "You're coming from 1.2.3.4" > > > >>> > > > >>> Alan DeKok. > > > >>> -- > > > >>> http://deployingradius.com - The web site of the book > > > >>> http://deployingradius.com/blog/ - The blog > > > >>> - > > > >>> List info/subscribe/unsubscribe? See > > > >>> http://www.freeradius.org/list/users.html > > > >>> > > > >>> > > > >> - > > > >> List info/subscribe/unsubscribe? See > > > >> http://www.freeradius.org/list/users.html > > > >> > > > >> > > > > > > > > - > > > > List info/subscribe/unsubscribe? See > > >http://www.freeradius.org/list/users.html > > > > > > > > > > > > > > > >------------------------------ > > > > > >Message: 6 > > >Date: Mon, 2 Apr 2007 03:03:25 +0000 > > >From: Aren Chua <cclian18(a)hotmail.com> > > >Subject: RE: Anyone using dd-wrt for AP? > > >To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > >Message-ID: <BAY130-W126EC141C8DD048BA432ECCC600(a)phx.gbl> > > >Content-Type: text/plain; charset="iso-8859-1" > > > > > > > > >Ian Truelsen > > > > > >you can try the hotspot(chillispot) under DD-WRT firmware to configure > > your > > >AP to authenticate against the radius server. > > >Regards, > > >Aren Chua> Date: Sun, 1 Apr 2007 10:16:25 +0200> From: > > >aland(a)deployingradius.com> To: freeradius-users(a)lists.freeradius.org> > > >Subject: Re: Anyone using dd-wrt for AP?> > Ian Truelsen wrote:> >> > > > >Hopefully that is not the case. The freeradius server is on an >external> > > > > > >machine. I am trying to get the AP to authenticate against that >server,> > > > > > >but I am having trouble sorting out how to get it to do this.> > There > > >should be a RADIUS server configuration. But you'll have to> enable > > 802.1x > > >authentication, too.> > Alan DeKok.> --> http://deployingradius.com - >The > > >web site of the book> http://deployingradius.com/blog/ - The blog> - > > > List > > >info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > >_________________________________________________________________ > > >Your friends are close to you.?Keep them that way. > > >http://spaces.live.com/signup.aspx > > >

4 6

Sqlcounter Max-Octets doesn't reset
by Sigfrido 03 Apr '07

03 Apr '07

Hi all, freeradius 1.1.0 on Ubuntu Dapper all's going but the counter below is not resetting: sqlcounter volumelimitcounter { counter-name = Total-Max-Octets check-name = Max-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctOutputOctets) FROM radacct where UserName ='%{%k}'" } I would like to reset, everyday at 00:00, the Max-Octets (in radcheck table) to 0 but it seems not working. I tried also the "hourly" reset, with same results. Any idea ? It's a bug or what ? TIA -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Problemi di Liquiditÿ? Con Logos Finanziaria 30.000 ÿ in 24 ore a dipendenti e lavoratori autonomi con rimborsi fino a 120 mesi clicca qui * Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=2907&d=2-4

2 2

Cleartext-Password with rlm_sql problem
by Fabio Pedretti 03 Apr '07

03 Apr '07

Hi, I just upgraded my freeradius 1.1.3 to 1.1.5, which I am using with a MySQL db for storing users password. I did a diff from original 1.1.3 raddb vs my modified raddb and applied it to 1.1.5 raddb. All worked fine. After that I see in the users file that User-Password was replaced with Cleartext-Password, so I replaced in the radcheck all "User-Password" with "Cleartext-Password": after doing that, my users can't no more authenticate. I get this in radius.log: Tue Apr 3 12:29:35 2007 : Info: rlm_sql (sql_main): No matching entry in the database for request from user [user1] Tue Apr 3 12:29:35 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Tue Apr 3 12:29:35 2007 : Info: rlm_sql (sql_main): No matching entry in the database for request from user [user1] Tue Apr 3 12:29:35 2007 : Auth: Login incorrect: [user1@mydomain] (from client localhost port 29) Tue Apr 3 12:29:35 2007 : Auth: Login incorrect: [user1@mydomain] (from client ap-1 port 29) Backing to "User-Password" worked again. What wrong? Is it correct to replace "User-Password" to "Cleartext-Password" with users in a MySQL db, as done in users file? Thanks

2 3

Can't connect to remote freeradius server
by A B 03 Apr '07

03 Apr '07

I've installed freeradius 1.1.5 and am able to run radtest successfully on the machine that freeradius is installed on. However, when I try to run radtest (or NTRadPing or radius test client) it is unable to connect to the server. Does anyone have any ideas? I do have the servers I'm running radtest on listed in clients.conf Here is the output from NTRadPing (IP address removed by me): Sending authentication request to server XX.XXX.XXX.XXX:1812 Transmitting packet, code=1 id=0 length=67 recvfrom() error, WSAGetLastError() = 10054 could not receive a response from the server Any suggestions would be appreciated.

2 3

realms in my Postgres DB
by Santiago Balaguer García 03 Apr '07

03 Apr '07

2 1

radius accounting and syslog
by Archie Holland 03 Apr '07

03 Apr '07

I'm preparing to transition from NavisRadius to FreeRadius. NavisRadius allowed me to log stop/start events via syslog. Is there any _EASY_ way to emulate this behavior in FreeRadius? -- ========================= The Net That Works! ======================== Archie Holland http://www.blue.net 1(270)735-3553 Bluegrass Network LLC 1(270)765-6361, ext6220 Senior Systems Administrator Fax: 1(270)737-0580 ========================= The AdminBlue Team ========================= Archie Holland Mitzi Reynolds Douglas Lamb Tommy Chism Cheryl Ruckriegel Keith Corbin ===================== mailto:adminblue@blue.net ======================

3 2

passing Calling-Station-ID
by Adil Azmi Bikarbass 03 Apr '07

03 Apr '07

Hello All, We would like to get your input on an issue we are facing: We are using two NASs and one FreeRadius 1.1.5, the first NAS authenticate the user "someuser" through Radius and assign an IP address with no problem. we can see the accounting start record with the calling-station-ID and other attributes. The issue is that we want the second NAS to get the calling-station-ID from the "someuser" session on Radius is there a way we can have this to work and pass this attribute from one session to another? Thank you -- |-Adil Azmi Bikarbass |-IT Manager |-MTDS S.A. |-tel +212.3.767.4861 |-fax +212.3.767.4863 |-gsm +212.6.139. 4541 |-14, rue 16 novembre |-Rabat, Kingdom of Morocco

3 5

Re : Anyone using dd-wrt for AP?
by Eshun Benjamin 03 Apr '07

03 Apr '07

The settings below will help: SETUP Internet connection: IP on WAN Under Optional Settings Host Name: MyWireless (Name of your client-AP) Domain Name: yourdomain.com (Your own domain) MTU: Auto Under Network Setup Router Local IP: 192.168.1.1 Subnet: 255.255.255.0 Gateway: 0.0.0.0 DHCP DHCP Server: enabled WIRELESS Under Basic settings; Wireless mode: AP wireless Network Mode: Mixed Wireless Network Name: MyWireless (Name of your client-AP) Wireless Channel: 11-2.462GHz Wireless SSID Broadcast: enable Sensitivity Range: 2000 Under Radius MAC Radius Client: enable MAC format : aabbcc-ddeeff Radius Server Address: your radius server IP Radius Server port: 1812 MUU: Password format: shared key Radius shared secret: the secret of your cliet (AP) Wireless Security Security Mode: WPA Radius WPA Algorithms: TKIP+AES Radius Server Address: Your radius server IP Radius Server port: 1812 WPA shared key: the secret of your cliet (AP) key renewal interval: 3600 ADMINISTRATION management Routing: enable 802.1x : enable Make sure you have your client(AP) information in radius: client.conf ( AP IP , MyWireless, Shared Key) configure eap.conf and radius.conf as well. All the best. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Ian Truelsen <ian.truelsen(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 1 Avril 2007, 3h56mn 39s Objet : Anyone using dd-wrt for AP? I am trying to set up dd-wrt to use freeradius for authentication with EAP-TLS, however, I have run into a problem: there doesn't seem to be an option under the WPA encryption system for entering the freeradius secret. If anyone has got this working, can you let me know the where and how? The dd-wrt forums have been pretty silent on the issue. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 2