- Freeradius-Users - lists.freeradius.org

Re: new query verification in sql.conf
by Jean Carlos Oliveira Guandalini 14 Mar '07

14 Mar '07

I did not explain correctly. I have a table in database with mac-adress registered, when the user connect, radius makes a verification in this table(on database) comparing mac-address of the user with mac-address registered in the database, if the mac-adress of user contain in the table(on database), user not be able to connect. Sorry for my english. I use translator! lol Thanks Jean > ------------------------------------------------------------------------ > > Subject: > > From: > <tnt(a)kalik.co.yu> > Date: > Wed, 14 Mar 2007 15:09:49 +0100 > To: > "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > To: > "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > > use huntgroups: > > ohnoyouwont Calling-Station-ID == whatever > SQL-Group == suspended > > where suspended is a group with Auth-Type reject. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 14/3/2007, "Jean Carlos Oliveira Guandalini" > <jeanguandalini(a)visaonet.com.br> piše: > > >> I use freeradius for authentication of pppoe wifi. >> >> I need to make new sql query in a table with a list of mac-address, if >> the CallingStationId will be equal to the some mac-adress of the table >> then will not have to be connected. >> A system of mac-adress blacklist. >> I tried to make adding one query in sql.conf but it does not function. >> >> I find that it would have to add a new function in rlm_sql.c, but am not >> habil C programmer. >> >> Somebody can help me? >> >> Sorry for my english >> >> Thanks >> >> Jean >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> >> > > > > > ------------------------------------------------------------------------

3 2

Proposal for LNS load-balancing with Freeradius
by Mathieu Dessus 14 Mar '07

14 Mar '07

Hello, I was working on a solution for having round-robin LNS repartition with Freeradius. Since I must replace several parameters and they must match against each other (the Tunnel-Server-Auth-Id name must match the Tunnel-Server-Endpoint IP), I had trouble with using an external script returning random values. So, my solutions consists in modifying the SQL groupreply request (in sql.conf). Instead of: authorize_group_reply_query = "SELECT ${groupreply_table}.id,${groupreply_table}.GroupName,${groupreply_table}.Attribute,${groupreply_table}.Value, ${groupreply_table}.op FROM ${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id" I put: authorize_group_reply_query = "SELECT ${groupreply_table}.id,${groupreply_table}.GroupName,${groupreply_table}.Attribute,substring_index(substring_index(${groupreply_table}.Value, ';', myrand.val),';',-1),${groupreply_table}.op FROM ${groupreply_table},${usergroup_table},(select floor(1+rand()*2) as val) as myrand WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id" where the number in "rand()*2" must match the number of LNS. The database value format must be either in the usual from (the value itself) when only one value must be replied, either "firstvalue;secondvalue..." separed by semicolon (in this case, it will return randomly one of the values, and the same random number will be used for all this request). I saw only two drawbacks: you must restart Freeradius if you modify the number of LNS and the separator character must no be used anywhere else. Does anybody have some comments on this method, or a better method to do the same thing ? Sincerely, Mathieu Dessus.

1 0

Freeradius 1.1.5 on RH 7.3 crashes
by Dario Palmisano 14 Mar '07

14 Mar '07

Dear All, I successfully used freeradius-1.0.5 on our RedHat 7.3 system for a couple years to authenticate wireless and VPN clients. I decided to upgrade to the version 1.1.5 to enable the wireless connection on a few Windows Vista clients. I downloaded the source freeradius-1.1.5.tar.gz and customized the provided freeradius.spec. Essentially in the configure I added: --with-openssl-includes=/usr/local/ssl/include \ --with-openssl-libraries=/usr/local/ssl/lib \ (as openssl-0.9.7i is installed in /usr/local/ssl/lib) and removed: --with-system-libtool \) and succefully produced the rpm for my system. I installed it and it worked even for 6, 7 hours (enabling the wireless clients to work, included the Vista clients) but then invariably it crashed. Apparently, (from the various logs attached) it always crashed after the configuration reload, but it is not evident if immedialtely after the reload or some time later. The crash can some time be initiated by sending kill -HUP at the radiusd process. Trying to minimze the frequency of the crashed I set: max_request_time = 10 but without any change in the behaviour. Any suggestion on how to solve the problem would be appreciated. Best regards Dario P.S.: Attached is a partial log (otherwise was too big), only username and password are masked). I can provide longer logs on request. -- ______________________________________________________________ Dario Palmisano ICGEB Computer System & Network Administrator Tel: +39 040 3757330 Fax: +39 040 226555 E-Mail: Dario.Palmisano(a)icgeb.org International Centre for Genetic Engineering and Biotechnology Area Science Park, Padriciano 99, I-34012 Trieste, ITALY ______________________________________________________________

3 4

clients.conf shortname
by Geoffroy Arnoud 14 Mar '07

14 Mar '07

Hi All, I have a quick question on the shortname attribute for clients: must it be unique among all clients? Thanks in advance for your answers Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

authenticating multiple modules?
by Tim Tyler 14 Mar '07

14 Mar '07

Freeradius experts, I want to use one freeradius server to authenticate against a system file for students and against ldap for faculty/staff. I can get the system file to work alone. I can get the ldap module to work alone. But I can't seem to find a way to get both of them to work together. If I set DEFAULT Auth-Type = System in the users file, it authenticates the system files. If I set it to ldap, it authenticates to ldap. If I put both in the users file, it authenticates ldap users only. How do I allow both unix and ldap modules to authenticate their respective users? Note: users are unique to each module. A user in unix does not exist in ldap and vice versa. Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu

3 9

Re: RE : EAP-TTLS outer identity & accounting
by Sam Schultz 14 Mar '07

14 Mar '07

On Wed, 14 Mar 2007 11:25:20 -0500 Thibault Le Meur <Thibault.LeMeur(a)supelec.fr> wrote: >> -----Message d'origine----- >> De : >> freeradius-users-bounces+thibault.lemeur=supelec.fr(a)lists.free >> radius.org >> [mailto:freeradius-users-bounces+thibault.lemeur=supelec.fr@li >> sts.freeradius.org] De la part de Sam Schultz >> Envoyé : mercredi 14 mars 2007 17:13 >> À : freeradius-users(a)lists.freeradius.org >> Objet : Re: EAP-TTLS outer identity & accounting >> >> >> >> >> On Tue, 13 Mar 2007 13:15:52 -0500 Alan DeKok >> <aland(a)deployingradius.com> wrote: >> >Sam Schultz wrote: >> >> >> >> This should be solvable by adding something like >> >> 'User-Name = %{User-Name}' to the DEFAULT entries in the >users >> >file, >> >> correct? >> > >> > Yes. >> >> One of my users file DEFAULT entries look like this: >> >> DEFAULT Realm == "test", Autz-Type := sql-test, User- >Name = >> "%u" >> >> However, FreeRADIUS tells me this: >> >> Error: Invalid operator for item User-Name: reverting to '==' >> >> I assume I'm not supposed to forcibly change User-Name, so what >> attribute would I set to return the correct username to the NAS? > >> I know there is a run-time variable %(reply:User-Name}, would I >> need to somehow update it with the correct value for User-Name >> instead? > >Yes, by simply adding the User-Name = XXX to the reply items (that >is to say >not on the first line). Try something like this: This didn't make much sense at first, but I think I understand it now. What you're saying is that the first line is only for check items, which is why I couldn't set User-Name there. The second line and beyond then are for, what? Reply items ONLY, or check & reply items? Is this documented anywhere? I just did a quick check through the freeradius doc directory, and only found a rlm_fastusers document which didn't have anything to say about format restrictions. > >DEFAULT Realm == "test", Autz-Type := sql-test > User-Name=`%{User-Name}` > >HTH, >Thibault > > > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S7YfNF4AEzCH38YxSm8GfpqO2/

2 1

Re: EAP-TTLS outer identity & accounting
by Sam Schultz 14 Mar '07

14 Mar '07

On Tue, 13 Mar 2007 13:15:52 -0500 Alan DeKok <aland(a)deployingradius.com> wrote: >Sam Schultz wrote: >> >> This should be solvable by adding something like >> 'User-Name = %{User-Name}' to the DEFAULT entries in the users >file, >> correct? > > Yes. One of my users file DEFAULT entries look like this: DEFAULT Realm == "test", Autz-Type := sql-test, User-Name = "%u" However, FreeRADIUS tells me this: Error: Invalid operator for item User-Name: reverting to '==' I assume I'm not supposed to forcibly change User-Name, so what attribute would I set to return the correct username to the NAS? I know there is a run-time variable %(reply:User-Name}, would I need to somehow update it with the correct value for User-Name instead? This question seems to have been asked several times on the list before, but I have yet to find a definitive answer to it. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1WBS8PxpFqA1erqcUaYXrLCjjS/

2 1

checkrad or sql base simultaneous-use
by satish patel 14 Mar '07

14 Mar '07

Note: forwarded message attached. $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Access-Challenge with Avaya
by Romain Mercier 14 Mar '07

14 Mar '07

Hello ! I am having troubles with Avaya P334T switch. I am trying to authenticate users directly connected to ports of the switch. I have configured the switch well I think because the acces-request is sent to the radius but then the radius send an access-challenge to the switch and nothing is done after. There is no answer of the switch and the user cannot access the network but it is not rejected by the radius. I think the problem come from the switch because authentication on a wireless access-point connected on this switch works fine. Did anybody encounter the same problem? Any idea? Thanks for your help ----- Romain Mercier - Technicien réseau et sécurité Université d'Angers - CRI Service Systèmes & Réseaux 40 rue de Rennes 49035 Angers Cedex - France

2 3

Attributes of a realm
by Santiago Balaguer García 14 Mar '07

14 Mar '07

1 0