- Freeradius-Users - lists.freeradius.org

Is there a simple way to restrict a user in the 'users' file to access only a specific ip addr/device?
by Ellis, Scott 1 (N-Comptel Inc.) 17 Jan '07

17 Jan '07

I am using PAM for auth-type in my users file. Is there a simple way to say that user 'x' can only login to IP addr 'y' and /or 'z'? I have groups of engrs, admins, and operators and need to discriminate who can access which device........ Scott -----Original Message----- From: Ellis, Scott 1 (N-Comptel Inc.) Sent: Tuesday, January 02, 2007 11:40 AM To: 'FreeRadius users mailing list' Cc: Ellis, Scott 1 (N-Comptel Inc.) Subject: RE: How to restrict users /PAM to specific NAS devices?? I have looked it over, but I am still not clear. I was thinking that I could use huntgroups to map devices to specific groups, but then I am not clear on how to restrict users ('users' file) to those groups. I know this has probably been done most everywhere in one form or another. Any examples that show the actual entries in the approp. files? Thanks, Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Tuesday, January 02, 2007 9:43 AM To: FreeRadius users mailing list Subject: Re: How to restrict users /PAM to specific NAS devices?? Ellis, Scott 1 (N-Comptel Inc.) wrote: > I am using PAM for Auth-Type. > I want to be able to either 1) restrict the devices the user has > access to (admins,operators, etc) by username and/or 2) preferably > carve into groups my network gear/NAS devices and then assign users to groups. See "man rlm_passwd". It's documentation describes how to create groups like this. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Strange behaviour of freeradius...?
by apolyxrono 16 Jan '07

16 Jan '07

Hi list , I have set up a wlan using : freeradius-1.1.4 (peap-eap/mschapv2-authentication), AccessPoint-3Com7250 and windows xp wireless users. My AP has the option for accounting and i have set it on. I logged the accounting info in the radius database in the radacct table to be more specific. When a wireless user connected to the wlan i am executing the following sql query: select UserName , NASIPAddress , AcctStartTime , AcctStopTime , AcctSessionTime , AcctInputOctets , AcctOutputOctets from radacct ; and the output is : +----------+--------------+---------------------+---------------------+-----------------+-----------------+------------------+ | UserName | NASIPAddress | AcctStartTime | AcctStopTime | AcctSessionTime | AcctInputOctets | AcctOutputOctets | +----------+--------------+---------------------+---------------------+-----------------+-----------------+------------------+ | sony | 10.0.0.10 | 2007-01-15 22:33:12 | 0000-00-00 00:00:00 | 41 | 718 | 164 | +----------+--------------+---------------------+---------------------+-----------------+-----------------+------------------+ After If the user select from his wireless card software to disconnect from the specific wlan and make the same query to the database i can see that the AcctStopTime have a specific value and accounting for this user has stopped. However if the user does not use his/her wireless software to disconnect from the wlan and tun-off the wlan switcher of his/her card the accounting is continued (AcctSessionTime is counting) on freeradius but the AcctInputOctets and AcctOutputOctets stop counting. Why is that happening ? How should i know when the user is connected in the wlan and the user was just turned-off his/her switch of wlan ? thanks ___________________________________________________________ The all-new Yahoo! Mail goes wherever you go - free your email address from your Internet provider. http://uk.docs.yahoo.com/nowyoucan.html

5 5

Problem with Freeradius+LDAP+wifi
by Rafał Kamiński 16 Jan '07

16 Jan '07

Hello, I have that configuration: -server with Freeradius + connect with internal system and Ldap server -Linksys WPA54G -laptop with wifi -PC with freebsd when i testing connections from PC use radtest i was auth. by radius and ldap server. But when i want to use laptop and wifi i see some freeradius logs: - i see that linksys connect to ldap.server over freeradius but user (the same what on the pc auth) didn't be auth :( LOGS: rad_recv: Access-Request packet from host 192.168.1.245:3072, id=0, length=119 User-Name = "rka" NAS-IP-Address = 192.168.1.245 Called-Station-Id = "001217694588" Calling-Station-Id = "000d93ee9b55" NAS-Identifier = "001217694588" NAS-Port = 32 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000801726b61 Message-Authenticator = 0x31c848a6f4f552bd2024d49b5ffa79c4 Mon Jan 15 13:39:00 2007 : Debug: Processing the authorize section of radiusd.conf Mon Jan 15 13:39:00 2007 : Debug: modcall: entering group authorize for request 2 Mon Jan 15 13:39:00 2007 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: - authorize Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: performing user authorization for rka Mon Jan 15 13:39:00 2007 : Debug: radius_xlat: '(uid=rka)' Mon Jan 15 13:39:00 2007 : Debug: radius_xlat: 'ou=Users,dc=domain' Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: performing search in ou=Users,dc=blstream, with filter (uid=rka) Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: looking for check items in directory... Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: looking for reply items in directory... Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: user rka authorized to use remote access Mon Jan 15 13:39:00 2007 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Jan 15 13:39:00 2007 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Jan 15 13:39:00 2007 : Debug: modcall[authorize]: module "ldap" returns ok for request 2 Mon Jan 15 13:39:00 2007 : Debug: modcall: leaving group authorize (returns ok) for request 2 Mon Jan 15 13:39:00 2007 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Mon Jan 15 13:39:00 2007 : Debug: auth: Failed to validate the user. Mon Jan 15 13:39:00 2007 : Debug: Delaying request 2 for 1 seconds Mon Jan 15 13:39:00 2007 : Debug: Finished request 2 Mon Jan 15 13:39:00 2007 : Debug: Going to the next request Mon Jan 15 13:39:00 2007 : Debug: --- Walking the entire request list --- Mon Jan 15 13:39:00 2007 : Debug: Waking up in 1 seconds... Mon Jan 15 13:39:01 2007 : Debug: --- Walking the entire request list --- Mon Jan 15 13:39:01 2007 : Debug: Waking up in 1 seconds... Mon Jan 15 13:39:02 2007 : Debug: --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.245 port 3072 I set in /etc/freeradius/clients.conf client 192.168.1.245 { secret = password shortname = ldap_test } Why ldap didn't want auth. me ? And it is so freak because when i used PC with the same users ldap auth me. BR, -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

4 12

EAP-TLS Fast Reconnect?
by michael able 16 Jan '07

16 Jan '07

Hi all, i'm trying to test the Fast-Reauthentication Method of EAP-TLS. i tried it with wpa_supplicant - hostapd, but then found out the the authentication server of hostapd doesn't support Fast-Reauthentication. so right now i'm running wpa_supplicant - hostapd - freeradius 1.1.3. eap-tls is working, but not Fast-Reauthentication. I found no entry in the config-files to switch it on or off. Does Freeradius 1.1.3 support Fast-Reauthentication of EAP-TLS? greetings, michael.

2 1

Stale session problem
by Cory Robson 16 Jan '07

16 Jan '07

My upstream (comindico/Soul) do not allow me to query the nas's via any method SNMP or finger. What happens is I get a dropped packet occasionally which may be a disconnect but of course I never receive it full, hence the user is still shown as online on the SQL backend. Has anyone written a script or event process to monitor the update packets against the users apparently online and in the event that no update is received in a 20 min period (my updates are every 15 mins from the NAS) create a close session event? Or if you have an alternative solution please let me know. Thanks Cory

4 5

Compile freeradius + debian + rlm_eap_tls
by Rafał Kamiński 16 Jan '07

16 Jan '07

Hello, I have freeradius on debian etch but without rlm_eap_tls. How i can compile new freeradius-1.1.4 witch rlm_eap_tls ? Sorry for easy question, but i'm new one in that. BR, Rafal Kaminski

2 1

RE: Using MySQL and assigning IP-Addressesbased onCalling-Station-ID
by Ackbar Joolia 16 Jan '07

16 Jan '07

Thanks Phil, I will try that. What is the CVS code you are referring to? Al Sent: 15 January 2007 18:28 To: FreeRadius users mailing list Subject: Re: Using MySQL and assigning IP-Addressesbased onCalling-Station-ID Ackbar Joolia wrote: > Phil, Thanks for your reply. I didn’t know about the Fall-Through. > > I have got a list of static addresses, which I will need to assign > through the Framed-IP-Address attribute. > > This is what I am trying to do: When I receive requests, they all > come with the same username and password, but with different > Calling-Station-ID. I have to authenticate and differentiate on the > calling-station-id, and then assign static IP-Address to these users, > based on the calling-station-id. Ah. > > I know it sounds simple, but I can't get it to work or am not getting > the logic right. Can you advise please? You won't be able to do that on the current SQL code. Since the SQL groups are all "squashed together" and you're using the same user. > > My model has to work in the way described above i.e. same username > and password, and assigning Framed-IP-Address based on the > calling-station-id, in MySql. You could try the CVS code - it should work as you expect. Set the user-password on the "radcheck" table, then have a group per station with a single check item of calling-station-id, and a single reply item of framed-ip-address If you can't upgrade, you could possibly re-write the username to the calling-station-id in the hints file, then put the calling-station-id as the username in radcheck, and the framed-ip-address in radreply. I know you said it "has to" be in mysql, but you should also investigate the rlm_passwd module (which does not do what it sounds like). It ought to be trivial to dump the SQL to a file of the form: calling-station-id:framed-ip-address ...and set it on the reply. See "man rlm_passwd" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

1 0

Patch to 3Com-User-Access-Level
by Alexandre Soares 16 Jan '07

16 Jan '07

Hi All, I found in other msgs fill changes applied in /usr/local/src/freeradius- 1.1.4/src/lib/valuepair.c (showed below), but the 3Com-User-Access-Level attibute still sending wrong. Thanks for all, but if anyone have any suggestion please send me. case PW_TYPE_INTEGER: /* * Note that ALL integers are unsigned! */ vp->lvalue = (uint32_t) strtoul(value, &p, 10); if (!*p) { vp->length = 4; break; } /* * Look for the named value for the given * attribute. */ if ((dval = dict_valbyname(vp->attribute, value)) == NULL) { librad_log("Unknown value %s for attribute %s", value, vp->name); return NULL; } vp->lvalue = dval->value; vp->length = 4; break; case PW_TYPE_DATE

1 0

Dialup Admin NAS List
by Cory Robson 16 Jan '07

16 Jan '07

I'm hoping someone may be able to assist in modifying the user_finger.php script to retrieve the list of NAS's for the online users from radacct table. Basically instead of reading the text file and cycling through them to add the breakdown of NAS's I want to use something like select DISTINCT NASIPAddress from radacct add them to an array and use the php gethostbyaddr() function to retrieve the true hostname to sort them by I don't need any of the snmp or NAS type or number of lines left as my upstream does not allow me to connect to verify the information anyway . This should just be a quick change for someone more talented than I to remove the existing loop and replace it with the relevant sql loop instead. Anyone ?

2 3

Daylight savings dialup admin
by Cory Robson 16 Jan '07

16 Jan '07

I'm having several problems still with the php scripting not display my current date time correctly. The system time is correct and mysql timestamps are correct both the console and mysql show the correct time and date showing the true daylight savings adjustment however the user_admin and user_finger page does not show this counters show the customer online time incorrect by an hour Any coders know how I can get php to show the correct time adjustment automatically? Thanks

1 1