- Freeradius-Users - lists.freeradius.org

RE: How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 03 Jan '07

03 Jan '07

Well here is where I am. I am using PAM. All I need to pull all the pieces together is one simple example of what has to be done to do the following: user1 and user2 can access devices 10.1.1.1, 10.1.1.2, and user3 can access only 10.1.1.3. ************* Here is where I am. To turn on rlm_passwd, I think, you have to goto radiusd.conf and create a passwd entry say passwd My_group { filename = ${raddbdir}/My.group format "=Group-Name:*,User-Name" authtype = PAM (I hope I can auth via PAM since that is how my security is tailored) delimiter = ":" Next, you have to add it to the dictionary ... My_group? Then, I was thinking I could use the huntgroups and add a entry called admin and ops. The huntgroup would include multiple entries huntgroups admin NAS-IP-Address = 10.1.1.1 admin NAS-IP-Address = 10.1.1.2 User-Name = user1, User-Name = user2 ops NAS-IP-Address = 10.1.1.3 User-Name = user3 Next, in the My.group file I would put "admin:user1,user2" and on the next line "ops:user3" Finally, if I am at least close, I am not entirely clear how to setup the USERS file for user1 and user2 and user3. Can I use the following: user1 My_group == "admin" ??? (this would add admin to my custom group for user1??) Then, how do I map user1 with My_group "admin" to the admin huntgroup? Or do I just insert a DEFAULT entry at the bottom and include huntgroup-name == admin ??? Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Tuesday, January 02, 2007 4:12 PM To: FreeRadius users mailing list Subject: Re: How to restrict users /PAM to specific NAS devices?? Ellis, Scott 1 (N-Comptel Inc.) wrote: > I have looked it over, but I am still not clear. What *exactly* about the documentation is not clear? You can use rlm_passwd to make a group of anything you want. > I was thinking that I > could use huntgroups to map devices to specific groups, but then I am > not clear on how to restrict users ('users' file) to those groups. The FAQ has an example of limiting users to groups. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

My AP does accountig but radwho doesn't work..
by adreas Polyxronopoulos 03 Jan '07

03 Jan '07

Hi list, I am trying to work the radwho command but i get this error : radwho: Error reading /usr/local/var/log/radius/radutmp: No such file or directory My AccessPoint (3com 7250) has the accounting option i have set it enable and i have detail files in /usr/local/var/log/radius/radacct/10.0.0.10 . In my radiusd.conf : radutmp { filename = ${LOGDIR}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = yes } accounting { detail radutmp } session { radutmp } ----- and when running radiusd -X : .............. Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes .... Module: Instantiated radutmp (radutmp) thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

RE: How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 02 Jan '07

02 Jan '07

I have looked it over, but I am still not clear. I was thinking that I could use huntgroups to map devices to specific groups, but then I am not clear on how to restrict users ('users' file) to those groups. I know this has probably been done most everywhere in one form or another. Any examples that show the actual entries in the approp. files? Thanks, Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Tuesday, January 02, 2007 9:43 AM To: FreeRadius users mailing list Subject: Re: How to restrict users /PAM to specific NAS devices?? Ellis, Scott 1 (N-Comptel Inc.) wrote: > I am using PAM for Auth-Type. > I want to be able to either 1) restrict the devices the user has > access to (admins,operators, etc) by username and/or 2) preferably > carve into groups my network gear/NAS devices and then assign users to groups. See "man rlm_passwd". It's documentation describes how to create groups like this. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Status of my book
by Alan DeKok 02 Jan '07

02 Jan '07

It's January, so the book obviously hasn't met my target of being finished by December. The good news is that I have over 100 pages of content, and I recently entered an agreement with a partner that will give me access to additional networking equipment, which should help expand the content to include configuration for many common clients. However, I'm in the middle of moving 6000 km, so I'm a little busy. I expect to be able to start working on the book again in a month or so. Thanks to everyone who's emailed to inquire about the book, or offer help. That has given me incentive to push hard to finish it ASAP. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 1

radiusd command line parameters?
by Eduardo Costa Lisboa 02 Jan '07

02 Jan '07

Hi all. I would like to know where can I find a list of the parameters used by radiusd. I looked all over the wiki FAQ and the documentation under /usr/share/doc/freeradius-1.0.1 and couldn't find any mention to it. Attentiously, -- Eduardo Costa Lisboa

2 2

How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 02 Jan '07

02 Jan '07

I am using PAM for Auth-Type. I want to be able to either 1) restrict the devices the user has access to (admins,operators, etc) by username and/or 2) preferably carve into groups my network gear/NAS devices and then assign users to groups. Simply put, I would like to know what I have to do for user1 and user2 that auth via PAM to limit the NAS/Network gear they are allowed to access/authenticate against....I am looking for one straight for example. I would like user1 to be able to access device 10.1.1.1 and user2 to be able to access 10.1.1.2 and 10.1.1.3 and 10.1.1.4..... Thanks, Scott

2 1

Radrelay: Zero Session length packets
by Etienne Pretorius 02 Jan '07

02 Jan '07

Hello everyone. I've been going a bit mad on this subject for a while. I am receiving proxied requests from my upstream provider and I am also doing authentication locally. The issue I've been experiencing has to do with this error handed to me from my upstream provider : Tue Jan 2 09:47:05 2007 : Error: rlm_sql: Stop packet with zero session length. (user 'celliott@<snip>', nas 'XXX.XXX.XXX.XXX') It seems that this is always the second ISDN connection that has its session time set to zero. Thu Dec 21 23:08:02 2006 Acct-Session-Id = "00009F8B" Framed-Protocol = PPP Acct-Authentic = RADIUS X-Ascend-Connect-Progress = Call-Up X-Ascend-PreSession-Time = 1 X-Ascend-Xmit-Rate = 64000 X-Ascend-Data-Rate = 64000 Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 X-Ascend-Pre-Input-Octets = 233 X-Ascend-Pre-Output-Octets = 102 Acct-Input-Packets = 0 Acct-Output-Packets = 0 X-Ascend-Pre-Input-Packets = 6 X-Ascend-Pre-Output-Packets = 4 Acct-Terminate-Cause = Port-Unneeded X-Ascend-Disconnect-Cause = No-Reason Acct-Status-Type = Stop User-Name = "celliott@<cut>" Acct-Multi-Session-Id = "00005D0F" X-Ascend-Multilink-ID = 23823 Acct-Link-Count = 2 X-Ascend-Num-In-Multilink = 2 Framed-IP-Address = XXX.XXX.XXX.XXX NAS-Port = 20423 NAS-Port-Id = "Serial7/4:23" NAS-Port-Type = ISDN Calling-Station-Id = "0217624546" Connect-Info = "64000 HDLC" Called-Station-Id = "0000" Service-Type = Framed-User NAS-IP-Address = XXX.XXX.XXX.XXX Acct-Delay-Time = 30 Vendor-1431-Attr-1 = 0x4449414c Proxy-State = 0x3936 Client-IP-Address = QQQ.QQQ.QQQ.QQQ Hint = "KING" Acct-Unique-Session-Id = "2b29fa83d47585d9" Timestamp = 1166735282 What I would like, is to avoid radrelay for those packets as it only jams up the radrelay queue when this happens while the logging to sql works. The config below is insuffiecient as this is what leads me up to a radrelay jam. [root@CCCCC:/var/log/freeradius/radacct] ls -hal total 6.4M drwxr-xr-x 2 freerad freerad 120 2006-12-21 23:08 . drwxr-xr-x 3 freerad freerad 872 2006-12-31 06:30 .. -rw------- 1 freerad freerad 6.3M 2007-01-02 08:45 detail-radrelay -rw------- 1 freerad freerad 1.2K 2006-12-21 23:08 detail-radrelay.work BTW is there a way to specify an OR / AND operator below for acct_users? So that I can say something like DEFAULT [ Client-IP-Address == "XXX.XXX.XXX.XXX" || Client-IP-Address == "YYY.YYY.YYY.YYY" || Client-IP-Address == "ZZZ.ZZZ.ZZZ.ZZZ" && Acct-Session-Time == "0" ] , Acct-type := "REMOTE-AUTH" *acct_users* # Do not radrelay these packets: DEFAULT Acct-Session-Time == "0", Acct-type := "REMOTE-AUTH" # This Configuration prevents Accouting loops of a two-way radrelay sync # [o] Radrelay must be sending accounting info from IP(s) below # on the other Radius server(s) DEFAULT Client-IP-Address == "XXX.XXX.XXX.XXX", Acct-type := "REMOTE-AUTH" DEFAULT Client-IP-Address == "YYY.YYY.YYY.YYY", Acct-type := "REMOTE-AUTH" DEFAULT Client-IP-Address == "ZZZ.ZZZ.ZZZ.ZZZ", Acct-type := "REMOTE-AUTH" # Everyone else must still be radrelay'ed DEFAULT Acct-type := "LOCAL-AUTH" *radiusd.conf* accounting { # 2006-09-27: EPP # If Acct-Type is LOCAL-AUTH then log to sql module AND to detail file # for radrelay - accounting sync daemon Acct-Type LOCAL-AUTH { radrelay sql } # 2006-11-24: EPP # If accounting packet is from one of our other radius servers, then # just log it to sql...otherwise we will end up with an Accouting packet # storm/loop. Acct-Type REMOTE-AUTH { sql } [snip...] -- Kind Regards Etienne

2 1

RE: problem with NT-Password and LDAP
by Ana Gallardo Gómez 02 Jan '07

02 Jan '07

---------------------------------------- > Date: Thu, 28 Dec 2006 08:44:22 -0800 > From: aland(a)deployingradius.com > To: freeradius-users(a)lists.freeradius.org > Subject: Re: problem with NT-Password and LDAP > > Ana Gallardo Gómez wrote: > > > Well, I can not modify the LDAP server, I only can use it, > > so, while I ask the LDAP administrator to modify this atribute, > > I would like to modify in Freeradius server. > > OK, use the "perl" module to re-write the attribute. There is an > "example.pl" distributed with the server that should be a good start. > > Alan DeKok. > -- I'm goint to use the "perl" module, but first, and while I learn to use it, I probed the attr_rewrite module: attr_rewrite quitar_espacios { attribute = NT-Password # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = config searchfor = " " replacewith = "" ignore_case = no new_attribute = no max_matches = 220 ## If set to yes then the replace string will be appended to the original string append = no } I don't know if I can use regular expressions in "searcfor" field, and, in this case, what is the regular expressions grammar; or if is better with "max_matches = 220 and searchfor = " ""... I use this module in authorize section: authorize { preprocess suffix files Autz-Type LDAP_LOCAL{ ldap_local } Autz-Type LDAP_UNEX_ES{ ldap_unex_es quitar_espacios } mschap eap } and I can authenticate users: rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_unex_es" returns ok for request 7 radius_xlat: ' ' rlm_attr_rewrite: Changed value for attribute NT-Password from '06B11E3D941021E1A5C51C6868F2F0E6 ' to '06B11E3D941021E1A5C51C6868F2F0E6' modcall[authorize]: module "quitar_espacios" returns ok for request 7 modcall: leaving group LDAP_UNEX_ES (returns ok) for request 7 Thank you _________________________________________________________________ ¡Ya está aquí Windows Live Spaces! Ahora podrás crear fácilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

1 0

About modules rlm_eap_peap , rlm_eap_tls....
by adreas Polyxronopoulos 31 Dec '06

31 Dec '06

Hi everyone , I am trying to set up freeradius-1.1.3 for a wlan using peap - eap/mschapv2. I have downloaded the source of freeradius-1.1.3 and compile it (./configure , make , make install) . I am using a guide for setting-up freeradius-1.0.2 . The guide after compiling the source of freeradius-1.0.2 it builds 2 modules ( rlm_eap_peap , rlm_eap_tls). My question is : Do i have to do this in freeradius-1.1.3 source version after i compile it ? Or these modules are build from the top level compile ? thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Help with peap-eap/mschapv2
by adreas Polyxronopoulos 30 Dec '06

30 Dec '06

Hi everyone Merry Christmas and a Happy new year , I have Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0