- Freeradius-Users - lists.freeradius.org

Status of my book
by Alan DeKok 02 Jan '07

02 Jan '07

It's January, so the book obviously hasn't met my target of being finished by December. The good news is that I have over 100 pages of content, and I recently entered an agreement with a partner that will give me access to additional networking equipment, which should help expand the content to include configuration for many common clients. However, I'm in the middle of moving 6000 km, so I'm a little busy. I expect to be able to start working on the book again in a month or so. Thanks to everyone who's emailed to inquire about the book, or offer help. That has given me incentive to push hard to finish it ASAP. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 1

radiusd command line parameters?
by Eduardo Costa Lisboa 02 Jan '07

02 Jan '07

Hi all. I would like to know where can I find a list of the parameters used by radiusd. I looked all over the wiki FAQ and the documentation under /usr/share/doc/freeradius-1.0.1 and couldn't find any mention to it. Attentiously, -- Eduardo Costa Lisboa

2 2

How to restrict users /PAM to specific NAS devices??
by Ellis, Scott 1 (N-Comptel Inc.) 02 Jan '07

02 Jan '07

I am using PAM for Auth-Type. I want to be able to either 1) restrict the devices the user has access to (admins,operators, etc) by username and/or 2) preferably carve into groups my network gear/NAS devices and then assign users to groups. Simply put, I would like to know what I have to do for user1 and user2 that auth via PAM to limit the NAS/Network gear they are allowed to access/authenticate against....I am looking for one straight for example. I would like user1 to be able to access device 10.1.1.1 and user2 to be able to access 10.1.1.2 and 10.1.1.3 and 10.1.1.4..... Thanks, Scott

2 1

Radrelay: Zero Session length packets
by Etienne Pretorius 02 Jan '07

02 Jan '07

Hello everyone. I've been going a bit mad on this subject for a while. I am receiving proxied requests from my upstream provider and I am also doing authentication locally. The issue I've been experiencing has to do with this error handed to me from my upstream provider : Tue Jan 2 09:47:05 2007 : Error: rlm_sql: Stop packet with zero session length. (user 'celliott@<snip>', nas 'XXX.XXX.XXX.XXX') It seems that this is always the second ISDN connection that has its session time set to zero. Thu Dec 21 23:08:02 2006 Acct-Session-Id = "00009F8B" Framed-Protocol = PPP Acct-Authentic = RADIUS X-Ascend-Connect-Progress = Call-Up X-Ascend-PreSession-Time = 1 X-Ascend-Xmit-Rate = 64000 X-Ascend-Data-Rate = 64000 Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 X-Ascend-Pre-Input-Octets = 233 X-Ascend-Pre-Output-Octets = 102 Acct-Input-Packets = 0 Acct-Output-Packets = 0 X-Ascend-Pre-Input-Packets = 6 X-Ascend-Pre-Output-Packets = 4 Acct-Terminate-Cause = Port-Unneeded X-Ascend-Disconnect-Cause = No-Reason Acct-Status-Type = Stop User-Name = "celliott@<cut>" Acct-Multi-Session-Id = "00005D0F" X-Ascend-Multilink-ID = 23823 Acct-Link-Count = 2 X-Ascend-Num-In-Multilink = 2 Framed-IP-Address = XXX.XXX.XXX.XXX NAS-Port = 20423 NAS-Port-Id = "Serial7/4:23" NAS-Port-Type = ISDN Calling-Station-Id = "0217624546" Connect-Info = "64000 HDLC" Called-Station-Id = "0000" Service-Type = Framed-User NAS-IP-Address = XXX.XXX.XXX.XXX Acct-Delay-Time = 30 Vendor-1431-Attr-1 = 0x4449414c Proxy-State = 0x3936 Client-IP-Address = QQQ.QQQ.QQQ.QQQ Hint = "KING" Acct-Unique-Session-Id = "2b29fa83d47585d9" Timestamp = 1166735282 What I would like, is to avoid radrelay for those packets as it only jams up the radrelay queue when this happens while the logging to sql works. The config below is insuffiecient as this is what leads me up to a radrelay jam. [root@CCCCC:/var/log/freeradius/radacct] ls -hal total 6.4M drwxr-xr-x 2 freerad freerad 120 2006-12-21 23:08 . drwxr-xr-x 3 freerad freerad 872 2006-12-31 06:30 .. -rw------- 1 freerad freerad 6.3M 2007-01-02 08:45 detail-radrelay -rw------- 1 freerad freerad 1.2K 2006-12-21 23:08 detail-radrelay.work BTW is there a way to specify an OR / AND operator below for acct_users? So that I can say something like DEFAULT [ Client-IP-Address == "XXX.XXX.XXX.XXX" || Client-IP-Address == "YYY.YYY.YYY.YYY" || Client-IP-Address == "ZZZ.ZZZ.ZZZ.ZZZ" && Acct-Session-Time == "0" ] , Acct-type := "REMOTE-AUTH" *acct_users* # Do not radrelay these packets: DEFAULT Acct-Session-Time == "0", Acct-type := "REMOTE-AUTH" # This Configuration prevents Accouting loops of a two-way radrelay sync # [o] Radrelay must be sending accounting info from IP(s) below # on the other Radius server(s) DEFAULT Client-IP-Address == "XXX.XXX.XXX.XXX", Acct-type := "REMOTE-AUTH" DEFAULT Client-IP-Address == "YYY.YYY.YYY.YYY", Acct-type := "REMOTE-AUTH" DEFAULT Client-IP-Address == "ZZZ.ZZZ.ZZZ.ZZZ", Acct-type := "REMOTE-AUTH" # Everyone else must still be radrelay'ed DEFAULT Acct-type := "LOCAL-AUTH" *radiusd.conf* accounting { # 2006-09-27: EPP # If Acct-Type is LOCAL-AUTH then log to sql module AND to detail file # for radrelay - accounting sync daemon Acct-Type LOCAL-AUTH { radrelay sql } # 2006-11-24: EPP # If accounting packet is from one of our other radius servers, then # just log it to sql...otherwise we will end up with an Accouting packet # storm/loop. Acct-Type REMOTE-AUTH { sql } [snip...] -- Kind Regards Etienne

2 1

RE: problem with NT-Password and LDAP
by Ana Gallardo Gómez 02 Jan '07

02 Jan '07

---------------------------------------- > Date: Thu, 28 Dec 2006 08:44:22 -0800 > From: aland(a)deployingradius.com > To: freeradius-users(a)lists.freeradius.org > Subject: Re: problem with NT-Password and LDAP > > Ana Gallardo Gómez wrote: > > > Well, I can not modify the LDAP server, I only can use it, > > so, while I ask the LDAP administrator to modify this atribute, > > I would like to modify in Freeradius server. > > OK, use the "perl" module to re-write the attribute. There is an > "example.pl" distributed with the server that should be a good start. > > Alan DeKok. > -- I'm goint to use the "perl" module, but first, and while I learn to use it, I probed the attr_rewrite module: attr_rewrite quitar_espacios { attribute = NT-Password # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = config searchfor = " " replacewith = "" ignore_case = no new_attribute = no max_matches = 220 ## If set to yes then the replace string will be appended to the original string append = no } I don't know if I can use regular expressions in "searcfor" field, and, in this case, what is the regular expressions grammar; or if is better with "max_matches = 220 and searchfor = " ""... I use this module in authorize section: authorize { preprocess suffix files Autz-Type LDAP_LOCAL{ ldap_local } Autz-Type LDAP_UNEX_ES{ ldap_unex_es quitar_espacios } mschap eap } and I can authenticate users: rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_unex_es" returns ok for request 7 radius_xlat: ' ' rlm_attr_rewrite: Changed value for attribute NT-Password from '06B11E3D941021E1A5C51C6868F2F0E6 ' to '06B11E3D941021E1A5C51C6868F2F0E6' modcall[authorize]: module "quitar_espacios" returns ok for request 7 modcall: leaving group LDAP_UNEX_ES (returns ok) for request 7 Thank you _________________________________________________________________ ¡Ya está aquí Windows Live Spaces! Ahora podrás crear fácilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

1 0

About modules rlm_eap_peap , rlm_eap_tls....
by adreas Polyxronopoulos 31 Dec '06

31 Dec '06

Hi everyone , I am trying to set up freeradius-1.1.3 for a wlan using peap - eap/mschapv2. I have downloaded the source of freeradius-1.1.3 and compile it (./configure , make , make install) . I am using a guide for setting-up freeradius-1.0.2 . The guide after compiling the source of freeradius-1.0.2 it builds 2 modules ( rlm_eap_peap , rlm_eap_tls). My question is : Do i have to do this in freeradius-1.1.3 source version after i compile it ? Or these modules are build from the top level compile ? thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Help with peap-eap/mschapv2
by adreas Polyxronopoulos 30 Dec '06

30 Dec '06

Hi everyone Merry Christmas and a Happy new year , I have Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

dailup admin and badusers
by jerrrry＠voila.fr 30 Dec '06

30 Dec '06

hi, i don't understand why dialup admin need its own sql table "badusers" and a script to get bad logins whereas rejected users can be found in the freeradius table "radpostauth" ? Regards, Thomas

3 2

Possible to define range of users?
by Ran Shenhar 29 Dec '06

29 Dec '06

Hi All, I was wondering if the users file can hold some definition for a group of users, for example users with IP 192.168.1.*? I've seen the group example (http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_spec ific_user.2C_or_group_of_users.3F), but didn't understand if that also helps to my case. I've also seen http://www.freeradius.org/doc/users.5.html and the =~ for regex, but trying to use that with a User-Name attribute (User-Name =~ 10.100.0.*, Auth-Type := Local, User-Password == "my pass"), the config file couldn't be parsed, with this message: /usr/local/etc/raddb/users-grande-ATM[1]: Parse error (check) for entry User-Name: expecting '=' /usr/local/etc/raddb/users[6]: Could not open included file /usr/local/etc/raddb/users-grande-ATM: Success Errors reading /usr/local/etc/raddb/users radiusd.conf[1035]: files: Module instantiation failed. Am I missing something here, or is this not supported? TIA,

1 0

Repost: Properly using the := and = operators?
by Mike 29 Dec '06

29 Dec '06

Dear list, I'm having a hard time learning how to use the attribute properties correctly in my mysql/radius database and my test enviroment is freeradius 1.1.3 / debian etch. What I'm trying to do is to establish a 'suspended' user group which receives a Framed-IP-Address attribute of 10.10.0.2+, and which overrides any previously assigned Famed-IP-Address, if present. I know that group processing is happening, because I can add attributes to the suspended group and my test user gets those attributes. I am adding the Framed-IP-Address attribute in the radreply table, but it is not being overwritten from the one set by radgroupreply. If I remove this from radreply, then the ip assigned in suspended group is applied. If I change the one in radgroupreply to use the += operator, then it returns both ip addresses in the reply. But I can't seem to get := to overwrite like the docs says it does. Here is a dump of my sample sql tables: mysql> select * from radcheck ; +----+----------+---------------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-----------------+ | 2 | joe.user | User-Password | == | ididntpaymybill | +----+----------+---------------+----+-----------------+ mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup ; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupcheck ; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 3 | dynamic | Framed-Protocol | == | PPP | | 4 | suspended | Framed-Protocol | == | PPP | +----+-----------+-----------------+----+-------+ mysql> select * from radgroupreply ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ | | 7 | dynamic | Framed-IP-Address | := | 255.255.255.255 | +----+-----------+-------------------+----+-----------------+ Here is the results of running radtest on this user: > radtest joe.user ididntpaymybill localhost 0 testing123 Sending Access-Request of id 140 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=140, length=32 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255 What I am trying to accomplish is simply to allow us to put overdue users into the 'suspended' group, which will hand out a different set of ip addresses than their normal non-suspended configuration. I realise I could be approaching this all wrong but right now I simply set those items (framed-ip-address, framed-route, and etc) in the radreply table and I don't want to remove those items from the database, just override them. Any pointers would be greatly appreciated. Mike- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 3