- Freeradius-Users - lists.freeradius.org

rewriting usernames
by Christopher Carver 21 Nov '06

21 Nov '06

Hello, How do I rewrite the value of the User-Name attribute based on Called-Station-Id? I need to do a series of these logical decisions and replace the username with username@<some-isp.com> based on what the value of Called-Station-Id is. rlm_attr_rewrite seems the obvious choice, but I can't figure out how to use various instances of that module only when Called-Station-Id has a certain value. It seems like a strange thing to need to do, but I've thought about our problem and this is really the only scalable way. I can give a lot of background as to why, but I figured I would ask the question first. So, does anyone have any ideas? Also, thank you for all the hard work on Freeradius. Its a great piece of software. Thanks Chris Carver

4 9

Filtering strange character sequences out of usernames
by Barry A Byrne 21 Nov '06

21 Nov '06

Hello The user names arriving at Freeradius from the server has strange character sequences in them. For instance, the user's realm starts with =3D28 Is there a way of filtering out or converting these sequences to something human-readable? Thank you Barry Barry A Byrne Network Applications and Public Services Cable & Wireless Direct Dial: +44 (0) 1344 812046 Mobile: +44 (0) 7900 164 620 Switchboard: +44 (0) 20 7206 5555 <http://www.cw.com/> www.cw.com

2 1

LDAP and SQL
by Tobias Hug 21 Nov '06

21 Nov '06

I'm authenticating wireless users with freeradius against an os x ldap server. This works all well. But I also want to check if the device (mac address) is allowed to connect. How do I configure Freeradius to Authenticate Users against ldap and check the mac address in an SQL-Database? Thanks Tobias

2 1

distinction between users on different AP (talking to the same radius server)
by liran tal 21 Nov '06

21 Nov '06

Hey everyone, I was just wondering for your opinion on this issue- I want to spread several access points in different locations (they all talk to a central radius) and then i want to distinct one location from another for example user foo can login from either location but id like to make the distinction from which ap he got connected from... whats the best way to do that? I was thinking of one method which is to configure in each AP a different subnet mask for the DHCP allocations and then make the distinction based on that but I'm looking for a more elegant way. Thanks guys, Liran.

3 5

Re: huntgroups question
by Michael Mitchell 21 Nov '06

21 Nov '06

Frank Cusack wrote: > On November 21, 2006 8:48:30 AM +1100 Michael Mitchell wrote: > >> >> dial Client-IP-Address =~ 192.168.1..* >> dsl Client-IP-Address =~ 192.168.2..* > > > > warning, the first of those captures 100 /24's, the second 56 /24's. > Ahh yes, so it does. Thanks for pointing that out Frank! But the example still stands, you can do regular expressions in the huntgroups file - just be careful with your regular expressions. :) cheers, Mike

1 0

Re: huntgroups question
by Michael Mitchell 21 Nov '06

21 Nov '06

Alexandru Dincov wrote: > knows if there are any limitations in huntgroups size? Are there other > solutions to have huntgroups functionality (access control based on > NAS-IP-Address or Client-IP-Address) using IP address ranges? Hi Alex, You can do regular expression matches in the huntgroups file. For example: dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..* Maybe that can get you close to what you want? Oh and by the way, these types of questions should be asked on the FreeRADIUS Users list. cheers, Mike

2 1

multiple entries with same user name in radcheck table
by Sri 21 Nov '06

21 Nov '06

Hi List, Happy Thanks Giving, I need to add two users with same name, from different NASes/stations. I added the two groups for them in usergroup and corresponding entries in radcheck and radreply tables. So they look like this: usergroup: ----------------------------------- 1 Ronrobert dialup 2 Ronrobert conference ----------------------------------- radcheck ---------------------------------------- 1 Ronrobert Password == value 2 Ronrobert Password == value2 ---------------------------------------- radreply --------------------------------------------- 1 Ronrobert Reply-Message := value1 2 Ronrobert Reply-Message := value2 . . . ---------------------------------------------- But the authentication failed for both users as FR not able identify which user to consider? Can anybody pls tell me any way to address this problem? Thanks in advance. ____________________________________________________________________________________ Sponsored Link $200,000 mortgage for $660/ mo - 30/15 yr fixed, reduce debt - http://yahoo.ratemarketplace.com

1 0

Re: huntgroups question
by Alan DeKok 20 Nov '06

20 Nov '06

Frank Cusack wrote: ... >> dial Client-IP-Address =~ 192.168.1..* >> dsl Client-IP-Address =~ 192.168.2..* > > warning, the first of those captures 100 /24's, the second 56 /24's. dial Client-IP-Address =~ '192\.168\.1\..*' The backslashes can make a big difference. And note the single quotes, too. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Help needed on FreeRadius SQLCounter
by sagar.patil＠bt.com 20 Nov '06

20 Nov '06

Hi All, I have got sqlcounters working with mysql database. I want to sell 15 mins, 30 mins, 1 hour, 2 hour vouchers and I want Freeradius to lock all users who even use 1 min of their voucher time every 24 hours. The vouchers are valid only for 24 hours after logging into network first time. The current options for reset= never & daily which don't work for me. Daily= Will reset midnight and allow user to login next day Never = Will allow user to use time forever until he exceeds "session-timeout" value. Thanks, Sagar

3 2

huntgroups question
by Alexandru Dincov 20 Nov '06

20 Nov '06

Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks, Alex

2 1