- Freeradius-Users - lists.freeradius.org

RE: Assign IP based on CallingStationID.
by John Longland 09 Nov '06

09 Nov '06

Here is the query that I put into sql.conf Maybe use it and build on it for your specific example ?? authorize_check_query = "select id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE UserName in (select UserName from ${authcheck_table} WHERE Value = '%{Calling-Station-ID}') ORDER BY id" John -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of banga Sent: 08 November 2006 15:14 To: freeradius-users(a)lists.freeradius.org Subject: Assign IP based on CallingStationID. I use dafault table-layout. How I understand you just change username authentication to callingstationid authentication inside sql.conf. Thx, it’s really good idea. I think that I could do the same by myself, but it will take a time. Therefore any examples will be very useful. Can you post it here? If It’s too big you can send it to me - “nebula-at-inbox-lv”. >From other side, I need username/password authentication also (for other users) therefore it will be difficult to implement this ( may be I’ll install another freeradius specially for that). In my situation radius for some users check username/password, for other users it should do the next: check username/password/callingstationid (in fact username and password always the same) if callingstationid has specific value (can be dosen specifc callingstationid_s) then replay accept and some specific IP for each specific callingstationid or just assign ip from radius pool. if callingstationid is not in the list of “specific callingstationid” then just replay accept and NAS will assign ip from equipment’s IP pool Main Idea: For now most users has the same username and password and it is not possible to change anything in that. Some callingstationid is not friendly for my network (they should have only http traffic). That’s why I want to assign them IP from specific pool – I going to setup firewall rules for a such IPs. Any idea ? John Longland wrote: > > Yes, I have just done it. > > You need to change the sql-statement in /etc/raddb/sql.conf > > That is the > autorize_check_query.Depending on how you use your tables, the query > that I am using may or may not work. If you want I can give you the > one that works for me if you supply your table-layout. > > JOhn > P.S> The statement I use does NOT check username/password !!! > > -----Original Message----- > From: > freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. > org]On Behalf Of banga > Sent: 08 November 2006 11:37 > To: freeradius-users(a)lists.freeradius.org > Subject: Assign IP based on CallingStationID. > > > > Hello all. > I use freeradius ver. 1.1.1 + mysql. > I use same login/password for couple of users but they has different > callingstationid. > Is it possible to check callingstationid and asiighn IP based on it? > Do I need to create some additional tables in mysql for that? > > Thx. > > -- > View this message in context: > http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 > 235317 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 238235 Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: Assign IP based on CallingStationID.
by John Longland 09 Nov '06

09 Nov '06

Yes, I have just done it. You need to change the sql-statement in /etc/raddb/sql.conf That is the autorize_check_query.Depending on how you use your tables, the query that I am using may or may not work. If you want I can give you the one that works for me if you supply your table-layout. JOhn P.S> The statement I use does NOT check username/password !!! -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of banga Sent: 08 November 2006 11:37 To: freeradius-users(a)lists.freeradius.org Subject: Assign IP based on CallingStationID. Hello all. I use freeradius ver. 1.1.1 + mysql. I use same login/password for couple of users but they has different callingstationid. Is it possible to check callingstationid and asiighn IP based on it? Do I need to create some additional tables in mysql for that? Thx. -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 235317 Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

how to NOT expand varaibles in a sql-query
by info＠w3welt.de 08 Nov '06

08 Nov '06

Hello, i need to pass the string '%d %b %Y %T' inside a query to mysql (as a date format). Unfortunately this gets expanded to '07 0 2006 2006-11-07-00.06.18.000000' which leads to an sql error and crashes freeradius with a segmentation fault. I found a post from Nicolas Baradakis who advises to double the percentage-signs. I tried this too, but this creates a string like this '%0d %0b %0Y %0T' which again leads to a sql error (but without crash) How can i pass this string literaly without any variable-substitution? I'm running "FreeRADIUS Version 1.0.0" Thanks in advance for your help... Yours Olaf Kolling -- ******************************************************************** W³Welt Web-Entwicklung -------------------------------------------------------------------- Olaf Kolling eMail: info#w3welt.de Mörikestraße 67 Tel.: +49 711 96666-200 70199 Stuttgart Fax: +49 711 96666-201 ********************************************************************

1 0

Windows-Domain login without local users
by Michael Messner 08 Nov '06

08 Nov '06

hey freeRADIUS users, PEAP auth. works now with *X and MS-clients, the backend is a freeradius server on centOS with active directory connection. Now, the user needs a local account to login to the clientmachine and then he is able to start the PEAP authentication process. A local login for every user is a big overhead! What is the normal way to handle this? thanks ca mIke

2 3

Assign IP based on CallingStationID.
by banga 08 Nov '06

08 Nov '06

Hello all. I use freeradius ver. 1.1.1 + mysql. I use same login/password for couple of users but they has different callingstationid. Is it possible to check callingstationid and asiighn IP based on it? Do I need to create some additional tables in mysql for that? Thx. -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

(no subject)
by Mike May 07 Nov '06

07 Nov '06

"Mike May" <mmay3(a)nd.edu> wrote: > Hello everyone, is it possible to have NAS entries for a subnet, if so > could someone give me an example raddb/clients.conf Alan DeKok. -- http://deployingradius.com <http://deployingradius.com/> - The web site of the book http://deployingradius.com/blog/ - The blog Thanks for example Alan, I thought it may be helpful for me to provide you some more information, I am not a Radius expert but have managed to keep a somewhat large client base using radius. I currently use the clients file to allow connections, but not to do any real authorization. Example of my clients file is below, this is only a small section as my radius servers handles modem pool, vpn, wireless, 802.1x etc and soon wired 802.1x. I use LDAP/ Kerberos as the authn backend I use huntgroup entries to point to matches in my users file see examples below. in the users file is where I am using ldaps.conf to connect to the directory servers, verifying what group the user is in and at the end authn to Kerberos store. After the authn I set some authz like Cisco-AVPair = "priv-lvl=15" used by Cisco routers and switches for network engineers who live in the proper LDAP group, here is where the problem is. PIX firewalls do not like me setting the priv lvl, and the reason is that the PIX will only accept authz from a tacacs server(it seems like). What I need to do is specify a "netauth" == NAS-IP-ADDRESS 192.168.20.0/23 subnet. Instead of "netauth" == NAS-IP-ADDRESS 192.168.20.15, this way I can use my users file and not set the Cisco priv lvl for those devices that live on the firewall subnets. Thank you for all your help Mike ========= clients.conf============================= #This are for network engineering devices (outside wireless and dialup) # 2/20/06 client 172.16.255.2/29 { secret shortname = devicenet-15 } client 172.16.240.0/20 { secret = shortname = devicenet-16 } client 172.17.240.0/20 { secret = shortname = devicenet-17 } client 172.18.240.0/20 { secret = shortname = devicenet-18 } client 172.19.240.0/20 { secret = shortname = devicenet-19 } client 172.20.240.0/20 { secret = shortname = devicenet-20 } client 172.21.240.0/20 { secret = shortname = devicenet-21 } client 172.22.240.0/20 { secret = shortname = devicenet-22 Huntgroups wireless-prime NAS-IP-Address == xxx.xxx.xxx.xxx wireless-backup NAS-IP-Address == xxx.xxx.xxx.xxx spam1 NAS-IP-Address == xxx.xxx.xxx.xxx spam2 NAS-IP-Address == xxx.xxx.xxx.xxx ciscovpnadmin NAS-IP-Address == xxx.xxx.xxx.xxx dialup8 NAS-IP-Address == xxx.xxx.xxx.xxx ciscovpnadmin2 NAS-IP-Address == xxx.xxx.xxx.xxx dialup9 NAS-IP-Address == xxx.xxx.xxx.xxx dialup10 NAS-IP-Address == xxx.xxx.xxx.xxx netautz NAS-Port-Type == "Virtual" netautz_fw NAS-IP-Address == xxxx netautz_fw1 NAS-IP-Address == xxxxx =================================================== Users file DEFAULT Huntgroup-Name == "netautz", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Cisco-AVPair = "priv-lvl=15", Fall-Through = Yes DEFAULT Huntgroup-Name == "netautz_fw", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes DEFAULT Huntgroup-Name == "netautz_fw1", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes # VPN Group Definition note please make additions at the begining of the stanza not the end DEFAULT Huntgroup-Name == "ciscovpnadmin", Hint =="NETENG", Ldap-Group == ndbx2jj5, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn CVPN3000-IPSec-Banner1 = "Welcome to VPN group NETENG!", Class = "OU=neteng;", Fall-Through = No

2 1

password header in ldap definition
by basile 07 Nov '06

07 Nov '06

hi is it possible to have multiple password header definition in an ldap section ( because we have differents encryption in our ldap directory ) thanks basile

2 1

multiline line values for Cisco-AVPair (in ldap.attrmap)
by Peter Param 07 Nov '06

07 Nov '06

hey, I've got Cisco-AVPair for an ldap.attrmap entry and it works ...but unfortunately only for the first occurence of that attribute from the LDAP schema (it will pick the first in the schema). How do I map and return four Cisco-AVPair entries? Is there a particular multiline separator that I should use ...or do I use the attribute re-entrantly? The device in question is a Cisco VPN3000 concentrator and I'm running ver 1.1.1 freeradius. cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Re: Failed to link EAP type EAP/TLS
by Chad Best 07 Nov '06

07 Nov '06

Alan DeKok <aland(a)deployingradius.com> wrote: > The TLS module wasn't built because you don't > have > OpenSSL > installed. (Or you're running debian). Install > OpenSSL, then > re-build and re-install the server. Thanks Alan. You are right, I am running Debian(Ubuntu). I checked and OpenSSL is installed. OpenSSL and Freeradius have both been installed with the Synaptic package manager. Is there anything else I can do? Any help would be greatly appreciated.

4 3

Multiple LDAP (Not failover) lookup...
by Eric Martell 07 Nov '06

07 Nov '06

Hi... I need to do multiple ldap lookups (2).. The purpose of both the ldaps are different so it does not abide with configurable_failover scenario in a way. ldap1. This ldap is solely used for authentication for given user. ldap2. This ldap is solely used for checking ldap attribute ex. productCode for given user. User exists in BOTH The ldaps but in ldap2 we don't store the password hash. So its just userid with given attributes. Here is what should happen for a given user. If(authentication in ldap1 success) { if(productCode attribute exists in ldap2 success) { return Access-Accept. } else { return Access-Reject. } } else { return Access-Reject. } Any inputs will be greatly appreciated. Thanks in advance. ____________________________________________________________________________________ Sponsored Link Try Netflix today! With plans starting at only $5.99 a month what are you waiting for? http://www.netflix.com/Signup?mqso=80010030

1 0