- Freeradius-Users - lists.freeradius.org

static IP's with rlm_perl
by Michael Gale 20 Oct '06

20 Oct '06

Hello, I am trying to set static IP addresses for clients I have authenticated via radius with my rlm_perl module. I am trying the following as a test but it is not working: --snip-- $RAD_CHECK{'NT-Password'} = $pass; $RAD_REPLY{'Framed-IP-Address'} = '192.168.77.200'; $RAD_REPLY{'Framed-Netmask'}= '255.255.255.255'; $RAD_REPLY{'Framed-Protocol'} = 'PPP'; $RAD_REPLY{'Service-Type'} = 'Framed-User'; --snip-- Any help would be great full. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 6

RE: static IP's with rlm_perl
by Garber, Neal 20 Oct '06

20 Oct '06

> $RAD_REPLY{'Framed-IP-Address'} = '192.168.77.200'; Perhaps the problem is that your are assigning a string to an attribute of type ipaddr (look in /usr/local/share/freeradius/dictionary.rfc2865)?

1 0

rlm_perl and checking request status in post-proxy
by Pshem Kowalczyk 20 Oct '06

20 Oct '06

Hi, I have a simple question - is it possible to check the status of request (Accept/Reject) in a post-proxy phase using rlm_perl? And if so - how? kind regards pshemko

2 1

Re: Pam radius authentication
by danieldinu＠rdslink.ro 20 Oct '06

20 Oct '06

Isn't there anyone who tried this implementation? > >Hi! >if you are reffering to this line: >"account required pam_radius_auth.so debug" >than here is the explanation: > "The pam configuration can be: >... >auth sufficient /lib/security/pam_radius_auth.so [options] >... >account sufficient /lib/security/pam_radius_auth.so" > (this is taken from http://www.freeradius.org/pam_radius_auth/USAGE) > >On the other hand, I don't care if I don't use this module for accounting. As a matter of fact, I tried in many configurations, even without using it for accounting. >The main concern is to succed in authetincating the users!!! if anyone can help me accomplish that, I would be happy and I will not mind about accounting... > > > > >> >>Hi, >> >>> I don't understand why you are saying that "you are invoking pam_radius_auth in the wrong place and for the wrong reason"...please, be more specific and if you know the right configuration, enlight me! >>> >>> >> >#%PAM-1.0 >>> >> >auth required pam_securetty.so >>> >> >auth sufficient pam_radius_auth.so debug >>> >> >auth required /lib/security/pam_unix_auth.so >>> >> >account required pam_radius_auth.so debug >> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> >>explain >> >>alan >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Rewrite Attribute when proxy the specific realm
by Rio Yang 20 Oct '06

20 Oct '06

Hi, I have tried attr_rewrite function to rewrite attribute value on specific attribute successfully. But now, I want to rewrite to attribute that proxy to specific realm. For example, When the AUTH proxy the realm "abc.com". I wanna to rewrite the attribute "NAS-Identifier" value into new one. Could somebody know to how configure it? Thanks. Rio

2 3

Difference between radiusd-cistron and freeradius?
by Jan Mulders 20 Oct '06

20 Oct '06

Hello, I'm currently trying to get hold of a CVS snapshot of the latest FreeRADIUS build - but I'm having some real trouble. I've tried looking in the cvs-snapshots subfolder, and found: radiusd-cistron-1.6-snapshot-20061019.tar.gz Is this freeradius? I would like the new functionality that allows me to write to the RAD_CHECK hash from rlm_perl, that's the only reason I want to use CVS. When I attempt to connect to CVS, I get the following: root@betabitch [~/installs/radiusd-cvs]# cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login Logging in to :pserver:anoncvs@cvs.freeradius.org:2401/source CVS password: root@betabitch [~/installs/radiusd-cvs]# cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd ....upon which point it sits there doing nothing for about 20 minutes. I presume this is not normal CVS behaviour? Where do I get the correct CVS snapshot for freeradius? I apologise, this is probably very obvious but I've been trying all day to figure out why the snapshot I had downloaded (see top of email) doesn't read from config files, or accept the radiusd -X switch... Regards, Jan

2 2

Inserting and/or replacing reply attributes on a proxy request
by Jarrod Sayers 19 Oct '06

19 Oct '06

Hi, I have a FreeRADIUS 1.1.2 box which its only job in life is to proxy requests based on realms, i.e., no local authentication is done. One of the realms is internal to the organisation (lets call that internal.org.com.au) and I trust the variables being returned, however I have no control over one external realm (lets call that some.other.org.net.au) and the default realm. The FreeRADIUS box is used to proxy wireless requests which relies on the following variables to dump users into their particular tunnel groups: Tunnel-Type:1 => VLAN Tunnel-Medium-Type:1 => IEEE-802 Tunnel-Private-Group-Id:1 => 1234 What I am trying to accomplish is to have replies from a certain realm forced to be returned with set values either adding them in if they are missing, or replacing them is they are not the same. So, if the request is proxied to a trusted source then don't alter the reply, though if its proxied to an external realm, force the Tunnel- Private-Group-Id:1 attribute to be 1234, yet if its proxied to the default realm, use 4321 instead. I had a go at this using the exec clause and had some success in adding variables if they didn't exist in the reply, but it wouldn't replace existing ones: modules { ... exec vlan_assignment { wait = yes program = ${confdir}/vlan.sh input_pairs = proxy-request output_pairs = proxy-reply packet_type = Access-Accept } } post-proxy { vlan_assignment ... } The associated script that it ran: fruitbox# cat vlan.sh #!/bin/sh # Set defaults. TunnelType="VLAN" TunnelMediumType="IEEE-802" TunnelPrivateGroupId="200" # Only alter Wireless-802.11 requests. if [ "${NAS_PORT_TYPE}" = "Wireless-802.11" -a "${REALM}" != "internal.org.com.au" ]; then # Determine VLAN to be used. if [ "${REALM}" = "some.other.org.net.au" ]; then # Force user into specific tunnel group. TunnelPrivateGroupId="1234" elif [ "${REALM}" = "DEFAULT" ]; then # Force user into specific tunnel group. TunnelPrivateGroupId="4321" fi # Return actual VLAN assignment. echo "Tunnel-Type:1 = ${TunnelType}" echo "Tunnel-Medium-Type:1 = ${TunnelMediumType}" echo "Tunnel-Private-Group-Id:1 = \"${TunnelPrivateGroupId}\"" fi exit 0 fruitbox# Allowing these variables to pass though from untrusted sources may allow a user to be placed in another organisations tunnel group which I cannot allow. Any help or ideas appreciated :) Jarrod.

6 11

Privelege Level with Different Manufacturers
by Maestro_Ba 19 Oct '06

19 Oct '06

Hi, I've been using freeradius for a while, for authentication in a network of cisco devices. All my users follow this pattern: </etc/raddb/users> user1 Auth-Type := System Service-Type = Shell-User, cisco-avpair = "shell:priv-lvl=15" However, now I have other manufacturers' devices in my network, namely Alcatel, Enterasys and Nortel. I want this user to be able to authenticate in any device, and with high privilege levels, if possible. As it is right now, an error occurs in non-cisco equipment (because of "cisco-avpair"). Can anyone tell me: 1 - How to configure </etc/raddb/users> file? 2 - How to configure the different devices? Thanks a lot, any information will be very helpful! Maestro_Ba -- View this message in context: http://www.nabble.com/Privelege-Level-with-Different-Manufacturers-tf247300… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Duplicate accounting packets
by John Williams 19 Oct '06

19 Oct '06

Why would I see more than one start entry in the radacct table for a user all with the same session id? +-----------------+-----------+---------------------+---------------------+ | UserName | AccStatus | AcctStartTime | AcctStopTime | +-----------------+-----------+---------------------+---------------------+ | rpascoe@online | Start | 2006-10-13 12:39:08 | 0000-00-00 00:00:00 | | rpascoe@online | Start | 2006-10-13 12:39:15 | 0000-00-00 00:00:00 | | rpascoe@online | Start | 2006-10-13 12:39:22 | 0000-00-00 00:00:00 | | rpascoe@online | Start | 2006-10-13 12:39:30 | 0000-00-00 00:00:00 | | rpascoe@online | Start | 2006-10-13 12:39:37 | 0000-00-00 00:00:00 | Normally I wouldn't worry about it but I'm trying to script something that will show each users stats, time online, octets in/out etc. But having more than one start entry without a stop time for each is going to be a problem. Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.0.408 / Virus Database: 268.13.3/473 - Release Date: 12/10/2006

2 1

SNMP with Freeradius - Again
by Velikanov 19 Oct '06

19 Oct '06

I want to use SNMP with Freeradius. NOW, after some work, I have: 1.FreeRADIUS Version 1.1.3, for host, configured with option '-with-snmp' Now I see in src/include/autoconf.h: /* Include SNMP subagent */ #define WITH_SNMP 1 #define HAVE_UCD_SNMP_ASN1_SNMP_SNMPIMPL_H 1 /* #undef HAVE_ASN1_SNMP_SNMPIMPL_H */ #define HAVE_LIBSNMP 1 All other rest the same 2.Red Hat Linux v.3.3; 2.6.9-34.EL 3.net-snmp-5.1.2-11.EL4.6 configured with option '--with-mib-modules=host agentx smux ucd-snmp/lmSensors' radiusd.conf, snmp.conf, snmpd.conf - where configured as in docs and in http://wiki.freeradius.org/SNMP_HOWTO when I run /usr/local/sbin/radiusd -X And NOW, again, there are no strings with "smux", as shown in wiki Where is my mistake? What must I looking for? Thanks.

2 1