- Freeradius-Users - lists.freeradius.org

checking attributes in MySQL 'radgroupcheck'?
by Jan Mulders 08 Oct '06

08 Oct '06

Hello, I'm trying to assign users a different speed of service based on how much data they've used on the service. I found the following in the experimental.conf information on sqlcounter: # # DEFAULT Max-Daily-Session > 3600, Auth-Type = Reject # Reply-Message = "You've used up more than one hour today" # How do I do a similar thing in MySQL? There aren't enough fields to do this. Am I overlooking something, or is this not actually possible? Regards, Jan

1 0

Prevent certain ip ranges from accounting
by Van Der Westhuizen, Eldridge (Mr) (Summerstrand Campus North) 07 Oct '06

07 Oct '06

Hi I'm busy setting up a community network. I'm using freeradius and mysql to authenticate users and do accounting. After the users authenticated to the freeradius system, i only want to do accounting for any internet services. All the free community services, like local chatting within the community network, local voice over ip, etc, should not be billed. All of this traffic will flow between the local network on a class B range. Is it possible to exclude this range from accounting on the radius system and only do accounting for any other ip address (to only bill actual internet traffic) ? Thanks NOTICE: Please note that this eMail, and the contents thereof, is subject to the standard NMMU eMail disclaimer which may be found at: <http://www.nmmu.ac.za/disclaimer/email.htm>> NOTICE: Please note that this eMail, and the contents thereof, is subject to the standard NMMU eMail disclaimer which may be found at: http://www.nmmu.ac.za/disclaimer/email.htm

3 2

Called-Station-ID and Cisco AP's
by Walter Reynolds 07 Oct '06

07 Oct '06

I am just starting looking into this, but it seems that the Called-Station-ID being logged from my Cisco AP's is off: What I see in the log is the following: Called-Station-Id = "0017.0f8c.25c1" However, the cisco itself shows something slightly different: Mac Address 0017.0f8c.25c0 As you can see, the last digit is off. This is not the only one. Another example.... Called-Station-Id = "0013.6078.7661" MAC Address 00:13:60:78:76:60 The only other system I have on the system (Bluesocket) does not have this discrepancy. I have searched through the archives, but trying to limit search by Called-Station-Id and cisco does not help a lot. Have others seen/noticed this before? If so any pointers to information on it? If not, can anyone else look and see if they are having a similar issue? Here is the information on AP Cisco Aironet 1200 IOS Firmware: 12.3(8)JA2 Using FreeRadius 1.1.2 The only conf file that even mentioned called station ID (that I am using) is radiusd.conf. Here is the subsection #attr_rewrite sanecallerid { # attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" # searchin = packet # searchfor = "[+ ]" # replacewith = "" # ignore_case = no # new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended # to the original string # append = no #} As it is commented out I do not see that it could be the issue. If you want any conf files let me know, I just did not want to clog up the message with lots of conf info that is not useful. Thanks to all. -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438

5 9

Can Simultaneous-Use be used with EAP-TLS?
by Jason Wittlin-Cohen 07 Oct '06

07 Oct '06

I am using EAP-TLS for authentication so I have no use for a backend db to check username/password credentials. However, I would still like to prevent simultaneous logins with the same certificate. Is this possible without having an sql database? I have "Simultaneous-Users := 1" set in the "users" configuration file but it doesn't seem to do anything. Clients are being checked against this line in "users" DEFAULT Simultaneous-Use :=1

1 0

Can Session-Timeout be used to force users to re-authenticate?
by Jason Wittlin-Cohen 06 Oct '06

06 Oct '06

Is it possible to use the Session-Timeout setting to force wireless clients to re-authenticate with the RADIUS server at a given interval? Unfortunately my Acesss Point does not provide this functionality, so I either have to do it via a supplicant such as the Funk Odyssey Client or on the Freeradius server. I am running Freeradius 1.1.3 on a Debian Sarge 3.1 system and I'm using EAP-TLS for authentication. I don't think it matters but I'm using a Buffalo WHR-G54S Wireless Router with the DD-WRT v23 SP2 firmware. I am trying to force my wireless clients to re-authenticate with the RADIUS server every 30 minutes (1800 seconds) with the Session-Timeout setting. Currently I am testing with just one user, and the Session-Timeout = 1800 setting is being sent with the Radius Access Accept message (I can see it in the Accept Accept message when I run in debug mode). However, this seems to have no affect. The user does not re-authenticate at the given interval. Here's my setting from the users file: "Jason Wittlin-Cohen" Session-Timeout = 1800

2 1

freeradius bug?
by Abel Monzon 06 Oct '06

06 Oct '06

Hello, why if I have in my clients.conf this configuration: client localhost { secret = testing123 nastype = other shortname = localhost login = test password = test } and I try #radtest test test localhost testing123 say: Sending Access-Request of id 231 to 201.220.197.66 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 231 to 201.220.197.66 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host locahost:1812, id=231, length=20 Why is Access-Reject? There is a bug of freeradius? some idea?

3 4

clients
by Abel Monzon 06 Oct '06

06 Oct '06

I have a question.... Is possible no have secret for X client? Tanx, Abel

1 0

dialup_admin
by Abel Monzon 06 Oct '06

06 Oct '06

Hello, I need administer my freeradius+mysql, and I ask: There is some utility in addition to dialup_admin? Tanx

1 0

I want to use freeradius to manage my socks5 proxy
by taft 06 Oct '06

06 Oct '06

I configured a socks5 proxy. This question for me is how to authenticate users who I permit to use my socks5 proxy and account them--such as period and data flow--- I do not know how to integrate socks5 authentication and freeradius together. Is there any one have any idea or can provide me some docs. to help me. Thank you very much -- please visit my blog http://blog.csdn.net/taft

2 3

free radius ntlm_auth problem
by Andris 06 Oct '06

06 Oct '06

Hello! I sucesfully installed a free radius server with ntlm_auth, but have one problem. I have user names in Windows 2003 domain with whitespaces like 'user 1' 'user 2' (i know this is a bit lame, but they was created about years ago and be wery hard to change), these username with whitespaces ntlm_auth string won't authorize. Usernames without whitespaces authorize succesfully. When run ntlm_auth manal and write usernames like 'user 1' than work. And i want put a NT group requirment too like a 'Domain Users' ntlm_auth string is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" How can I fix this ? Thanks! P.S. Sorry my englisg isnt perfect :) Andris

3 2