- Freeradius-Users - lists.freeradius.org

RE: Conditionally adding reply pair
by Garber, Neal 20 Sep '06

20 Sep '06

> You should be able to do this through the users file: >... > Just change the check and reply items where necessary. > If you don't expect to use the NetSensory huntgroup after > these lines, you may want to add the following after all > users file entries related to the NetSensory huntrgroup. I didn't think of that because LDAP-Group isn't set when files executes. But, I can move files after the ldap module in my authorize section. Then, the LDAP-Group attribute would exist in the check list. Given there will be one LDAP-Group attribute for each group in which the user is a member, will files check all of them and stop when it finds a match? If so, then I can use the users file. Thanks Kevin.

1 0

realtime for freeradius
by Tariq Rashid 20 Sep '06

20 Sep '06

With modern operating systems we have various server task scheduling options available to use. We can either use OSes modified to provide soft real-time such as versions of Linux. We can also ask the task schedulers to give certain processes either higher priority or to give them real-time alike scheduling, as is possible in Solaris and maybe Linux. I wonder of anyone has experimented with observing FreeRadius performance under load conditions with these options? We shouldn't expect faster performance, but we may achieve more consistent behaviour - for example a smaller variance in response times. Thoughts and suggestions welcome. tariq (this applies not just to freeradius but other server tasks too)

2 1

Users file and rlm_sql
by Benoît Bianchi 20 Sep '06

20 Sep '06

Hi, We are currently using freeradius with users file configuration for our Wireless system, authenticating through ldap and rlm_eap which is working fine, but wed like to use a sql database to store login/password for guest accounts. This seems to us the easiest way to manage this because well have to create and delete theses accounts from a web interface. Can we do this with rlm_sql? After lookink at the documentation and googled about this, my feeling is that using rlm_sql will prevent the server to parse the users file, but Id like the users to be parsed first and then if there is no match, the sql database to be queried. Is this possible? Do we have to create all radius tables in the sql server even if we use only the radcheck one? Here is our actual users file which I dont see how to configure with rlm_mysql: DEFAULT hint == "WPA" , FreeRADIUS-Proxied-To == 127.0.0.1, Ldap-Group != "WPA_Allowed", Auth-Type := Reject DEFAULT User-Name := "%{User-Name}" Will putting sql in the authorise section of radius.conf just after file do the trick? Thanks for your help. Benoît.

2 1

radcheck vs radreply
by Graham Beneke 20 Sep '06

20 Sep '06

I seem to have a conceptual misunderstanding of the radcheck and radreply tables - and all my googling has given me nothing solid to correct myself on. Can someone explain the difference of the 2 and what their purpose in the system is. My understanding it the radcheck is used to decide whether a user should have access to the NAS and values are then sent back from the results of these checks... The radreply is then simply a list of properties/configuration attributes that are returned to the NAS is that specific user is authorised. My confusion comes - though - due to the fact that when running a radtest on my server none of the radcheck attributes are being returned and the users are being allowed to do more than they should be as a result.

1 0

Authenticating users on cisco 3750 switch
by Jean-Francois Fortin 20 Sep '06

20 Sep '06

Hi, We are trying to use freeradius as authentication system to allow users to connect to our cisco switch (3750) for management. The radius server is running ok, we can authenticate Cisco ASA, BigIP LB against it. But when trying with the 3750, we see that the radius server accept the user and return an answer to the switch, but it doesn't work. Anyone has sample config using freeradius with cisco switch? Thanks JF Jean-Francois Fortin | Deployment Prime | OZ T: 514.390.1333 x4004 | F: 514.390.0033 | M: 514.260.6334 | jean-francois.fortin(a)oz.com

3 5

users fil vs sql
by Keith Woodworth 20 Sep '06

20 Sep '06

Ive got things working using 1.1.3, username in radcheck with crypt-password, using auth-type = Local in radgroupcheck. I'm using the flat Users file with a simple 6 line Default entry to make it all work. On my test bed this has been working quite well for the last 3 days. While this is ok, how does radius get configured to use the sql table to send the replies, not the users file? Ive tried commenting out all the files entries in radiusd.conf but radius sends back a access-accept but the client side gets rejected. Thanks, Keith

2 4

New to FreeRadius (not to Radius) and need to know about capabilities.
by Dan Geist 19 Sep '06

19 Sep '06

Greetings, all. I'm a new user that's looking at FreeRadius because of some of it's features, but I'd like to figure out if it can replicate what I'm currently doing before I start looking into a migration. My current setup does the following (with openradius, mysql, perl, and a PAM-securID module) on each packet arrival: 1) check an SQL db for the encryption key and tokenize everything (if so, continue, else exit) 2) check to see if it's an accounting packet and log it (if so, then do it then exit) 3) if it's anything else, check the SQL db to see if the username is valid. (if so, continue, else exit) 4) execute a PAM check on the valid user with the credentials just provided (which could be unix auth, securID, mysql, LDAP, whatever PAM supports) (if authenticated, continue, else exit) 5) check to see if it's one of a short list of auth-only NASs (if so, authenticate that user and exit, else continue) 6) do another SQL lookup to get the combination of VSA option values for that unique username/nas pair and return the appropriate RAD-access option along with the VSA options for that user/device combination (return packet/VSAs and exit) Now, I know that's a lot of info, but does FreeRadius have the flexibility to be able to do something like this? The big things are that it be able to do PAM auth on users and that it be able to return VSAs based on a one-to-one relationship that's stored in a MySQL db. Thanks. Dan -- Dan Geist | dan.geist(a)cox.com | (404) 269-6822 Cox Communications - Engineering Security

3 2

Banking Time
by Prabhdeep Singh 19 Sep '06

19 Sep '06

Hi, I am trying to figure out how can i support two sets of users on same DB (radius/MySQL), where one set of users are able to bank the time, and others not. For example. User A buys a plan that is good for 2 hour.... he/she logs in and after 1 hour logs out. One day after User A is again able to log in and use the remaining 1 hour. User B buys a plan that is also good for 2 hours.... he/she logs in and after 1 hour logs out. But One day after User B is not able to log in as the time was calculated from the time, when user first logged in. Thanks. With Regards, Prabh -- Get your news at www.DailyHeadlines.NET

1 0

Re: sqlippool not working
by Peter Nixon 19 Sep '06

19 Sep '06

It turns out that sqlippool.conf was in the Makefile for 1.1.x but not for CVS head. It didnt affect us because we use an rpm. Guilherme can you please test a new cvs checkout? Also, because sqlippool is still experimental you need to explicitly enable it with ./configure --with-modules="rlm_sqlippool" Cheers Peter On Tue 19 Sep 2006 17:44, Tuyan Ozipek wrote: > Hi Peter, > > When i installed (compiled from source) the > freeradius-snapshot-20060918 tarball, the only missing thing was > the sqlippool.conf file (which i copied from some other test > environment). Since sqlippool module is not(yeah, we run it on > production happily for sometime..) considered stable yet, we do not > build it by default.(Lets check sqlippool.conf file installation in the > makefiles tho.) > > I am running it now on my development machine with no problems. > > The only thing possible is there is some type of typo in the config file > that Guilherme Franco is using. > > also, trace shows that there is no allocate-clear statement set for > sqlippool to use. > > > here is the allocate-clear statement that i used for my test.. > > allocate-clear = "UPDATE radippool \ > SET nasipaddress = '', pool_key = 0, callingstationid = '', \ > expiry_time = 'now'::timestamp(0) - '1 second'::interval \ > WHERE pool_key = '${pool-key}'" > > > > Regards > > On Tue, 2006-09-19 at 00:27 +0300, Peter Nixon wrote: > > ---------- Forwarded Message ---------- > > > > Subject: sqlippool not working > > Date: Mon 18 Sep 2006 23:40 > > From: "Guilherme Franco" <guilhermefranco(a)gmail.com> > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > > > Hi Peter, > > > > Like you told me before, you did some cleanups in the sqlippool.conf. > > > > Well, I've tried to install todays freeradius CVS, and it installed > > without the sqlippool module, don't know why. > > > > So, I've compiled it manually from > > freeradius-snapshot-20060918/src/modules/rlm_sqlippool/ > > > > OK, but when I run radiusd -X, I got this in the end, regardless of my > > configuration in sqlippool.conf and radiusd.conf: > > > > Module: Loaded SQL IP Pool > > sqlippool: sql-instance-name = "sql" > > sqlippool: lease-duration = 86400 > > sqlippool: pool-name = "" > > sqlippool: allocate-begin = "BEGIN" > > sqlippool: allocate-clear = "" > > sqlippool: allocate-find = "" > > sqlippool: allocate-update = "" > > sqlippool: allocate-commit = "COMMIT" > > sqlippool: allocate-rollback = "ROLLBACK" > > sqlippool: start-begin = "BEGIN" > > sqlippool: start-update = "" > > sqlippool: start-commit = "COMMIT" > > sqlippool: start-rollback = "ROLLBACK" > > sqlippool: alive-begin = "BEGIN" > > sqlippool: alive-update = "" > > sqlippool: alive-commit = "COMMIT" > > sqlippool: alive-rollback = "ROLLBACK" > > sqlippool: stop-begin = "BEGIN" > > sqlippool: stop-clear = "" > > sqlippool: stop-commit = "COMMIT" > > sqlippool: stop-rollback = "ROLLBACK" > > sqlippool: on-begin = "BEGIN" > > sqlippool: on-clear = "" > > sqlippool: on-commit = "COMMIT" > > sqlippool: on-rollback = "ROLLBACK" > > sqlippool: off-begin = "BEGIN" > > sqlippool: off-clear = "" > > sqlippool: off-commit = "COMMIT" > > sqlippool: off-rollback = "ROLLBACK" > > rlm_sqlippool: the 'allocate-clear' statement must be set. > > > > It's not even trying to access the Oracle server. > > > > What can it be? > > > > Thanks! > > > > ------------------------------------------------------- -- Peter Nixon mailto:peter@suntel.com.tr Chief Technologist Suntel Communications http://www.suntel.com.tr TR tel:+902123369299 US tel:+13103177825 UK tel:+448700685002 VoIP sip:pbx@suntel.com.tr IM jabber:peter@suntel.com.tr Absolutum obsoletum. (If it works, it's out of date.) -- Stafford Beer -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 5

Matter of Life and Death - SQL and Proxy
by Guilherme Franco 19 Sep '06

19 Sep '06

Hello, I work in a Carrier and have an important question regarding SQL query check: I need to check a value in authorize_check_query (oracle-dialup.conf) to see if the user has paid his ADSL service. If he did paid the service, the request would be proxied to the ISP radius to authenticate the user, otherwise, the access needs to be rejected. So , the query would be checked like that: authorize_check_query = "SELECT id,UserName,Attribute,Value,op,PAID FROM ${authcheck_table} WHERE Username = '%{SQL-User-Name}' AND PAID = 'YES' ORDER BY id" The problem is, If PAID != YES, the user is not found by the SELECT (correctly) but the request is still proxied to the ISP (normal proxy behaviour). What can I do to reject the request and not proxy it? Please help! Thank you.

3 3