- Freeradius-Users - lists.freeradius.org

Called-Station-Id not logged to sql when login fails csid check
by Mike Jakubik 01 Jul '06

01 Jul '06

Hello, It seems that the Called-Station-Id is not logged to SQL when the login fails the Called-Station-Id check using the rlm_checkval module. Any ideas why that is? It makes troubleshooting impossible. Thanks.

2 3

rlm_perl %RAD_REQUEST rewrite
by Evil I_Am 01 Jul '06

01 Jul '06

Hi Is the %RAD_REQUEST hash used by rlm_perl read only? i need to modify some of the request packet attributes but it do not seems to work.

4 3

Simultaneous-Use does not match on Huntgroup-Name
by B Thompson 01 Jul '06

01 Jul '06

Hi I have just been testing out Simultaneaous-Use and I cannot get it to match on a Huntgroup-Name (where the the huntgroup is a list of NAS-IP-Address entries). If I specify Simultaneous-Use against each NAS-IP-Address individually in the users file it works fine. This works :- DEFAULT NAS-IP-Address == x.x.x.x, Simultaneous-Use := 1 Fall-Through = Yes This does not work :- DEFAULT Huntgroup-Name == blah, Simultaneous-Use := 1 Fall-Through = Yes This is with the stock RedHat FreeRADIUS 1.0.1 Am I doing something wrong or is this a bug? Thanks Ben -- Ben Thompson University of York

1 1

How to Disable user
by Jeremy ohara 01 Jul '06

01 Jul '06

hi there i have Freeradius 1.0.5 and using MYSQL backend how can i disble a user from logging in? hope you can help. Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

2 4

Throttle On Cap
by Alex Abraham 01 Jul '06

01 Jul '06

I need some help with implementing "Throttle on Cap Usage" type feature for our ADSL project. Wondering if any one has implemented this using Freeradius and MySQL and if you could point me in the right direction. The BRAS we are using is Huawei MA5200F. Thanks in Advance ============================================ Alex Abraham

3 5

error: Failed dependencies: libeap-1.1.2.so is needed by freeradius-1.1.2-0.i386
by Alberto Cruz 30 Jun '06

30 Jun '06

Hi everybody. I'm trying to install the RPM file that I built for RedHat Entrerprise 4.0 (RHEL4) and Freeradius 1.1.2 When I tried the command I'm getting the following error: error: Failed dependencies: libeap-1.1.2.so is needed by freeradius-1.1.2-0.i386 Do I need to install something else before the freeradius RPM file? Should I had added a prefix/option at the time of build the RPM packet in order to include the libeap-1.1.2 libray? Regards Alberto Cruz

4 10

radius_xlat question
by fvt3 30 Jun '06

30 Jun '06

Hi, I am trying to strip off some information in the username. I have domain\\username and I have a script to strip domain\\ and return the username. After executing the script it returns the username but radius_xlat adds a space right after the user name. How do I get rid of that space. Any suggestions would be appreciated. Thanks... radius_xlat: Running registered xlat function of module exec for string '/usr/local/freeradius/etc/raddb/nodomain.sh %u' rlm_exec (exec): Executing /usr/local/freeradius/etc/raddb/nodomain.sh %u radius_xlat: '/usr/local/freeradius/etc/raddb/nodomain.sh jdoe' Exec-Program: /usr/local/freeradius/etc/raddb/nodomain.sh jdoe Exec-Program output: jdoe Exec-Program-Wait: plaintext: jdoe Exec-Program: returned: 0 rlm_exec (exec): result 0 radius_xlat: '(SamAccountName=jdoe )' rlm_ldap: ldap_get_conn: Checking Id: 0 __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: FW: mpd+freeradius+AD
by Егоров Сергей 30 Jun '06

30 Jun '06

Ok, this is my users file test Auth-Type := MS-CHAP Framed-IP-Address = 192.168.10.65 DEFAULT Auth-Type := MS-CHAP And this is freeradius log, then I connect to mpd via test account: Login OK: [test/<no User-Password attribute>] (from client localhost port 0 cli 192.168.12.126) Sending Access-Accept of id 121 to 127.0.0.1 port 49791 Framed-IP-Address = 192.168.10.65 MS-CHAP2-Success = 0x01533d42454334303938434341393443383234413844444431463938303641384133453236394441413430 MS-MPPE-Recv-Key = 0x0bbdc1d49670112e799bd5a86b084808 MS-MPPE-Send-Key = 0x0df81127464f94a443c13e7e683f5251 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:54511, id=119, length=139 NAS-Identifier = "testradius.ion.ru" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "192.168.12.126" User-Name = "test" Framed-IP-Address = 192.168.10.12 Acct-Status-Type = Start Acct-Session-Id = "1652038-pptp0" Acct-Multi-Session-Id = "1652038-pptp0" Acct-Link-Count = 1 Acct-Authentic = RADIUS Sending Accounting-Response of id 119 to 127.0.0.1 port 54511 In this log freeradius said that account test OK, and his address 192.168.10.65. But mpd replace it this his own. How could I improve it? -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Thursday, June 29, 2006 7:05 PM To: Undisclosed.Recipients : Cc: Егоров Сергей Subject: Re: FW: mpd+freeradius+AD On Thursday 29 June 2006 15:28, Егоров Сергей wrote: > >This is Framed-IP-Address in radius dialect. > > Thanks for explaining freeradius basic concepts. I understood, that to > assign IP to user I should use users freeradius file. But I couldn't > configure it correctly. Now I have only one line in this file > > DEFAULT Auth-Type := MS-CHAP > > I've add another string (for user test), but it doesn't correct > > test Auth-Type := MS-CHAP, Try without the comma run the server in debug mode(radiusd -X) and use radclient > Framed-IP-Address = 192.168.10.65, > I think you can put this in AD. Don't know... > That should I fix? > > > -----Original Message----- > From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] > Sent: Monday, June 26, 2006 5:09 PM > To: freeradius-users(a)lists.freeradius.org > Cc: Егоров Сергей > Subject: Re: mpd+freeradius+AD > > On Monday 26 June 2006 14:04, Егоров Сергей wrote: > > Thanks for reply. > > > > >You can use one of the three firewalls avaliable in the base > > > system(ipfw, > > > > > > >ipf and pf), however mpd comes with a small dictionary that uses > > > > > > ipfw(8) >and you can easily define some filter bound to an interface > > > (bound to a >username) via a radius reply attribute, let filter be a > > > pipe(for bandwidth >control) or a packet filtering expression. > > > > That's fine for filtering vpn users access to local net. But how could I > > assign specific IP for specific user in AD? > > > > > Your questions don't clearly tell where your problem is. > > >Active Directory? mpd? or FreeRADIUS? You should define > > >them better in order to get help from the list. > > > > My goal is to replace VPN server, based on win2003, with FreeBSD one. WIN > > 2003 can do 1 and 2 in my questions, so I have to realize how to setup > > this in mpd + freeradius. I already authenticate users from AD group: > > > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00} > > --require-membership-of=EXAMPLE+VPN_Allowed". > > > > But I have several vpn groups and need to setup timeouts on each one. > > setup timeout? This looks like Session-Timeout in radius dialect. > > > Also > > I need to I assign specific IP for specific user in AD. > > This is Framed-IP-Address in radius dialect. > > > Looks like > > FreeRadius should respond for this. > > Yes, you have to have basic understanding of what radius is. All of these > are very basic setup. I don't know how FreeRADIUS interacts with AD and > what info it should get from AD. So, try searching (or asking) for active > directory and FreeRADIUS. Keep the mpd part out of it, since it will > add unneeded complexity. Or perhaps start from setting up mpd and > FreeRADIUS. And then you could add AD. > > A few suggestions, Nikos > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

RE: exec-program dependent on ldap attribute values
by Tariq Rashid 30 Jun '06

30 Jun '06

"Tariq Rashid" <tariq.rashid(a)uk.easynet.net> wrote: > I would like however for the script to be called only when an LDAP attribute has a certain values. Is this possible? The user's LDAP profile has already been searched for the user's password in the initial auth request, and possibly in the acct request. > > something like the following does not work: > > DEFAULT Acct-Status-Type == Start, Account-Status == "inactive" > Exec-Program = "/etc/freeradius/scripts/acct_start.py %{User-Name}" > > where Account-Status is mapped to the LDAP attribute in the ldap-attrmap file. Probably because Account-Status is a check item, and not in the request. It will have to go into the request for it to be compared in the acct_users file. Alan DeKok. --------------- so must it be added to the request artificially before the comparision happens? i'm not sure what the recommended what to achieve this is... tariq

1 0

Radius Primary an Decondary
by Vinicius Bufoni 30 Jun '06

30 Jun '06

Hi People. My name is Vinicius, and i have a freeradius in my company. But i have a question: Some way of mine radius work with primary and secondary proxy radius?? That is, if the first radius died the second radius in the proxy get up??? Excuse for the bad English I hope you will understand my mail Thank you very much for all Vinicius Bufoni

2 1