- Freeradius-Users - lists.freeradius.org

change proxy attributes
by André Lemos 24 May '06

24 May '06

isn't there a way to change the attributes my freeradius sends out to a proxy by messing with the users file? thanks DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

2 4

Freeradius + GoRemote Authentication
by Chris Armstrong 24 May '06

24 May '06

Hello I want to change from Radiator/LDAP to Freeradius/MySQL. My problem is that i don't know how to configure GoRemote in Freeradius. On Google i don't seem to find an example how this has to be setup. Can somebody tell me how i do this in Freeradius? In clients.conf i have added following: client 216.231.206.61 { secret = mysecret shortname = GoRemote } Where do i have to put the realm part and how should it look? Below you see my configuration in radiator. Thanks for you help. Chris The configuration in radiator looks like this: clients.cfg --------------------------------- # Requests from GoRemote <Client 216.231.206.61> Secret mysecret Identifier GoRemote </Client> realms.cfg ----------------------------------------------- # GoRemote redirect <Handler Client-Identifier=tnt,Realm=/..*/> AuthByPolicy ContinueAlways AuthBy GoRemote <AuthBy RADIUS> Host 216.231.206.81 Secret mysecret AuthPort 1645 AcctPort 1646 RetryTimeout 10 RejectEmptyPassword </AuthBy> </Handler>

1 0

Attributes and LDAP
by Marek Gradzki 24 May '06

24 May '06

Hi. I am currently using FreeRadius server 1.0.2 on Solaris 8 with LDAP authentication and MySQL accounting for PPPoE sessions with ADSL technology. Everything works fine, but some problems appeared lately. User profiles are stored in some subtree of LDAP server. Each user has an attribute radiusGroupName set to test (for example). I would like to setup some common attribute values in the group profile, which is also stored in the LDAP server but in the other subtree, and import them to user profile during authentication. Now it does not work. Unfortunately I do not have much space to experiment because it is working configration and I really do not have an idea how to setup this kind of behaviour. Parts of my config files are below: _huntgroups: _cisco NAS-IP-Address == 192.168.0.211 _clients.conf: _client 192.168.0.211 { secret = cisco nastype = cisco shortname = c7200vxr } _radiusd.conf:_ # MODULE CONFIGURATION modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "ds1i.ostisp.intra ds2i.ostisp.intra" identity = "cn=freeradius,ou=admins,o=radius,dc=ostnet,dc=pl" password = radius basedn = "ou=users,ou=adsl,o=radius,dc=ostnet,dc=pl" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" password_attribute = userPassword # access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap_ext.attrmap groupname_attribute = radiusGroupName groupmembership_filter = "(cn=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)" groupmembership_attribute = radiusGroupName ldap_connections_number = 40 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp # username = %{User-Name} username = %{Stripped-User-Name:-%{User-Name}} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } $INCLUDE ${confdir}/sql.conf } # Instantiation instantiate { expr detail } authorize { preprocess chap ldap files } # Authentication. authenticate { Auth-Type CHAP { chap } Auth-Type LDAP { ldap } Auth-Type PAP { pap } unix } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique suffix files } # # Accounting. Log the accounting data. # accounting { sql } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } _users: _DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Blocked account." DEFAULT Huntgroup-Name == cisco, LDAP-Group == ostinternet, User-Profile := "cn=ostinternet,ou=profiles,ou=adsl,o=radius,dc=ostnet,dc=pl" Fall-Through = no DEFAULT Huntgroup-Name == huawei, LDAP-Group == ostinternet, User-Profile := "cn=ostinternet,ou=profiles,ou-adsl,o=radius,dc=ostnet,dc=pl" Fall-Through = no Write if You have any ideas. Thanks in advance.

2 3

returning variable as HEX in Access-Accept
by Michael Kopp 24 May '06

24 May '06

Hi all, I have maybe a strange request OK I receive some Attributes in Access-Request and I have to return the HEX values of the received Attribute back to the NAS within the Access-Accept message. For example I receive for instance "Framed-MTU" = 1500 in Access-Request and now I have to put in the Access-Accept Class = "05DC" (the hex value of the framed-MTU) and sent it back to the NAS. I already tried several things but cannot get it to work. What I tried Class = `%{Framed-MTU}`, but then I only get the integer value in the class attribute If I do something like Class = 0x`%{Framed-MTU}`, I just get an parser error Additionally I have to add a second variable into the Class attribute, is this also possible to tie together the both variables and sent their Hex value back in Class attribute ? or maybe just one variable and a fixed other value ? Like "Class = 0xAAAA`%{Framed-MTU}`, (Also with this I get a parser error ) Hope my explanation is clear, I know strange request ;-) Is the stuff what I try to achive even possible ? and if yes, can somebody show me how ? I cannot find a answer in the archive and in the man pages Thanks Michael -- Bis zu 70% Ihrer Onlinekosten sparen: GMX SmartSurfer! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

3 2

FreeRadius 1.1.1 and run-away CPU
by Aaron Burruss 24 May '06

24 May '06

Hi all. I'm running freeraduius 1.1.1 on a FreeBSD 5.4 server. I'm using the mysql module (mysql 4.0.24), and everything seems to be working fine... but at random times, the CPU becomes pegged by the radiusd process, and it will stop accepting requests from my clients. This does not (seem to) occur when I run in debug (-X), but I obviously don't want to run it in that mode for the long term. I've looked around, and can't seem to find anything that might be causing this to happen. last pid: 3745; load averages: 0.51, 0.26, 0.53 up 0+18:46:06 09:29:34 41 processes: 2 running, 39 sleeping CPU states: 46.7% user, 0.0% nice, 52.9% system, 0.4% interrupt, 0.0% idle Mem: 41M Active, 315M Inact, 105M Wired, 12K Cache, 111M Buf, 535M Free Swap: 1024M Total, 1024M Free PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 3744 root 115 0 4172K 3240K RUN 0:42 98.62% 86.57% radiusd 536 mysql 20 0 57672K 33996K kserel 1:07 0.00% 0.00% mysqld 414 root 96 0 3476K 2808K select 0:01 0.00% 0.00% sendmail This is a 2.8GHz box with 1GB ram. Restarting the daemon sometimes helps, for a while, then high CPU again. Sometimes it spikes up immediately. Reboot has not helped. Thoughts? -A

3 3

Connecting two freeradius server ?
by Frank Bonnet 24 May '06

24 May '06

Hello I use freeradius to authenticate Chillispot users using an Openldap backend , everything works like a charm :-) Another (friendly) site has quite the same configuration they do use freeradius too to authenticate their wi-fi users. Both sites have a permanent Internet access. Now is it possible for "my" daemon to "communicate" with another freeradius daemon which is running in another distant site to let all of our users ( my site + distant site ) authenticate transparently with their own site logins/passwds on the two sites ? Thank you. -- Frank Bonnet

2 2

specific accounting attributes
by JVUVANT Yahoo 24 May '06

24 May '06

Hi all I'm using redback SE800 and I would like to collect some specific attributes returned by the NAS with freeradius. someone can help me how to ? Thanks Jacques vuvant

2 1

Getting the signaling IP address
by vignesh 24 May '06

24 May '06

Hello all I am using cisco TCL IVR 2.0 and Free Radius 1.1. I am trying to send signalling ip as an extra attribute to radius from the NAS in the accounting request packet using h323-ivr-out. The problem is I am not able to retrive the signaling ip of the out bound leg( I even tried the same for the inbound leg but still no luck). I am retriving the signaling ip using the info tag infotag get leg_remote_signaling_ip_address leg_outgoing. But I am getting a empty string This is my code where I retrive the signaling ip proc act_Cleanup { } { set signalip [infotag get leg_remote_signaling_ip_address leg_outgoing] set avsend(h323-ivr-out,0) "billingid:$signalip" aaa accounting update leg_outgoing -a avsend call close } This is the procedure that's get called when the call ends. I even tried using this code snippet when the call is established but I am still unable to read the signaling ip. I am accounting at stop only. In the accounting request there is one attribute h323-remote-address which gives me the signaling ip but how do I retrive it in my tcl ivr script. Please guys help me out Thanks Vignesh

1 0

dual-master mysql replication - seems promissing
by RobertB 24 May '06

24 May '06

Hi All Does anybody run dual-master replication with freeradius? I have been doing some testing and it seems good. I also use the rlm_sqlippool with it and works very well. I need to do a lot more testing under heavy load and simulate some faults, but seems very promising, at least with NTRadPing. I'm running mysql-5.0.21 with auto_increment_increment and auto_increment_offset options. Cheers, RobertB

1 0

RE: FreeRadius 1.1.1 and run-away CPU
by Aaron Burruss 23 May '06

23 May '06

I have the proxy section commented out in radiusd.conf, occurs both ways... I do see something in the radius.log... when the CPU pegs out (and the server stops handling requests), I see this occur in the radius.log: Tue May 23 16:37:03 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Tue May 23 16:37:03 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Before that, I have some other misc errors, but nothing that I'm too worried about. -A -----Original Message----- From: freeradius-users-bounces+aburruss=networkinsight.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+aburruss=networkinsight.com@lists.freer adius.org] On Behalf Of Alan DeKok Sent: Tuesday, May 23, 2006 10:49 AM To: FreeRadius users mailing list Subject: Re: FreeRadius 1.1.1 and run-away CPU "Aaron Burruss" <aburruss(a)networkinsight.com> wrote: > I'm running freeraduius 1.1.1 on a FreeBSD 5.4 server. I'm using the > mysql module (mysql 4.0.24), and everything seems to be working fine... > but at random times, the CPU becomes pegged by the radiusd process, and > it will stop accepting requests from my clients. This does not (seem > to) occur when I run in debug (-X), but I obviously don't want to run it > in that mode for the long term. I've looked around, and can't seem to > find anything that might be causing this to happen. Are you proxying requests? If so, try the patch from bug #331. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0