- Freeradius-Users - lists.freeradius.org

RE: on the right track?
by Galloway, David Mr KRS 02 May '06

02 May '06

I just worked this out yesterday. Best way for me (I found) was to create two groups (one is pubnet-dialup the other is pubnet-extend) I set this in the /etc/raddb/users file # Authentication for pubnet-dialup group DEFAULT Auth-Type = System, Group == "pubnet-dialup" Fall-Through = 1 # authentication for pubnet-extend group DEFAULT Auth-Type = System, Group == "pubnet-extend" Fall-Through = 1 # Defaults for all framed connections. # # sets timeout for group "pubnet-dialup" DEFAULT Service-Type == Framed-User, Group == "pubnet-dialup" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 14400, Idle-Timeout = 1800, Fall-Through = Yes # Sets timeout for group "pubnet-extend" DEFAULT Service-Type == Framed-User, Group == "pubnet-extend" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 28800, Idle-Timeout = 1800, Fall-Through = Yes I authenticate against two groups. Then set the timeouts per each group (first is for 4 hours, second 8). Hope that helps. Regards, David Galloway Public Networks Administration KRS IT Network Operations Help Desk (805) 355-2444 Direct (805) 355-4512 -----Original Message----- From: freeradius-users-bounces+david.l.galloway=us.army.mil(a)lists.freeradius.org [mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradi us.org] On Behalf Of mbjohn(a)duke.edu Sent: Thursday, February 23, 2006 3:43 AM To: freeradius-users(a)lists.freeradius.org Subject: on the right track? Hello all! I've tried to search the web and the archives for an answer to this question and didn't come up with anything, so I hope I'm not duplicating a question that's already been answered. Currently, where I work, we run two modem pools. One pool is limited to certain users who are allowed to connect up to 8 hrs at a time. The other pool is for general users who are given 15 min to quickly check email or search for something on the web (fwiw, they're allowed to reconnect after their time is up....). As broadband has become more available, less and less users are using the modem pool. We still have a handful of people from both groups who are still using it. So, in the interest to provide the service for the people still using it while not paying for unused lines, we're trying to consolidate things. We have a Cisco AS5300 terminal server that already uses freeradius w/ kerberos to authenticate users. We would like to take that a step further and use freeradius to limit usage time based on the user name (certain users are allowed 8hrs while all others are given 15min). Looking over the config files in /etc/raddb, it appears the attrs file is just what I need to use. Would I be able to use a combination of huntgroups and the attrs file to accomplish what I need? I know in the documentation for the "fisp" entry, it talks about not having a Fall-Through entry. Does that mean it CANNOT have a Fall-Through entry, or that the given example does not? Am I on the right track with this, or should I look elsewhere? Thanks for your help! Brian - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

default vlan for ldap users
by Nuno Reis 02 May '06

02 May '06

Hi, Is there any way to make freeradius assign a vlan to any user that was authenticated using active directory database? Something like, freeradius asks active directory for user authenticity, and if accepted, freeradius forwards always the same tunnel-pvt-group-id to NAS. Thanks, Nuno Reis -- View this message in context: http://www.nabble.com/default-vlan-for-ldap-users-t1538508.html#a4179753 Sent from the FreeRadius - User forum at Nabble.com.

3 2

newbie authorization question
by Marisa Brandt 02 May '06

02 May '06

I have what I think is probably an ultra-basic question: I'm authenticating users via ldap; everything appears to be working perfectly. However, I'd like to restrict access to all users, EXCEPT for a few select groups. I'm clearly missing something really obvious, because I can't seem to figure out how to do that. Can someone help me out? Thanks very much, Marisa

2 1

eap-sim question
by Steven Krausman 02 May '06

02 May '06

I'm trying to configure a DEFAULT user setting to perform EAP-SIM. The default user setting is: DEFAULT: Auth-Type := EAP, EAP-Type := SIM, EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 When I run the freeRadius server, I get the following output: Rlm_eap: EAP Identity Rlm_eap: processing type sim Can not initial sim, no RAND1 attribute Where should the RAND1 attribute be configured? Thanks, Steve

1 0

c module
by kamanashisroy 02 May '06

02 May '06

Please tell me, how can i write a module of my own in c. Also, tell me how can i compile it and use with freeradius(also say the config file changes) -- View this message in context: http://www.nabble.com/c-module-t1532707.html#a4163751 Sent from the FreeRadius - User forum at Nabble.com.

2 1

Re: c module
by yao guoxian 02 May '06

02 May '06

>Please tell me, how can i write a module of my own in c. >Also, tell me how can i compile it and use with freeradius(also say the config file changes) I think you should edit and compile your own program code and get the final executable file, e.g your_own.exe. Then edit radiusd.conf , add your own 'exec' section such as : exec echo { wait = yes program = "/your_own.exe_path/your_own.exe %{argu1} %{augu2} ..." input_pairs = request output_pairs = reply } Finally, recomplie Freeradius.

1 0

New PHP for interface
by JasonN 01 May '06

01 May '06

I've have a set of new code for the PHP web-based interface to control users, specifically in relation to the MySQL and FreeRADIUS combo. These features are complete: add user[s] remove user[s] disable user[s] check user[s] password It is however clean PHP with straightforward readable code and is PHP4/5 compliant. Anyone interested in working on this new approach, please let me know. It's simple, nothing fancy, no frames, etc. in the HTML. And, it already works for the basic necessary features. I would like to see a few people code up some additional features. It works right now, as is, for most ISP needs. -- Please address your interest directly to me: imjasonn(a)gmail.com, so you don't get filtered to my FreeRADIUS box. You'll get quicker attention, since I don't read this list every day. -- Jason A. Nunnelley ---------------------------------------- http://www.jasonn.com/

4 4

FreeRADIUS, MySQL and usergroups
by Michael Schwartzkopff 01 May '06

01 May '06

Hi, I want to built a RADIUS system with a MySQL database to authenticate / authorize users. One group of the users should be allowed to use the internet and an other group shoud be allowed to use the RAS server to dial in. Of course some of the users can use both. Can I use user groups in MySQL and let FreeRADIUS ask for a membership in that group? How can I do this with FreeRADIUS / MySQL? Any hints are welcome. Thanks. Additionally: I read that SQUID can use a lot of AAA possibilities. I think PAM and the pam_radius module is the best solution. Any other suggestions? Thanks again. Sincerely, -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

1 0

Cisco Aironet Access-Reject messages
by David Smith 30 Apr '06

30 Apr '06

Hi there, I'm trying to use FreeRadius 1.1.1 to authenticate MAC addresses from a Cisco Aironet 1231 wireless access point. I have the perl module working, and it can compare a MAC address sent by the access point and return the Access-Accept message and the access point is all happy. This is done using the "return RLM_MODULE_OK" message. However, returning an Access-Reject message ("return RLM_MODULE_REJECT") just makes the access point continually keep sending Access-Request messages every time a Access-Reject message is returned. Is this normal? I can't see it... What I'm wanting to do is tell the access point that this MAC address is not valid, go away until it connects again... Here is the Access-Reject message that I return: rad_recv: Access-Request packet from host 172.20.1.201:1645, id=166, length=113 User-Name = "009096beba0c" User-Password = "009096beba0c" Called-Station-Id = "0014.693c.6250" Calling-Station-Id = "0090.96be.ba0c" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 665 NAS-IP-Address = 172.20.1.201 NAS-Identifier = "ap1" perl_pool: item 0x97a51b0 asigned new request. Handled so far: 3 found interpetator at address 0x97a51b0 rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: Service-Type = Login-User rlm_perl: RAD_REQUEST: Calling-Station-Id = 0090.96be.ba0c rlm_perl: RAD_REQUEST: Called-Station-Id = 0014.693c.6250 rlm_perl: RAD_REQUEST: Client-IP-Address = 172.20.1.201 rlm_perl: RAD_REQUEST: User-Name = 009096beba0c rlm_perl: RAD_REQUEST: NAS-Identifier = ap1 rlm_perl: RAD_REQUEST: User-Password = 009096beba0c rlm_perl: RAD_REQUEST: NAS-Port = 665 rlm_perl: RAD_REQUEST: NAS-IP-Address = 172.20.1.201 rlm_perl: Added pair Password-Retry = 0 rlm_perl: Added pair Reply-Message = Sorry, no authentication perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x97a51b0 Sending Access-Reject of id 166 to 172.20.1.201 port 1645 Reply-Message = "Sorry, no authentication" As you can see, i've added the Password-Retry option, but to no avail... Can anyone shed any light on this? Thanks, Dave Smith

2 1

sent tlv failure
by bel hassine monem 30 Apr '06

30 Apr '06

Hello, I installed freeradius-1.1.1 I'm using eap/peap and mschapv2 but radius server return access-reject when I try to authentificate a user Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.2.14:2050, id=0, > length=168 > User-Name = "root" > NAS-IP-Address = 192.168.2.14 > Called-Station-Id = "000f6645db2a" > Calling-Station-Id = "0020ed792d18" > NAS-Identifier = "000f6645db2a" > NAS-Port = 12 > Framed-MTU = 1400 > State = 0x9ffc28e6266e915f48a2c65201988172 > NAS-Port-Type = Wireless-802.11 > EAP-Message = > 0x020800261900170301001bdc0d980a2faf3b259a1c839845feaee7fa20acda7735f5da62fb21 > Message-Authenticator = 0xc1149f0adc27f8d6973700ddb42b51ab > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 78 > modcall[authorize]: module "preprocess" returns ok for request 78 > modcall[authorize]: module "chap" returns noop for request 78 > modcall[authorize]: module "mschap" returns noop for request 78 > rlm_realm: No '@' in User-Name = "root", looking up realm NULL > rlm_realm: Found realm "NULL" > rlm_realm: Adding Stripped-User-Name = "root" > rlm_realm: Proxying request from user root to realm NULL > rlm_realm: Adding Realm = "NULL" > rlm_realm: Authentication realm is LOCAL. > modcall[authorize]: module "suffix" returns noop for request 78 > rlm_eap: EAP packet type response id 8 length 38 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 78 > users: Matched DEFAULT at 152 > modcall[authorize]: module "files" returns ok for request 78 > modcall: group authorize returns updated for request 78 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 78 > rlm_eap: Request found, released from the list > rlm_eap: EAP/peap > rlm_eap: processing type peap > rlm_eap_peap: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > eaptls_process returned 7 > rlm_eap_peap: EAPTLS_OK > rlm_eap_peap: Session established. Decoding tunneled attributes. > rlm_eap_peap: Received EAP-TLV response. > rlm_eap_peap: Tunneled data is valid. > rlm_eap_peap: Had sent TLV failure, rejecting. > rlm_eap: Handler failed in EAP/peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 78 > modcall: group authenticate returns invalid for request 78 > auth: Failed to validate the user. > Delaying request 78 for 1 seconds > Finished request 78 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 0 to 192.168.2.14:2050 > EAP-Message = 0x04080004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 78 ID 0 with timestamp 413fce87 > Nothing to do. Sleeping until we see a request. > thanks you, --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici. --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

2 1