- Freeradius-Users - lists.freeradius.org

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 27 Mar '06

27 Mar '06

> > Since you seem to know something about this, can you either: > > > > A) Explain what the "extended key oid nonsense" is? > > B) Point me to some place I can read about it? > > http://www.freeradius.org/doc/ > > See the EAP-TLS stuff. > > Microsoft requires magic stuff in the server certificate, otherwise > the windows supplicants silently stop talking to the AP. Ok, I read the document, but I still do not understand something... I am proxying the packets from the Cisco through the FreeRADIUS server to the IAS server. EAP messages are exchanged between the supplicant and the IAS server; the Cisco AP and FreeRADIUS server do not touch them, correct? They just do RADIUS stuff and encapsulate the EAP messages, right? And, if that is the case, then the IAS server and the supplicant are doing all the TLS stuff. The IAS server obviously supports those OID extensions. So, shouldn't the supplicant work properly? I mean, we are not creating a TLS tunnel from the supplicant to the FreeRADIUS server and another from the FreeRADIUS server to the IAS server -- it should be from the supplicant to the IAS server, encapsulated in RADIUS, proxied through the FreeRADIUS server. And, in that kind of setup, the FreeRADIUS server should not be causing any problems, correct?

2 1

Sqlcounter - Data Download limiting
by Jaco van Tonder 27 Mar '06

27 Mar '06

I would like to use sqlcounter to limit the max number of bytes a user can download via a NAS. My NAS supports this, but I need sqlcounter to return a different attribute (eg. RecvLimit) and not Session-Timeout. I have also seen that this is possible with the counter module but not with sqlcounter Has anyone done this before / or have a patch for the sqlcounter module to enable this Jaco van Tonder

1 0

Zombie accounting processes
by George-Cristian Bîrzan 27 Mar '06

27 Mar '06

Hello! I've been having a rather annoying problem with FreeRADIUS, including version 1.1.0. I've set up authentication and accounting via a Perl script. -- George-Cristian Bîrzan Network Engineer _______________________________________ RCS & RDS Constanta Tel.: +40341.400.401 / +40341.400.402 Fax: +40341.400.450 http://www.rcs-rds.ro _______________________________________ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

4 10

RE: Different user attributes based on NAS-IP-Address? Also Suffixwildcards available?
by John Mylchreest 27 Mar '06

27 Mar '06

Funnily enough, I asked the very same thing recently. We do it quite crudely at the moment, but it works. We add an nshortname field to radreply/anything else necessary, and in sql.conf we link it to the user reply. Ie: Something like this would work: authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR radreply.nshortname is NULL) ORDER BY id" If you find any cleaner solution using the default schema, I would LOVE to hear about it, since that’s the problem/task I'm currently facing. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Andy Coates Sent: 27 March 2006 13:35 To: freeradius-users(a)lists.freeradius.org Subject: Different user attributes based on NAS-IP-Address? Also Suffixwildcards available? Hey, Is this even possible? The basic problem is that I have 2 devices that will use the same username. For example, one device handles dialup, one handles DSL. I'd like the user to have the same username, and depending on the NAS sending the request the correct IP/Netmask would be returned. I've setup huntgroups for the NAS, and can match them in various setups in the users file - but this only seems like it would work for group based attributes (i.e. common fields). Returning unique fields for each user based on the NAS-IP-Address doesn't seem possible? That aside, does anyone know if its possible to use wildcards with Suffix when stripping usernames? I've tried "@*" or "@*.domain.com" and it doesn't seem to match :( Thanks in advance, Andy. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Multiple Accounting in Radacct
by zack musa 27 Mar '06

27 Mar '06

Hi all. My radius server records to mysql database for every single user session for 3 times in three rows. similar records for 1 single user but the different is in mil.sec. What configuration in freeradius might done this? Is this because the NAS or th radius server? Thanks for any help. --------------------------------- Blab-away for as little as 1¢/min. Make PC-to-Phone Calls using Yahoo! Messenger with Voice.

2 1

proxy installation
by vivek mangai 27 Mar '06

27 Mar '06

1 0

How Getting accounting informations ?
by Vincent MARGUERIE 27 Mar '06

27 Mar '06

Hi guys, I would like to kkow, how I can get "accounting informations" from my client ? I use a dlink DWL-2000ap+ as NAS (is it compatible ?) and my client is connecting from a windows XP computer. Could you confirm that only the NAS can send accounting informations and not the client...am I right ? If it is, do you know if this dlink is compatible with accounting request ? Do you know another Acces point that sure make this task or is there a software that can be behind my acces point to do this right (a sort of NAS in fact) ? Thanks for your help, Vincent

2 1

Help !!!!
by fjlagos＠vtr.net 26 Mar '06

26 Mar '06

Hello: I have problem with freeradius. I am a new user of freeradius and radius. I have a Extreme Networks switch, i know how set Radius in the switch. I was login to the switch through freeradius, but i don't know how configure it. Please Help... Saludos y Gracias Francisco

1 0

Re: User Disconnect
by mohammad flaifel 26 Mar '06

26 Mar '06

Its for ADSL Customers mainly now and then will be for Dial-up on time basisregards,Flaifel> Message: 6> Date: Sun, 26 Mar 2006 11:58:37 +0200> From: "Seferovic Edvin" > Subject: RE: User Disconnect> To: "'FreeRadius users mailing list'"> > Message-ID: <200603260958.k2Q9wf3N018893(a)mxdrop44.xs4all.nl>> Content-Type: text/plain; charset="iso-8859-2"> > Hi,> > are you using PPP ???> > Regards,> > Edvin

1 0

User Disconnect
by Mohammad Flaifel 26 Mar '06

26 Mar '06

Dears, I know I asked this questions before, but I got lost what shall I do. Can I disconnect a user when he/she reaches a download limit? We have Radius server and connected to an oracle server. What do you think? Regards,

2 1