- Freeradius-Users - lists.freeradius.org

Passing value of attribute set in acct_users
by Ben Plimpton 16 Mar '06

16 Mar '06

Can someone please tell me how I can reference a value I set in the acct_users file so that I can use it in attr_rewrite? Or can I not do so? Thanks Ben

1 0

Question about processing multiple authorization sources
by Will Saxon 16 Mar '06

16 Mar '06

Hello, I am using FreeRADIUS 1.1.0 on FreeBSD 6.0 with Cisco Aironet 1200 WAPs. I need to be able to control which VLAN my users are assigned to, and it seems like this is accomplished by setting three RADIUS user attributes which control the assigned vlan after authentication. The problem is that my authorization/authentication source is an LDAP server, which I don't have any control over, that does not contain these attributes. Is it possible to have FreeRADIUS check a separate user database to provide the additional attributes? It seems like I could write a script to take the username, perform some database queries and return the appropriate information, but beyond that I don't know how to go about implementing such a solution. If it matters, I am currently using EAP-TTLS/PAP with SecureW2 and the aforementioned LDAP server. -Will -- Will Saxon Systems Programmer - Network Services University of Florida Department of Housing

2 2

RE: About Monthly Time Limits
by Ben Plimpton 16 Mar '06

16 Mar '06

Please let me know if you can tell what I'm doing wrong. I do authorization and authentication all from LDAP. Here's my line in ldap.attrmap: replyItem Ldap-UserDn dn Here's my counter config: counter monthly { filename = ${raddbdir}/db.monthly key = Ldap-UserDn count-attribute = Acct-Session-Time reset = monthly counter-name = Monthly-Session-Time check-name = Max-Monthly-Session allowed-servicetype = Framed-User cache-size = 5000 } But I get this in my radius logs when I logout: rlm_counter: Packet Unique ID = '549154f744531b54' rlm_counter: Could not find the key-attribute in the request. Returning NOOP. I hope I'm not missing something really simple. Thanks Ben On Tue, 2006-03-14 at 00:05 +0100, Seferovic Edvin wrote: > > -----Original Message----- > > From: freeradius-users-> > >bounces+edvin.seferovic=kolp.at(a)lists.freeradius.org > [mailto:freeradius->users-bounces+edvin.seferovic=kolp.at(a)lists.freeradius.o > rg] On Behalf Of >Ben Plimpton > >Sent: Montag, 13. März 2006 23:34 > >To: freeradius-users(a)lists.freeradius.org > >Subject: RE: About Monthly Time Limits > > > >This is a somewhat related question. > > > >Can I use an attribute that is not in the Stop record as the key for a > >monthly counter? For example, I would like to make the Ldap-UserDn > >attribute the key for the counter. Is there a way to make that value > >available to my counter? > > > >Thanks > > Sure.. if you use LDAP for Authentication and Authorisation ! there is > ldap.attrmap file which maps the LDAP attributes to freeradius attributes. > > The key is usually username ( or something else specific for a user or > machine ). > > I have such setup in a boarding home and it works like a charm ;) > > Regards, > > Edvin >

4 4

LDAP authorization for EAP-TLS authentication
by Keith Moores 16 Mar '06

16 Mar '06

I'm trying to understand the relationship between the modules in the authorize {} and authenticate {} sections and how it relates to the directives defined in users. EAP-TLS works fine, but I can't seem to figure how to get make the ldap authorization reject a user. DEFAULT Auth-Type := eap, Autz-Type := ldap authorize{ preprocess ldap eap } authenticate { eap } ldap { server = "our-server.itc.virginia.edu" identity = "uid=uva-all,ou=ITC-User,ou=It,o=University of Virginia,c=US" password = "our-password" basedn = "o=University of Virginia,c=US" filter = "(wirelessAccess=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=Person)" start_tls = no access_attr = "wirelessAccess" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = yes } In the ldap server logs show multiple queries, which are not returning anything. This can be confirmed with: ldapsearch -b "o=University of Virginia,c=US" wirelessAccess=kmm6b wirelessAccess which returns nothing. If nothing is returned shouldn't the authorization fail? I'm missing something, hopefully not too obvious... ------------------------------------------------------------------------ Keith Moores <mailto:kmm6b@virginia.edu> Network Systems ITC-Communications and Systems Division University of Virginia, ITC-2015 Ivy Rd Phone (434) 924-0621 Box 400324, Charlottesville, VA 22904-4324 Fax (434) 982-4715

2 1

freeradius
by mkerkoub＠free.fr 16 Mar '06

16 Mar '06

Hello, Here is my question: i would like to créate a proxy freeradius. I have 3 forests, 3 data base for storing users. I want to know how to configure: 1. proxy freeradius with IAS in each forest, how to give to freeradius server the certificat stored in active directory? 2. Is it possible to configure proxy freeradius to forward requests directly to Active Directory without IAS (3 Active directory). Thank you very much for you answer. Have a good day.

2 1

problem with secret
by Guido 16 Mar '06

16 Mar '06

Hi list, I'm using Freeradius 1.0.2 and receiving request from Squire SVI Softswitch as NAS. The problem is that Squire softswitch is not sending to freeradius the shared secret in request accounting. So, I need accept accounting request from a NAS that does not send secret. I know that secret is mandatory in clients.conf, but I need solve this... Who can help me ? Thanks in advance, Guido

2 1

Working freeradius without shared secret!
by Guido 16 Mar '06

16 Mar '06

Hi, everybode, I sent this same mesage last March 14. I NEED accept a NAS that is not sending the shared secret. Somebody can help me ? please, if not, somebody can tell me which part of source code must I modify? Thanks very much, Guido

2 1

Ldap-Group AND EAP-TTLS/Ldap Question (Again)
by Benoît Bianchi 16 Mar '06

16 Mar '06

Hi, Is there a way to use the Ldap-Group with EAP-TTLS authentication based on LDAP??? Ive set it up in my users file but It doesnt work as the group belonging is performed on the outer identity first Can I some way specify to check the group only for the tunnelled identity? Benoît Bianchi. Ingénieur Système CRI / ISTY Université de Versailles Saint Quentin en Yvelines

2 1

There are no DB handles to use
by Vasco Santos 16 Mar '06

16 Mar '06

Hi Folks, I have freebsd 4.10-RELEASE with mysql 4.1.1-alpha and freeradius 1.1.0 Radius give me this error: There are no DB handles to use! what this error means ? radiusd -X ql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1845 Listening on accounting *:1846 Listening on proxy *:1847 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.11:2919, id=83, length=57 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 192.168.1.11 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "teste", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user teste to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'teste' rlm_sql (sql): sql_set_user escaped user --> 'teste' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'teste' ORDER BY id' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 My mysql.log show only connections but querys no. What is the min System Requerements to freeradius work, mem and processor ? Try to install a old version of radius?

1 0

Help mixing proxied and non-proxied auth mechanisms
by Geoff Silver 16 Mar '06

16 Mar '06

I'm hoping to simply my users file, and I'm hoping someone can help. Right now I have something like the following. users file: --------- user01 Auth-Type:=Accept, Huntgroup-Name=="Office", Hint==Port-1812 Connect-Info="OFFICE_NET" user01 Huntgroup-Name=="Office", Hint==Port-1645, Proxy-To-Realm := PROXY_GW Connect-Info="OFFICE_NET" hints: ----- DEFAULT User-Name =~ "^(.*)$" Hint = "Port-%{request:Packet-Dst-Port}" proxy.conf: ---------- proxy server { synchronous = no retry_delay = 5 retry_count = 1 dead_time = 300 default_fallback = yes # enable post_proxy_authorize to get our local radius instance to # send back the connect-info on successful auth post_proxy_authorize = yes } realm PROXY_GW { type = radius authhost = 10.1.2.3:1812 secret = mys3kr1t } Basically, if "user01" connects on port 1812, all we do is the authorize step. If they're in the users file, they get access. If not, they don't. If "user01" connects on port 1645, we want to proxy their authentication to another radius server, and we want to do authorization locally against this file. So, right now, for every huntgroup/connect-info pair, I have *two* entries in the users file. One is for Port-1812, the other for Port-1645. So the question of the hour is: Is there something nifty I can do to eliminate the need for *two* nearly-identical entries for each user? Thanks!

3 5