- Freeradius-Users - lists.freeradius.org

Problem using exec module
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to use the next exec module: radius.conf ------------------- modules { exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{Autz-Type}" input_pairs = request output_pairs = reply } } authorize { suffix echo files sql auth_log } ------------------------------- And the Radiusd gave me the next output: radiusd -X -------------------- WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Autz-Type} radius_xlat: '/bin/echo ' Exec-Program: /bin/echo Exec-Program output: Exec-Program-Wait: plaintext: Exec-Program: returned: 0 ------------------------------- I hope someone can help me. Thanks and bye, NanO

2 2

Juniper buys Funk
by Alan DeKok 15 Nov '05

15 Nov '05

http://www.juniper.net/company/presscenter/pr/2005/pr-051114.html Alan DeKok.

3 3

Radius Server
by tarun sharma 15 Nov '05

15 Nov '05

Dear All, We are making a new Radius Server for our billing purpose so please kindly send me the installation procedure of new radius and necessary requirements of system. Waiting for your reply Thanks & Regards, Amit __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

3 3

Re: Radius Server
by Sean 15 Nov '05

15 Nov '05

Hi Tarun, I've written a how to for FreeRadius that might help you, You will find it here http://swarmhotspots.com/faq.html BTW You should be very explicit with questions posted to the mailing list. You will find people very helpful but don't ask questions if the answer can be found in the docs. Regards, Sean Bracken

1 0

Blank User-name attribute
by Gustave Nylander 15 Nov '05

15 Nov '05

Hello all, I have freeradias 1.0.5 installed with the rlm_perl module, and the trouble I'm having is that the user-name attribute is an empty string within the 'authenticate' routine I have for the perl script. My goal is to have the perl script handle the authentication, so this is obviously a problem. I'm guessing I have something misconfigured. Freeradius *definitely* runs the perl script, as you'll see from the debug info below. I have the perl script explicitely checking for an empty user-name string, and rejecting on that situation. Any hints would be much appreciated! In the .conf file, I have the following relevant sections: modules { perl{ module = /home/goose/radperl.pl func_authenticate = authenticate func_authorize = authorize } ... authorize { perl ... authenticate { perl And here is the debug from radiusd: rad_recv: Access-Request packet from host 127.0.0.1:33480, id=31, length=55 User-Name = "gus" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 perl_pool: item 0x9d35538 asigned new request. Handled so far: 1 found interpetator at address 0x9d35538 we did something with the perl module! perl_pool total/active/spare [5/0/5] Unreserve perl at address 0x9d35538 modcall[authorize]: module "perl" returns ok for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "gus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry gus at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type perl auth: type "perl" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 perl_pool: item 0x9e8b308 asigned new request. Handled so far: 1 found interpetator at address 0x9e8b308 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair User-Password = 123 rlm_perl: Added pair Auth-Type = perl perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x9e8b308 modcall[authenticate]: module "perl" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 127.0.0.1:33480 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 436d5cab Nothing to do. Sleeping until we see a request.

2 3

Send Cisco AVPair Attribute in Access-Accept Response
by Mehdi Torki 15 Nov '05

15 Nov '05

Hi all I have a Cisco AS5350 and I writed a custom TCL IVR script for voice application. When a call occures, then my script collects a 10 digit number and sends it to my freeRadius for authorization. my freeRadius configured with MySql db. I inserted (VENDOR: CISCO) and (ATTRIBUTE: Cisco-AVPair) in dictionary table. also in radreply table I have below record: <a 10 digit number> (user FIELD) Cisco-AVPair (Attribute FIELD) := (op FIELD) h323-ivr-in=A:B (Value FIELD) In debug output of Cisco AS5350, after sending authorization request, I saw: ************************************************************************ ROUTER#Received from id 42 192.168.230.110:1645<http://192.168.230.110:1645>, Access-Accept, len 56 4w5d: RADIUS: authenticator 06 3A 4D BB 2C AA 28 B8 - B7 11 CE DA B0 66 B2 66 4w5d: RADIUS: Vendor, Cisco [26] 24 4w5d: RADIUS: Cisco AVpair [1] 18 "h323-ivr-in=A:B" 4w5d: RADIUS: Service-Type [6] 6 Framed [2] 4w5d: RADIUS: Framed-Protocol [7] 6 PPP [1] ************************************************************************ It doesn't show any "Attribute 26 ..." in debug output. Also in my TCL script: "infotag get aaa_avpair_exists h323-ivr-in" returns False and could not found h323-ivr-in avpair in Access-Accept message! Please help me and guide me if I take a mistake on freeRadius configuration or MySql configuration for sending Cisco AVPair (VSA) to AS5350. Tank you in Advanced.

1 0

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 15 Nov '05

15 Nov '05

Yohoo! > This is done via simple LDAP bind, which AD supports. Yes, thought so. > It works for PAP authentication. It doesn't work for CHAP, MSCHAP, >or PEAP. THX for the information. I'm just writing a little howto. For completeness could you explain in short words the disadvantage when using PAP? Greets Christian

1 0

RE: 802.1x
by Jonathan De Graeve 15 Nov '05

15 Nov '05

Chillispot certainly does! M0n0wall almost ;) Don't know about nocat J. ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Alex M Verzonden: woensdag 2 november 2005 19:19 Aan: 'FreeRadius users mailing list' Onderwerp: RE: 802.1x Ok, will call Dlink to see if that have something (the hotspot itself has that functionality internally though) Also do you know if opensources such as NoCAT and ChillBox support such features? ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 1:08 PM To: FreeRadius users mailing list Subject: RE: 802.1x AV = ATTRIBUTE VALUE <? D-Link what? D-Link makes lots of stuff... generally great price... but not the most feature rich products. To get the features you desire you'll likely need a higher-end box. I'm not a big proponent of "pitching" specific products in this forum. Suffice it to say there are vendors that will (or attempt) to provide CoS / filtering on Wireless... jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm(a)lrcommunications.net> Date: Wed, November 02, 2005 10:04 am To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Ok I got it By the way what is AV pair? And how do you get NAS related attributes to control bandwidth from vendors? Like if im using D-Link how could I get attributes from them? Thanks! ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 11:53 AM To: FreeRadius users mailing list Subject: RE: 802.1x Alex, Features such as 'bandwidth and port blocking" (if any) are allocated/configured on the _NAS_ (in this case a NAS port) via AV pair/s provided by RADIUS... the '802.1x Supplicant" (Client/Endpoint) in simple terms... provides a secure/standard conduit which facilitates the communication of credentials (from the Supplicant to the Authenticator). The '802.1x Authenticator" (or NAS) _MAY_ provision/enforce Authorization for the specific endpoint in the context of a user or group... The management & granularity of this functionality verifies greatly by switch vendor as a result providing this functionality across a multi-vendor environment... in a large scale deployment... is often too complex to seriously consider.<?<? jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm(a)lrcommunications.net> Date: Wed, November 02, 2005 9:10 am To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Now im totally lost... Can u give me an example what 802.1x does? -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 02, 2005 11:04 AM To: FreeRadius users mailing list Subject: Re: 802.1x "Alex M" <alexm(a)lrcommunications.net> wrote: > So then such features as bandwidth and port blocking could be controlled via > 802.1x? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 12

nospace_user not working as expected in 1.0.5
by Kristina Pfaff-Harris 14 Nov '05

14 Nov '05

Hi, again. Another strangeness I noticed: we have "nospace_user = after" in radiusd.conf, but since switching to 1.0.5, this doesn't appear to act the same way as it did in 0.8.1. Using a username like "username " keeps rejecting the user instead of stripping spaces and trying again. "nospace_user = before" works fine. Actually, "nospace_pass = after" seems to work fine as well. Is this a known issue, or an "oops?" My workaround was to put use nospace_user before and keep nospace_pass after, since passwords may have spaces in them, but usernames may not. Thanks! Kristina

2 4

Script for counting # of NAS ports in use?
by Scott Langley 14 Nov '05

14 Nov '05

Before I write one, I wonder if anyone already has a script or module for counting the number of ports on a NAS that were in use at a given point of time? I know this can be done by collecting the SNMP data sent from the NAS, but I would rather do this by querying the radacct table in a SQL database. -- Scott Langley scott(a)ruralnetwork.net Systems Administrator Rural Network Services

2 1