- Freeradius-Users - lists.freeradius.org

assigning a vlan-id after successful authentication
by Sven Juergensen 12 Nov '05

12 Nov '05

hello people, how does the above mentioned work? i am not quite sure where to start. is it embedded in the 'Reply-Message' or does it have to do with the tunnel-types? i'm trying to supply a vlan-id to an hp2626 with mac-based authentication. couldn't find this in the faq or relevant conf-files either - what am i missing? thanks alot in advance, sven

2 1

RE: possible bug in rlm_preprocess parsing of huntgroups?
by Jonathan De Graeve 12 Nov '05

12 Nov '05

> This time it DID match on the proper huntgroup. Radiusd debugging > confirms this, but for the sake of brevity I omitted it here. This > email is already long enough. Is this a bug or am I clearly doing > something wrong? This behavior is not seen in freeradius-0.9.3. It > seems to surface after 1.x. Prior to 1.x users file huntgroup matching > happens perfectly regardless of order and quantity of huntgroups. > > Any ideas? Thanks in advance! > There's nothing wrong with Freeradius. The code is: first matched, first served. The order in which you setup huntgroups is important, that's all. So you always need to specify the exceptions first and later on the default stuff J.

1 0

Ascend-Data-Filters
by Eric Gregory 12 Nov '05

12 Nov '05

I am having an issue that hopefully someone can help with. I am trying to configure my radius server to send liethe following reps Ascend-Data-Filterwhen a user authenticates. Ascend-Data-Filter = ip in forward tcp est Ascend-Data-Filter = ip in forward dstip xxx.xxx.xxx.4/32 Ascend-Data-Filter = ip in drop tcp dstport = 25 Ascend-Data-Filter = ip in forward This is for configuration with GlobalPops and I need my users to be able to relay mail through my SMTP server for this to work. I am using FreeRadius 1.0.4 with the Mysql backend. When I run radcheck I get this info in the reply Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Netmask = 255.255.255.255 Session-Timeout = 43200 Idle-Timeout = 1500 Port-Limit = 1 Framed-MTU = 1300 Ascend-Data-Filter = "ip in forward tcp est" If I wipe out the "ip in forward tcp est" line I get the "ip in forward dstip xxx.xxx.xxx.4/32" line in the reply, if I wipe that out the next comes back but I can't get more than one to come back at me. I have tried applying the filters to the user and to the group which the user is a part of and gotten the same result. Anyone know what my problem is here. Is there a setting that I have to set to allow it to send multiple instances of the same reply attribute back? Thanks for any help you can offer. Eric Gregory

3 2

possible bug in rlm_preprocess parsing of huntgroups?
by Christopher Carver 12 Nov '05

12 Nov '05

The scenario is complicated. I will try to keep this as short and simple as possible. We are experiencing odd and different behavior when we modify just the order of the huntgroups being built in raddb/huntgroups. Nothing else is changed, just the ordering. FreeBSD 5.3-RELEASE w/ Freeradius-1.0.5. We authenticate dialup users. In our users file we want to pass back to the NAS a specific ip pool if the customer's Calling-Station-Id is a certain set of area codes and exchanges. However, we want to have exceptions to this. So, we have a huntgroup called "migration" for the set of Calling-Station-Id area codes and exchanges and an "exceptions" huntgroup that has the Calling-Station-Id values of people who will not get the ip pool even though they are part of the set defined under "migration". raddb/huntgroups (note the ordering, migration THEN exceptions): migration Calling-Station-Id =~ "^304729" migration Calling-Station-Id =~ "^304297" exceptions Calling-Station-Id =~ "3047291185" exceptions Calling-Station-Id =~ "3047299137" exceptions Calling-Station-Id =~ "3042972446" raddb/users (note the use of fall-through to keep exceptions matches from getting the ip pool): DEFAULT Autz-Type := NoTollfree, Simultaneous-Use := 1, Session-Type := dialup Port-Limit = 1, Idle-Timeout = 1800, Framed-Protocol = PPP, Service-Type = Framed-User, Fall-Through = yes DEFAULT Huntgroup-Name == exceptions Fall-Through = no DEFAULT Huntgroup-Name == migration cisco-avpair = "ip:addr-pool=migration", Now we test with an authentication request packet in a file and radclient. Here is the contents of the file and output when testing with radclient: # auth request packet User-Name = test Password = test Calling-Station-Id = 3047291185 # radiusd reply packet Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Cisco-AVPair = "ip:addr-pool=migration" Port-Limit = 2 It obviously didn't match the exceptions huntgroup in the huntgroups file because 3047291185 is clearly a member of that huntgroup. radiusd -x verifies it did not. Now watch what happens when we do nothing but reverse the order of the huntgroups and restart radiusd. The users file and authentication request packet will both remain exactly the same. Here's the new raddb/huntgroups file: exceptions Calling-Station-Id =~ "3047291185" exceptions Calling-Station-Id =~ "3047299137" exceptions Calling-Station-Id =~ "3042972446" migration Calling-Station-Id =~ "^304729" migration Calling-Station-Id =~ "^304297" Now the new output after testing with radclient (keeping the auth packet and users file exactly the same): Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Port-Limit = 2 This time it DID match on the proper huntgroup. Radiusd debugging confirms this, but for the sake of brevity I omitted it here. This email is already long enough. Is this a bug or am I clearly doing something wrong? This behavior is not seen in freeradius-0.9.3. It seems to surface after 1.x. Prior to 1.x users file huntgroup matching happens perfectly regardless of order and quantity of huntgroups. Any ideas? Thanks in advance! Chris Carver

1 0

Announce: ARA v.0.3 released.
by Dawid Ciężarkiewicz 11 Nov '05

11 Nov '05

ARA is OpenSource web application written in PHP. It's goal is to create simple but convenient solution for managing the FreeRADIUS server. It resides on web server and connects to FreeRADIUS' database to allow easy and efficient manipulation of users, groups, network access servers and more. Currently only MySQL backend is finished, but adding other should be easy. While being a PHP application ARA uses the Sigma templating engine, and it's code tries to be friendly and "developer inviting". Be sure to check out the 0.3 release screenshots: http://projects.asn.pl/ara/wiki/screenshots And grab ARA here: http://download.asn.pl/ara/ara-0.3.tar.gz md5: aaf0301668a82bc1e9dcfa026e2fe100 More on http://projects.asn.pl/ara/ . Waiting for your comments! -- Dawid Ciężarkiewicz

1 0

RE: freeradius wont let realms based auth
by Andres Pazos 11 Nov '05

11 Nov '05

thanks anyway!. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Alan DeKok Sent: Fri 11/11/2005 4:18 PM To: FreeRadius users mailing list Subject: Re: freeradius wont let realms based auth "Andres Pazos" <andy(a)ferengi.com.ar> wrote: > My problem is that after reading the "users" file and getting a Match, > when Radius enters the authorize seccion it never read the subsection > "autz-Type SQL2 { sql2 }". what's wrong with that?. thanks alan! I think the problem is that your story keeps changing. I don't think I can help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

accounting question
by Chuck 11 Nov '05

11 Nov '05

we keep getting a lot of missed stop packets that we never had problems with when we ran icradius. I don't know what the problem could be but I am getting ready to turn accounting off for us. However I have a major concern with this. We are using the mysql option with freeradius including the nas table. We use a flat file, proxy.conf, for our remote realm configurations. We proxy for a number of remote realms running their own radius authentication and they receive accounting information we receive from our upstream passed on to them. If I turn accounting off, is there a way we can still pass accounting through to our remote realms, or is it a global on/off switch that affects everyone? I just don't want to keep track of it locally until we can figure out what is causing this. I do notice a number of error messages about 0 length stop packets being received and I assume they are rejected. I have also contacted our upstream provider and asked them to be sure all is well with what they pass us. We use 1645:1646 and have those ports in iptables to freely accept.. are there possibly other ports I should be putting in there? -- Chuck

2 3

RE: freeradius wont let realms based auth
by Andres Pazos 11 Nov '05

11 Nov '05

thanks again. im really sorry about mistakes i've made. i was trying to say "authorize" instead of "authenticate", then: if realm is "wireless", i want radius to authorize the user using MySQL. if realm is "dhcp", i want radius to authorize the user using the SQL server. ----- users file # Except these two lines of the file the rest is commented. line 155 - DEFAULT Auth-Type := System, Realm == "wireless", Autz-Type := SQL1 line 157 - DEFAULT Auth-Type := System, Realm == "dhcp", Autz-Type := SQL2 ------ radiusd.conf file $INCLUDE ${confdir}/sql1.conf $INCLUDE ${confdir}/sql2.conf authorize { ... Autz-Type SQL1 { sql1 } Autz-Type SQL2 { sql2 } } My problem is that after reading the "users" file and getting a Match, when Radius enters the authorize seccion it never read the subsection "Autz-Type SQL2 { sql2 }". what's wrong with that?. thanks alan!. should i add more files/data?. thanks!!!

2 1

radiusd.conf[9] Failed to link to module 'rlm_eap'
by Daniel Frankovic 11 Nov '05

11 Nov '05

Hi, I have a problem: radiusd.conf[9] Failed to link to module 'rlm_eap': /usr/local/lib/ rlm_eap-1.0.2.so: cannot make segment writable for relocation: Permission denied I have tried with freeradius 1.0.5 same problem Can anyone help me? Daniel

2 1

virtual domains as realms
by Marko Dinic 11 Nov '05

11 Nov '05

Hello, I have the following setup on my system: In LDAP i have: dc=mydomain,dc=com | |---ou=Virtual Domains | | |---dc=domain1.com | | | |---uid=john | |---uid=mike | |---uid=peter | |---dc=domain2.com | | | |---uid=john | |---uid=mike | |---uid=andrew | |---dc=domain3.com | | | |---uid=mike | |---uid=jack | |---uid=joe | etc. These are virtual domains and accounts for some mail service and they have to be arranged only in the above order. In addition to mail service, virtual users are supposed to have a dialup access, logging in as username(a)virtualdomain.com i.e. john(a)domain1.com, john(a)domain2.com, mike(a)domain3.com and so on... If I configure LDAP module like this: ldap ldap_vdomains { ... basedn = "dc=%{Realm},ou=Virtual Domains,dc=eunet,dc=yu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=posixAccount)" ... } and add each of these virtual domains to proxy.conf as realms, it works like a charm... However, these domains and accounts are independently created in LDAP through some web interface by our accounting officers in the sales department, so proxy.conf is not updated every time the domain is added or modified. Of course, it could be automatically updated by some script, but, still, I don't like the idea of HUPing radius every time virtual domain is added, removed or renamed. So, realm DEFAULT seems like an elegant solution, but, when it produces a match for any of these virtual domains realms, it sets Realm = DEFAULT and LDAP search is done with basedn = "dc=DEFAULT,ou=Virtual Domains,dc=eunet,dc=yu" Is there a way to make the DEFAULT realm preserve the original realm name from the request and set it as the Realm attribute's value instead of "DEFAULT" ? If not, is there some other solution to this ? It could help if I could at least set the DEFAULT realm not to strip the user name and then use regexp to extract the realm name from %{User-Name} in basedn= line in ldap module config, but I don't seem to find the working syntax for this. Simply put, I need a way of using the realm part of the User-Name in ldap module's configuration, while using only realm DEFAULT (or, perhaps, some other catch-all entry, if availabe) in proxy.conf. -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. -----

2 1