- Freeradius-Users - lists.freeradius.org

rlm_exec for diferent users
by Miguel 14 Oct '05

14 Oct '05

Hi, how can i run diferent scripts depending on the usergroup of the username? According to the documentation: in radiusd.conf i can define diferent rlm_exec scripts: modules { exec tariff { program = "/path/to/program/tariff" wait = yes input_pairs = request output_pairs = reply } [...] exec billing { program = "/path/to/program/billing" wait = yes input_pairs = request output_pairs = reply } [...] } authorize { [...] exec [...] } So, _every_ user will execute both scripts, i want that user a from usergroup tariff execute the script tariff, user b from usergroup billing execute script billing, etc Right now im doing it with radgroupreply and exec-program-wait, but this is depreciated, isnt it? what options did you leave me?, to check this inside every script? thanks

1 0

Group checking - Radius AVP retrieval
by lenirsantiago＠yahoo.com 14 Oct '05

14 Oct '05

Hello list, Radius authentication works fine. The problem is after, when my radiusclient/application sends another radius Access-Request message but without the User-Password field and freeradius complains that it requires it since we are using Digest. What the radiusclient is trying to do is find out if a user (in this case 1000) belongs to a specific group. In /etc/raddb/users file I have the following at line 152: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Group-Check, Auth-Type := None DEFAULT Service-Type == SIP-Callee-AVPs, Auth-Type := None ----- These are mysql tables: +----+----------+-----------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------+ | 1 | Jhassell | Password | == | changeme | | 2 | Rneis | Password | == | changeme | | 3 | 1000 | Password | == | 1000 | | 4 | 2000 | Password | == | 2000 | | 5 | 3000 | Password | == | 3000 | | 8 | 1000 | Auth-Type | := | Digest | +----+----------+-----------+----+----------+ +----+-----------+-----------+----+--------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+--------+ | 6 | Dialin | Auth-Type | := | Accept | +----+-----------+-----------+----+--------+ +----+-----------+---------------+----+----------------------------------+-- ----+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+---------------+----+----------------------------------+-- ----+ | 1 | Dialin | Reply-Message | = | "Authenticated by group Dialin" | 0 | | 2 | Dialin2 | Reply-Message | = | "Authenticated by group Dialin2" | 0 | +----+-----------+---------------+----+----------------------------------+-- ----+ +----+----------+---------------+----+------------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+------------------+ | 1 | 1000 | Reply-Message | = | "Authenticated" | | 2 | 1000 | Sip-Group | = | Dialin | | 3 | 1000 | SIP-AVP | = | Sip-Group:Dialin | +----+----------+---------------+----+------------------+ +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 1 | Jhassell | Dialin | | 2 | Rneis | Staticdial | | 3 | 1000 | Dialin | | 4 | 2000 | Dialin | | 5 | 3000 | Dialin | | 6 | 3000 | Dialin2 | +----+----------+------------+ ------ This is the debug I get from freeradius for the group check: rad_recv: Access-Request packet from host xx.xx.xx.xx:33025, id=15, length=67 User-Name = "1000(a)xx.xx.xx.xx" Sip-Group = "Dialin2" Service-Type = Group-Check NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 74 modcall[authorize]: module "preprocess" returns ok for request 74 modcall[authorize]: module "chap" returns noop for request 74 modcall[authorize]: module "mschap" returns noop for request 74 modcall[authorize]: module "digest" returns noop for request 74 rlm_realm: Looking up realm "xx.xx.xx.xx" for User-Name = "1000(a)xx.xx.xx.xx" rlm_realm: Found realm "xx.xx.xx.xx" rlm_realm: Adding Stripped-User-Name = "1000" rlm_realm: Proxying request from user 1000 to realm xx.xx.xx.xx rlm_realm: Adding Realm = "xx.xx.xx.xx" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 74 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 74 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 158 modcall[authorize]: module "files" returns ok for request 74 radius_xlat: '1000' rlm_sql (sql): sql_set_user escaped user --> '1000' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 74 modcall: group authorize returns ok for request 74 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 74 ERROR: No Digest-Nonce: Cannot perform Digest authentication modcall[authenticate]: module "digest" returns invalid for request 74 modcall: group authenticate returns invalid for request 74 auth: Failed to validate the user. Delaying request 74 for 1 seconds Finished request 74 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to xx.xx.xx.xx:33025 Reply-Message = "Authenticated" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 74 ID 15 with timestamp 434f1121 Nothing to do. Sleeping until we see a request. Any help in this matter would be deeply appreciated, thanks Lenir

3 2

Simultaneous Use question
by Miguel 14 Oct '05

14 Oct '05

Hi, at what time is the user included in the radutmp file, in the authentication process or after a successful connection? I mean, if i agree with some friend and make at the same time (well, almost...., supose 30 seconds delay from one call to another) a connection attemp, both will be authenticated by the nas, or there is some way to know in advance that an authentication is in progress and deny any other for that user? I've verified im having this problem, i use freeradius + postgres for my voip solution, with the wonderful pgsql-voip scripts from Peter, if a pin has an active call, nobody can make another call, but in the seconds when the ivr is telling the user "please enter your card number blablabla....", you are allowed to call the access number and interact with the ivr too, and if both users enter the same valid pin, both calls are established. Am i confusing or missing something??? I can give you more details if you need it. thanks

1 0

Freeradius, Ldap, and static IPs for users.
by Terry J Fike Jr 14 Oct '05

14 Oct '05

Hello All, I'm trying to figure out how to get a static ip to only show up on a DSL login, and not a Dial-up. I'm using Freeradius 1.0.1 and OpenLdap 2.1.30. The only changes in the radiusd.conf is to bind to an ip and port and turn off radutmp and radwtmp I have a huntgroup for the dial-up that allows me to differentiate between the dial and dsl based on the radiusGroupName without any problems. But now i need to be able to let a DSL user with a static ip be able to log in via dial-up and pull a dynamic ip. Is this possible and how do i do it (or for that matter, what docs might even point me in the right direction) i'm not seeing much on this in my searches. my huntgroups.conf is like this: dialup NAS-IP-Address == ip of nas device in my users file i have this: DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." DEFAULT Huntgroup-Name == dialup, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl128, User-Profile :="uid=dsl128,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl256, User-Profile :="uid=dsl256,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl512, User-Profile :="uid=dsl512,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl768, User-Profile :="uid=dsl768,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl4m, User-Profile :="uid=dsl4m,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Ldap-Group == dsl8m, User-Profile :="uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." the ldap user i'm testing this all with looks like this: dn: uid=tfike,ou=People,dc=mtaonline,dc=net cn: Terry gecos: Terry,,Fike gidNumber: 14 homeDirectory: /export/home/tfike loginShell: /bin/csh objectClass: posixAccount objectClass: top objectClass: radiusprofile objectClass: shadowAccount radiusFramedIPAddress: 216.152.176.25 radiusFramedIPNetmask: 255.255.255.255 radiusGroupName: dial radiusGroupName: dsl4m shadowLastChange: 13062 uid: tfike uidNumber: 130 userPassword: temppass thanks in advance. -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

crash, leaving PID file
by Tariq Rashid 14 Oct '05

14 Oct '05

i'm running a freeradius 1.0.2 as a proxy, with a very simple configuration - no ldap, no sql, only a users file, and some attribnute filters for pre- and post- proxying. strangely i'm finding that about once a day at random times the server is not running, but the PID is left - thus confusing any restart mechanisms. the main log file does not indicate any error. anyone suggest a good why to uncover the problem, short of running it in -X mode and waiting for it to fail. tariq

2 1

client configuration via postgres in version 1.0.1
by Joel Bjerk 14 Oct '05

14 Oct '05

Is it possible to use the nas table for client information instead of clients.conf? I tried uncommenting readclients=yes in sql.conf but the server read the clients from clients.conf. Thanks, Joel

3 4

rlm_perl & %RAD_REPLY issue
by Max Lock 14 Oct '05

14 Oct '05

Hi Folks, trying to run version 1.0.4 on Debian sarge.. export LD_PRELOAD=/usr/lib/libperl.so.5.8; freeradius -X (to account for known debian weirdness) using rlm_perl like so... sub authorize { $RAD_REPLY{'Max-Total-Octets'} = "xxx6000000"; &log_request_attributes; &log_reply_attributes; &log_check_attributes; return RLM_MODULE_UPDATED; } and getting the following error on STDOUT... rlm_perl: ERROR: Failed to create pair Max-Total-Octets = 6000000 googled around, but can't see anything? other attribs in sql radgroupcheck table are working fine (also using rlm_sql). I took a look at the source code, but I'm not really a coder, and couldn't follow it too easily. However, all I can see is that the following is failing in rlm_perl.c vpp = pairmake(key, val, T_OP_EQ); if (vpp != NULL) { pairadd(vp, vpp); radlog(L_DBG, "rlm_perl: Added pair %s = %s", key, val); return 1; } else { radlog(L_DBG, "rlm_perl: ERROR: Failed to create pair %s = % s", key, val); } can anyone point me in the right direction? just going to try version 1.0.5 in the meantime :) -Thanks Max.

3 9

testing freeradius ports
by jean 14 Oct '05

14 Oct '05

Hi All, I am running freeradius 1.0.5, it seems to start with no errors and listens on the default ports 1812 1813, should I be able to telnet to these ports to check if it accepts connections on them?

3 2

Logging question
by Curt LeCaptain 14 Oct '05

14 Oct '05

Currently I'm using the mysql logging functions of FreeRADIUS and I'm logging two different things: Dial-up customers that log in with just their username (username) DSL Customers that log in with user at domain (username(a)domain.com) I'm wondering, how would I get it so that both log the same way, that is, just username, not the suffix @itol.com. Any advice would be great! Thanks, Curt LeCaptain

3 2

RE: IP address assignment
by Infusino, Michael - ADP Dataphile 14 Oct '05

14 Oct '05

Very nice. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:jmaimon@ttec.com] Sent: Thursday, October 13, 2005 11:41 PM To: FreeRadius users mailing list Subject: Re: IP address assignment Infusino, Michael - ADP Dataphile wrote: > I am using radius to authenticate access from VPN. > > > > Would anyone now how to record the IP address the user is assigned after > they log in. > > > > Michael How does a little dynamic dns strike you? Make sure to actualy read below and attached scripts and setup a DNS key. --------------radiusd.conf------------- ----modules section-------- exec ddns_update { wait = no program = "/usr/local/sbin/radius-dns-update.sh" input_pairs = request packet_type = Accounting-Request shell_escape = yes } ------------end modules---- ----instantiate section------- ddns_update -----------end section-------- _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

3 2