- Freeradius-Users - lists.freeradius.org

RE: Grab caller id and insert into radcheck how to
by Jonathan De Graeve 08 Oct '05

08 Oct '05

You should use: IF NOT EXISTS -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Shane Hart Verzonden: vrijdag 7 oktober 2005 13:22 Aan: FreeRadius users mailing list Onderwerp: Grab caller id and insert into radcheck how to Hi all, I an attempting to add an additional attribute upon the first login for user accounts and I am a bit lost. The way I am testing this is with postauth query. postauth_query = "INSERT into ${authcheck_table} (id, UserName, Attribute, op, value) values('', '%{SQL-User-Name}', 'Calling-Station-Id', '==', '%{Calling-Station-Id}' )" This works great but it adds a new record every time the user successfully authenticates. Not a problem really but there are also users I don't need to lock to a caller id. I tried using postauth_query = "UPDATE in various ways but I just can't get my head around it. If I manually create an entry in radcheck for a user with the attribute "Calling-Station-Id" and a "NULL" value, then the user can't login obviously. Does anybody have any ideas how to have this attribute somehow dynamically created when the user first logs in if they are a member of a group and ultimately not create it if the record already exists? Any ideas or pointers greatly appreciated. Thanks Shane - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

about pam_radius_auth.so module and creating user accounts on AAA client..
by Raj 07 Oct '05

07 Oct '05

If I have a Radius client setup on a RHEL 4.0 linux with pam_auth_radius module active for telnet/ssh service, do I need to create a linux user (with no passwd) that is same as the Radius user for this authentication to work? This is assuming "sufficient" control flag for pam_radius_auth as the very first entry in the related service files under /etc/pam.d dir. Basically, I don't want to create a user account on AAA client machine but only on AAA server. Is there a way I can accomplish this using pam_auth_radius and nsswitch.conf ? i.e if there's a way to specify AAA server lookup for passwd DB in nsswitch.conf? __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Post Accounting
by Devrim Seral 07 Oct '05

07 Oct '05

Hi freeradius community! I want to do something with freeradius but i haven't find any information how to do that. The problem is I want to run SQL query after accounting stop request with in sql module. I found that sql module have postauth_query feature. So i want same functionality but after accounting stop request.. Is there any way to do it? (Note that i don't want to use SQL trigger) Thanks for your responses devrim

2 1

best practice for combination freeradius -- active directory?
by ho 07 Oct '05

07 Oct '05

Hi all, i need some more ideas for doing a good, stable and easy to use connection between freeradius and Active Directory. first of all a little bit of our configuration and history: i've set up a freeradius server for authentication/authorization/accounting of dsl-dial-in user on a cisco asa. it works very well: - local (Auth-type = system) authentication on a linux box - authorisation (especially cisco acl's) - mysql-db -- accounting (this is my favourite feature!!!!!) a new requirement was given to make a connection between the asa and our central authentication: Active Directory. AD is a must in our company. first there were many thoughts in my brain, then i decided to use a NIS-Master-Client combination to do this stuff (it was the easiest way for me to implement). -> freeradius-server is the NIS-client, so Auth-Type = system still remains -> the AD-Servers have installed MS SFU (Services for Unix) with a NIS-Master Server. Everything works well ... but the procedure to get the AD-Users into the SFU-NIS-Master-Server seems to be a little bit tricky, particularly the password stuff (it must be changed in the AD at the first time it was brought into SFU although it was synchronized !!??) I think, this is a solution for 1-100 Users, but not for 2000 and this is our aim. a LDAP-Server is not planned in our company. So now my questions: ---------------------------- - has anybody implemented a similar system? - what could be a alternative/better way to make a connection between freeradius and the AD-Servers only for password-authentication? Authorization and Accounting still remains on the linux-box - I've heard from our AD-God's ;-) that kerberos is used in the AD-system and that it could be a way? ---> has anybody tried this? I would be glad for any idea or hints. Thank you.

3 2

Re: newbie install problem
by Lefteris St 07 Oct '05

07 Oct '05

>I have RedHat ES4 and I downloaded FreeRadius-1.0.5. >unzipped it and >did >./configure >make >make install > >It didn't seem to complain, but I can't run it. I can't >find the >radiusd >file. And after server startup I don't see any radius >daemon running. >How do >I run it? The radiusd binary should be in the /usr/local/sbin folder. If not, something went wrong during compile/installation. Check the output again. It may help if you redirect it to a file (like make > make_output.txt). You can also check configure.log. Lefteris, __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

3 3

Add Attribute into Accounting-Response packet ?
by Yurij Korik 07 Oct '05

07 Oct '05

Hi. Forgive for my bad english. When RADIUS got an update accounting packet (PW_STATUS_ALIVE), i need create and add pair (for example "Session-timeout") into request->reply->vps (module rlm_sql). I write apropriate code into rlm_sql.c alivepair = paircreate(PW_SESSION_TIMEOUT, PW_TYPE_INTEGER); alivepair->lvalue = sesstout; pairadd(&request->reply->vps, alivepair); It's need to dynamically change Session-timeout depend by user trafic. Is possible sothat this attributes was sended with Accounting-Response packet to NAS ?

2 1

freeradis with other library then opnssl
by Sudhananda 07 Oct '05

07 Oct '05

Hi, I have got a supplicant which does not use openssl library. does my supplicant works with freeradius server? Does the certifiactes generated using openssl work with this? Thanks, Sudhananda This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message.Global Edge Software Ltd has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Global Edge Software Ltd reserves the right to monitor and review the content of all messages sent to or from this e-mail address

1 0

RE: SQL Integration
by Jonathan De Graeve 07 Oct '05

07 Oct '05

>1. It is possible with to get free radius to failed logins to the sql >database, as well as logging to another table that a successful login >occurred yes >2 is it possible to populate the utmp / wtmp files into a database as well >instead of a flat file? Yes >Thanks all in advance No problem J.

2 1

Which Operating System is best for freeRADIUS
by Gunther 07 Oct '05

07 Oct '05

Building my FR server, I have the choice of a number of operating system for my FreeRADIUS server. Anybody with a suggestion which operating system is best suited for FR? I like to run FR on a VPS (virtual private server) using one of the following OS: - FreeBSD 4.9 (jail) - FreeBSD 5.2 (jail) - Fedora 2 (virtuozza) - Redhat AS3 (virtuozza) - Redhat 9.0 (virtuozza) - CentOS 4.0 (virtuozza) Thanks! Gunther

6 8

RE: RE: access for 24 hours after first login?
by Jonathan De Graeve 07 Oct '05

07 Oct '05

>how is the actual comparision of the calculated value in "query" done, does >it >mean, that the value returned by "query" has to be smaller than the one >referred to by "check-name" (in your example Max-Secs-Passed)? It works quite simple If ( (Max-Secs-Passed - All-Secs-Passed > 0) => allow access >what does the line "sqlmod-inst = sql" mean (in >/usr/share/doc/freeradius/rlm_sqlcounter there is also the value "sqlcc3", >what >does this do?) It are the defined SQL instances in sql.conf >what about the following: > >SELECT TO_DAYS(NOW()) - TO_DAYS(AcctStartTime) from radacct WHERE UserName >= >'%(%k)' LIMIT 1; This query works but I don't use it because of the rounding it gives me... >would this mean that a user can login until 23:59 after logged in the first >time >that day? Yes, since he doesn't look at the hour/minutes/seconds...

1 0