- Freeradius-Users - lists.freeradius.org

access for 24 hours after first login?
by Markus Krause 06 Oct '05

06 Oct '05

hello list, i set up freeradius succesfully for authentification against pam and users file :-) now i want to enhance the functionality about the following feature: setting up several predefined (guest) accounts with a generated username and password. this account should be valid from the first time it is used (first login) for 24 hours (or even better until 23:59 that day). this is intended for our daily visitors and guests or for conference members, the idea is to give them a username/password pair to be used just that day without much administration effort. (just generate a list of lets say 100 accounts and if they have been used just create new ones). (how) can this be realized using freeradius? has anyone set up a similar (or even better ;-) ) solution for this aim? (one-day passwords valid after first login) thanks for any help and hints! regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Re: question on dialup_admin
by Kostas Kalevras 06 Oct '05

06 Oct '05

On Thu, 6 Oct 2005, radius.unime(a)email.it wrote: > Ok, > I have successfuly stored in mysql the lod data. > > But the Calling-Station-Id and Called-Station-Id aren't stored. This > attributes are present in the access_request and access_response packet but > not in the accounting_packet. It's possible to store this data also? > > Thanks, > Felice If they are not present in the accounting packets there's not much you can do. Try making your NAS send them. -- Kostas Kalevras Network Operations Center kkalev(a)noc.ntua.gr National Technical University of Athens, Greece Work Phone: +30 210 7721861 'Go back to the shadow' Gandalf

1 0

RE: Using freeradius and 802.1x for dynamic VLAN on Cisco 2950
by Øystein Gåsdal 06 Oct '05

06 Oct '05

I think you need to apply this command to the port: switchport access vlan dynamic - Øystein Gåsdal _____ From: HOWLETT C DsicEmi [mailto:Claire.Howlett@socgen.com] Sent: 6. oktober 2005 10:54 To: freeradius-users(a)lists.freeradius.org Subject: Using freeradius and 802.1x for dynamic VLAN on Cisco 2950 Hi Everyone, Dave, Are you sure the command aaa authentication network default group radius is valid on 2950 switches ? I am running Version 12.1(22)EA5, which was the last stable image in july and "network" is not available as aaa authentication option. If anyone has met any success with dynamic VLAN assignment on Cisco 29502 with FreeRadius. I am interested ! Here is how my user is declared: Client_Arpege Auth-Type := EAP Service-Type = Framed-User, Reply-Message = "Authentification OK - Bienvenue sur le RCSG", Tunnel-Type = :1:VLAN, Tunnel-Medium-Type = :1:6, Tunnel-Private-Group-ID = :1:140 :1: are used to give tags a value of 1, 6 is interprested by FreeRadius as IEEE-802. I have checked with Ethereal and the paquet sent seems OK. I think the problem comes from the switch. Here is the configuration file: ! version 12.1 no service pad service timestamps debug datetime msec localtime service timestamps log datetime msec localtime no service password-encryption ! hostname Switch802_1x ! aaa new-model aaa authentication login default group radius local aaa authentication dot1x default group radius aaa authorization exec default group radius if-authenticated aaa accounting dot1x default start-stop group radius enable password ******** ! username admin secret 5 $1$IqQs$tJ9S4pfeDfZR42vlaFrbQ1 ip subnet-zero ! ! spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id dot1x system-auth-control ! ! ! ! interface FastEthernet0/1 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/2 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/3 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/4 switchport access vlan 136 switchport mode access spanning-tree portfast ! interface FastEthernet0/5 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/6 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/7 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/8 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/9 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/10 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/11 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/12 switchport access vlan 141 switchport mode access switchport port-security switchport port-security mac-address sticky switchport port-security mac-address sticky 0001.e6a7.09d8 spanning-tree portfast ! interface FastEthernet0/13 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/14 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/15 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/16 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/17 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/18 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/19 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/20 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/21 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/22 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/23 switchport mode access dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/24 switchport trunk native vlan 136 switchport mode trunk ! interface GigabitEthernet0/1 ! interface GigabitEthernet0/2 ! interface Vlan1 no ip address no ip route-cache shutdown ! interface Vlan136 ip address XX.XX.XX.XX 255.255.255.0 no ip route-cache ! ip default-gateway YY.YY.YY.YY ip http server logging trap notifications logging facility local6 logging ZZ.ZZ.ZZ.ZZ radius-server host ZZ.ZZ.ZZ.ZZ auth-port 1812 acct-port 1813 key testing123 radius-server retransmit 3 ! line con 0 exec-timeout 0 0 password ******** line vty 0 4 exec-timeout 0 0 password ******** line vty 5 15 exec-timeout 0 0 password ******** ! ! end The Client is connected to port 0/23 which is dot1x enabled. It is authenticated (interface is up and logs in Freeradius prove that it's OK) BUT interface 0/23 remains in vlan 1, whereas it should be switched to vlan 140. Switch802_1x#sh vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/18, Fa0/19, Fa0/20, Fa0/21 Fa0/22, Fa0/23, Gi0/1, Gi0/2 136 reseau_PFT-DEF active Fa0/1, Fa0/2, Fa0/3, Fa0/4 140 VLAN0140 active 141 VLAN0141 active Fa0/12 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup If anyone can help me... I am losing hope ;-( Claire, claire.howlett(a)socgen.com ======================================================= Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. La SOCIETE GENERALE et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ======================================================= This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorized use or dissemination is prohibited. E-mails are susceptible to alteration. Neither SOCIETE GENERALE nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. =======================================================

1 0

request->proxy & request->proxy_reply
by Massimiliano Liccardo 06 Oct '05

06 Oct '05

hi folks, I should write a module that strips/modifies AV pairs from a proxy reply according to the AV pairs prior sent into the originated request. My doubt is: the AV request->proxy are still valid during post-proxy stage of a rlm_module? -- Massimiliano Liccardo (maX) <liccardo(a)acmesolutions.it> jid:coccolesto@jabber.org sip:maX@macchese.no-ip.org GnuPG public key available on wwwkeys.eu.pgp.net Key ID: D01F1CAD Key fingerprint: 992D 91B7 9682 9735 12C9 402D AD3F E4BB D01F 1CAD "la velocità induce all'oblio, la lentezza al ricordo"

3 2

Re: question on dialup_admin
by radius.unime＠email.it 06 Oct '05

06 Oct '05

--------- Original Message -------- Da: Kostas Kalevras <kkalev(a)noc.ntua.gr> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Oggetto: Re: question on dialup_admin Data: 04/10/05 16:36 > > > On Mon, 3 Oct 2005, radius.unime(a)email.it wrote: > > > Hello! > > > > I have a question on dialup_admin: > > > > I have configured freeradius to authorization by LDAP and authentication by > > EAP and it works fine. > > > > Now I want to log the activity of my users with dialup_admin, > > > > it's necessary that I use sql for authentication and authorization? or I can > > use EAP and LDAP again and dialup_admin only for log? > > dialupadmin will use sql to read accounting data and sql OR ldap to read user > data. So u only need to point dialupadmin to ldap to read your user profiles > and to sql to read the accounting information. > > Hope this helps > > > > > If yes, I must add the entry in the database (mysql) for any user that can > > access to my network? > > > > excuse me for my bad english... > > Thanks, > > > > Felice > > -- > > Email.it, the professional e-mail, gratis per te: http://www.email.it/f > > > > Sponsor: > > Occhialeria.it > > Scopri le migliori marche a prezzi imbattibili > > Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=879&d=20051003 > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > -- > Kostas Kalevras Network Operations Center > kkalev(a)noc.ntua.gr National Technical University of Athens, Greece > Work Phone: +30 210 7721861 > 'Go back to the shadow' Gandalf Ok, I have successfuly stored in mysql the lod data. But the Calling-Station-Id and Called-Station-Id aren't stored. This attributes are present in the access_request and access_response packet but not in the accounting_packet. It's possible to store this data also? Thanks, Felice -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Email.it Phone Card: chiami in tutto il mondo a tariffe imbattibili da tutti i telefoni fissi e cellulari! Clicca e scopri come Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=2686&d=20051006

1 0

Online Status & SQL
by Gunther 06 Oct '05

06 Oct '05

Hi, What is the second easiest way to know who is online beside radwho when using FR & MySQL. The radacct table seems to be the only place. Will it be sufficient just testing if AcctStopTime is 0? I saw some 'old' sessions in the table, which have AcctStopTime = 0 and no terminate cause. These 'zombies' would have to be cleaned by a watchdog ... (Note: Zombies were left under FR 1.0.4, now I'm on 1.0.5 and no zombies so far). Am I on the right track here? Thanks!

2 1

RE: Call-Check
by Jonathan De Graeve 05 Oct '05

05 Oct '05

>From the site: RADIUS Debugging File FreeRADIUS server does not support preauthentication. There is no example for this case. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens King, Michael Verzonden: woensdag 5 oktober 2005 20:08 Aan: FreeRadius users mailing list Onderwerp: RE: Call-Check I wonder if it's this one? http://www.cisco.com/univercd/cc/td/doc/product/voice/sipproxy/radiusps/ radpreau.htm > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, October 05, 2005 2:01 PM > To: FreeRadius users mailing list > Subject: Re: Call-Check > > Ivo <ml.radius(a)ultra.hr> wrote: > > Can someone tell me is it possible to get freeradius respond to > > Service-Type==Call-Check requests? > > I don't see why niot. > > > I have read on cisco's web pages that it is not possible. > > Please post the URL. > > > Namely, I would like to check for valid caller-id before > answering the > > call and going on with username/password check. > > Sure. It's just data in RADIUS packets. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 4

Accounting and Cisco devices
by Ryan Klinkhammer 05 Oct '05

05 Oct '05

Is it possible receive accounting information for cisco devices. When I go to my log files I can see the start and stop of my session but don't see the commands I entered on the device. Or does freeradius not log accounting information. I am using version 1.0.5 Thanks, Ryan

4 3

RE: Call-Check
by King, Michael 05 Oct '05

05 Oct '05

I wonder if it's this one? http://www.cisco.com/univercd/cc/td/doc/product/voice/sipproxy/radiusps/ radpreau.htm > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, October 05, 2005 2:01 PM > To: FreeRadius users mailing list > Subject: Re: Call-Check > > Ivo <ml.radius(a)ultra.hr> wrote: > > Can someone tell me is it possible to get freeradius respond to > > Service-Type==Call-Check requests? > > I don't see why niot. > > > I have read on cisco's web pages that it is not possible. > > Please post the URL. > > > Namely, I would like to check for valid caller-id before > answering the > > call and going on with username/password check. > > Sure. It's just data in RADIUS packets. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Multiple Connections for One UserID
by Samson Martinez 05 Oct '05

05 Oct '05

Let me preface this with the required "I'm pretty much a newbie to freeRADIUS"... Can someone point me to the place where I can modify the number of simultaneous connections that are allowed per user? I've just now noticed that I am currently only allowed a single connection and I'd like to increase that value. Even better, can someone recommend a good resource (book, website, etc.) to supplement the freeRADIUS website? My configuration is being used to authenticate DSL connections - I have modems that terminate on an Alcatel DSLAM which are aggregated at at Juniper ERX router. The router uses the freeRADIUS configuration for auth. Thanks! -Samson

2 1