- Freeradius-Users - lists.freeradius.org

RE: howto reset rlm_sqlcounter
by Bart van Daal 23 Sep '05

23 Sep '05

thanks for your reply Alan, I didn't mean the max-all-sessions value but the actual counter value. If a user has 15600seconds of online time ad is online for e.g. 3600 seconds, where do these 3600 seconds get stored with rlm_sqlcounter? thanks, kind regards, Bart van Daal -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: donderdag 22 september 2005 19:36 To: FreeRadius users mailing list Subject: Re: howto reset rlm_sqlcounter Bart van Daal <B.Vandaal(a)edpnet.net> wrote: > two possible options I think of to reset the counter are: > 1. write a program to manipulate the gdbm file. Where is this file stored? If you're using rlm_sqlcounter, it's not in a GDBM file. It's in SQL. If you're using rlm_counter, the location of the GDBM file is set in the configuration file. > 2. keep adding the minutes to the allready existing value for the > session-time. You can't do that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

howto reset rlm_sqlcounter
by Bart van Daal 22 Sep '05

22 Sep '05

Hi All, I'm authenticating users who can buy a specified amount of time to go online. I'm using the rlm_sqlcounter module with a reset=never option because there is no specified amount of time in which users have to use their minutes. A user can also buy additional minutes or when his minutes are depleted, a new subscription. two possible options I think of to reset the counter are: 1. write a program to manipulate the gdbm file. Where is this file stored? 2. keep adding the minutes to the allready existing value for the session-time. I was wondering if there was an 'easy' way to reset the counter for a user. thanks, kind regards, Bart van Daal Bart van Daal Network Operations Van Landeghemstraat 20 9100 SINT-NIKLAAS b.vandaal(a)edpnet.net www.edpnet.be T +32 (0)3 265 67 00 F +32 (0)3 265 67 01

3 2

RE: choosing userprofile by NAS
by Jonathan De Graeve 22 Sep '05

22 Sep '05

I'm looking for the same thing but then with an SQL backend instead of LDAP J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Florian Prester Verzonden: donderdag 22 september 2005 10:33 Aan: FreeRadius users mailing list Onderwerp: choosing userprofile by NAS Hi, how can I serve different information to the same user depending on the Huntgroup having all information stored in a LDAP-server? meaning: userA logging in NAS_A: receives IP-A supplied by LDAP userA logging in NAS_B: receives IP-B supplied by LDAP -- ---------------------------------------------------------- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Germany Tel.: +499131 8527813 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Realm extraction
by Dmitry Alekhin 22 Sep '05

22 Sep '05

Hi all, I am new in free radius , so I have one question: How can I exctract Realm attribute in radiusd.conf name? So, I need to use it in LDAP filter to make search like : ldap { server = "localhost" identity = "uid=pr,ou=Staff,dc=domain,dc=com" password = secret basedn = "ou=People,dc=ivoho,dc=com" filter = "(uid=%{User-Name},ou=%{Realm-Name})" # base_filter = "(objectclass=radiusprofile)" ... how can I get Realm-Name variable ?

3 3

Using NAS-Port-Type to allow or disallow?
by Martin.Ward＠uk.neceur.com 22 Sep '05

22 Sep '05

Hi all, I have succumbed and purchased the RADIUS book from O'Reilly, but it'll be a few days in coming so I going to have to bug you all again. I'm still having problems understanding if I can allow some users access to some equipment and others to other kit. I thought I could do it but I'm having real problems, probably with my lack of understanding... I have a wireless LAN switch which has access points ( APs ) connected to it. When a laptop first connects to an AP that AP sends a RADIUS request through the WLAN switch to the RADIUS server, passing the MAC address of the laptop as the User-Name and also as the User-Password. I have a simple flat file with all the allowed MAC addresses in it, and the passwd module is being used to verify that the MAC address is in that flat file. This works well. Now because the WLAN switch is configured to use RADIUS to authenticate laptops, it also uses it to authenticate logins to the switch itself, I haven't found a way around this and don't think there is one. This means that you can gain access to the WLAN switch by using the MAC address of your laptop as the user name and password, albeit with fairly high restrictions on what you can do. This is a security problem for two reasons: 1. Obviously anyone figuring this out can gain access to kit they should not have access to (there are other ways of stopping this, but you'll excuse me if I don't mention them here). 2. The proper administrators, and the default administration login itself, have to be put in to the flat file I mentioned above to allow the administrators access to the switch. The switch won't use its own internal user and password list. This causes another security breach as we would have to leave administrator logins and passwords lying around in flat files, which is extremely insecure and just begging to be broken. I have been trying to get administrator access to authenticate via the Unix module since the RADIUS server is on a Linux box. Alas I have been unable to get this to work. Investigation reveals that when the AP passes the RADIUS request in, the request sets 'NAS-Port-Type = Wireless-802.11' and the NAS-Port-ID to the correct port value, while when the switch requests a login to be authenticated the request contains 'NAS-Port-Type = Virtual', and doesn't have the NAS-Port-ID or NAS-Indentifier parameters set. So, it seems I have lots of information to help me define if a RADIUS request is coming from an access point (which requires MAC address validation) or from the switch (which requires login username and password validation), but I can't find a way of verifying via passwd OR Unix module, only via both. Is what I am after possible, or do I just not understand the way RADIUS servers work? |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

2 1

Re: Transmitted packet
by Iandc Davies 22 Sep '05

22 Sep '05

> "Iandc Davies" <Iandc.Davies(a)Marconi.com> wrote: > The contents of the transmitted packet include an uint8_t *data. > > What exactly is this pointing to ? >> The transmitted packet. >> Your terminology is confused: Aaahhh, I think it is. OK. >> - RADIUS_PACKET = internal FreeRADIUS data structure holdin uint8_t *data >> - uint8_t *data = actual RADIUS packet sent via "sendto" >> Alan DeKok. So, if I was to sent a packet to the radius server what format would it be ? I was running under the understanding that I needed to populate the contents of the RADIUS_PACKET structure, therefore :- int sockfd - uint32_t src_ipaddr - uint32_t dst_ipaddr - u_short src_port - u_short dst_port - int id - to be populated by me unsigned int code - to be populated by me uint8_t vector[16] - to be populated by me time_t timestamp - int verified - uint8_t *data - int data_len - to be populated by me VALUE_PAIR *vps - to be populated by me Apart from the above is there anything else that needs filling in ? .... or am I completely wrong again ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

proxy EAP/PAP ?
by Tim Winders 22 Sep '05

22 Sep '05

Hello All - As I can't seem to get freeradius working on my Tru64 box and my box seems to be "broken" I thought I'd try to install freeradius on a RHEL box and use the fr proxy feature to proxy back to my Tru64 box running the Livinginston Radius server. My question, I want to be able to authenticate against the Tru64 passwd user database from a Windows client connected to a wireless AP running WPA. When I had a working fr on the Tru64 box, I was able to use the SecureW2 supplicant on XP with EAP/PAP to authenticate against passwd and it worked great. So, now, if I am running a non-EAP aware radius on the Tru64, and freeradius on a Linux box proxying to the Tru64 box, will I be able to do EAP/PAP authentication? I'm ready the proxy doc, but, I don't see anything about that, or if it's even applicable. --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html

3 4

Serializing database requests
by Mike Chamberlain 22 Sep '05

22 Sep '05

Hi there. We are using FreeRadius on a VoIP network, talking to a database holding account information. Consider the following sequence of SQL statements generated by FreeRadius, which in some cases are producing a problem for us: AUTHENTICATE EXEC Rad_Authenticate '1211170776', '0889810576', '', '34333239 66326330 65380031 34383800', 'h323-ivr-out=ACCESSCODE:4441', '', '211.26.139.42', '' AUTHORIZE EXEC Rad_Authenticate '1211170776', '0889810576', '00113162558045', '34333239 66326330 65380031 34383800', 'h323-ivr-out=ACCESSCODE:4441;h323-ivr-out=FOLLOW_ON_FLAG:0', '', '211.26.139.42', '' STOP ACCOUTNING EXEC Rad_Stop_Accounting '1211170776', '34333239 66326330 65380031 34383800', '34333239 66326330 65380031 34383800', 'answer', '0889810576', '4441', '10', '51', '211.26.139.42', 'au-syd-primus1' We are currently not using start accounting messages. In the above case, the authorize messages and stop accounting messages are generated almost simultaneously because the user has hung up immediately after dialling the number. But the authorize procedure takes longer to process than the stop accounting procedure, meaning that the stop procedure completes before the authorize. This means that in effect the two messages get processed back to front. In our scenario this leaves a call open in the database that will never be closed. How do other people cope with this? Is there some way of forcing FreeRadius to serialize requests from the same username so it won't issue a new one until it has received a response for an existing one? Thanks in advance for any help, Mike

2 1

Implementation advice needed.
by Daniel Corbe 22 Sep '05

22 Sep '05

Hello, I'm looking for a couple of suggestions as how to implement some specifics. I've set up a FreeRADIUS server to do AAA primarily in a SIP enviornment. I've got a B2BUA which attempts to authorize outgoing calls. I want to use this to do Least Cost Routing. Upon an INVITE packet, the B2BUA sends the following attributes User-Name = "1234" User-Password = "." NAS-IP-Address = 10.10.17.5 NAS-Port = 1000 Called-Station-Id = "5551212" Calling-Station-Id = "1234" This is enough information for me to authorize the phone call. Here are my questions 1) I have tariff tables stored in a back-end database. What would be the best way to go about looking up this information? Is there some way to execute a custom SQL lookup to pull this information back? Or should I be calling exec to say a custom script? 2) If exec is the best way to go about doing this, am I correct in reading the documentation that my script should be returning 0 (Access-Accept) or 1 (Access-Reject)? 3) I can customize my B2BUA so it accepts an IP address to forward a SIP request along. Is there a way either from exec or another method to add Radius attributes to the reply packet? That way I can do true LCR and tell the B2BUA which Gateway to forward the request. Thanks. -Daniel

1 0

WPA with freeradius
by poczta＠flashnet.pl 22 Sep '05

22 Sep '05

Hello i want to configure freeradius with hardware adsl router ... could you sugest me some? i've got linksys wag54g which doesnt support pure radius but WPA radius.. is it posible to make them work together with my freeradius server? any hints, links (!), anything... i've searchd faqs and lists but i haven't found anything special (or i didn't search enough) thanks wasyl

2 1