- Freeradius-Users - lists.freeradius.org

RE: [FreeRADIUS and PPPd] How to limit the bandwidth?
by Sebastian Mauer 21 Jul '05

21 Jul '05

freeradius-users-bounces(a)lists.freeradius.org wrote: > Dnia czwartek, 21 lipca 2005 13:36, Sebastian Mauer napisał: >> Hello there, >> >> I'm currently setting up FreeRADIUS as authentication/authorization >> backend for a PPPoE Server running with the ppp Daemon. I've managed >> to get the ppp Daemon to work with my working FreeRADIUS 1.0.3 Server >> but now have to solve another problem. Is it possible to limit the >> bandwidth the ppp channel allocated via an attribute in FreeRADIUS? >> >> Or has someone another Idea how to manage a bandwidth cap? > > What kind of OS this PPPoE server is running? The Server is running on Linux (Debian 3.1 Sarge/stable) > > If it is Linux/*BSD you can execute commands on session initialization > ( /etc/ppp/if-up or something like that ). Just put some tc/altq/ipfw > commands there... > > btw: Search for "WARTA project" on google ;) Hello there, thanks for the Info I will gather Information about WARTA and iproute2. But another problem should be that I have to control the bandwidth limits individually for each user logging into the pppoe-server. Sincerely, Sebastian Mauer

2 1

Fwd: Re: [FreeRADIUS and PPPd] How to limit the bandwidth?
by Charles Price 21 Jul '05

21 Jul '05

---------- Forwarded Message ---------- Subject: Re: [FreeRADIUS and PPPd] How to limit the bandwidth? Date: Thursday 21 Jul 2005 14:02 From: Charles Price <charlie.price(a)w3z.co.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > I'm currently setting up FreeRADIUS as authentication/authorization backend > for a PPPoE Server running with the ppp Daemon. I've managed to get the ppp > Daemon to work with my working FreeRADIUS 1.0.3 Server but now have to > solve another problem. Is it possible to limit the bandwidth the ppp > channel allocated via an attribute in FreeRADIUS? I use two Vendor Specific Atrributes (Bw-Up and Bw-Down - you need to edit the dictionary files on both RADIUS server and PPPoE Concentrator) so that RADIUS can manage bandwidth resources. Once this is set up you can use the radattr plugin for pppd, which writes all the received RADIUS attributes to /var/run/radattr.pppX - you can read this from /etc/ppp/ip-up and use the data with tc to create bandwidth limited PPP tunnels. I found that routing all traffic through an IMQ ( http://www.linuximq.org ) rather than on a ppp interface speeds things up a lot. HTH Charlie Price -------------------------------------------------------

1 0

[FreeRADIUS and PPPd] How to limit the bandwidth?
by Sebastian Mauer 21 Jul '05

21 Jul '05

Hello there, I'm currently setting up FreeRADIUS as authentication/authorization backend for a PPPoE Server running with the ppp Daemon. I've managed to get the ppp Daemon to work with my working FreeRADIUS 1.0.3 Server but now have to solve another problem. Is it possible to limit the bandwidth the ppp channel allocated via an attribute in FreeRADIUS? Or has someone another Idea how to manage a bandwidth cap? Sincerely, Sebastian Mauer

2 1

AW: Multiple Appearing of the same Attribute & variables
by Metz, Frederic 21 Jul '05

21 Jul '05

Hi, thank you Alan. While compiling the actual CVS (and also CVS nightly snapshot) there was a compile error in rlm_sql.c with the funcion call if (!client_add(mainconfig.client_trees, c)) { client_free(c); return -1; } You can see that client_add(..) expects RADCLIENT_LIST* as the first parameter, so this should look like this I think, right ? : if (!client_add(mainconfig.clients, c)) { client_free(c); return -1; } Frederic-Philippe Metz -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Mittwoch, 20. Juli 2005 18:27 An: FreeRadius users mailing list Betreff: Re: Multiple Appearing of the same Attribute & variables "Metz, Frederic" <Frederic.Metz(a)t-com.net> wrote: > I have a Radius Packet with one Vendor Specific Attribute coming > twice in that packet. Since I am writing the information into Mysql > database, I wanted to know how to address the first and the second ? > I saw that %{Attribute[index]} should work, but it doesn't. The > entry (seen in Debug mode) is empty. I am using Radius 1.0.4. What's > wrong with my conf ? The problem is not your configuration. The problem is that the syntax you quoted is valid only in the current CVS snapshot, not in 1.0.4. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Proble with an Accounting query
by Santiago Balaguer García 21 Jul '05

21 Jul '05

2 2

allow access only from specific networks
by Christian Seitz 21 Jul '05

21 Jul '05

Hi there, I tried to solve my problem using huntgroups, but after several days I couldn't find a solution. Perhaps someone has an idea... There are accounts that should only be able to connect when the callingstationid is an ip address within 10.0.0.0/8 or 192.168.0.0/16. Otherwise the user must be rejected. Other accounts should be able to connect from everywhere. Any ideas? Chris -- Christian Seitz <chris(a)in-berlin.de> http://www.in-berlin.de/ Individual Network Berlin e.V. PGP Fingerprint: A9 17 03 0D 36 AB 07 4E D0 1E C3 8E 3F B0 66 9A

1 0

howto log the activity of my user
by Dominique Lambert 21 Jul '05

21 Jul '05

hello i search to log the activity of my users i want to know date,time,url please thank's

3 4

Re: howto log the activity of my user
by Marcin Jessa 21 Jul '05

21 Jul '05

On Thu, 21 Jul 2005 11:26:47 +0200 Dominique Lambert <dlambert(a)hotel-sofibra.com> wrote: > Marcin Jessa a écrit : > > >On Thu, 21 Jul 2005 11:07:40 +0200 > >Dominique Lambert <dlambert(a)hotel-sofibra.com> wrote: > > > > > > > >>hello > >>i search to log the activity of my users > >> > >> > >What kind of activity? > > > > > > > >>i want to know date,time,url > >>please > >>thank's > >> > >> > >> > hello > i want know welch url my users visit, when etc... You'd need a traffic logger on your gateway to be able to see that or a http proxy. Radius cannot log such a thing. Radius can log following: Client IP Address Download/Upload Login/Logout Time NAS IP Address NAS Port Session Time User Name

1 0

disconnect user from terminal
by yuniva wati 21 Jul '05

21 Jul '05

hello, I have a problem using freeradius. when one user connect to freeradius can we disconnect them if we want to do that. Can we use terminal on Linux to disconnect??? thank you __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

re: Restricting Access by Group Membership
by Sayantan Bhowmick 21 Jul '05

21 Jul '05

Hi, To allow access the (regardless of password) you can set Auth-Type := Accept (See FreeRADIUS FAQ 5.5). I am not sure that is what you want though, as in this case irrespective of what password a user enters he will be granted access. You can use the configuration suggested by Dusty Doris. That should work for you. -Sayantan. >>> jp(a)joshmp.com 07/21/05 1:04 AM >>> My fault...members of that group are DENIED access. Now I get. So, that leads me to another question. How do I change the syntax so that users are ALLOWED access if they are a member of the specified group? I tried changing the line in the users file to Auth-Type := Allow, but this didn't work. Unfortunately, I can't find anything on this in rlm_ldap or FAQ. Thanks in advance, Josh -----Original Message----- Setup: FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticating to eDirectory on Netware 6.5 server. Issue: I have read the FAQ section regaring limiting access to specific groups (http://freeradius.org/faq/#5.2) but I can't get it to work. For one, I am not entirely certain where to add the lines. I have tried using the users file, but this doesn't seem to work. Two, I am not sure that I am using the right syntax. Here is what I have tried: - adding the following lines to users file: ----snip----- DEFAULT Group == "cn=remoteusers,o=services", Auth-Type := Reject Reply-Message = "Your account has been disabled" DEFAULT Auth-Type = LDAP -----snip----- Here is the debug: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secretrad" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:2254, id=53, length=60 User-Name = "dcitest1" User-Password = "dcitest1" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=services' radius_xlat: '(cn=dcitest1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/secretrad to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=dcitest1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=remoteusers,o=services, with filter (|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=remoteusers,o=services not found or user is not a member. users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dcitest1" with password "dcitest1" rlm_ldap: user DN: cn=dcitest1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=dcitest1,ou=GW,o=Services/dcitest1 to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dcitest1 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 53 to 127.0.0.1:2254 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 42de3bed Nothing to do. Sleeping until we see a request. -----snip----- Thanks in advance, Josh - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0