- Freeradius-Users - lists.freeradius.org

Load-balancing LDAP
by Jonathan Gazeley 15 Jul '16

15 Jul '16

Hi folks, We're using an instantiation of the ldap module to check group membership, currently calling in an xlat[1] way like this: switch "%{uobldap:ldap:///DC=ads,DC=bris,DC=ac,DC=uk?objectCategory?sub?(Name=%{reply:User-Name})}" { ... } At the moment the ldap config itself specifies multiple ldap servers and we've been using this for load-balancing, but we have found it unsatisfactory as the openldap client doesn't seem to fail over properly when the ldap servers go away. So I want to start using FreeRADIUS's redundant-load-balance section[2] but at the moment I can't see how to use this with the xlat style of calling the ldap module. Can I do something like wrap it in a policy and load-balance between policies? [1] http://wiki.freeradius.org/modules/rlm_ldap#ldap-xlat [2] http://wiki.freeradius.org/config/load-balancing Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

6 8

unlang foreach loop
by Fabrice Durand 14 Jul '16

14 Jul '16

Hi all, On my freeradius server i want to be able to have access to each attributes/values of the reply. (to save one attribute/value per line in a database) I tried to implement foreach loop, i have access to the value but i don't know if it's possible to have access to the attribute name. Here my unlang syntax: foreach &reply { update reply { # insert into ... attribute_name , "%{Foreach-Variable-0}" Reply-Message += "%{Foreach-Variable-0}" } } Is there any way to fetch the attribute name ? Thanks Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

1 0

vlan assigment on called-station-id
by Zenon Matuszyk 14 Jul '16

14 Jul '16

Hello, I have a problem with assigment vlan, i have two locations with 6 AP each, and two groups workers and guest (one serwer radius). If user is in group workers in site1 shoud be assigned to VLAN 200 or in group guest, than shoud be assigned to VLAN 300. On site2 workers vlan 400, guest 600.I want it to be checked using the mac address the APs. I try use user file, but not working. If i try plugin to wifi on site1 its ok but in site2 radius trying to get me assigned to vlan 200 not 400. How can I assign VLAN depending on location AP?? Maybe someone tried to do like that site1 DEFAULT LDAP-Group == workers Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 200 DEFAULT LDAP-Group == guest Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 300 site2 DEFAULT LDAP-Group == workers Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 400 DEFAULT LDAP-Group == guest Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 600 -- Z poważaniem / Yours sincerely Zenon Matuszyk mobile: 00 48 797 004 938 e-mail: zenon.matuszyk(a)networkers.pl www: http://www.networkers.pl

2 3

Any example for rlm_redis_ippool?
by Yanrui Hu 14 Jul '16

14 Jul '16

Guys. Currently we are using rlm_sqlippool to allocate IP addresses for strongswan, the CPU of the DB server is rather high. Somebody said that rlm_redis_ippool could mitigate the problem, we want have a try. Can you send us an example -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

2 1

i cant change rate limit in mikrotik by coa
by تعلم البرمجة 14 Jul '16

14 Jul '16

hello ! i have dynamic ip and i want update user when online Update control { .... Mikrotik-Rate-Limit = "256k/1024k" } home_server example_coa { .... ipaddr = X.X.X.X # ?????????? } Unkown destination ip any idea ? sorry for language english

3 2

Freeradius with Cisco VSA tutorial?
by Ted Hyde 13 Jul '16

13 Jul '16

Greets, I'm migrating a cisco router from local auth to radius (already did wifi eap-tls on the ap's, that was the easy part), now looking to do the ssl vpn auth as well. There is mention of using both inline attributes and dictionary attributes (such as "webvpn:........" key pairs), however I haven't found any direct examples of such. Has anyone tried this before with freeradius and can share examples? Thanks, Ted. ⁣

2 1

Add APs based on MAC address instead of IP
by Raj Meka 13 Jul '16

13 Jul '16

Friends, I have installed freeradius recently on cloud. If I configure the IP in clients.conf file it is working fine. But I want add MAC address instead of IP, So I don't need to worry about the IP address of AP. Any suggestions, or anyone configured this way ? Raj

2 2

String expansion of attributes value from database
by Krzysztof Grobelak 13 Jul '16

13 Jul '16

Hello All, Is it possible to have similar functionality in a database stored reply item as with users file? in users file: user1 Cleartext-Password := “super_secret" Alc-Subsc-ID-Str := "%{Alc-Client-Hardware-Addr}", Alc-Subsc-Prof-Str := "sub_profile_1", Alc-SLA-Prof-Str := “sla_profile_1" The above works and the %{Alc-Client-Hardware-Addr} gets expanded to a correct mac address. However when the following is used in database: +----+----------------+--------------------+----+-------------------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+-------------------------------+ | 1 | profile_1 | Alc-Subsc-ID-Str | := | "%{Alc-Client-Hardware-Addr}" | | 2 | profile_1 | Alc-Subsc-Prof-Str | := | sub_profile_1 | | 3 | profile_1 | Alc-SLA-Prof-Str | := | sla_profile_1 | +----+----------------+--------------------+----+-------------------------------+ The value of Alc-Subsc-ID-Str attribute is returned as is, without expansion. The comments in the sql module say that the sql should mirror the users file in functionality so i’m assuming i’m missing something ;) Can you advice please? Regards, Kris

3 6

dhcp after wpa_supplicant auth on Unbuntu 16.04
by Alex Sharaz 13 Jul '16

13 Jul '16

Hi, Performing eap-tls on wired interface of an Ubuntu VM. Everything works o.k. and I'm in a vlan supporting IPv4 pooled addressing and SLACC IPv6. But interface IPv4 address is from before wpa_supplicant auth. Any easy way to delay dhpc request until after the wpa_auth operation? Rgds Alex

2 1

Swapping input and output octets
by Anuruddha Premalal 13 Jul '16

13 Jul '16

Hi All, One of the NAS in our network is reporting the accounting the wrong way (input and output octets are swapped). I'm trying to fix it by adding a logic similar to below at the start of the accounting section if( request:NAS-IP-Address == "192.168.1.7" && Acct-Status-Type != "Start"){ Temp-Attribute = &Acct-Input-Octets update request { Acct-Input-Octets := &Temp-Attribute Acct-Output-Octets := &Acct-Input-Octets } } I need to use a temporary variable to perform the data swapping. However I couldn't find a documentation of use of temporary variables or any such. Is there a better way to achieve this. How can a variable be used to store a value for a temporary reason without adding it to the request body. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 2