- Freeradius-Users - lists.freeradius.org

FreeRadius logging for Eduroam
by Peter Hutchison 18 Jul '16

18 Jul '16

I have FreeRadius 12.1.12 on Ubuntu 14.04 LTS and we have it configured for our Wireless network. We have a normal internal wireless network configured for AD authenticated users and we also use Eduroam. I am using a Linelog module to record logins and for Eduroam entries,, I would like it to log the eduroma name instead of the Switch the user it authenticated to e.g. Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client roaming0.ja.net port 0 via TLS tunnel). Instead of Mon Jul 18 08:38:00 2016 : Auth : [U1234567(a)hud.ac.uk] (from client qsa.n2k-mc01 port 0 via TLS tunnel). The date and time is provided by variable %t, user name by %{username} and the client by %{client:shortname}. The names are provided in the clients.conf e.g. Client ipaddress { Secret = secret-string Shortname = switch-name Virtual_server = switches } Client roaming0.ja.net { Secret = secret-string Shortname = roaming0.ja.net Nastype = other Virtual_Server = eduroam Shortname = eduroam } Any ideas how to update logging config to record what I need? Peter Hutchison MCP Senior Network Systems Specialist * 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Problem Get Array
by تعلم البرمجة 16 Jul '16

16 Jul '16

Hello ! I Can`t Get array in db by SELECT * update control { Tmp-String-1 = "{sql:SELECT * FROM profiles Where id=1 } expend :%{sql:SELECT * .... } ->1 ++[control] returns noop expend : %{control:Tmp-string-1[2] -> Empy Results Why ?

3 2

linelog csv quoting problem
by Adamczak Krzysztof 15 Jul '16

15 Jul '16

Hey guys, I've another question. I need csv accounting - I used linelog for this. Basically I have: linelog csv_acct_log { ... Accounting-Request { Start = "\"%m/%d/%Y\",\"%H:%G\",\"%{Acct-Status-Type}\",\"%{User-Name}\",\"%{Auth-Type}\",\"%{User-Name}\",\"%{NAS-IP-Address}\",\"%{NAS-Port}\",\"%{Service-Type}\",\"%{Framed-Protocol}\",\"%{Framed-IP-Address}\",\"%{Framed-IP-Netmask}\"..." ... } It works great - the only problem is that I want to use double quotes when there's attribute and don't use them when attribute is not present. In CSV file it should like this "07/14/2016","10:59:16","Interim","login(a)mycompany.com.pl",,,"some other value" The best solution would be to do it directly in linelog module - maybe using conditional syntax? I tried it but I haven't succeed yet. Otherwise I have to do it in unlang outside linelog. I tried something like that: %{%{Framed-Compression}:-%{control:empty}} but it doesn't allow me to introduce quoting. Any ideas? thanks, Chris

4 6

Load-balancing LDAP
by Jonathan Gazeley 15 Jul '16

15 Jul '16

Hi folks, We're using an instantiation of the ldap module to check group membership, currently calling in an xlat[1] way like this: switch "%{uobldap:ldap:///DC=ads,DC=bris,DC=ac,DC=uk?objectCategory?sub?(Name=%{reply:User-Name})}" { ... } At the moment the ldap config itself specifies multiple ldap servers and we've been using this for load-balancing, but we have found it unsatisfactory as the openldap client doesn't seem to fail over properly when the ldap servers go away. So I want to start using FreeRADIUS's redundant-load-balance section[2] but at the moment I can't see how to use this with the xlat style of calling the ldap module. Can I do something like wrap it in a policy and load-balance between policies? [1] http://wiki.freeradius.org/modules/rlm_ldap#ldap-xlat [2] http://wiki.freeradius.org/config/load-balancing Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

6 8

unlang foreach loop
by Fabrice Durand 14 Jul '16

14 Jul '16

Hi all, On my freeradius server i want to be able to have access to each attributes/values of the reply. (to save one attribute/value per line in a database) I tried to implement foreach loop, i have access to the value but i don't know if it's possible to have access to the attribute name. Here my unlang syntax: foreach &reply { update reply { # insert into ... attribute_name , "%{Foreach-Variable-0}" Reply-Message += "%{Foreach-Variable-0}" } } Is there any way to fetch the attribute name ? Thanks Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

1 0

vlan assigment on called-station-id
by Zenon Matuszyk 14 Jul '16

14 Jul '16

Hello, I have a problem with assigment vlan, i have two locations with 6 AP each, and two groups workers and guest (one serwer radius). If user is in group workers in site1 shoud be assigned to VLAN 200 or in group guest, than shoud be assigned to VLAN 300. On site2 workers vlan 400, guest 600.I want it to be checked using the mac address the APs. I try use user file, but not working. If i try plugin to wifi on site1 its ok but in site2 radius trying to get me assigned to vlan 200 not 400. How can I assign VLAN depending on location AP?? Maybe someone tried to do like that site1 DEFAULT LDAP-Group == workers Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 200 DEFAULT LDAP-Group == guest Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 300 site2 DEFAULT LDAP-Group == workers Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 400 DEFAULT LDAP-Group == guest Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 600 -- Z poważaniem / Yours sincerely Zenon Matuszyk mobile: 00 48 797 004 938 e-mail: zenon.matuszyk(a)networkers.pl www: http://www.networkers.pl

2 3

Any example for rlm_redis_ippool?
by Yanrui Hu 14 Jul '16

14 Jul '16

Guys. Currently we are using rlm_sqlippool to allocate IP addresses for strongswan, the CPU of the DB server is rather high. Somebody said that rlm_redis_ippool could mitigate the problem, we want have a try. Can you send us an example -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

2 1

i cant change rate limit in mikrotik by coa
by تعلم البرمجة 14 Jul '16

14 Jul '16

hello ! i have dynamic ip and i want update user when online Update control { .... Mikrotik-Rate-Limit = "256k/1024k" } home_server example_coa { .... ipaddr = X.X.X.X # ?????????? } Unkown destination ip any idea ? sorry for language english

3 2

Freeradius with Cisco VSA tutorial?
by Ted Hyde 13 Jul '16

13 Jul '16

Greets, I'm migrating a cisco router from local auth to radius (already did wifi eap-tls on the ap's, that was the easy part), now looking to do the ssl vpn auth as well. There is mention of using both inline attributes and dictionary attributes (such as "webvpn:........" key pairs), however I haven't found any direct examples of such. Has anyone tried this before with freeradius and can share examples? Thanks, Ted. ⁣

2 1

Add APs based on MAC address instead of IP
by Raj Meka 13 Jul '16

13 Jul '16

Friends, I have installed freeradius recently on cloud. If I configure the IP in clients.conf file it is working fine. But I want add MAC address instead of IP, So I don't need to worry about the IP address of AP. Any suggestions, or anyone configured this way ? Raj

2 2