- Freeradius-Users - lists.freeradius.org

Contextual mapping of LDAP attributes
by Adamczak Krzysztof 07 Jul '16

07 Jul '16

Hey guys, I have another question. Again I haven't found nice solution yet. How can I map different LDAP attribute to the same RADIUS attribute depending on some access request parameters? E.g. in my LDAP I have: - adslVirtualRouterName - xdslVirtualRouterName - xxxVirtualName I'd like to map this LDAP attribute to RADIUS ERX-Virtual-Router-Name depending on e.g. NAS-IP-Address. One solution would be declare some additional variables in /etc/raddb/dictionary and just map it in ldap module update section. But is there better solution? thanks, Krzysztof

5 7

Return or not return
by Franks Andy (IT Technical Architecture Manager) 07 Jul '16

07 Jul '16

Hi all, Another basic question. I feel like a dunce coming here. Oh well, here goes : I'm confused about the correct way to exit processing of a policy/unlang bit of "code". I guess I'm used to treating them like subroutines, but that may be naughty behaviour since I'm not sure return is exactly what I want, in fact I'm fairly sure it isn't, as a way of halting processing of a policy based on condition checks. I found this out the hard way when setting up a nas to do periodic updates and seeing that it was just sending a barrage of start packets and whinging that it couldn't talk to the radius server. The last part of my accounting statement did a check to see if this was an interim-update, and if not, do a return. The outcome was that the radius server exits the accounting bit without sending a response back, which is by design. Anyway, is there a better way of stopping a set of checks etc for a policy or module without using if .. else throughout the policy, and continuing the rest of the authorisation or accounting section? If not, I'll have to end up trying to put the code that has returns in as the last bit of an auth or possibly accounting section or nesting everything up which makes for awkward structure. I've tried using noop, ok or similar, setting the module return default=1 to try and "catch" the return, but it's obviously not supposed to work like that. I have read http://wiki.freeradius.org/config/Fail-over but I'm still struggling to match what I'm after. Thanks Andy

2 2

Accounting interim data delta
by liran kessel 07 Jul '16

07 Jul '16

Hi, we have a radius server installed collecting accounting data from a Cellular network. Currently we receive the Interim update every 30 minutes, and it updates the radacct table correctly . What we need is to be able to know what was the delta of acctinputoctets and acctoutputoctets that was received in this event , in comparison to the data that was already in the DB from the previous notifications. Can I somehow enter this delta into a different table that will show me the usage for each notification? Thanks Liran

2 7

FreeRADIUS 3.0 - Help with understanding op value for cleartext-password
by Ian Hiddleston 06 Jul '16

06 Jul '16

Hi all, I've got my server working ok, one thing that I'm curious about is why the op value for Cleartext-Password is ':=' rather than '==' ? As my google-fu appears to be lacking I figured I might as well ask the question. Thanks, Ian.

4 4

Called-Station-Id
by Манцуров Дмитрий Вячеславович 06 Jul '16

06 Jul '16

Hi All, Tell me, please, how to make so that the montlycounter module in accounting section works only when Called-Station-Id starts with 8 (Called-Station-Id = '8.....')? I think that the need to write something on unlang use a regular expression, but I do not know how to do it correctly. Thanks.

2 1

using SSL certs with EAP-TLS
by Wouter 05 Jul '16

05 Jul '16

Goodday, In my FreeRadius setup for authenticating WiFi devices with EAP-TLS, I use server- and client SSL certificates from CA provider ' X '. I understand that now everyone with knowledge of this fact, can get a client SSL cert (PKCS#12) from this CA provider X and can authenticate with my WPA2 Enterprise network. After reading the following from the README: "In general, you should use self-signed certificates for 802.1x (EAP) authentication. When you list root CAs from other organisations in the "ca_file", you permit them to masquerade as you, to authenticate your users, and to issue client certificates for EAP-TLS." I would like to ask the following question. Is there something I can configure on the server side that only certain CommonName's and/or serial's can be used to authenticate correctly? Next to this question, I wonder why also a username (Benutzername) is asked in iOS when we use EAP-TLS with a certificate? I can fill out this field with whatever string and it authenticates in FreeRadius (when a correct cert is presented of course). screenshot: https://hilfe.uni-paderborn.de/images/thumb/4/4f/Eduroam_iOS7_04.png/250px-… I run version 3.0.11 on Ubuntu 14.04 LTS 64bit. Thank you

4 10

Re: Help on users file
by jon Yu 05 Jul '16

05 Jul '16

Hi, I have a problem to invoke rm_ldap_groupcmp() by the users file in freeradius 3.1.x. For example, DEFAULT Huntgroup-Name == "mytest", Hint == "MYTEST", Ldap-Group == ndvm6mk9, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes When entering this configuation, it only shows noop during files according to debug mode (-X) Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling files (rlm_files) for request 0 Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) for request 0 Mon Jun 20 15:59:36 2016 : Debug: (0) [files] = noop Mon Jun 20 15:59:36 2016 : Debug: (0) debug_control debug_control { Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == '') Mon Jun 20 15:59:36 2016 : Info: (0) Attributes matching "control:" Mon Jun 20 15:59:36 2016 : Debug: (0) EXPAND %{debug_attr:control:} Mon Jun 20 15:59:36 2016 : Debug: (0) --> Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == '') -> TRUE Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == '') { Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling noop (rlm_always) for request 0 Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from noop (rlm_always) for request Please help, Thanks, Jon On Mon, Jun 20, 2016 at 4:33 PM, jon Yu <yunc.yu(a)nd.edu> wrote: > Hi, > > I have a probem to invoke rm_ldap_groupcmp() by the users file in > freeradius 3.1.x. > > For example, > > DEFAULT Huntgroup-Name == "mytest", Hint == "MYTEST", Ldap-Group == > ndvm6mk9, Auth-Type := ldap-vpn > > Service-Type = 6, > > Fall-Through = Yes > > > When entering this configuation, it only shows noop during files according > to debug mode (-X) > > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling files > (rlm_files) for request 0 > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from > files (rlm_files) for request 0 > > Mon Jun 20 15:59:36 2016 : Debug: (0) [files] = noop > > Mon Jun 20 15:59:36 2016 : Debug: (0) debug_control debug_control { > > Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == > '') > > Mon Jun 20 15:59:36 2016 : Info: (0) Attributes matching "control:" > > Mon Jun 20 15:59:36 2016 : Debug: (0) EXPAND %{debug_attr:control:} > > Mon Jun 20 15:59:36 2016 : Debug: (0) --> > > Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == > '') -> TRUE > > Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == > '') { > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling noop > (rlm_always) for request 0 > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from > noop (rlm_always) for request > > > Please help, > > Thanks, > > Jon >

5 18

ldap profile (no full dn in profile attribute)
by Adamczak Krzysztof 05 Jul '16

05 Jul '16

Hi, I have a problem with obtaining profile for ldap user. The problem is caused by not having full, valid DN to profile - that is I only have part of it. The structure is quite simple I'll show it below (simplified). Could you help me with radius configuration? I tried few options but none worked. I apologize if it was already covered - I haven't found the answer yet. Radius config: profile { default = "ou=profiles,dc=example,dc=com" attribute = "profile" } LDAP structure # users dn: dc=example,dc=com dc: example objectClass: dcObject objectClass: organization o: example dn: ou=radius,dc=example,dc=com ou: radius objectClass: organizationalUnit dn: ou=xdsl,ou=radius,dc=example,dc=com objectClass: organizationalUnit ou: xdsl dn: uid=login(a)com.pl,ou=xdsl,ou=radius,dc=example,dc=com uid: login(a)com.pl ... profile: SOME_PROFILE_NAME # profiles dn: ou=profiles,dc=example,dc=com ou: profiles objectClass: organizationalUnit dn: uid=SOME_PROFILE_NAME,ou=profiles,dc=example,dc=com uid: SOME_PROFILE_NAME ... thanks, Chris

4 8

Permissions on Log Files.
by Marc Beaumont 04 Jul '16

04 Jul '16

Hi, Despite setting my permissions in the log file setup to be 770 all my log files are only getting 644 or 640. I can't seem to explain it as I've modified all files on the mods-available directory to have these permissions set but it does not seem to actually do it. Running 3.0.4 on CentoOS 7 Marc Beaumont Network Admin / Linux Specialist Comms365 Limited ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ______________________________________________________________________

2 1

Ubuntu on wiki page.
by Arjan Sinnige 04 Jul '16

04 Jul '16

Just a FYI. I just created a new page on the wiki for installing freeradius on Ubuntu. I did this because the debian page is kinda messy and did not seem to make any sense anymore. As I only use Ubuntu, I created a new page as Debian does look different in some aspects. Kept it very new user friendly. If someone would cast a quick look to make sure I did not make a F**kup, I'd appreciate it. Arjan Sinnige Hope this gives something back to the community that has helped me quite a bit in the past.

2 1