- Freeradius-Users - lists.freeradius.org

Post Auth Configurations
by Navodit Bhardwaj 19 Jul '13

19 Jul '13

Hi For each Access-Request recieved and authenticated successfully I want to do following: 1. Verify if Access-Request contains a parameter i.e IMEI of mobile 2. If Not, send Access-Reject. Else, 3. compare IMEI to value in database and assign a 32bit hex number in Access-Accept Basically, I am doing a second authentication after initial authentication (PAP, CHAP) is successful. Any pointers are appreciated. -- br, Navodit Bhardwaj Hughes Systique Corporation

4 4

FreeRadius error LDAP Authentication
by Marco Aresu 19 Jul '13

19 Jul '13

Hi All, i am new about FreeRadius. I am moving from Cisco ACS Tacacs to FreeRadius. During LDAP configuration i am getting the follow error : [ldap] bind as cn="User",ou=people,dc="domain",dc=it/"Password" to "ldapserver":636 [ldap] waiting for bind result ... [ldap] cn="user",ou=people,dc="domain",dc=it bind to "ldapServer":636 failed No such object [ldap] (re)connection attempt failed Any idea about the error? Below the ldap configuration server = "ldapserver" port = 636 identity = "cn="user",ou=people,dc="domain",dc=it" password = "password" basedn = "dc="domain",dc=it" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=groupofuniquenames)" Thanks Marco Aresu

2 1

Re: SNMP support for Free Radius
by Bruce Nunn 18 Jul '13

18 Jul '13

To get by the work of those kittens I set up a remote login to run radmin commands and parse the output so it is suitable for mrtg. It has worked well for me. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: > > > > >On 18 Jul 2013, at 08:43, "manjunath uthappa ponnachana" <pu_manjunath(a)rediffmail.com> wrote: > >> Hi, >> >> Can i know the reason why SNMP support in Free Radius was broken. > >Kittens! They attacked the source code with their tiny claws and gnashing teeth. > >> Which is the last version of Free radius having SNMP support. > >There's a script in scripts to proxy between snmp and status-server, to technically all recent versions have snmp support. > >> >> Also want to know which version of Free Radius has trigger.conf enabled. > >3.0.0 rc0 > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

logout error
by val john 18 Jul '13

18 Jul '13

Hi guys when users logout from the wireless network , i can see following error in the log Error ==== Error: rlm_radutmp: Logout for NAS Wlan1 port 0, but no Login record IS there any reason for that, how can fix it Thank You John

2 1

SNMP support for Free Radius
by manjunath uthappa ponnachana 18 Jul '13

18 Jul '13

Hi, Can i know the reason why SNMP support in Free Radius was broken. Which is the last version of Free radius having SNMP support. Also want to know which version of Free Radius has trigger.conf enabled. Please help for the above information Thanks & Regards Manjunath

3 2

Re: Delete one value of multiple attribute(Class)
by Okis Chuang 18 Jul '13

18 Jul '13

Hi all, Really appreciate all your kind supports and helps very much. Alan..I didn't meant to be inaccurate about describing my situation...I just don't want to blur my question with too many details. Well, I think I didn't keep the balance well. If let you feel bad, I'm very sorry about that. Then you mentioned keeping information in the gateway...in fact, it's a long story.. Anyway, I agree the most part of your point. However, in some kind of situation, I almost can't avoid that. Like this time, due to lacking of supporting on another mandatory attribute(Chargeable-User-Identity) that external AAA needs in our wi-fi gateway, we decide to make this workaround without database. The less database transaction, the better solution it would be. This is the principle we follow on the implementation of RADIUS Proxy server. Our proxy server is like a guard who should check and make many policy or criteria before requests are proxied out. So we do our most effort to prevent us from relying on database. And Thank to Olivier! I've been desired to try 3.0.0 for a long time, while there isn't a good chance for. I've found some new and helpful features in 3.0.0 about Unlang, but never experience them yet. The functions you mention are really helpful. Maybe I should start to plan migrating to 3.0.0. And also thanks for SerpentoR, but unfortunately I can't know which index of Class array is what I want, and even cannot sure about how many items in Class array. So such like "foreach" could be my need for solving this problem. Thanks for all respondents again! Sincerely, Okis.

1 0

RE: Freeradius-Users Digest, Vol 99, Issue 55
by Okis Chuang 18 Jul '13

18 Jul '13

Hi all, Really appreciate all your kind supports and helps very much. Alan..I didn't meant to be inaccurate about describing my situation...I just don't want to blur my question with too many details. Well, I think I didn't keep the balance well. If let you feel bad, I'm very sorry about that. Then you mentioned keeping information in the gateway...in fact, it's a long story.. Anyway, I agree the most part of your point. However, in some kind of situation, I almost can't avoid that. Like this time, due to lacking of supporting on another mandatory attribute(Chargeable-User-Identity) that external AAA needs in our wi-fi gateway, we decide to make this workaround without database. The less database transaction, the better solution it would be. This is the principle we follow on the implementation of RADIUS Proxy server. Our proxy server is like a guard who should check and make many policy or criteria before requests are proxied out. So we do our most effort to prevent us from relying on database. And Thank to Olivier! I've been desired to try 3.0.0 for a long time, while there isn't a good chance for. I've found some new and helpful features in 3.0.0 about Unlang, but never experience them yet. The functions you mention are really helpful. Maybe I should start to plan migrating to 3.0.0. And also thanks for SerpentoR, but unfortunately I can't know which index of Class array is what I want, and even cannot sure about how many items in Class array. So such like "foreach" could be my need for solving this problem. Thanks for all respondents again! Sincerely, Okis.

1 0

Re: [ANN] Version 3.0.0-rc0
by Alan Buxey 17 Jul '13

17 Jul '13

Hi Don't you have freeradius-utils already. .. which contains radtest etc which is very useful for admins alan

2 1

Re: Delete one value of multiple attribute(Class)
by Okis Chuang 17 Jul '13

17 Jul '13

Okis Chuang wrote: > Actually I can write a short perl script to do this, but I try to do > with pure unlang. Unlang is not really intended to do that. > In fact, the reason why I need this function is that sometimes we treat > some attributes as temporary variable for generating another attribute > value pair. Use Tmp-String-0, or Tmp-Octets-0 instead. That way the problem goes away. See "dictionary.freeradius.internal" for more examples. > Then erase it before sending request or reply out. So I am wondering > would majority of FR user do this things like this? And you don't need to erase the Tmp-* attributes before sending a packet. They will *never* show up in a packet. Alan DeKok. ------------- Hi Alan, Thanks for reply. Yes, I totally can understand the solution you recommend, and I've been using this skill for quite a long time. But the situation I encountered is : 1. I need to save some information returned in Access-Accept from external AAA in the attribute *Class* at the section *post-auth*. So it will return back to gateway. 2. Then gateway will send Accounting-Start to my server. In this time, I need to pop out the information I saved in the attribute *Class* in the section *accounting* so that I can generate the avp what I need. Hence, it cannot work by using Tmp-XXX internal attribute because those two events occur in two different sessions to FreeRADIUS. I thought Tmp-* attributes will not exist across two sessions at the same time. So that way I must choose some kind of attribute that gateway must return back for saving temporary attribute value. Concerning about total available length of Class in our wifi gateway, I don't want to do such a waste on attribute Class. Again, just like I said before, because Class is a multi-value attribute I can't find a way to remove a specific value from entire Class array. But anyway, if this is too much for unlang I can use perl to fulfill this definitely. Just curious about if unlang can totally achieve this. :P Cheers, Okis.

3 2

Re: Delete one value of multiple attribute(Class)
by Fahad Saleem 17 Jul '13

17 Jul '13

Hi Alan, Thanks for reply. Yes, I totally can understand the solution you recommend, and I've been using this skill for quite a long time. But the situation I encountered is : 1. I need to save some information returned in Access-Accept from external AAA in the attribute *Class* at the section *post-auth*. So it will return back to gateway. 2. Then gateway will send Accounting-Start to my server. In this time, I need to pop out the information I saved in the attribute *Class* in the section *accounting* so that I can generate the avp what I need. Hence, it cannot work by using Tmp-XXX internal attribute because those two events occur in two different sessions to FreeRADIUS. I thought Tmp-* attributes will not exist across two sessions at the same time. So that way I must choose some kind of attribute that gateway must return back for saving temporary attribute value. Concerning about total available length of Class in our wifi gateway, I don't want to do such a waste on attribute Class. Again, just like I said before, because Class is a multi-value attribute I can't find a way to remove a specific value from entire Class array. But anyway, if this is too much for unlang I can use perl to fulfill this definitely. Just curious about if unlang can totally achieve this. :P If there are the class attributes then Class = 0x3131 Class = 0x3232 Class = 0x3333 This will delete the second Class attribute with value 0x3232 if ("%{Class[1]}" =~ /^(0x3232)/i) { update request { Class -= "%{Class[1]}" } }

1 0