- Freeradius-Users - lists.freeradius.org

[Help] radtest mschap problem
by Andres 28 Apr '13

28 Apr '13

Hello All, I'm trying to test mschap with radtest but it gives me strange error message. I've tried to solve it several days, but had no success. I'm using syntax like that: $ radtest -t mschap user password 127.0.0.1 0 secret radclient : Failed to find IP address for host user: Success radclient: $Id$ built on Jan 22 2013 at 23:55:37 FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Jan 22 2013 host file looks fine I would appreciate it if someone can help me , Andres

5 11

how to remove some character from end of user name
by Mehdi Ravanbakhsh 27 Apr '13

27 Apr '13

Dear All I need to remove "m" character in end of all username i think i should use hint but i can not find how ? Best regrads

3 4

RE: Freeradius-Users Digest, Vol 96, Issue 88
by Okis Chuang 27 Apr '13

27 Apr '13

> Okis Chuang wrote: > > From the originate-coa documentation, it seems I can?t originate > > coa-request at the section of pre-proxy or post-proxy. > > > > It?s documented, pretty clear. > > It's nice to hear that the documentation helps. :) I thought docs are very helpful at most of time. :p > > I?m not sure whether it is the cause of my following questions. > > It is. > > > But what if I need two steps below finished continually both in the > > same > > move: > > > > 1. **proxy** auth request to other AAA dispatcher(also FreeRADIUS) > > to decide where to authenticate. > > That's easy. > > > 2. Getting Access-Accept in post-auth, then originate coa request > > at once in order to change redirect profile to forward profile for > > subscriber. > > That's hard. At least with "originate-coa". So.. the core concept of *originate-coa* is just "proxy-the-coa" instead of initiating a coa request? > > The short answer is that you can run "radclient" as an external program > from the post-proxy section. It's ugly, but it will work. > Hmm..that is indeed an alternative, but like you said, it's kind of not a neat way to achieve my goal. And I'm worrying that might have some performance issue if supposed I will have high traffic. > > But I got the warning that **cannot proxy and originate CoA packets at > > the same time**. > > Yes. We're looking into fixing that for 3.0. No offense, I'm curious that why can't view these two request: "Proxy-Auth Request" and "CoA Request" as two independent request? Or this is about some kind of concern on designation? I thought that was intuitive until I saw the result and got your kind but hopeless response : ( > > Actually I move the coa origination to my AAA dispatcher, it also > > can?t works and occurs the same warning.(It makes sense because both > > are doing coa request after proxying auth request I guess. > > Originating a CoA packet is really proxying it. And the server can't proxy > to two different destinations. Ok. I got your point. > > So here are my questions: > > > > 1. Does this flow works possibly in my scenario? I mean can I > > originate coa at once after getting Access-Accept? > > Not today. Does this would be a difficult demand? > > > 2. What if I set a **virtual coa server** for receiving coa request > > from itself, then send to gateway at the section of > > That won't change anything. > > It may be easy to originate CoA packets *after* proxying. Just so long as it > doesn't do both at the same time. What do you mean *after*? The next any-kind-of request? But I really need they do it in the same sequence. It a bit upset me. > I'll see if I have time to look into it. Thanks Alan! Thanks your contribution and devotion to FreeRADIUS. It's really impressive. Not a compliment at all. lol > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 96, Issue 88 > ************************************************

2 1

Re: Originate CoA Request After Receiving Access-Accept
by Okis Chuang 27 Apr '13

27 Apr '13

> Okis Chuang wrote: > > From the originate-coa documentation, it seems I can?t originate > > coa-request at the section of pre-proxy or post-proxy. > > > > It?s documented, pretty clear. > > It's nice to hear that the documentation helps. :) I thought docs are very helpful at most of time. :p > > I?m not sure whether it is the cause of my following questions. > > It is. > > > But what if I need two steps below finished continually both in the > > same > > move: > > > > 1. **proxy** auth request to other AAA dispatcher(also FreeRADIUS) > > to decide where to authenticate. > > That's easy. > > > 2. Getting Access-Accept in post-auth, then originate coa request > > at once in order to change redirect profile to forward profile for > > subscriber. > > That's hard. At least with "originate-coa". So.. the core concept of *originate-coa* is just "proxy-the-coa" instead of initiating a coa request? > > The short answer is that you can run "radclient" as an external > program from the post-proxy section. It's ugly, but it will work. > Hmm..that is indeed an alternative, but like you said, it's kind of not a neat way to achieve my goal. And I'm worrying that might have some performance issue if supposed I will have high traffic. > > But I got the warning that **cannot proxy and originate CoA packets > > at the same time**. > > Yes. We're looking into fixing that for 3.0. No offense, I'm curious that why can't view these two request: "Proxy-Auth Request" and "CoA Request" as two independent request? Or this is about some kind of concern on designation? I thought that was intuitive until I saw the result and got your kind but hopeless response : ( > > Actually I move the coa origination to my AAA dispatcher, it also > > can?t works and occurs the same warning.(It makes sense because both > > are doing coa request after proxying auth request I guess. > > Originating a CoA packet is really proxying it. And the server > can't proxy to two different destinations. Ok. I got your point. > > So here are my questions: > > > > 1. Does this flow works possibly in my scenario? I mean can I > > originate coa at once after getting Access-Accept? > > Not today. Does this would be a difficult demand? > > > 2. What if I set a **virtual coa server** for receiving coa request > > from itself, then send to gateway at the section of > > That won't change anything. > > It may be easy to originate CoA packets *after* proxying. Just so > long as it doesn't do both at the same time. What do you mean *after*? The next any-kind-of request? But I really need they do it in the same sequence. It a bit upset me. > I'll see if I have time to look into it. Thanks Alan! Thanks your contribution and devotion to FreeRADIUS. It's really impressive. Not a compliment at all. lol > Alan DeKok. > > > ------------------------------

1 0

FW: Freeradius-UsRe: Originate CoA Request After Receiving Access-Accepters Digest, Vol 96, Issue 88
by Okis Chuang 27 Apr '13

27 Apr '13

> Okis Chuang wrote: > > From the originate-coa documentation, it seems I can?t originate > > coa-request at the section of pre-proxy or post-proxy. > > > > It?s documented, pretty clear. > > It's nice to hear that the documentation helps. :) I thought docs are very helpful at most of time. :p > > I?m not sure whether it is the cause of my following questions. > > It is. > > > But what if I need two steps below finished continually both in the > > same > > move: > > > > 1. **proxy** auth request to other AAA dispatcher(also FreeRADIUS) > > to decide where to authenticate. > > That's easy. > > > 2. Getting Access-Accept in post-auth, then originate coa request > > at once in order to change redirect profile to forward profile for > > subscriber. > > That's hard. At least with "originate-coa". So.. the core concept of *originate-coa* is just "proxy-the-coa" instead of initiating a coa request? > > The short answer is that you can run "radclient" as an external > program from the post-proxy section. It's ugly, but it will work. > Hmm..that is indeed an alternative, but like you said, it's kind of not a neat way to achieve my goal. And I'm worrying that might have some performance issue if supposed I will have high traffic. > > But I got the warning that **cannot proxy and originate CoA packets > > at the same time**. > > Yes. We're looking into fixing that for 3.0. No offense, I'm curious that why can't view these two request: "Proxy-Auth Request" and "CoA Request" as two independent request? Or this is about some kind of concern on designation? I thought that was intuitive until I saw the result and got your kind but hopeless response : ( > > Actually I move the coa origination to my AAA dispatcher, it also > > can?t works and occurs the same warning.(It makes sense because both > > are doing coa request after proxying auth request I guess. > > Originating a CoA packet is really proxying it. And the server > can't proxy to two different destinations. Ok. I got your point. > > So here are my questions: > > > > 1. Does this flow works possibly in my scenario? I mean can I > > originate coa at once after getting Access-Accept? > > Not today. Does this would be a difficult demand? > > > 2. What if I set a **virtual coa server** for receiving coa request > > from itself, then send to gateway at the section of > > That won't change anything. > > It may be easy to originate CoA packets *after* proxying. Just so > long as it doesn't do both at the same time. What do you mean *after*? The next any-kind-of request? But I really need they do it in the same sequence. It a bit upset me. > I'll see if I have time to look into it. Thanks Alan! Thanks your contribution and devotion to FreeRADIUS. It's really impressive. Not a compliment at all. lol > Alan DeKok. > > > ------------------------------

1 0

unlang and optimization
by Jason 'XenoPhage' Frisvold 26 Apr '13

26 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, I'm looking for some information on optimizing some of the configuration I've made in my freeradius 2.2.0 installation. Specifically, I need to set a variable based on the LDAP Group membership of a user. I'm doing this in the post-auth section at the moment, which I think is correct. The syntax I'm using is as follows : if (LDAP-Group == "cn=violations,ou=groups,o=mycorp") { update request { Tmp-String-0 := "VIOLATORS" } } elsif (LDAP-Group == "cn=guests,ou=groups,o=mycorp") { update request { Tmp-String-0 := "GUEST" } } This seems to work fine, but I'm not sure if this is the right way to go about it. LDAP is getting a query for each if statement which seems a little much? Is there a way to have the full memberOf list sent back to RADIUS in one shot and then have it processed internally without having to beat up LDAP? I had tried to use a switch/case statement to do this as well, but that doesn't seem to work. Two questions here. First, is switch/case better to use for this or is it functionally equivalent to the if/elsif statement? And second, the syntax I used is below.. Did I do something wrong, or is this not supported? switch LDAP-Group { case "cn=violations,ou=groups,o=mycorp" { update request { Tmp-String-0 := "VIOLATORS" } } case "cn=guests,ou=groups,o=mycorp" { update request { Tmp-String-0 := "GUEST" } } } Thanks, - -- - --------------------------- Jason 'XenoPhage' Frisvold xenophage(a)godshell.com - --------------------------- "Any sufficiently advanced magic is indistinguishable from technology.\" - - Niven's Inverse of Clarke's Third Law -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlF5drEACgkQO80o6DJ8Uvnx4gCdEOriy/lBK5P/AbV1CsiS3YbO zlQAn02AmVmfUbKlz0LmfWTu0Hi8tKq0 =F8oD -----END PGP SIGNATURE-----

4 4

Retrieve 'Aruba-Location-Id' from RAD_REQUEST
by Wang, Yu 26 Apr '13

26 Apr '13

Hello, I am trying to retrieve 'Aruba-Location-Id' from RAD_REQUEST forwarded from Aruba wireless controllers. From radiusd -X output, I can see 'Aruba-Location-Id' contains wireless AP id value. But when I call it from rlm_perl using $RAD_REQUEST{'Aruba-Location-Id'}, I got blank result. The 'Aruba-Location-Id' is in share/dictionary.aruba: ATTRIBUTE Aruba-Location-Id 6 string I would appreciate it if someone can point me what I did wrong and how to correct it. Here is a copy from radiusd -X: rad_recv: Access-Request packet from host 128.186.xxx.xxx port 32795, id=184, length=214 User-Name = "xxxxxxx" NAS-IP-Address = 128.186.xxx.xxx NAS-Port = 0 NAS-Identifier = "128.186.xxx.xxx" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "8C5557290002" Called-Station-Id = "000B860D1980" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201000f016d65678456c65747469 Aruba-Essid-Name = "FSUSecure" Aruba-Location-Id = "wg-a105-HRM.acf.fsu.edu" Aruba-Attr-10 = 0x416c753e544233453656e746572 Message-Authenticator = 0x1509982900acc34524353fc32fa Thanks, Yu Wang Network Architect, FSU

3 7

Originate CoA Request After Receiving Access-Accept
by Okis Chuang 26 Apr '13

26 Apr '13

Dear all, >From the originate-coa documentation, it seems I can't originate coa-request at the section of pre-proxy or post-proxy. It's documented, pretty clear. I'm not sure whether it is the cause of my following questions. But what if I need two steps below finished continually both in the same move: 1. *proxy* auth request to other AAA dispatcher(also FreeRADIUS) to decide where to authenticate. 2. Getting Access-Accept in post-auth, then originate coa request at once in order to change redirect profile to forward profile for subscriber. But I got the warning that *cannot proxy and originate CoA packets at the same time*. Actually I move the coa origination to my AAA dispatcher, it also can't works and occurs the same warning.(It makes sense because both are doing coa request after proxying auth request I guess. So here are my questions: 1. Does this flow works possibly in my scenario? I mean can I originate coa at once after getting Access-Accept? 2. What if I set a *virtual coa server* for receiving coa request from itself, then send to gateway at the section of recv-coa { update coa { ... } } Does it make sense? Thanks in advance! Okis

2 1

implementing 3gpp2 attributes
by Juan Pablo L. 25 Apr '13

25 Apr '13

Hi, i m in the early stages of implementing a prepaid service for a CDMA network, i have to exchange radius package using the 3gpp2 standard which is an extension to the basic radius protocol. i m facing an issue and that is that the attributes in the 3gpp2 standard included attributes that contain subtypes, in the form of: type:26Length: variable, greated than 8Vendor-ID: 5535Vendor-Type: 91Vendor-Length: variable, greater than 2Sub-Type (=1): Sub-Type for AvailableInClient attributeSub-Type (=2): Sub-Type for SelectedForSession attribute.......Sub-Type (=N): XXXX i have done several tests to confirm that freeradius only supports simple attributes in the form of attribute = value, i need to implement the above, is there any way i can implement it ? i dont mind doing all the work my self but i do not see available or easy ways to access the actual data of the structures directly ... can someone please advise how to implement attributes such as the above ? thanks!

3 3

Best way to select multiple NAS-Port-Ids
by Franks Andy (RLZ) IT Systems Engineer 25 Apr '13

25 Apr '13

Hi All, I have a hopefully fairly straightforward question. We have a network switch, a procurve 5406 that we're doing mac based port authentication on. The switch sends radius attributes including the NAS-Port-ID. I want to be able to reply with tagged and untagged vlans for the ports once authenticated, but the combination depends on the port. Lots of ports will likely have the same setup though, so I'd like to do something (I guess in the users file) like DEFAULT NAS-Port-ID == 1-12, ... This would work ok, but the ports are named modularly, i.e. A1, A2 etc, up to usually F24 max, not just numerically. What's the most elegant way of doing this? I could do a wildcard match, but I think I've seen incompatibilities mentioned with possibly chap, which is what I'm using. Could have that wrong though. Is there a better way? Thanks Andy

3 3