- Freeradius-Users - lists.freeradius.org

Get Stop in accounting do some action
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

Hello everyone I need to update some check and replay attribute in database when get stop in accounting and the session is finish i need to know in which section of virtual server file ( sites-enabled/default) i need to put unlang script (and/or perl script) ? and how i can check in script if accounting get stop packet , read some radacct fild of that session to do some calculate and do some query in database in radcheck and radreplay . Best regards.

2 3

Value-pairs from exec script
by Brian Wallen 06 Mar '13

06 Mar '13

I have an exec script that returns a User-Name. FreeRADIUS passes the User-Name to my script (ie MyOldUsername) and my script changes it (ie MyNewUsername). In my logs I see Exec-Program-Wait: value-pairs: User-Name = MyNewUsername so I know my script is working and returning correctly. My problem is that FreeRADIUS doesn't take MyNewUsername from the script and MyOldUsername gets inserted into the radacct table. Below is my exec config. My script is a PHP script on a web server that gets called via wget. One thing that I'm not sure of is what input_pairs and output_pairs should be set to. I see that "config" and "reply" are valid options, but what is the difference between them? What other information is needed in order to troubleshoot this problem? exec { wait = yes program = `/usr/bin/wget -q -O - 127.0.0.1/%{Calling-Station-Id}` shell_escape = yes input_pairs = config output_pairs = config }

3 8

mschap module vs ntlm_auth module
by Óscar Remírez de Ganuza Satrústegui 06 Mar '13

06 Mar '13

Good afternoon, As I said some days ago in this list, we have configured our freeradius server to use ntlm_auth for autentication following the document: http://deployingradius.com/documents/configuration/active_directory.html Everything is working as expected. Thanks! But I have some doubts about that documentation. In section "Configuring FreeRADIUS to use ntlm_auth" is said to "to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file." I have made some tests and it seems that is not needed to add it, as freeradius is using mschap module to autenticate. +- entering group MS-CHAP {...} [mschap] Client is using MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> oscarrdg [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=oscarrdg [mschap] mschap1: b9 [mschap] expand: %{mschap:Challenge} -> b9415739df3a9c1b [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=b9415739df3a9c1b [mschap] expand: %{mschap:NT-Response} -> 2d41aa6d7e87e086dfc2920f2234b58ca1f6efe2c71505b8 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=2d41aa6d7e87e086dfc2920f2234b58ca1f6efe2c71505b8 Exec-Program output: NT_KEY: 312D5366FF0179461F1E13FA4AECD06A Exec-Program-Wait: plaintext: NT_KEY: 312D5366FF0179461F1E13FA4AECD06A Exec-Program: returned: 0 [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok Is there anything else to take into account considering adding that section to the virtual servers configuration or not? Or is it just needed when Auth-Type is set to ntlm_auth manually in order to test the system? I usually prefer to let config files as similar to the default files as posible. Thank you so much for your help. Regards, * Oscar Remírez de Ganuza Satrústegui* Servicios Informáticos (Área de Infraestructuras) Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.es/SI/

3 3

design question
by Matt Zagrabelny 06 Mar '13

06 Mar '13

Greetings, I am configuring a general purpose RADIUS server that any number of clients can connect to for authn - it uses a PostgreSQL DB as the backend datastore. I would also like to setup a secondary RADIUS server listening on a different port (ie. 1814) and use the same Pg DB as a backend, but use a "restricted" view as the "users" table, then configure devices (certain network gear) that wish to only allow users in the "restricted" view to use that secondary RADIUS server and corresponding port. I am currently using Debian 6.0 with corresponding FR 2.1.10+dfsg-2+squeeze1. My questions are these: Has anyone here setup a second instance of FR running on the same system as their primary instance, but with different configs? Do you have any suggestions for layout or keeping configs/logs straight? Or said another way, how much confusion will there be in /etc/freeradius (default Debian config dir) due to the second instance? Is it worth it, just to have a single system have all of your RADIUS servers or should I just stand up another virtual server and use that instead? Thanks for any help or hints! -matt zagrabelny

3 7

Help
by Jed Gainer 06 Mar '13

06 Mar '13

Help

3 3

Thank You freeRADIUS!
by Thomas Simmons 06 Mar '13

06 Mar '13

Hello All, I have been working on a pretty major upgrade of the "core authentication system" at my company. The original system was designed and deployed by me nearly a decade ago, and was built around Samba3, OpenLDAP and freeRADIUS 1. Until I started the upgrade, I was unaware of the new capabilities of freeRADIUS 2, namely virtual servers. To be honest, when I started a few months back it was primarily for the functionality of Samba 4 (Active Directory). That said, when I became aware of the capabilities of freeRADIUS 2, it gave me some great ideas about authentication.Until now, we had a simple internal network where people could login with their Samba3 credentials and a external (connected to our DMZ) network that just used WPA2-PSK. I never liked this setup for two reasons: 1) anyone could bring their own device and connect to our internal network (it's gotten really bad since smartphones and tablets became the new craze) and 2) we have a large number of employees that are off-site, but come on-site regularly. These employees always want to connect to our main network with non-or-other-company systems since using their domain credentials is easier. In any event, I really started digging into freeRADIUS 2 over the last week and now have an internal network that does AD auth (user or computer) w/ MAC restrictions and an external network that does both AD auth and has a "guest" account in a file (I may change this to MySQL and create a small web interface so employees can create a temporary, self-expiring account for guests). The only hiccup I ran into along the way was Microsoft's client not liking wildcard certs, so I can say it was a very smooth process from a freeRADIUS perspective. Now I'm starting to think how can we push this out to a few other sites we have across the country. Pretty easily actually! Anyhow, I just wanted to give a big thank you to Mr. DeKok and anyone else who works on freeRADIUS or helps on the lists. As a lllloooonnngggg time user, your efforts are very much appreciated here! Thanks, Thomas

1 0

freeradius2.2.1 rpm build
by Fred MAISON 06 Mar '13

06 Mar '13

Hi all, I have make a build unsing Suse spec, I saw it is binded to SOURCES/freeradius-server-2.2.0.tar.bz2. Is there any way to create SOURCES/freeradius-server-2.2.1.tar.bz2 after following sequence : git clone git://git.freeradius.org/freeradius-server.git git fetch origin v2.x.x:v2.x.x git checkout v2.x.x ? Does a tar cvfj could be OK ? Best regards , Fred MAISON

1 0

Is updating RAD_CHECK attribute take effect on replay attribute
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

If in section of sites-enabled file ( such as : authorize - authenticate - preacct - accounting - checksimul - post_auth and ..) i update some RAD_CHECK control attribute such as Pool-Name it is take effect on Framed -ip address replay attribute ? Is it matter that in which section i update RAD_CHECK control attribute ?

1 0

overlapping cisco avpairs (UCS+IOS)
by Jimmy Stewpot 06 Mar '13

06 Mar '13

Hello, For some time we have been using freeradius to provide authentication to our networking estate. Recently we introduced the Cisco UCS. The problem that we now have is it appears that we have a conflict in the VSA attributes required to provide the right levels of access to end users. We have always had the Cisco-AVPAIR of "shell:priv-lvl=15" which has been working for some time. With the Cisco UCS platform we need to introduce an additional shell: variable which looks like this "shell:roles=admin". I have tried to add the variables to our users file with a += but the values are never accepted by the end Cisco device. It seems that only the first-to-be-received is actually activated on the Cisco device. I have bene playing around with various formats in the users file without any success. I am interested to know if anyone else has had such issues and if so what the solution is? I am currently running with Freeradius v2.1.12 provided as a part of the Redhat EL6 distro. We have our users in an Active Directory tree using the ldap plugin. our users file looks like this currently. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15" I've tried the following DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15, roles=admin" - Fails.. both networking and UCS result in read-only or no access. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15,roles=admin" - Fails.. both networking and UCS result in read-only or no access. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15", Cisco-AVPAIR+="shell:roles=admin" - Works with the switch/router estate but not with UCS. If i do a debug on the device it always matches the first entry in the returned attributes and discards the second. If I remove the priv-lvl=15 and only have shell:roles=admin and it works for UCS but the switch and router estate fails. Any assistance would be greatly appreciated. Regards, Jimmy.

3 2

Re: Freeradius 2.2.0 memory leak issue.
by Alan Buxey 06 Mar '13

06 Mar '13

Have you tried the latest 2.2 GIT release? Many code updates alan

3 2