List of FreeRADIUS specific attributes

freeradius

I am using FreeRADIUS 2.1.12 with PostgreSQL for user and client (nas) auth. I'm a bit new to this–I learned what RADIUS was when I was assigned to set this server up a couple of weeks ago–so pardon me if I'm misunderstanding.

In the database used by FreeRADIUS, there are several tables that have an "attribute" column. From examples on the web, I see the column can contain many things, like Auth-Type, Framed-IP-Address, Crypt-Password, and so on. However, I have been unable to find documentation anywhere dictating what attributes are valid.

The closest I have come is the RFC attribute list, but none of the examples mentioned above are in that list. This implies that there is a set of vendor-specific attributes. However, in days of searching I have found nothing.

Where can I find documentation for acceptable attributes in FreeRADIUS? Are there different sets of attributes depending on the sql table/config file?

Best Answer

Funny that I would find the answer minutes after posting a question, despite searching for days beforehand.

While explanations of each attribute are not present, I have found where FreeRADIUS stores/looks up attributes. With these lists I can at least figure out what I need.

On my debian install, /etc/freeradius/dictionary includes a file /usr/share/freeradius/dictionary. On many other systems, I believe that you may need to substitute raddb for freeradius in the file paths.

The dictionary file in /usr/share includes many other files, most notably the RFC definitions, dictionary.freeradius for FreeRADIUS vendor-specific definitions, and dictionary.freeradius.internal for things like the users file and SQL databases.

Hopefully this helps someone else with similar questions.

Related Solutions

FreeRADIUS policy to restrict certain users trying to log on a specific device

You should put it in raddb/policy.conf inside the policy {} stanza. Then they can be referenced (by their name) as you would a normal module, in authorize, authenticate, post-auth etc...

Policies in FreeRADIUS are essentially macros, they're not functions, they don't take arguments.

Defining a special attribute to control policy decisions is fine, do it in raddb/dictionary unless you have an IANA number and want to spin your own custom dictionary. An easier way may just be to query SQL directly.

I'm not sure what you want to do specifically, but here's an example that may help... Modify as necessary

special_access {
    if ("%{Called-Station-ID}" == 'special device') {
        if ("%{sql:SELECT special_priv FROM table WHERE username = '%{User-Name}'}" != '1') {
            reject
        }
    }
}

Ubuntu – Freeradius is ignoring Packets

If FreeRADIUS is showing absolutely no debug output, then the server is not receiving the packets from the kernel, or you have it listening on the wrong port.

Trace using radsniff -i <interface>. It will show any packets received on UDP ports 1812/1813.

If you see packets, verify netstat -lun | grep 181[23] shows FreeRADIUS is listening on those ports.

Also verify the reverse routing path for the packet is the same interface as it was received on or disable RPS (http://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering).

Best Answer

Related Solutions

FreeRADIUS policy to restrict certain users trying to log on a specific device

Ubuntu – Freeradius is ignoring Packets

Related Topic