- Freeradius-Devel - lists.freeradius.org

edit RAD_REQUEST_PROXY_REPLY with perl
by Tim.W 22 Jan '09

22 Jan '09

Hi, I'm trying to edit the values in RAD_REQUEST_PROXY_REPLY with perl. I've started with the example.pl file, and I'm able to list the first different attributes but I'm not sure how to list all the values, and how to change them. Specifically I want to edit the values of cisco-avpair attributes (which are multiple), replacing specific strings. I don't want to add a new attribute, but to change one or more of the attributes before they are sent to my NAS. Can anyone help me with an example of how to traverse and change these? (btw, I'm using freeradius version 2.1.3) Thanks, Tim

3 4

Nas-Ip-Address attribute and source IP address of UDP datagram.
by Dmitry V. Krivenok 22 Jan '09

22 Jan '09

Hello! I deal with bad "hand-made" NAS, which doesn't include "Nas-Ip-Address" attribute into the packet. So I can't distinguish packets from different NAS'es. Is there a way to add this attribute (with value of source address of UDP datagram) using standard FreeRadius facilities? We don't use proxies, so this solution seems to be correct. I'm writing my own rlm and I can implement desired functionality if there is no one in FreeRadius. The problem lies in that I can't find the address of client in REQUEST (i.e. auth_req) structure. Comments in "site-enabled/default" say that preprocess module should add "Client-IP-Address" attribute. I printed request->packet->vps, but did't find this attribute in the list. Is source IP address reachable via REQUEST structure passed to authorize callback? -- Sincerely yours, Dmitry V. Krivenok Orange System Co., Ltd. Saint-Petersburg, Russia work phone: +7 812 332-32-40 cellular phone: +7 921 576-70-91 e-mail: krivenok(a)orangesystem.ru web: http://www.orangesystem.ru skype: krivenok_dmitry jabber: krivenok_dmitry(a)jabber.ru icq: 242-526-443

1 0

status server
by Gabriel Blanchard 22 Jan '09

22 Jan '09

Man I've been bugging you guys all day... Another issue came up when I tried to enable the status server. I used the default settings provided and this is what I get. /usr/local/etc/raddb/sites-enabled/status[20]: Failed to find module "ok". /usr/local/etc/raddb/sites-enabled/status[19]: Errors parsing authorize section. From what I understand "ok" isn't even supposed to be processed by modcall.c I found another thread regarding this pasted below... >> /opt/radius/etc/raddb/sites-enabled/status[63]: Failed to find module >"ok". >> Wed Nov 26 15:53:18 2008 : Error: >> /opt/radius/etc/raddb/sites-enabled/status[61]: Errors parsing authorize >> section. >> Wed Nov 26 15:53:18 2008 : Debug: } >> Wed Nov 26 15:53:18 2008 : Debug: } >> Wed Nov 26 15:53:18 2008 : Error: Errors initializing modules >> >> The same config works fine with REL3 and 32 bit. >> >> Any ideas what could be wrong ? > > Nope. I'll see if I have access to a 64-bit system. > > Alan DeKok. I'm using FreeBSD amd64 so I figured that I'm also affected. After digging for an hour in the source code I pretty much gave up, but I did find a work-around by declaring always okhack { rcode = ok } and then replacing the "ok"s with okhack in the status server. That seems to have fixed it. -Gabriel

2 1

GIT Log for 2009-01-22 00:33 GMT
by aland＠deployingradius.com 22 Jan '09

22 Jan '09

commit 2ce4a036dcb9a5e860462e3f452c2d634cb1efd7 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 21 14:40:30 2009 +0100 Look for setuid && set/getresuid Files changed: configure | 6 ------ src/include/autoconf.h.in | 9 --------- 2 files changed, 0 insertions(+), 15 deletions(-) ====================================================================== commit ab8297a0d666c19367717169eba68dc7b3ce6b50 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 21 14:35:40 2009 +0100 Check for setuid, and use those checks Conflicts: configure.in Files changed: configure.in | 3 --- src/main/mainconfig.c | 11 ++++------- 2 files changed, 4 insertions(+), 10 deletions(-) ====================================================================== commit 451d5da93a4f19a37bc5d3ba9fc8d4d97adbeabc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 21 11:13:24 2009 +0100 If we're at EOF, the socket will never be ready So check for EOF in more places Files changed: src/modules/frs_detail/frs_detail.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ======================================================================

1 0

rlm_fastusers
by Gabriel Blanchard 21 Jan '09

21 Jan '09

So I am in the process of upgrading from freeradius 1.x to 2.x. I have scripts that check if my radius configuration is correct before I actually run radiusd. I'm more specifically interested in checking if my fastusers file syntax is correct before loading it. I found out that by running radiusd -n radiusd-test -C -X it wouldn't check my fastusers module at all. Module: Linked to module rlm_fastusers Module: Skipping instantiation of fastusers After some more digging I found that the module needs to have a type flag of "RLM_TYPE_CHECK_CONFIG_SAFE" for it to check. Now I'm not sure if I should just blindly change the source code and add this flag in the module or not. Should I just try it and report back if it works?

2 3

buffered-sql
by Gabriel Blanchard 21 Jan '09

21 Jan '09

I was just trying to implement a buffered-sql server (type detail) using the FreeBSD port 2.1.3 and it was only passing on the first SQL query and any consecutive query would be left out. I found an old thread in the freeradius archive regarding this and you pointed this out (Alan) Copy pasting.. > It looks like it isn't noticing that it's finished reading the file. > > I would suggest going to line 482 of src/main/detail.c, and adding a >new line: > > data->state = STATE_HEADER; > if (feof(data->fp) goto cleanup; // added line > return 0; > > If that fixes it, I'll commit it to CVS. if not then the issue is a > little more complicated. > > The good news is that 2.0 now has the skeleton of a regression test >suite in src/tests. So adding an automated test for this case should be >relatively straightforward. and there was no follow up after it....so I tried it and it appears to work. Now I realize that your latest GIT isn't the same at all from what I can see and honestly I don't really have the time to look at it. Anyway this patch appears to fix the issue on 2.1.3 --- src/main/detail.c 2009-01-20 20:32:05.000000000 -0500 +++ src/main/detail.c 2009-01-20 20:32:27.000000000 -0500 @@ -579,6 +579,7 @@ */ if (!data->vps) { data->state = STATE_HEADER; + if (feof(data->fp)) goto cleanup; return 0; } Unless someone may think that this will cause an issue, I'll be using it on my radius servers for now... -Gabriel

2 1

FreeRadius as a RADIUS server cum GPRS subscriber database
by Sourav Chakraborty 20 Jan '09

20 Jan '09

Thanks for your answer......I understand that on GGSN restarts it handles thousands of msgs per sec......what about sustained handling of say around 3000 msgs/sec?Is that handled? regards Sourav

2 1

GIT Log for 2009-01-20 00:33 GMT
by aland＠deployingradius.com 20 Jan '09

20 Jan '09

commit 41f7fe149bce496f5584df11dd6e9fe1a28bc3a1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 19 16:15:08 2009 +0100 Notes on MySQL Files changed: raddb/sqlippool.conf | 9 +-------- 1 files changed, 1 insertions(+), 8 deletions(-) ====================================================================== commit 2378dddd64ec401c905fd919be64e74a65c68aee Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jan 13 14:01:14 2009 +0100 Note restrictions on detail file usage Files changed: raddb/modules/detail | 7 ------- raddb/sites-available/robust-proxy-accounting | 7 ------- 2 files changed, 0 insertions(+), 14 deletions(-) ====================================================================== commit 27e1fa07d2397eef1429b0f9686abc5acce6403f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jan 18 16:13:13 2009 +0100 CoA is in request->proxy, not request->packet Files changed: src/main/event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 74e3af45d731ad88b040256769c5848e8c4949cc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 19 14:51:19 2009 +0100 Try to work around transactional issues... Files changed: raddb/sql/mysql/ippool.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 59eb241b7e0a3ae3af834deb1a516226f1a9aa81 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 19 13:41:34 2009 +0100 Clean up CoA origination to not depend on CoA This makes the patch a little cleaner Files changed: src/main/event.c | 13 +++++-------- 1 files changed, 5 insertions(+), 8 deletions(-) ======================================================================

1 0

GIT Log for 2009-01-19 00:33 GMT
by aland＠deployingradius.com 19 Jan '09

19 Jan '09

commit 43c7d9ced19f33f1f8b9370f53f223067dffd747 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Jan 18 17:16:10 2009 +0100 Removed extraneous line src/main/checkrad.pl.in | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)

1 0

detail logging not logging?
by Brad Clemmons Jr 17 Jan '09

17 Jan '09

Hi all. I seem to be missing something somewhere. I'm new to freeradius but I managed to get a system up and running. Here's a copy of my stripped down radiusd.conf. I'm only doing accounting right now so no auth stuff. I know radius itself is working because I can change the secret in the client.conf and I get the errors in the radius.log when the client sends. The issue I'm having now though is that I can't seem to get the detail logging to work so the only time I get any logs is if I purposefully foul something up to cause it to error. Right now I have the detail statement at the bottom of the file. I've tried moving it into the modules section but that didn't make any different. I also tried manually specifying the fully qualified path for the log file as well to no avail. I verified user and group permissions in the necessary directories, but I must still be missing something. Anyone able to point out what's wrong but right under my nose? Also it's worth noting this is running on Solaris10x86 under a zone. ############################################################ ## radiusd.conf -- FreeRADIUS server configuration file. ## ## http://www.freeradius.org/ ## $Id$ ## prefix = /opt/freeradius exec_prefix = ${prefix} instance_prefix = /opt/voip/freeradius sysconfdir = ${instance_prefix}/etc localstatedir = ${instance_prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${instance_prefix}/logs raddbdir = ${instance_prefix}/etc radacctdir = ${instance_prefix}/var/radacct # # name of the running server. See also the "-n" command-line option. name = radiusd # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir} # # libdir: Where to find the rlm_* modules. # # libdir = ${exec_prefix}/lib # pidfile: Where to place the PID of the RADIUS server. # pidfile = ${run_dir}/${name}.pid # user/group: The name (or #number) of the user/group to run radiusd as. # user = ****** group = ****** # max_request_time: The maximum time (in seconds) to handle a request. # max_request_time = 30 # cleanup_delay: The time to wait (in seconds) before cleaning up cleanup_delay = 5 # max_requests: The maximum number of requests which the server keeps max_requests = 1024 # listen: Make the server listen on a particular IP address, and send listen { type = acct ipaddr = * port = 1813 } # hostname_lookups: Log the names of clients or just their IP addresses hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' allow_core_dumps = no # Regular expressions regular_expressions = yes extended_expressions = yes # # Logging section. The various "log_*" configuration items log { destination = files file = ${logdir}/radius.log syslog_facility = daemon # Log the full User-Name attribute, as it was found in the request. stripped_names = no # Log authentication requests to the log file. auth = no # Log passwords with the authentication requests. auth_badpass = no auth_goodpass = no } # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad # SECURITY CONFIGURATION security { max_attributes = 200 reject_delay = 1 status_server = yes } # PROXY CONFIGURATION # # proxy_requests: Turns proxying of RADIUS requests on or off. proxy_requests = no #$INCLUDE proxy.conf # CLIENTS CONFIGURATION $INCLUDE clients.conf # THREAD POOL CONFIGURATION thread pool { # Number of servers to start initially --- should be a reasonable # ballpark figure. start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } # MODULE CONFIGURATION modules { # $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf #$INCLUDE sql/postgresql/counter.conf } # Instantiation instantiate { exec expr expiration logintime } ###################################################################### # # Policies that can be applied in multiple places are listed # globally. That way, they can be defined once, and referred # to multiple times. # ###################################################################### $INCLUDE policy.conf #$INCLUDE sites-enabled/ detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d #detailfile = ${radacctdir}/%{NAS-IP-Address}/detail-%Y%m%d #detailfile = ${radacctdir}/detail.log detailperm = 0600 } ########################################################################

2 3