October 2005 - Freeradius-Users - lists.freeradius.org

Can someone guide to configuring pgsql-voip docs
by maruna 28 Oct '05

28 Oct '05

I read through the list archives but I still reading for almost a week now no success yet. What I a looking for is a document on how to enter my rate table i.e. tariff for the prepaid VoIP and to which table of the radius db? I have a successfully running radius server with pgsql-voip module. And the NAS Cisco 5350 is able to send all the accounting record. However, I need to have a rate table in place that will actually bill the call traffic and disconnect the call if the h323-credit-amount turns to zero. Can someone guide me on this? goksie

1 0

Testing accounting
by S�bastien Cantos 28 Oct '05

28 Oct '05

Hi, I've got 2 radius servers in HA mode behind a load balancer. My load balancer needs to test the 2 radius servers to make sure they are responding. I need to send some payload to the accounting port to test this. Can someone tell me which payload I could send to test the accounting port ? Regards, -- Sebastien Cantos <scantos(a)technodiva.com> Network / System Manager Neopost DIVA

2 1

rlm_perl and empty user name variable
by Gustave Nylander 28 Oct '05

28 Oct '05

I have freeradius 1.05 configured with rlm_perl to handle authentication, and the problem seems to be that the $RAD_REQUEST{'User-Name'} variable is an empty string within the perl script I have set up. The perl script is based on the example.pl script provided with freeradius. My users file has one line: DEFAULT Auth-Type := Perl_Auth The applicable sections of radiusd.conf are: modules section: perl { module = "/home/rpm/test_rad.pl" func_authenticate = authenticate func_authorize = authorize } authorize { files } authenticate { Auth-Type Perl_Auth { perl } } The perl script itself has the variables toward the top uncommented, and the authenticate sub is: sub authenticate { # For debugging purposes only &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =="") { return RLM_MODULE_REJECT; } if ($RAD_REQUEST{'User-Name'} =~ /^fred/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } All authentication attempts get caught with the empty string check in the code above. Below is the radiusd debug: rad_recv: Access-Request packet from host 127.0.0.1:43349, id=196, length=55 User-Name = "gus" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Perl_Auth auth: type "Perl_Auth" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_perl: Added pair Auth-Type = Perl_Auth modcall[authenticate]: module "perl" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user.

2 2

RE: Freeradius doesn't find VNUML hosts and nets
by andre kip 27 Oct '05

27 Oct '05

OK. Sorry for assuming that some people could be conversant on this issue. VNUML stands for "Virtual Network User Mode Linux" (http://jungla.dit.upm.es/~vnuml/) a tool to simulate networks and hosts (virtual machines) in linux. The result is a near physical network with all its features... each machine with its filesystem, interfaces, e.t.c. I am in the process of building a radius server and some firewalls in these simulated networks... To the original question: How do I configure freeradius to recognize the nets and hosts created by VNUML ? Radtest receives an Accept-Accept with localhost, but keeps sending access-request for a long time. xxxxxx@linux:~> radtest steve testing routerA localhost testing123 Sending Access-Request of id 246 to 10.0.10.2:1812 User-Name = "steve" User-Password = "testing" NAS-IP-Address = linux Re-sending Access-Request of id 246 to 10.0.10.2:1812 User-Name = "steve" User-Password = "W\272\327Mr":\275\251\223;\206\264\005\3657" NAS-IP-Address = linux : : Thanks in advance, mfG, Trüffel ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

2 1

Error: out of memory
by Erling Paulsen 27 Oct '05

27 Oct '05

Hi all. I have a problem of periodic "crashes" with my server. It can be anything from 1-3 weeks inbetween. Currently I'm running 1.0.5, but I also had the same crashes with 1.0.4. Right before it dies, these messages are recorded to the log: <logsnip> Wed Oct 26 19:23:04 2005 : Error: out of memory Wed Oct 26 19:23:05 2005 : Error: no memory </logsnip> The general system management graphs/tools-history show no excessive or heightened memory usage on the machine before or during the time of these events. The server has 1GB of RAM. I would guess that installing more physical memory on the server would not fix this problem! Generally about the server: The server runs in chroot environment, is threaded, and mostly functions as a proxy server to remote ad/ldaps and other radiuses. It also authenticates some VPN/dial-in users towards local /etc/passwd. The main load is however proxying of about 40-60 PEAP requests a minute. It sends full accounting to a secondary server that pushes ACCT-messages to a Postgresql server. Anyone has some ideas or clues to why this happens? Are there some hints on memory tuning for my server. I.e. what size should my thread-pools be etc for the load described above? - Erling Paulsen

2 1

rlm_counter questions
by Lisa Casey 27 Oct '05

27 Oct '05

Hi, I have setup a brand new FreeBSD 5..3 box with a brand new installation of FreeRadius 1.0.0 (installed from ports). I want to install the rlm_counter module. So I went to /usr/ports/distfiles/freeradius-1.0.1/src/modules/rlm_counter and did a make but got this error: # make "../rules.mak", line 65: Missing dependency operator Error expanding embedded variable. I did some googling and found some posts from this list that suggested I use FreeBSD's gmake instead. If I type gmake I get "command not found", but I found gmake in /usr/local/bin. So I typed /usr/local/bin/gmake and get this error: radius# /usr/local/bin/gmake ../rules.mak:137: warning: overriding commands for target `clean' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:107: warning: ign oring old commands for target `clean' ../rules.mak:157: warning: overriding commands for target `install' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:111: warning: ign oring old commands for target `install' gmake: *** No rule to make target `radiusd.c', needed by `radiusd.o'. Stop. Any suggestions on how to proceed from here? thanks, Lisa Casey -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.361 / Virus Database: 267.12.5/150 - Release Date: 10/27/2005

2 1

Problems with rlm_sql module / drivers on Sparc 64
by Andrew Mattie 27 Oct '05

27 Oct '05

Hello all. I'm having some problems getting FreeRADIUS on a Sparc 64 (E450) to successfully query our MS SQL 2000 database through FreeTDS and through one of the ODBC modules. I've tried both rlm_sql_iodbc and rlm_sql_unixodbc, but I haven't had any luck getting either of them to work on this particular arch / system. However, I _have_ gotten FreeRADIUS to work wonderfully using the same exact config files and UnixODBC on an x86 system. I'm using Linux (Gentoo, not that it really matters) and FreeRADIUS v 1.0.5 on both machines. Accoring to rlm_sql.c, I'm using v 1.131.2.4 of the module. First, I try to rlm_sql_iodbc driver. When I start the server in debug mode on the Sparc, I get the following output and then the server shuts down. *snip* rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked rlm_sql (sql): Attempting to connect to CustomerRadius@:/Emerald4 rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 sql_create_socket: SQLConnectfailed: rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM fRadClients rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[10]: sql: Module instantiation failed. nitrogen raddb # The query it fails on is trying to grab the RADIUS client list from the database. I get the same exact errors on my x86 system using the iodbc driver, so I'm not sure that the problem is architecture dependent. I should point out here that I am able to use the 'iodbctest' program that comes with the libiodbc package to query the database using the same query, DSN, and username without problems. I initially thought it was a problem with FreeRADIUS and libiodbc since it failed on both of my architectures, but a x86 Debian box with FreeRADIUS 1.0.2 seems to work fine with libiodbc. I'm not sure what's relevantly different between the two installations other than a newer version of FreeRADIUS on the installation, so maybe someone could help me out with this problem. Next, I try the rlm_sql_unixodbc driver. Like I said, it works flawlessly on my x86 box, but using it on the Sparc results in a quick consumption of all of the memory on the machine (1 GB) and a subsequent FreeRADIUS crash. Here's what I'm seeing: *snip* rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to CustomerRadius@Emerald4:/ rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM fRadClients rlm_sql (sql): Reserving sql socket id: 4 no memory nitrogen raddb # UnixODBC also includes a program to test out the DSN, username, and query. The program, 'isql,' works perfectly with the given query on both machines and returns the desired results. I'm assuming then that this may be an architecture-dependent problem with either the rlm_sql module or rlm_sql_unixodbc driver. One thing you might notice between the two outputs is that the second line is subtly different in each. From what I've found in setting up the Debian box is that the rlm_sql_iodbc driver looks at the 'radius_db' variable for the name of the DSN. On the other hand, rlm_sql_unixodbc looks at a completely different variable, the 'server' variable, for the name of the DSN! It took me quite some time to figure out that it used two different fields for the different drivers, but experience tells me that it's true. Sure enough, examining sql_iodbc.c:82 looks like it uses config->sql_db (equivalent to radius_db?) for the DSN name and sql_unixodbc.c:93 looks like it uses config->sql_server (equivalent to server?). Just though I'd let anyone trying to get this working know about it. Anyway, I really don't care which SQL driver I use as long as it works. Anyone have any ideas?

1 0

SV: Re: Freeradius stops authenticating
by Svein Hansen 27 Oct '05

27 Oct '05

Thanks, Nicolas I have recompiled freeradius with your patch, and it's running now. (There is a typo in the patch..: ht->table = NULL: ) Svein >>> nbk(a)sitadelle.com 27.10.2005 12:34 >>> Svein Hansen wrote: > I suspected that there had to be a module in freeradius that makes > glibc fault, so I tried to run freeradius in Valgrind: Thanks, the output of Valgrind is very useful. > I'm not a programmer, but can it be that radius tries a double-close > or a double-free? Indeed, it looks like a file stream is closed more than once. Please try to apply these changes to src/modules/rlm_passwd/rlm_passwd.c then recompile FreeRADIUS and test again. Index: src/modules/rlm_passwd/rlm_passwd.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_passwd/rlm_passwd.c,v retrieving revision 1.13.2.3 diff -u -r1.13.2.3 rlm_passwd.c --- src/modules/rlm_passwd/rlm_passwd.c 19 Dec 2004 20:06:30 -0000 1.13.2.3 +++ src/modules/rlm_passwd/rlm_passwd.c 27 Oct 2005 10:23:00 -0000 @@ -136,8 +136,15 @@ for (i=0; i<ht->tablesize; i++) if (ht->table[i]) destroy_password(ht->table[i]); - if (ht->table) free(ht->table); - if (ht->fp) fclose(ht->fp); + if (ht->table) { + free(ht->table); + ht->table = NULL: + } + if (ht->fp) { + fclose(ht->fp); + ht->fp = NULL; + } + ht->tablesize = 0; } static void release_ht(struct hashtable * ht){ @@ -194,7 +201,6 @@ if(*buffer && *buffer!='\n' && (!ignorenis || (*buffer != '+' && *buffer != '-')) ){ if(!(hashentry = mypasswd_malloc(buffer, nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } len = string_to_entry(buffer, nfields, *ht->delimiter, hashentry, len); @@ -219,7 +225,6 @@ else nextlist = 0; if(!(hashentry1 = mypasswd_malloc("", nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } for (i=0; i<nfields; i++) hashentry1->field[i] = hashentry->field[i]; -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Discriminating request between internal and external of the tunnel
by Fabio 27 Oct '05

27 Oct '05

Hi, I am using radius for authorize/authenticate wireless users using PEAP and TTLS. I want to autenticate the users using the information in the tunneled request to a MySQL server. The problem is that freeradius try to authorize also the request outside of the tunnel, that contains an anonymous identity. I am now using the check "Freeradius-Proxied-To == 127.0.0.1" in the file users for determining when a request is inside the tunnel (this attribute is present) and when is outside (the attribute is not present). Is this the right way to do this or there is a better way? Thanks.

1 0

Re: Problem with Password and MySQL
by Fabio 27 Oct '05

27 Oct '05

Hi, I discovered where was the error: I was also limiting the users that can access at the database using the field "NAS-Identifier". That field was copied in the internal tunnell using "copy_request_to_tunnel = yes" in ttls, but not in PEAP. ========================================== To the developer: ========================================== Please document the option "copy_request_to_tunnel" in the peap module in eap.conf. I see it is supported but not documented as in the ttls module. Thanks. ========================================== > What kind of password have you stored in your db? > Alseo the "upper" part of debug info is relevant. Could you post it? > Yuri > > > On 10/25/05, Fabio <fabio.ped(a)libero.it> wrote: > > > > Hi, > > I am trying to use MySQL to autenticate users of a wireless network, using > > EAP-TTLS-PAP or PEAP-MS-CHAPv2. > > > > I use the following users file: > > > > user1 User-Password == "user1" > > DEFAULT Suffix == "@mydomain.org <http://mydomain.org>", Autz-Type := SQL > > > > while I have the following user in radcheck in MySQL > > > > mysql> select * from radcheck; > > +----+----------+---------------+----+-------+ > > | id | UserName | Attribute | op | Value | > > +----+----------+---------------+----+-------+ > > | 11 | sql1 | User-Password | == | sql1 | > > +----+----------+---------------+----+-------+ > > 1 row in set (0.00 sec) > > > > Logging with the user "user1" work fo both TTLS-PAP and PEAP-MS-CHAP-V2 > > (Tested with wpa_supplicant (both TTLS and PEAP) and MS Windows XP (PEAP)). > > > > When i try to authenticate as the user sql1 (which is in the MySQL DB), > > works for TTLS-PAP but doesn't work with PEAP. Seems that inside the file > > "users" are handled both PAP and MS-CHAPv2 password, while with MySQL I can > > use only PAP. > > > > The relevant part of the log with radiusd -X is provided below. > > > > Thanks to anyone helping with this. > > > > > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 8 > > rlm_eap: Request found, released from the list > > rlm_eap: EAP/peap > > rlm_eap: processing type peap > > rlm_eap_peap: Authenticate > > rlm_eap_tls: processing TLS > > eaptls_verify returned 7 > > rlm_eap_tls: Done initial handshake > > eaptls_process returned 7 > > rlm_eap_peap: EAPTLS_OK > > rlm_eap_peap: Session established. Decoding tunneled attributes. > > rlm_eap_peap: Received EAP-TLV response. > > rlm_eap_peap: Tunneled data is valid. > > rlm_eap_peap: Had sent TLV failure, rejecting. > > rlm_eap: Handler failed in EAP/peap > > rlm_eap: Failed in EAP select > > modcall[authenticate]: module "eap" returns invalid for request 8 > > modcall: group authenticate returns invalid for request 8 > > auth: Failed to validate the user. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > Yuri Francalacci > yuri.francalacci(a)gmail.com >

1 0