November 2005 - Freeradius-Users - lists.freeradius.org

MSSQL Querys -> No matching entry
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to make a simple authorization using the mssql module but when Radius execute all the querys "No matching entry..." is the answer. I'm completely sure that all the data store in my database is correct, but I always had the same responce: radiusd -X ------------------------- radius_xlat: '00:11:7C:00:01:57' rlm_sql (mssql): sql_set_user escaped user --> '00:11:7C:00:01:57' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:11:7C:00:01:57' ORDER BY id' rlm_sql (mssql): Reserving sql socket id: 4 query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:11:7C:00:01:57' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'usergroup'. ' rlm_sql_getvpdata: database query error radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:11:7C:00:01:57' ORDER BY id' query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:11:7C:00:01:57' ORDER BY id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'radreply'. ' rlm_sql_getvpdata: database query error radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'usergroup'. ' rlm_sql_getvpdata: database query error rlm_sql (mssql): No matching entry in the database for request from user [00:11:7C:00:01:57] rlm_sql (mssql): Released sql socket id: 4 modcall[authorize]: module "mssql" returns notfound for request 0 ------------------------------------ Is there something that I'm missing?!?! Thanks!! NanO

2 1

Re: FreeRadius using two SQL servers
by Dusty Doris 15 Nov '05

15 Nov '05

> what do you think if we try to use a Perl module inside of the autorize > section?!?!. I want the Perl module to decide between my two sql servers > depending of the incoming realm, I think this can be a possible way to > take. If you have any idea please let me know. Thanks!! That should work too. However, you can do this with Autz-Type, I am currently doing it right now, but using ldap instead of sql. Comment out your Autz-Type entries in your users file and try this. Actually, comment out all your entries if you're not on a production system. DEFAULT Realm == "wireless", Autz-Type := SQL1 DEFAULT Realm == "dhcp", Autz-Type := SQL2 Notice that the check item Realm == is first, then Autz-Type. Make sure your sql1.conf and sql2.conf files look like this at the top. sql1.conf sql sql1 { ... } sql2.conf sql sql2 { ... } Then give it a shot. If that does not work, try change it to add Auth-Type to the end. DEFAULT Realm == "dhcp", Autz-Type := SQL2, Auth-Type := Local If neither of those work for you, please post your debug again. Also, make sure to reply to all, so your replies go back to the list, not just me. -Dusty

2 1

detail files and accounting Alive packets
by Christopher Carver 15 Nov '05

15 Nov '05

Several NAS's we lease, whose configurations we cannot change, authenticate through our freeradius server. The Alive packets we are receiving from these machines are filling up our hard drive. Is there any way to deny just these Alive type packets and continue to accept Start and Stop packets? Everything I read seems to indicate this is impossible. Can someone please confirm or deny? Thanks

2 2

Accounting-Response
by Ruslan A Dautkhanov 15 Nov '05

15 Nov '05

Hello ! Short question ------------------ My FR 1.0 doesn't send Accounting-Response when sql module fail. Is it correct? I think it must always send response packets as an indication that acct packet just recieved. My NAS send acct-request packets in infinity loop until response pkt recived. Explanation --------------- Is it normal behaviour of FreeRADIUS when it does not send Accounting-Response packet to Accounting-Request? My sql module fails to insert data to DB because server due to different reasons send duplicated accounting-stop packet, and I have unique index on sessions table. We use Nomadix HSG as an our central access server for wireless connections. Nomadix send acct-request packets in infinity loop until response pkt recived. Radius debug ----------------- Tue Nov 15 12:40:33 2005 : Error: rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (WIFI.RADACCT_UNIQUEID) violated Tue Nov 15 12:40:33 2005 : Error: rlm_sql (sql): failed after re-connect Tue Nov 15 12:40:33 2005 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - ORA-00001: unique constraint (WIFI.RADACCT_UNIQUEID) violated Tue Nov 15 12:40:33 2005 : Debug: rlm_sql (sql): Released sql socket id: 1 Tue Nov 15 12:40:33 2005 : Debug: modsingle[accounting]: returned from sql (rlm_sql) for request 17 Tue Nov 15 12:40:33 2005 : Debug: modcall[accounting]: module "sql" returns fail for request 17 Tue Nov 15 12:40:33 2005 : Debug: modcall: group accounting returns fail for request 17 Tue Nov 15 12:40:33 2005 : Debug: Finished request 17 Tue Nov 15 12:40:33 2005 : Debug: Going to the next request Tue Nov 15 12:40:33 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:33 2005 : Debug: Waking up in 2 seconds... Tue Nov 15 12:40:35 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:35 2005 : Debug: Cleaning up request 14 ID 2 with timestamp 437974c7 Tue Nov 15 12:40:35 2005 : Debug: Waking up in 1 seconds... Tue Nov 15 12:40:36 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:36 2005 : Debug: Cleaning up request 15 ID 6 with timestamp 437974c9 Tue Nov 15 12:40:36 2005 : Debug: Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 213.24.217.233:1025, id=8, length=162 Thanks a lot for your help -- Ruslan A Dautkhanov

2 1

Interaction between accounting data and radutmp
by TK Lew 15 Nov '05

15 Nov '05

hi all :: I have a weird problem. If I am not mistaken sessions are logged and remove on accouting-start and accouting-stop but I have encountered where an active session for a particular users have been deleted from the session database without the corresponding accounting stop packet. I am running Freeradius 1.0.4 on Solaris 9. Is there a problem with radutmp ?? My config file for radutmp under radiusd.conf :: =========================== radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = no # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } Thanks !

2 5

RE: Problem using exec module
by Mitchell, Michael J 15 Nov '05

15 Nov '05

Hi Nan0, The authorize section of radiusd.conf is actually run twice when an Access-Request is received by the server. The first time, Autz-Type is not set. During the first run through the authorize section, one of the modules may set Autz-Type, for example, a module may set Autz-Type to MY_AUTZ_TYPE. The second time through the authorize section only modules contained within the subsection defined by the Autz-Type variable will be run. eg: Autz-Type MY_AUTZ_TYPE { echo } Hope that helps, Mike > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 15 November 2005 8:38 AM > To: 'FreeRadius users mailing list' > Subject: Problem using exec module > > Hi, I'm trying to use the next exec module: > > radius.conf ------------------- > > modules { > exec { > wait = yes > input_pairs = request > } > exec echo { > wait = yes > program = "/bin/echo %{Autz-Type}" > input_pairs = request > output_pairs = reply > } > } > > authorize { > suffix > echo > files > sql > auth_log > } > > ------------------------------- > > > And the Radiusd gave me the next output: > > radiusd -X -------------------- > > WARNING: Attempt to use unknown xlat function, or > non-existent attribute in string %{Autz-Type} > radius_xlat: '/bin/echo ' > Exec-Program: /bin/echo > Exec-Program output: > Exec-Program-Wait: plaintext: > Exec-Program: returned: 0 > > ------------------------------- > > > I hope someone can help me. Thanks and bye, > > > NanO > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Problem using exec module
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to use the next exec module: radius.conf ------------------- modules { exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{Autz-Type}" input_pairs = request output_pairs = reply } } authorize { suffix echo files sql auth_log } ------------------------------- And the Radiusd gave me the next output: radiusd -X -------------------- WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Autz-Type} radius_xlat: '/bin/echo ' Exec-Program: /bin/echo Exec-Program output: Exec-Program-Wait: plaintext: Exec-Program: returned: 0 ------------------------------- I hope someone can help me. Thanks and bye, NanO

2 2

Juniper buys Funk
by Alan DeKok 15 Nov '05

15 Nov '05

http://www.juniper.net/company/presscenter/pr/2005/pr-051114.html Alan DeKok.

3 3

Radius Server
by tarun sharma 15 Nov '05

15 Nov '05

Dear All, We are making a new Radius Server for our billing purpose so please kindly send me the installation procedure of new radius and necessary requirements of system. Waiting for your reply Thanks & Regards, Amit __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

3 3

Re: Radius Server
by Sean 15 Nov '05

15 Nov '05

Hi Tarun, I've written a how to for FreeRadius that might help you, You will find it here http://swarmhotspots.com/faq.html BTW You should be very explicit with questions posted to the mailing list. You will find people very helpful but don't ask questions if the answer can be found in the docs. Regards, Sean Bracken

1 0