November 2005 - Freeradius-Users - lists.freeradius.org

radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

When I run radiusd from the command line in a Fedora Core 1/RedHat 9 base system, it will start w/o any problems. However, when I try to start radiusd from inside a helper app., it says it is ready to process requests but then throws the following error to the radius.log file: Sun Nov 13 22:39:10 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Nov 13 22:39:10 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Nov 13 22:39:10 2005 : Info: Ready to process requests. Sun Nov 13 22:39:10 2005 : Error: Error receiving packet: Socket operation on non-socket Sun Nov 13 22:39:10 2005 : Error: Error receiving packet: Socket operation on non-socket Sun Nov 13 22:39:10 2005 : Error: Error receiving packet: Socket operation on non-socket The helper script is as follows: ======================= /* This program is distributed under the terms of the GNU General Public * Licence. See the file COPYING for details. * * filename: radctrl * Simple program intended to be installed setuid(0) that can be used for * controling the Captive Portal service (FreeRadius). */ #include "setuid.h" int main(int argc, char *argv[]) { int fd = -1; if (!(initsetuid(1))) exit(1); if (argc < 2) { fprintf(stderr, "Missing arg\n"); exit(1); } if (((fd = open("/var/smoothwall/mods/captiveportal/enable", O_RDONLY)) != -1) || (strcmp(argv[1], "X") == 0)) { close(fd); } else { return 0; } // Declare used vars FILE *radpidfile = NULL; FILE *radstatusfile = NULL; char radstatusfilepath[STRING_SIZE]; memset(radstatusfilepath, 0, STRING_SIZE); char command[STRING_SIZE]; memset(command, 0, STRING_SIZE); char radpid[STRING_SIZE]; memset(radpid, 0, STRING_SIZE); int radrunning = 0; // Open freeradius's pid file if ((radpidfile = fopen("/var/run/radiusd/radiusd.pid", "r"))) { // Read in freeradius's pid fgets(radpid, STRING_SIZE, radpidfile); if (radpid[strlen(radpid) - 1] == '\n') { radpid[strlen(radpid) - 1] = '\0'; } fclose (radpidfile); } else { // Set -1 flag snprintf(radpid, STRING_SIZE - 1, "-1"); } // Null out file pointer radpidfile = NULL; // Check to see if have a valid pid if (strcmp(radpid, "-1")) { // Get freeradius status file path snprintf(radstatusfilepath, STRING_SIZE - 1, "/proc/%s/status", radpid); // Open freeradius's status file if ((radstatusfile = fopen(radstatusfilepath, "r"))) { // Set status and close file radrunning = 1; fclose (radstatusfile); } else { radrunning = 0; } // Null out file poinnter radstatusfile = NULL; } else { radrunning = 0; } // Check for start if (strcmp(argv[1], "S") == 0) { if (radrunning == 0) { system("/usr/local/sbin/radiusd > /dev/null"); system("/usr/bin/logger -t smoothwall 'FreeRadius has been started'"); } else { system("/usr/bin/logger -t smoothwall 'FreeRadius is already running'"); } // Check for restart } else if (strcmp(argv[1], "R") == 0) { if (radrunning == 1) { snprintf(command, STRING_SIZE - 1, "/bin/kill -9 %s > /dev/null", radpid); system(command); sleep(1); system("/usr/local/sbin/radiusd > /dev/null"); system("/usr/bin/logger -t smoothwall 'FreeRadius has been restarted'"); } else { system("/usr/bin/logger -t smoothwall 'Can not restart FreeRadius since it is not running'"); } // Check for stop } else if (strcmp(argv[1], "X") == 0) { if (radrunning == 1) { snprintf(command, STRING_SIZE - 1, "/bin/kill -1 %s > /dev/null", radpid); system(command); system("/usr/bin/logger -t smoothwall 'FreeRadius has been stopped'"); } else { system("/usr/bin/logger -t smoothwall 'Can not stop FreeRadius since it is not running'"); } } else { fprintf(stderr, "Bad arg\n"); exit(1); } return 0; } ================ This app used to work just fine before my recent HD and MoBo crashes today. I had to restore the system from a backup and the app. will no longer work. Like I said, radiusd from the command line starts FreeRadius just fine. It is only in this app. that it is now causing me problems. Thank you, Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

2 1

RE: assigning a vlan-id after successful authentication
by Jeff Reilly 13 Nov '05

13 Nov '05

2 1

Computer Logon with PEAP-MSCHAPv2
by Sebastian Mauer 13 Nov '05

13 Nov '05

Hello there, after setting up our new central Radius Server I now want to finally set up PEAP-MSCHAPv2 with support for Computer acces, that my users can log in to the Samba administered Domain from Wireless Terminals (like their Laptops). I found a lot of helpful HowTos and Documentations but never managed to get Information about Computer Logons with PEAP. I understand that PEAP only uses certificates to identify the Radius Server, but uses Username/Password for connecting Users to the Wireless Network. Can someone point me to a resource or tell me how to do this all for Machines that they can authenticate when no user has logged in, to manage connection to the Domain when it comes to specific User login. Greetings, Sebastian Mauer

2 3

RE: sqlcounter and session-timeout
by Jonathan De Graeve 12 Nov '05

12 Nov '05

> > > I am trying to use sqlcounter to count octets and am having the same > problem. It seems that sqlcounter module was designed to handle the > amount of time a user is allowed online and as such is hardcoded to > return the Session-Timeout value according to the sql query. > > >how can i override the value of session-timeout, lets say for 10 minutes > (i dont > >care if a user can stay connected until 0:10) ?? > > > I put a seperate entry in the radcheckgroup table with the > session-timeout value but freeradius seems to always return the lower of > the two values... again presumably to limit online usage. > > Anyway let me know if you find a way... I am going to see if I can make > sense of "rlm_sqlcounter.c" with my limited c knowledge :-) > I have the same problem and this by configured my nas to discard the session timeout. It would be nice if you could have a config parameter if the system should return session-timeout for the specific sqlcounter or return it as another 'defined by admin' radius attribute (for octets in the case of Nomadix lets say: Nomadix-MaxBytesDown/Nomadix-MaxBytesUp) J.

2 1

sqlcounter and session-timeout
by Markus Krause 12 Nov '05

12 Nov '05

hi all, i have set up freeradius v1.0.5 with experimental modules on a sles 9 system. i am storing the user information in a mysql db, which works. then i wanted to set configure some "short term accounts" which are only valid for some days, to be more exact: after the first usage of a username the account should be valid until midnight (the same, following, .. days). testing with ntradping worked. to achieve this i use the following in radiusd.conf, sqlcounter.conf and dictionary: +++++ radiusd.conf authorize { preprocess eap files sql shorttermaccount } authenticate { eap } accounting { detail unix radutmp sql } ----- (radiusd.conf) +++++ sqlcounter.conf sqlcounter shorttermaccount { counter-name = Short-Term-Account check-name = Max-Days-Passed sqlmod-inst = sql key = User-Name reset = never query = "SELECT TO_DAYS( NOW() ) - TO_DAYS( AcctStartTime ) FROM radacct WHERE UserName = '%{%k}' LIMIT 1;" } ----- (sqlcounter.conf) +++++ dictionary ATTRIBUTE Max-Days-Passed 3000 integer ----- (dictionary) in the mysql db i have: +++++ mysql output mysql> select * from radcheck; +----+----------+-----------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+----------+ | 6 | guest2 | Password | := | secret99 | | 7 | guest2 | Max-Days-Passed | := | 1 | +----+----------+-----------------+----+----------+ ----- (mysql output) testing with ntradping shows access-accept (unil midnight after first accounting). but when using an ironpoint 200 ap i run into the following problem: the reply message contains "Session-Timeout := 1" which is (as it seems) sent by sqlcounter, which means the client (a windows xp sp2 with intel pro 2200bg) reconnects every second!! i already tried to enter the user "guest2" in mysql in the table "radreply": ++++ mysql output: mysql> select * from radreply; +----+----------+-----------------+----+-------+------+ | id | UserName | Attribute | op | Value | prio | +----+----------+-----------------+----+-------+------+ | 1 | guest2 | Session-Timeout | := | 600 | 1 | +----+----------+-----------------+----+-------+------+ 1 row in set (0.00 sec) ----- (mysql output) but this only affects user which have no attribute "Max-Days-Passed"... how can i override the value of session-timeout, lets say for 10 minutes (i dont care if a user can stay connected until 0:10) ?? thanks in advance for any hints!! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

rlm_radutmp: No NAS-Port seen
by Markus Krause 12 Nov '05

12 Nov '05

hi all! when running freeradius in debug mode i am finding the following message: +++++ [snipp] rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [snipp] radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'anonymous' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ----- is this really jsut a warning or does it mean the accounting (done for short term accounts using mysql) will not work? (as reported in another mail i only got accounting entries for user "anonymous" which comes from eap-ttls) thanks in advance for your help! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

assigning a vlan-id after successful authentication
by Sven Juergensen 12 Nov '05

12 Nov '05

hello people, how does the above mentioned work? i am not quite sure where to start. is it embedded in the 'Reply-Message' or does it have to do with the tunnel-types? i'm trying to supply a vlan-id to an hp2626 with mac-based authentication. couldn't find this in the faq or relevant conf-files either - what am i missing? thanks alot in advance, sven

2 1

RE: possible bug in rlm_preprocess parsing of huntgroups?
by Jonathan De Graeve 12 Nov '05

12 Nov '05

> This time it DID match on the proper huntgroup. Radiusd debugging > confirms this, but for the sake of brevity I omitted it here. This > email is already long enough. Is this a bug or am I clearly doing > something wrong? This behavior is not seen in freeradius-0.9.3. It > seems to surface after 1.x. Prior to 1.x users file huntgroup matching > happens perfectly regardless of order and quantity of huntgroups. > > Any ideas? Thanks in advance! > There's nothing wrong with Freeradius. The code is: first matched, first served. The order in which you setup huntgroups is important, that's all. So you always need to specify the exceptions first and later on the default stuff J.

1 0

Ascend-Data-Filters
by Eric Gregory 11 Nov '05

11 Nov '05

I am having an issue that hopefully someone can help with. I am trying to configure my radius server to send liethe following reps Ascend-Data-Filterwhen a user authenticates. Ascend-Data-Filter = ip in forward tcp est Ascend-Data-Filter = ip in forward dstip xxx.xxx.xxx.4/32 Ascend-Data-Filter = ip in drop tcp dstport = 25 Ascend-Data-Filter = ip in forward This is for configuration with GlobalPops and I need my users to be able to relay mail through my SMTP server for this to work. I am using FreeRadius 1.0.4 with the Mysql backend. When I run radcheck I get this info in the reply Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Netmask = 255.255.255.255 Session-Timeout = 43200 Idle-Timeout = 1500 Port-Limit = 1 Framed-MTU = 1300 Ascend-Data-Filter = "ip in forward tcp est" If I wipe out the "ip in forward tcp est" line I get the "ip in forward dstip xxx.xxx.xxx.4/32" line in the reply, if I wipe that out the next comes back but I can't get more than one to come back at me. I have tried applying the filters to the user and to the group which the user is a part of and gotten the same result. Anyone know what my problem is here. Is there a setting that I have to set to allow it to send multiple instances of the same reply attribute back? Thanks for any help you can offer. Eric Gregory

3 2

possible bug in rlm_preprocess parsing of huntgroups?
by Christopher Carver 11 Nov '05

11 Nov '05

The scenario is complicated. I will try to keep this as short and simple as possible. We are experiencing odd and different behavior when we modify just the order of the huntgroups being built in raddb/huntgroups. Nothing else is changed, just the ordering. FreeBSD 5.3-RELEASE w/ Freeradius-1.0.5. We authenticate dialup users. In our users file we want to pass back to the NAS a specific ip pool if the customer's Calling-Station-Id is a certain set of area codes and exchanges. However, we want to have exceptions to this. So, we have a huntgroup called "migration" for the set of Calling-Station-Id area codes and exchanges and an "exceptions" huntgroup that has the Calling-Station-Id values of people who will not get the ip pool even though they are part of the set defined under "migration". raddb/huntgroups (note the ordering, migration THEN exceptions): migration Calling-Station-Id =~ "^304729" migration Calling-Station-Id =~ "^304297" exceptions Calling-Station-Id =~ "3047291185" exceptions Calling-Station-Id =~ "3047299137" exceptions Calling-Station-Id =~ "3042972446" raddb/users (note the use of fall-through to keep exceptions matches from getting the ip pool): DEFAULT Autz-Type := NoTollfree, Simultaneous-Use := 1, Session-Type := dialup Port-Limit = 1, Idle-Timeout = 1800, Framed-Protocol = PPP, Service-Type = Framed-User, Fall-Through = yes DEFAULT Huntgroup-Name == exceptions Fall-Through = no DEFAULT Huntgroup-Name == migration cisco-avpair = "ip:addr-pool=migration", Now we test with an authentication request packet in a file and radclient. Here is the contents of the file and output when testing with radclient: # auth request packet User-Name = test Password = test Calling-Station-Id = 3047291185 # radiusd reply packet Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Cisco-AVPair = "ip:addr-pool=migration" Port-Limit = 2 It obviously didn't match the exceptions huntgroup in the huntgroups file because 3047291185 is clearly a member of that huntgroup. radiusd -x verifies it did not. Now watch what happens when we do nothing but reverse the order of the huntgroups and restart radiusd. The users file and authentication request packet will both remain exactly the same. Here's the new raddb/huntgroups file: exceptions Calling-Station-Id =~ "3047291185" exceptions Calling-Station-Id =~ "3047299137" exceptions Calling-Station-Id =~ "3042972446" migration Calling-Station-Id =~ "^304729" migration Calling-Station-Id =~ "^304297" Now the new output after testing with radclient (keeping the auth packet and users file exactly the same): Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Port-Limit = 2 This time it DID match on the proper huntgroup. Radiusd debugging confirms this, but for the sake of brevity I omitted it here. This email is already long enough. Is this a bug or am I clearly doing something wrong? This behavior is not seen in freeradius-0.9.3. It seems to surface after 1.x. Prior to 1.x users file huntgroup matching happens perfectly regardless of order and quantity of huntgroups. Any ideas? Thanks in advance! Chris Carver

1 0