December 2005 - Freeradius-Users - lists.freeradius.org

default gateway per user basis
by Igor Smitran 23 Dec '05

23 Dec '05

Hello. I am new to this list and also to freeradius server. Can someone please help me? I have a pppoe server on freebsd. I want to setup freeradius to give different ip address block and gateway to users. I need two pools, and i have a two gateways. One gateway is more expensive than the otherone. So, users that pay less will use chiper gateway and vice versa. Is this possible? 10x in advance.

3 9

mysql account and users account using exec-program-wait
by SantaYeh 23 Dec '05

23 Dec '05

I store all user account in mysql, and freeradius works fine. And now, we have some special account that need to write a external program to do authentication. So we use the users file using DEFAULT auth-type = Accept with exec-program-wait. The problem is all mysql accounts doesn't work any more. We check with radiusd -X and find all mysql accounts will pass to users and run exec-program-wait. I just want to know how can we stop the users checking if mysql return OK. Regards, Santa Yeh

2 1

patch for sqlcounter, please test!
by Markus Krause 23 Dec '05

23 Dec '05

hi list! part of a radius-related project is to allow access to our guests and visitors at our institute to parts of our network, of course only with username and password, and do some logging. the idea is that guests get an account and a password which they can use for a period of one to seven days (according to setup). to achieve this i am using the sqlcounter module using the following query: query = "SELECT TO_DAYS(NOW()) - MIN(TO_DAYS(AcctStartTime)) FROM radacct WHERE UserName = '%{%k}' LIMIT 1"; this actually works very well, a user logs in and is allowed to access to the network until the date changes e.g. the second time if he is allowed access for two days. but as i am saving the days as "days" in the mysql database, i run into trouble with "Session-Timeout" because rlm_sqlcounter assumes that the query returns seconds and the user gets a session timeout of the remaining days as seconds (a value between 1 and 7!). putting the day limit as seconds into the database does (in my case/opinion) not make any sense here. as i posted a question about this some two months ago to the freeradius users list unfortunately nobody had a solution available, but i can remember several answers (to the list an by private mail) that this feature would be nice! so i finaly tried some coding today and now here is my proposal: add an optional parameter 'timeunit' to sqlcounter.conf that represents the time unit used in the query and the check value (in the sql db), my config then reads: +++++ /etc/raddb/sqlcounter.conf sqlcounter shorttermaccounts { counter-name = Short-Term-Account check-name = Max-Days-Passed sqlmod-inst = sql key = User-Name reset = never timeunit = days query = "SELECT TO_DAYS(NOW()) - MIN(TO_DAYS(AcctStartTime)) FROM radacct WHERE UserName = '%{%k}' LIMIT 1"; } ----- /etc/raddb/sqlcounter.conf in rlm_sqlcounter.c i added some lines which (if 'timeunit' is set) multiply the value of 'res' (i assume this is the remaining time of allowd success) by an appropriate value to get seconds. in this case Session-Timeout is returned "correctly". possible values for timeunit are minutes, hours, days, and weeks (for now). a patch to version 1.0.5 can be found as attachment to this email. i ran several tests and it is also working with different queries (like the ones in the doc), but i would appreciate others to do some testing if it really works. but as it seems that nobody has made a proposal/code for this yet, what do think about it? i put this also on bugs.freeradius.org but could not find the component "rlm_sqlcounter" so i put it in "modules", i hope i did not mess up things! hoping for many feedback! ;-) with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Any Good Documentation for newbies
by Manuj 23 Dec '05

23 Dec '05

Hello As I am new to this free radius, could you please suggest me a good documentation(free) available on the net. Version I am using is Free RADIUS 1.0.5. Regards Manuj

2 1

Radius SIP billing
by Lenir 22 Dec '05

22 Dec '05

Hey guys, I'm running FR1.0.5 with unixODBC (Sybase) backend and I'm trying to bill calls generated from Sip Express Router (SER). The problem that I have is the following scenario: When UserA calls UserB: SER generates a star-record where the Calling-Station-Id is UserA and the Called-Station-Id is UserB, this is the desired and always the correct behavior. When UserA hangs up on UserB: SER generates a stop-record where the Calling-Station-Id is UserA and the Called-Station-Id is UserB, this is the desired and correct behavior. But if UserB hangs up on UserA: SER generates a stop-record where the Calling-Station-Id is UserB and the Called-Station-Id is UserA, this is the undesired and incorrect behavior. To me the Calling-Station-Id and the Called-Station-Id should be the same for both start and stop records, am I right by thinking that? According to the developers of SER/OpenSER, this is the correct behavior, whoever sends the hangup signal (BYE or CANCEL) is considered the Calling-Station-Id, and they are unwilling to modify or create a patch to "fix" this. So for my purposes, i need the Calling-Station-Id and the Called-Station-Id to be the same on both the star and stop records, since the start record is always correct, what do I need to do to have FR "fix" the stop record when it receives it to show the same Calling-Station-Id and the Called-Station-Id as the Start Record? Thanks in advance, Lenir

2 1

rlm_sql_mysql.so where do I locate this file and its associated files for Redhat ES4 to run Radius and MySQL
by Frank Reiss 22 Dec '05

22 Dec '05

Hi, I am trying to build a radius server using MySQL and am getting a message about missing rlm_sql_mysql.so. I could use some help in locating the required modules. Thanks Frank Reiss

3 2

Bind radius authentication with mac address? so radius will check username, password and mac address from radius database
by Yudi Wijaya 22 Dec '05

22 Dec '05

Hello FreeRadius, as subject.. I don't find any clue of this.. even with google :( I already set up this in sql.conf authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE STRCMP(Username, '%{SQL-User-Name}') = 0 and (mac='%{Calling-Station-Id}' or isnull(mac) or mac='') ORDER BY id" postauth_query = "UPDATE ${authcheck_table} set mac='%{Calling-Station-Id}' WHERE Username = '%{SQL-User-Name}' and (mac='' or isnull(mac))" then add this to radreply table in radius database: UserName Attribute op value hendy Calling-Station-Id = 00:0D:87:C7:13:81 i use MikroTik and PPPoE then i try reconnect from different mac address with username: hendy but still connected :( -- Best regards, Yudi mailto:yudiw@centrin.net.id

2 1

Auth/Autz Windows Guest
by Stefan Adams 22 Dec '05

22 Dec '05

Hypothetically: I notice that when you choose "authenticate as guest when computer and user information are not available" in the Windows XP wZc utility, that it passes a User-Name of "". Let's say I wanted to just automatically authorize and authenticate the user "". How could this be done? To try and answer this hypothetical situation, I tried it myself in my test lab but my eap/ldap settings kept jumping in and denying the request. Thanks to all!! Stefan

1 0

Bind radius authentication with mac address?
by Yudi Wijaya 22 Dec '05

22 Dec '05

Hello freeradius-users, so radius will check username, password and mac address from radius database as subject.. I can't find any idea of this.. :( I already set up this in sql.conf authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE STRCMP(Username, '%{SQL-User-Name}') = 0 and (mac='%{Calling-Station-Id}' or isnull(mac) or mac='') ORDER BY id" postauth_query = "UPDATE ${authcheck_table} set mac='%{Calling-Station-Id}' WHERE Username = '%{SQL-User-Name}' and (mac='' or isnull(mac))" then add this to radreply table in radius database: UserName Attribute op value hendy Calling-Station-Id = 00:0D:87:C7:13:81 i use MikroTik and PPPoE then i try reconnect from different mac address with username: hendy but still connected :( -- Best regards, Yudi

1 0

Re: Freeradius Configure Help me
by Kai Geek 22 Dec '05

22 Dec '05

Hello, Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary[14]: Couldn't open dictionary "/usr/share/freeradius/d ictionary": Too many open files Errors reading radiusd.conf ----- Original Message ----- From: "Philippe Sultan" <philippe.sultan(a)gmail.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Configure Help me Date: Thu, 22 Dec 2005 11:58:45 +0100 > > On 12/22/05, Kai Geek <kaigeek(a)linuxmail.org> wrote: > > Hello, > > i am install Slackware 10.2 on freeradius server. > > > In this order? > > > root@slackware:/etc/raddb# radiusd > > Thu Dec 22 12:07:48 2005 : Info: Starting - reading configuration files ... > > root@slackware:/etc/raddb# > > > You successfully launched the radiusd daemon. Try radiusd -X to keep > output to your terminal. > > Bye, > > Philippe > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html +-+-+- BEGIN PGP SIGNATURE -+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) ___ / __) Kai "Ozgur" Geek \__ \ PGP ID: B1B63B6E (___/lackware Network Engineer +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

3 2