December 2005 - Freeradius-Users - lists.freeradius.org

RE: rlm_sqlcounter and something else than Session-Timeout
by Jonathan De Graeve 21 Dec '05

21 Dec '05

> So if they're under the limit at the start of the session, they can > go over during the session, and no one will notice. This has NOTHING > to do with changing the limits during a session. The problem I think most people (and also me) now have appears when you have max-octet limits. If a user exceeded his monthly usage, he can't login anymore until the next month starts. But if he didn't so the remainder is returned as Session-Timeout. The problem with this is that all nasses take this value as 'seconds' instead as octets which will logout a user. Lets say if he got 4GB as remainder, the system will logout the user in 4s (which isn't the behaviour we want offcourse) That's the reason (IMHO) most people want the possibility to set the reply attribute. J.

2 1

Re: Problem with CHAP, users file and radclient
by Andreas Engler 21 Dec '05

21 Dec '05

> Andreas Engler <freeradius(a)arcor.de> wrote: > >>> rlm_chap: login attempt by "hubba" with CHAP password >>> rlm_chap: Using clear text password bubba for user hubba >>> authentication. >>> rlm_chap: Pasword check failed >> >> > > > The password entered in the client does not match the password you > configured on the server. Nothing else will cause this error. > > Alan DeKok. > > thank you for response. One question remains. Is it possible to resend an auth-detail file with Access-Requests that once where successfully authenticated via radclient and authenticate them successfully again, even if there are Chap-Password and Chap-Challenge attributes in the auth-detail file and so the Auth-Type will be CHAP? I expected that would work, but it seems not to function. Is that an CHAP related issue? Andreas Engler

2 1

rlm_sqlcounter and something else than Session-Timeout
by Damjan 21 Dec '05

21 Dec '05

Currently rlm_sqlcounter sums all the session time used by a user, via a MySQL query (summing all the AcctSessionTime) and returns a coresponding Session-Timeout reply to the nas. Now, in my application, I limit users by bytes transfered, so I need to sum AcctInputOctets and AcctOutputOctets, compare that sum to a check attribute (let's call it Max-All-Transfer) and return a coresponding ChilliSpot-Max-Total-Octets. I beleive this is not configurable in rlm_sqlcounter? I could try to make a patch if someone is willing to help me and guide me a bit. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

6 9

Multiple accounting hosts for one realm?
by Johan Ramm-Ericson 21 Dec '05

21 Dec '05

Hello Freeradius-users! While configuring freeradius 1.0.5 on Solaris 9 I began to look at setting up different accounting hosts for users depending on which realm users orginated from. That worked fine. However; I have now come across a situation where it might be valuable to send the same accounting information to multiple accounting hosts. I am hoping to do this by changing the accthost variable in etc/raddb/proxy.conf. Does anyone on the list know if (a) this is possible, and if it is possible (b) how to do it - i.e can I add further hosts in a list to the existing variable or do I need to use some other method? Thanks! /jre

2 1

bug or feature? attr_rewrite rule in post-proxy cannot create config items
by Bastiaan Bakker 21 Dec '05

21 Dec '05

Hi, We have a freeradius 'frontend' server that proxies requests to several legacy radius servers. The frontend server is responsible for IP pool management, but the backend radius server should be able to determine on a per user basis from which IP pool the frontend server should allocate IP addresses. The backend servers return the name of the desired pool in the reply attribute Framed-Pool. On the frontend server I've added a rewrite rule to the post-proxy section in order to copy the Framed-Pool value to the Pool-Name attribute used by rlm_ippool: modules { ... attr_rewrite framedpool2poolname { attribute = Pool-Name searchin = config new_attribute=yes searchfor="" replacewith="%{proxy-reply:Framed-Pool}" append=no } } post-proxy { framedpool2poolname ... } If I run freeradius in debuging mode 'radiusd -X -y', it says it sets the Framed-Pool attribute: rlm_attr_rewrite: Added attribute Pool-Name with value 'eln1' modcall[post-proxy]: module "framedpool2poolname" returns ok for request 0 However the 'eln1' IP pool module fails to find the Pool-Name config item and consequently does not assign an address. Do I misunderstand how the attr_rewrite module is supposed to work or is this a bug? I'm using freeradius-1.0.1-3.RHEL4 on CentOS 4.2. BTW, I did manage to get freeradius to do what I wanted but the 'solution' looks very much like an ugly kludge: I changed the framedpool2poolname module to add a Pool-Name attribute as reply item instead of config item and copy the reply item to the config item in post-auth: modules { ... attr_rewrite poolname2poolname { attribute = Pool-Name searchin = config new_attribute=yes searchfor="" replacewith="%{reply:Pool-Name}" append=no } attr_rewrite framedpool2poolname { attribute = Pool-Name searchin = reply new_attribute=yes searchfor="" replacewith="%{proxy-reply:Framed-Pool}" append=no } } post-auth { poolname2poolname ... } The reason why I can't directly copy Framed-Pool to Pool-Name in post-auth is that I don't want to send the Framed-Pool attribute to the client and the last place where I can filter it out AFAIK is in an attr_filter in post-proxy. Any help in simplifying this setup or confirmation that the current behaviour is indeed a bug would be appreciated very much. Best regards, Bastiaan Bakker E.Novation Lifeline Networks bv

1 0

Problem with rlm_counter in compiling
by Rafael Roldán 21 Dec '05

21 Dec '05

Hy all, I am trying to install freeradius 1.0.5 in a solaris 8 machine. When I run make, I obtain the following error: ... rlm_counter.c:38:18: gdbm.h: No such file or directory rlm_counter.c:84: parse error before "GDBM_FILE" rlm_counter.c:84: warning: no semicolon at end of struct or union rlm_counter.c:88: parse error before '}' token rlm_counter.c:88: warning: type defaults to `int' in declaration of `rlm_counter_t' rlm_counter.c:88: warning: data definition has no type or storage class rlm_counter.c:116: parse error before ')' token rlm_counter.c:116: initializer element is not constant rlm_counter.c:116: (near initialization for `module_config[0].offset') rlm_counter.c:116: warning: missing initializer rlm_counter.c:116: warning: (near initialization for `module_config[0].offset') rlm_counter.c:116: initializer element is not constant rlm_counter.c:116: (near initialization for `module_config[0]') rlm_counter.c:117: parse error before ')' token rlm_counter.c:117: initializer element is not constant rlm_counter.c:117: (near initialization for `module_config[1].offset') rlm_counter.c:117: warning: missing initializer rlm_counter.c:117: warning: (near initialization for `module_config[1].offset') rlm_counter.c:117: initializer element is not constant rlm_counter.c:117: (near initialization for `module_config[1]') rlm_counter.c:118: parse error before ')' token rlm_counter.c:118: initializer element is not constant rlm_counter.c:118: (near initialization for `module_config[2].offset') rlm_counter.c:118: warning: missing initializer rlm_counter.c:118: warning: (near initialization for `module_config[2].offset') rlm_counter.c:118: initializer element is not constant rlm_counter.c:118: (near initialization for `module_config[2]') rlm_counter.c:119: parse error before ')' token rlm_counter.c:119: initializer element is not constant rlm_counter.c:119: (near initialization for `module_config[3].offset') rlm_counter.c:119: warning: missing initializer rlm_counter.c:119: warning: (near initialization for `module_config[3].offset') rlm_counter.c:119: initializer element is not constant rlm_counter.c:119: (near initialization for `module_config[3]') rlm_counter.c:120: parse error before ')' token rlm_counter.c:120: initializer element is not constant rlm_counter.c:120: (near initialization for `module_config[4].offset') rlm_counter.c:120: warning: missing initializer rlm_counter.c:120: warning: (near initialization for `module_config[4].offset') rlm_counter.c:120: initializer element is not constant rlm_counter.c:120: (near initialization for `module_config[4]') rlm_counter.c:121: parse error before ')' token rlm_counter.c:121: initializer element is not constant rlm_counter.c:121: (near initialization for `module_config[5].offset') rlm_counter.c:121: warning: missing initializer rlm_counter.c:121: warning: (near initialization for `module_config[5].offset') rlm_counter.c:121: initializer element is not constant rlm_counter.c:121: (near initialization for `module_config[5]') rlm_counter.c:122: parse error before ')' token rlm_counter.c:122: initializer element is not constant rlm_counter.c:122: (near initialization for `module_config[6].offset') rlm_counter.c:122: warning: missing initializer rlm_counter.c:122: warning: (near initialization for `module_config[6].offset') rlm_counter.c:122: initializer element is not constant rlm_counter.c:122: (near initialization for `module_config[6]') rlm_counter.c:123: parse error before ')' token rlm_counter.c:123: initializer element is not constant rlm_counter.c:123: (near initialization for `module_config[7].offset') rlm_counter.c:123: warning: missing initializer rlm_counter.c:123: warning: (near initialization for `module_config[7].offset') rlm_counter.c:123: initializer element is not constant rlm_counter.c:123: (near initialization for `module_config[7]') rlm_counter.c:124: initializer element is not constant rlm_counter.c:124: (near initialization for `module_config[8]') rlm_counter.c: In function `counter_cmp': rlm_counter.c:138: `data' undeclared (first use in this function) rlm_counter.c:138: (Each undeclared identifier is reported only once rlm_counter.c:138: for each function it appears in.) rlm_counter.c:138: parse error before ')' token rlm_counter.c:139: `datum' undeclared (first use in this function) rlm_counter.c:156: `key_datum' undeclared (first use in this function) rlm_counter.c:159: `count_datum' undeclared (first use in this function) rlm_counter.c:159: warning: implicit declaration of function `gdbm_fetch' rlm_counter.c:133: warning: unused parameter `instance' rlm_counter.c: At top level: rlm_counter.c:171: parse error before '*' token rlm_counter.c:172: warning: function declaration isn't a prototype rlm_counter.c: In function `add_defaults': rlm_counter.c:173: `datum' undeclared (first use in this function) rlm_counter.c:173: parse error before "key_datum" rlm_counter.c:180: `key_datum' undeclared (first use in this function) rlm_counter.c:180: warning: cast discards qualifiers from pointer target type rlm_counter.c:182: `time_datum' undeclared (first use in this function) rlm_counter.c:182: `data' undeclared (first use in this function) rlm_counter.c:185: warning: implicit declaration of function `gdbm_store' rlm_counter.c:185: `GDBM_REPLACE' undeclared (first use in this function) rlm_counter.c:187: warning: implicit declaration of function `gdbm_strerror' rlm_counter.c:187: `gdbm_errno' undeclared (first use in this function) rlm_counter.c:187: warning: format argument is not a pointer (arg 4) rlm_counter.c:192: warning: cast discards qualifiers from pointer target type rlm_counter.c:199: warning: format argument is not a pointer (arg 4) rlm_counter.c: At top level: rlm_counter.c:208: parse error before '*' token rlm_counter.c:209: warning: function declaration isn't a prototype rlm_counter.c: In function `reset_db': rlm_counter.c:210: `data' undeclared (first use in this function) rlm_counter.c:214: warning: implicit declaration of function `gdbm_close' rlm_counter.c:219: warning: implicit declaration of function `gdbm_open' rlm_counter.c:220: `GDBM_NEWDB' undeclared (first use in this function) rlm_counter.c:226: warning: implicit declaration of function `gdbm_setopt' rlm_counter.c:226: `GDBM_CACHESIZE' undeclared (first use in this function) rlm_counter.c: At top level: rlm_counter.c:242: parse error before '*' token rlm_counter.c:243: warning: function declaration isn't a prototype rlm_counter.c: In function `find_next_reset': rlm_counter.c:250: `timeval' undeclared (first use in this function) rlm_counter.c:254: `data' undeclared (first use in this function) rlm_counter.c: In function `counter_instantiate': rlm_counter.c:320: `data' undeclared (first use in this function) rlm_counter.c:327: `datum' undeclared (first use in this function) rlm_counter.c:327: parse error before "key_datum" rlm_counter.c:463: `GDBM_WRCREAT' undeclared (first use in this function) rlm_counter.c:470: `GDBM_CACHESIZE' undeclared (first use in this function) rlm_counter.c:486: `key_datum' undeclared (first use in this function) rlm_counter.c:486: warning: cast discards qualifiers from pointer target type rlm_counter.c:489: `time_datum' undeclared (first use in this function) rlm_counter.c:507: warning: cast discards qualifiers from pointer target type rlm_counter.c:320: warning: statement with no effect rlm_counter.c: In function `counter_accounting': rlm_counter.c:546: `data' undeclared (first use in this function) rlm_counter.c:546: parse error before ')' token rlm_counter.c:547: `datum' undeclared (first use in this function) rlm_counter.c:632: `key_datum' undeclared (first use in this function) rlm_counter.c:637: `count_datum' undeclared (first use in this function) rlm_counter.c:676: warning: comparison between signed and unsigned rlm_counter.c:676: warning: signed and unsigned type in conditional expression rlm_counter.c:699: `GDBM_REPLACE' undeclared (first use in this function) rlm_counter.c:703: `gdbm_errno' undeclared (first use in this function) rlm_counter.c:703: warning: format argument is not a pointer (arg 4) rlm_counter.c:544: warning: unused parameter `instance' rlm_counter.c: In function `counter_authorize': rlm_counter.c:719: `data' undeclared (first use in this function) rlm_counter.c:719: parse error before ')' token rlm_counter.c:721: `datum' undeclared (first use in this function) rlm_counter.c:721: parse error before "key_datum" rlm_counter.c:769: `key_datum' undeclared (first use in this function) rlm_counter.c:781: `count_datum' undeclared (first use in this function) rlm_counter.c:827: warning: comparison between signed and unsigned rlm_counter.c:725: warning: `key_vp' might be used uninitialized in this function rlm_counter.c: In function `counter_detach': rlm_counter.c:873: `data' undeclared (first use in this function) rlm_counter.c:873: parse error before ')' token make[6]: *** [rlm_counter.o] Error 1 make[6]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules/rlm_counter' make[5]: *** [common] Error 2 make[5]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5' make: *** [all] Error 2 It is the first time I use a UNIX machine. How can I resolve this problem? Thank you very much, Rafa

2 2

users file logic?
by Maqbool Hashim 21 Dec '05

21 Dec '05

Hi, I have this in my users file: user Auth-Type := Local, User-Password = "pass" Tunnel-Type = 13, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 4016, Fall-Through = No I would like to assign a different vlan-id if the user doesn't authenticate successfully, i.e. the username is the same but he enters the wrong password. Is this actually possible, as the processing will stop once it matches the first entry for the user "user"? Regards, Maqbool Hashim

1 0

Cisco WLSE status?
by Jeffrey C. Ollie 21 Dec '05

21 Dec '05

Ok, I know that the problems getting Cisco WLSE to authenticate properly with FreeRadius is a problem with the Cisco supplicant, but I'm wondering: 1) Has anyone opened up a ticket with Cisco trying to get them to fix the problem? If so, what is the status of the ticket? 2) Has anyone polished up a patch that will allow WLSE to authenticate agianst FreeRadius? It'd be nice to have a hack that could be enabled conditionally so it doesn't break other hosts but if I have to run a separate server on a different host or port that'd probably work until we can get Cisco to fix their problem. Jeff Ollie

1 0

EAP-PEAP (mschapv2) & ssid restriction
by Sergey Velikanov 20 Dec '05

20 Dec '05

Hi I've implemented wi-fi access (EAP-PEAP with ms-chap v2), it works fine, now I want that users from one ssid could not connect to another ssid, my AP can include this infrmation in Access-Request packet rad_recv: Access-Request packet from host 192.168.232.3:1645, id=215, length=274 User-Name = "user1" Framed-MTU = 1400 Called-Station-Id = "0013.1a4b.ae50" Calling-Station-Id = "0002.2d37.249f" Cisco-AVPair = "ssid=is_client" in my raddb/users I've changed user1 User-Password == "123456" to user1 Cisco-AVPair =~ "ssid=is_client", User-Password == "123456" it works fine with EAP-TLS, but it fails with EAP-PEAP (it uses mschap), rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 18 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for user1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect It seems that rlm_mschap do not include Cisco-AVPair = "ssid=is_client" in its auth request How can I solve this situation?

2 2

"make install" error with FreeRadius 1.0.5 on RH8.0
by Vineet Verma 20 Dec '05

20 Dec '05

I completed the configure and make successfully but "make install" gives me the following error: Making install in rlm_eap_gtc... gmake[11]: Entering directory `/data/software/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_gtc' if [ "xrlm_eap_gtc" != "x" ]; then \ /data/software/freeradius-1.0.5/libtool --mode=install /data/software/freeradius-1.0.5/install-sh -c -c \ rlm_eap_gtc.la /usr/local/lib/rlm_eap_gtc.la; \ rm -f /usr/local/lib/rlm_eap_gtc-1.0.5.la; \ ln -s rlm_eap_gtc.la /usr/local/lib/rlm_eap_gtc-1.0.5.la || exit ; \ fi gmake[11]: execvp: /bin/sh: Argument list too long gmake[11]: *** [install] Error 127 gmake[11]: Leaving directory `/data/software/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_gtc' gmake[10]: *** [common] Error 2 I understand that the "Argument list too long" error is from the OS because the argv list is probably exceeding the 128K buffer. Usually the workaround is to rewrite the offending commands so that the argument lists are shorter. Has anyone run into this problem before and do you have any tips on how I can workaround this?

2 2