December 2006 - Freeradius-Users - lists.freeradius.org

modify sql table structure for additional logging
by Cory Robson 05 Jan '07

05 Jan '07

Is it possible to modify the existing radacct table with some extra fields for logging. My upstream also sends Attr-151 X-Ascend-Session-Svr-Key which I would also like logged (its used for terminating a user if need be). I could use it in the unique session server key field instead of the calculated one but would need a step by step on how to go about that. Alternatively as stated above if I could add additional fields then I would also like to log the Ascend-Xmit-Rate & Ascend-data-rate into my database as well as the Ascend-Session-Server-Key. But I don't want to stuff up function ability with Dialup Admin. Thoughts and suggestions please

3 4

Freeradius and biometric devices
by Kenneth Penza 05 Jan '07

05 Jan '07

Hi, I am trying to setup a biometric authentication using freeradius, first the user gives his/her password and then uses fingerprint information. On positive matches the user is authenticated. Can it be implemented? Is there literature that I need to have a look at? Thanks in advance Kenneth ____________________________________________________________________________________ Need a quick answer? Get one in minutes from people who know. Ask your question on www.Answers.yahoo.com

7 11

About modules rlm_eap_peap , rlm_eap_tls....
by adreas Polyxronopoulos 31 Dec '06

31 Dec '06

Hi everyone , I am trying to set up freeradius-1.1.3 for a wlan using peap - eap/mschapv2. I have downloaded the source of freeradius-1.1.3 and compile it (./configure , make , make install) . I am using a guide for setting-up freeradius-1.0.2 . The guide after compiling the source of freeradius-1.0.2 it builds 2 modules ( rlm_eap_peap , rlm_eap_tls). My question is : Do i have to do this in freeradius-1.1.3 source version after i compile it ? Or these modules are build from the top level compile ? thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Help with peap-eap/mschapv2
by adreas Polyxronopoulos 30 Dec '06

30 Dec '06

Hi everyone Merry Christmas and a Happy new year , I have Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

dailup admin and badusers
by jerrrry＠voila.fr 30 Dec '06

30 Dec '06

hi, i don't understand why dialup admin need its own sql table "badusers" and a script to get bad logins whereas rejected users can be found in the freeradius table "radpostauth" ? Regards, Thomas

3 2

Possible to define range of users?
by Ran Shenhar 29 Dec '06

29 Dec '06

Hi All, I was wondering if the users file can hold some definition for a group of users, for example users with IP 192.168.1.*? I've seen the group example (http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_spec ific_user.2C_or_group_of_users.3F), but didn't understand if that also helps to my case. I've also seen http://www.freeradius.org/doc/users.5.html and the =~ for regex, but trying to use that with a User-Name attribute (User-Name =~ 10.100.0.*, Auth-Type := Local, User-Password == "my pass"), the config file couldn't be parsed, with this message: /usr/local/etc/raddb/users-grande-ATM[1]: Parse error (check) for entry User-Name: expecting '=' /usr/local/etc/raddb/users[6]: Could not open included file /usr/local/etc/raddb/users-grande-ATM: Success Errors reading /usr/local/etc/raddb/users radiusd.conf[1035]: files: Module instantiation failed. Am I missing something here, or is this not supported? TIA,

1 0

Repost: Properly using the := and = operators?
by Mike 29 Dec '06

29 Dec '06

Dear list, I'm having a hard time learning how to use the attribute properties correctly in my mysql/radius database and my test enviroment is freeradius 1.1.3 / debian etch. What I'm trying to do is to establish a 'suspended' user group which receives a Framed-IP-Address attribute of 10.10.0.2+, and which overrides any previously assigned Famed-IP-Address, if present. I know that group processing is happening, because I can add attributes to the suspended group and my test user gets those attributes. I am adding the Framed-IP-Address attribute in the radreply table, but it is not being overwritten from the one set by radgroupreply. If I remove this from radreply, then the ip assigned in suspended group is applied. If I change the one in radgroupreply to use the += operator, then it returns both ip addresses in the reply. But I can't seem to get := to overwrite like the docs says it does. Here is a dump of my sample sql tables: mysql> select * from radcheck ; +----+----------+---------------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-----------------+ | 2 | joe.user | User-Password | == | ididntpaymybill | +----+----------+---------------+----+-----------------+ mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup ; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupcheck ; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 3 | dynamic | Framed-Protocol | == | PPP | | 4 | suspended | Framed-Protocol | == | PPP | +----+-----------+-----------------+----+-------+ mysql> select * from radgroupreply ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ | | 7 | dynamic | Framed-IP-Address | := | 255.255.255.255 | +----+-----------+-------------------+----+-----------------+ Here is the results of running radtest on this user: > radtest joe.user ididntpaymybill localhost 0 testing123 Sending Access-Request of id 140 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=140, length=32 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255 What I am trying to accomplish is simply to allow us to put overdue users into the 'suspended' group, which will hand out a different set of ip addresses than their normal non-suspended configuration. I realise I could be approaching this all wrong but right now I simply set those items (framed-ip-address, framed-route, and etc) in the radreply table and I don't want to remove those items from the database, just override them. Any pointers would be greatly appreciated. Mike- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 3

Freeradius, MySQL and unique accounting records.
by Mark J Elkins 29 Dec '06

29 Dec '06

I'm getting multiple "accounting_start_query" records in my "radacct" table. When a "Stop" arrives, each gets the same accounting info (time online, bytes in, bytes out - etc)... However - when I run SQL queries - I do not get true stats - which is a problem. My "accounting_start_query" are stock standard (I'm running an oldish version of radius though). What is happening is that I'm getting multiple Start Records - and logging each one. accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'ade8e732c3a7aef6', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:25', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '0', '0'); INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'ade8e732c3a7aef6', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:29', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '5', '0'); INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'e71dbe474c39274d', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:35', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '15', '0'); INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'db5198a07e9ebe18', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:39', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '10', '0'); [the stop record] UPDATE radacct_rad2 SET AcctStopTime = '2006-12-20 06:37:09', AcctSessionTime = '2040', AcctInputOctets = '2371574', AcctOutputOctets = '93521334', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = 'AutoShapedVC' WHERE AcctSessionId = '7/0/3/5.117_18EB0F13' AND UserName = 'scubaw(a)pop.co.za' AND NASIPAddress = '196.43.27.19'; The Acct-Delay-Time is different for each record - increases by 5 seconds - etc. So what do people do to maintain accurate accounting records? For example - to get the current monthly data-in+out total for an individual - I run.... MBYTE=$(mysql -u$USR -p$SQLPASS -h$DBHOST -B --skip-column-names $DB -e \ "SELECT ROUND(SUM((AcctInputOctets + AcctOutputOctets)/1048576)) FROM radacct WHERE AcctStartTime > '$monthstart' AND username = '$username@$realm'") Currently - this is quite quick - but would give me the wrong results for the above! What about making the column "AcctSessionId" unique? (somehow) - or maybe a new column which contains AcctSessionId, UserName and NASIPAddress - or what do people suggest? -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

PEAP+PAM or MySQL possible?
by Matt Goebel 28 Dec '06

28 Dec '06

I'd like to move to WPA Enterprise EAP/PEAP from EAP/TLS. That way there are no client certificates to deal with and I can instead just use usernames/passwords. I don't, however, want either OpenLDAP or AD to do it. Both would be overkill for my needs and just add an extra layer to maintain. Instead I want to use either PAM or MySQL in their place. Is this even possible? If so how? I haven't seen any documentation that definitively explains this one way or another. Testing I'm able to successfully authenticate using the radtest program. From a client (both Windows and Linux) I get invalid username/password errors. Debug mode I see the username being passed correctly along with other information but no password, encrypted or otherwise. Maybe this is by design? I haven't seen what working PEAP debug messages look like so I have no frame of reference.

2 1

RE: FreeRadius overview
by David Covert 28 Dec '06

28 Dec '06

Ok, I almost get it... question: The mssql.conf file has an entry like this: #Database table configutation radius_db = "radius" I assume that "radius" refers to a pre-determined schema that freeRadius assumes the auth db is going to use. Thing is, I want to reference a different schema, one that is used by my current customer care system (Platypus). Can I refer to a different schema? If so, where do I go to define it? Does anyone happen to know if a Platypus schema already exists? Or would I be better off to write triggers in my current Platypus db to copy data from various tables to the radius tables every time a customer record is updated? Thank you for your time, Dave Covert I am serious... and don't call me Shirley! _____ From: freeradius-users-bounces+dcovert=erfwireless.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+dcovert=erfwireless.com@lists.freeradiu s.org] On Behalf Of Hernan Antolini Sent: Thursday, December 28, 2006 11:29 AM To: FreeRadius users mailing list Subject: Re: FreeRadius overview David, start with "rlm_sql" at source_directory/doc, check also your sql.conf in your installation etc/raddb directory....it help me also this one to start http://www.frontios.com/freeradius.html (for mysql). I hope it helps....if you're about using ms-sql check also "mssql" at source_directory/doc. Regards freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on 12/28/2006 01:37:51 PM: > > I have gotten freeRadius working with a mikrotik NAS using the users > flat file (hooray for me! <g>). Now I need to have the freeRadius server > reference a MS-SQL db server rather than the users file on the > freeRadius server. I am quite fuzzy about the process tho. I am hoping > for some basic edukashun. > > How do you tell freeRadius to reference an external MS-SQL db rather > than the local users flat file? > How do you issue the query to the db? (what file contains the connection > string and query) > How do the returning fields get mapped into RADIUS attributes? (what do > you do when the db calls the field "uname" and RADIUS calls it > "user-name") > > Thank you for your time, > Dave Covert > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1