February 2006 - Freeradius-Users - lists.freeradius.org

dictionary: override attribute type/id mapping
by Andriy Gapon 09 Feb '06

09 Feb '06

I use freeradius-1.1.0 built from FreeBSD ports on FreeBSD. There is the following comment in default raddb/dictionary.sample (this file probably comes from the FreeBSD port): # # Place additional attributes or $INCLUDEs here. They will # over-ride the definitions in the pre-defined dictionaries. # But this doesn't seem to be true or, at least, entirely true. For example, I place the following lines in my raddb/dictionary: # big all-inclusive freeradius dictionary $INCLUDE /usr/local/share/freeradius/dictionary # my local dictionary $INCLUDE /usr/local/local/dictionary.mine And dictionary.mine has this content: #try to override Digest-Response with value from # draft-ietf-radext-digest-auth-06.txt ATTRIBUTE Digest-Response 102 string Then I get the following error on radiusd startup: $ radiusd -sfxxyz -l stdout ... Errors reading dictionary: dict_init: /usr/local/local/dictionary.mine[3]: dict_addattr: Duplicate attribute name Digest-Response Errors reading radiusd.conf Shouldn't I be able to override name->number mapping for attributes ? How to work around this problem ? Is copying the "all-inclusive" dictionary and throwing out the following line the only solution ? ATTRIBUTE Digest-Response 206 string On a related note - is it a good idea in general to have digest authentication stuff defined in main dictionary file and dictionary.freeradius.internal ? Especially given that those definitions are based on the very old and expired draft and are very unlikely to become standard. I think that those definitions should be clearly separated into their own dictionary and they should also somehow be marked as based on the draft-sterman-aaa-sip-00.txt and conflicting with the subsequent drafts, including the latest one (draft-ietf-radext-digest-auth-06.txt). -- Andriy Gapon

2 5

radclient windows
by alfonso 09 Feb '06

09 Feb '06

is there a compile version fro windows ?? thanks, Alfonso Guerendiain oliver

1 0

rsa key length in EAP-TLS.
by Andrea G Forte 09 Feb '06

09 Feb '06

Hi all, as of yesterday I have updated the certificates to use a 2048 bit key. The odd thing is that when I start freeradius, I get the message: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 the length seems to be 512. (?) I would also like to know if the rsa key exchange should be enabled instead of the dh key exchange, and if so how do I enable it? I could not find anything in the config file. Thank you, Andrea

1 0

Duplicate AccSessionId + AcctUniqueId from NAS (which I don't want)
by Mark Elkins 09 Feb '06

09 Feb '06

I've got a problem where sometimes I'm getting duplicate accounting records entered into my Accounts file. The customer is on an ADSL line and the NAS is owned by the local monopoly operator. We need accurate traffic counts for each user - as thats what they are billed on. The Telco has sent multiple accounting records for the same person - due to some error on their side - and this seems to be happening more frequently. The Accounting Data is an attached TXT file - cause its wide... The IP's, Realm and UserName have been changed to protect the innocent. What I don't understand is that the AcctUniqueId sometimes changes for the same AcctSessionId. To fix the problem of getting duplicate accounting entries - I was thinking about making either AcctUniqueId or AcctSessionId a unique key in the MySQL table?... but which should I use - listening to the news that some NAS's don't always seny unique AcctUniqueId info. Does setting AcctSessionId to a unique value make more sense? Does it ever duplicate itself by accident? If I make AcctSessionId a unique key (index?) and radius tries to add a duplicate - what will happen? (I'm hoping the answer is it'll be silently ignored - and not that the whole accounting table will be corrupted as radius dies...). Still - it would seem more useful to have AcctSessionId as a unique index - as its actually used as a value for updating the accounting info when a STOP record arrives. Suggestions? Being really lazy - what would the appropriate MySQL command be? .. and wouldn't this generally be a "Good Thing" to do anyway??? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

A little problem - FR with Mysql Stored Procedure
by Saeed Ahmed 09 Feb '06

09 Feb '06

Dear Sir, I was wondering on mailing list for last 3 days and I didn't get proper response, I am really in problem. I am getting problem to use Mysql Stored procedures with Freeradius. After exploring web It came to know that, (this text I got from mysql.com forum:) the result's of SP execution are sent as result sets over the protocol. Once you call a SP you get at least 1 return code and could get many result sets. The execution of a stored procedure is very similar to execution of a multi-query. MySQL 5.0 supports the execution of multiple statements specified in a single query string. To use this capability with a given connection, you must specify the CLIENT_MULTI_STATEMENTS option in the flags parameter to mysql_real_connect() when opening the connection. You can also set this for an existing connection by calling mysql_set_server_option(MYSQL_OPTION_MULTI_STATEMENTS_ON). By default, mysql_query() and mysql_real_query() return only the first query status and the subsequent queries status can be processed using mysql_more_results() and mysql_next_result(). /* Connect to server with option CLIENT_MULTI_STATEMENTS */ mysql_real_connect(..., CLIENT_MULTI_STATEMENTS); /* Now execute multiple queries */ mysql_query(mysql,"DROP TABLE IF EXISTS test_table;\ CREATE TABLE test_table(id INT);\ INSERT INTO test_table VALUES(10);\ UPDATE test_table SET id=20 WHERE id=10;\ SELECT * FROM test_table;\ DROP TABLE test_table"); Means I need to use CLIENT_MULTI_STATEMENTS in mysql_real_connect(), so, for now, I just need this little guidance that which file should I edit to get SP working with Freeradius. I hope I'll get response this time thanking you in advance Best Regards

3 3

log files not generated!
by DilipSimha.N.M 09 Feb '06

09 Feb '06

hi, i am running freeradius 1.04 on redhat 9.0 linux. i see that log file radius.log is not getting created. but accounting(detail) files are created normally. also the radiusd.pid file doesn't contain the pid of the radius that is currently running. it contains some other pid. also.....only for the first time.....this file gets changed.... after the first time, if u restart RADIUS, then the pid file is not at all modified. Note: i have enabled logging for all possible combinations available and permissions for the log files are full. am i missing something? --DilipSimha

2 2

mschap-v2 - freeradius(proxy) -mschap-v1
by Dmitry S. Vlasov 09 Feb '06

09 Feb '06

Hello! I wanna use mschap-v2 AUTH between windoze VPN clients and NAS, but my billing system use old radius, which can use mschap-v1 ONLY. Can I proxy RADIUS packets through FreeRADIUS and convert mschap-v2 <--> mschap-v1 ? windoze --- (v2)--- freeradius ---(v1) --- billing radius Thanks. Dmitry

2 1

LDAP module locks
by Peter Manckok 09 Feb '06

09 Feb '06

Hy all, I was reading the messages in the forum looking for some information for a problem I have. And I found this post: On August 30, 2005 6:42:39 PM -0400 Alan DeKok <aland at ox.org> wrote: > Frank Cusack <fcusack at fcusack.com> wrote: >> > In ldap_get_conn(), conns[i].locked must >> > not be tested until after a lock is obtained. >> >> fixed in rlm_ldap.c#1.156 but I don't know how to propagate this change >> to 1.0.5 candidate. > > Looking at the code, I'm not even sure that the "locked" member is > appropriate for a threaded environment. It could probably be deleted. > > For non-threading mode, the LDAP module can't be using multiple > connections, because it can only be called once. For threading mode, > the mutexes protect the data structure. > > The "locked" member should be deleted, unless I'm missing something. I have a question: In the ldap_get_conn I see that you use a pthread_mutex_trylock. So if you try to get connection and all the connections are locked, the module fails. Why don´t you use the pthread_mutex_lock function instead in order to wait until the connection is unlocked? Thanks a lot Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Compiling without threads
by Peter Manckok 09 Feb '06

09 Feb '06

Hy all, I am going to compile FR without threads. And I would like to know: How will FR handle simultaneous requests? Does it create new processes using fork functions? Thanks a lot Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

PEAP error with 1.1.0
by hazed＠xs4all.nl 09 Feb '06

09 Feb '06

Hi, I'm trying to get Freeradius 1.1.0 running on a Debian Sarge box. I compiled and built the deb packages from the tarball according to the FAQ instructions. After installing and configuring according to the 802.1X Port-Based Authentication HOWTO on tldp.org, the daemon refuses to start. Freeradius -x gives the following output: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls rlm_eap: Failed to link EAP-Type/peap: rlm_eap_peap.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. I hope someone can shed some light on this. Thanks in advance. Regards Matthew Smith

3 4