February 2006 - Freeradius-Users - lists.freeradius.org

System hangs with Apache SSL mod_auth_radius sending authentication information to a radius - my sql server.
by Frank Reiss 07 Feb '06

07 Feb '06

System hangs with Apache SSL mod_auth_radius sending authentication information to a radius - mysql server. Hi everyone, I am having a problem with my apache web server hanging and am looking for help. I have check the log files and am finding nothing to indicate the cause of the system hangs. The web server which hangs is Fedora Core 4 The Radius - Mysql server is Redhat EL4 httpd.conf excerpts. LoadModule cgi_module modules/mod_cgi.so LoadModule radius_auth_module /usr/lib/httpd/modules/mod_auth_radius-2.0.so #</IfModule> # End of proxy directives. ###################################################################### # # Add to the BOTTOM of httpd.conf # If we're using mod_auth_radius, then add it's specific # configuration options. # <IfModule mod_auth_radius-2.0.c> # # AddRadiusAuth server[:port] <shared-secret> [ timeout [ : retries ]] # Use localhost, the old RADIUS port, secret 'testing123', # time out after 5 seconds, and retry 3 times. AddRadiusAuth imp-dell-21:1812 password 5:3 # ServerName RadiusPassword in clients.conf file # # AuthRadiusBindAddress <hostname/ip-address> # # Bind client (local) socket to this local IP address. # The server will then see RADIUS client requests will come from # the given IP address. # # By default, the module does not bind to any particular address, # and the operating system chooses the address to use. # # # AddRadiusCookieValid <minutes-for-which-cookie-is-valid> # # the special value of 0 (zero) means the cookie is valid forever. # AddRadiusCookieValid 5 </IfModule> /var/www/html/.htaccess file is unchanged ###################################################################### # # A sample per-directory access-control configuration, to be used # as a '.htacces' file. # # # Use basic password authentication. # AuthType Digest won't work with RADIUS authentication. # AuthType Basic # # Tell the user the realm to which they're authenticating. # This string should be configured for your site. # AuthName "RADIUS authentication for localhost" # # don't use 'mod_auth'. # You might want to disable other authentication types here. # You can get a similar effect by commenting out the # 'AddModule mod_auth_*' lines, previously in httpd.conf # AuthAuthoritative off # # Use mod_auth_radius for all authentication, and make the responses # from it authoritative. # AuthRadiusAuthoritative on # # Make a local variation of AddRadiusCookieValid. The server will choose # the MINIMUM of the two values. # # AuthRadiusCookieValid <minutes-for-which-cookie-is-valid> # AuthRadiusCookieValid 5 # # Set the use of RADIUS authentication at this <Location>" # # Locally set the RADIUS authentication active. # # If there is a directory which you do NOT want to have RADIUS # authentication for, then use a <Directory> directive, and # set "AuthRadiusActive Off" # AuthRadiusActive On # # require that mod_auth_radius return a valid user, otherwise # access is denied. # require valid-user The error logs do not record what the problem is. Any ideas? Frank Reiss

1 0

NAS online/offline?
by nikwan (sent by Nabble.com) 07 Feb '06

07 Feb '06

Hypothetically situation: You have users logged into a NAS. the NAS goes down without warning (power failure...) Users who where logged in now have sessions which are not complete (acctstoptime is set to NULL). In my case Simultaneous logins is disabled and need to be so. Therefore once the NAS is brought back up. the users cant log back in, as radius will not authorize the users as they are apparently logged in. My question is... How do i set the accstoptime to the time when the NAS goes down. Is there a way to see when a NAS dies.... Any input will be greatly appreciated -- View this message in context: http://www.nabble.com/NAS-online-offline--t1075858.html#a2800675 Sent from the FreeRadius - User forum at Nabble.com.

5 5

sqlcounter and dialup admin issue
by Georgi Alexandrov 07 Feb '06

07 Feb '06

hello list, i'm using freeradius 1.1.0 with mysql 5.0.x and dialup_admin i want to use the monthly counter function of the sqlcounter module. I've added "checkItem MaxMonthlySession MaxMonthlySession" to sql.attrmap also added: MaxMonthlySession to user_edit.attrs in the radiusd.conf added "monthlycounter" in the authorize section. freeradius loading the module: http://pastebin.com/542929 I add a user from dialup_admin with a maxmonthlysession = 14400 for example and when the user tries to log in radius says: " 1. Tue Feb 7 10:47:14 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [het] 2. Tue Feb 7 10:47:14 2006 : Auth: Login incorrect: [het/het] (from client pppoe-as port 0 cli 00:0A:EB:40:9F:FD) " if i don't specify maxmonthlysession the user logs fine. any idea? -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

1 0

Error -1635
by Hubert Kupper 07 Feb '06

07 Feb '06

Hello, we have freeradius 1.0.4-4 installed on a suse 10.0 64bit box. We want to authenticate with LDAP against Novell edirectory. On suse 10.0 32bit everything worked fine. With the 64bit version we get the following error: "Error reading Universal Password. Errorcode = -1635". Universal Password is already set for our users. What can be wrong? Best regards Hubert

2 2

Freeradius and IKEV.2
by Priscilla B 06 Feb '06

06 Feb '06

Can someone help me with this? Is Freeradius support the implementation of IKEv.2? If so, where can I find documentation of it? Many thanks Priscilla __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

client certificate in PEAP or TTLS
by Norbert Grochal 06 Feb '06

06 Feb '06

Is it possible to force peap to require client's certificates? I can use PEAP, I can use TLS, but I want to join them together. I know that in PEAP certificates are optional not obligatory, how to make it obligatory? Norbert

3 2

FR - Writing Own Queries in sql.conf - Help
by Saeed Ahmed 06 Feb '06

06 Feb '06

Hi Everyone, I am sending this message at very first time, and I hope that I'll get response. My Question is that: In sql.conf's Authorization section, can I write my own queries and can I use the result of my own query. For detailed elaboration I will give you following example: I want something like that: authorize_check_query = "SELECT id, UserName, Attribute, Value, op, uid \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" in query above I created another field `uid` in my radcheck table and suppose here I am getting some kind of user-id. Then I want to use this value in next authorize_reply_query something like that: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' AND uid= '%{authorize_check_query[5]}' \ ORDER BY id" Instead of authorize_check_query I can also use my own query if possible example my_own_query = "SELECT uid from mytable where Username='%{SQL-User-Name}' and then I should be able to use the result of my_own_query. Like my_own_query[0]; etc etc I am using: freeradius-1.0.5 with MySql 5.0 Hope I will get help soon. Thanks in advance for your time. Regards Saeed Ahmed

1 0

FR - Writing own queries in sql.conf - help
by Saeed Ahmed 06 Feb '06

06 Feb '06

Hi Everyone, I am sending this message at very first time, and I hope that I'll get response. My Question is that: In sql.conf's Authorization section, can I write my own queries and can I use the result of my own query. For detailed elaboration I will give you following example: I want something like that: authorize_check_query = "SELECT id, UserName, Attribute, Value, op, uid \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" in query above I created another field `uid` in my radcheck table and suppose here I am getting some kind of user-id. Then I want to use this value in next authorize_reply_query something like that: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' AND uid= '%{authorize_check_query[5]}' \ ORDER BY id" Instead of authorize_check_query I can also use my own query if possible example my_own_query = "SELECT uid from mytable where Username='%{SQL-User-Name}' and then I should be able to use the result of my_own_query. Like my_own_query[0]; etc etc I am using: freeradius-1.0.5 with MySql 5.0 Hope I will get help soon. Thanks in advance for your time. Regards Saeed Ahmed FR - User; currently Helpless;

1 0

Re: How to kick a logged user
by John C. Koen 06 Feb '06

06 Feb '06

On Mon, Feb 06, 2006 at 11:47:38AM -0500, Eduardo Bejar wrote: > > Hi, > > I?ve been searching a while about how to kick a logged user or force > terminate it?s session. It seems that this has been asked before on the > list, but I didn?t find an answer different from "radius can?t do that". The > only answer that I?ve found is that it?s required an external script for > this. > > Section 4.3 of the Freeradius FAQ mentions a radkill program, but the link > included is dead. And also says "try using SNMP". I haven?t also been able > to find information on how to use SNMP for this, so I ask the list: > > Can anyone post a link to download radkill? Here is a link I found on google. This site posts a copy of radkill dated from 2000/04/26: http://slava.parma.ru:8100/Linux-Soft/Billing/radkill/ --johnk > > Or > > Can anyone explain me how to do this with SNMP? > > Or perhaps, > > Can anyone post a procedure to kick a logged user? > > Thanks for your replies, > > Edo > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Multiple ippools with a singe group problem
by Georgi Alexandrov 06 Feb '06

06 Feb '06

Hello list, I'm using freeradius 1.1.0 with dialup_admin and mysql 5.0.x I need different ip pools to be accessible only by one name, e.g. : ippool 1 { ... } ippool 2 { ... } ippool 3 { ... } post-auth { 1 2 3 } accounting { 1 2 3 ... } That way it's working if i add a user to one of 1, 2 or 3 pools. But i need him added to all of the pools. Putting "DEFAULT" won't even asign ip address. post-auth { group all { 1 2 3 } } and putting user in pool "all" doesn't work, freeradius says invalid module "group". So i generally need all the pools to be accessible like one pool name ;-) Thanks in advance -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

1 0