March 2006 - Freeradius-Users - lists.freeradius.org

(no subject)
by vignesh 22 Mar '06

22 Mar '06

Hello guys This is Vignesh here. I have just started with RADIUS. We are planning to build a VoIP billing system using Free RADIUS and Oracle as the backend and using CISCO IPIP gateway . We were planning to implement both postpaid and prepaid scenario. I believe most of you must be doing the same thing. So far we were working on PostPaid Solution. There some problems that we are facing 1. we are using triggers to do the accounting of the call. i.e. calculating the rates etc for that particular call. There many users who can call from either using gateway or using soft phones, hard phones etc. the problem is that while accounting using the trigger, there is no single column from where we can identify the user. The user can be accounted based on his ani or his remote gateway. Also we want multi leg accounting. 2. also we would like to know how we can build a prepaid solution. What are the changes that needs to be done for doing the same. Vignesh vignesh(a)novanet.net

1 0

Doubt regarding sql.conf
by vignesh 22 Mar '06

22 Mar '06

Hello guys I am trying to modify the query for authorization in sql.conf file. I will let you know what I exactly want I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and the call for this particular user has to come from a set of ips like 222.223.33.24 or 33.44.334.44 and many more. the user will be authenticated only when the ani is 9204 and the ip is either of these only. But I am not sure how to modify the query or is there something else That I need to do.. Vignesh vignesh(a)novanet.net

1 0

Table radacct is empty
by Vincent MARGUERIE 22 Mar '06

22 Mar '06

Hi, I've installed freeradius 1.1.1 on a Debian Sarge distribution, and the connection works fine with my wireless windows XP client but I have a problem to get information into radacct table in my mysql database. Does anyone get solution for this ? Rq : I use a Dlink-DWL-2000AP+ as Acces Point Regards, Vincent

2 1

Avoiding ldapsearch on LDAP authentication
by MAEDA 22 Mar '06

22 Mar '06

Hello, I'm running Freeradius 1.0.4 with OpenLDAP 2.2.29 on my Fedora Core 4 box and try to configure radiusd so that ldap_search is not performed on authentication (i.e. just use ldap_bind for authentication). But so far, I've got no success. Radiusd seems to perform search anyway. I've read the document doc/rlm_ldap and followed the instruction, but I couldn't get it working (I must be missing something). I configured radiusd as follows: In users: DEFAULT Ldap-UserDn := `uid=%{User-Name},ou=people,dc=atusi,dc=org`, Auth-Type = LDAP In radiusd.conf: modules { ldap { server = "localhost" ldap_debug = 0xFFFF # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=people,dc=atusi,dc=org" # filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "dialupAccess" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } ... } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } # All other parts are left as default. When I test my setup with: (echo 'User-Name=mytestuser'; echo 'User-Password = mypassword') | radclient -c 1 127.0.0.1 auth testing123 radiusd (run with -X option) says: rad_recv: Access-Request packet from host 127.0.0.1:32791, id=183, length=43 User-Name = "mytestuser" User-Password = "mypassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "mytestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 214 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "mypassword" radius_xlat: '(uid=mytestuser)' radius_xlat: 'ou=people,dc=atusi,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 6 tm: 1 async: 0 ldap_ndelay_on: 6 ldap_is_sock_ready: 6 ldap_ndelay_off: 6 ldap_open_defconn: successful ldap_send_server_request rlm_ldap: waiting for bind result ... ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue Mar 21 13:31:12 2006 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ldap_read: message type bind msgid 1, original id 1 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=atusi,dc=org, with filter (uid=mytestuser) ldap_search put_filter: "(uid=mytestuser)" put_filter: simple put_simple_filter: "uid=mytestuser" ldap_send_initial_request ldap_send_server_request ldap_result msgid 2 ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 2 wait4msg continue, msgid 2, all 1 ** Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue Mar 21 13:31:12 2006 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 2, all 1 ldap_read: message type search-result msgid 2, original id 2 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 2 request 2 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result rlm_ldap: object not found or got ambiguous search result ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: group Auth-Type returns notfound for request 0 auth: Failed to validate the user. According to the log lines: rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 I guessed (by reading rlm_ldap.c) Ldap-UserDn valuepair is not passed to ldap_authenticate() for some reason. I tried to write `Ldap-UserDn := ...' as reply item of the DEFAULT entry in users file but in that case radiusd says: WARNING! Check item "Ldap-UserDn" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items and still got the same result. I also tried in radiusd.conf: modules { ldap { identity = "%{Ldap-UserDN}" password = `%{User-Password}` ... } } but these attributes are not xlated and passed to LDAP as they are. Any clues would be greately appreciated.

3 3

Accounting-Response packet with invalid signature!
by Ryan Melendez 21 Mar '06

21 Mar '06

Hello, I am getting Accounting-Response packets from one particular NAS with an invalid signature. I verified the shared secret is correct. Radiusd is configured to proxy Accounting-Request packets the following way. proxy server { synchronous = no retry_delay = 10 retry_count = 30 dead_time = 300 } This particular NAS take about 25 seconds to send the Accounting-Response. By the time it's sent its response freeradius has moved on to the second or third retry. The authenticator calculated by the NAS is for the initial accounting packet and is invalid for the second request due to a change in the Acct-Delay-Time (and possibly proxy-state). Freeradius then bails out: Received Accounting-Response packet from with invalid signature! Server rejecting request 1. Finished request 1 Going to the next request rl_next: returning NULL Cleaning up request 1 ID 11 with timestamp 44206de3 If I change the config to: retry_delay = 30 retry_count = 1 then freeradius sleeps for 30 seconds and does not send a second packet. Waking up in 31 seconds... rad_recv: Accounting-Response packet from host :1813, id=1, length=25 Proxy-State = 0x323233 Sending Accounting-Response of id 223 to :51818 Finished request 0 What is the correct way to do this according to the RFC? 25 seconds is an extremely long delay but it seems there should be a way to handle this. I tried playing with cleanup_delay, but I'm not getting anywhere. Do I have to set the retry_delay very high to have a better chance? 25 seconds is a long time to wait if the host is actually down. Thanks, Ryan

2 1

Limiting number of EAP connexion
by JVUVANT Yahoo 21 Mar '06

21 Mar '06

Hi people Someone can tell me how to limit number of simultaneous EAP connexions with same login/password ? Thanks Jacques

2 1

Using a LDAP attribute value as the complete HA1 digest string
by Alan 21 Mar '06

21 Mar '06

I would like to use encrypted passwords stored as an attribute value in LDAP. How can I tell the rlm_digest driver to use the complete User-Password attribute value as the full Digest-HA1 string? Instead it takes the value and appends it to the end of the of the A1 string. Please help. ~Alan -- This hash value placed in the LDAP User-Password attribute: $ echo -n 'alan:sip.host.com:test' | md5sum eeee888a05bbdb4b18a5ab5abd3b37c2 Authentication from a SIP server to FreeRadius rlm_ldap and rlm_digest modules: rlm_ldap: - authorize rlm_ldap: performing user authorization for alan radius_xlat: '(uid=alan)' radius_xlat: 'ou=People,o=host.com,o=isp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,o=host.com,o=isp, with filter (uid=alan) rlm_ldap: Added password eeee888a05bbdb4b18a5ab5abd3b37c2 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user alan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3634 modcall: leaving group authorize (returns ok) for request 3634 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3634 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "alan" Digest-Realm = "sip.host.com" Digest-Nonce = "44202102581bdded7ea02108890770e6ad22e27e" Digest-URI = "sip:sip.host.com" Digest-Method = "REGISTER" A1 = alan:sip.host.com:eeee888a05bbdb4b18a5ab5abd3b37c2 A2 = REGISTER:sip:sip.host.com KD = 263c616981c1331d745557f8c7685613:442025f0efb6eb92635e3b938327dfee91ea8b12:f0 8bbaef30f8f1f7c252330c693a3bb3 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 3634 modcall: leaving group authenticate (returns reject) for request 3634 auth: Failed to validate the user.

3 2

Mod_auth_radius
by Cris Boisvert 21 Mar '06

21 Mar '06

I have a couple macs running apache (Preconfigured via Apple) The source is not supplied and the apple didn't apxs.. Has anyone installed mod_auth_radius on a Apple running osx? Thanx

1 0

MySQL and Gigawords help
by Daniel 21 Mar '06

21 Mar '06

Hi I have been trying to get a accounting_update_query accounting_stop_query that will work with MySQL and record over the 4gig for data transfers. Can anyone help? We are needing to record AcctInputOctets and AcctOutputOctets over the 4 gig amount therefore we need to use the Acct-Input-Gigawords and Acct-Output-Gigawords in to account. We are receiving them from our suppliers. We need this because these days we are seeing very long session times for ADSL links and high speed. We can record up to the 4gig mark. I have tried: AcctInputOctets = '%{Acct-Input-Octets}+(%{Acct-Input-Gigawords}*4294967296)' Doesn't seem to work. Any pointing in the right direction would br greatly appreciated. Freeradius 1.1.0 MySQL 4.0.26 Regards Daniel

3 2

sql.conf
by Atkins, Dwane P 21 Mar '06

21 Mar '06

Why is it that when I run a radiusd -X, I always come back with errors on saying that it cannot connect to the mysql server: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user 'radius'@'localhost' (using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. I have put this in my sql.conf like so: # Connect info server = "localhost" login = "radius" password = "xxxxxxxxx" # Database table configuration radius_db = "radius" <mailto:atkinsd@uthscsa.edu> What am I doing wrong? I have followed a number of whitepapers to install this and most of them say the same thing. I downloaded freeradius and mysql-server using the 'yum install' option. Now, when I do a ./configure on freeradius, do I need to do it with a -with-mysql option? Should I try this on something other than FC4? I am opened to options. Thanks Dwane

5 4