March 2006 - Freeradius-Users - lists.freeradius.org

incorrect radacct AcctSessionTime
by Gunther 16 Mar '06

16 Mar '06

Just one observation ... >From time to time I see entries in the radacct AcctSessionTime column with over 1 billion seconds, despite that the StopTime minus StartTime is less than 5 seconds. With FR 1.0.5 it was a few times 2147483647: AcctStartTime AcctStopTime AcctSessionTime inOctets outOctets 2005-10-06 03:34:30 2005-10-06 03:34:34 2147483647 1069 4541 2005-11-09 00:13:39 2005-11-09 00:13:40 2147483647 128 124 2005-12-01 03:13:55 2005-12-01 03:13:58 2147483647 0 40 Now with 1.1.0 it is around 1142280970: 2006-03-14 00:16:29 2006-03-14 00:16:32 1142280970 100 152 2006-03-14 00:16:29 2006-03-14 00:16:32 1142280970 0 0 2006-03-14 00:16:29 2006-03-14 00:16:32 1142280969 0 0 2006-03-14 00:16:30 2006-03-14 00:16:32 1142280969 0 0 2006-03-14 03:26:54 2006-03-14 03:26:56 1142292393 0 0 While the number of transferred octes is usually less than 200 bytes. There are less than 15 users at the same time (GMT time) using the server. There is some heavy download activity before ... I presume that the NAS (wrt54g with Chillispot) is sending the incorrect information ... Is this correct? Gunther

4 6

Creating unique monthly counter entries
by Ben Plimpton 15 Mar '06

15 Mar '06

Hello I'm going to have users trying to authenticate with the same user name from different nases and would like to keep unique monthly counter entries based on what huntgroup they login from. So, what I would like to know if either of the following is possible: 1) Can I have my monthly counter run only on accounting packets received from a certain NAS? or 2) Can I run attr_rewrite only on accounting packets received from certain nases or huntgroups and leave all others untouched? If this solution is possible, I would like to change the username from whatever it comes in as to username@huntgroup but I don't know if that's possible since huntgroup is not an attribute that is contained in the accounting packets. I tried changing it using attr_rewrite using this line: replacewith = %{Stripped-User-Name}@%{NAS-Identifier} but this won't work b/c we want to limit some dialup users to 10 hrs/mo but they can dialup to many different nases so they would end up getting a different entry in the counter for each different nas that they dialed into and would not get cut off properly. I have tried to use the acct_users file to set the huntgoup but cannot figure out how to pass that information on to the counter module. Please help point me in the right direction or if there is a better way to do this, please let me know. Thank you -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

1 0

RE: Freeradius-Users Digest, Vol 11, Issue 58
by Atkins, Dwane P 15 Mar '06

15 Mar '06

Hi, > OReilly FreeRADIUS book, free online documents and help guides I am away that this book is available, and we are trying to purchase it, but it will need to be delivered. > make sure you have the mysql RPMs and the freeradius-mysql RPMs installed I did exactly what the instructions told me to do. I downloaded and extracted the tarball. Configured, make and make install. Was there more I need to do to configure it with mysql? > make sure the right calls are in it. Not sure what this means!!! > How do I enter my users in mysql? Hi, > Is there a free radius for Dummies book out there? I know that most of > the instruction probably make sense to everyone, but me. OReilly FreeRADIUS book, free online documents and help guides > I am trying to configure Freeradius 1.1 on a mysql database using fedora > 4. make sure you have the mysql RPMs and the freeradius-mysql RPMs installed > Is there something I need to do with the sql.conf file to tie all of > this together? > make sure the right calls are in it. I am not sure what you meant by this. > use mysql or use one of the myriad of front-ends to use MySQL via a web interface - mysqladmin etc. PERL scripts using the DBD system too. Where do I find these myriads of front-ends? > Users? the users should be looking at FreeRADIUS. it authenticates them and accounts them via the NAS. or do you mean system admin users? For sys admin users. > yes. in MySQL tables - then use rlm_accounting calls to make sure the dates etc are within those ranges. Where do I find these. I have been to the archives and back. I have searched countless hours for some better examples of installing this process using MySql on Fedora. Thanks Dwane

2 1

FW: Freeradius-Users Digest, Vol 11, Issue 57
by Atkins, Dwane P 15 Mar '06

15 Mar '06

Can you explain a little better what you mean? I am not stuck on loading this. The documentation is way too gray for me and I know that O'Reilly's have put out a Radius book, but it is not in any of the local stores and I am trying to get this done this week instead of the normal 3 -5 business days. I will order it, for reference. I see where is called the sql.conf, but I so not see anything more. What is it actually suppose to look like when I run the Radiusd -X? Also, is there a way that I can get this to start without doing this. Can it run in the background? Thank you for all your inputs. Dwane -----Original Message----- From: freeradius-users-bounces+atkinsd=uthscsa.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+atkinsd=uthscsa.edu@lists.freeradius.or g] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, March 15, 2006 1:35 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 11, Issue 57 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: perl scripts (debik) 2. problem with secret (Guido) 3. Re: Problems configuring Free Radius (321Admin) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Mar 2006 19:38:15 +0100 From: "debik" <debik(a)vp.pl> Subject: Re: perl scripts To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <008001c6485f$9f46fb40$0500a8c0@laptop> Content-Type: text/plain; charset="windows-1250" Hello again. I have stuckon writing that perl script to autheticate users from onother database. How can i grep the User-Name and Password from RAD_REQUEST to my perl script as a variable. I have tried to do something like this: my $username = $RAD_REQUEST{'User-Name'} Is it anyway possibble what im trying to do ? ----- Original Message ----- From: debik To: FreeRadius users mailing list Sent: Sunday, March 12, 2006 12:28 PM Subject: Re: perl scripts I tried to add new sql1.conf. But when i trie starting te radius server he told me that the database is nit in the Attribute Value. I that onother dsatabase i have got users of my network, and i wont, that teh radius server use that logins which are in that database. Sorry for that HTML, and for my english. ----- Original Message ----- From: mnisay To: 'FreeRadius users mailing list' Sent: Sunday, March 12, 2006 10:55 AM Subject: RE: perl scripts what do you want to achieve with this perl script, freeradius can do the authentication. is this script for management of database? if it is, you can use server side php scripts as well. if its not, does the perl script manipulates user database differently? sorry i think i did not get you well. ------------------------------------------------------------------------ ---- From: freeradius-users-bounces+mnisay=aim-consultants.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mnisay=aim-consultants.com@lists.freera dius.org] On Behalf Of debik Sent: Saturday, March 11, 2006 2:43 PM To: FreeRadius users mailing list Subject: Re: perl scripts Yes. But that onother database is not in radius format like: op, value, etc. So I have to write a perl script. ----- Original Message ----- From: mnisay To: 'FreeRadius users mailing list' Sent: Saturday, March 11, 2006 11:27 AM Subject: RE: perl scripts ------------------------------------------------------------------------ -- From: freeradius-users-bounces+mnisay=aim-consultants.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mnisay=aim-consultants.com@lists.freera dius.org] On Behalf Of debik Sent: Friday, March 10, 2006 8:41 PM To: FreeRadius users mailing list Subject: Re: perl scripts > I have got onother mysql base and i wont to write perl script to tel the radius server to use the data in that database. do you mean use MySQL for freeradius authentication? ----- Original Message ----- From: mnisay To: 'FreeRadius users mailing list' Sent: Friday, March 10, 2006 11:26 AM Subject: RE: perl scripts > Could somebody share with some scripts that authorize users in radius. > Im trying to write my own script, but i don't find any docs. > Could somebody help me. authorize users in radius? freeradius can authorize users by default. -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006 ------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 3/10/2006 ------------------------------------------------------------------------ -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 3/10/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 3/10/2006 ------------------------------------------------------------------------ ---- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ ------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Problems configuring Free Radius
by Atkins, Dwane P 15 Mar '06

15 Mar '06

Is there a free radius for Dummies book out there? I know that most of the instruction probably make sense to everyone, but me. I am trying to configure Freeradius 1.1 on a mysql database using fedora 4. I can get to a point where I do the radiusd -X and it starts the radius server. Is there something I need to do with the sql.conf file to tie all of this together? How do I enter my users in mysql? Is there a web interface for the users? Can I put in a start date for a user and a stop date for a user? Is there a web site that I can go to for answers to these questions? I have been to the archives. Thank you and if this all cannot be done, please let me know so I can scrap this project and move onto something different. Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

4 3

Pool-Name attribute missing
by S. K Rahman 15 Mar '06

15 Mar '06

Hello all, After solving the permission issue for rlm_ippool the radius was not assigning the IP from the pool that I defined in the conf file. After doing search in the list archives I realized that I need to assign the poolname to the user or group of user but was not sure where . After doing some more search I found that I need to set the Pool-Name attribute in the radcheck table (Yes I am using Mysql Database) but in the php dialup admin tool does not has the attribute pool-name neither the sql or sql schema mentioned anything about it. I downloaded the dialup admin from the current release version but it also does seem to have the attribute listed. So I was wondering is the poolname deliberately not provided in the dialup admin tool? Do I have to hand edit it to add it? Also does freeradius supports the pool management via sql instead of conf file? Regards

1 0

Error: There are no DB handles to use!
by Vasco Santos 15 Mar '06

15 Mar '06

Hi Folks, I have freebsd 4.10-RELEASE with mysql 4.1.1-alpha and freeradius 1.1.0 Radius give me this error: There are no DB handles to use! what this error means ? radiusd -X ql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1845 Listening on accounting *:1846 Listening on proxy *:1847 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.11:2919, id=83, length=57 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 192.168.1.11 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "teste", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user teste to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'teste' rlm_sql (sql): sql_set_user escaped user --> 'teste' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'teste' ORDER BY id' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 My mysql.log show only connections but querys no. What is the min System Requerements to freeradius work, mem and processor ? Try to install a old version of radius?

1 0

ippool module permission denied
by S. K Rahman 15 Mar '06

15 Mar '06

Hello all, I am prototyping a wifi net access system using prebuilt version of freeradius that came with opensuse. The version is 1.0.4-4 Inorder to have control over the IP assigned when a user authenticates itself I have uncommented the mail_pool from the post auth and accounting section and kept the ippool main_pool section as it is the config. Unfortunately it does not work. When I run the raddius -X it throws me an error rlm_ippool: Failed to open file /etc/raddb/db.ippool: Permission denied The entire rml_pool error is listed below I thought the issue would be related to write access so I checked for the permission. The /etc/raddb directory owner is radiusd I am not sure what I am doing wrong Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/etc/raddb/db.ippool" ippool: ip-index = "/etc/raddb/db.ipindex" ippool: range-start = 192.168.1.1 IP address [192.168.1.1] ippool: range-stop = 192.168.3.254 IP address [192.168.3.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 rlm_ippool: Failed to open file /etc/raddb/db.ippool: Permission denied radiusd.conf[1483]: main_pool: Module instantiation failed. Regards

2 2

RE: Accounting Cisco VSA attributes
by Caines, Max 15 Mar '06

15 Mar '06

Hi I have now upgraded to 1.1.0, and yes, it now converts Cisco AV pairs to new attributes. Many thanks. I thought it was worth mentioning that I had a few problems building Freeradius, which I should have brought up before, because I have dim memories of getting the same ones with 0.9.3. It's making rlm_sql_mysql hat gave me problems, and they were of two sorts. First, "configure" reckoned that MySQL was not usable on my system and didn't create the module in the first place. Then, when I fixed that, the run-time linker failed when the module was first loaded. I was able to fix both these problems, but I thought it might be worth letting you know, because I compiled it on two systems and got the same problems. One is an ancient Sun Ultra 1 running Solaris 5.9, while the other is a SunFire V240s running 5.8, so other Solaris users may see them as well. The "configure" problem I fixed by modifying "src/modules/rlm_sql/drivers/rlm_sql_mysql/configure. This is the output from "diff": 978c978 < LIBS="-L$try -lmysqlclient_r $old_LIBS" --- > LIBS="-L$try -lmysqlclient_r $old_LIBS -lsocket -lm -lz -lnsl" Without that compiling and linking of "conftest.c" in "configure" fails, and it assumes that that's because your MySQL is absent or wrongly set up. The other problem is in "Makefile.in". Here's the "diff" output: 6c6 < RLM_SQL_LIBS = @sql_mysql_ldflags@ --- > RLM_SQL_LIBS = @sql_mysql_ldflags@ -lm -lz The need for "libz" is the result of using MySQL 5.0, which has a new "archive" storage type that uses compression routines from a separate library, so I guess you have this issue on any architecture. "libm" is required because somewhere in the MySQL library there's a call to "floor", and that's probably only an issue with Suns. I realise that this may all be down to something odd about our Solaris systems, and if so please ignore this, but I thought it might be useful. Max Caines > -----Original Message----- > From: > freeradius-users-bounces+max.caines=wlv.ac.uk(a)lists.freeradius.org > [mailto:freeradius-users-bounces+max.caines=wlv.ac.uk@lists.fr > eeradius.o > rg]On Behalf Of Alan DeKok > Sent: 09 March 2006 19:37 > To: FreeRadius users mailing list > Subject: Re: Accounting Cisco VSA attributes > > > "Caines, Max" <Max.Caines(a)wlv.ac.uk> wrote: > > I'm using FreeRadius (0.9.3) > > Oh dear, you *really* should upgrade. See > http://www.freeradius.org/security.html. > > As for the rest of your message, I recall issues with cisco_vsa_hack > in older versions of the server. Maybe a newer version works better. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

detail log
by José Berenguer 15 Mar '06

15 Mar '06

Hello, in the logs of the module auth_log you can suppress the log of the passord? Thanks!

1 0