June 2006 - Freeradius-Users - lists.freeradius.org

Alvarion issue with radius accounting in Free Radius server
by Robert Dukes 13 Jun '06

13 Jun '06

Hello, I am writing to see if anyone on the list is using Alarion breezeAcess radios with free radius for accounting? If can you give me a helping hand, I am trying to get freeradius to understand what the radios is sending and have it mapped the attributes to the right sql fields. I can send some debug data if needed . We are in Russia working on a project for schools kids and the orphanges and we need ot account trafice with our network of Alvarion radios !!!! -- Robert Dukes

1 0

huntgroup
by Kartthik Raghunathan 13 Jun '06

13 Jun '06

Am using two linksys access points for my wireless client. In one of my access points i want to restrict the users connecting to it, ist possible to do this using huntgroup. If so can someone show some light or provide a sample config to do it. thanks, Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

4 7

called failed 408 Request timeout
by raviprakash sunkara 13 Jun '06

13 Jun '06

hi users, I need to say just "hello to all" I'm working on openser + radius.. Actually in LAN network its working fine... When I deploy the openser + radius in My main server which is in some other place . its successfully login and When I trying to make call its show the log messages as " Called Failed :- 408 Request TimeOut.... " ========================================================================= modparam('registrar","nat_flag',6) modparam("nathelper","natping_interval",30) modparam("nathelper","ping_nated_only",1) modparam("nathelper", "rtpproxy_sock", "unix:/var/run/rtpproxy.sock") #################33 modparam("rr", "enable_full_lr", 1) ############################################### route { # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("13")) { sl_send_reply("483","Too Many Hops........................!"); exit; }; if ( msg:len > max_len ) { sl_send_reply("513", "Message too big"); exit; }; # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if(!method== "REGISTER") { record_route(); }; # loose-route processing if (loose_route()) { # add now 0n 9 setflag(1); acc_rad_request("200 ok "); t_relay(); exit; }; # account completed transactions via syslog if(uri==myself) { if(method=="REGISTER") { if(!radius_www_authorize("192.168.2.55")) { www_challenge("192.168.2.55","0"); exit; }; #consume_credentials(); save("location"); if (m_dump()) { log("MSILO: offline messages dumped - if they were\n"); }else{ log("MSILO: no offline messages dumped\n"); }; exit; }; if(method=="INVITE"|| method=="ACK") { record_route(); acc_rad_request("200"); if(isflagset(6)) { force_rtp_proxy("e"); }; #setflag(1); t_on_reply("1"); }; /* if (method=="BYE") { record_route(); }; */ if (method=="MESSAGE") { log(1, "MESSAGE\n"); setflag(1); /* set for accounting (the same value as in log_flag!) */ }; fix_nat_contact(); if (method=="BYE" || method=="CANCEL") { #log (1, "BYE or CANCEL\n"); #setflag(1); acc_rad_request("200"); #acc_rad_request("Stop"); unforce_rtp_proxy("e"); #setflag(1); }; if(!lookup("location")) { sl_send_reply("404","Woo......... NOt found"); }; }; if(!t_relay()) { sl_reply_error(); }; lookup("aliases"); #setflag(2); exit; } onreply_route[1] { if( isflagset96) && status=~"[0-9][0-9][0-9]") { fix_nat_contact(); force_rtp_proxy("e"); }; } ========================================================================= -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com <b>

2 1

nas table
by Cliff Hayes 13 Jun '06

13 Jun '06

Hello, I am a new user trying to set up FreeRadius on Fedora 5. I purchased a copy of Hassell's Radius book; didn't seem to help much. I was able to get it to work with clients.conf Then, I converted to MySQL. I think I'm supposed to copy the clients into the nas table, so I did that, but the table doesn't appear to be being used. What do I have to do to use the table? Am I supposed to be using the table? Cliff

2 2

sql_log outputs truncated sql-statements
by Hans-Peter Fuchs 13 Jun '06

13 Jun '06

I have updated to freeradius1.1.2 under linux rh as3 and want to use the sql_log module. Most of the lines sql_log outputs are valid sql-statements, but there are also a lot of truncated lines: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm ,NASIPAddress , NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAut hentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProt ocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00045F05', '13b1 c0e611f3176f', 'a2757389', 'NULL', '172.20.24.2', '20205', 'ISDN', '2006-06-13 14:13:28', '0', '0', 'RADIUS', '', '', '0', '0', '276760', '2217882770', '', ' Framed-User', 'PPP', ' ', '0', '0'); UPDATE radacct SET FramedIPAddress = '134.95.88.79', AcctSessionTime = '', Ac ctInputOctets = '', ***** here is something missing **** INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm ,NASIPAddress , NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAut hentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProt ocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('0000E964', 'b622 40b32eb6d15a', 'zhangn(a)uni-koeln.de', 'uni-koeln.de', '195.14.247.90', '0', 'Vi rtual', '2006-06-13 14:13:28', '0', '0', 'RADIUS', '', '', '0', '0', '', '', ' ', 'Framed-User', 'PPP', '134.95.91.102 ', '0', '0'); Configuration of sql_log: sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" # Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '%S', '0', '0', '');" # Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ # '%{Acct-Terminate-Cause}');" # Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" # Start = "INSERT INTO ${acct_table} (AcctSessionId, AcctUniqueId, UserName, \ Realm ,NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, \ AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, \ AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, \ AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', '%{User-Name}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', \ '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', \ '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', \ '%{Framed-IP-Address} ', '%{Acct-Delay-Time}', '0');" Stop = "UPDATE ${acct_table} SET AcctStopTime = '%S', \ AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octet s}', \ AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = \ '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', \ ConnectInfo_stop = '%{Connect-Info}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = '0';" Alive = "UPDATE ${acct_table} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}';" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" } is this a bug or my stupidness? Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RZKR, Zimmer 20 Zentrum fuer angewandte Informatik - Universitaetsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 1

Re: Accounting start/stop packets
by David Mitton 13 Jun '06

13 Jun '06

Typically No. The accounting start packet is generated by most NASes when the authentication is approved. Unless there is a static IP address assigned to the port, it will not wait for the DHCP cycle to complete (which could even fail!). Dave. ----- Original Message ----- From: "John Williams" To: freeradius-users(a)lists.freeradius.org Subject: Accounting start/stop packets Date: Tue, 13 Jun 2006 11:39:26 +0100 Currently the end users IP address is only sent in accounting stop packets. Is there a way to get the start packets to include the IP address also? Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.3/362 - Release Date: 12/06/2006 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Radius Proxying and IP injection
by John Williams 13 Jun '06

13 Jun '06

Hi all We are proxying a realm for a customer that takes ADSL connections from us. Our ADSL connections terminate on a Cisco 7204 over an L2TP tunnel. The proxying seems to be working fine as all requests for the realm are sent to the customers radius server. And our log files show that the authentication was "OK". However the users that are authenticating are being dropped offline as soon as they authenticate. The account logs show the reason as being "User-Request" although the user hasn't requested a disconnect, in fact they aren't connected long enough to do so. The customer is also sending a framed IP address for each user that connects via the users radius users file entry. I'm wondering if this has something to do with the problem, although I can't really see why. The customer is issuing IP addresses from our own RIPE allocation that the Cisco knows about and we announce via BGP to upstreams. I'm trying to get some radius and cisco debugging for these users, but unfortunately everyone has buggered off home and most of the users are offices. So I guess I'm just wondering if there are any gotchas with radius proxying and injecting IP addresses that anyone may have come across. Or does anyone have any ideas what I should be looking for to help fix the problem? Thanks In Advance John

2 8

Re: error: Failed dependencies: libeap-1.1.2.so is needed by freeradius-1.1.2-0.i386
by bt4＠york.ac.uk 13 Jun '06

13 Jun '06

>> On Friday 09 June 2006 17:19, Alberto Cruz wrote: >> These is the output from the commands: >> [root at cdr i386]# rpm -qp --provides freeradius-1.1.2-0.i386.rpm >> config(freeradius) = 1.1.2-0 >> libradius-1.1.2.so >> libradius-1.1.2.so.debug >> radiusd >> rlm_sql_mysql-1.1.2.so >> rlm_sql_mysql-1.1.2.so.debug >> freeradius = 1.1.2-0 > > That is a very short list. There should be lots of rlm_ modules listed, > not just mysql. Look for any warnings/errors when you try to build the > RPM, or specifically the rlm_eap module. My guess is that you're being > hit by the same libtool problem I've run into when trying to build an RPM > on my CentOS 4 box. > > Kevin Bonner Could this be the problem :- if [ "xrlm_eap" != "x" ]; then \ /usr/src/redhat/BUILD/freeradius-1.1.2/libtool --mode=install /usr/src/redhat/BUILD/freeradius-1.1.2/install-sh -c -c \ rlm_eap.la /var/tmp/freeradius-root/usr/lib/rlm_eap.la || exit $?; \ rm -f /var/tmp/freeradius-root/usr/lib/rlm_eap-1.1.2.la; \ ln -s rlm_eap.la /var/tmp/freeradius-root/usr/lib/rlm_eap-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_eap.la' (cd /usr/src/redhat/BUILD/freeradius-1.1.2/src/modules/rlm_eap; /bin/sh /usr/src/redhat/BUILD/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_eap.la -rpath /usr/lib rlm_eap.lo eap.lo mem.lo state.lo rlm_eap.c eap.c mem.c state.c /usr/src/redhat/BUILD/freeradius-1.1.2/src/lib/libradius.la libeap/libeap.la -lltdl -lnsl -lresolv -lpthread) gcc -shared rlm_eap.lo eap.lo mem.lo state.lo -L/usr/src/redhat/BUILD/freeradius-1.1.2/src/lib/.libs -L/usr/lib -lradius -leap -lltdl -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_eap-1.1.2.so -o .libs/rlm_eap-1.1.2.so /usr/bin/ld: cannot find -leap collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap.la' with the above command before installing it libtool: install: warning: remember to run `libtool --finish /usr/lib' gmake[6]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1.2/src/modules/rlm_eap' -- Ben Thompson

1 0

ldap credential caching
by sumi thra 13 Jun '06

13 Jun '06

Hi All, Any body knows how to enable ldap credential caching in freeradius-1.1.1? Does this version of freeradius support this feature? If so, what config change needs to be done? Please do reply me. Thanks, Sumi

1 0

Accounting start/stop packets
by John Williams 13 Jun '06

13 Jun '06

Currently the end users IP address is only sent in accounting stop packets. Is there a way to get the start packets to include the IP address also? Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.3/362 - Release Date: 12/06/2006

1 0