June 2006 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 14, Issue 37
by Gilbert Lo 08 Jun '06

08 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Another RPM build issue with version 1.1.1
by Sandworm 08 Jun '06

08 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello There appears to be a conflict with the Makefiles in the doc directories and the behaviour of RPM. With version 1.1.0, this was OK as they were both consistent, but are not with version 1.1.1. Now when the RPMs are built (on RHEL3 U6), the build bombs out with: RPM build errors: Installed (but unpackaged) file(s) found: /usr/share/doc/freeradius/Acct-Type /usr/share/doc/freeradius/Autz-Type /usr/share/doc/freeradius/CYGWIN /usr/share/doc/freeradius/ChangeLog /usr/share/doc/freeradius/DIFFS /usr/share/doc/freeradius/MACOSX etc... This is because the Makefiles in the doc directories have lines like this: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius whereas version 1.1.0 had lines like: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius- $(RADIUSD_VERSION) RPMs %doc macro, however (AFAIK), uses the version in the path, and the documentation seems to say this too (from http://www.rpm.org/max-rpm-snapshot/s1-rpm-inside-files-list- directives.html, "When the package is installed, RPM creates a directory in the documentation directory named the same as the package (ie, <software>-<version>-<release>)"). This is what I am seeing during the RPM build - a relevant extract: Processing files: freeradius-1.1.1-0 Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.18818 + umask 022 + cd /usr/src/redhat/BUILD + cd freeradius-1.1.1 + DOCDIR=/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.1 + export DOCDIR Incidentally, apart from this, even if the Makefile/RPM conflict were resolved, not all files get copied into the doc directory, I think, and this was true with version 1.1.0 as well. The only files seen there are: ls /usr/share/doc/freeradius-1.1.0 ChangeLog COPYRIGHT INSTALL README todo To get the other files there, it would unfortunately need a more detailed list in the %files section of the SPEC file as shown below: %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL Regards SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQp19gACgkQmw4BJyaatJ3xhgCgsjwbq8mP6XhQpsqSTLCBFena9fUA nAvGkYPRHnlRzCnV+FMt5R6F5lOm =jS3p -----END PGP SIGNATURE-----

4 3

FW: Install - Freeradius can't connect to MySQL
by Cliff Hayes 08 Jun '06

08 Jun '06

Here's even more light: When I start freeradius by just typing radiusd on the command line, it connects to MySQL ok. But if I start it like I'm supposed to: service radiusd start, it doesn't. I'm using Fedora 5 with the latest freeradius.i386, freeradius-unixODBC.i386, and freeradius-mysql.i386. Cliff -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Cliff Hayes Sent: Wednesday, June 07, 2006 4:03 PM To: freeradius-users(a)lists.freeradius.org Subject: FW: Install - Freeradius can't connect to MySQL Hello again, This may shed some light on the situation. When I run in debug mode with -x option, it looks like it may be connecting. Am I interpreting the output correctly? If so, is it normal to connect 5 times? Cliff Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded files Module: Instantiated files (files) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Cliff Hayes Sent: Wednesday, June 07, 2006 2:28 PM To: freeradius-users(a)lists.freeradius.org Subject: Install - Freeradius can't connect to MySQL Hello, Warning - newbie installing Freeradius. I get this in the radius.log even though the sql.conf has the correct host/user/password (and I can access MySQL from the command line using the same login criteria): Wed Jun 7 14:01:52 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Jun 7 14:01:52 2006 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Wed Jun 7 14:01:52 2006 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)' Wed Jun 7 14:01:52 2006 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Jun 7 14:01:52 2006 : Info: Ready to process requests. Thanks, Cliff - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Re: Freeradius-Users Digest, Vol 14, Issue 36
by Gilbert Lo 08 Jun '06

08 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 35
by Gilbert Lo 08 Jun '06

08 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Issues with sessions
by Stelio Gouveia 08 Jun '06

08 Jun '06

Using freeradius 1.0.2 with rlm_sql_postgres, all my users are defined in my DB and all my accounting is stored in this manner too. I have simultaneous-use set to 1. Only 1 user can login at a time! Let me present my case and then i will detail what i think is happening on my radius server. Firstly, my users have a problem when trying to login to my radius. Sometimes it lets then in first time, othertimes they need to try multiple times. So i tested the authentication by using the radtest tool locally with valid users on my system. Radius would respond with the following pattern: Access-Accept, Access-Accept, Access-Reject. (There has been some variations, but generally this pattern occured) When i do get a reject, radius spits out the "You are already logged in message". But i do notice that the reject radius reply from a radtest gives me a strange looking password [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 202 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=202, length=20 [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 206 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=206, length=20 [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 210 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 Re-sending Access-Request of id 210 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "\205t\2673VxL\214\264\255\212Lmu\214\337" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=210, length=20 Heres my # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } *My system works for a bit if i uncomment radutmp. about 30 mins if i have 20+- users active* Alan if you out there please give me some pointers! Regards, the aspiring radman.

1 0

Exec-Program and length of arguments
by Anton Maksimenkov 08 Jun '06

08 Jun '06

Hi. If I add to "users" file this: "bob" Auth-Type := Local, User-Password == "bob" Reply-Message = "Hello, %u", Exec-Program = "/home/engineer/acrad.pl User-Name=%{User-Name} Service-Type=%{Service-Type} Acct-Status-Type=%{Acct-Status-Type} Acct-Session-Id=%{Acct-Session-Id} Framed-Protocol=%{Framed-Protocol} NAS-Identifier=%{NAS-Identifier} NAS-Port-Id=%{NAS-Port-Id}" it work. But I need to pass more arguments to my program, but as far as I can see there is some limit. If I add this: Exec-Program = "/home/engineer/acrad.sh User-Name=%{User-Name} Service-Type=%{Service-Type} Acct-Status-Type=%{Acct-Status-Type} Acct-Session-Id=%{Acct-Session-Id} Framed-Protocol=%{Framed-Protocol} NAS-Identifier=%{NAS-Identifier} NAS-Port-Id=%{NAS-Port-Id} NAS-IP-Address=%{NAS-IP-Address} Calling-Station-Id=%{Calling-Station-Id} Called-Station-Id=%{Called-Station-Id} Framed-IP-Address=%{Framed-IP-Address} Acct-Input-Octets=%{Acct-Input-Octets} Acct-Output-Octets=%{Acct-Output-Octets} Acct-Input-Packets=%{Acct-Input-Packets} Acct-Output-Packets=%{Acct-Output-Packets} Acct-Session-Time=%{Acct-Session-Time} Acct-Terminate-Cause=%{Acct-Terminate-Cause}" # radiusd -sfxxyz -l stdout 2>&1 ... Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" /etc/raddb/users[220]: Parse error (reply) for entry bob: Expected end of line or comma Errors reading /etc/raddb/users radiusd.conf[1047]: files: Module instantiation failed. radiusd.conf[1791] Unknown module "files". radiusd.conf[1727] Failed to parse authorize section. and same with "hints" file. The main goal is that I need to do some accounting by my script. I saw at experimental.conf (at "perl" section), but for now I not understand can I utilize it for my needs somehow. What can I do? -- engineer

2 3

radwatch
by xuxu 08 Jun '06

08 Jun '06

freeradius-users， The radwatch script will restart a radius every 10 seconds ,does it affect the radius running ? 2006-06-08

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 34
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

More information in the post auth?
by Troy Settle 07 Jun '06

07 Jun '06

I'm just about done converting to use freeradius exclusively, but have one more rather daunting task to get done. I need more information for failed logins. What variables are available that will tell me which check item failed and why? For example, if it's the password, how about access to the attempted password? "Chap-Password" doesn't cut it when dealing with most of our customers. We need to be able to see that the password field is blank because Windows XP decided to unsave it, or that they need to spell Jesus with a 'u' and not an 'a.' Any pointers to appropriate documentation would be greatly appreciated. Thanks, -- Troy Settle Pulaski Networks 866.477.5638 http://www.psknet.com

2 1