July 2006 - Freeradius-Users - lists.freeradius.org

Problem about execute external program
by Kun Niu 21 Jul '06

21 Jul '06

Dear all, I'm trying to use an external script written by myself. And I insert the following line into my mysql database. INSERT INTO radreply( UserName,Attribute, Value ) VALUES( "123", "Session-Timeout", "%{exec:/path/to/myprogram}" ); And I insert exec into instanciate and authorize section. But the server failed to send the session-timeout to my client. the following is "myprogram" #!/usr/bin/perl -w print "Session-Timeout==1800"; And my exec section is like this: exec { wait = yes inputpairs=request outputpairs=response program="/path/to/myprogram" packet_type=Access-Accept } Have I missed anything? Any help would be appreciated and thanks in advance. Sincerely, Kun

1 0

what is .../log/radius/radacct/NULL
by Rich 21 Jul '06

21 Jul '06

I have a file named NULL in /usr/local/var/log/radius/radacct on one of my FreeRadius servers... that keeps growing and growing... it seems to be a binary equivalent of the csv files I am collecting. Application is VOIP CDR collection. It is an older version of freeradius running in a SCREEN session with 'radiusd -sfx' Problem is I think the NULL file grows until it is too big then the radiusd task crashes. This has happened once just recently. I cannot find anything about it nor how to not use it. I have 2 other FreeRadius servers running, looks like they are configured the same , they are running the same way... but do not have this file showing up... I do not see it mentioned anywhere in docs or config files. I am currently building up an FC5 server with newest rev of freeradius, but am having difficulty porting the sql.conf file. Any clues would help and be appreciated. Thanks, Rich

2 1

Proxy WinXP Computer Account
by Flyswatter 20 Jul '06

20 Jul '06

Hello All, I am having issues proxying requests to IAS when the username is in the format host/MACHINE.domain.com where domain.com is our AD name. WinXP likes to put it in that format when it logs in with the computer account. It will also be proxying for 2 other domains without any trust between them. I have it working with DOMAIN\User, but these machine accounts are baffling me. Does anyone have some pointers? It would be really appreciated! Thanks! -- View this message in context: http://www.nabble.com/Proxy-WinXP-Computer-Account-tf1977488.html#a5425247 Sent from the FreeRadius - User forum at Nabble.com.

1 0

Howto rlm_sqlippool ?
by Michael Kopp 20 Jul '06

20 Jul '06

Hi together, I configured freeradius 1.1.2 with ip-pools. Everything works fine so far. But now I want to use rlm_sqlippool module to change from flat files to mysql database for my ip pools (to achive greater performance, hopefully) So far I have compiled the rlm_sqlippool and the module library files are created and successfully installed (i verfied that the .o and .la files are in the correct folder) in radiusd.conf I uncommented the "include sqlippool.conf" and looked also at this file. But from what I can see it is only I series of SQL statements howto update and grap IP from SQL database. I am missing some description howto setup the database part, how should the database be named, and how should the needed tables look like ? Is there some howto , which explains me what steps I have to take to the rlm_sqlippools up and running ? A howto would be great, or at least some hints how the database and the tables should look like ? Is there a script for initialization ? Do I have to change anything in some other files ? sql.conf ? Regards Michael -- Echte DSL-Flatrate dauerhaft für 0,- Euro*! "Feel free" mit GMX DSL! http://www.gmx.net/de/go/dsl

1 1

mschap machine authentication
by Guillermo Vargas-DellaCasa 20 Jul '06

20 Jul '06

I'm using Free Radius 1.1.2. I wanted to share what I did to get Windows machine authentication (via ntlm_auth) to work properly in my network. After configuring FreeRadius for ntlm_auth against my windows network, I found that not all machines got authenticated. Machines with names longer than 15 characters did not get authenticated. I found out that this is because Windows supplicant send the machine name as "host/quitelongmachinename.company.domain", and the mschap module of FreeRadius strip "quitelongmachinename" and use that when running ntlm_auth (it actually uses "quitelongmachinename$". But, ntlm_auth needs "quitelongmachin$" to work (i.e. only the first 15 chars). So, I went to "src/modules/rlm_mschap/rlm_mschap.c" and changed this line: snprintf(out, outlen, "%s$", user_name->strvalue + 5); with these lines: char largo[20]=""; snprintf(largo, 16, "%s", user_name->strvalue + 5); strcat(largo, "$"); strNcpy(out,largo,17); And recompiled. That got FreeRadius to send to ntlm_auth only the first 15 chars of the machinename when doing machine authentication. I'm not a programmer so probably what's above is not the nicer way to get the idea done, but hey, it worked pretty well. Now machine authentication works no matter how long the machine name is. Thought I would share it... FreeRadius version: 1.1.2 Authentication method: PEAP-MSCHAP Client: Windows XP supplicant Authenticating against: A windows AD domain via ntlm_auth Samba version: 3.0.22 G.

2 1

I'm writing a RADIUS book... who's interested?
by Alan DeKok 20 Jul '06

20 Jul '06

I'm in the process of writing a RADIUS book, with everything I've learned over the last 10 years working with RADIUS. I'm wondering who's interested. :) The goal is to have 200-300 pages of densely packed information. The working title is "Deploying RADIUS: Practices and Principles". My main difficult is that I'm finding it hard to bootstap the book. i.e. time/money. I'm wondering who's interested in buying the book (i.e. is there a market for it). Having a known market means it's much easier for me to find the time to finish it I'm also wondering how many people are interested in buying pre-prints, with additional rights not available to the average buyer. (i.e. internal duplication, etc). This *is* a call for funding. I've been putting a lot of work into the server for many years now, and it just keeps getting bigger and better. With additional funding, I should be able to devote significantly more time to developing those features and documentation that everyone is interested in. Please respond privately with interest, if any. Alan DeKok.

2 2

Radius Authentication
by amr el-saeed 20 Jul '06

20 Jul '06

Dear All, i'm using freeradius 1.1.0 . i'm facing a little problem. in some times my mysql DB server is down & the radius can't insert records into it of-course, so the users can't login as the radius doesn't authenticate them unless he can record them. Is there any solution to make the radius authenticate the users without insert records in the DB. thanks for your help -- regards, Amr el-Saeed

4 4

3com problem with service-type
by Nuno Cervaens 20 Jul '06

20 Jul '06

Hi guys, I have a lot of hp switches and a lot of 3com switches. I have users that I want them to have Administrator privilege and others that will have NAS-Prompt privilege. So, my users files should be like this, so it can work for both brands: userA Password = pass Service-Type = 7, 3Com-User-Access-Level = 1 userB Password = pass Service-Type = 6, 3Com-User-Access-Level = 3 The problem is that 3COM doesnt accept a service-type =7! It only accepts Service-Type = 6! So the 3COM rejects the access-accept from RADIUS for userA. I know that I can use huntgroups and create for each huntgroup a different account for the same user with different attributes, but I dont want to use huntgroups because I already use it for Mac-address authentication (and apparently a same NAS-IP-Address cannot belong to more than 1 huntgroup as RADIUS returns the first huntgroup that matches the NAS-IP-Address). Does anyone has a solution for my problem? Thanks, Nuno

3 3

Accounting on different mysql on different host
by Amendola Maurizio 20 Jul '06

20 Jul '06

Hi we have 2 freeradius ver 1.1.0 server that on different locations. They use mysql servers(one master and one replica(read only) configuration) to download users' attributes. Every radius server point to own local mysql server. I have a probem with radius that point to mysql replica: it can't write accounting info on mysql. Is it possible to configure two different mysql servers on radius so it reads info from one and write accounting info on other? Any idea? Thank you Cheers Mau

2 1

running log_badlogins
by Avrohom 19 Jul '06

19 Jul '06

I have run log_badlogins from the command line and it does work. I was just wondering where the best place to run the script is from. it should always be running so a cron job is not necessary. should i just have it run when the radius server starts up? Thanks, Avrohom

2 1