August 2006 - Freeradius-Users - lists.freeradius.org

Backing up Mysql
by Sarkis Gabriel 10 Dec '06

10 Dec '06

Hi all i started backing up the db using a crontab job early in the morning which backs up everything, but i have had complains from users who try to logon after the backup process. What is the best way to backup an active database with radiusd waiting for connection? Thank you Sarky

6 9

FreeRadius and MySQL boot problem
by Diniz Da Rocha 26 Nov '06

26 Nov '06

HI, I have currently setup FreeRadius 1.0.4 with ldap authentication and authorization as well as mysql authorization and its all working fine. My only problem is that when I boot the server (Fedora Core 4) and radiusd starts up there is a rlm_sql_mysql error: Wed Feb 15 18:38:51 2006 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Wed Feb 15 18:38:51 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius_client@myip:radius Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on 'myip' (13)' Wed Feb 15 18:38:51 2006 : Error: rlm_sql (sql): Failed to connect DB handle #4 The MySQL server is on another server with ip "myip" I initially thought it was a firewall block but even with no firewall I get this error. But once the server has started and I run "service radiusd restart" from a terminal the connect to the MySQL server works fine and has no problems. I even tried running the service from rc.local but it still fails did anyone have this problem??? is anyone running the MySQL server on another machine???? Is there a fix for this??? thanks diniz

5 8

3com wx - peap-mschapv2 - freeradius - mysql
by news.gmane.org 30 Oct '06

30 Oct '06

Hello, I have a wireless network based on wx switch 3com (centrally managed access-point) and I'm trying to activate WPA protection on one ssid "wpa-experimental". I hope to have configured all the component correctly. When I attempt to connect, on radius log (started by radiusd -X) I see: rad_recv: Access-Request packet from host 149.139.32.61:20001, id=118, length=148 NAS-Port-Id = "2/1" Calling-Station-Id = "00-08-E3-B0-73-46" Called-Station-Id = "00-12-A9-17-08-40:wpa-experimental" Service-Type = Framed-User EAP-Message = 0x0201000d0161676f7374696e69 User-Name = "agostini" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = xxx.xxx.xxx.xxx Message-Authenticator = 0x3c8c9588223b33c4a8dafd70db73e334 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 203 modcall[authorize]: module "preprocess" returns ok for request 203 modcall[authorize]: module "chap" returns noop for request 203 modcall[authorize]: module "mschap" returns noop for request 203 rlm_realm: No '@' in User-Name = "agostini", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 203 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 203 radius_xlat: 'agostini' rlm_sql (sql): sql_set_user escaped user --> 'agostini' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 203 users: Matched DEFAULT at 155 modcall[authorize]: module "files" returns ok for request 203 modcall: group authorize returns updated for request 203 rad_check_password: Found Auth-Type EAP rad_check_password: Found Auth-Type Local Warning: Found 2 auth-types on request for user 'agostini' auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [agostini/<no User-Password attribute>] (from client Wx1200-B1D port 0 cli 00-08-E3-B0-73-46) Delaying request 203 for 1 seconds Finished request 203 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 118 to 149.139.32.61:20001 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 203 ID 118 with timestamp 44896cc8 Nothing to do. Sleeping until we see a request. Have you any idea what is wrong? Thank you in advance A Agostini

6 11

Ascend 16 Bit VSAs
by Adam 28 Sep '06

28 Sep '06

Version: freeradius-1.1.3 I need to be able to send Ascend 16 bit VSAs to my NAS. The two that I need to be able to send are: Ascend-LCP-Keepalive-Period and Ascend-LCP-Keepalive-Missed-Limit. In my "/etc/raddb/dictionary" file I have place the following two lines: ATTRIBUTE Ascend-LCP-Keepalive-Period 321 integer Ascend ATTRIBUTE Ascend-LCP-Keepalive-Missed-Limit 322 integer Ascend When I start Radius I get the following errors: ... read_config_files: reading dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary[34]: dict_addattr: ATTRIBUTE has invalid number (larger than 255). Is there support for 16 bit Ascend VSAs? If so how do I enable and use them? Thanks Adam

2 3

assigning vlan based on LDAP attribute
by Matt Ashfield 27 Sep '06

27 Sep '06

Hi All, I'm trying to add a user to a vlan based on an ldap attribute. I've checked out: http://vuksan.com/linux/dot1x/802-1x-LDAP.html annd saw the following would have to be added to the user's ldap record: radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 If I don't want to actually insert that into the LDAP database, is it possible for Radius to figure out which vlan to assign to based on some other already existing LDAP attribute? For example, if I want to assign users whose userDepartment attribute equals ITS into vlan 3 and those who's userDepartment attribute equals HR into vlan 4? If so, could you give me a link to how to do that, or explain briefly? Thanks for your time, Matt mda(a)unb.ca

3 9

rlm_perl and accounting
by Justin Church 25 Sep '06

25 Sep '06

I'm running freeradius v. 1.1.0 and am trying to use rlm_perl to rewrite accounting attributes before they are written to log with detail and then replicated with radrelay. Here is the version of example.pl that I'm using (I've only added a single statement to the preacct function): use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { # For debugging purposes only # &log_request_attributes; # Here's where your authorization code comes # You can call another function from here: &test_call; return RLM_MODULE_OK; } # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } # Function to handle preacct sub preacct { # For debugging purposes only #&log_request_attributes; $RAD_REPLY{'Acct-Session-Id'} = "new-session-value"; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { # For debugging purposes only # &log_request_attributes; # You can call another subroutine from here #&test_call; return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle pre_proxy sub pre_proxy { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_proxy sub post_proxy { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_auth sub post_auth { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only # &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only # &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } Here's the output of freeradius -X: root@black-pearl:/etc/freeradius# freeradius -X ... Module: Loaded perl perl: module = "/home/jcc/scripts/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" perl: max_clones = 32 perl: start_clones = 5 perl: min_spare_clones = 3 perl: max_spare_clones = 3 perl: cleanup_delay = 5 perl: max_request_per_clone = 0 Module: Instantiated perl (perl) ... Here's my radiusd.conf: ... modules { perl { module = /home/jcc/scripts/example.pl max_clones = 32 start_clones = 5 min_spare_clones = 3 max_spare_clones = 3 cleanup_delay = 5 max_request_per_clone = 0 } } ... preacct { preprocess acct_unique perl suffix files } accounting { local-detail radrelay-detail unix radutmp } ... Notice from my example.pl that I'm trying to rewrite the value for Acct-Session-Id. The freeradius -X output shows that I've added a new pair, Acct-Session-Id = new-session-value, but only the original value shows up in the radacct log, not the new value: rad_recv: Accounting-Request packet from host 127.0.0.1:32819, id=89, length=65 User-Name = "jcc" NAS-Port = 1 Acct-Session-Id = "accounting-session-1" Sip-Transport-Protocol = TCP Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "accounting-session-1",User-Name = "jcc"' rlm_acct_unique: Acct-Unique-Session-ID = "4f08f8eb92e050ff". modcall[preacct]: module "acct_unique" returns ok for request 0 perl_pool: item 0x8168260 asigned new request. Handled so far: 1 found interpetator at address 0x8168260 rlm_perl: Added pair Acct-Session-Id = new-session-value perl_pool total/active/spare [5/0/5] Could not get @DynaLoader::dl_librefs for unloading. Unreserve perl at address 0x8168260 modcall[preacct]: module "perl" returns ok for request 0 rlm_realm: No '@' in User-Name = "jcc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/detail-20060822' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20060822 modcall[accounting]: module "local-detail" returns ok for request 0 radius_xlat: '/var/log/freeradius/radacct/radrelay-detail' rlm_detail: /var/log/freeradius/radacct/radrelay-detail expands to /var/log/freeradius/radacct/radrelay-detail rlm_detail: Acquired filelock, tried 1 time(s) rlm_detail: Released filelock modcall[accounting]: module "radrelay-detail" returns ok for request 0 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 0 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 89 to 127.0.0.1 port 32819 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 89 with timestamp 44eb308c Nothing to do. Sleeping until we see a request. radrelay-detail log: Tue Aug 22 12:27:56 2006 User-Name = "jcc" NAS-Port = 1 Acct-Session-Id = "accounting-session-1" Sip-Transport-Protocol = TCP NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "4f08f8eb92e050ff" Timestamp = 1156264076 What am I missing? Thanks. -jc

9 37

Freeradius + OpenLDAP - user password problem
by Stuckzor 25 Sep '06

25 Sep '06

Hello, as you can see, i must be pretty desperate to register somewhere so i can ask for help. Anyway, the situation is: i recently set up a freeradius server with openldap for auth., everything seemed to work great (radtest returns access-accept ), until i tried to login via notebook and Linksys router (with dd-wrt firmware). Linksys is properly configured, i believe. On laptop i have chosen WPA 2 security using ms-chap, and when i try to connect, access-request packet doesn't contain attribute user-password! I am really stuck here, have no idea what to do so any help would be really apprechiated. If you need additional info i will be glad to asisst (e.g. post debug output or something). -- View this message in context: http://www.nabble.com/Freeradius-%2B-OpenLDAP---user-password-problem-tf201… Sent from the FreeRadius - User forum at Nabble.com.

9 47

freeRADIUS doc
by Carlo Prestopino 14 Sep '06

14 Sep '06

Hi all, I'm trying to access freeRaDIUS doc section (http://www.freeradius.org/radiusd/doc/) but I got a "Forbidden" access message. Is this section accessible to normal users? Best regards, Carlo

4 3

Re: Help to modify the reply list for accounting response packets.
by V.Kukushkin 05 Sep '06

05 Sep '06

You have to modify src/modules/rlm_sql/conf.h src/modules/rlm_sql/rlm_sql.c src/modules/rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c /etc/raddb/sql.conf .. and forget about RFC :-) -- regards, Vladimir

2 1

Interface binding problem
by Marcel.De_Boer＠alcatel.be 04 Sep '06

04 Sep '06

Hello, I'm trying to setup FreeRADIUS in a testing setup where the IP address to which it binds needs to be set. The RADIUS server is loaded on-demand on a number of machines, where almost all configuration is the same, except for the IP address to which it needs to listen. Normally this would be setup in the configuration file, but this means that either I can't have a centralized configuration file (which makes things very complicated, as I'm trying to provide a standard service in an experimental environment), or the configuration file needs to be changed before every FreeRADIUS startup, which also is very inconvenient. I'd like to set it up with the commandline switch (-i <ip-addr>), but this does not seem to work (tested on versions 0.2, 1.0.1 and 1.2): the server only takes the address from the configuration file and completely ignores the commandline switch. I do realise that the commandline switch is deprecated, but is it possible to get this to work somehow? Kind regards, Marcel de Boer

5 6