August 2006 - Freeradius-Users - lists.freeradius.org

Missing Attributes
by Graham Beneke 06 Aug '06

06 Aug '06

I have FreeRadius 1.1 installed on a Ubuntu 6.06 Server Edition. I have integrated it with MySQL and a PHP admin application called phpMyPrepaid It is serving requests for a ChilliSpot daemon at my hotspot. I've added the additional Chillispot dictionary that has attributes for data volume limiting - but it does not appear to be working. I did a test radius request from a little win app called RadiusTest and it appears that the custom attributes are not been sent in the rad-reply packet by the radius server... As this is my first experience with radius - i have no idea where to start looking for where the problem may be. regards Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> WEB: www.apolix.co.za <http://www.apolix.co.za/> Cell: 082-432-1873 <skype:+27824321873?call> Skype: grbeneke <skype:grbeneke?call>

2 3

sqlcounter measuring weird times
by Olivier Cant 06 Aug '06

06 Aug '06

Hi all, I'm new to freeradius configuration, but I have read trough the documentation and ggogled quite a lot about freeradius configuration. I'm using freeradius with chillispot to implement an hourly prepaid card WiFi service. Chillispot talks to the radius server with no problem and accoutning is properly written into the mysql table radacct. The problem is that chillispot says to the user that he can still connect for 4531 hours even when the Max-All-Session attribute for that login says 3600 (the total od the corresponding entries in radacct for AcctSessionTime gives 5056. The user can still connect trough the captive portal. Here is my sqlcounter.conf file : sqlcounter noresetcounter{ counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } noresetcounter and sql are in the authorize section and sql is in the accounting section Has anyone run into this issue ? Thanks a lot, sorry if this is a newbie question Oli

1 0

ntlm_auth with special characters
by Nathan L. Cable 05 Aug '06

05 Aug '06

Hi all, I am trying to set up FreeRadius (1.09.5-1.2, bundled with Redhat FC5) to authenticate off of a Win2k3 server. I have tested the setup, and everything works fine. However, we run quite a large domain, and I would like to restrict access to users in appropriate groups. I can do that if I use the SID for the group, but not if I want to use the regular group name. For example, the following will work when put in the MSCHAP module: ntlm_auth = "/usr/bin/ntlm_auth --require-membership-of=S-1-2-3-4 --request-nt-key --domain=MYDOMAIN.COM --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00)" However, when I use a Windows group, such as the following... ntlm_auth = "/usr/bin/ntlm_auth --require-membership-of='WKGRP/Wireless Users' --request-nt-key --domain=MYDOMAIN.COM --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00)" ...FreeRadius spits out the following error message: utils/ntlm_auth.c:get_require_membership_sid(237) Winbindd lookupname failed to resolve 'WKGRP\Wireless into a SID! What appears to be happening is that when Radius gets to the space in the group name, it jumps to the next argument in the line, disregarding the " Users'" part of the group. I've tried several different variations on escape characters, with no success. Just as further info, I have also been able to successfully run the ntlm_atuh program outside of radius with the offending command, and it works fine. What is the appropriate syntax to use when using long group names in the radiusd.conf file, or will I need to stick to using Windows SID numbers? Thanks for your time (and thought), Nathan Cable

1 0

PHP + radius
by raviprakash sunkara 05 Aug '06

05 Aug '06

Hi Guys.... Happy friend ship day........... ! I'm Working on Linux. box.. I want How to integrate the PHP with RADIUS.... Ccan any one tell the Doccumetation Help me ........! -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

2 1

Re: Regarding adding a module
by Mitchell, Michael J 05 Aug '06

05 Aug '06

Hi Ravi, If you're even remotely proficient in C, you'll find it is not a difficult task to add a new module. Use the "example" module, or one of the other modules (including Makefile) as a basis. Start with an "empty" module that just returns RLM_MODULE_OK from each function, get it to compile and run, then you can start adding your specific functionality. The module definition at the end of the ".c" file defines the functions that are called for initialization and destruction of your module, and for each stage of request processing. Don't forget to change the module name in the module definition, and also in the Makefile. Its easiest to start with a static Makefile, but you can add your module into the auto configure system if required - a little extra configuration is then required in the modules configure files. To get your module to compile when you run make in the top level directory, you can do two things: 1) Add your module name to the "stable" file in src/modules before you run "./configure", or 2) Add your module name to the "MODULES" definition in Make.inc after you've run configure. Once you get your module to compile and install, add its configuration to radiusd.conf and it will be automagically linked into the server at run time. It really is not difficult, so give it a go and you'll soon see what else is required as you reach each stage. If you run into trouble you can ask specific questions on this list. And as always, search the list archives, as chances are other people have come across similar hurdles to what you will encounter. cheers, Mike ------------------------------------------------------------------------ -------- From: freeradius-users-bounces+mitchell.michael=bigpond.com(a)lists.freeradius.o rg [mailto:freeradius-users-bounces+mitchell.michael=bigpond.com@lists.free radius.org] On Behalf Of Ravi S M Sent: Saturday, 5 August 2006 6:25 PM To: freeradius-users(a)lists.freeradius.org Subject: Regarding adding a module Hi I wanted to add our own module for free radius code on Solaris box. So please through some light on this. With best regards Ravi

1 0

programing RADIUS
by darshak＠elitecore.com 05 Aug '06

05 Aug '06

Hi, All I want to learn how to programm a RADIUS protocol.Can anyone help me. I have read the RFC but, how to code it , I ahve no experience in that I just want to know simple programming. Thanxs all. Rgds Darshak

1 0

Regarding adding a module
by Ravi S M 05 Aug '06

05 Aug '06

Hi I wanted to add our own module for free radius code on Solaris box. So please through some light on this. With best regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

change password packet error..
by 나종현 05 Aug '06

05 Aug '06

1 0

Password Problem
by Lawrence Shafer 04 Aug '06

04 Aug '06

I set up FreeRadius/MySQL and ChilliSpot and created a test user with the included DialupAdmin. I then connected to the server radius nic and was directed to the login page and typed my username and password and was rejected. I then went to the DialupAdmin user edit and checked the password and it failed, so I changed the password and the PW check failed again. I even tried a new user and had the same problem. Everything else seems to be working correctly. What could the problem be? Could the password DB be missing in MySQL? How do I check? I'm a noob to all of this (FreeRadius, MySQL) but not to linux. I have it installed on gentoo if that makes any difference. I also tried directly inserting a user into the DB with mysql> INSERT INTO radcheck (UserName, Attribute, Value) VALUES ('lawrence', 'Password', 'le'); Query OK, 1 row affected (0.00 sec) and had the same problem Thanks for your help, Lawrence Shafer

7 14

monitoring freeradius with snmp
by Andy Ford 04 Aug '06

04 Aug '06

Hi, I have a requirement to monitor freeradius with snmp. According to the freeradius web site and other sources I've done the following... 1. compiled freeradius with the '--with-snmp' option 2. modified the freeradius snmp.conf file to include smux_password = verysecret 2. modified the radiusd.conf file with snmp = yes $INCLUDE ${confdir}/snmp.conf 3. modified the net-snmp snmpd.conf file to include smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret 4. started the radiusd and snmpd daemons. When I do an 'snmpwalk -v1 -c public localhost system' I get the 'system' info from the MIB (as expected). When I walk enterprises.3317 I get nothing. I didn't actually expect to get much as I have a huge gap in my knowledge which is the smux. I'm not sure how it works or how I implement it successfully. Has anyone implemented an smux or monitoring freeradius with snmp. If you have, It would be great if you would impart with any knowledge you may have so I can sort this out. Thanks for your time Regards Andy -- perl -e "print qq^bIG VeRN ! ^^qq^#'#Yv#=<D+ ^" This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

3 2