September 2006 - Freeradius-Users - lists.freeradius.org

Re: sqlippool not working
by Guilherme Franco 21 Sep '06

21 Sep '06

Thanks, that's ok now. I removed the block as you said and now it shows the queries. I had added those block earlier because I've seen this configuration from another post as a working sqlippool configuration... Now, if netmask does not exist, nor range-start - range-stop, how can I specify that in radippool? Please remember that I'm using Oracle and it does not have "inet" like postgres, so I've created the tables like this: CREATE TABLE radippool ( id INT PRIMARY KEY, pool_name VARCHAR(30) NOT NULL, framedipaddress VARCHAR(30) NOT NULL, nasipaddress VARCHAR(30) NOT NULL, nas_port INT NOT NULL, calling_station_id VARCHAR(30) NOT NULL, expiry_time timestamp(0) NOT NULL, username VARCHAR(100) ); CREATE INDEX radippool_poolname_ipaadr ON radippool (pool_name, framedipaddress); CREATE INDEX radippool_poolname_expire ON radippool (pool_name, expiry_time); CREATE INDEX radippool_nasipaddr_port ON radippool (nas_ip_address, nas_port); CREATE INDEX radippool_nasipaddr_calling ON radippool (nas_ip_address, calling_station_id); CREATE SEQUENCE radippool_seq START WITH 1 INCREMENT BY 1; CREATE OR REPLACE TRIGGER radippool_serialnumber BEFORE INSERT OR UPDATE OF id ON radippool FOR EACH ROW BEGIN if ( :new.id = 0 or :new.id is null ) then SELECT radippool_seq.nextval into :new.id from dual; end if; END; / How can I use this, please? Sorry for bothering about everything, but everytime I have a question, I first search through the entire freeradius maillist, man pages, docs as well as thoroughly in google. The problem is that usually I don't find much information about those things, so I come back here to ask. Thanks a lot! On 9/20/06, Tuyan Ozipek <tuyan(a)suntel.com.tr> wrote: > On Wed, 2006-09-20 at 14:14 -0300, Guilherme Franco wrote: > > Hello, > > > > Unfortunately, even with freeradius-snapshot-20060920.tar.gz and > > using the ./configure --with-modules="rlm_sqlippool" option, the > > module did not install. > > > > I needed again, to compile it manuallyThe following is in my radiusd.conf: > > > > $INCLUDE ${confdir}/sqlippool.conf > > get rid of this block, since there is no need for > range,netmask,cache-size,override,timeout... > in sqlipoool.. > --------------------------------------------------- > sqlippool foo { > > range-start = 192.168.1.1 > range-stop = 192.168.3.254 > > netmask = 255.255.255.0 > cache-size = 800 > override = no > maximum-timeout = 0 > } > ---------------------------------------------------- > > you are missing the first pools trace in the messages and > all youre seeing is the misconfiguration on the second sqlippool > instance.. > just keep the $INCLUDE directive, and remove the rest.. > there is already an ippool configured in the sqlippool.conf file.. > > > Cheers > > Tuyan > > > > freeradius-snapshot-20060920/src/modules/rlm_sqlippool/ > > > > And then, the same problem persists: > > > > Module: Loaded SQL IP Pool > > sqlippool: sql-instance-name = "sql" > > sqlippool: lease-duration = 86400 > > sqlippool: pool-name = "" > > sqlippool: allocate-begin = "BEGIN" > > sqlippool: allocate-clear = "" > > sqlippool: allocate-find = "" > > sqlippool: allocate-update = "" > > sqlippool: allocate-commit = "COMMIT" > > sqlippool: allocate-rollback = "ROLLBACK" > > sqlippool: start-begin = "BEGIN" > > sqlippool: start-update = "" > > sqlippool: start-commit = "COMMIT" > > sqlippool: start-rollback = "ROLLBACK" > > sqlippool: alive-begin = "BEGIN" > > sqlippool: alive-update = "" > > sqlippool: alive-commit = "COMMIT" > > sqlippool: alive-rollback = "ROLLBACK" > > sqlippool: stop-begin = "BEGIN" > > sqlippool: stop-clear = "" > > sqlippool: stop-commit = "COMMIT" > > sqlippool: stop-rollback = "ROLLBACK" > > sqlippool: on-begin = "BEGIN" > > sqlippool: on-clear = "" > > sqlippool: on-commit = "COMMIT" > > sqlippool: on-rollback = "ROLLBACK" > > sqlippool: off-begin = "BEGIN" > > sqlippool: off-clear = "" > > sqlippool: off-commit = "COMMIT" > > sqlippool: off-rollback = "ROLLBACK" > > rlm_sqlippool: the 'allocate-clear' statement must be set. > > > > The following is in my radiusd.conf: > > > > $INCLUDE ${confdir}/sqlippool.conf > > > > sqlippool foo { > > > > range-start = 192.168.1.1 > > range-stop = 192.168.3.254 > > > > netmask = 255.255.255.0 > > cache-size = 800 > > override = no > > maximum-timeout = 0 > > } > > > > ------------------------ > > > > I didn't modified my sqlippool.conf, so it's the same as > > sqlipool.conf,v 1.3 2006/09/13 12:49:37 pnixon Exp $ > > > > What can it be? > > > > Also, what values should I populate in radippool table? > > > > PS. Some things left: > > IN configure.in (rlm_sql_oracle) > > checking for oci.h... configure: WARNING: PETER XXXXXXXXXXXXXXXX1. > > > > IN oracle-dialup.conf > > # Optional Query - pnixon > > #accounting_stop_query =3D > > > > Another issue: with oracle instant_client_10_2, rlm_sql_oracle would > > not find it's libs, even when the required paths are configured. The > > only way that I managed to install it was copying the whole oracle > > folder to the freeradius server. I know that simply a matter of > > changing the 10.1.0.3 version and something to the new one in > > configure.in of rlm_sql_oracle, but I was in a rush: > > > > # Look for Oracle10g "Instant Client" installed from RPM > > if test "x$ORACLE_INCLUDE" = "x"; then > > old_CFLAGS="$CFLAGS" > > > > AC_MSG_WARN([PETER XXXXXXXXXXXXXXXX1.]) > > FR_LOCATE_DIR(oracle_include_dir,oci.h) > > for try in /usr/include/oracle/10.1.0.3/ > > > > THANK YOU! > > > > > > On 9/20/06, Peter Nixon <listuser(a)peternixon.net> wrote: > > > On Wed 20 Sep 2006 05:49, Guilherme Franco wrote: > > > > I need to thank you again and congratulate you guys for such a great > > > > support. > > > > > > You're welcome. Thanks for helping us make FreeRADIUS better :-) > > > > > > > Question: Even with freeradius-snapshot-20060920.tar.gz I will need to > > > > use ./configure --with-modules="rlm_sqlippool"? > > > > > > Yes. This is because the module is sill considered experimental and is > > > therefore not enabled by default. > > > > > > > If all works well, I assume that in radcheck table, the users need to > > > > have "Pool-Name := test_pool" right? > > > > > > Yes. You need to tell FreeRADIUS which pool (if any) to use for that user. > > > With sqlippool there is effectively no limit on the number of pools you may > > > have configured (Only limit is disk space on your SQL server and IP space on > > > your network) > > > > > > Cheers > > > > > > -- > > > > > > Peter Nixon > > > http://www.peternixon.net/ > > > PGP Key: http://www.peternixon.net/public.asc > > > > > > > > > - > > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > > > > > -- > Tuyan Ozipek <tuyan(a)suntel.com.tr> > >

2 3

setting freeradius + ldap + linux
by R_2_S_1_T_0 20 Sep '06

20 Sep '06

I have install freeradius and linux , but not yet also succeed. user of in windows 2000 ( LDAP ) as which/such ? helping my sending mail is settinganya? thanks

1 0

working rlm_perl example ?
by Michael Gale 20 Sep '06

20 Sep '06

Hello, Does anyone have a working rlm_perl module I can test with ? I have just started out and at this point can not determine if it is my perl module that is having a problem or my radius configuration. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 1

rlm_perl with WinXP MS-CHAP clients ?
by Michael Gale 20 Sep '06

20 Sep '06

Hello, I have a freeradius 1.0.X server setup with ppp and pptp using a mysql DB for user authentication. Here I assign static IP's and users to groups. We wish to use rlm_perl instead of the sql module so we can authenticate the users against a in house application. I have build freeradius 1.1.3 from source and it seems to work however since the client is WinXP and the auth type is MS-CHAP it seems to be calling the mschap section under authentication and then exiting. Here is my debug output: rad_recv: Access-Request packet from host 127.0.0.1:32768, id=51, length=141 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "baduser" MS-CHAP-Challenge = 0x0c09ad640ce7275613b8a0dd51d2f4c6 MS-CHAP2-Response = 0x630065cbdfea16f542fbda8cdc65d7fd30930000000000000000ca32eebf6779cfb34001c39530a93ea7f5aebd54eea79f2b Calling-Station-Id = ".271" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "baduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 perl_pool: item 0x9d5ad20 asigned new request. Handled so far: 1 found interpetator at address 0x9d5ad20 rlm_perl: MG RAD_REQUEST: Service-Type = Framed-User rlm_perl: MG RAD_REQUEST: Calling-Station-Id = .271 rlm_perl: MG RAD_REQUEST: MS-CHAP-Challenge = 0x0c09ad640ce7275613b8a0dd51d2f4c6 rlm_perl: MG RAD_REQUEST: Client-IP-Address = 127.0.0.1 rlm_perl: MG RAD_REQUEST: Framed-Protocol = PPP rlm_perl: MG RAD_REQUEST: User-Name = baduser rlm_perl: MG RAD_REQUEST: MS-CHAP2-Response = 0x630065cbdfea16f542fbda8cdc65d7fd30930000000000000000ca32eebf6779cfb34001c39530a93ea7f5aebd54eea79f2b rlm_perl: MG RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: MG RAD_REQUEST: NAS-Port = 0 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = MS-CHAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9d5ad20 modcall[authorize]: module "perl" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for baduser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [baduser/<no User-Password attribute>] (from client localhost port 0 cli .271) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 51 to 127.0.0.1 port 32768 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 51 with timestamp 451194b6 Nothing to do. Sleeping until we see a request. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 6

Re: sqlippool not working
by Guilherme Franco 20 Sep '06

20 Sep '06

I need to thank you again and congratulate you guys for such a great support. Question: Even with freeradius-snapshot-20060920.tar.gz I will need to use ./configure --with-modules="rlm_sqlippool"? If all works well, I assume that in radcheck table, the users need to have "Pool-Name := test_pool" right? Thanks a lot. On 9/19/06, Peter Nixon <listuser(a)peternixon.net> wrote: > On Wed 20 Sep 2006 01:51, Tuyan Ozipek wrote: > > Hi everybody, > > Sorry for not being able to cc to radius-users list. > > I will be on the list as soon as possible. > > > > > Gentlemen, > > > > > > Thank you very much for lending me your time. > > > > That's ok. Thank you for testing the software... > > > > > I'm downloading freeradius-snapshot-20060919.tar.gz right now. > > > > > > Yes, my allocate-clear is configured exactly as Tuyan's and that's why > > > I stated before that "regardless of my configuration in sqlippool.conf > > > and radiusd.conf" the trace is always empty. > > > > > > For example, if in sqlippool.conf I set sql-instance-name = "foobar", > > > the output of radiusd -X is always: > > > > > > Module: Loaded SQL IP Pool > > > sqlippool: sql-instance-name = "sql" > > > > There should be something wrong with your sqlippool.conf file, are you > > sure you are including the right one from the main radius configuration > > file? All the variables that we see in your trace, are the default > > ones.Basically we are putting them in case there is no value set for > > that variable.. > > For example : If there is no sql-instance-name set in your > > sqlippool.conf file, we set it as "sql" internally. > > > > Please double check your include paths for the sqlippool.conf file. > > Is there any sqlippool { } directives hanging around in your > > radiusd.conf? Maybe a clean install with ./configure --prefix=/xxx/xxx > > can help you to find the config problem as well.. > > My guess is that his problem is caused by the way he built sqlippool: > > > Well, I've tried to install todays freeradius CVS, and it installed > > without the sqlippool module, don't know why. > > So, I've compiled it manually from > > freeradius-snapshot-20060918/src/modules/rlm_sqlippool/ > > If he does a clean install from tonight's cvs I think everything will work as > expected. > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > > >

2 2

Re: IAS and Freeradius
by Artur Hayne 20 Sep '06

20 Sep '06

HI, The freeradius is comunicate with the IAS through a proxy, but dont authenticate. The windows show me this error: "Event type: Error Source: IAS A malformed request was received from client XXXX. The data is the packet." The freeradius debug: modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_realm: Looking up realm "voip.domain.br" for User-Name = "teste(a)voip.domain.br" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user teste to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 3 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for teste(a)voip.domain.br radius_xlat: '(uid=teste(a)voip.domain.br)' radius_xlat: 'ou=users,dc=voip,dc=domain,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,dc=voip,dc=domain,dc=br, with filter (uid=teste(a)voip.domain.br) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 3 modcall: leaving group authorize (returns notfound) for request 3 Sending Access-Request of id 3 to 10.2.1.XY port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Proxy-State = 0x323038 Re-sending Access-Request of id 0 to 10.2.1.XX port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Client-IP-Address = 10.2.1.XX Realm = "DEFAULT" Module-Failure-Message = "rlm_ldap: User not found" Realm = "DEFAULT" Proxy-State = 0x323035 Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.2.1.XX:33634, id=206, length=200 Ignoring duplicate packet from client OpenSER:33634 - ID: 206, due to outstanding proxied request 1. What is worng? I dont undestand: freeradius and IAS use the same protocol... It is attribute question? Cryptografy? Please any Idea... a tip anybody already had some similar experience? I tried in some ways: |Openser| -> |Freeradius| -> |AD| |Openser| -> |Radiusclient| -> |IAS| -> |AD| |Openser| -> |Freeradius| -> |IAS| -> |AD| help! thanks... --------------------------------- O Yahoo! está de cara nova. Venha conferir!

2 1

RE: realtime for freeradius
by Tariq Rashid 20 Sep '06

20 Sep '06

yes - realtime scheduling won't be of too much help for throughput-bound services buy may improve the performance characteristics of latency-bound services, especially in small size transaction services. consider clusters of proxying freeradius - no database backend - these servers merely proxy radius requests onto other servers (possibly other organisations)... would real-time scheduling improve the "jitter" at this layer which sees large numbers of small sized transactions? t -----Original Message----- From: freeradius-users-bounces+tariq.rashid=uk.easynet.net(a)lists.freeradius.or g [mailto:freeradius-users-bounces+tariq.rashid=uk.easynet.net@lists.freer adius.org]On Behalf Of Peter Nixon Sent: 20 September 2006 12:22 To: FreeRadius users mailing list Subject: Re: realtime for freeradius On Wed 20 Sep 2006 14:09, Tariq Rashid wrote: > With modern operating systems we have various server task scheduling > options available to use. > > We can either use OSes modified to provide soft real-time such as versions > of Linux. We can also ask the task schedulers to give certain processes > either higher priority or to give them real-time alike scheduling, as is > possible in Solaris and maybe Linux. > > I wonder of anyone has experimented with observing FreeRadius performance > under load conditions with these options? We shouldn't expect faster > performance, but we may achieve more consistent behaviour - for example a > smaller variance in response times. > > Thoughts and suggestions welcome. Realtime typically is used for Telecom and Telemetry applications. I can't think of any reason why you would need a radius server to run as realtime however... Generally you are in any case waiting on a backend LDAP or SQL database in any case.. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

RE: Conditionally adding reply pair
by Garber, Neal 20 Sep '06

20 Sep '06

> You should be able to do this through the users file: >... > Just change the check and reply items where necessary. > If you don't expect to use the NetSensory huntgroup after > these lines, you may want to add the following after all > users file entries related to the NetSensory huntrgroup. I didn't think of that because LDAP-Group isn't set when files executes. But, I can move files after the ldap module in my authorize section. Then, the LDAP-Group attribute would exist in the check list. Given there will be one LDAP-Group attribute for each group in which the user is a member, will files check all of them and stop when it finds a match? If so, then I can use the users file. Thanks Kevin.

1 0

realtime for freeradius
by Tariq Rashid 20 Sep '06

20 Sep '06

With modern operating systems we have various server task scheduling options available to use. We can either use OSes modified to provide soft real-time such as versions of Linux. We can also ask the task schedulers to give certain processes either higher priority or to give them real-time alike scheduling, as is possible in Solaris and maybe Linux. I wonder of anyone has experimented with observing FreeRadius performance under load conditions with these options? We shouldn't expect faster performance, but we may achieve more consistent behaviour - for example a smaller variance in response times. Thoughts and suggestions welcome. tariq (this applies not just to freeradius but other server tasks too)

2 1

Users file and rlm_sql
by Benoît Bianchi 20 Sep '06

20 Sep '06

Hi, We are currently using freeradius with users file configuration for our Wireless system, authenticating through ldap and rlm_eap which is working fine, but wed like to use a sql database to store login/password for guest accounts. This seems to us the easiest way to manage this because well have to create and delete theses accounts from a web interface. Can we do this with rlm_sql? After lookink at the documentation and googled about this, my feeling is that using rlm_sql will prevent the server to parse the users file, but Id like the users to be parsed first and then if there is no match, the sql database to be queried. Is this possible? Do we have to create all radius tables in the sql server even if we use only the radcheck one? Here is our actual users file which I dont see how to configure with rlm_mysql: DEFAULT hint == "WPA" , FreeRADIUS-Proxied-To == 127.0.0.1, Ldap-Group != "WPA_Allowed", Auth-Type := Reject DEFAULT User-Name := "%{User-Name}" Will putting sql in the authorise section of radius.conf just after file do the trick? Thanks for your help. Benoît.

2 1