September 2006 - Freeradius-Users - lists.freeradius.org

Radrelay - Duplicate records...
by Etienne Pretorius 28 Sep '06

28 Sep '06

Hello List, I would like to know if it is possible to setup FreeRAIUS not to log accounting info from a specific server to the detail file and still log the accounting info into the local mysql database. Some background on the subject: I have recently taken over the maintenance of a couple of FreeRADIUS servers. I'll be frank, I am not an experienced FreeRADIUS admin, so my first priority was to get the accounting information synced at all times between our servers. After some searching I found a couple of documents and posts about radrelay and I have proceeded to set it up on the servers hoping to achieve a two-way accounting replication service. +-----------+ +-----------+ | Primary | <===================== | Secondary | | RADIUS | =====================> | RADIUS | +-----------+ +-----------+ As the documentation is quite brief - I assume everything is working fine. I kept my eye on the logs and started to see the following appearing. Wed Sep 27 17:37:45 2006 : Info: rlm_radutmp: Login entry for NAS <1> port 1090715896 duplicate Wed Sep 27 17:37:46 2006 : Info: rlm_radutmp: Login entry for NAS <1> port 1090716313 duplicate (Also please note that I am aware of record duplication coming from my upstream provider's RADIUS proxy) When I killed radrelay on the Secondary then everything was OK except I now only have a one-way replication happening. Looking at the sql tables showed that there are about double the amount of records on the primary then on the secondary for that time period. As I have little experience on configuring FreeRadius (We all have to start somewhere), I would greatly appreciate the any help or comments about the subject at hand. Thank you. Etienne Pretorius

1 1

'-' Character in Group
by William A. Peroche 28 Sep '06

28 Sep '06

When I use '-' character as Group name, the authentication fails. For example 1. Group Name: -A Result : Aunthentication Fails 2. Group Name: A- Result : Authentication Successful What are the valid character and what is the explanation regarding this? Thank you very much. --------------------------------- Try the new Yahoo! Philippines Front Page!

2 1

Ascend 16 Bit VSAs
by Adam 28 Sep '06

28 Sep '06

Version: freeradius-1.1.3 I need to be able to send Ascend 16 bit VSAs to my NAS. The two that I need to be able to send are: Ascend-LCP-Keepalive-Period and Ascend-LCP-Keepalive-Missed-Limit. In my "/etc/raddb/dictionary" file I have place the following two lines: ATTRIBUTE Ascend-LCP-Keepalive-Period 321 integer Ascend ATTRIBUTE Ascend-LCP-Keepalive-Missed-Limit 322 integer Ascend When I start Radius I get the following errors: ... read_config_files: reading dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary[34]: dict_addattr: ATTRIBUTE has invalid number (larger than 255). Is there support for 16 bit Ascend VSAs? If so how do I enable and use them? Thanks Adam

2 3

Using pam_radius_auth.o, why call pam_sm_chauthtok twice??
by 나종현 28 Sep '06

28 Sep '06

1 0

CRITICAL! NFS/ SQLIPPOOL :~(
by Guilherme Franco 27 Sep '06

27 Sep '06

Hello, I'm in a situation where I have 2 freeradius servers, working perfectly with rlm_sql_oracle (the entire AAA is done in Oracle, except the ippool). It's not possible to have the same pool configured the same way in the 2 servers, and also It's totally out of question to configure range1 for radius1 and range2 for radius2. I can't create the pool in the BRAS because of a limitation of itself. So, another option would be NFS with db files for the ippool module (which does not work also because of file locks). The only option that I see is to use SQLIPPOOL, which is not working for me in Oracle. I''ve modified sqlippool.conf to suit Oracle's needs and even removed the 'BEGIN' section from rlm_sqlippool.c and recompiled it (because oracle does not need BEGIN and it was causing me more problems). Even then, I'm still not able to use sqlippool! If sqlippool in oracle does not work, the only option left would be install postgre in the same machine as oracle (horrible!). This is the output (without BEGIN): ------------------------------------------------------------------------------ rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: '' sqlippool_command: xlat failed. UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414557' SELECT framedipaddress FROM radippool WHERE pool_name = 'POOL' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#157'), expiry_time FOR UPDATE sqlippool_query1: SQL query did not succeed rlm_sqlippool: ip=[] len=0 radius_xlat: 'COMMIT' COMMIT rlm_sqlippool: IP number could not be allocated. rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test_user' rlm_sql (sql): sql_set_user escaped user --> 'test_user' ------------------------------------------------------------------------------ The first sqlippool_command: xlat failed. is because I removed the begin in rlm_sqlippool.c... This is the output (with BEGIN): ------------------------------------------------------------------------------ rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' BEGIN rlm_sql_oracle: execute query failed in sql_query: ORA-06550: line 1, column 5: PLS-00103: Encountered the symbol "end-of-file" when expecting one of the following: begin case declare exit for goto if loop mod null pragma raise return select update while with <an identifier> <a double-quoted delimited-identifier> <a bind variable> << close current delete fetch lock insert open rollback savepoint set sql execute commit forall merge pipe rlm_sql_oracle: OCI_SERVER_NORMAL sqlippool_command: database query error UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414558' SELECT framedipaddress FROM radippool WHERE pool_name = 'POOL' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#158'), expiry_time FOR UPDATE sqlippool_query1: SQL query did not succeed rlm_sqlippool: ip=[] len=0 radius_xlat: 'COMMIT' COMMIT rlm_sqlippool: IP number could not be allocated. rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test_user' rlm_sql (sql): sql_set_user escaped user --> 'test_user' ------------------------------------------------------------------------------ Can anybody help me, please?

1 0

How to deny user with changed username when using EAP-TLS
by Marcos González 27 Sep '06

27 Sep '06

Hello, my name is Marcos and I'm developing an access control solution using FreeRADIUS+MySQL+Web frontend. I use check attributes in table 'radusercheck ' to allow or deny access on a per user basis. The problem is, if an user changes his 'UserName' in his wireless network adapter configuration, then there's no match in the table, and he enters the network bypassing my solution. There's an option in sql.conf that allows defining a DEFAULT profile, and also assigning it to non known users. But it's parsed after the normal check, so if I define an 'Auth-Type := Reject', both are denied, known and unknown users. Is there any way to allow known users (those whose UserName appears in radcheck) access, but deny unknown (all other) users? Thank you in advance.

2 1

assigning vlan based on LDAP attribute
by Matt Ashfield 27 Sep '06

27 Sep '06

Hi All, I'm trying to add a user to a vlan based on an ldap attribute. I've checked out: http://vuksan.com/linux/dot1x/802-1x-LDAP.html annd saw the following would have to be added to the user's ldap record: radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 2 If I don't want to actually insert that into the LDAP database, is it possible for Radius to figure out which vlan to assign to based on some other already existing LDAP attribute? For example, if I want to assign users whose userDepartment attribute equals ITS into vlan 3 and those who's userDepartment attribute equals HR into vlan 4? If so, could you give me a link to how to do that, or explain briefly? Thanks for your time, Matt mda(a)unb.ca

3 9

RADIUS + MySQL + decisionmaking?
by Jan Mulders 27 Sep '06

27 Sep '06

Hello, I am trying to set up some decision-making logic into FreeRADIUS, to assign users a different speed of service depending on how much bandwidth they've used since their billing started. I want to issue 512k speed to users in group A, who have used less than 20GB of bandwidth (monthlybytecounter is working fine at the moment and totals this up nicely). However, if they've used more than 20GB, I want to issue 256k speed to users. For group B, I want users to get 10Mbps as long as they've used less than 50GB of bandwidth, and 1Mbps if they're over. I want to assign the values for speed to some vendor-specific variable, let's say Max-User-Speed. I am using MySQL for this. Here is a snippet from my database: radcheck table: username, attribute, op, value testuser1, Password, ==, testing usergroup table: username, groupname testuser1, groupa Here is a snippet from my radiusd.conf file: instantiate { monthlybytecounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess } accounting { #acct_unique #detail sql radutmp # ? } session { radutmp # ? sql } My question is... how do I implement this? Can anyone write down a few examples of how I'd go about making these rules? Would I perhaps be better off making a cronjob or something that changes the user's group to one of the following? groupA_belowcap, groupA_overcap, groupB_belowcap, groupB_overcap? Regards, Jan Mulders

2 2

ULTRA IMPORTANT! Proxy - Assertion failed in listen.c, line 558 error
by Guilherme Franco 27 Sep '06

27 Sep '06

HI, Please, this is a very important problem that is affecting thousands of customers of mine: I have 2 realms for send proxy requests (foo.com and bar.net) If the proxy server foo.com goes down (for whatever reason) this happens: rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 User-Name = "user(a)foo.com" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 rlm_realm: Looking up realm "foo.com" for User-Name = "user(a)foo.com" rlm_realm: Found realm "foo.com" rlm_realm: Proxying request from user user to realm foo.com rlm_realm: Adding Realm = "foo.com" rlm_realm: Preparing to proxy authentication request to realm "foo.com" rlm_eap: No EAP-Message, not doing EAP modcall: group authorize returns noop for request 20 Sending Access-Request of id 16 to foo.com port 1645 User-Name = "user(a)foo.com" User-Password = "password" NAS-IP-Address = 192.168.1.1 Proxy-State = 0x3231 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 Sending duplicate proxied request to home server foo.com port 1645 - ID: 16 Assertion failed in listen.c, line 558 Aborted Then my radiusd dies and I need to bring it up again. This is incredibly critical because if domain foo.com dies, my freeradius server dies too, and in consequence, I can't proxy requests to bar.net (which have more than 21.000,00 users!) Thanks!

3 7

syslog.conf
by sean＠swarmhotspots.com 27 Sep '06

27 Sep '06

Hi, I've been running a trouble free Radius server for over a year. Last weekend a local power company substation went on fire. This resulted in a massive power surge and a major system crash. Since then Radius has been validating users from MySQL no problem. However it is not updating its log files or radacct in the database. After a lot of searching I discovered that the Linux (Mandriva 2006) syslog.conf was corrupted. I've created a new syslog and reinstalled Radius version 1.0.5. The problem has persisted. I reckon I must be missing something in the log config. Any advice or help would be very much appreciated. Two nights now with no sleep. Regards and thanks in advance. Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0