September 2006 - Freeradius-Users - lists.freeradius.org

Show Groups in dialup_admin
by Evert 27 Sep '06

27 Sep '06

Hi all! This question has been asked (but not answered?) before: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11278.… I do the following: * click on 'Show Groups' * click on a group * select a member of the group * click on 'Administer selected user' I am then supposed to get the user info on that specific user. Instead the group administration page reloads... How do I make it so that I actually get the selected user info page? Greetings, Evert

2 2

Accounting issues in Oracle solved
by Guilherme Franco 27 Sep '06

27 Sep '06

Hello, I had to modify oracle-dialup.conf to make accounting on/off to work. In AcctSessionTime, the original query would generate "expected NUMBER, got INTERVAL" error. Here is the original: accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime=TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), AcctSessionTime=((TO_DATE('%S','yyyy-mm-dd hh24:mi:ss') - AcctStartTime)*86400), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time:-0} WHERE AcctSessionTime=0 AND AcctStopTime IS NULL AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStartTime <= TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')" So I modified it to: accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime=TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), AcctSessionTime=(to_number(TO_DATE('%S','yyyy-mm-dd hh24:mi:ss') - cast(AcctStartTime as date))*86400), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time:-0} WHERE AcctSessionTime=0 AND AcctStopTime IS NULL AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStartTime <= TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')" And it works great now.

1 0

Source IP address for proxy requests
by Angel L. Mateo 27 Sep '06

27 Sep '06

Hello, I have a cluster of two servers running freeradius (the cluster is monitored by heartbeat). Each of the two members of the cluster has its own IP address (192.168.1.2 and 192.168.1.3) and one of the (the active member) has the IP address in which it runs freeradius (192.168.1.1), so freeradius only listen in this address, not in the owned by the server. Freeradius is working fine with this configuration, except the proxy module. The problema I have is that proxy requests are originated with the IP address of the member, not the IP of the cluster. And I haven't found any configuration option to configure this. Is there any way to do it? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

7 18

Autoreply: Reid Canavan is out of the office.
by Reid Canavan 27 Sep '06

27 Sep '06

I will be out of the office starting 09/27/2006 and will not return until 09/28/2006. I will respond to your message when I return.

1 0

mod_auth_radius-2.0
by William 26 Sep '06

26 Sep '06

Greetings, I am having some probles with mod_auth_radius-2.0 on apache 2.0.54. The error I am receiving is: Cannot load /usr/local/apache/modules/mod_auth_radius-2.0.so into server: /usr/local/apache/modules/mod_auth_radius-2.0.so: undefined symbol: ap_snprintf I am running on suse 10.1-x86_64 and apache is compiled from source. Any suggestions? Help? -- William Server Administrator NetOne Communications, Inc. 231-734-2917

2 1

Prefixing Topics with Mailing list name
by Graham Beneke 26 Sep '06

26 Sep '06

Hi Guys Something thats been bugging me about this list for a while is the fact that the post subjects have no indication which mailing list they are from. All the other mailing lists I'm on prefix subjects with something like "[freeradius]" but since this list (as well as freeradius-devel) don't do this it makes it quite difficult to figure out what is going on in my inbox. Could we get this changed? regards -- Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> Cell: 082-432-1873 <callto://+27824321873> Skype: grbeneke <callto://grbeneke> WEB: www.apolix.co.za <http://www.apolix.co.za/>

5 5

RE: Hiding Passwords in Debug Output
by Garber, Neal 26 Sep '06

26 Sep '06

> Insulting me because I disagree with you pretty much guarantees that > I will never agree with you. Please accept my apology as it was not my intent to offend or insult you.

1 0

RE: Hiding Passwords in Debug Output
by Garber, Neal 26 Sep '06

26 Sep '06

> The administrator has access to ALL secret information by simple > fact that he's an administrator. He can run tcpdump, and manually > decrypt the passwords. So hiding the password on the server is > pointless, and a waste of time. I realize that. I wasn't trying to *prevent* the admin. from getting the password if they felt they needed it (as if the admin. couldn't be trusted). Rather, I believe most of the time admins don't need to see it so why not have the *option* to suppress it since it's considered sensitive information. Displaying it increases the risk that others could see it and/or that an admin. would redirect debug output to disk because: they forgot it included sensitive information, they don't understand the risk, they're troubleshooting an intermittent problem and they need to save the output for later analysis, or because they normally redirect output of the server to disk just in case they need to troubleshoot a problem. Once it's on disk, it's the same issue that caused the eventual change to the detail module. > And that's the crux of the problem. The server is used by people > other than you, who DO need access to that information. That's unfair Alan. I was not trying to *dictate* that other admins shouldn't see it - I was proposing that admins should have a choice - because, IMO it's not needed to troubleshoot most problems. > Why not simply run the shell script I presented? I could and it would do most of what I wanted. However, it feels like a kludge and everyone on my team would need to remember to filter the output when running in debug mode. I just think it's safer (from the perspective of admins that don't want/need to see the passwords) to have a config. option that forces the suppression. With the config. option, you can change the server to run in debug mode without having to remember to pipe the output to sed (or to run a special script that pipes the output to sed). I've tried to articulate my point of view and why I see value in having this option. I've asked questions in an attempt to understand your point-of-view and you didn't answer them. I feel either I failed to explain myself clearly or you made up your mind from the start and aren't interested in hearing contrary opinions. Perhaps our difference is a matter of perspective, level of paranoia and the business environment in which the server is operating. In any case, it's not worth arguing about. After all, FreeRadius is open source so, if my team feels strongly enough about it, we can make the change and maintain it locally.

2 1

Apologies for Mr. Peter Nixon and updated sqlippool debug
by Guilherme Franco 26 Sep '06

26 Sep '06

Mr. Nixon, Please accept my humble apologies for the earlier spam. I would like to test your experimental module sqlippool in Oracle and in return, contribute somehow with my working configs and tables to the CVS. I understand that you are a busy man, so please excuse me if I did bother you. This question is not directed only to you but I'm asking it because module rlm_sqlippool have pnixon ownership. Please correct me with I'm wrong. With all the help from yours and everyone from freeradius-user-list, I've managed to make some progress with the sqlippool in Oracle, with just one error left. I'm not a SQL newbie, but I'm struggling to debug that error because I can't see the originating query as it is apparently mounted on the fly in lib/rlm_sqlippool* objects. I have C knowledge but didn't discovered what might be causing the error in rlm_sqlippool.c. Currently, I'm using freeradius-snapshot-20060925. I've compiled it with --enable-developer and ran radiusd -X through gdb. The error happens even when I'm using the default v1.4 of sqlippool.conf, without modifying it: ---------------------------------------------------------- Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' BEGIN rlm_sql_oracle: execute query failed in sql_query: ORA-06550: line 1, column 5: PLS-00103: Encountered the symbol "end-of-file" when expecting one of the following: begin case declare exit for goto if loop mod null pragma raise return select update while with <an identifier> <a double-quoted delimited-identifier> <a bind variable> << close current delete fetch lock insert open rollback savepoint set sql execute commit forall merge pipe rlm_sql_oracle: OCI_SERVER_NORMAL sqlippool_command: database query error ----------------------------------------------------------- Next is an output of Oracle's compatible version of sqlippool.conf that I've made. It works, but the IP from the sql pool does not get allocated because of the previous error: ----------------------------------------------------------- UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '2398432' SELECT framedipaddress FROM radippool WHERE pool_name = 'FOO' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> ''), expiry_time FOR UPDATE sqlippool_query1: SQL query did not succeed rlm_sqlippool: ip=[ ] len=0 radius_xlat: 'COMMIT' COMMIT rlm_sqlippool: IP number could not be allocated. rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test_user2' rlm_sql (sql): sql_set_user escaped user --> 'test_user2' modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 44 to 172.16.4.1 port 2243 Finished request 0 ----------------------------------------------------------- The question is: What is the complete BEGIN query? so I can debug the cause of the error through sqlplus. PS. gdb debug info: (gdb) info threads * 1 Thread 182896320192 (LWP 12546) 0x00000039718bf8f5 in __select_nocancel () from /lib64/tls/libc.so.6 (gdb) thread apply all bt full Thread 1 (Thread 182896320192 (LWP 12546)): #0 0x00000039718bf8f5 in __select_nocancel () from /lib64/tls/libc.so.6 No symbol table info available. #1 0x0000000000413271 in main (argc=Variable "argc" is not available. ) at radiusd.c:596 tv = {tv_sec = 1, tv_usec = 625000} request = (REQUEST *) 0x74f160 buffer = "* port 1814", '\0' <repeats 45 times>, "pôÿ¿\177\000\000\000àôÿ¿\177\000\000\000\021y\000s9\000\000\000`m\023s9\000\000\000pòÿ¿\177\000\000\000@(c)g\225*\000\000\000Ý\226`q9", '\0' <repeats 11 times>, "\ay\000s9\000\000\000\021y\000s9\000\000\000\t\000\000\000\000\000\000\000àôÿ¿\177\000\000\000ú\232`q9\000\000\0000/x\225*\000\000\000à3x\225*\000\000\000\2008x\225*\000\000\000(=x\225*\000\000\000\000ðU\225*\000\000\000P*x\225*\000\000\000ØAx\225*\000\000\000¨$x\225*", '\0' <repeats 11 times>, "`m\023s9"... readfds = {fds_bits = {448, 0 <repeats 15 times>}} argval = Variable "argval" is not available. Thank you very much.

3 7

proxy.conf
by srg krn 26 Sep '06

26 Sep '06

Hello: I have a freeradius proxy working fine with one realm (radgroup) defined in proxy.conf. If it receives a query for user@radgroup if "sends" to another radius server striping the "@radgroup" from username and all is OK. Now, I need that if a query for "user2@ldapgroup" arrives, then freeradius will send it to an ldap server. It is possible to configure a realm with "type=ldap" or something like this? Thanks and best regards

2 1