May 2007 - Freeradius-Users - lists.freeradius.org

FreeRadius 2.0 proxy question - home_server auth and acct server?
by Brian Walters 16 May '07

16 May '07

With the new 2.0 release do we have to make 2 entries for each home server? 1 for auth packets and 1 for acct packets? -- Brian

3 4

FreeRadius 2.0 Radrelay to multiple servers?
by Brian Walters 16 May '07

16 May '07

Currently I have 3 FR 1.1.3 servers that proxy for a couple of ISP customers. Right now I have radrelay processes point from 1->3, 2->3 and 3->1, 3->2. This allows me to have reasonably matched accounting data on all 3 servers for all my ISP customers while allowing me to load balance my NAS gear across my servers. In the new 2.0 release it appears that we are using the proxy.conf to tell radiusd -n radrelay where to send those packets. Wouldn't I need to set up a separate proxy.conf with a DEFAULT entry in order to send ALL realm acct packets to my two other servers as described above otherwise it would seem the packets would try to forward to the ISP customer again instead of my own servers? How do I get it to send the data to both servers in a server_pool like I did with the old radrelay: 3->1 & 3->2. -- Brian

2 3

Support for MySQL Stored Procedures in FreeRADIUS 2.0?
by Gunther 16 May '07

16 May '07

Will there be support for MySQL Stored Procedures in 2.0? FreeRADIUS 2.0.0-pre1 does not yet support SP in MySQL. Gunther

2 1

HUP stops radiusd
by John Horne 16 May '07

16 May '07

Hello, This is a 'me too' message I'm afraid. From the list archives I saw: ====================================================== > Date: Mon, 02 Apr 2007 20:20:47 +0200 > From: Alan DeKok <aland at deployingradius.com> > Subject: Re: HUP in freeradius-1.1.5 + CVS results in process death. > To: FreeRadius users mailing list > <freeradius-users at lists.freeradius.org> > Message-ID: <4611497F.3000500 at deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: > >> I know theres a bug report for this already, >> but when I HUP the process freeradius doesn't die in the same place. >> > > If it's an issue due to incorrectly free'd memory, the crashes will be > random. > > There may be a fix in 1.1.6, but I'm not sure. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Looks more like a bug in rlm_tls . Dies every time on HUP, deffinatly not random... ====================================================== In our case, using freeradius 1.1.6, if I HUP the radiusd process it crashes/stops. Running 'radiusd -X', the tail part shows: ========================================================= security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Mon May 14 13:38:54 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon May 14 13:38:54 2007 : Error: radiusd.conf[230] Auth-Type PAP already configured - skipping Mon May 14 13:38:54 2007 : Error: radiusd.conf[234] Auth-Type MS-CHAP already configured - skipping Mon May 14 13:38:54 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon May 14 13:38:54 2007 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Mon May 14 13:38:54 2007 : Error: rlm_eap_tls: Error reading certificate file Mon May 14 13:38:54 2007 : Error: rlm_eap: Failed to initialize type tls Mon May 14 13:38:54 2007 : Error: radiusd.conf[1]: eap: Module instantiation failed. Mon May 14 13:38:54 2007 : Error: radiusd.conf[238] Unknown module "eap". Mon May 14 13:38:54 2007 : Error: radiusd.conf[229] Failed to parse authenticate section. ========================================================= This was running radiusd as the root user, running it as our usual non-root user caused the same output. Starting up radiusd normally shows no such error messages, so I'm not sure why it should now complain about the Auth-Type's or the certificate. Using the original radiusd.conf produces the same error messages, with a couple of extras (for the Auth-Types's system and CHAP). Any ideas? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

8 11

Attributes mapping between LDAP and RADIUS
by Jian Wang 16 May '07

16 May '07

Is there an RFC standardizing the attribute mapping between LDAP and RADIUS? Thanks.

2 1

Proxy + LOCAL - Is it possible?
by Apostolos Pantsiopoulos 16 May '07

16 May '07

Hi, I am about to migrate from our old radius based system (VoIP) to a new one (based on freeradius). Is it possible to use the proxy feature so that I can process the requests both locally ( acct=LOCAL, auth=LOCAL) as well as remotely (send them to the old system as well)? I would like to use both systems simultaneously until I am sure that the new one behaves as expected. Regards, -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

2 1

RE: help on radius, how to make password in clear text
by liRyan 16 May '07

16 May '07

Ok, thanks for reminder. [Email] wsly790104(a)hotmail.com; wsly790104(a)yahoo.com; [MSN] wsly790104(a)hotmail.com [YahooMessage]wsly790104> From: stefan.winter(a)restena.lu> To: freeradius-users(a)lists.freeradius.org> Subject: Re: help on radius, how to make password in clear text> Date: Wed, 16 May 2007 07:52:07 +0200> CC: freeradius-devel(a)lists.freeradius.org> > Hi,> > this is for the _users_ list, not developers.> > > But if other client using same radius server authticate with same username> > and pasword, the "User-Password" field is in clear text and all works.> > Could some one look this for me, many thanks. Ryan.> > 1) double-check the shared secret on NAS and FreeRADIUS - if they don't match, > decryption of User-Password results in weird characters> 2) post _useful_ debugs. Of "radiusd -X" as a whole, not just a few lines. > radiusd -X probably even tells you that it suspects a mismatched shared > secret a few lines later.> > Stefan> > -- > Stefan WINTER> > Stiftung RESTENA - Réseau Téléinformat! ique de l'Education Nationale et de > la Recherche> Ingenieur Forschung & Entwicklung> > 6, rue Richard Coudenhove-Kalergi> L-1359 Luxembourg> E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1> http://www.restena.lu Fax: +352 422473 _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

1 0

Re: help on radius, how to make password in clear text
by Stefan Winter 16 May '07

16 May '07

Hi, this is for the _users_ list, not developers. > But if other client using same radius server authticate with same username > and pasword, the "User-Password" field is in clear text and all works. > Could some one look this for me, many thanks. Ryan. 1) double-check the shared secret on NAS and FreeRADIUS - if they don't match, decryption of User-Password results in weird characters 2) post _useful_ debugs. Of "radiusd -X" as a whole, not just a few lines. radiusd -X probably even tells you that it suspects a mismatched shared secret a few lines later. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Server IP changed and "FreeRADIUS+MySQL" does not work
by yao guoxian 15 May '07

15 May '07

I have installed FreeRADIUS and MySQL on the same machine. "FreeRADIUS + MySQL" had worked well before Server IP changed. For some reason the server had to be carried to a new place and its IP must be changed. After the server IP changed, "FreeRADIUS + MySQL" does not work. I have edited sql.conf and changed IP to the new correct IP . I also edited the table "user" in the database "mysql" and altered the Host field from the old IP to the new correct IP. However these mendings do not work. The following is part of the result to the command "radiusd -X": rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@202.117.54.251:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server root@202.117.54.251:radius rlm_sql_mysql: Mysql error 'Access denied for user 'root'@'202.117.54.251' (using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) I have not compile and install FreeRADIUS and just edited the related files. What should I do to make FreeRADIUS and MySQL work well again ? Thanks in advance. Regards Guoxian

4 4

RE: Pool-Name from Called-Station-Id
by Hugh Messenger 15 May '07

15 May '07

Ala DeKok said: > DEFAULT Called-Station-Id =~ "^(\w+_pppoe_\d+)$", Pool-Name := `%{1}` > > \w && \d may not be supported by the regex library on your system. You > may have to use [a-fA-F] etc. explictely. I don't seem to be able to get this to work. This is my DEFAULT entry: DEFAULT Called-Station-Id =~ "^([A-z0-9]+_pppoe_[0-9]+)$", Pool-Name := `%{1}` Framed-IP-Netmask = 255.255.0.0, Fall-Through = 1 ... and it seems to be matching on authentication requests, as per this -X fragment: users: Matched entry DEFAULT at line 162 ... where line 162 is the above DEFAULT. And I've triple checked my regexp using my IDE's RX toolkit. But sqlippool isn't picking up that pattern match as the pool name: rlm_sql_mysql: query: SELECT FramedIPAddress FROM radippool WHERE pool_name = '' AND expiry_time < NOW() ORDER BY pool_name, (UserName <> 'radiustest'), (CallingStationId <> '00:60:B3:45:6A:98'), expiry_time LIMIT 1 FOR UPDATE sqlippool_query1: SQL query did not return any results If I replace the regexp version with a specific one, like ... DEFAULT Called-Station-Id == "brantley_pppoe_141", Pool-Name := "brantley_pppoe_141" ... it all works fine. > > Alan DeKok. -- hugh

1 0