January 2008 - Freeradius-Users - lists.freeradius.org

dialup-admin sql table creation error
by rgreiner 20 Jan '08

20 Jan '08

I was making some tests with the freeradius 2 install, and found that the creation schema for the "badusers" table for dialupadmin (in the /dialup_admin/sql/mysql folder) has 2 problems: # # Table structure for table 'badusers' # CREATE TABLE badusers ( id int(10) DEFAULT '0' NOT NULL auto_increment, UserName varchar(30), IncidentDate datetime DEFAULT '0000-00-00 00:00:00' NOT NULL, Reason varchar(200), Admin varchar(30) DEFAULT '-', PRIMARY KEY (id), KEY UserName (UserName), KEY Date (Date) ); The first is in the 'id' creation line. Starting with version 4.11 (I think its this version), MySQL does not accept having a default value when you use auto_increment. So, "id int(10) NOT NULL auto_increment" would be the correct entry. The second problem is in the last line. There is a reference to 'Date' beeing used as key, but the 'Date' was not created. There is no reference creating it. Checking version 1.1.7, the line was " Date datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,". Now, was it removed because it's no longer used, or was it removed by accident, ir should it be renamed to the "IncidentDate" field? I guess it would be the last option.... Thanks, Roberto -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

3 2

rlm_perl build on mac osx
by Info 19 Jan '08

19 Jan '08

Greetings, Quick disclaimer: Though I've been working on my unix chops for the last year (intermittently), I still consider myself a bit of a newbie, so I apologize for any questions that might have obvious answers. That said: I'm working on a port of FR 2.0 for macports.org and had a couple questions about what appears to be the main stumbling block when building it on the mac (both ppc and intel, in this case under osx 10.4.11). The problem, as those familiar with installing this on the mac, has to do with linking to the apple build of perl under /System/ Library... Bug #471 shows this, and an example of my initial attempts showed much the same: ... (cd .libs && rm -f rlm_perl.so && ln -s rlm_perl-2.0.0.so rlm_perl.so) ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.6/darwin-thread- multi-2level/auto/DynaLoader/DynaLoader.a rlm_perl.o /System/Library/ Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (7) cpusubtype (3) is not an object file (bad magic number) ar: internal ranlib command failed gmake[6]: *** [rlm_perl.la] Error 1 ... Mind you, I've found a way to get past this by simply installing my own build of perl (5.8.8). Regardless, I have these questions: 1] Is it at all possible for rlm_perl to build against apple's install of perl? 2] Is perl only a build dependency for rlm_perl, or does the module make runtime calls to external perl libs? 3] I've discovered with an install of perl 5.10 that, during configure (of freeradius 2), the linker chooses the /System/Library/ 5.8.6... over the new perl ( at {prefix}/lib/perl/5.10.0 ). The only thing I can guess is that when searching for perl libs/includes, the linker only expands to seek version n.n.n and does not recognize a two digit subversion n.nn.n. If that's what's happening, is that patchable? Cheers, Jim ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

4 4

Rlm_sql in freeradius-1.1.7
by Dashamir Hoxha 19 Jan '08

19 Jan '08

Hi, I have installed freeradius-1.1.7 in fedora8. However I find that the module rlm_sql does not work as described in this page: http://wiki.freeradius.org/Rlm_sql For example, I have inserted such data in the database: radcheck: +------+----------+------------------+----+-------+ | id | UserName | Attribute | op | Value | +------+----------+------------------+----+-------+ | 5272 | test | User-Password | := | test | | 5262 | test | Simultaneous-Use | := | 5 | +------+----------+------------------+----+-------+ radreply: +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 42 | test | Reply-Message | := | Wellcome | +----+----------+---------------+----+----------+ usergroup: +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | test | group2 | 2 | | test | group1 | 1 | +----------+-----------+----------+ radgroupcheck: +----+-----------+----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+-------+ | 42 | group1 | NAS-Identifier | != | 123 | | 52 | group2 | NAS-Identifier | == | 123 | +----+-----------+----------------+----+-------+ radgroupreply: +----+-----------+---------------+----+--------+ | id | GroupName | Attribute | op | Value | +----+-----------+---------------+----+--------+ | 52 | group1 | Reply-Message | += | group1 | | 62 | group2 | Reply-Message | += | group2 | +----+-----------+---------------+----+--------+ When I try to login with username 'test' and password 'test' I get debug messages like these: Sending Access-Accept of id 30 to 192.168.252.47 port 2053 Reply-Message := "Wellcome" Reply-Message += "group1" Reply-Message += "group2" It seems to me that this is not according to the behavior described in the documentation above. Am I right or I am missing something? Regards, Dashamir

5 9

Re: Administering with MySQL DB
by Andy Smith 19 Jan '08

19 Jan '08

Erm, thanks. But Im trying to work out how I Administer the data in MySQL. Are there no utilities for entering data? If I have to enter data manually with SQL insert etc can anyone point me at some docs explaining the format the information should be in?? Andy Smith wrote: > Im completely new to freeradius, I have installed the server with > MySQL and also got the dialup web GUI up and running. > However its still not clear to me how I add new NAS devices, you dont > appear to be able to do that in the GUI. I just want > to add a system by IP address with a secret. Do I need to manually do an > insert into mysql? If so can someone give me > a pointer to how the data should be entered? Or any other help!! Edit the configuration files with a text editor. Alan DeKok.

4 3

EAP-TLS Machine Authentication problems
by Michael Olson 18 Jan '08

18 Jan '08

I'm attempting to use FreeRADIUS to do EAP-TLS with Windows XP using machine authentication. I set up FreeRADIUS following the guide at http://wiki.freeradius.org/WPA_HOWTO#Step_2:_Configure_FreeRADIUS and I'm using OpenSSL to generate the cetificates. I can authenticate using user certificates fine, so I'm pretty sure all the Certificates & CA setup is right on the RADIUS server certificate, User certificate, and the Root Certificate. That leaves the Computer Certificate. I generated the computer certificate to have the common name be the machine name (I've tried it plain and FQDN) and I've put the FQDN is the altSubjectName field as well. It has the same usage extensions as the User certificates. (TLS Client Auth: 1.3.6.1.5.5.7.3.2) I set the AuthMode registry key to Computer Only (2), and it trys to authenticate which suggests that the workstation is okay with the certificate. Computer Certificate details: http://www.cs.odu.edu/~olson/eap/computer.crt.txt Other than that I can't think of where to look for a problem. Comparing logs between user and computer authentication I can see where it starts differing but I can't find anything I can interpret as to why. Nothing seems to fail for the computer, it just cycles endlessly. Successful User Authentication Log: http://www.cs.odu.edu/~olson/eap/eap-tls_user_auth.log Failed Computer Authentication Log: http://www.cs.odu.edu/~olson/eap/eap-tls_computer_auth.log I also tossed out the windows tracing logs for both user and computer auth and anything else that seemed useful in http://www.cs.odu.edu/~olson/eap/ Can anybody give me a pointer on where to look for problems? Thanks -- Mike Olson

2 6

Problem with Max-Daily-Session
by Gabriele Giuliani 18 Jan '08

18 Jan '08

As entitled, with my office we have installed at a library town a server with Ubuntu 7.10, Freeradius and Chilispot to ensure wireless navigation to users with their notebooks from the local library; The access point is configured without any authentication, anyone can connect, authentication is performed by the server radius, which are stored registered users who are entitled to navigation (etc / freeradius / users), for simplicity we have not used SQL; Everything works great: Users come, authentify and happy surfing, what we fail to do is set the maximum daily navigation (which in our case should be 2 hours), the Daily-Session-Time works, after 2 hours of connection users are disconnected, only they can safely again for another 2 hours, which we would like to avoid (a maximum of 2 hours of daily connection); this is our configuration file (etc/freeradius/radiusd.conf ) of the "counter module": counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } Do we need to set some other parameter somewhere else? Any advice is welcome Thanks for the answers :) -- Gabriele Giuliani STUDIO 16 64 S.r.l. Via degli Abeti, 52 61100 PESARO Tel. 0721 0130897 Fax. 06 452215814 Cell. 329 9503621

2 1

Administering with MySQL DB
by Andy Smith 18 Jan '08

18 Jan '08

Hi list, Im completely new to freeradius, I have installed the server with MySQL and also got the dialup web GUI up and running. However its still not clear to me how I add new NAS devices, you dont appear to be able to do that in the GUI. I just want to add a system by IP address with a secret. Do I need to manually do an insert into mysql? If so can someone give me a pointer to how the data should be entered? Or any other help!! thanks! Andy.

2 1

eap-mschapv2
by indira kolli 18 Jan '08

18 Jan '08

Josh Howlett wrote: ... >> Sending Access-Challenge of id 3 to x.x.x.x port 1812 >> MS-CHAP2-Success = ... >> EAP-Message = ... > That looks like a bug to me. It's a violation of RFC2548: No. The bug is different: EAP-MSCHAPv2 is *not* MS-CHAPv2. The MS-CHAP2-Success attribute has no business being in *any* packet that also contains EAP. I've committed a fix for that to CVS head. >>How and when do I get this fix >> Also does thi fix the reply as type Access-Accept instead of Access-challenge Alan DeKok. - List info/subscribe/unsubscribe? See * http://www.freeradius.org/list/users.html*<http://www.freeradius.org/list/users.html>

2 9

Traffic volume accounting
by Spam Eater 18 Jan '08

18 Jan '08

Hello everyone, I am trying to implement traffic volume accounting in my Radius server. Is it possible to have a counter setup to achieve this? I've tested a lot and it seems freeradius is just ignoring my counter. I have somewhat managed to do some traffic accounting relying on external scripts, but it doesn't work properly. I'd like to know if someone has implemented realtime upload/download limitations and what methods were used. Thank you all!

2 1

Not sending a reply packet from proxy
by Pshem Kowalczyk 18 Jan '08

18 Jan '08

Hi, We have quite extensive proxy step up. With a few dozens of realms and a small army of home servers. Some of those home servers belong to our wholesale customers. Normally devices send packets to to the geographically closest proxy servers, which in turn use the closest (geographically again) home servers. When the proxies don't get reply from the home servers (because for example the link went down) they return a 'Reject' - as expected. Some customers of ours are not entirely happy with that approach as they would like to get those packets answered by a different home servers farm in a different city. Our proxies do not forward packets between cities (mainly for efficiency and manageability reasons), but our devices can fall back to a different proxy farm (in a different city) if the primary IP for that customer (freeradius farm load balanced by a SLB) goes down. Is it possible to discard the packet on the proxy if the home server doesn't reply and let the device to fall back to a different proxy? Currently we use radius 1.1.7, but looking into upgrading it to 2.0.0. kind regards Pshem

2 3