January 2008 - Freeradius-Users - lists.freeradius.org

RPM install error.
by mohsen rahmanian 10 Jan '08

10 Jan '08

His name I install freeradius-1.1.7-7.1.i386.rpm few days ago, When I try to install, upgrade or remove freeradius-1.1.7-7.1.i386.rpm get this error: /var/tmp/rpm-tmp.25681: line 1: fg: no job control error: %postun( freeradius-1.1.7-7.1.i386) scriptlet failed, exit status 1 I use Fedora Core 6 on Toshiba laptop. I try it with apt-get, but get previous error. Can you tell me why? -- Best Regards Rahmanian

2 3

Configuring own VSA to FreeRADIUS server
by Sourav Chakraborty 10 Jan '08

10 Jan '08

Hi Everyone, We are tring to add our own VSA to the Access-Accept message sent out by FreeRADIUS server.Can you please outline the steps as to how this can be done?We require this urgently. Thanks in advance for the help sought. Regards Sourav

2 1

different authentication methods in users file
by Johan 09 Jan '08

09 Jan '08

Hi list I'd like to authenticate some users request coming from a firewall with perl, and some other coming from a Brocade box with LDAP. Each authentication alone works, but I haven't figure out how make things work toghether. This combinaison works, but I'd rather have a generic statement : firewalluser Auth-Type == perl Fall-Through = no DEFAULT Auth-Type == ldap Fall-Through = Yes DEFAULT Huntgroup-Name == netadmin Auth-Type = ldap, Brocade-Auth-Role = "admin", Fall-Through = no if I replace the user name firewalluser by DEFAULT, and add a property like NAS-IP-Address = 192.168.9.111, or Login-IP-Host = 192.168.9.111 that doesn;t work. What's wrong ?

2 1

Stopping LDAP searches during each part of EAP session?
by Matt Alexander 09 Jan '08

09 Jan '08

I have a freeradius server configured to do both EAP-TLS and LDAP auth. It works great so far. If I have a cert. configured, then I'm authenticated with the cert. If I don't have a cert then I get prompted for my un/pw on my NAS's Captive Portal page, which then passes my username/password on to the Radius server which then checks my LDAP server if my un/pw are correct. When I look through the debug logs, however, I see that the rlm_ldap module is doing an LDAP search for my username during each stage of the EAP session. Is there a way to configure freeradius so that it won't try LDAP auth in the middle of an EAP session? Here's my radiusd.conf: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radius group = radius max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 8192 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = after lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 0 status_server = yes } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 10 max_servers = 128 min_spare_servers = 3 max_spare_servers = 20 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "ldap.mycompany.com" basedn = "ou=people,dc=mycompany,dc=com" filter = "(&(accountInstance=wireless)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = yes dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 25 timeout = 10 timelimit = 10 net_timeout = 1 access_attr_used_for_allow = yes } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { expr } authorize { preprocess mschap eap files ldap } authenticate { Auth-Type MS-CHAP { mschap } eap Auth-Type LDAP { ldap } } preacct { preprocess acct_unique files } accounting { } session { } post-auth { } pre-proxy { } post-proxy { } Here's my eap.conf: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_password = private_key_file = /etc/raddb/certs/mycompany.com.key certificate_file = /etc/raddb/certs/mycompany.com.crt CA_path = /etc/raddb/certs dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random fragment_size = 1024 include_length = yes check_crl = yes } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } }

2 1

OpenSSH, PAM and pam_radius_auth
by Johan Rydberg 09 Jan '08

09 Jan '08

I'm trying to get RADIUS authentication to work on one of our systems, but keep running into problems. For some reason it seems that the account system does not allow the user to login, and once the user has been authenticated, it drops the connection by not allowing sshd to establish credentials for the user. It seems that OpenSSH first tries to authetnicate the user with an empty password (""), because if I set an empty password both in the local /etc/passwd, and on the RADIUS server, sshd is able to establish credentials for the user. Note that even with a non-empty password the authentication works, the daemon gets and OK from the radius server. There's a user with that given name in /etc/passwd. Anyone ideas about what could be wrong here? Here's the debug output from OpenSSH: debug1: userauth-request for user orbit-admin service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "orbit-admin" debug1: PAM: setting PAM_RHOST to "192.168.99.111" debug1: PAM: setting PAM_TTY to "ssh" debug1: userauth_send_banner: sent debug1: PAM: password authentication failed for orbit-admin: Authentication failure Failed none for orbit-admin from 192.168.99.111 port 39102 ssh2 debug1: userauth-request for user orbit-admin service ssh-connection method keyboard-interactive debug1: attempt 1 failures 1 debug1: keyboard-interactive devs debug1: auth2_challenge: user=orbit-admin devs= debug1: kbdint_alloc: devices 'pam' debug1: auth2_challenge_start: trying authentication method 'pam' Postponed keyboard-interactive for orbit-admin from 192.168.99.111 port 39102 ssh2 debug1: do_pam_account: called debug1: PAM: num PAM env strings 0 Postponed keyboard-interactive/pam for orbit-admin from 192.168.99.111 port 39102 ssh2 debug1: do_pam_account: called Accepted keyboard-interactive/pam for orbit-admin from 192.168.99.111 port 39102 ssh2 debug1: Entering interactive session for SSH2. debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 65536 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug1: session_new: init debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_channel_req: channel 0 request pty-req reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug1: session_pty_req: session 0 alloc /dev/ttyp1 debug1: server_input_channel_req: channel 0 request env reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req env debug1: server_input_channel_req: channel 0 request shell reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell debug1: PAM: setting PAM_TTY to "/dev/ttyp1" debug1: PAM: establishing credentials PAM: pam_setcred(): Authentication service cannot retrieve user credentials debug1: do_cleanup debug1: PAM: cleanup debug1: session_pty_cleanup: session 0 release /dev/ttyp1 My system-auth file: auth sufficient pam_radius_auth.so debug auth sufficient pam_unix.so likeauth nullok debug auth required pam_deny.so account required pam_unix.so password sufficient pam_unix.so nullok use_authtok md5 password required pam_deny.so session required pam_unix.so Versions: pam_radius-1.3.17 openssh-4.5p1

5 12

How to Make Digital Certificates in Radius
by niel m 09 Jan '08

09 Jan '08

Hello All, Good Morning Im niel, Im making a radius server for a wireless LAN and with LDAP Support. LDAP is set-up already Radius Application is ready but 1 thing is lacking, it is how to create a Digital Certificate for Radius both Server Certificate and Client Certificate. Kindly help me on this problem, I appreciate any help that you can offer in order for me to implement such system. Thank you very much and more power to you all. Respectfully yours, Niel

3 8

ldap group membership required
by Daniel Durgin 09 Jan '08

09 Jan '08

Hello, I have search the archives and google, and there seems to be lots of confusion on the subject: Requiring membership to and LDAP group to authenticate. I can seem to get it to work. Notice the misspelling og the member: dn: cn=radius_wifi,ou=Groups,dc=fu,dc=bar cn: min_radius_wifi objectClass: groupOfNames objectClass: top member: cn=tes guest,ou=Guests,dc=fu,dc=bar The real user, cn=test guest,ou=Guests,dc=fu,dc=bar, is still able to login. FreeRadius Version: freeradius-1.0.1 ldap { server = "localhost" identity = "uid=authman,dc=fu,dc=bar" password = XXXXXXX basedn = "dc=fu,dc=bar" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=person)" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #` access_attr = "uid" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "cn=radius_wifi,ou=Group,dc=fu,dc=bar" timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = no } Thank you for the help, Dan

2 2

bug? in configure script
by Andrew Higginbotham 08 Jan '08

08 Jan '08

I was installing freeradius today and the only way I could get it to recognize my ssl install, which is in a custom location, was to change line 21268 of the 'configure' script to from LIBS="-lssl -lcrypto $LIBS" LIBS="-lssl $LIBS" For some reason, even when I add '-lcrypto' to LDFLAGS it does not work, which seems like a bug. Even stranger, config.log shows that when this is done -lcrypto is being called: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -I/usr/local/pkg/openssl/include -ldl -lcrypto -L/usr/local/pkg/openssl/lib conftest.c -lssl -lnsl -lresolv -lpthread >&5 /usr/local/pkg/openssl/lib/libssl.a(ssl_lib.o): In function `SSL_CTX_set_cert_store': ssl_lib.c:(.text+0x763): undefined reference to `X509_STORE_free' /usr/local/pkg/openssl/lib/libssl.a(ssl_lib.o): In function `SSL_CTX_get_ex_new_index': ssl_lib.c:(.text+0x813): undefined reference to `CRYPTO_get_ex_new_index' /usr/local/pkg/openssl/lib/libssl.a(ssl_lib.o): In function `SSL_get_ex_new_index': Note the '-lcrypto' in the gcc line. Now, without -lcrypto in LDFLAGS but with the line changed in the configure script this part of config.log becomes configure:21297: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -I/usr/local/pkg/openssl/include -ldl -L/usr/local/pkg/openssl/lib conftest.c -lssl -lcrypto -lnsl -lresolv -lpthread >&5 configure:21303: $? = 0 configure:21310: test -z "$ac_c_werror_flag" || test ! -s conftest.err configure:21313: $? = 0 configure:21320: test -s conftest configure:21323: $? = 0 configure:21337: result: yes The only difference that I can see is that '-lcrypto' is in a different position now. Does order matter in this case? ~Andrew

2 1

FreeRadius with SQL and Asterisk - FreeRadius inserts acct data toSQL database , but the data seems useless
by Antun Mihalicek 07 Jan '08

07 Jan '08

Hi! First of all, I apologize if I sent this to non-appropriate mailing list, but nevertheless I hope that you can help me. I installed FreeRadius because I wanted to see how it works in conjunction with Asterisk, only for accounting purposes. In my case, I managed to configure Asterisk to send RADIUS packets to FreeRadius server, as we can see from file /var/log/radius/radacct/127.0.0.1/detail-20080107: > Mon Jan 7 09:38:45 2008 > Acct-Status-Type = Stop > Asterisk-Acc-Code = "" > Asterisk-Src = "amihalicek" > Asterisk-Dst = "s" > Asterisk-Dst-Ctx = "default" > Asterisk-Clid = "amihalicek" > Asterisk-Chan = "SIP/5061-08b5f250" > Asterisk-Dst-Chan = "" > Asterisk-Last-App = "BackGround" > Asterisk-Last-Data = "demo-congrats" > Asterisk-Start-Time = "2008-01-07 08:38:38 +0000" > Asterisk-Answer-Time = "2008-01-07 08:38:39 +0000" > Asterisk-End-Time = "2008-01-07 08:38:45 +0000" > Asterisk-Duration = 7 > Asterisk-Bill-Sec = 6 > Asterisk-Disposition = "ANSWERED" > Asterisk-AMA-Flags = "DOCUMENTATION" > Asterisk-Unique-ID = "1199695118.0" > Asterisk-User-Field = "" > User-Name = "SIP/5061-08b5f250" > Acct-Session-Id = "1199695118.0" > NAS-Port = 0 > Acct-Delay-Time = 0 > NAS-IP-Address = 127.0.0.1 > Client-IP-Address = 127.0.0.1 > Acct-Unique-Session-Id = "e8e8e47588d22eed" > Timestamp = 1199695125 The problems start when I configure FreeRadius to insert RADIUS accounting data into SQL, in my case - postgreSQL database. I followed the steps on http://wiki.freeradius.org/SQL_HOWTO. FreeRadius creates SQL insert indeed, as you can see down below, but the thing is that the data from this table is totally useless, as e.g. acctstartime and acctstoptime fields are equal, which doesn't make sense. If we see the /var/log/radius/radacct/127.0.0.1/detail-20080107 file (see above), we can see that all of the AvPs are created in the SQL table, except the ones which have "Asterisk" as prefix (e.g. Asterisk-Acc-Code, Asterisk-Src, etc). I thought that FreeRadius will somehow map these values from Asterisk to values which can be put to radacct table, e.g. Asterisk-Start-Time ---> acctstarttime, etc. Obviously, it doesn't. I've been googling for whole day concerning this problem, and I wasn't able to find anything related to it, so probably other users had no problems with that. I assume that I would have to create a custom table for supporting asterisk RADIUS packets, but I wasn't able to find anything on google. I would appreciate any kind of help, hint, or advice. Below you can also see debug output from freeRADIUS. Thank you very much and sorry for the long e-mail, Antun Radacct table form postgreSQL: > radius=# select * from radacct; > radacctid | acctsessionid | acctuniqueid | username | > realm | nasipaddress | nasportid | nasporttype | > acctstarttime | acctstoptime | acctsessiontime | > acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets > | acctoutputoctets | calledstationid | callingstationid | > acctterminatecause | servicetype | framedprotocol | framedipaddress | > acctstartdelay | acctstopdelay | xascendsessionsvrkey | start-time | > starttime | asteriskstarttime > -----------+---------------+------------------+-------------------+-------+--------------+-----------+-------------+------------------------+------------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+------------+-----------+------------------- > 1 | 1199695118.0 | e8e8e47588d22eed | SIP/5061-08b5f250 > | | 127.0.0.1 | 0 | | 2008-01-07 > 09:38:45+01 | 2008-01-07 09:38:45+01 | | > | | | 0 > | 0 | | > | | | | > | | 0 | | > | | FreeRadius DEBUG: > [amihalicek@antun sbin]$ ./radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /home/amihalicek/radius/etc/raddb/proxy.conf > Config: including file: /home/amihalicek/radius/etc/raddb/clients.conf > Config: including file: /home/amihalicek/radius/etc/raddb/snmp.conf > Config: including file: /home/amihalicek/radius/etc/raddb/eap.conf > Config: including file: > /home/amihalicek/radius/etc/raddb/postgresql.conf > main: prefix = "/home/amihalicek/radius" > main: localstatedir = "/home/amihalicek/radius/var" > main: logdir = "/home/amihalicek/radius/var/log/radius" > main: libdir = "/home/amihalicek/radius/lib" > main: radacctdir = "/home/amihalicek/radius/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/home/amihalicek/radius/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/home/amihalicek/radius/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/home/amihalicek/radius/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /home/amihalicek/radius/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > pap: auto_header = yes > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded DIGEST > Module: Instantiated digest (digest) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/home/amihalicek/radius/etc/raddb/huntgroups" > preprocess: hints = "/home/amihalicek/radius/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/home/amihalicek/radius/etc/raddb/users" > files: acctusersfile = "/home/amihalicek/radius/etc/raddb/acct_users" > files: preproxy_usersfile = > "/home/amihalicek/radius/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded SQL > sql: driver = "rlm_sql_postgresql" > sql: server = "localhost" > sql: port = "" > sql: login = "radius" > sql: password = "radius" > sql: radius_db = "radius" > sql: nas_table = "nas" > sql: sqltrace = yes > sql: sqltracefile = "/home/amihalicek/radius/var/log/radius/sqltrace.sql" > sql: readclients = no > sql: deletestalesessions = yes > sql: num_sql_socks = 5 > sql: sql_user_name = "%{User-Name}" > sql: default_user_profile = "" > sql: query_on_not_found = no > sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, > Op ??FROM radcheck ??WHERE Username = '%{SQL-User-Name}' ??ORDER BY id" > sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, > Op ??FROM radreply ??WHERE Username = '%{SQL-User-Name}' ??ORDER BY id" > sql: authorize_group_check_query = "SELECT radgroupcheck.id, > radgroupcheck.GroupName, ??radgroupcheck.Attribute, > radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup > ??WHERE usergroup.Username = '%{SQL-User-Name}' AND > usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id" > sql: authorize_group_reply_query = "SELECT radgroupreply.id, > radgroupreply.GroupName, radgroupreply.Attribute, > ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup > ??WHERE usergroup.Username = '%{SQL-User-Name}' AND > usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id" > sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime = > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > AcctSessionTime = (EXTRACT(EPOCH FROM('%S'::timestamp with time zone > - AcctStartTime::timestamp with time zone > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, > AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = 0 > WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND > NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" > sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress > = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = > (EXTRACT(EPOCH FROM('%S'::timestamp with time zone > - AcctStartTime::timestamp with time zone > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, > AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) > + '%{Acct-Input-Octets:-0}'::bigint), > AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) > + '%{Acct-Output-Octets:-0}'::bigint) WHERE > AcctSessionId = '%{Acct-Session-Id}' AND UserName = > '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND > AcctStopTime IS NULL" > sql: accounting_update_query_alt = "INSERT into radacct > (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, > NASPortId, NASPortType, AcctStartTime, AcctSessionTime, > AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, > CallingStationId, ??ServiceType, FramedProtocol, FramedIPAddress, > XAscendSessionSvrKey) ??values('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', > '%{NAS-IP-Address}', ??'%{NAS-Port}', > '%{NAS-Port-Type}', ('%S'::timestamp - > '%{Acct-Delay-Time:-0}'::interval - > '%{Acct-Session-Time:-0}'::interval), ??'%{Acct-Session-Time}', > '%{Acct-Authentic}', ??(('%{Acct-Input-Gigawords:-0}'::bigint << 32) + > '%{Acct-Input-Octets:-0}'::bigint), > ??(('%{Acct-Output-Gigawords:-0}'::bigint << 32) + > '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', > ??'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', > ??NULLIF('%{Framed-IP-Address}', '')::inet, > '%{X-Ascend-Session-Svr-Key}')" > sql: accounting_start_query = "INSERT into radacct ??(AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, > CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay, XAscendSessionSvrKey) ??values('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', > '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > '%{Acct-Authentic}', '%{Connect-Info}', ??'%{Called-Station-Id}', > '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', > ??NULLIF('%{Framed-IP-Address}', '')::inet, 0, > '%{X-Ascend-Session-Svr-Key}')" > sql: accounting_start_query_alt = "UPDATE radacct ??SET AcctStartTime > = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > AcctStartDelay = 0, ??ConnectInfo_start = '%{Connect-Info}' WHERE > AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' > ??AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" > sql: accounting_stop_query = "UPDATE radacct ??SET AcctStopTime = > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > ??AcctSessionTime = NULLIF('%{Acct-Session-Time}', '')::bigint, > ??AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + > '%{Acct-Input-Octets:-0}'::bigint), ??AcctOutputOctets = > (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + > '%{Acct-Output-Octets:-0}'::bigint), ??AcctTerminateCause = > '%{Acct-Terminate-Cause}', AcctStopDelay = 0, ??FramedIPAddress = > NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = > '%{Connect-Info}' ??WHERE AcctSessionId = '%{Acct-Session-Id}' AND > UserName = '%{SQL-User-Name}' ??AND NASIPAddress = '%{NAS-IP-Address}' > AND AcctStopTime IS NULL" > sql: accounting_stop_query_alt = "INSERT into radacct > ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, > NASPortId, NASPortType, AcctStartTime, AcctStopTime, > ??AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, > AcctOutputOctets, CalledStationId, CallingStationId, > ??AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStopDelay) ??values('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', > '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval - > '%{Acct-Session-Time:-0}'::interval), ??('%S'::timestamp - > '%{Acct-Delay-Time:-0}'::interval), NULLIF('%{Acct-Session-Time}', > '')::bigint, ??'%{Acct-Authentic}', '%{Connect-Info}', > ??(('%{Acct-Input-Gigawords:-0}'::bigint << 32) + > '%{Acct-Input-Octets:-0}'::bigint), > ??(('%{Acct-Output-Gigawords:-0}'::bigint << 32) + > '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', > ??'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', > '%{Service-Type}', '%{Framed-Protocol}', > ??NULLIF('%{Framed-IP-Address}', '')::inet, 0)" > sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE > UserName='%{SQL-User-Name}'" > sql: connect_failure_retry_delay = 60 > sql: simul_count_query = "" > sql: simul_verify_query = "" > sql: postauth_query = "INSERT INTO radpostauth (username, pass, > reply, authdate) VALUES ('%{User-Name}', > '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" > sql: safe-characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" > rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) > loaded and linked > rlm_sql (sql): Attempting to connect to radius@localhost:/radius > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 > rlm_sql (sql): Connected new DB handle, #4 > Module: Instantiated sql (sql) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/home/amihalicek/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/home/amihalicek/radius/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded radutmp > radutmp: filename = "/home/amihalicek/radius/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Accounting-Request packet from host 127.0.0.1:32773, id=148, > length=405 > Acct-Status-Type = Stop > Asterisk-Acc-Code = "" > Asterisk-Src = "amihalicek" > Asterisk-Dst = "s" > Asterisk-Dst-Ctx = "default" > Asterisk-Clid = "amihalicek" > Asterisk-Chan = "SIP/5061-08b5f250" > Asterisk-Dst-Chan = "" > Asterisk-Last-App = "BackGround" > Asterisk-Last-Data = "demo-congrats" > Asterisk-Start-Time = "2008-01-07 08:38:38 +0000" > Asterisk-Answer-Time = "2008-01-07 08:38:39 +0000" > Asterisk-End-Time = "2008-01-07 08:38:45 +0000" > Asterisk-Duration = 7 > Asterisk-Bill-Sec = 6 > Asterisk-Disposition = "ANSWERED" > Asterisk-AMA-Flags = "DOCUMENTATION" > Asterisk-Unique-ID = "1199695118.0" > Asterisk-User-Field = "" > User-Name = "SIP/5061-08b5f250" > Acct-Session-Id = "1199695118.0" > NAS-Port = 0 > Acct-Delay-Time = 0 > NAS-IP-Address = 127.0.0.1 > Processing the preacct section of radiusd.conf > modcall: entering group preacct for request 0 > modcall[preacct]: module "preprocess" returns noop for request 0 > rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = > 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = > "1199695118.0",User-Name = "SIP/5061-08b5f250"' > rlm_acct_unique: Acct-Unique-Session-ID = "e8e8e47588d22eed". > modcall[preacct]: module "acct_unique" returns ok for request 0 > rlm_realm: No '@' in User-Name = "SIP/5061-08b5f250", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[preacct]: module "suffix" returns noop for request 0 > modcall[preacct]: module "files" returns noop for request 0 > modcall: leaving group preacct (returns ok) for request 0 > Processing the accounting section of radiusd.conf > modcall: entering group accounting for request 0 > radius_xlat: > '/home/amihalicek/radius/var/log/radius/radacct/127.0.0.1/detail-20080107' > rlm_detail: > /home/amihalicek/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d > expands to > /home/amihalicek/radius/var/log/radius/radacct/127.0.0.1/detail-20080107 > modcall[accounting]: module "detail" returns ok for request 0 > modcall[accounting]: module "unix" returns ok for request 0 > radius_xlat: '/home/amihalicek/radius/var/log/radius/radutmp' > radius_xlat: 'SIP/5061-08b5f250' > rlm_radutmp: Logout for NAS localhost port 0, but no Login record > modcall[accounting]: module "radutmp" returns ok for request 0 > radius_xlat: 'SIP/5061-08b5f250' > rlm_sql (sql): sql_set_user escaped user --> 'SIP/5061-08b5f250' > radius_xlat: 'UPDATE radacct ??SET AcctStopTime = ('2008-01-07 > 09:38:45'::timestamp - '0'::interval), ??AcctSessionTime = NULLIF('', > '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), > ??AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), > ??AcctTerminateCause = '', AcctStopDelay = 0, ??FramedIPAddress = > NULLIF('', '')::inet, ConnectInfo_stop = '' ??WHERE AcctSessionId = > '1199695118.0' AND UserName = 'SIP/5061-08b5f250' ??AND NASIPAddress = > '127.0.0.1' AND AcctStopTime IS NULL' > radius_xlat: '/home/amihalicek/radius/var/log/radius/sqltrace.sql' > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql_postgresql: query: UPDATE radacct ??SET AcctStopTime = > ('2008-01-07 09:38:45'::timestamp - '0'::interval), ??AcctSessionTime > = NULLIF('', '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + > '0'::bigint), ??AcctOutputOctets = (('0'::bigint << 32) + > '0'::bigint), ??AcctTerminateCause = '', AcctStopDelay = 0, > ??FramedIPAddress = NULLIF('', '')::inet, ConnectInfo_stop = '' > ??WHERE AcctSessionId = '1199695118.0' AND UserName = > 'SIP/5061-08b5f250' ??AND NASIPAddress = '127.0.0.1' AND AcctStopTime > IS NULL > rlm_sql_postgresql: Status: PGRES_COMMAND_OK > rlm_sql_postgresql: affected rows = 0 > radius_xlat: 'stop packet with zero session length. [user > 'SIP/5061-08b5f250', nas '127.0.0.1']' > rlm_sql (sql) in sql_accounting: stop packet with zero session length. > [user 'SIP/5061-08b5f250', nas '127.0.0.1'] > rlm_sql (sql): Released sql socket id: 4 > radius_xlat: 'INSERT into radacct ??(AcctSessionId, AcctUniqueId, > UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, > AcctStopTime, ??AcctSessionTime, AcctAuthentic, ConnectInfo_stop, > AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, > ??AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStopDelay) ??values('1199695118.0', 'e8e8e47588d22eed', > 'SIP/5061-08b5f250', '', '127.0.0.1', ??'0', '', ('2008-01-07 > 09:38:45'::timestamp - '0'::interval - '0'::interval), ??('2008-01-07 > 09:38:45'::timestamp - '0'::interval), NULLIF('', '')::bigint, ??'', > '', ??(('0'::bigint << 32) + '0'::bigint), ??(('0'::bigint << 32) + > '0'::bigint), '', ??'', '', '', '', ??NULLIF('', '')::inet, 0)' > radius_xlat: '/home/amihalicek/radius/var/log/radius/sqltrace.sql' > rlm_sql_postgresql: query: INSERT into radacct ??(AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctStopTime, ??AcctSessionTime, AcctAuthentic, > ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, > CallingStationId, ??AcctTerminateCause, ServiceType, FramedProtocol, > FramedIPAddress, AcctStopDelay) ??values('1199695118.0', > 'e8e8e47588d22eed', 'SIP/5061-08b5f250', '', '127.0.0.1', ??'0', '', > ('2008-01-07 09:38:45'::timestamp - '0'::interval - '0'::interval), > ??('2008-01-07 09:38:45'::timestamp - '0'::interval), NULLIF('', > '')::bigint, ??'', '', ??(('0'::bigint << 32) + '0'::bigint), > ??(('0'::bigint << 32) + '0'::bigint), '', ??'', '', '', '', > ??NULLIF('', '')::inet, 0) > rlm_sql_postgresql: Status: PGRES_COMMAND_OK > rlm_sql_postgresql: affected rows = 1 > rlm_sql (sql): Released sql socket id: 4 > modcall[accounting]: module "sql" returns noop for request 0 > modcall: leaving group accounting (returns ok) for request 0 > Sending Accounting-Response of id 148 to 127.0.0.1 port 32773 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 148 with timestamp 4781e515 > Nothing to do. Sleeping until we see a request.

3 2

rpm for suse
by Norbert Wegener 07 Jan '08

07 Jan '08

The recent cvs seems to contain a new spec file for suse. With that spec I tried to build an rpm on 10.2. rpmbuild -ba freeradius.spec .... checking for SQLConnect in -liodbc... no checking for isql.h... no configure: error: set --without-rlm_sql_iodbc to disable it explicitly. configure: error: /bin/sh './configure' failed for ./drivers/rlm_sql_iodbc configure: error: ./configure failed for ./src/modules/rlm_sql error: Bad exit status from /var/tmp/rpm-tmp.19102 (%build) In Suse10.2 I don't find packages like *iodb* Which package contains the neccessary files? As I don't need everything, I modifyed the configure instruction in the spec-file and added: --without-rlm_sql_iodbc \ --without-rlm_sql_firebird \ --without-rlm_sql_db2 \ configure now runs without errors. Nevertheless, later on I get: gmake[10]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_firebird'^M gmake[10]: Für das Ziel »all« ist nichts zu tun.^M gmake[10]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_firebird'^M Making all in rlm_sql_freetds...^M gmake[10]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_freetds'^M gmake[10]: *** Keine Regel, um »all« zu erstellen. Schluss.^M gmake[10]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_freetds'^M gmake[9]: *** [common] Fehler 2^M gmake[9]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers'^M gmake[8]: *** [all] Fehler 2^M gmake[8]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers'^M gmake[7]: *** [common] Fehler 2^M gmake[7]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql'^M gmake[6]: *** [build-module] Fehler 2^M gmake[6]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql'^M gmake[5]: *** [common] Fehler 2^M gmake[5]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules'^M gmake[4]: *** [all] Fehler 2^M gmake[4]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules'^M gmake[3]: *** [common] Fehler 2^M gmake[3]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src'^M gmake[2]: *** [all] Fehler 2^M gmake[2]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src'^M gmake[1]: *** [common] Fehler 2^M gmake[1]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0'^M make: *** [all] Fehler 2^M error: Bad exit status from /var/tmp/rpm-tmp.36031 (%build)^M ^M ^M RPM build errors:^M Bad exit status from /var/tmp/rpm-tmp.36031 (%build)^M de7018tc:/usr/src/packages/SPECS # exit^M Norbert Wegener

4 3