January 2008 - Freeradius-Users - lists.freeradius.org

EAP Notification
by Arran Cudbard-Bell 03 Jan '08

03 Jan '08

Hi, Running a packet capture of an EAP TTLS session against FR cvs head, noticed EAP Notifcation packets are being sent. The type-data appears to match that of the Reply-Message. Is this a feature of rlm_eap that I missed before, or is the NAS being clever about it's interpretation of the Access-Accept packet, and encapsulating the Reply-Message attribute in an EAP-Request Notification packet ? Either way it's pretty cool, and the message gets logged in /var/log/system.log (On Mac OS X) which has the potential to be useful for debugging... Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 4

Re:query
by Raghu V S 03 Jan '08

03 Jan '08

hi sir, i am using freeradius server of version 1.1.7 . i want to add a user at the run time. please help me out of the issue. best regards, raghu v s ---- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Monday, December 31, 2007 4:30 PM Subject: Freeradius-Users Digest, Vol 32, Issue 84 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. clients.conf and SQL? (Tuc at T-B-O-H.NET) > 2. RE: (Raghu V S) > 3. Re: (liran tal) > 4. Re: clients.conf and SQL? (liran tal) > 5. Re: (Marinko Tarlac) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 30 Dec 2007 20:15:27 -0500 (EST) > From: "Tuc at T-B-O-H.NET" <ml(a)t-b-o-h.net> > Subject: clients.conf and SQL? > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <200712310115.lBV1FRDO012471(a)himinbjorg.tucs-beachin-obx-house.com> > Content-Type: text/plain; charset=us-ascii > > Hi, > > I can't seem to find any reference to making the > contents of the clients.conf accessible via SQL. We are > constantly making edits, and having to constantly reload > the server doesn't make sense. > > Pointers to where I missed putting it into > MySQL, or if anyone knows how to would be appreciated. > > Thanks, Tuc > > > ------------------------------ > > Message: 2 > Date: Mon, 31 Dec 2007 10:59:30 +0530 > From: "Raghu V S" <raghu.vs(a)lifetreeindia.com> > Subject: RE: > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <000201c84b72$a71befc0$a901a8c0@Raghu> > Content-Type: text/plain; charset="iso-8859-1" > > initially started radius with (radiusd command). > > then once more gave the cmmand (radiusd -x) > output was as follows... > > " Starting - reading configuration files ... > Using deprecated naslist file. Support for this will go away soon. > There appears to be another RADIUS server running on the authentication > port 1812" > > how restart the server in debug mode? >

6 7

(no subject)
by Oguzhan Kayhan 03 Jan '08

03 Jan '08

Hello, I just managed to authenticate with rlm_perl and logging via sql. But i got a few problems which i can not slove yet. First of all when i run freeradius with -x parameter.. I see some error messages as : rlm_sql_log (sql_log): Processing sql_log_accounting perl_pool: item 0x801243e0 asigned new request. Handled so far: 2 found interpetator at address 0x801243e0 rlm_perl: perl_embed:: module = /usr/local/bin/login.pl , func = accounting exit status= Undefined subroutine &main::accounting called. And also, when i check sql radacct table i see the same Session-ID Unique-ID etc... all same datas except radacctid tab. So, it adds the log part to sql 2 times.

1 0

freeradius & sql server with high loads
by A.Dupont 03 Jan '08

03 Jan '08

Hello, I'm using freeradius 1.1.7 with sql server 2005, the problem is that I don't find all accounting in database, freeradius doesn't send ack for all accounting tickets (it sends 300 for 4000 tickets from 10 NAS), can you tell me what is the prob? here is a part of my radiusd.conf: max_request_time = 120 max_requests = 10000 start_servers = 10 max_servers = 50 min_spare_servers = 10 max_spare_servers = 30 num_sql_socks = 40 I find these error in the radius.log : Dropping conflicting packet from client myclient1 - ID: 45 due to unfinished request 1 ..... Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 (I use 40 handles ) .... CPU use: 100 % can you help me plz? thanks in advance _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr

2 1

R: Radius Load-Balancing concept
by Francesco Cristofori 03 Jan '08

03 Jan '08

Hi Sebastian, > But the most important thing for me is, if I get any trouble > if both radius servers will write their accounting records > into the same database. I'm not running postgres, but the concepts are the same. I set up a mysql replication (every dbms is slave of the other one) and one virtual ip which i configured in FR. When one server goes down the other takes the virtual ip address and continues to respond to radius requests. Accounting is consistent since both databases replicate each other. Uniqueness of accounting entry (remember that we have an auto_increment field in the radacct table) is guaranteed using different step increment values for the two dbms: the first server starts at 1 and increments two units (so: 1, 3, 5, ...), while the second server starts at 2 and increments two units (so: 2, 4, 6, ...). > Sebastian I hope this helps, Sorry for my poor english, Francesco Cristofori.

1 0

R: freeradius & sql server with high loads
by Francesco Cristofori 03 Jan '08

03 Jan '08

Hi A., I think the problem is that FR is trying to use more db connections than the ones available. You have to check MSSQL configuration and raise your incoming connections limit. Regards, Francesco Cristofori.

1 0

Re: Freeradius-Users Digest, Vol 32, Issue 82
by Raghu V S 03 Jan '08

03 Jan '08

respected sir/mam, i am using freeradius server (1.1.7). i was going through some documentation files. i have a doubt here. "Are the properties of Attributes, are predefined or userdefined." ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Saturday, December 29, 2007 4:30 PM Subject: Freeradius-Users Digest, Vol 32, Issue 82 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: building problem wit actual cvs (Alan DeKok) > 2. Re: building problem wit actual cvs (Norbert Wegener) > 3. Re: building problem wit actual cvs (Alan DeKok) > 4. Re: building problem wit actual cvs (Norbert Wegener) > 5. Re: I have some problem about dialup_admin , need help . > (David Wood) > 6. RE: I have some problem about dialup_admin , need help . > (Ben Wiechman) > 7. Re: EAP Auth failing with CVS Head (Arran Cudbard-Bell) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 28 Dec 2007 12:16:26 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: building problem wit actual cvs > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4774DB0A.6010307(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Norbert Wegener wrote: >> With the actual cvs there is a build problem: > ... >> radiusd.c:148: error: 'buffer' undeclared (first use in this function) > > I see no reference to "buffer" in radiusd.c in revision 1.348, which > is the latest for radiusd.c. > > Are you sure your copy is up to date, AND that you've made no local > changes? > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Fri, 28 Dec 2007 12:26:55 +0100 > From: Norbert Wegener <norbert.wegener(a)siemens.com> > Subject: Re: building problem wit actual cvs > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4774DD7F.30709(a)siemens.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Alan DeKok wrote: >> Norbert Wegener wrote: >> >>> With the actual cvs there is a build problem: >>> >> ... >> >>> radiusd.c:148: error: 'buffer' undeclared (first use in this function) >>> >> >> I see no reference to "buffer" in radiusd.c in revision 1.348, which >> is the latest for radiusd.c. >> > 1.348 or 1.384? > > > * Version: $Id: radiusd.c,v 1.384 2007/12/27 09:17:22 aland Exp $ > .... > 140 /* This is a quick fix start-stop scripts for radrelay-radiusd > 141 * so if we are called as 'radiusd' then, config file > 142 * is 'radiusd.conf', if we are called as 'mokoko', then > 143 * config file is 'mokoko.conf', which will probably make > things > 144 * easier.. will it ? Does it break something?? > 145 * (-n option still overwrites the config file name) > 146 * A long comment for a 2 line patch.. </tuyan> > 147 */ > 148 snprintf(buffer, sizeof(buffer), "%s.conf",progname); > 149 mainconfig.radiusd_conf = strdup(buffer); > >> Are you sure your copy is up to date, AND that you've made no local >> changes? >> > No changes. > Norbert Wegener > >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > > ------------------------------ > > Message: 3 > Date: Fri, 28 Dec 2007 12:30:53 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: building problem wit actual cvs > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4774DE6D.7020308(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Norbert Wegener wrote: >> 1.348 or 1.384? > > 1.384, sorry. > >> >> * Version: $Id: radiusd.c,v 1.384 2007/12/27 09:17:22 aland Exp $ >> .... >> 140 /* This is a quick fix start-stop scripts for >> radrelay-radiusd >> 141 * so if we are called as 'radiusd' then, config file >> 142 * is 'radiusd.conf', if we are called as 'mokoko', then >> 143 * config file is 'mokoko.conf', which will probably make >> things >> 144 * easier.. will it ? Does it break something?? >> 145 * (-n option still overwrites the config file name) >> 146 * A long comment for a 2 line patch.. </tuyan> > > Err... Tuyan used to work for Peter. He doesn't have commit access. > There is no such text in CVS. This text has NEVER existed in CVS. > >> 147 */ >> 148 snprintf(buffer, sizeof(buffer), "%s.conf",progname); >> 149 mainconfig.radiusd_conf = strdup(buffer); >> >>> Are you sure your copy is up to date, AND that you've made no local >>> changes? >>> >> No changes. > > You have local changes, OR local patches you apply after a CVS checkout. > > Fix your local system. CVS is fine. > > Alan DeKok. > > > ------------------------------ > > Message: 4 > Date: Fri, 28 Dec 2007 12:43:57 +0100 > From: Norbert Wegener <norbert.wegener(a)siemens.com> > Subject: Re: building problem wit actual cvs > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4774E17D.4090907(a)siemens.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Alan DeKok wrote: >> Norbert Wegener wrote: >> >>> 1.348 or 1.384? >>> >> >> 1.384, sorry. >> >> >>> * Version: $Id: radiusd.c,v 1.384 2007/12/27 09:17:22 aland Exp $ >>> .... >>> 140 /* This is a quick fix start-stop scripts for >>> radrelay-radiusd >>> 141 * so if we are called as 'radiusd' then, config file >>> 142 * is 'radiusd.conf', if we are called as 'mokoko', then >>> 143 * config file is 'mokoko.conf', which will probably make >>> things >>> 144 * easier.. will it ? Does it break something?? >>> 145 * (-n option still overwrites the config file name) >>> 146 * A long comment for a 2 line patch.. </tuyan> >>> >> >> Err... Tuyan used to work for Peter. He doesn't have commit access. >> There is no such text in CVS. This text has NEVER existed in CVS. >> >> >>> 147 */ >>> 148 snprintf(buffer, sizeof(buffer), "%s.conf",progname); >>> 149 mainconfig.radiusd_conf = strdup(buffer); >>> >>> >>>> Are you sure your copy is up to date, AND that you've made no local >>>> changes? >>>> >>>> >>> No changes. >>> >> >> You have local changes, OR local patches you apply after a CVS >> checkout. >> > Sorry, you are right. I did not realize that patches from > > http://download.opensuse.org/repositories/network:/aaa/SLES_9/src/freeradiu… > had been applied to my local copy. > > Norbert Wegener > >> Fix your local system. CVS is fine. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > > ------------------------------ > > Message: 5 > Date: Fri, 28 Dec 2007 12:32:31 +0000 > From: David Wood <david(a)wood2.org.uk> > Subject: Re: I have some problem about dialup_admin , need help . > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <ufIwJeCfzOdHFA6y(a)wood2.org.uk> > Content-Type: text/plain;charset=iso-8859-1;format=flowed > > Hi there, > > In message <006601c848f9$3e710530$7301000a(a)int.ntt.co.th>, watthanachai > <watthanachai(a)ntt.co.th> writes >>Dear Radius Team , Radius User >>? >>I install freeradius in freebsd 6.2 install by port >>? >>#cd /usr/ports/sysutils/freeradius >>#make install clean > > I think you mean /usr/ports/net/freeradius - though that doesn't change > anything. I am the maintainer of net/freeradius in FreeBSD. > > >>everything look fine , no error and can start to daemon.. >>? >>So I install dialup admin for management radius . > > The port doesn't attempt to install dialup_admin at all - in fact, it > completely ignores it. It is a set of scripts, really, but there is a > fairly well defined FreeBSD way to install such items ready for use > (see, for example, the phpMyAdmin port). > > If there was any demand, I could produce a dialup_admin port, though I'm > not sure I have any use for it. I'm heading towards putting my user > database in LDAP. > > >>I have some problem when I want to?select user information?like error >>in?this site >>http://golfreeze.packetlove.com/download/error_dialup.JPG? >>? >>How could I fix this problem ? > > It looks as if the PHP scripts are being served rather than executed. As > the README says, the scripts are PHP 4 despite having a php3 extension. > > In httpd.conf (/usr/local/etc/apacheXX on FreeBSD, where XX is 22 on my > machines as I have Apache 2.2 installed) look for the: > > AddType application/x-httpd-php > > line. Add .php3 to the end. Restart Apache; graceful will probably be > OK, but a restart will definitely work. > > > Does it work now? > > > > Is there any reason why the dialup_admin scripts can't be renamed as > .php rather than .php3? They'd work 'out of the box' on more people's > systems if this was done. > > What is the current status of dialup_admin - does it work with PHP 5? > PHP 4 is end of life, with development ceasing as of the end of this > month. > > > > Best wishes, > > > > > David > -- > David Wood > david(a)wood2.org.uk > > > > ------------------------------ > > Message: 6 > Date: Fri, 28 Dec 2007 08:34:58 -0600 > From: "Ben Wiechman" <ben(a)wisper-wireless.com> > Subject: RE: I have some problem about dialup_admin , need help . > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <007901c8495e$d2658080$5204a8c0(a)DiversiCOM2.local> > Content-Type: text/plain; charset="iso-8859-1" > > It works with php5. I have been using it with php5 for some time. > > I would guess that it hasn't been updated because all the includes would > need to be tracked down and updated as well. Otherwise I don't see any > reason that it couldn't be done. It's probably more that it takes about 1 > minute to add php3 to the php types in apache, and would take a bit more > work to track down all the links in the dialup_admin source - unless > you're > really good with funky grep and sed commands (which sadly I'm not). > > Ben Wiechman > Network Admin > Wisper High Speed Internet > ben(a)wisper-wireless.com > > >> -----Original Message----- >> From: freeradius-users-bounces+ben=wisper- >> wireless.com(a)lists.freeradius.org [mailto:freeradius-users- >> bounces+ben=wisper-wireless.com(a)lists.freeradius.org] On Behalf Of David >> Wood >> Sent: Friday, December 28, 2007 6:33 AM >> To: FreeRadius users mailing list >> Subject: Re: I have some problem about dialup_admin , need help . >> >> Hi there, >> >> In message <006601c848f9$3e710530$7301000a(a)int.ntt.co.th>, watthanachai >> <watthanachai(a)ntt.co.th> writes >> >Dear Radius Team , Radius User >> > >> >I install freeradius in freebsd 6.2 install by port >> > >> >#cd /usr/ports/sysutils/freeradius >> >#make install clean >> >> I think you mean /usr/ports/net/freeradius - though that doesn't change >> anything. I am the maintainer of net/freeradius in FreeBSD. >> >> >> >everything look fine , no error and can start to daemon.. >> > >> >So I install dialup admin for management radius . >> >> The port doesn't attempt to install dialup_admin at all - in fact, it >> completely ignores it. It is a set of scripts, really, but there is a >> fairly well defined FreeBSD way to install such items ready for use >> (see, for example, the phpMyAdmin port). >> >> If there was any demand, I could produce a dialup_admin port, though I'm >> not sure I have any use for it. I'm heading towards putting my user >> database in LDAP. >> >> >> >I have some problem when I want to?select user information?like error >> in?this site >> >http://golfreeze.packetlove.com/download/error_dialup.JPG >> > >> >How could I fix this problem ? >> >> It looks as if the PHP scripts are being served rather than executed. As >> the README says, the scripts are PHP 4 despite having a php3 extension. >> >> In httpd.conf (/usr/local/etc/apacheXX on FreeBSD, where XX is 22 on my >> machines as I have Apache 2.2 installed) look for the: >> >> AddType application/x-httpd-php >> >> line. Add .php3 to the end. Restart Apache; graceful will probably be >> OK, but a restart will definitely work. >> >> >> Does it work now? >> >> >> >> Is there any reason why the dialup_admin scripts can't be renamed as >> .php rather than .php3? They'd work 'out of the box' on more people's >> systems if this was done. >> >> What is the current status of dialup_admin - does it work with PHP 5? >> PHP 4 is end of life, with development ceasing as of the end of this >> month. >> >> >> >> Best wishes, >> >> >> >> >> David >> -- >> David Wood >> david(a)wood2.org.uk >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > > > > ------------------------------ > > Message: 7 > Date: Sat, 29 Dec 2007 10:49:57 +0000 > From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > Subject: Re: EAP Auth failing with CVS Head > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <47762655.30906(a)sussex.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Alan DeKok wrote: >> Arran Cudbard-Bell wrote: >>>> Well, that's wrong. The State attribute should be a bunch of random >>>> hex stuff, not all zeros. >>>> >>>> This is on a 64-bit machine? >>>> >>> Yes, and it only happens for random users, and often only after a few >>> minutes of running. I can find a failing user, force re-authentication, >>> have it fail, restart the server, force re-authentication and have it >>> succeed . >> >> I've committed some changes which will help. They won't fix the >> "all-zeros" problem, because I don't know what's causing that. >> >> But they will make the State attribute unique in the way that the rest >> of the code expects. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > Thanks, > > Will try today. It's strange how it only seems to appear after a few > minutes of the server running. > > -- > Arran > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 32, Issue 82 > ************************************************ >

2 1

RE: adding users at run time
by Raghu V S 03 Jan '08

03 Jan '08

Hi all, i am using freeradius of version 1.1.7 i wanted to know "is it possible to add the users to the user list at the run time. " Thank you all Raghu V S

1 0

Reread config files
by Norbert Wegener 02 Jan '08

02 Jan '08

When I remember correctly, one issue in pre2 had been, that on SIGHUP freeradius did not reread its configration completely. Is this issue already solved in cvs? Will especially the clients be reread by SIGHUP? Norbert Wegener **

2 1

truncate_radacct script deleted more then desired
by YvesDM 02 Jan '08

02 Jan '08

Hi, FR1.1.6 on debian. I use the truncate_radacct script that comes with dialup admin to delete older accounting records. I got the $back_days set at 365 days in order to keep the accounting data for one year. It 's been working fine untill this morning (1/1/08, 00:01) Instead of deleting data older then 01/01/07 it deleted all data older then 01/01/08, or everything in radacct :-( I 've got backups, that's not the problem, but I wonder what went wrong here. Anyone experiencing the same, any clues? Kind regards Yves

2 2