December 2008 - Freeradius-Users - lists.freeradius.org

Daloradius Help
by Bashir Jahed 01 Dec '08

01 Dec '08

I have managed to get freeradius + mysql authentication working and have installed daloradius 0.9-7, when I attempt to log on I get the following error message, Google proved fruitless on this occasion: Database connection error Error Message: DB Error: connect failed Debug: [nativecode=Can't connect to MySQL server on '127.0.0.1' (13)] ** mysql://root:@127.0.0.1/radius Help Me please...

3 2

sim-use check via perl
by Oguzhan Kayhan 01 Dec '08

01 Dec '08

Hello, I am using a perl script to check the user-password couple. And also managed to add radreply. But i cant figure out where to add simultaneous-check. I mean it is checking sim. use but by default always only 1 usage. Even i add it to users data in mysql, it does not effect. By the way, do i need to check sim-use in this perl script or is there a way to check it via freeradius itself by mysql ? Here is the perl script i am using.. PS: I am not much familiar about perl. Any correction or advices are welcome also. #!/usr/bin/perl $cfg_database = "wireless"; $cfg_data_source = "DBI:mysql:$cfg_database:databaseserver.adress"; $cfg_username = "xxx"; $cfg_password = "xxx"; use URI; use CGI; use CGI::Carp qw( fatalsToBrowser ); use DBI; use LWP::UserAgent; use XML::Simple; use HTTP::Headers; #Oguz-End #use strict; # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # Function to handle authorize sub authorize { ####### Staff&Student Decision $length_uid = length($RAD_REQUEST{'User-Name'}); if ($length_uid < 6) { $request = 'staff-info'; $usertype= 'P'; } else { $request = 'student-info'; $usertype = 'O'; } ####### Login Check via BAIS my $url = URI->new('http://urlforcontrolofclient/xxx.php'); $url->query_form( # And here the form data pairs: 'request' => $request, 'id' => $RAD_REQUEST{'User-Name'}, 'pwd' => $RAD_REQUEST{'User-Password'}, ); my $response = LWP::UserAgent->new->get( $url ); $dump = Dumper($response); @res_satirlari = split('\n', $dump); foreach $satir (@res_satirlari) { if ( $satir=~ /<(.*)>(.*)<\/.*/ ) { $variable = $1; $value=$2; $cmd='$'.$variable."=\"$value\""; $cmd=~s/@/\\@/g; eval($cmd); } } $namesurname = $firstname . " " . $lastname; ######## Check BAIS for Timeouts if ($dump =~ /Timeout/){ $RAD_REPLY{'Reply-Message'} = "Timeout- Try Again"; return RLM_MODULE_REJECT; } ######## Get Password from Database $dbh = DBI->connect( $cfg_data_source, $cfg_username, $cfg_password) or die ("Can not connect to $cfg_data_source \n"); $sql5 = "select Value from radcheck where UserName = \'$RAD_REQUEST{'User-Name'}\' and Attribute = 'Password';"; $sth = $dbh -> prepare($sql5); $sth -> execute() or die("olmadi"); ($pass) = $sth-> fetchrow_array(); if ($dump =~ />false</i) { ####### Check Account On MySQL if ($pass eq $RAD_REQUEST{'User-Password'}) { # User Accepted via SQL return RLM_MODULE_OK; } else { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Unknown Username Or Password"; return RLM_MODULE_REJECT; } } else { ####### User Accepted ####### Database check $dbh = DBI->connect( $cfg_data_source, $cfg_username, $cfg_password) or die ("2Can not connect to $cfg_data_source \n"); $sql = "select UserName from radcheck where UserName = \'$RAD_REQUEST{'User-Name'}\';"; $sth = $dbh -> prepare($sql); $sth -> execute() or die("olmadi"); ($adi) = $sth-> fetchrow_array(); if (!$adi) { $sql2 = "INSERT INTO radcheck (UserName,Attribute,op,Value) VALUES (\'$RAD_REQUEST{'User-Name'}\','NameSurname',':=',\"$namesurname\");"; $sth2 = $dbh -> prepare($sql2); $sth2 -> execute() or die("olmadi"); $sql3 = "INSERT INTO radcheck (UserName,Attribute,op,Value) values(\'$RAD_REQUEST{'User-Name'}\','email',':=',\'$email\')"; $sth = $dbh -> prepare($sql3); $sth -> execute() or die("olmadi"); $sql4 = "INSERT INTO radcheck (UserName,Attribute,op,Value) values (\'$RAD_REQUEST{'User-Name'}\','UserType',':=',\'$usertype\');"; $sth = $dbh -> prepare($sql4); $sth -> execute() or die("olmadi"); $sql5 = "INSERT INTO usergroup (UserName,GroupName) values (\'$RAD_REQUEST{'User-Name'}\',\'$usertype\');"; $sth = $dbh -> prepare($sql5); $sth -> execute() or die("olmadi"); $sql16 = "INSERT INTO radcheck (UserName,Attribute,op,Value) values(\'$RAD_REQUEST{'User-Name'}\','Auth-Type','==',\'Local\')"; $sth = $dbh -> prepare($sql16); $sth -> execute() or die("olmadi"); } #### $dbh -> disconnect(); return RLM_MODULE_OK; } } # Function to handle authenticate sub authenticate { $dbh = DBI->connect( $cfg_data_source, $cfg_username, $cfg_password) or die ("Can not connect to $cfg_data_source \n"); $sql6 = "select Value from radcheck where UserName = \'$RAD_REQUEST{'User-Name'}\' and Attribute = 'Auth-Type';"; $sth = $dbh -> prepare($sql6); $sth -> execute() or die("olmadi"); ($type) = $sth-> fetchrow_array(); if ($type eq "Reject") { $sql7 = "select Value from radreply where UserName = \'$RAD_REQUEST{'User-Name'}\' and Attribute = 'Reply-Message';"; $sth = $dbh -> prepare($sql7); $sth -> execute() or die("olmadi"); ($reply) = $sth-> fetchrow_array(); ###dbg("REPLY ".$reply); $dbh -> disconnect(); $RAD_REPLY{'Reply-Message'} = $reply; return RLM_MODULE_REJECT; if ($RAD_REQUEST{'User-Name'} eq "") { ###dbg("REPLY ".$reply); $RAD_REPLY{'Reply-Message'} = "Enter username"; return RLM_MODULE_REJECT; } } else { # Accept user and set some attribute ### Sending radcheck requests### $sql8= "select Value from radcheck where UserName = \'$RAD_REQUEST{'User-Name'}\' and Attribute = 'Simultaneous-Use';"; $sth = $dbh -> prepare($sql8); $sth -> execute() or die("olmadi"); ($sim) = $sth-> fetchrow_array(); if (!$sim) { $RAD_CHECK{'Simultaneous-Use'} = "1"; } else { $RAD_CHECK{'Simultaneous-Use'} = $sim; } $sql9= "select Value from radreply where UserName = \'$RAD_REQUEST{'User-Name'}\' and Attribute = 'WISPr-Bandwidth-Max-Down';"; $sth = $dbh -> prepare($sql9); $sth -> execute() or die("olmadi"); ($bwdown) = $sth-> fetchrow_array(); if (!$bwdown) { $RAD_REPLY{'WISPr-Bandwidth-Max-Down'} = "1000000"; } $sql10= "select Value from radreply where UserName = \'$RAD_REQUEST{'User-Name'}\' and Attribute = 'WISPr-Bandwidth-Max-Up';"; $sth = $dbh -> prepare($sql10); $sth -> execute() or die("olmadi"); ($bwup) = $sth-> fetchrow_array(); if (!$bwup) { $RAD_REPLY{'WISPr-Bandwidth-Max-Up'} = "512000"; } $RAD_REPLY{'Acct-Interim-Interval'} = "60"; $sql11= "select * from radreply where UserName = \'$RAD_REQUEST{'User-Name'}\' ;"; $sth = $dbh -> prepare($sql11); $sth -> execute() or die("olmadi"); while(@results = $sth-> fetchrow_array()) { $RAD_REPLY{$results[2]} = $results[4]; } return RLM_MODULE_OK; $dbh -> disconnect(); } } sub dbg { my $msg = shift; open(DBG, ">>/tmp/dbg"); print DBG "$msg\n"; close DBG; return 1; } # Function to handle accounting sub accounting { # For debugging purposes only # &log_request_attributes; # You can call another subroutine from here return RLM_MODULE_OK; }

2 1

pls help: restrict authentication for certain realms from particular clients
by ST Wong (ITSC) 01 Dec '08

01 Dec '08

Hi all, We just upgraded our freeradius server from 1.7 to 2.1.1. I'd like to restrict authentication requests as following: client A accepts: @realm1, @realm2 client B accepts: @realm2, @realm3 so that requests like follwoing will be rejected: @realm3 to client A @realm1 to client B Would anyone please help? Sorry for newbie question. Thank you very much. /ST Wong

3 3