October 2009 - Freeradius-Users - lists.freeradius.org

how to call an external script once the users is expired?
by aangles 22 Oct '09

22 Oct '09

hello, please i need to know how to call an external script one the users is expired. I got radius call an external script once the user is authenticated with success by using the echo module, but now I need to call another script when the user tries to connect after expiration date. Any ideas? thanks a lot -- View this message in context: http://www.nabble.com/how-to-call-an-external-script-once-the-users-is-expi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Re:
by INACIO ALVES 22 Oct '09

22 Oct '09

Thanks Alan DeKok, but I have some questions. > So, how I said in the last post, > the HOW_TO about SQL is out-of-date. The tables has name/schema changed. > But I will have success. All of this is documented in the config files. I search in the config files but I don't find nothing about this changes. In the sql directory have only the schemas to databases, and in the sql.conf file have only the configurations to access the database. See raddb/sites-available/dhcp, and modules/mac2ip Don't have problems in use this options? I read that it is in experimental stage. I think that this can break my server. No more, thanks Inácio Alves http://www.polluxweb.com/inacioalves/site

2 1

Re: Counting Packets
by Alan DeKok 22 Oct '09

22 Oct '09

Stefan A. wrote: > Is there a function available to report the number of packets the RADIUS > Server handles at a given time? SNMP, statistics via radius (raddb/sites-available/status), or radmin. See also scripts/freeradius* for Munin plugins that can do graphing. Alan DeKok.

1 0

RE: Building a test tool
by Vinit Karandikar 22 Oct '09

22 Oct '09

Not sure how radclient will help, Tim. Based on my limited exposure, I get the impression that I can use radclient to simulate 1 network element (like the PDSN). I'm trying to simulate 10 different ones simultaneously. As mentioned in my initial email, I need the tool to simulate the PDSN, the Pre-Paid Server and hosts of other network elements (possibly 10 such like the Foreign AAA, the Carrier Exchange and so on...) Am I underestimating what the radclient can do ? > Message: 2 > Date: Mon, 1 Jun 2009 11:34:19 -0700 > From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> > Subject: RE: Building a test tool > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4a241f34.16538c0a.1328.ffffa6b7(a)mx.google.com> > Content-Type: text/plain; charset="us-ascii" > > Use the radclient tool. You can create test files that have the attributes > for the radius packets and feed them to radclient. > > NAME > radclient - send packets to a RADIUS server, show reply > > SYNOPSIS > radclient [-d raddb_directory] [-c count] [-f file] [-i id] [-n > num_requests_per_second] > [-p num_requests_in_parallel] [-r num_retries] [-s] [-S > shared_secret_file] [-t timeout] > [-qvx] server {acct|auth|status|disconnect|auto} secret > > DESCRIPTION > radclient is a radius client program. It can send arbitrary radius > packets to a radius > server, then shows the reply. It can be used to test changes you made > in the configura- > tion of the radius server, or it can be used to monitor if a radius > server is up. > > radclient reads radius attribute/value pairs from it standard input, > or from a file spec- > ified on the command line. It then encodes these attribute/value > pairs using the dictio- > nary, and sends them to the remote server. > > The User-Password and CHAP-Password attributes are automatically > encrypted before the > packet is sent to the server. > > Tim > > >> -----Original Message----- >> From: freeradius-users- >> bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org >> [mailto:freeradius-users- >> bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org] On Behalf >> Of Vinit Karandikar >> Sent: Monday, June 01, 2009 11:25 AM >> To: freeradius-users(a)lists.freeradius.org >> Subject: Building a test tool >> >> Hello folks, >> >> I'm new to Free Radius and would like to use it to build a test tool >> for >> testing a AAA server. >> >> I'd like the test tool to simulate (say) 10 network elements that talk >> to a AAA server >> - using threads on different ports that are controlled by the main >> thread. >> >> Some of these will initiate traffic to the AAA server (like the one >> simulating the PDSN). >> Others will receive traffic and talk back to the AAA server (like the >> one simulating the Pre-paid Server). >> >> I'm sure I'm not going to find something like this in the wild. So I'm >> planning to write code to do the above. >> >> I was wondering if there are bits of code that I can shamelessly pilfer >> from or use as a starting point. >> >> Any tips are plenty welcome... >> >> Thanks in advance to all, >> -Vinit >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > >

3 2

rlm_python and post-auth manipulation.
by phil lemelin 21 Oct '09

21 Oct '09

Good day Freeradius users, I am trying to use the rlm_python module to do additional actions after an user has been authenticated. To learn, I'm using the radiusd_test.py which is in the python path. I haven't found an indication that says it is impossible to do, correct me if I'm wrong off-course. I did the following ( by the way, i made sure rlm_python was compiled with the server ) : Created a python module under "modules" : python { > > mod_instantiate = radiusd_test > func_instantiate = instantiate > > mod_authorize = radiusd_test > func_authorize = authorize > > mod_accounting = radiusd_test > func_accounting = accounting > > mod_preproxy = radiusd_test > func_preproxy = preproxy > > mod_postproxy = radiusd_test > func_postproxy = postproxy > > mod_postauth = radiusd_test > func_postauth = postauth > > mod_detach = radiusd_test > func_detach = detach > } > Added "python" in the site-enabled/default "post-auth" section Now, in the radiusd -X log, I can see the following : Module: Instantiating python > python_init done > python { > mod_instantiate = "radiusd_test" > func_instantiate = "instantiate" > mod_authorize = "radiusd_test" > func_authorize = "authorize" > mod_accounting = "radiusd_test" > func_accounting = "accounting" > mod_detach = "radiusd_test" > func_detach = "detach" > } > *** instantiate *** > *Ok, i'm missing the postauth, why ?* The radiusd_test.py file has a postauth function which I think should be linked by my python modules declaration. Finnaly, in the log, I have the following : /usr/local/etc/raddb/sites-enabled/default[422]: "python" modules aren't > allowed in 'post-auth' sections -- they have no such method. > /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth > section. > Is this caused because I can't use python modules in post-auth sections, or I can't use THAT python module because it is missing the post-auth method ? Feel free to point me in the right documentation section that I MUST have missed. -- Philippe-Alexandre Lemelin

3 9

RE:
by INACIO ALVES 20 Oct '09

20 Oct '09

> But, how I said, I don't need proxy, Then I have commented the line proxy > proxy_requests = no > #$INCLUDE proxy.conf ... and broke the server (inner-tunnel processing). Well done! Now put it back the way it was. I read in the radiusd.conf # The server has proxying turned on by default. If your system is NOT # set up to proxy requests to another server, then you can turn proxying # off here. This will save a small amount of resources on the server. then I disable the proxy. But in the next line have # If you have proxying turned off, and your configuration files say # to proxy a request, then an error message will be logged. How I can turn off the proxy and my config file say proxy request? I think was this that broke my server. P.S. I have returned to default donfiguration proxy_requests = yes $INCLUDE proxy.conf Inácio Alves http://www.polluxweb.com/inacioalves/site

1 0

Invitation to connect on LinkedIn
by Nelson Acero Fino 20 Oct '09

20 Oct '09

LinkedIn ------------ Nelson Acero Fino requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Nelson Accept invitation from Nelson Acero Fino http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… View invitation from Nelson Acero Fino http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… ------------------------------------------ Why might connecting with Nelson Acero Fino be a good idea? People Nelson Acero Fino knows can discover your profile: Connecting to Nelson Acero Fino will attract the attention of LinkedIn users. See who's been viewing your profile: http://www.linkedin.com/e/wvp/inv18_wvmp/ ------ (c) 2009, LinkedIn Corporation

1 0

Session resumption problem
by David Mitchell 20 Oct '09

20 Oct '09

I was searching back in the archives, and in September there was a user who reported a problem with session resumption. I'm seeing the exact same symptoms I believe, also on Debian 5.0 with OpenSSL 0.9.8g. I never saw any follow up? Is there a fix known for this? I am using a locally compiled version of FreeRadius 2.1.7. It's linked against the system OpenSSL libraries though. Building a local 0.9.8k or even 1.0.0 is certainly an option if there is a chance it will help. Here's a snippet from the original thread. I think it was about Sept. 1st 2009. I get similar errors. Sometimes the client (an Ubuntu 9.04 Jaunty laptop) connects, but sometimes I get this resumption error. My other clients (XP, iPhone, etc.) don't seem to ever exhibit the problem. > [peap] Success > [peap] FAIL: Forcibly stopping session resumption as it is not allowed. > [eap] Freeing handler Arg. FreeRADIUS tells OpenSSL to *not* allow session resumption, and it still negotiates session resumption. Which OS are you using? Which version of OpenSSL? -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

3 5

{control:SQL-Group} in post-auth
by Anton Borisov 20 Oct '09

20 Oct '09

Hello! My user is inserted in group = my_pool in sql DB. I try to use in my sites-enabled/default something like this post-auth { ... ... if ( SQL-Group == my_pool ) { ... ... } } when my user comes I can see it : Tue Oct 20 18:49:23 2009 : Info: [sqlauth] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id ... Tue Oct 20 18:49:23 2009 : Info: [sqlauth] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE (usergroup.Username = '%{SQL-User-Name}' OR usergroup.CLID = '%{Calling-Station-Id}') AND usergroup.GroupName = radgroupcheck.GroupName AND usergroup.GroupName = '%{SQL-Group}' ORDER BY usergroup.PRIORITY,radgroupcheck.id ... Tue Oct 20 18:49:23 2009 : Info: [sqlauth] User found in group my_pool ... Ok, we can see that user is in my_pool group - this it ## point 1 #### ... Tue Oct 20 18:49:23 2009 : Info: +- entering group post-auth {...} Tue Oct 20 18:49:23 2009 : Info: ++[exec] returns noop Tue Oct 20 18:49:23 2009 : Info: ++? if (SQL-Group == pool ) Tue Oct 20 18:49:23 2009 : Info: sql_groupcmp Tue Oct 20 18:49:23 2009 : Debug: rlm_sql (sqlacct): Reserving sql socket id: 24 Tue Oct 20 18:49:23 2009 : Info: expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' OR CLID='%{Calling-Station-Id}' order by priority -> SELECT GroupName FROM usergroup WHERE UserName='bebebeb' OR CLID='bebebeb' order by priority Tue Oct 20 18:49:23 2009 : Info: sql_groupcmp finished: User is a member of group pool Tue Oct 20 18:49:23 2009 : Debug: rlm_sql (sqlacct): Released sql socket id: 24 Tue Oct 20 18:49:23 2009 : Info: ? Evaluating (SQL-Group == pool ) -> TRUE Tue Oct 20 18:49:23 2009 : Info: ++? if (SQL-Group == pool ) -> TRUE Tue Oct 20 18:49:23 2009 : Info: ++- entering if (SQL-Group == pool ) {...} Ok, we can see that because ###if ( SQL-Group == my_pool ) ### - so, radius try to use new SQL query to sql DB.. But why? In this point radius knows that user had been found in group my_pool - see ###point 1###. Can I use another world for this check?, for example if ( '%{control:SQL-Group}' == my_pool ) { .... } because in this point I know exactly that my user belong to group my_pool (see ####point 1####). If I can use previous sql-select (###point 1####), I do not have to make another SQL query every time when I use "if (SQL-Group == my_pool)" . -- Yours faithfully, Anton Borisov.

2 1

Question about Max-All-Session vs. Expiration attributes
by Cory Hill 20 Oct '09

20 Oct '09

I have a successful wifi captured portal system running with FreeRadius and HP Procurve equipment. When I originally started learning how to build it, I used WiFiGator as my first test case. When they set up that system, they used both the Max-All-Session and the Expiration attributes for all users, so I am still doing this now. We sell our time in Day, Week and Month increments, and the users are free to used the system as much as they want during their time. My Question is, do I really need to use Max-All-Session if all I really need is a hard expiration date for my users? Thank you in advance.

2 1