April 2009 - Freeradius-Users - lists.freeradius.org

Re: billing using radius
by Eric 13 Apr '09

13 Apr '09

> > Thanks parham, I'm new in freeradius. could you please send me configs needed in freeradius files? I want to disconnect some users after receiving 8G and for others I want to calculate base on KB that they have used rather than 8G. In which file I should do changes? > > > Message: 1 > Date: Sun, 12 Apr 2009 14:45:21 +0430 > From: "Parham Beheshti" <p_beheshti(a)rasana.net> > Subject: RE: billing using radius > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org>, > <freeradius-users(a)lists.freeradius.org> > Message-ID: <ED57DEBBACDAFF43A9ABD14FF9CBD1E82BB823(a)mail.rasana.ir> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > Well, this can be very simple ... or very complicated ... > I'm doing traffic based accounting with freeradius and have been more then > happy. > Our scenario is pretty complicated, it involves different pricing KB for > day of week/time of day, users are able to purchase additional credit,etc. > to get you started: > > 1. you can get user's traffic (acctinputoctets+acctoutputoctets) for a > given time period and don't let the user login next time he/she wants to > access the service. This will take care of not letting users over the quota > to login... > > 2. you can check your online users periodically send COA (Disconnect > packet) if user's traffic is above your limit... > > 3. you may have very long sessions(days, weeks or months) that cross > bounderies for example: 10GB/week and have sessions longer then week. to > solve this issue you need to have interim-update packets from your NAS, the > nas will send you packets regularly... use this against your old data to > calculate how much traffic was used. create a daily traffic table and update > it with calculated amount. use counters based on the dailytraffic. > > depending on number of users you have you may need to partition your daily > traffic table. > > this solution scales pretty good: > we have about 50,000 broadband users, 5 minute interim-update and we have > hourly and daily traffic information tables. we are no where near our limits > and freeradius/mysql is scaling very well. (10% load) > > You will be better off to do all this calculation in stored procedures > instead of queries ... > Let me know if you need more info > > Cheers, > Parham > > > ------------------------------------------------------------------------------------------ > > > Hi, > I use freeradius server for accounting of vpn users.I use monthly counter > to limit users but now I want if user's traffic is rather than specific > amount, I will be able to have billing for them and to disconnect some of > them. Is it possible to have billing with config in freeradius or a new > software is needed? > could radius disconnect users based on amount of traffic not counters? > > > > End of Freeradius-Users Digest, Vol 48, Issue 48 > ************************************************ >

1 0

Help userpassword attribute requird
by Basant Agarwal 12 Apr '09

12 Apr '09

Hello, I am using freeradius-1.1.7 . i am using the default configuration with a local user whose entry is in users file . now when i try from localhost it works.. But when i try from laptop it shows error that user password attribute requird ..!!! what should i do...? rad_recv: Access-Request packet from host 172.16.1.205:3072, id=0, length=125 User-Name = "basant" NAS-IP-Address = 172.16.1.205 Called-Station-Id = "001a70aa5bee" Calling-Station-Id = "001b777bdffa" NAS-Identifier = "001a70aa5bee" NAS-Port = 30 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000b01626173616e74 Message-Authenticator = 0xda9d5f6bde06b199a7cbb321e26604cc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "basant", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry basant at line 100 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 172.16.1.205 port 3072 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 49dffaf3 Nothing to do. Sleeping until we see a request.

2 1

billing using radius
by Eric 12 Apr '09

12 Apr '09

Hi, I use freeradius server for accounting of vpn users.I use monthly counter to limit users but now I want if user's traffic is rather than specific amount, I will be able to have billing for them and to disconnect some of them. Is it possible to have billing with config in freeradius or a new software is needed? could radius disconnect users based on amount of traffic not counters?

2 1

rlm_perl behavior
by Apostolos Pantsiopoulos 12 Apr '09

12 Apr '09

I updated my server from 2.0.x to 2.1.4 and found out that the rlm_perl config now resides in the /module directory. I noticed that the following directives : max_clones = 10 start_clones = 5 min_spare_clones = 1 max_spare_clones = 5 max_request_per_clone = 100 for perl were not present in the file after the compiling. Are these directives obsolete? Also, in my perl script I make use of the CLONE function that according to the wiki is the ideal place to initialize database handlers. This seemed to work fine for the last 2 years with 1.x and 2.0.x freeradius. Using the parameters above and the CLONE function I could see 10 connections to my mysql server from the moment radiusd was up. When I migrated to 2.1.x the CLONE function seems to be called only after the first radius packet arrives (which is not an issue really). But when I check my connections to the mysql server there seems to be only one...! Was the behavior of rlm_perl altered in any way? I want to have multiple instances of rlm_perl so that I can connect to different databases simultaneously and spread the load. -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com R & D email: regs(a)kinetix.gr -------------------------------------------

2 4

How to cleanup cisco dhcp inserted attributes ?
by Jarkko Torppa 11 Apr '09

11 Apr '09

What would be good way to cleanup attributes that are generated by cisco's dhcp snooping/inserting ? User-Name = "\001\026harjuniitty-ftth-sw1_6" ADSL-Agent-Circuit-Id = "\001\026harjuniitty-ftth-sw1_6" ADSL-Agent-Remote-Id = "\001\024harjuniitty-ftth-sw1" Id like to strip that type 0x01 and length from data so that I would have "harjuniitty-ftth-sw1_6" for user-name. I did'nt see anything obivous in unlang that could do this, and created hack in rlm_preprocess.c As a background, cisco switch snoops dhcp-packet and inserts it's name and port into Option82 of dhcp-packet which is then forwarded to dhcp- relay that first authenticates that request via radius server.

2 1

RE: Dear freeradius-users@list.xs4all.nl Pharmacy Message 2693120
by VIAGRA � Official Site 11 Apr '09

11 Apr '09

About this mailing: You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice. ©2009 Microsoft | Unsubscribe at http://newmeek.com | More news at http://newmeek.com | Prvacy at http://newmeek.com Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

1 0

freeradius-server-2.1.4 make fails
by Thor Spruyt 10 Apr '09

10 Apr '09

Hi, I'm trying to compile freeradius-server-2.1.4 on CentOS 4.6 32-bit Configure command: ./configure --prefix=/opt/freeradius-2.1.4 --with-mysql --with-postgresql --with-openldap --without-snmp --without-openssl --without-krb5 --without-vmps But make fails: /home/thor/freeradius-server-2.1.4/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/thor/freeradius-server-2.1.4/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.5\" -DNO_OPENSSL -c listen.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/thor/freeradius-server-2.1.4/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.5\" -DNO_OPENSSL -c listen.c -fPIC -DPIC -o .libs/listen.o listen.c: In function `client_listener_find': listen.c:126: warning: passing arg 1 of pointer to function discards qualifiers from pointer target type listen.c:206: warning: assignment discards qualifiers from pointer target type In file included from listen.c:1053: command.c: In function `command_show_client_config': command.c:845: warning: passing arg 2 of `cf_section2file' discards qualifiers from pointer target type listen.c: In function `listen_init': listen.c:1795: error: `RAD_LISTEN_VQP' undeclared (first use in this function) listen.c:1795: error: (Each undeclared identifier is reported only once listen.c:1795: error: for each function it appears in.) gmake[4]: *** [listen.lo] Error 1 gmake[4]: Leaving directory `/home/thor/freeradius-server-2.1.4/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/thor/freeradius-server-2.1.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/thor/freeradius-server-2.1.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/thor/freeradius-server-2.1.4' make: *** [all] Error 2 Any idea what's going wrong? Regards, Thor Spruyt

3 2

Sending Access-Challenge
by Laszlo Fekete 10 Apr '09

10 Apr '09

Hello! I'm new to this list and don't found archive or something where maybe somebody answered my question. So I want a radius server to wifi auth with eap-ttls/peap, ldap and not plain-text passwords. I downloaded 2.1.4 source and create debian package without modification, do some basic configuration and testing, radtest from local is fine, but radeapclient eap-md5 testing fail. I saw this on server side: rad_recv: Access-Request packet from host 127.0.0.1 port 52650, id=76, length=69 User-Name = "steve" NAS-IP-Address = 127.0.0.1 Message-Authenticator = 0xafa8ae1b1aaa6fb0a6cbd0719b507e94 NAS-Port = 0 EAP-Message = 0x02d2000a017374657665 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 210 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry steve at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 76 to 127.0.0.1 port 52650 Service-Type = Framed-User Framed-Protocol = SLIP Framed-IP-Address = 192.20.126.200 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x01d300160410b7703d97cfb88bff2835ec9a9aedde83 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xae48086bae9b0cd33d7dacc7cd15f18d Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 76 with timestamp +94 Ready to process requests. And this on client side (local): # radeapclient -s -X localhost auth testing123 About to send encoded packet: User-Name = "steve" Cleartext-Password = "testing" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "steve" Message-Authenticator = 0x30 NAS-Port = 0 Received response ID 76, code 11, length = 131 Service-Type = Framed-User Framed-Protocol = SLIP Framed-IP-Address = 192.20.126.200 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x01d300160410b7703d97cfb88bff2835ec9a9aedde83 Message-Authenticator = 0xe65c832fea00201e76a340cc0e38cf37 State = 0xae48086bae9b0cd33d7dacc7cd15f18d <+++ EAP decoded packet: Service-Type = Framed-User Framed-Protocol = SLIP Framed-IP-Address = 192.20.126.200 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x01d300160410b7703d97cfb88bff2835ec9a9aedde83 Message-Authenticator = 0xe65c832fea00201e76a340cc0e38cf37 State = 0xae48086bae9b0cd33d7dacc7cd15f18d EAP-Id = 211 EAP-Code = Request EAP-Type-MD5 = 0x10b7703d97cfb88bff2835ec9a9aedde83 +++> About to send encoded packet: User-Name = "steve" Cleartext-Password = "testing" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Type-MD5 = 0x106e2008d8fc099a16335131c045fc6df6 State = 0xae48086bae9b0cd33d7dacc7cd15f18d ^C # cat re.txt User-Name = "steve" Cleartext-Password = "testing" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "steve" Message-Authenticator = 0 NAS-Port = 0 What's wrong with the configuration? Thank you: blackluck

3 5

freeradius crashes if can not connect to mysql
by Oguzhan Kayhan 10 Apr '09

10 Apr '09

Hello, I noticed that..if a network error or another connection problem occurs between freeradius and mysql server, freeradius service just exits... And sure service stops automatically. Is there any way to give a timeout value or retry number for mysql in freeradius configuration that prevents freeradius to exit abnormally in that case.. Thanks..

1 0

Freeradius server not starting!
by ramesh p 10 Apr '09

10 Apr '09

[root@localhost log]# /usr/local/fnmt/etc/init.d/radiusd start Starting FreeRADIUS:Fri Apr 10 05:52:13 2009 : Info: Starting - reading configuration files ... radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_exec: Wait=yes but no output defined. Did you mean output=none?) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql (sql): Attempting to connect to radius@localhost:/LWT) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #0) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #1) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #2) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #3) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #4) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (Failed creating PID file /usr/local/fnmt/var/run/radiusd/radiusd.pid: Permission denied ) radiusd Please suggest me. Regards, Ramesh.

3 13