May 2009 - Freeradius-Users - lists.freeradius.org

Re: insert something into reply message
by Lajos Meszaros 21 May '09

21 May '09

>Post the output of radiusd -X and your user entry. The relevant part of the freeradius output is: ----------------------------------- rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "tequet" Digest-Nonce = "4a1527742cb58a911390a13daeab535c71b92a74" Digest-URI = "sip:" Digest-Method = "INVITE" Digest-CNonce = "1242900340" Digest-Nonce-Count = "00000001" Digest-QOP = "auth" Digest-User-Name = "user8" A1 = user8:tequet:pass8 A2 = INVITE:sip: H(A1) = 1a2bb1fd4713741dbc8dcd841b2754c5 H(A2) = 4c2df2005737eb44dbf0c9993285dc46 KD = 1a2bb1fd4713741dbc8dcd841b2754c5:4a1527742cb58a911390a13daeab535c71b92a74:00000001:1242900340:a uth:4c2df2005737eb44dbf0c9993285dc46 EXPECTED 10c0611670df125d841de06019a0ecd7 RECEIVED 10c0611670df125d841de06019a0ecd7 ++[digest] returns ok Login OK: [599(a)10.14.2.10/<via Auth-Type = DIGEST>] (from client 10.14.1.5 port 0 cli 599(a)10.14.2.10 ) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 199 to 10.14.1.5 port 40646 Finished request 0. Going to the next request -------------------------------------- The end of the "users" file (its other part is unchanged) --------------------------------------- user0 Cleartext-Password := "pass0" "user8" Cleartext-Password := "pass8" "599(a)10.14.2.10" Cleartext-Password := "pass8" ------------------------------------- Ludwig M.

1 0

Sql Counter reads only the first 4 digits
by Mauro Iorio - Smart Soft s.r.l. 21 May '09

21 May '09

Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

4 11

Realms issues
by EMP 21 May '09

21 May '09

Hi all I have an issue where i'm trying to use realms to determine what LDAP server to authenticate a user against. What seems to happen is that the realm in my users file is never matched and hence the authentication fails. Any help would be greatly appreciated. My users file is - DEFAULT Realm == "NULL", Auth-Type := ldap-default, Autz-Type := ldap-default DEFAULT Realm == "test.com", Auth-Type :=test.com, Autz-Type := test.com DEFAULT Auth-Type := Reject my proxy.conf has the following - realm test.com { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } The radius.conf is - prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = /etc/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run log_file = ${logdir}/radiusd.log pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd libdir = /usr/lib/freeradius max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 256 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 1 max_servers = 4 min_spare_servers = 1 max_spare_servers = 3 max_requests_per_server = 0 } modules { pap { #auto_header = yes encryption_scheme = crypt } chap { authtype = CHAP } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes authtype = MS-CHAP # with_ntdomain_hack = yes } files { usersfile = ${confdir}/users compat = no } ### Added ldap test.com { server = "ldap1.test.com" #port = 389 port = 636 identity = "cn=xxxx" password = "xxx" basedn = "o=xxx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" tls_mode = yes tls_cacertfile = /etc/raddb/certs/cert.b64 tls_cacertdir = /etc/raddb/certs/ dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = yes password_attribute = nspmPassword } ldap ldap-default { server = "ldap1.test.com" #port = 389 port = 636 identity = "cn=xxxl" password = "xxx" basedn = "o=xxx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" tls_mode = yes tls_cacertfile = /etc/raddb/certs/cert.b64 tls_cacertdir = /etc/raddb/certs/ dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = yes password_attribute = nspmPassword } ### // realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } ### Added Auth-Type test.com { test.com } Auth-Type ldap-default { ldap-default } ### // eap } authorize { chap mschap eap files ### Added Autz-Type test.com { test.com } Autz-Type ldap-default { ldap-default } ### // } post-auth { ldap-default Post-Auth-Type REJECT { ldap-default } } I then see the following - rad_recv: Access-Request packet from host xxx:40485, id=38, length=63 User-Name = "auto(a)test.com" User-Password = "xx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 9 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [auto(a)test.com/xxx] (from client xxx port 0) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 2 modcall[post-auth]: module "ldap-default" returns noop for request 2 modcall: leaving group REJECT (returns noop) for request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list ---

2 1

Re: Interim Accounting
by Ming-Ching Tiew 21 May '09

21 May '09

--- On Thu, 5/21/09, Ivan Kalik <tnt(a)kalik.net> wrote: > > > I just checked Coova chilli, it does it for the > clients session > > based on a configurable interval. But for the > administrative > > account of the NAS itself, it does not do any interim > > accounting. > > Why on Earth would it? Are you going to charge > administrators for using > your equipment? Or do you actually pay them to do that? > I did not say it does not make sense, did I ? I just put forward my observations. :) However, now that you are talking about it, I think it's not totally unreasonable to want to get accounting update on the 'administrator' account. There maybe cases where the accounting need to be done on ensamble basis of the traffic coming in/out of the whole box. Any agreement or objection ? :)

1 0

FreeRADIUS 2.1.6 RPM's for Fedora, RHEL 5, CentOS 5
by John Dennis 20 May '09

20 May '09

The new 2.1.6 FreeRADIUS has been built into a set of RPM's for Fedora, RHEL 5, and CentOS 5. For Fedora the rpm's are in the updates-testing repository for F-9 and F-10. The next release of Fedora is F-11 and is due out shortly, it is currently in the process of being composed for release and is locked preventing updates. F-11 still has the 2.1.3 version, but as soon as F-11 is released and the update channel opens for F-11 I will push a 2.1.6 update for F-11. The updates will likely stay in testing for two weeks, if there are no problems they'll be promoted to stable. Feedback on the Fedora 2.1.6 updates is welcome, this helps determine if the packages can be promoted to stable. Please report your experience with the package at the Fedora updates site: https://admin.fedoraproject.org/updates/search/freeradius Locate the package you installed, click on it, scroll to the bottom and add a comment. As promised current pre-built FreeRADIUS RPM's are now available for download on a tech preview basis, refer to the information here: http://wiki.freeradius.org/Red_Hat_FAQ The download site is: http://people.redhat.com/jdennis/freeradius-rhel-centos -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

RE: Freeradius-Users Digest, Vol 49, Issue 93
by Ivan Kalik 20 May '09

20 May '09

> >>What does that mean? IP of the original NAS packet? > > I have 2 interfaces towards the network. > > ____________________________________________________________________________ > Radius Client --> Radius Proxy > 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > 192.168.24.3 --> IPS2(192.168.24.4) > ____________________________________________________________________________ > > Steps: > 1)Radius Client ---> Send packet with NAS-IP-Address = 192.168.1.2 > towards Radius Proxy. > 2)Radius Proxy changes NAS-IP-Address with 192.168.14.3 for IPS1(or > 192.168.24.3 for IPS2) and sends it. > > > You say that changing NAS-IP-Address the packet is transmitted correctly. > Right? > > From 192.168.14.3 to IPS1(192.168.14.4) if NAS-IP-Address = > 192.168.14.3 > From 192.168.24.3 to IPS1(192.168.24.4) if NAS-IP-Address = > 192.168.24.3 > Yes. Proxy server will change NAS-IP-Address from the original NAS address into it's own. That is OK. >> That's in internal attribute Packet-Src-IP-Address. > > Should I modify this attribute or FreeRadius associates > Packet-Src-IP-Address = NAS-IP-Address. No, Packet-Src-IP-Address has the originating IP address for the radius packet (in your case it will be 192.168.1.2). If ISP needs to know the original NAS IP they should look in Packet-Src-IP-Address. Ivan Kalik Kalik Informatika ISP

1 0

question about windows users
by Bartosz Chodzinski 20 May '09

20 May '09

Hi, I have freeradius with eap support on debian etch, radius v1.1.3 "everthing" working fine but I'd like to have much more simple configuration only by certificate and nothing more, so I have few question: 1. fragment of my log first, before question Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206:1812, id=182, length=159 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "PC-01\\Administrator" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001b014e4c504c2d4943455c41646d696e6973747261746f72 Message-Authenticator = 0xe0b4e2966553f890137d9e56bebd0b3d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "PC-01\Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 my users file contain: "PC-01\\Administrator" User-Password == "passwd" how can I avoid this value PC-01 ?, its really annoying, I would like to have only real user, PC-01 is "my computer -> properties -> computer name -> full computer name". I would like to have only username (with no matter of case sensitive). sth like "administrator" User-Password == "passwd" 2. I would like to use only certificate to check wheter or not some computer should have network connection, I dont care about login or password, if client has a valid cacert.pem installed on pc (windows xp) it should grant acces to network, is it possible to do that? I tried do sth like: users: DEFAULT Auth-Type := Accept but it didn't work the perfect way for me is possiblity to set up something in radiusd.conf and live file users empty 3. when I read log from freeradius -X I see that one pc need to have 7requests in freeradius and in 8-th request is accepted, is it ok? modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 193 to 192.168.5.206 port 1812 MS-MPPE-Recv-Key = 0xc349694508a365a56e56e085069e36270cb13b60c3cc7847129b2386a7062dde MS-MPPE-Send-Key = 0xf93f6de4f455056df7f1d88aa3d12a26cd1a71994fdf6c31bb726612eaf2f038 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "PC-01\\Administrator" Finished request 8 ----------------------------------------------- my configuration files: eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/freeradius/eap/newkey.pem certificate_file = /etc/freeradius/eap/newcert.pem CA_file = /etc/freeradius/eap/eapCA/cacert.pem dh_file = /etc/freeradius/eap/dh random_file = /etc/freeradius/eap/random fragment_size = 1024 include_length = yes check_crl = no } peap { default_eap_type = mschapv2 } mschapv2 { } } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = freerad group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

4 43

RE: Freeradius-Users Digest, Vol 49, Issue 93
by Marco De Magistris 20 May '09

20 May '09

>What does that mean? IP of the original NAS packet? I have 2 interfaces towards the network. ____________________________________________________________________________ Radius Client --> Radius Proxy 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) 192.168.24.3 --> IPS2(192.168.24.4) ____________________________________________________________________________ Steps: 1)Radius Client ---> Send packet with NAS-IP-Address = 192.168.1.2 towards Radius Proxy. 2)Radius Proxy changes NAS-IP-Address with 192.168.14.3 for IPS1(or 192.168.24.3 for IPS2) and sends it. You say that changing NAS-IP-Address the packet is transmitted correctly. Right? From 192.168.14.3 to IPS1(192.168.14.4) if NAS-IP-Address = 192.168.14.3 From 192.168.24.3 to IPS1(192.168.24.4) if NAS-IP-Address = 192.168.24.3 > That's in internal attribute Packet-Src-IP-Address. Should I modify this attribute or FreeRadius associates Packet-Src-IP-Address = NAS-IP-Address. Thanks again Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 14.12 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 93 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Freeradius-Users Digest, Vol 49, Issue 89 (Ivan Kalik) 2. Re: Long attribute name (Alan DeKok) 3. Sql Counter reads only the first 4 digits (Mauro Iorio - Smart Soft s.r.l.) 4. Re: question about windows users (Bartosz Chodzinski) 5. Re: Sql Counter reads only the first 4 digits (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 12:44:28 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Freeradius-Users Digest, Vol 49, Issue 89 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <41583.194.176.105.44.1242819868.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > The problem is the following: > > The customers ask me if possible send them the packets from an > interface defined. What does that mean? IP of the original NAS packet? That's in internal attribute Packet-Src-IP-Address. > My Radius proxy listen on an IP address (i.e. 192.168.1.3) for > authentication packet and forwarding them towards two different networks > (i.e. 192.168.14.4(Customer1) and 192.168.24.4(Customer2)) Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 2 Date: Wed, 20 May 2009 13:50:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Long attribute name To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A13EE8B.1000301(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ming-Ching Tiew wrote: > > I know it's almost trivial to go an alter the table column size, but for users convenience, the sql attribute length should be increased. Currently the schema.sql which comes with the distribution is varchar(32). One of the motorola wimax attributes is 39 characters, Motorola-WiMAX-Maximum-Commit-Bandwidth. And I notice the mysql silently truncate the inserted string. That's reasonable. Alan DeKok. ------------------------------ Message: 3 Date: Wed, 20 May 2009 13:58:32 +0200 From: "Mauro Iorio - Smart Soft s.r.l." <m.iorio(a)smartsoft.it> Subject: Sql Counter reads only the first 4 digits To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <370DA20735BC482C80A4249BF39468B5@zuccherino> Content-Type: text/plain; charset="us-ascii" Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

1 0

OTP PAM FreeRadius module supporting challenge-respons
by Jayal1972 20 May '09

20 May '09

Hi all! Do anyone know about a FreeRadius module supporting OTP PAM challenge-respons. I know about the OTP module in FreeRadius but it´s supporting a built in database. I have configured Freeradius to use the PAM module and OTP software is supporting PAM as well. But it is using a challenge-respons mechanism so the message i.e. "Enter OTP Password" is not reaching the user (after the username have been confirmed). The FreeRadius is then sending the authentication details "username/password" again and the OTP software is only seeing the "username" part of the "username/password". Do anyone had a similar issue? Sincerely Joakim -- View this message in context: http://www.nabble.com/OTP-PAM-FreeRadius-module-supporting-challenge-respon… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Long attribute name
by Ming-Ching Tiew 20 May '09

20 May '09

I know it's almost trivial to go an alter the table column size, but for users convenience, the sql attribute length should be increased. Currently the schema.sql which comes with the distribution is varchar(32). One of the motorola wimax attributes is 39 characters, Motorola-WiMAX-Maximum-Commit-Bandwidth. And I notice the mysql silently truncate the inserted string. Regards.

2 1