May 2009 - Freeradius-Users - lists.freeradius.org

Building rlm_sql_oracle
by Maxim Denisov 14 May '09

14 May '09

Hi! Has enybody successfully built freeradius 2.1.4 with instant client? I have installed oracle instant client basic 10.2.0.4 + sqlplus + sdk for linux x86_64, everything from rpm. I can successfully connect with sqlplus64, paths are correct but when I execute configure in rlm_sql_oracle I am getting checking for oracle_init in -loracleclient... no configure: WARNING: oracle libraries not found. Use --with-oracle-lib-dir=<path>. I've unsuccessfully tried to specify correct paths in --with-oracle-lib-dir, $CFLAGS and $LDFLAGS but can't find whare oracle_init() located. Can anybody say where this function located? I have the folliwing rpms installed: [root@truba rlm_sql_oracle]# rpm -qa | grep oracle oracle-instantclient-sqlplus-10.2.0.4-1 oracle-instantclient-basic-10.2.0.4-1 oracle-logos-1.1.1-3 oracle-instantclient-odbc-10.2.0.4-1 oracle-instantclient-devel-10.2.0.4-1 glade2-2.6.0-1.oracle Should I install anything else? - Regards, Maxim S. Denisov IP Studio, Inc.

3 6

undefined symbol: sql_get_socket
by Цэвээндорж ЖиМэйл 14 May '09

14 May '09

Hello, Today I've changed my OS and install FreeRADIUS 1.1.7. I got following error when I enabled sqlippool. Freeradius: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool.so: undefined symbol: sql_get_socket How do I do ? Sincerely, Tseveendorj

3 2

Log IP of RADIUS to database
by Sebastian Heil 14 May '09

14 May '09

Hello, is there an easy way to log the ip of the radius-server together with the accounting and radpostauth queries to the database. Of course it would be necessary to extend the database schema (should be now problem), but which internal variable or variable out of request can be used to be written in the database? Thanks. kind regards Sebastian -- Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dslspecial.gmx.de/freedsl-surfflat/?ac=OM.AD.PD003K11308T4569a

3 2

PEAP - Intermediate CA
by CJ O 14 May '09

14 May '09

Good Afternoon - I am having an issue where FreeRadius is not handing the intermediate CA to a windows WPA2 client. We are in the process of deploying WPA2/AES with PEAP. So we purchased a certificate from a company that has a Trusted Root CA in Windows, Mac OSX, and Linux. However, it was signed with there intermediate CA, so the OS will not vailded the certificate during authentication. The only solution seems to be installing the intermediate CA certifcate on all my clients (2,000-3,000). If it possible to chain the certificates together like you can in Apache? Thanks CJ

4 4

Need Log For Acces Request, access Accept and Access Reject
by Sanhenra Sinaga 14 May '09

14 May '09

Dear all, As the subject, i need the log that i said in the subject. Help me please...! ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Thursday, 14 May, 2009 5:33:33 PM GMT +07:00 Bangkok, Hanoi, Jakarta Subject: Freeradius-Users Digest, Vol 49, Issue 53 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Release 2.1.6 will be on Monday (Alan DeKok) 2. Re: rlm_perl to authenticate against data in ldap (Ivan Kalik) 3. question about windows users (Bartosz Chodzinski) ---------------------------------------------------------------------- Message: 1 Date: Thu, 14 May 2009 12:12:57 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Release 2.1.6 will be on Monday To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BEEA9.8000209(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Unless any last-minute panics come up. The release candidate is available on: http://git.freeradius.org/pre/ If there are no other comments, that "tar" file will become the official 2.1.6 release. Alan DeKok. ------------------------------ Message: 2 Date: Thu, 14 May 2009 11:33:05 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: rlm_perl to authenticate against data in ldap To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <61037.194.176.105.43.1242297185.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > I browsed the mailing list for possible solutions to the problem I have > but unfortunately I didn't find any (or something I missed I dunno) > > We have this Cisco ISG 7301 router that we are using that are passing the > Remote-ID av pair as its User-Name (just a copy not that it matters) > Now, the remote ID format is ascii in format but hexadecimal in meaning > 0000079d010100660000000000000000000050544e55544147303033000705000064 > > We would only want to authenticate the part after the 20 zeroes > "50544e55544147303033000705000064". By the way the length before this > substring is always fixed (18 bytes) so we only want the part after 18 > bytes. > > is it possible to parse this string in perl then passing the result string > to ldap for authentication? Yes, it will be passed as $RAD_REQUEST{'User-Name'}. Rewrite the username to what you think it should be in perl. Just list perl before ldap in authorize. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Thu, 14 May 2009 12:33:24 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: question about windows users To: Freeradius-Users(a)lists.freeradius.org Message-ID: <1f06c2db0905140333od4725cap9991b8a752510a46(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, I have freeradius with eap support on debian etch, radius v1.1.3 "everthing" working fine but I'd like to have much more simple configuration only by certificate and nothing more, so I have few question: 1. fragment of my log first, before question Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206:1812, id=182, length=159 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "PC-01\\Administrator" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001b014e4c504c2d4943455c41646d696e6973747261746f72 Message-Authenticator = 0xe0b4e2966553f890137d9e56bebd0b3d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "PC-01\Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 my users file contain: "PC-01\\Administrator" User-Password == "passwd" how can I avoid this value PC-01 ?, its really annoying, I would like to have only real user, PC-01 is "my computer -> properties -> computer name -> full computer name". I would like to have only username (with no matter of case sensitive). sth like "administrator" User-Password == "passwd" 2. I would like to use only certificate to check wheter or not some computer should have network connection, I dont care about login or password, if client has a valid cacert.pem installed on pc (windows xp) it should grant acces to network, is it possible to do that? I tried do sth like: users: DEFAULT Auth-Type := Accept but it didn't work the perfect way for me is possiblity to set up something in radiusd.conf and live file users empty 3. when I read log from freeradius -X I see that one pc need to have 7requests in freeradius and in 8-th request is accepted, is it ok? modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 193 to 192.168.5.206 port 1812 MS-MPPE-Recv-Key = 0xc349694508a365a56e56e085069e36270cb13b60c3cc7847129b2386a7062dde MS-MPPE-Send-Key = 0xf93f6de4f455056df7f1d88aa3d12a26cd1a71994fdf6c31bb726612eaf2f038 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "PC-01\\Administrator" Finished request 8 ----------------------------------------------- my configuration files: eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/freeradius/eap/newkey.pem certificate_file = /etc/freeradius/eap/newcert.pem CA_file = /etc/freeradius/eap/eapCA/cacert.pem dh_file = /etc/freeradius/eap/dh random_file = /etc/freeradius/eap/random fragment_size = 1024 include_length = yes check_crl = no } peap { default_eap_type = mschapv2 } mschapv2 { } } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = freerad group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

2 1

Re: Freeradius-Users Digest, Vol 49, Issue 51
by Sanhenra Sinaga 14 May '09

14 May '09

Dear all,, I'm a newbie.. In freeRadius, I read Station ID. Can you explain what the meaning of Station Id in freeRadius? Thank's ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Thursday, 14 May, 2009 4:27:33 PM GMT +07:00 Bangkok, Hanoi, Jakarta Subject: Freeradius-Users Digest, Vol 49, Issue 51 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Proposed release of 2.1.6 (A.L.M.Buxey(a)lboro.ac.uk) 2. Re: Proposed release of 2.1.6 (Alan DeKok) 3. Re: CoovaChilli - 'acctupdate' (Johan Meiring) 4. Re: Problems with IP address allocation, help needed (Ramm-Ericson, Johannes) 5. Re: Proposed release of 2.1.6 (A.L.M.Buxey(a)lboro.ac.uk) 6. Re: Problems with IP address allocation, help needed (A.L.M.Buxey(a)lboro.ac.uk) 7. Re: Proposed release of 2.1.6 (Alan DeKok) 8. Re: Building rlm_sql_oracle (Maxim Denisov) ---------------------------------------------------------------------- Message: 1 Date: Thu, 14 May 2009 09:32:47 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090514083247.GB6774(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > We plan on releasing 2.1.6 this week. > > Please test the pre release at: http://git.freeradius.org/pre/ > > If there are any concerns, problems, errors, etc., please let us know > before we release the final version. a quick request....the mschap module comes with example ntlm_auth line which now uses deprecated method - as the complaints when you try using it will testify...can this: #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challen ge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" be changed to #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" thanks alan ------------------------------ Message: 2 Date: Thu, 14 May 2009 10:36:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BD823.6000205(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, >> We plan on releasing 2.1.6 this week. >> >> Please test the pre release at: http://git.freeradius.org/pre/ >> >> If there are any concerns, problems, errors, etc., please let us know >> before we release the final version. > > a quick request....the mschap module comes with example ntlm_auth line > which now uses deprecated method - as the complaints when you try using > it will testify...can this: Ok... that's small enough that I think it can wait for the next version. Alan DeKok. ------------------------------ Message: 3 Date: Thu, 14 May 2009 10:48:25 +0200 From: Johan Meiring <jmeiring(a)pcservices.co.za> Subject: Re: CoovaChilli - 'acctupdate' To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BDAD9.60205(a)pcservices.co.za> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: > wlanmac wrote: >> For what it's worth, CoovaChilli supports an option called 'acctupdate' >> which will allow for "updated" provisioning attributes to be returned to >> the NAS in accounting response. Yes, it's not very RFC compliant, but >> certainly helpful when you don't have the ability to send CoA requests >> to the NAS. > > It's not actually forbidden by the RFC's, or by the (new) RADIUS > design guidelines document. It's not a bad idea, quite frankly. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > I for one use it quite extensively, and it works very well! Without it you cannot safely allow dual logins. (e.g. if a user with 100MB left, logs in twice at the same time, he will get 200MB) -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 ------------------------------ Message: 4 Date: Thu, 14 May 2009 10:53:10 +0200 From: "Ramm-Ericson, Johannes" <Johannes.Ramm-Ericson(a)sonyericsson.com> Subject: Re: Problems with IP address allocation, help needed To: "'freeradius-users(a)lists.freeradius.org'" <freeradius-users(a)lists.freeradius.org> Message-ID: <1B6DFC4AB624B04FBF99FF21371C88E40BEFA6F3(a)SELDMBX04.corpusers.net> Content-Type: text/plain; charset="us-ascii" Alan de Kok wrote: >Ramm-Ericson, Johannes wrote: > As (nearly) always, the debug output is instructive: > >> Following are extracts from the debug log that exemplify a working >> instance with GLANA and a failing instance with CBJN: >... >> **************** Failing instance with CBJN **************** >... >> +- entering group post-auth {...} >... >> ++[GLANA] returns noop > > ... and no reference to CBJN. > > Perhaps listing "CBJN" in the "post-auth" section would be a good >idea. If it's not listed, the module isn't called, and it doesn't >allocate IP addresses. > > Alan DeKok. OK, fair enough, I can agree that that is what it looks like. Trouble is though that CBJN is listed together with GLANA in the post-auth section where the ippools are configured. So, for some reason the server is not acknowledging that part of the configuration. Sure, I may definitely be doing something wrong. At this point I just don't have a clue as to where it is I'm going wrong... Thanks, Johannes ------------------------------ Message: 5 Date: Thu, 14 May 2009 10:14:07 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090514091407.GA6817(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Ok... that's small enough that I think it can wait for the next version. okay - by the way, the download link on deployingradius.com is for 2.1.1 - any reason for love of this old version rather than eg 2.1.3 ? :-) alan ------------------------------ Message: 6 Date: Thu, 14 May 2009 10:19:36 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Problems with IP address allocation, help needed To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090514091936.GD6817(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > OK, fair enough, I can agree that that is what it looks like. Trouble is > though that CBJN is listed together with GLANA in the post-auth section > where the ippools are configured. So, for some reason the server is not > acknowledging that part of the configuration. Sure, I may definitely be > doing something wrong. At this point I just don't have a clue as to where > it is I'm going wrong... copy of the config? is it reading the post-auth section you think it is - ie in the correct virtual server file or some other one? alan ------------------------------ Message: 7 Date: Thu, 14 May 2009 11:26:27 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BE3C3.8020604(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, > >> Ok... that's small enough that I think it can wait for the next version. > > okay - by the way, the download link on deployingradius.com is for 2.1.1 > - any reason for love of this old version rather than eg 2.1.3 ? :-) Lack of updates... I'll got fix that once 2.1.6 is released. Alan DeKok. ------------------------------ Message: 8 Date: Thu, 14 May 2009 13:27:25 +0400 From: Maxim Denisov <kbessmertniy(a)gmail.com> Subject: Re: Building rlm_sql_oracle To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <90ec93e70905140227y2f4a9134j33a8e7cf88d585cd(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Thank you for your reply. I alredy built it, the problem was in configure file logic - it tried to detect oracle version by looking for $ORACLE_HOME variable and if it is absent it mentioned that you have 8i. Also I didn't find where --with-oracle-include-dir used and I changed the pathes in configure file. Now I have successfully compiled freeradius with the following keys: ./configure --enable-shared --disable-static --with-gnu-ld --with-threads --with-thread-pool --disable-ltdl-install --without-rlm-sql_postgresql --without-rlm-sql_mysql --with-rlm-sql --with-rlm-sql_oracle --with-oracle-home-dir=/usr/lib/oracle/10.2.0.4/client64--with-oracle-lib-dir=/usr/lib/oracle/ 10.2.0.4/client64/lib --with-oracle-include-dir=/usr/include/oracle/ 10.2.0.4/client64 Everything works fine except oracle - radiusd is not linked to rlm_sql_oracle.so root@truba:~/freeradius-server-2.1.4# ldd /usr/local/sbin/radiusd libfreeradius-radius-2.1.5.so => /usr/local/lib/ libfreeradius-radius-2.1.5.so (0x0000002a95579000) libnsl.so.1 => /lib64/libnsl.so.1 (0x000000322bc00000) libresolv.so.2 => /lib64/libresolv.so.2 (0x0000003225100000) libpthread.so.0 => /lib64/tls/libpthread.so.0 (0x0000003224900000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x000000322b400000) libltdl.so.3 => /usr/lib64/libltdl.so.3 (0x0000003ab6700000) libssl.so.4 => /lib64/libssl.so.4 (0x0000003228000000) libcrypto.so.4 => /lib64/libcrypto.so.4 (0x0000003227900000) libc.so.6 => /lib64/tls/libc.so.6 (0x0000003223e00000) /lib64/ld-linux-x86-64.so.2 (0x0000003223c00000) libdl.so.2 => /lib64/libdl.so.2 (0x0000003224300000) libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x0000003227c00000) libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x0000003227e00000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x0000003227500000) libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x0000003227700000) libz.so.1 => /usr/lib64/libz.so.1 (0x0000003224f00000) root@truba:~/freeradius-server-2.1.4# ldd /usr/local/lib/ libfreeradius-radius-2.1.5.so libc.so.6 => /lib64/tls/libc.so.6 (0x0000002a95698000) /lib64/ld-linux-x86-64.so.2 (0x000000552aaaa000) Can anybody tell me what have I done wrong? 2009/5/14 Alan DeKok <aland(a)deployingradius.com> > Maxim Denisov wrote: > > Has enybody successfully built freeradius 2.1.4 with instant client? > > Yes. It sometimes takes a bit of fighting, but it works. > > > I have installed oracle instant client basic 10.2.0.4 + sqlplus + sdk > > for linux x86_64, everything from rpm. I can successfully connect with > > sqlplus64, paths are correct but when I execute configure in > > rlm_sql_oracle I am getting > > If configure doesn't work, don't worry. Just edit the file > ..../rlm_sql_oracle/Makefile directly. > > The only magic I've found is 32/64-bit issues. You might have to link > explicitly to a particular library, rather than using "-l". > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

rlm_perl to authenticate against data in ldap
by Vincent Arniego 14 May '09

14 May '09

Hi Everyone, I browsed the mailing list for possible solutions to the problem I have but unfortunately I didn't find any (or something I missed I dunno) We have this Cisco ISG 7301 router that we are using that are passing the Remote-ID av pair as its User-Name (just a copy not that it matters) Now, the remote ID format is ascii in format but hexadecimal in meaning 0000079d010100660000000000000000000050544e55544147303033000705000064 We would only want to authenticate the part after the 20 zeroes "50544e55544147303033000705000064". By the way the length before this substring is always fixed (18 bytes) so we only want the part after 18 bytes. is it possible to parse this string in perl then passing the result string to ldap for authentication? Or will we use ldap inside rlm_perl? Just to add, we also want to check the first 4 bytes (0000079d) if it is not in this format, we'll treat the whole user-id as a whole. Thank you in advanced. Vincent

3 2

Release 2.1.6 will be on Monday
by Alan DeKok 14 May '09

14 May '09

Unless any last-minute panics come up. The release candidate is available on: http://git.freeradius.org/pre/ If there are no other comments, that "tar" file will become the official 2.1.6 release. Alan DeKok.

1 0

Re: how to limiting user bandwidth by quota..
by Nizar Zulmi 14 May '09

14 May '09

thank you ahmed..which script??is that script belongs to freeradius or.. iam using chillispot, as alan sugest me there is no specified attribute to do limiting bandwidth by quota,.do you know what type attribut of chillispot can do this??or you can give simple or detailed tutorial to do so please.. --- On Thu, 5/14/09, ahmed adel <ahmedadel4eg(a)yahoo.com> wrote: From: ahmed adel <ahmedadel4eg(a)yahoo.com> Subject: Re: how to limiting user bandwidth by quota.. To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, May 14, 2009, 2:36 PM You can use a script that disconnect the user as soon as the user exceeds his limit. You should check for the bandwidth usage in the Input Octets and the Output Octets Fields Best Regards Ahmed Adel From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, May 13, 2009 11:22:38 PM Subject: Re: how to limiting user bandwidth by quota.. > dear all..i'am using freeradius 1.1.7 on ubuntu 8.04, i do implementing > sqlcounter like noresetcounter,dailycounter and montly counter and it > works properly. but i now i have 1 case how to limiting user bandwidth > usage with sqlcounter, i've read and learn how do sqlcounter work, but i > still dont have idea how to make a query to limiting user bandwidth. > i have 1 user and i want to limit the bandwidth for this user 300mb in a > week..how to perform this..clue please..really apreciate for your help Time counters work with Session-Timeout. There is no standard radius attribute for data counters - you have to use vendor specific ones. If your NAS vendor has data limiting attributes, then this can be done. If it doesn't - it can't. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Problems with IP address allocation, help needed
by Ramm-Ericson, Johannes 14 May '09

14 May '09

Alan de Kok wrote: >Ramm-Ericson, Johannes wrote: > As (nearly) always, the debug output is instructive: > >> Following are extracts from the debug log that exemplify a working >> instance with GLANA and a failing instance with CBJN: >... >> **************** Failing instance with CBJN **************** >... >> +- entering group post-auth {...} >... >> ++[GLANA] returns noop > > ... and no reference to CBJN. > > Perhaps listing "CBJN" in the "post-auth" section would be a good >idea. If it's not listed, the module isn't called, and it doesn't >allocate IP addresses. > > Alan DeKok. OK, fair enough, I can agree that that is what it looks like. Trouble is though that CBJN is listed together with GLANA in the post-auth section where the ippools are configured. So, for some reason the server is not acknowledging that part of the configuration. Sure, I may definitely be doing something wrong. At this point I just don't have a clue as to where it is I'm going wrong... Thanks, Johannes

2 1