August 2009 - Freeradius-Users - lists.freeradius.org

rlm_pool problem
by up＠3.am 27 Aug '09

27 Aug '09

I've had FreeRadius 2.1.6 running ippools fine on one linux server and just installed it on a new one. They run with --prefix=/usr on both servers, which neccessitated me putting /usr/lib in /etc/ld.so.conf to get rlm_ippool to load on the new server. I copied over the old raddb tree, but when I start radiusd in debug, I get this: Module: Linked to module rlm_ippool Module: Instantiating medium_pool ippool medium_pool { session-db = "/usr/etc/raddb/db.medium_ippool" ip-index = "/usr/etc/raddb/db.medium_ipindex" key = "%{NAS-IP-Address} %{NAS-Port}" range-start = 172.16.31.101 range-stop = 172.16.31.253 netmask = 255.255.255.0 cache-size = 251 override = yes maximum-timeout = 0 } rlm_ippool: Failed to open file /usr/etc/raddb/db.medium_ippool: Invalid argument /usr/etc/raddb/radiusd.conf[1824]: Instantiation failed for module "medium_pool" /usr/etc/raddb/sites-enabled/default[337]: Failed to find module "medium_pool". /usr/etc/raddb/sites-enabled/default[314]: Errors parsing accounting section. the db files for the pools, in this case: /usr/etc/raddb/db.medium_ippool do exist as chmod 600 root.wheel, just like the old server. We run as root to auth against shadow passwords. What did I miss? James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

1 1

Copy of accounting packets
by kokkola＠anonymizer.cz 27 Aug '09

27 Aug '09

Hello. I am trying to setup FreeRadius server so it proxies all requests to Server1 and also sends copy of accounting packets to Server2. Proxying is working fine, but I cant get the copy-acct-to-home-server function to work. At the moment, authentication works fine, but accounting packets gets only to Server2. Any idea what I do wrong ? Thanks in advance for any help, its appreciated. --- Server log --- Polling for detail file /var/log/radius/radacct/detail detail_recv: Renaming /var/log/radius/radacct/detail -> /var/log/radius/radacct/detail.work detail_recv: Read packet from /var/log/radius/radacct/detail.work Acct-Session-Id = "6000006B" User-Name = "xxx" NAS-Port-Type = Ethernet Acct-Status-Type = Start Acct-Delay-Time = 1 NAS-IP-Address = x.x.x.x Acct-Unique-Session-Id = "3abb2fc097796361" Stripped-User-Name = "xxx" Realm = "DEFAULT" Packet-Original-Timestamp = "Aug 26 2009 00:27:37 EDT" server copy-acct-to-home-server { +- entering group preacct {...} ++[preprocess] returns ok [suffix] Request already proxied. Ignoring. ++[suffix] returns ok +- entering group accounting {...} ++[ok] returns ok } # server copy-acct-to-home-server Finished request 1. Cleaning up request 1 ID 24938 with timestamp +6 Going to the next request Waking up in 1.0 seconds. --- proxy.conf --- proxy server { default_fallback = yes } home_server acct_server1 { type = acct port = 1813 ipaddr = x.x.x.x secret = xxxx } home_server acct_server2 { type = acct port = 1813 ipaddr = x.x.x.x secret = xxxx } home_server_pool my_acct_pool { home_server = acct_server1 home_server = acct_server2 } realm DEFAULT { type = radius authhost = server1:1812 accthost = server1:1813 acct_pool = my_acct_pool secret = xxxx }

2 1

GTC and XP
by Il Neofita 27 Aug '09

27 Aug '09

Hi I have installed free radius, with GTC and NIS on Mac, iphone, linux is working however, I am not able to configure XP SP2 When I go on EAP PEAP properties I can choise only EAP_MSCHAP2 and autre certificate I would like that XP was able to download the certificate automaticaly What I am doing wrong

2 1

Re: Rewrite domain
by David Rodríguez Fernández 27 Aug '09

27 Aug '09

Hi, I have a wifi with wpa2, with peap and mschap2, with db users with active directory, and all is working fine if my users log in with: WINDOWSDOMAIN\userlogin as username, but if the users auth as userlogin, the server reply: Auth: Login incorrect (rlm_mschap: No such user (0xc0000064)): There's a method to rewrite the login name to add WINDOWSDOMAIN\ to the beginning of login or to make that radius add a default domain to all users? Thanks.

3 4

Re: Selective Update of User-Name
by Gary Gatten 27 Aug '09

27 Aug '09

I don't know specifics, but pretty much any change will require an FR restart; kill -1 .... With the perl and python modules you can do pretty much anything, but I think you could also do this with "unlang". I recall reading examples of this, did you check the files in the "doc" dir? Wish I could help more, but I just started with FR and have issues of my own to get working :) ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thu Aug 27 08:27:47 2009 Subject: Selective Update of User-Name Hi Guys This email tries to ask my question in a different way, to last time. I need to Rewrite the User-Name of individual accounts to add a realm, this would need to reliable up to at least 10000 users. Does any one have any ideas on how this might be done, in a way that can be updated with out restarting Freeradius ? We do have some python code running in this proxy which might be able to help. Thanks Mike O'Connor - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: Rewrite domain
by David Rodríguez Fernández 27 Aug '09

27 Aug '09

Thank you very much. Work fine! Большое спасибо. 2009/8/27 Ivan Kalik <tnt(a)kalik.net>: >> That is my ntlm_auth: >> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key >> --domain=%{mschap:NT-DOMAIN} --username=%{mschap:User-Name} >> --challenge=%{mschap:Challenge:-00} >> --nt-response=%{mschap:NT-Response:-00}" >> >> What i can change to fix that? > > --domain=%{%{mschap:NT-DOMAIN}:-WINDOWSDOMAIN} > > I think that's correct expansion syntax. > > Ivan Kalik > Kalik Informatika ISP > >

1 0

Proxy-To-Realm and Users File
by Mike O'Connor 27 Aug '09

27 Aug '09

Hi All Using freeradius 2.1.4 the following works if I user the hints file. DEFAULT Called-Station-Id == "splns357" User-Name := "%{User-Name}(a)mb.webshield.net.au" The user is proxied to the correct server and the user is correctly set. I now need to proxy based on the User-Name which in this case will always be a telephone number (Mobile Broadband SIM's) I had added the following to the users file (which I hope to change to the fast users later) 61466004163 Proxy-To-Realm := "mb.webshield.net.au" User-Name := "%{User-Name}(a)mb.webshield.net.au" This proxies the user to the next server but does not rewrite the username, I've also tried a couple of other in this file but none seem to work. rad_recv: Access-Request packet from host 118.67.209.51 port 56036, id=1, length=92 Framed-Protocol = PPP User-Name = "61466004163" User-Password = "password" Calling-Station-Id = "61466004163" Called-Station-Id = "splns357" Service-Type = Framed-User NAS-IP-Address = 118.67.208.51 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/118.67.209.51/auth-detail-20090827 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/118.67.209.51/auth-detail-20090827 [auth_log] expand: %t -> Thu Aug 27 09:40:24 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "61466004163", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry 61466004163 at line 1 [files] expand: %{User-Name}(a)mb.webshield.net.au -> 61466004163(a)mb.webshield.net.au ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop 2009-08-27T09:40:24.327336: Verbose: RLM_PYTHON: handling Authorize request... ++[python] returns ok +- entering group pre-proxy {...} [attr_filter.pre-proxy] expand: %{Realm} -> mb.webshield.net.au ++[attr_filter.pre-proxy] returns noop Sending Access-Request of id 250 to 118.67.209.21 port 1812 Framed-Protocol = PPP User-Name = "61466004163" User-Password = "password" Calling-Station-Id = "61466004163" Called-Station-Id = "splns357" Service-Type = Framed-User NAS-IP-Address = 118.67.208.51 Proxy-State = 0x31 Proxying request 0 to home server 118.67.209.21 port 1812 Sending Access-Request of id 250 to 118.67.209.21 port 1812 Framed-Protocol = PPP User-Name = "61466004163" User-Password = "password" Calling-Station-Id = "61466004163" Called-Station-Id = "splns357" Service-Type = Framed-User NAS-IP-Address = 118.67.208.51 Proxy-State = 0x31 Going to the next request Waking up in 0.9 seconds. Waking up in 13.0 seconds. rad_recv: Access-Reject packet from host 118.67.209.21 port 1812, id=250, length=23 Proxy-State = 0x31 Thanks All Mike

2 2

rlm_sqlcounter: Some strangenesses.
by George Koulyabin 27 Aug '09

27 Aug '09

Hi. I am running FR v2.1.6. I am needing to generate some quota for users. This quota must be replied via attribute Cisco-Control-Info. I tryed to do this by different ways. I was interested by rlm_sqlcounter, as simple and powerful method of calculating of counters. I built test counter: sqlcounter noresetoutputoctetscounter { counter-name = Max-All-Output-Octets check-name = Max-All-Output reply-name = Cisco-Control-Info #reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = "SELECT COALESCE(SUM(AcctOutputOctets), 0) \ FROM radacct \ WHERE UserName = '%{%k}' AND (CiscoServiceInfo = '' OR CiscoServiceInfo IS NULL)" } I inserted Max-All-Output attribute/value pair into radcheck and added 'noresetoutputoctetscounter' into authorize section. a.) I set Max-All-Output to 100000000 and used Session-Timeout as reply-name when first experiment was. Result of query was 60842094 for all experiments. I had got true result for this case. b.) I increased value of Max-All-Output to 700000000 and had got 700486142. But this value is greater then value of check-name (Max-All-Output). c.) Reply-name was replaced with Cisco-Control-Info by me. Cisco-Control-Info has type of string and Session-Timeout has type of integer. When I looked into log I found that "rlm_sqlcounter: Sent Reply-Item for user guest, Type=Cisco-Control-Info, value=700486142". But reply-list went with empty Cisco-Control-Info: 'Cisco-Control-Info = ""'. Where can I find information about restrictions of rlm_sqlcounter?

1 1

Failed install of freeradius2-2.1.6-2.el5.i386
by Steven Sprague 26 Aug '09

26 Aug '09

Today I tried to install freeradius2-2.1.6-2.el5.i386 and ran into a dependencies problem I could not solve. After downloading support for SQL and all required dependencies I started my install and got this message - Missing libltdl.so.3. I am running Linux rhel 2.6.18-8.el5 and wonder now where on my software disks (I have searched) is this file? Is this file part of some other software required to run freeradius2-2.1.6-2.el5.i386? Suggestions ? Thanks Steven -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 3

Logging client IP address
by Ian Chard 26 Aug '09

26 Aug '09

Hi, I'm experimenting with using freeradius 2.0.4 to authenticate administrative access to network equipment. If I deploy it then I'll end up with well over a hundred clients, so I'd like to describe the entire address range in a single 'client' block. I also want to have a syslogged record of each login attempt, which I can do, but I can't figure out how to log the client's IP address without having to specify every client individually in freeradius's config. As it is, I just get Login OK: [username] (from client big-netblock port 0) Is there a way around this without having to maintain a huge list of clients? Thanks - Ian -- Ian Chard, Senior Unix and Network Gorilla | E: ian.chard(a)sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 242287

3 5