December 2010 - Freeradius-Users - lists.freeradius.org

FreeRadius + MySQL characters being converted to HEX
by Steve Staples 16 Dec '10

16 Dec '10

I do apologize if this has been asked (I did search, but found nothing definitive, or it was my poor searching skills). We are storing all the radius accounting into MySQL, and thus far, have not had any real issues. I was asked the other day, why some of the cisco-avpairs attributes were showing up like: connect-progress=3DLAN Ses Up there were some other attributes that get these =HEX values passed and stored, and what I am wondering is, is that in the flat files, it gets stored as connect-progress=LAN Ses Up ('=3D' translates to '=') but in MySQL, it gets parsed/translated to the '=3D' style. How do I go about storing this as the '=' and not the '=3D' as well as all the other attribute values that get parsed/translated to hex characters? It doesn't appear to be the MySQL that is changing it, it looks like it is from the FreeRadius side... but I could be wrong. Thanks in advance, Steve.

2 2

Query
by karnik jain 16 Dec '10

16 Dec '10

Ok, I understood your point. But as per RFC 2865, what is the meaning of then "UTF-8 encoded 10646 [7] characters", the [7]? 7 stands for what over here? And one more thing as per RFC 2865, 1) As per this new RFC only only we need to support US-ASCII not any other character set, right? 2) Does free RADIUS only supporting US-ASCII or all universal character set?

2 1

Re: FreeRADIUS - no service!
by Alan Buxey 16 Dec '10

16 Dec '10

1.1.0 ? And this is your ONLY problem? At least upgrade to 1.1.8 - but if you want my help you'll need to be running the current release 2.1.x train Alan ----- Reply message ----- From: "Александр Чурсин" <achursin86(a)gmail.com> Date: Wed, Dec 15, 2010 14:29 Subject: FreeRADIUS - no service! To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Ok, thanks for explanation. The RADIUS version is 1.1.0 In the accounting section of the radiusd.conf we have: accounting { #detail #acct_unique ################################################# # Vladikavkaz OSE Acct-Type OSE { acct_unique group { sqlacct { fail = 1 # ok = return } OSE { fail = 1 ok = return } } # sql_log } ################################################# and so on anologous to these constructions with #### as a delimeter ... So, no "sql" mentioned... I'am sorry, but it's unclear for me where to put the wrapper. Alexander - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 4

freeradius and change-password / password aging
by ap 16 Dec '10

16 Dec '10

Hi list, is there a possibility to ensure "change password on next logon" or a message "password expires in next 3 days"? Which are the reqirements on supplicant or NAS? Best regards, ap.

2 1

multiple usergroups failing; freeradius 2.1.10 + Cisco-AVPairs
by michael＠jarrett.id.au 16 Dec '10

16 Dec '10

Hi, During a rebuild of our Radius servers from an old freeradius 1.x install to 2.1.10, we've lost ability to push multiple usergroups to our Cisco LNS: MySQL: radcheck: id UserName Attribute op Value 9791 test@realm Password := {clear}somepass radgroupreply: id GroupName Attribute op Value 161 VRF-TEST Cisco-AVPair += ip:vrf-id=TEST 162 VRF-TEST Cisco-AVPair += ip:ip-unnumbered=loopback25 2211 QOS-PROFILE Cisco-AVPair += ip:sub-qos-policy-out=TEST-QOS-PROFILE radreply: id UserName Attribute op Value 124561 test@realm Framed-IP-Netmask = 255.255.255.255 124571 test@realm Framed-IP-Address = 1.1.1.1 usergroup: UserName GroupName priority test@realm VRF-TEST 1 test@realm QOS-PROFILE 2 debugging Radius on the Cisco shows (amongst other things): RADIUS: Vendor, Cisco [26] 21 RADIUS: Cisco AVpair [1] 15 "ip:vrf-id=TEST" RADIUS: Vendor, Cisco [26] 35 RADIUS: Cisco AVpair [1] 29 "ip:ip-unnumbered=loopback25" If you set QOS-PROFILE to priority 0 for example, it will then only pick up the QOS-PROFILE usergroup, not both. Setting both usergroups to same priority yeilds the same results; only applying the first, never both. To rule out the Cisco i've performed a tcpdump on Radius itself; I can only see freeradius sending one usergroup in the Access-Accept response. This is also a fresh freeradius install via FreeBSD ports; no configuration was carried over from the previous install except for MySQL DB credentials. Thoughts?

1 1

mysql huntgroups Access-Reject
by GeneTitus 15 Dec '10

15 Dec '10

Greetings from Texas. I'm setting up freeradius to authenticate/authorize network engineers to log into cisco and juniper devices. Some devices we share with other organizations. I need to be able to allow some engineers access to some devices and not others. I'm running on redhat with Mysql as the backend. I'll will be writing a web front end to manage our radius server(s) once I get a working configuration for our situation.. I have freeradius 2.1.7. That's the rpm for redhat 5.4. I have radcheck and radreply working. (username and password checking) I have radusergroup, radgroupcheck, radgroupreply working if I populate the huntgroups flat file with appropriate information. I can set shell:privs on ciscos for a specific user based on group membership via radgroupreply. As I understand it, if I move huntgroups out of the flat file (preprocess) and into mysql, I loose the ability to send an Access-Reject based on huntgroups. Is that correct? Thanks, Gene Titus The Office of Telecommunication Services The University of Texas at Austin -- View this message in context: http://freeradius.1045715.n5.nabble.com/mysql-huntgroups-Access-Reject-tp33… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

wifi ip allocation
by Alexandre Chapellon 15 Dec '10

15 Dec '10

Hi every body, While all the documentation on the web seems to answer *NO*, and because I feel like i need to talk to someone today, I was wondering if there is any way to allocate IP address to wifi user using radius Attributes instead of DHCP? Or maybe I should ask... How can i allocate IP address from differents Pools based on login (final goal would be to have transparent squid treat user differently )? Thanks. -- Follow us on: twitter https://www.twitter.com/manainternet

4 10

RE: FreeRADIUS - no service!
by Александр Чурсин 15 Dec '10

15 Dec '10

Thanks for the replies! We'll try to kill the process manually, but it is still unclear what is the core reason of the service fall ? >The logs should speak for itself. To fix this one you need to >coordinate with network/dba guys. Sometimes its simply because oracle >s dead or too busy to respond to anything. Other times in can be >firewall issues. There were no network changes before and during the RADIUS outage (no firewall). Dba guys say that the Oracle is Ok, and no significant issues were placed on record according to oracle logs. Alexander

3 5

Proxying CoA
by Zsolt Tripolszky 15 Dec '10

15 Dec '10

Hello, I'm trying to figure out how to proxy CoA packets. I have read through a similar thread on this list ( http://lists.freeradius.org/mailman/htdig/freeradius-users/2010-July/msg003… ), but somehow I cannot get it to work. My setup is the following: In my proxy.conf: home_server nas_coa { type = coa ipaddr = 10.0.0.2 port = 3799 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } secret = testing123 } home_server_pool to_coa_nas { home_server = nas_coa } I have updated the sites-enabled/coa to look as below: listen { type = coa ipaddr = * port = 3799 server = coa } server coa { recv-coa { update control { Home-Server-Pool := "to_coa_nas" } } send-coa { # Sample module. ok } } When I'm sending a Disconnect packet, I get the following: Wed Dec 15 12:06:41 2010 : Info: Ready to process requests. rad_recv: Disconnect-Request packet from host 127.0.0.1 port 56343, id=51, length=50 Framed-IP-Address = 91.83.148.2 Acct-Session-Id = "D94F82E3300682B3" NAS-IP-Address = 10.0.0.2 Wed Dec 15 12:06:43 2010 : Info: server coa { Wed Dec 15 12:06:43 2010 : Info: # Executing section recv-coa from file /Users/tripy/Devel/test-servers/freeradius-2.1.10/etc/raddb.proxy/sites-enabled/coa Wed Dec 15 12:06:43 2010 : Info: +- entering group recv-coa {...} Wed Dec 15 12:06:43 2010 : Info: ++[control] returns noop Wed Dec 15 12:06:43 2010 : Info: # Executing section send-coa from file /Users/tripy/Devel/test-servers/freeradius-2.1.10/etc/raddb.proxy/sites-enabled/coa Wed Dec 15 12:06:43 2010 : Info: +- entering group send-coa {...} Wed Dec 15 12:06:43 2010 : Info: ++[ok] returns ok Wed Dec 15 12:06:43 2010 : Info: } # server coa Sending Disconnect-ACK of id 51 to 127.0.0.1 port 56343 Clearly I am missing something obvious, but I cannot find what it is. Any idea? Thanks, tripy

1 0

FreeRADIUS - no service!
by Александр Чурсин 15 Dec '10

15 Dec '10

Hi to all! We have an issue with a FreeRADIUS server (FreeRADIUS server and Oracle Database). Sometimes it fails and stops to process the AAA requests (only complete server reboot helps)! Here is the log output during the time of a failed situation: [root@aaa0 ~]# tailf /usr/local/var/log/radius/radius.log Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: Oracle logon failed: 'rlm_sql_oracle: no connection to db' Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct) in sql_accounting: stop packet with zero session length. [user 'mobile', nas '10.115.66.5'] Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct) in sql_accounting: stop packet with zero session length. [user 'mobile', nas '10.115.66.5'] Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: Oracle logon failed: '(null)' Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct): Failed to connect DB handle #7 Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct): reconnect failed, database down? Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct): Couldn't insert SQL accounting START record - rlm_sql_oracle: no connection to db Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct) in sql_accounting: stop packet with zero session length. [user 'mobile', nas '10.115.66.5'] Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADIUS.ACCT_IDX1) violated Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: Oracle logon failed: 'rlm_sql_oracle: no connection to db' [root@aaa0 ~]# [root@aaa0 ~]# /etc/init.d/rc.radiusd restart Starting FreeRADIUS:Mon Dec 13 20:09:51 2010 : Info: Starting - reading configuration files ... radiusd [root@aaa0 ~]# tailf /usr/local/var/log/radius/radius.log Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct) in sql_accounting: stop packet with zero session length. [user 'mobile', nas '10.115.66.5'] Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: Oracle logon failed: '(null)' Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct): Failed to connect DB handle #7 Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct): reconnect failed, database down? Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct): Couldn't insert SQL accounting START record - rlm_sql_oracle: no connection to db Mon Dec 13 19:25:12 2010 : Error: rlm_sql (sqlacct) in sql_accounting: stop packet with zero session length. [user 'mobile', nas '10.115.66.5'] Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADIUS.ACCT_IDX1) violated Mon Dec 13 19:25:12 2010 : Error: rlm_sql_oracle: Oracle logon failed: 'rlm_sql_oracle: no connection to db' Mon Dec 13 20:09:51 2010 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Dec 13 20:09:51 2010 : Error: There appears to be another RADIUS server running on the authentication port 1812 [root@aaa0 ~]# reboot Please, advise what can be the reason of such negative behaviour of the RADIUS server? Why does it lose connection to a db? How can we troubleshoot the issue further? Alexander

4 3