February 2010 - Freeradius-Users - lists.freeradius.org

Re: Allowing user from one realm but not another
by Gary Gatten 13 Feb '10

13 Feb '10

LOL, easy to do with FR. I was just getting the hang of it when I was pulled off to another project. Check out the operators and unlang. Maybe there are some examples within the users file with similar replacement operations. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'FreeRadius users mailing list' <freeradius-users(a)lists.freeradius.org> Sent: Sat Feb 13 10:17:42 2010 Subject: RE: Allowing user from one realm but not another Yes that would work not not sure how to implement this. I have been trying to find a written example of someone who has done this On the search engines but all I have accomplished is making myself confused From: freeradius-users-bounces+jeffa=globalco.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jeffa=globalco.net@lists.freeradius.org] On Behalf Of Gary Gatten Sent: Saturday, February 13, 2010 11:11 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: Allowing user from one realm but not another Assuming there are not duplicate names, can't you jus rewrite his auth request so its always the realm you want? Billy.* = Billy.beg ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Sat Feb 13 09:52:33 2010 Subject: Allowing user from one realm but not another Heres my issue and no idea exactly how to do this. Trying to figure it out is making me more confused. 1st I use the usersfile for authentation I have three different realms users can login with For examples they are (foo.net, bar.net, beg.net) When users login from one of the realms from my two upstream providers they login as one of these realms Then freeradius will strip the realm and auth the user My delima is I have some users that abused a certain realm usage and I want to restrict them to another realm for login and deny the others Say billy(a)foo.net has abused the foo.net realm now I need him solely on the beg.net and disallowing the other two realms. In other words reject him before if he trys to use the old realm again. In other words I want to allow only billy to use this one new realm and be rejected if he trys another realm. This has to take place I figure in preproxy, cause my users file is authenticated minus the realm in proxy.. But as I said I have no idea on what to do to set this up.. I would not mind adding usernames to a file to be prechecked at preproxy and if user is and he is not using realm specified reject him , just not sure what to do or how.. Jeff "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 2

Re: Allowing user from one realm but not another
by Gary Gatten 13 Feb '10

13 Feb '10

Assuming there are not duplicate names, can't you jus rewrite his auth request so its always the realm you want? Billy.* = Billy.beg ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Sat Feb 13 09:52:33 2010 Subject: Allowing user from one realm but not another Heres my issue and no idea exactly how to do this. Trying to figure it out is making me more confused. 1st I use the usersfile for authentation I have three different realms users can login with For examples they are (foo.net, bar.net, beg.net) When users login from one of the realms from my two upstream providers they login as one of these realms Then freeradius will strip the realm and auth the user My delima is I have some users that abused a certain realm usage and I want to restrict them to another realm for login and deny the others Say billy(a)foo.net has abused the foo.net realm now I need him solely on the beg.net and disallowing the other two realms. In other words reject him before if he trys to use the old realm again. In other words I want to allow only billy to use this one new realm and be rejected if he trys another realm. This has to take place I figure in preproxy, cause my users file is authenticated minus the realm in proxy.. But as I said I have no idea on what to do to set this up.. I would not mind adding usernames to a file to be prechecked at preproxy and if user is and he is not using realm specified reject him , just not sure what to do or how.. Jeff <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

Resetting the status server counters
by Jonathan Gazeley 13 Feb '10

13 Feb '10

I've been looking at this page[1] and I'm using a command like echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1" | /usr/local/bin/radclient localhost:18120 status adminsecret to extract some numbers of processed packets, etc. Is there a way to send packets to the status server to reset the counters (without restarting radiusd?) I'm thinking of polling this command every X minutes and resetting the counter so I get a measure of "how many packets processed in the last X minutes" Thanks, Jonathan [1] http://wiki.freeradius.org/Status -- ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless& VPN Team Information Services University of Bristol ----------------------------

2 1

Radius Manager
by Teguh Kurniawan 12 Feb '10

12 Feb '10

Hello, I use "ancient" Free Radius 1.1.7 packages (from Ubuntu 8.04/Hardy) on Ubuntu Server 9.10. I use "ancient" Free Radius, because the requirement from Radius Manager we buy from http://www.radius-manager.com/. But after finish setting up the configuration for Free Radius, I've got some problem. Some problem I could fixed after asking some question from this mailing list and searching from google. But I've got another problem, my testing is rejected. What should I do ? Best Regards, Teguh Kurniawan # radtest user 1111 localhost 1812 testing123 Sending Access-Request of id 172 to 127.0.0.1 port 1812 User-Name = "user" User-Password = "1111" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=172, length=20 /etc/hosts 127.0.0.1 localhost 192.168.0.3 radiusmanager.testme.net radiusmanager # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "radius123" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/freeradius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:55166, id=172, length=56 User-Name = "user" User-Password = "1111" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 217 radius_xlat: '/usr/local/bin/rmauth "255.255.255.255" "user""" "1812"' modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'user' rlm_sql (sql): sql_set_user escaped user --> 'user' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 0 radius_xlat: 'user' rlm_sql (sql): sql_set_user escaped user --> 'user' radius_xlat: 'SELECT COUNT(*) FROM radacct WHERE UserName='user' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 modcall[session]: module "sql" returns ok for request 0 modcall: leaving group session (returns ok) for request 0 cfg.c, line 175: no permission for configfile Exec-Program output: Exec-Program: returned: 1 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1 port 55166 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 4b7537cd Nothing to do. Sleeping until we see a request.

2 1

FreeRadius 2.1.8 works fine in DEBUG mode
by Amal Janardhanan 12 Feb '10

12 Feb '10

Hi, I am using freeradius version 2.1.8. All the installation and everything went fine. Freeradius is able to accept and process the request in DEBUG mode. But in in normal mode, I am getting the following error. Mon Feb 8 17:29:20 2010 : Info: Ready to process requests. Mon Feb 8 17:29:59 2010 : Error: WARNING: Unresponsive child for request 0, in module python component authorize Mon Feb 8 17:30:00 2010 : Info: WARNING: Child is hung for request 0. Mon Feb 8 17:30:00 2010 : Info: WARNING: Child is hung for request 0. Mon Feb 8 17:30:01 2010 : Info: WARNING: Child is hung for request 0. Mon Feb 8 17:30:01 2010 : Info: WARNING: Child is hung for request 0. Mon Feb 8 17:30:03 2010 : Info: WARNING: Child is hung for request 0. Please let me know how I can solve this ? Thanks Amal

4 8

Simultaneous-Use problem with Mikrotik NAS clients
by Fojtán Balázs István 12 Feb '10

12 Feb '10

Hello, After I've made your suggested change (inserted the Simultaneous-Use := 1 record into radgroupcheck table), the checkrad.pl script run, when I use radtest to a user, who is listed by radwho. I've set the $debug, $snmpget, $snmpwalk, $cmmty_string variables in the /usr/sbin/checkrad. After I get this message to checkrad's debug file: Fri Feb 12 14:13:19 2010 checkrad mikrotik 172.16.2.246 2147483647 hz00001 80600043 Returning 2 (error detected) Is there any settings to get more detailed debug info somewhere? I've set a firewall logger between the freeradius and the NAS client, but it has not any packet detected. The snmpwalk or telnet (to reach the mikrotik NAS) are working fine if I try them from a simple linux shell. Regards, fbi

1 0

How to ignore some NASs?
by Leighton Man 12 Feb '10

12 Feb '10

Hi, I need to configure freeradius to ignore requests from particular clients based on NAS-IP-Address. Is there a quick way to do this? Thanks, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 2

Re: Re: Simultaneous-Use problem with Mikrotik NAS clients
by Fojtán Balázs István 12 Feb '10

12 Feb '10

Hello, >Yes, > >Simulaneous-Use is a check item, not a reply. Ok, I did this mistake, sorry. Now I've deleted the Simultaneous-Use := 1 record from radgroupreply (now this is empty), and inserted it into the radgroupcheck. mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | HZ | Simultaneous-Use | := | 1 | +----+-----------+------------------+----+-------+ I've got this in my radius.log: Fri Feb 12 10:33:59 2010 : Error: [sql] Failed to check the terminal server for user 'hz00001'. Fri Feb 12 10:33:59 2010 : Auth: Login OK: [hz00001/<CHAP-Password>] (from client HZ Test port 2156920837 cli 00:0E:35:3F:68:29) Is it means that, the freeradius can't verify on the NAS client whether the user is online? Regards, fbi

1 0

Re: Re: Simultaneous-Use problem with Mikrotik NAS clients
by Fojtán Balázs István 12 Feb '10

12 Feb '10

Hello Fajar, >> mysql> select * from radgroupreply; >> +----+-----------+------------------+----+-------+ >> | id | GroupName | Attribute ? ? ? ?| op | Value | >> +----+-----------+------------------+----+-------+ >> | ?1 | HZ ? ? ? ?| Simultaneous-Use | := | 1 ? ? | >> +----+-----------+------------------+----+-------+ > >Shouldn't this be on radgroupcheck? My radgroupcheck table is empty. Does it cause the problem? Regards, fbi

2 1

Coa server warning
by Andrew Rikhlivsky 12 Feb '10

12 Feb '10

Hello all. I tried to configure COA service on my test server. When i send coa packet: # echo User-Name = cisco, mpd-limit += \"in#1=all rate-limit 1320000 150000 300000\", mpd-limit += \"out#2=all rate-limit 1320000 150000 300000\"|radclient -d /usr/local/share/freeradius/ -x [nas ip]:3799 coa [nas secret] FreeRADIUS asking: rad_recv: CoA-Request packet from host 127.0.0.1 port 20722, id=231, length=126 User-Name = "cisco" mpd-limit = "in#1=all rate-limit 1320000 150000 300000" mpd-limit = "out#2=all rate-limit 1320000 150000 300000" server localhost-coa { WARNING: Empty section. Using default return values. WARNING: Empty section. Using default return values. } # server localhost-coa Sending CoA-ACK of id 231 to 127.0.0.1 port 20722 What am I missing? My configuration on FreeBSD 8.0, FreeRADIUS 2.1.8, MPD (as a NAS) in radius.conf listen { ipaddr = 127.0.0.1 port = 3799 type = coa virtual_server = coaon } in clients.conf client localhost { ipaddr = 127.0.0.1 secret = test1 nastype = other coa_server = coaon in sites-enabled/originate-coa home_server coaon { type = coa ipaddr = 127.0.0.1 port = 3799 secret = test2 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool coa { type = fail-over home_server = coaon }

2 2