September 2011 - Freeradius-Users - lists.freeradius.org

anybody out there?
by Arran Cudbard-Bell 15 Sep '11

15 Sep '11

poke poke Arran Cudbard-Bell a.cudbardb(a)freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !

3 2

Re: Test
by Imad Soltani 15 Sep '11

15 Sep '11

people are quiet :) Le jeu 15/09/11 16:49, Alan DeKok aland(a)deployingradius.com a écrit: > Is the list down, or are people quiet? > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

2 1

Re: Quick enable/disable user account.
by 2394263740 15 Sep '11

15 Sep '11

Hello, everyone, Thanks you all for your help. In my implementation, users have 3 states, 1. Need activation. 2. Enabled. 3. Disabled. So I use below method my my freeradiuis server. Update the attribute value to 3 status based on needs. It works. 1. Needactivation 2. Password 3. Disabled There're a couple of other solutions as people advised. I will try that needed. Thanks! Tom

1 0

Internal Sanity Check Fails
by DaveA 14 Sep '11

14 Sep '11

Hello, I have a perfectly working environment on a dev machine with FR 2.1.10-5 and very odd things are happening when I try and copy the configs to the production machine running the same version. The *ONLY* change I made on the prod version is in proxy.conf realm test.myrealdomain.com { } now reads realm myrealdomain.com { } The dev version properly handles the realm locally and everything is fine. After I make this change, FreeRadius tries proxying the requests for blah.com repeatedly to one of the servers configured in the DEFAULT realm, and then I get a log message: WARNING: Internal sanity check failed in event handler... If I revert my change on the prod box, everything goes back to normal. Ideas? Thanks, Dave -- View this message in context: http://freeradius.1045715.n5.nabble.com/Internal-Sanity-Check-Fails-tp48042… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRADIUS with NETGEAR WG103 WAP
by Ian Pilcher 14 Sep '11

14 Sep '11

Has anyone used $SUBJECT configuration? I am considering the WG103 for my home network, and I would really like to use its RADIUS support to start using "real" user IDs, rather than shared keys. I'm an experienced Linux admin (Red Hat RHCA certified), and I've got a pretty good familiarity with SSL and VLANs, but I have absolutely no experience with [Free]RADIUS. * Has anyone set up FreeRADIUS with the WG103 (or any other NETGEAR access point)? * How difficult is this likely to be? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================

4 6

WiSPr
by Luke Hammond 14 Sep '11

14 Sep '11

Hey al, iread that i can rate limit on a per user basis with the WISPr-Bandwidth-Max-Down and Up.. correct? Can someone please tell me how i can do this? I have freeradius running on Ubuntu server, with mysql atabase and daloradius for web management. My users connect to the freeradius through the captive portal on my pfSense firewall. Thanks in advance

3 6

Problem with update request
by Fabian Mikołajczak 14 Sep '11

14 Sep '11

Hi all, I'm trying to replace User-Name and User-Password with ADSL-Agent-Circuit-Id in request and it does not work. Configuration and debug output below. What I am doing wrong? freeradius: FreeRADIUS Version 2.1.10 --- config file --- if ADSL-Agent-Circuit-Id { update request { User-Name := "%{%{ADSL-Agent-Circuit-Id}:-bar}" User-Password := "%{ADSL-Agent-Circuit-Id}" } } --- debug Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 50917, id=104, length=69 User-Name = "00:16:17:eb:e1:ca" User-Password = "Redback" ADSL-Agent-Circuit-Id = "\000\001\001\024" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++? if ADSL-Agent-Circuit-Id Evaluating (ADSL-Agent-Circuit-Id) -> TRUE ++? if ADSL-Agent-Circuit-Id -> TRUE ++- entering if ADSL-Agent-Circuit-Id {...} expand: %{ADSL-Agent-Circuit-Id} -> ... expanding second conditional expand: %{%{ADSL-Agent-Circuit-Id}:-bar} -> bar expand: %{ADSL-Agent-Circuit-Id} -> +++[request] returns ok ++- if ADSL-Agent-Circuit-Id returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bar", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} ++[pap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject --- Do you have any idea? Thanks. -- Fabian

2 1

Quick enable/disable user account.
by 2394263740 14 Sep '11

14 Sep '11

Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom

7 21

Problem with rml_sqlcounter with GigaByte datavolume
by Hanno Schupp 14 Sep '11

14 Sep '11

Dear All, can I ask for some pointers please. in my FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu (Ubuntu LTS 10.04) installation I have followed the Gigabyte instructions on the FreeRADIUS wiki's FAQ http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Oct…. The Usage is calculated correctly, but the check_item value is not what I expect to see (1.7 GB as opposed th 6GB set in radcheck). I understand who the system determines the counter value and it is correctly calculated, but where does the check_item vlaue of 1.7GB come from? I have no idea to be truthful. Any pointers welcome. Thanks in advance. Here the data/logs: Here the relevant debug log: Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Entering module authorize code Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: 'SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}'' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: '%{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'}' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{User-Name} -> lapzel14 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_set_user escaped user --> 'lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Reserving sql socket id: 3 Sat Jun 4 23:10:21 2011 : Debug: rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat finished Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Released sql socket id: 3 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'} -> 2147513300 Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Rejected user lapzel14, check_item=1705032704, counter=2147513300 Sat Jun 4 23:10:21 2011 : Info: ++[noresettotal] returns reject Definition of the noresettotal module in counter.conf: sqlcounter noresettotal { counter-name = Max-All-Total-Octets check-name = Max-All-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql03 key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}'" } and here the radcheck values for user 'lapzel14': [image: Full Texts]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> id<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> UserName<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Attribute<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> op<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Value<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…>[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572098lapzel14User-Password:=loxdas[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572102lapzel14Expiration:=1311932528[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572106lapzel14Simultaneous-Use:=1[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572110lapzel14Max-All-Total:=6000000000

7 17

Replacing Cisco ACS with Free RADIUS
by Sallee, Stephen (Jake) 14 Sep '11

14 Sep '11

Our Cisco ACS was accidentally made useless by some numbskull (me) by raising the functionality level of our AD domain, apparently ACS 4.2 is not compatible with newer MS AD servers ... and once you raise the functionality level ... you can't go back ... go me >:o So! I am trying to replicate the Downloadable IP ACL function that we love so much in ACS, into Free RADIUS. It seems that this is done through the Cisco AV Pair radius attribute. If anyone has experience in this please drop me a line using my included contact info, if we move into production with it I will post back to the list for posterity what we did to get it to work. Any help is always appreciated. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221

3 2