June 2013 - Freeradius-Users - lists.freeradius.org

Re: IPv6 Pool
by William DELORAINE 14 Jun '13

14 Jun '13

Ok thanks for the reply. >Not right now. I'd suggest writing SQL queries to handle that. The >sql_ippool module should be able to do it, if the queries are updated. I aim to use the module to manage IPv4 pool and IPv6 prefix pool. Do you think I should update the module or create another one? Actually, I'm pretty lost and I don't know where to start.

3 2

Re: IPv6 Pool
by William DELORAINE 14 Jun '13

14 Jun '13

> You may be able to re-use the module, just with a different configuration. Is there a way to change the %reply returned by rlm_sqlippool?

1 0

Freeradius 3.0 build process different from 2.0?
by stefan.paetow＠diamond.ac.uk 14 Jun '13

14 Jun '13

Hi, I have more a development question for Arran/Alan D about the build process for FR 3.0... has it changed significantly compared to v2.2.0? The reason I ask is that I would like to get started on a 3.0 build spec for CentOS (since the last version for CentOS 6.4 is v2.1.12, and 2.2.0 is officially only on Fedora 17). I have 'fudged' a build spec for v2.2.0 on CentOS 6 (John D, I can share it with you, if you prefer), so with Project Moonshot, I'd like to get going with a proper package for FR 3.0. With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 5

evaluating unlang IF with sql results
by Bill Schoolfield 14 Jun '13

14 Jun '13

I can't seem to make this work. I'm comparing some values in the post-auth section: if("(%{expr: %{check:Max-All-Session}-%{sql:select sum(acctsessiontime) from radacct where username='%{User-Name}'}})" < "(%{expr: %{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))+0}})") { update reply { Session-Timeout := "%{expr: %{check:Max-All-Session}-%{sql:select sum(acctsessiontime) from radacct where username='%{User-Name}'}}" } } else { update reply { Session-Timeout := "%{expr: (%{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))})}" } } The above code fails with a message (below) that says "(Right field is not a number at: (1371158700))". I tried adding a zero to force a number interpretation but this does nothing. I have checked every source I can find and I don't see anyhing that addresses this problem. Thoughts anyone? Bill rad_recv: Access-Request packet from host 127.0.0.1 port 59971, id=77, length=74 User-Name = "wrs" CHAP-Password = 0x4dab7bdecf6c70f078b77bfa11cebd490d NAS-IP-Address = 10.0.0.147 NAS-Port = 0 Message-Authenticator = 0xcf99944924652eda7706d17c69afca2c # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "wrs", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> wrs [sql] sql_set_user escaped user --> 'wrs' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wrs' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wrs' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'wrs' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [expiration] Checking Expiration time: '13 Jun 2013 21:25:00' ++[expiration] returns ok ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop rlm_sqlcounter: Entering module authorize code WARNING: Please replace '%k' with '${key}' sqlcounter_expand: 'SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='wrs' WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='wrs'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> wrs [noresetcounter] sql_set_user escaped user --> 'wrs' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='wrs' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='wrs' rlm_sql (sql): Reserving sql socket id: 2 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 2 [noresetcounter] expand: %{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='wrs'} -> 12 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user wrs, check_item=600, counter=12 rlm_sqlcounter: Sent Reply-Item for user wrs, Type=Session-Timeout, value=180 ++[noresetcounter] returns ok Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "wrs" with CHAP password [chap] Using clear text password "test123" for user wrs authentication. [chap] chap user wrs authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop ++? if ("(%{expr: %{check:Max-All-Session}-%{sql:select sum(acctsessiontime) from radacct where username='%{User-Name}'}})" < "(%{expr: %{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))+0}})") sql_xlat expand: %{User-Name} -> wrs sql_set_user escaped user --> 'wrs' expand: select sum(acctsessiontime) from radacct where username='%{User-Name}' -> select sum(acctsessiontime) from radacct where username='wrs' rlm_sql (sql): Reserving sql socket id: 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 1 expand: %{check:Max-All-Session}-%{sql:select sum(acctsessiontime) from radacct where username='%{User-Name}'} -> 600-12 expand: (%{expr: %{check:Max-All-Session}-%{sql:select sum(acctsessiontime) from radacct where username='%{User-Name}'}}) -> (588) sql_xlat expand: %{User-Name} -> wrs sql_set_user escaped user --> 'wrs' expand: select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))+0 -> select unix_timestamp(str_to_date('Jun 13 2013 21:25:00 UTC', '%b %d %Y %H:%i:%s'))+0 rlm_sql (sql): Reserving sql socket id: 0 sql_xlat finished rlm_sql (sql): Released sql socket id: 0 expand: %{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))+0} -> 1371158700 expand: (%{expr: %{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))+0}}) -> (1371158700) (Right field is not a number at: (1371158700)) ++- entering else else {...} sql_xlat expand: %{User-Name} -> wrs sql_set_user escaped user --> 'wrs' expand: select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s')) -> select unix_timestamp(str_to_date('Jun 13 2013 21:25:00 UTC', '%b %d %Y %H:%i:%s')) rlm_sql (sql): Reserving sql socket id: 4 sql_xlat finished rlm_sql (sql): Released sql socket id: 4 expand: (%{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))}) -> (1371158700) expand: %{expr: (%{sql:select unix_timestamp(str_to_date('%{check:Expiration}', '%%b %%d %%Y %%H:%%i:%%s'))})} -> 1371158700 +++[reply] returns noop ++- else else returns noop

3 4

CHAP auth failure
by Strong, Mark 14 Jun '13

14 Jun '13

Guys, Having a problem with CHAP and freeradius (PAP works ok, and I'm using clear text passwords, I have this in the check table "Cleartext-Password := password"). I get this in the debug [chap] login attempt by "xxxxxxxxxx" with CHAP password [chap] Using clear text password "password" for user xxxxxxxxxx authentication. [chap] Password check failed I've tried with radtest using type chap, and it works fine, I'm thinking there's a problem with the access-request (but I don't control that end, it's a large Telco in AU). My radius box is a CentOS box with freeradius2-2.1.12-5.el5 installed. What I want to know is, do I have enough attributes in this access-request for CHAP to work? User-Name = "xxxxxxxxxx" CHAP-Password = 0x01345dcc75b35990d8b99bb0d0b0be3593 NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port = 1821857408 Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context 3GPP-IMSI = "50501xxxxxxxxxx" 3GPP-PDP-Type = 0 3GPP-GGSN-Address = xxx.xxx.xxx.xxx 3GPP-NSAPI = "5" Called-Station-Id = "apn" Calling-Station-Id = "xxxxxxxxxx" NAS-Identifier = "SFL9" Acct-Session-Id = "0A380612[]xxxxxxxxxxxxxxxx" NAS-Port-Type = Virtual I don't see one of these "CHAP-Challenge" from the NAS I'm not sure what pieces freeradius needs to munge together to come up with the same password hash that rolls in from the Telco. I didn't post the full debug just so I didn't have to redact so much. If this access request turns out to be ok, I can post the full debug. Mark.

2 3

automated response
by Javier Lidó Fernández 14 Jun '13

14 Jun '13

Thank you for your message. Sorry I'm not in the Office until 1st of July. In urgent cases please contact informatica(a)cemfi.es. Kind regards Javier Lidó -- CEMFI Casado del Alisal, 5 28014 Madrid Spain E-mail: lido(a)cemfi.es

1 0

Duplicated records in RADACCT with differents delay times
by Antonio Fernández Pérez 14 Jun '13

14 Jun '13

Hi everybody, I have a problema with my FreeRADIUS accounting. I have detected that there are a lot of records duplicated but with different AcctStartDelay and AcctStopDelay. In raddact table appears for the same user more than one use when should appear only one. AN EXAMPLE =========================================================== INSERT INTO `radacct` (`RadAcctId`, `AcctSessionId`, `AcctUniqueId`, `UserName`, `Realm`, `NASIPAddress`, `NASPortId`, `NASPortType`, `AcctStartTime`, `AcctStopTime`, `AcctSessionTime`, `AcctAuthentic`, `ConnectInfo_start`, `ConnectInfo_stop`, `AcctInputOctets`, `AcctOutputOctets`, `CalledStationId`, `CallingStationId`, `AcctTerminateCause`, `ServiceType`, `FramedProtocol`, `FramedIPAddress`, `AcctStartDelay`, `AcctStopDelay`, `XAscendSessionSvrKey`) VALUES (3970329, '80d0090b', '28e7b4a55f1dead8', 'ni334ROHUH', '', '192.168.1.102', '2161117451', 'Wireless-802.11', '2013-02-05 20:14:42', '2013-02-05 20:39:23', 1481, '', '', '', 1443428, 3321047, 'aptrevoli', 'E0:B9:BA:DB:B4:E4', 'Lost-Service', '', '', '172.21.0.31', 4, 4, ''); INSERT INTO `radacct` (`RadAcctId`, `AcctSessionId`, `AcctUniqueId`, `UserName`, `Realm`, `NASIPAddress`, `NASPortId`, `NASPortType`, `AcctStartTime`, `AcctStopTime`, `AcctSessionTime`, `AcctAuthentic`, `ConnectInfo_start`, `ConnectInfo_stop`, `AcctInputOctets`, `AcctOutputOctets`, `CalledStationId`, `CallingStationId`, `AcctTerminateCause`, `ServiceType`, `FramedProtocol`, `FramedIPAddress`, `AcctStartDelay`, `AcctStopDelay`, `XAscendSessionSvrKey`) VALUES (3970328, '80d0090b', '28e7b4a55f1dead8', 'ni334ROHUH', '', '192.168.1.102', '2161117451', 'Wireless-802.11', '2013-02-05 20:14:38', '2013-02-05 20:39:23', 1481, '', '', '', 1443428, 3321047, 'aptrevoli', 'E0:B9:BA:DB:B4:E4', 'Lost-Service', '', '', '172.21.0.31', 0, 4, ''); =========================================================== Anybody knows how could I fix this? Regards, Antonio.

2 1

RE: Exec problems in FR3.0
by Franks Andy (RLZ) IT Systems Engineer 14 Jun '13

14 Jun '13

Thanks Phil, I need to get my head around the coding side of this a bit more! -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 14 June 2013 09:19 To: freeradius-users(a)lists.freeradius.org Subject: Re: Exec problems in FR3.0 On 06/14/2013 07:39 AM, Franks Andy (RLZ) IT Systems Engineer wrote: > Hi > Do I need to file a bug report or something? No, the issue was raised on -devel You can revert: https://github.com/FreeRADIUS/freeradius-server/commit/4c3030db2743e682c 58a0fba30b43d066f22beb0 ...until a proper fix is available. "git show 4c3030db2743e68" will give you a patch file, which you can apply with -R to undo it. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Exec problems in FR3.0
by Franks Andy (RLZ) IT Systems Engineer 14 Jun '13

14 Jun '13

Hi Do I need to file a bug report or something? Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 13 June 2013 17:57 To: FreeRadius users mailing list Subject: Re: Exec problems in FR3.0 Phil Mayers wrote: > Confirmed. Looks like a bug has crept into the exec code in HEAD: > > 28619 execve(0x6461202e2e2e2000, [0x6461202e2e2e2000, > 0x77656e20676e6964, 0x2074656b636f7320, 0x7325, 0x612064656c696146, > 0x727020676e696464, 0x6b636f732079786f, > 0x7325203a7465, 0x612064656c696146, 0x766520676e696464, > 0x646e616820746e65, 0x20726f662072656c, 0x2174656b636f73, > 0x7265206c61746146, 0x6565726620726f72, 0x636f > 7320676e697a, ...], [/* 2 vars */]) = -1 EFAULT (Bad address) > 28619 write(1, "\33[1m\33[33m(0) WARNING: myexec : F"..., 91) = 91 > > Will investigate. It may be related to the use of argv in exec.c. Coverity says: 107 CID 1020962 (#1 of 1): Uninitialized scalar variable (UNINIT) 2. uninit_use_in_call: Using uninitialized element of array "argv" when calling "memcpy(void * restrict, void const * restrict, size_t)". 108 memcpy(&argv_p, &argv, sizeof(argv_p)); 109 So that's probably it. I haven't had a chance to look into it yet. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

FW: MSSQL using unixodbc and truncation of characters
by Franks Andy (RLZ) IT Systems Engineer 14 Jun '13

14 Jun '13

Hi, Just to say I tried recompiling freetds again, wondering if an older repo version was missing a function or something but still : rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/local/lib/libtdsodbc.so' : *??~: undefined symbol: get_vtable despite isql working fine.. Hmm, guess that's that then unless there is some expert out there who knows what's going on. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 13 June 2013 16:02 To: FreeRadius users mailing list Subject: Re: MSSQL using unixodbc and truncation of characters Franks Andy (RLZ) IT Systems Engineer wrote: > (by the way is there a nice way to get shot of all these ansi escape > codes from the radius.log? It looks nice in -X mode, but not great > back-end) See radiusd.conf, "log" subeection. Look for "colourise". > So I need to use an explicit sql call to set the database early on, but > otherwise it works without too much hassle, and no truncation of > returned value (!) That's good to hear. > Thanks VERY much, this list is great. Thanks. It's what we do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0