- Freeradius-Users - lists.freeradius.org

Logrotate tool
by yagizozen 15 May '12

15 May '12

Hello everyone, As you know, FR has a radius.log file under /var/log/radius directory. I noticed that inside the logrorate file, radius.log is set to rotate every month. Like this : /var/log/radius/radius.log { monthly rotate 100 create missingok compress } This is by default. I changed this to "daily" but the problem is, I need to restart radius everytime when the new day comes in order to write to NEW radius.log file. If I do not restart, it tries to point the compress version of the old radius.log. Why is that? I also can not do this inside an external script. When I rename the file inside the script, it still writes to the new renamed radius.log file. Any suggestions or any place for me to read? Thanks You in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Logrotate-tool-tp5709081.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

return list
by Luo, Frank Y.F. Mr. 15 May '12

15 May '12

I have a senario, no ldap schema extension is wanted ( no ldap group or profile is wanted); we do use ldap authentication though; and it works fine. after authentication, we need to check one ldap attribute like "vpn" and and return "class: ou={ldap vpn value}" back to the radius client (the cisco concentrator). So in the sites_avaiable/default, I have this post-auth { update reply { class = "ou=%Profile" } and in ldap.attrmap, i have replyItem Profile VPN There must a syntax error on how to refer a ldap attribute value here. since what I got is this # Executing section post-auth from file /opt/freeradius/etc/raddb/sites-enabled/default +- entering group post-auth {...} WARNING: Unknown variable '%P': See 'doc/variables.txt' expand: ou=%Profile -> ou=%Profile ++[reply] returns noop Any clue how to implement this? THanks Frank

2 1

change of acct_status type
by Sharad P 15 May '12

15 May '12

hi, can I change ACCT_STATUS_TYPE to interim update.if yes.Please tell me the procedure. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/change-of-acct-status-type-tp570979… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Multiple challenges to login
by Maria Sanchez 14 May '12

14 May '12

We are having problems when accessing our sites. No matter which browser we use to access it always requests authentication twice. We have an Apache web server (v.2.2) with mod_auth_radius 2.0 installed. And we have mounted a Jboss application using mod_jk module and protected access to it. I am not able to find any information about this and this is becoming a big problem. This is the configuration for radius.conf: <Location /> AuthType Basic AuthName "RADIUS authentication" AuthBasicAuthoritative Off AuthRadiusAuthoritative on AuthRadiusCookieValid 0 AuthRadiusActive On require valid-user </Location> I have been playing with the values of the cookies, I originally had it in 5 and changed it to 0 but didn't help. Any ideas why this can be happening? Thanks, Maria

2 1

Re:re: Re: Ldap attribute in pre-proxy possible?
by Mike 14 May '12

14 May '12

> Phil, I meant to say proxy-request, not proxy-reply. Secondly, why would you need a log file to show an attribute expanding to nothing? I just told you it is expanding to nothing aka it has no assigned value once reaching the pre-proxy stage. > Message: 3 > Date: Fri, 11 May 2012 18:07:40 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Ldap attribute in pre-proxy possible? > Message-ID: <4FAD475C.7090109(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 11/05/12 16:39, Mike wrote: >> Hello, >> >> Is it possible store and access an ldap attribute in pre-proxy? 1. >> Attribute defined in dictionary 2. Attribute mapped in ldap.attrmap >> 2. Trying to access using: >> >> pre-proxy { If (%{reply:attributename} == "cookies" { update >> proxy-reply { Whatever = "cookies" }} } > > You can't update the proxy-reply in pre-proxy; there is no proxy-reply > at this stage. > >> >> the problem is the attribute is expanding to nothing. This does work >> in the auth section but i need to update the proxy msg. What am i >> doing wrong? > > We don't know, because we're not psychic and you didn't include a debug > of it failing. > > > > ------------------------------ > > Message: 4 > Date: Fri, 11 May 2012 13:42:29 -0400 > From: "Luo, Frank Y.F. Mr." <luoy(a)muohio.edu> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: max_request > Message-ID: <200CB918-2061-4829-A888-8901A235E952(a)muohio.edu> > Content-Type: text/plain; charset="us-ascii" > > So there is this setting max_request that the server keeps track of. The question is how i can find the current active request that the server keeps track of. > > My experience is the sever silently drops the connection if max_request is reached. So I want to find out more info about the current status of the server. > > Thanks > > Frank > > > > ------------------------------ > > Message: 5 > Date: Fri, 11 May 2012 20:25:06 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: max_request > Message-ID: <4FAD5982.1080708(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Luo, Frank Y.F. Mr. wrote: >> So there is this setting max_request that the server keeps track of. The question is how i can find the current active request that the server keeps track of. >> >> My experience is the sever silently drops the connection if max_request is reached. So I want to find out more info about the current status of the server. > > In 2.1.12, there's no way to see that number in a "live" server. > > Alan DeKok. > > > ------------------------------ > > Message: 6 > Date: Fri, 11 May 2012 14:31:09 -0400 > From: "Luo, Frank Y.F. Mr." <luoy(a)muohio.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: max_request > Message-ID: <0C11C863-C520-491D-AD91-320B65E54B97(a)muohio.edu> > Content-Type: text/plain; charset="us-ascii" > > are you sure? > > Then how do i know I run out of request number and need to increase it? > > Thanks > > Frank > On May 11, 2012, at 2:25 PM, Alan DeKok wrote: > >> Luo, Frank Y.F. Mr. wrote: >>> So there is this setting max_request that the server keeps track of. The question is how i can find the current active request that the server keeps track of. >>> >>> My experience is the sever silently drops the connection if max_request is reached. So I want to find out more info about the current status of the server. >> >> In 2.1.12, there's no way to see that number in a "live" server. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 7 > Date: Fri, 11 May 2012 20:39:03 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: max_request > Message-ID: <4FAD5CC7.1090502(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Luo, Frank Y.F. Mr. wrote: >> are you sure? >> >> Then how do i know I run out of request number and need to increase it? > > You read the logs. > > You CANNOT increase it while the server is running. > > The best approach is to set it to a large value, and ignore it. If > you get errors in the logs about "max_requests", it means that something > is catastrophically wrong. Increasing "max_requests" WILL NOT HELP. > > You will need to fix the underlying problem: usually a slow / broken > database. > > Alan DeKok. > > > ------------------------------ > > Message: 8 > Date: Fri, 11 May 2012 14:45:29 -0400 > From: "Luo, Frank Y.F. Mr." <luoy(a)muohio.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: max_request > Message-ID: <A6E5F923-8012-468F-8E93-5CA954B97F87(a)muohio.edu> > Content-Type: text/plain; charset="us-ascii" > > I will read the logs - but what I look for in the log? > > I already set it to a large value and don't expect problem but i wan to verify that by either find the "active" request number or look for something in log to make sure it is / is not this max_request problem. > > THanks > > Frank > > > On May 11, 2012, at 2:39 PM, Alan DeKok wrote: > >> Luo, Frank Y.F. Mr. wrote: >>> are you sure? >>> >>> Then how do i know I run out of request number and need to increase it? >> >> You read the logs. >> >> You CANNOT increase it while the server is running. >> >> The best approach is to set it to a large value, and ignore it. If >> you get errors in the logs about "max_requests", it means that something >> is catastrophically wrong. Increasing "max_requests" WILL NOT HELP. >> >> You will need to fix the underlying problem: usually a slow / broken >> database. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 9 > Date: Fri, 11 May 2012 14:12:16 -0500 > From: Steve Hopps <steve.hopps(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: EAP/TTLS Auth problem > Message-ID: > <CAOxapJxED9bgrpE=UCpcrNi9NGKMv7U-EyaSzh2As=xTw2VZwQ(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I'm trying to use FreeRadius with OpenLDAP for authentication of some > Nanostation M2 access points, but have had no luck getting it to work. > When using rad_eap_test to experiment, I logged the following: > > Found Auth-Type = PAP > # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel > +- entering group PAP {...} > [pap] login attempt with password "-removed-" > [pap] Using CRYPT password "*" > [pap] Passwords don't match > ++[pap] returns reject > Failed to authenticate the user. > > Can anyone suggest what I'm doing wrong? The output for this section > is the same with rad_eap_test or the AP itself. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 85, Issue 39 > ************************************************

3 2

Sql radgroupcheck match airespace-wlan-id
by Paolo Barbato 14 May '12

14 May '12

I suppose to have sort out this……but I want reject user "paolo" when coming from airespace-wlan-id = 5 radcheck 9 paolo Expiration := 15 May 2012 8 paolo Cleartext-Password := paolo radusergroup paolo rfxguest 0 radgroupcheck 4 rfxguest Airespace-Wlan-Id := 5 radgoupreply 1 rfxguest Auth-Type := Reject radius -X …. Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "xxxxxx" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" ….. [peap] Using saved attributes from the original Access-Accept Auth-Type := Reject Session-Timeout = 48445 User-Name = "paolo" [eap] Freeing handler ++[eap] returns ok Login OK: [paolo] (from client private-network-1 port 1 cli 00-24-36-b6-3a-22) EAP-PEAP tunnel reply attribute return Auth-Type = Reject but paolo is authenticated. Any details to look into to debug this ? Thanks fro any reply, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 4

Accounting-Response disable
by peterpz 12 May '12

12 May '12

Hello Guys, I'm trying to configure my FreeRadius.net 1.1.7-r0.0.2, but am failing all the time. My goal is to receive accounting-requests from one of proxy servers in our network and save them in the log file. This is done succesfully, I added new client to the clients.conf file. The issue is that FreeRadius is responding to each packet (Accounting-Response). This was not welcome by proxy administrator, who does not want to receive anything from me. But I cannot configure FreeRadius to not send that packets. When in the radiusd.conf I will comment "detail" line from "accounting" module the Accounting-Responses are not send (super!), but also logging is disabled (sic!). How to disable reponses but without disabling logging? Remember, I have 1.1.7 (installed on Windows system). I will appreciate any help, because I already spent whole day on this issue! Best Regards, Peter -- View this message in context: http://freeradius.1045715.n5.nabble.com/Accounting-Response-disable-tp57069… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

max_request
by Luo, Frank Y.F. Mr. 12 May '12

12 May '12

So there is this setting max_request that the server keeps track of. The question is how i can find the current active request that the server keeps track of. My experience is the sever silently drops the connection if max_request is reached. So I want to find out more info about the current status of the server. Thanks Frank

3 8

Ldap attribute in pre-proxy possible?
by Mike 11 May '12

11 May '12

Hello, Is it possible store and access an ldap attribute in pre-proxy? 1. Attribute defined in dictionary 2. Attribute mapped in ldap.attrmap 2. Trying to access using: pre-proxy { If (%{reply:attributename} == "cookies" { update proxy-reply { Whatever = "cookies" }} } the problem is the attribute is expanding to nothing. This does work in the auth section but i need to update the proxy msg. What am i doing wrong?

2 1

logintime attribute - most specific time
by jomajo 11 May '12

11 May '12

Hello. I found an old example here how to set logintime attributes , http://www.gnu.org/software/radius/manual/html_node/radius_236.html . But maybe you know how to set logintime for the specific day of month / month / year ? Etc. this attribute says that user can login at this time : 2012/04/17/1700-1800 Thank you for the information! -- View this message in context: http://freeradius.1045715.n5.nabble.com/logintime-attribute-most-specific-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8