- Freeradius-Users - lists.freeradius.org

Problem with rml_sqlcounter with GigaByte datavolume
by Hanno Schupp 14 Sep '11

14 Sep '11

Dear All, can I ask for some pointers please. in my FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu (Ubuntu LTS 10.04) installation I have followed the Gigabyte instructions on the FreeRADIUS wiki's FAQ http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Oct…. The Usage is calculated correctly, but the check_item value is not what I expect to see (1.7 GB as opposed th 6GB set in radcheck). I understand who the system determines the counter value and it is correctly calculated, but where does the check_item vlaue of 1.7GB come from? I have no idea to be truthful. Any pointers welcome. Thanks in advance. Here the data/logs: Here the relevant debug log: Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Entering module authorize code Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: 'SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}'' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: '%{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'}' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{User-Name} -> lapzel14 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_set_user escaped user --> 'lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Reserving sql socket id: 3 Sat Jun 4 23:10:21 2011 : Debug: rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat finished Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Released sql socket id: 3 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'} -> 2147513300 Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Rejected user lapzel14, check_item=1705032704, counter=2147513300 Sat Jun 4 23:10:21 2011 : Info: ++[noresettotal] returns reject Definition of the noresettotal module in counter.conf: sqlcounter noresettotal { counter-name = Max-All-Total-Octets check-name = Max-All-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql03 key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}'" } and here the radcheck values for user 'lapzel14': [image: Full Texts]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> id<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> UserName<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Attribute<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> op<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Value<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…>[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572098lapzel14User-Password:=loxdas[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572102lapzel14Expiration:=1311932528[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572106lapzel14Simultaneous-Use:=1[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572110lapzel14Max-All-Total:=6000000000

7 17

Replacing Cisco ACS with Free RADIUS
by Sallee, Stephen (Jake) 14 Sep '11

14 Sep '11

Our Cisco ACS was accidentally made useless by some numbskull (me) by raising the functionality level of our AD domain, apparently ACS 4.2 is not compatible with newer MS AD servers ... and once you raise the functionality level ... you can't go back ... go me >:o So! I am trying to replicate the Downloadable IP ACL function that we love so much in ACS, into Free RADIUS. It seems that this is done through the Cisco AV Pair radius attribute. If anyone has experience in this please drop me a line using my included contact info, if we move into production with it I will post back to the list for posterity what we did to get it to work. Any help is always appreciated. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221

3 2

Grant Access
by 2394263740 14 Sep '11

14 Sep '11

Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql When the system goes wrong, I would like temporary grant all access request. Which means during the service is down, any username/password will be grant access. Can you please advise the solution? Thanks! Tom

3 2

Re: Grant Access
by Alan Buxey 14 Sep '11

14 Sep '11

You can't, which is why the reply said it'd only work with basic requests. For wired authentication, you can set the fail port to something useful on the switch, for wireless you can't change the method...the auth process is used to derive the encryption key...and the client expects a challenge response. alan

1 0

distributed database
by Ryan Williams 14 Sep '11

14 Sep '11

I'm looking at implementing freeradius w/MySQL for auth & accounting with a single master database and multiple (initially two) radius servers (slaves). The idea is that the slaves will run freeradius and the master will be integrated with the billing system. The slaves can download an exact copy of the masters radcheck & radreply tables at frequent intervals. - That bit is easy. The difficulty arises when trying to run a distributed session table and also trying to implement some sort of replication so the slaves can push their radacct table back up to the master while avoiding PK conflicts. I'm considering one of the two solutions 1) Make the ID column in both the session table and radacct a NEWID / GUID / statistical key or 2) Add a SlaveID int column to both tables and use a joint ID,SlaveID Primary Key. Does anyone have any experience with either or does anyone have any thoughts on the matter? Regards, Ryan Williams

2 1

Re:Grant Access
by 2394263740 14 Sep '11

14 Sep '11

Arran, I'm using PEAP. Do you have any suggestion to grant access? Thanks! ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Tue, Sep 13, 2011 11:59 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 50 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Grant Access ( 2394263740 ) 2. Re: Grant Access (Arran Cudbard-Bell) 3. Quick enable/disable user account. ( 2394263740 ) 4. Re: Quick enable/disable user account. (Alan DeKok) 5. Re: Quick enable/disable user account. (Arran Cudbard-Bell) 6. RE: Quick enable/disable user account. (Tim Sylvester) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 23:07:31 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Grant Access To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_1ABBB04B470455063AD97831(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql When the system goes wrong, I would like temporary grant all access request. Which means during the service is down, any username/password will be grant access. Can you please advise the solution? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 17:16:02 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Grant Access To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <9285C1EC-7439-4652-8AEC-22FBAD42A485(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" On 13 Sep 2011, at 17:07, 2394263740 wrote: > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > When the system goes wrong, I would like temporary grant all access request. > > Which means during the service is down, any username/password will be grant access. > > Can you please advise the solution? sql if(fail){ update control { Auth-Type := 'Accept' } } This will not work for protocols like PEAP. But should work for PAP, and CHAP. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Tue, 13 Sep 2011 23:32:43 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Quick enable/disable user account. To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_604FCE075B879FA320DD1DCF(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 4 Date: Tue, 13 Sep 2011 17:39:48 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6F7944.5050204(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 2394263740 wrote: > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? See the MySQL documentation for how to write to rows in MySQL. > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. Try harder. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 13 Sep 2011 17:42:54 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <AF7E673D-1735-467E-B0C8-06C49AC33E87(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" No. You're treating this like paid support. Go and find out the answer for yourself, this is not a FeeRADIUS question. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 6 Date: Tue, 13 Sep 2011 08:59:15 -0700 From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> Subject: RE: Quick enable/disable user account. To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <041301cc722e$1745e360$45d1aa20$(a)networkradius.com> Content-Type: text/plain; charset="us-ascii" Set Auth-Type := Reject in radcheck. http://deployingradius.com/documents/configuration/auth_type.html Tim From: freeradius-users-bounces+tim.sylvester=networkradius.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freer adius.org] On Behalf Of 2394263740 Sent: Tuesday, September 13, 2011 8:33 AM To: freeradius-users Subject: Quick enable/disable user account. Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 50 ************************************************

2 1

Re:Quick enable/disable user account.
by 2394263740 14 Sep '11

14 Sep '11

Christ, Thanks for your help. Can you please advise how to configurre a group reject access? Thanks! Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Wed, Sep 14, 2011 02:01 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 51 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Problem with rml_sqlcounter with GigaByte datavolume (Nicolas FOUREL) 2. Re: Problem with rml_sqlcounter with GigaByte datavolume (Suman Dash) 3. Re: Best Practices - maximum NAS entries in clients.conf (Christ Schlacta) 4. Re: Quick enable/disable user account. (Christ Schlacta) 5. Re: Best Practices - maximum NAS entries in clients.conf (Arran Cudbard-Bell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 18:30:55 +0200 From: "Nicolas FOUREL" <nicolas.fourel(a)adipsys.com> Subject: RE: Problem with rml_sqlcounter with GigaByte datavolume To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <4e6f8544.8dc5e30a.148c.558f(a)mx.google.com> Content-Type: text/plain; charset="iso-8859-1" Hi Arran, I have get version 3.0.0 with 64 bit counters support from Git and installed it. Unfortunatly, I still have the same problem with my sql counter which has always "check_item=0" when I put a value bigger than 2^32. On Access-Request in debug mode, I have the following lines : Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: Rejected user foo(a)bar.com, check_item=0, counter=68882 Here is my counter definition : sqlcounter totalinputoctets { counter-name = Total-Max-Input-Octets check-name = Max-Input-Octets reply-name = ChilliSpot-Max-Input-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctInputOctets) FROM radacct WHERE UserName='%{%k}'" } I have added "Max-Input-Octets" in the dictionary file like that : ATTRIBUTE Max-Input-Octets 3001 integer64 In radcheck table: foo(a)bar.com Max-Input-Octets := 107374182400 Did I miss a thing ? Many thanks Nicolas -----Message d'origine----- De?: freeradius-users-bounces+nicolas.fourel=adipsys.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+nicolas.fourel=adipsys.com@lists.freeradius .org] De la part de Arran Cudbard-Bell Envoy??: lundi 12 septembre 2011 11:46 ??: FreeRadius users mailing list Objet?: Re: Problem with rml_sqlcounter with GigaByte datavolume On 12 Sep 2011, at 10:20, nfourel wrote: > Thanks for your reply but I can't find any version 3.x.x of freeRADIUS. Where > can I find it ? > http://git.freeradius.org/ 3.x.x is currently in development on the master branch. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 23:09:39 +0530 From: Suman Dash <sumandash(a)gmail.com> Subject: Re: Problem with rml_sqlcounter with GigaByte datavolume To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CAOywgS8G==MvAZPs=s18pYsN36mA+xzGScb9e0KvcPELOHFsng(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" SELECT SUM(AcctInputOctets) FROM radacct WHERE UserName='username' Run the above query in mysql and post the result then post the freeradius log specific to this section. On Tue, Sep 13, 2011 at 10:00 PM, Nicolas FOUREL <nicolas.fourel(a)adipsys.com > wrote: > Hi Arran, > > I have get version 3.0.0 with 64 bit counters support from Git and > installed > it. Unfortunatly, I still have the same problem with my sql counter which > has always "check_item=0" when I put a value bigger than 2^32. On > Access-Request in debug mode, I have the following lines : > > Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: (Check item - counter) is > less than zero > Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: Rejected user > foo(a)bar.com, > check_item=0, counter=68882 > > Here is my counter definition : > sqlcounter totalinputoctets { > counter-name = Total-Max-Input-Octets > check-name = Max-Input-Octets > reply-name = ChilliSpot-Max-Input-Octets > sqlmod-inst = sql > key = User-Name > reset = never > query = "SELECT SUM(AcctInputOctets) FROM radacct WHERE > UserName='%{%k}'" > } > > I have added "Max-Input-Octets" in the dictionary file like that : > ATTRIBUTE Max-Input-Octets 3001 integer64 > > In radcheck table: > foo(a)bar.com Max-Input-Octets := > 107374182400 > > > Did I miss a thing ? > > Many thanks > > Nicolas > > -----Message d'origine----- > De : > freeradius-users-bounces+nicolas.fourel=adipsys.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+nicolas.fourel > =adipsys.com(a)lists.freeradius > .org] De la part de Arran Cudbard-Bell > Envoy? : lundi 12 septembre 2011 11:46 > ? : FreeRadius users mailing list > Objet : Re: Problem with rml_sqlcounter with GigaByte datavolume > > > On 12 Sep 2011, at 10:20, nfourel wrote: > > > Thanks for your reply but I can't find any version 3.x.x of freeRADIUS. > Where > > can I find it ? > > > > http://git.freeradius.org/ > > 3.x.x is currently in development on the master branch. > > -Arran > > Arran Cudbard-Bell > a.cudbardb(a)freeradius.org > > RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Tue, 13 Sep 2011 10:39:48 -0700 From: Christ Schlacta <lists(a)aarcane.org> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: freeradius-users(a)lists.freeradius.org Message-ID: <4E6F9564.1070103(a)aarcane.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 9/13/2011 00:59, Fajar A. Nugraha wrote: > On Tue, Sep 13, 2011 at 2:43 PM, Phil Mayers<p.mayers(a)imperial.ac.uk> wrote: >> On 09/12/2011 10:42 PM, Fajar A. Nugraha wrote: >>> If I understand raddb/sites-available/dynamic-clients correctly, the >>> only way to store (well, to retrieve actualy) dynamic clients >>> definition in SQL is to use "%{sql:" expansion. Is there a way to make >>> it have some level of redundancy? Last time I check, "%{sql:" can't be >>> used on "virtual" modules (from instantiate or policy section) which >>> groups multiple sql instance together using "redundant". >>> >> You could also use "exec", rlm_perl/python or whatever, all of which can >> themselves call SQL. > possible, though not ideal. > >> Or, perform an SQL query that MUST return some output, parse the results and >> call the individual SQL modules directly - like so: >> >> update control { >> Tmp-String-0 := "%{sql1:select name||','||secret ...}" >> } >> if (control:Tmp-String-0 == "") { >> update control { >> Tmp-String-0 := "%{sql2:...}" >> } >> } > That's what we currently do (for another purpose, not for dynamic > client). However: > - I lost load-balancing feature that comes with redundant-load-balance > - imagine having to create 8 if-elsif block to properly catch error > when working with 8 sql nodes, and write the same sql query 8 times in > the configuration file. Works, but kinda messy. > > With current sql module (that only reads nas list from sql during > startup/HUP) I can use one sql/mysql/*.conf to specify the query, and > have each sql instance $INCLUDE it. If we can do similar thing with > "%{sql:" expansion (e.g. store the query in some temporary internal > variable/attribute) it'd be reduce the measiness greatly, but I > haven't found out how to do it yet. > why not make an arbitrary program that takes the SQL statement as an argument, and returns from the first successful connection. it can take a random number between 0 and n-1 on the number of SQL servers you have, and start connecting from there. you get failover and round-robin load balancing with the convenience of only having to write your query and your series of if-else-if statements once. ------------------------------ Message: 4 Date: Tue, 13 Sep 2011 10:46:21 -0700 From: Christ Schlacta <lists(a)aarcane.org> Subject: Re: Quick enable/disable user account. To: freeradius-users(a)lists.freeradius.org Message-ID: <4E6F96ED.6080307(a)aarcane.org> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" On 9/13/2011 08:32, 2394263740 wrote: > > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? > > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. > > Thanks! > > Tom > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html read up on mysql groups, then use a group that's configured to reject access. add and delete members from that group as needed to disable and re-enable their account. that's what groups are there for. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 5 Date: Tue, 13 Sep 2011 20:01:14 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <97DF6DE5-5FDB-416C-A528-FDC68A1D4274(a)freeradius.org> Content-Type: text/plain; charset=us-ascii On 13 Sep 2011, at 19:39, Christ Schlacta wrote: > On 9/13/2011 00:59, Fajar A. Nugraha wrote: >> On Tue, Sep 13, 2011 at 2:43 PM, Phil Mayers<p.mayers(a)imperial.ac.uk> wrote: >>> On 09/12/2011 10:42 PM, Fajar A. Nugraha wrote: >>>> If I understand raddb/sites-available/dynamic-clients correctly, the >>>> only way to store (well, to retrieve actualy) dynamic clients >>>> definition in SQL is to use "%{sql:" expansion. Is there a way to make >>>> it have some level of redundancy? Last time I check, "%{sql:" can't be >>>> used on "virtual" modules (from instantiate or policy section) which >>>> groups multiple sql instance together using "redundant". >>>> >>> You could also use "exec", rlm_perl/python or whatever, all of which can >>> themselves call SQL. >> possible, though not ideal. >> >>> Or, perform an SQL query that MUST return some output, parse the results and >>> call the individual SQL modules directly - like so: >>> >>> update control { >>> Tmp-String-0 := "%{sql1:select name||','||secret ...}" >>> } >>> if (control:Tmp-String-0 == "") { >>> update control { >>> Tmp-String-0 := "%{sql2:...}" >>> } >>> } >> That's what we currently do (for another purpose, not for dynamic >> client). However: >> - I lost load-balancing feature that comes with redundant-load-balance >> - imagine having to create 8 if-elsif block to properly catch error >> when working with 8 sql nodes, and write the same sql query 8 times in >> the configuration file. Works, but kinda messy. >> >> With current sql module (that only reads nas list from sql during >> startup/HUP) I can use one sql/mysql/*.conf to specify the query, and >> have each sql instance $INCLUDE it. If we can do similar thing with >> "%{sql:" expansion (e.g. store the query in some temporary internal >> variable/attribute) it'd be reduce the measiness greatly, but I >> haven't found out how to do it yet. >> > why not make an arbitrary program that takes the SQL statement as an argument, and returns from the first successful connection. it can take a random number between 0 and n-1 on the number of SQL servers you have, and start connecting from there. you get failover and round-robin load balancing with the convenience of only having to write your query and your series of if-else-if statements once. Calling out to anything outside of FreeRADIUS comes with a big performance penalty. I do sometimes wonder whether 'update config' would be useful as an interim hack for some of this stuff. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 51 ************************************************

3 2

Re:Quick enable/disable user account.
by 2394263740 14 Sep '11

14 Sep '11

Arran, Thanks for your help as always. You have helped me to fix about 5 of my major issues. The support from you is very helpful. Thanks! Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Wed, Sep 14, 2011 09:27 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 53 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Quick enable/disable user account. (Arran Cudbard-Bell) 2. Re: Quick enable/disable user account. (Marinko Tarlac) 3. Re:Grant Access ( 2394263740 ) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 22:32:06 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <99359D5B-34B0-4277-BCE7-379EF2FC48F4(a)freeradius.org> Content-Type: text/plain; charset=us-ascii > So what are the most proper ways to mark a user in an sql database as either active or inactive, enabled or disabled? It's implementation specific! FreeRADIUS gives you the tools to defined the policies, but its up to the individual administrators to decide what they should be. Like Skinning Cats and Perl, there are many ways to achieve the same result. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 23:01:03 +0200 From: Marinko Tarlac <mangia81(a)gmail.com> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6FC48F.7060201(a)gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Imagine that you have 5 000 disabled accounts and that you constantly rejecting them over and over again... Better option is to create specific group (for example disabled_accounts with specific IP Pool) and assign users to this group when you want to block them. Then you can redirect them to specific web page with "welcome" message :) On 9/13/2011 5:59 PM, Tim Sylvester wrote: > > Set Auth-Type := Reject in radcheck. > > http://deployingradius.com/documents/configuration/auth_type.html > > Tim > > *From:*freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org > [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org] > *On Behalf Of *2394263740 > *Sent:* Tuesday, September 13, 2011 8:33 AM > *To:* freeradius-users > *Subject:* Quick enable/disable user account. > > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? > > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. > > Thanks! > > Tom > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Wed, 14 Sep 2011 09:27:00 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Re:Grant Access To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_7839F3D17E696E8063A56BF4(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Arran, I'm using PEAP. Do you have any suggestion to grant access? Thanks! ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Tue, Sep 13, 2011 11:59 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 50 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Grant Access ( 2394263740 ) 2. Re: Grant Access (Arran Cudbard-Bell) 3. Quick enable/disable user account. ( 2394263740 ) 4. Re: Quick enable/disable user account. (Alan DeKok) 5. Re: Quick enable/disable user account. (Arran Cudbard-Bell) 6. RE: Quick enable/disable user account. (Tim Sylvester) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 23:07:31 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Grant Access To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_1ABBB04B470455063AD97831(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql When the system goes wrong, I would like temporary grant all access request. Which means during the service is down, any username/password will be grant access. Can you please advise the solution? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 17:16:02 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Grant Access To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <9285C1EC-7439-4652-8AEC-22FBAD42A485(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" On 13 Sep 2011, at 17:07, 2394263740 wrote: > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > When the system goes wrong, I would like temporary grant all access request. > > Which means during the service is down, any username/password will be grant access. > > Can you please advise the solution? sql if(fail){ update control { Auth-Type := 'Accept' } } This will not work for protocols like PEAP. But should work for PAP, and CHAP. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Tue, 13 Sep 2011 23:32:43 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Quick enable/disable user account. To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_604FCE075B879FA320DD1DCF(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 4 Date: Tue, 13 Sep 2011 17:39:48 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6F7944.5050204(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 2394263740 wrote: > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? See the MySQL documentation for how to write to rows in MySQL. > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. Try harder. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 13 Sep 2011 17:42:54 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <AF7E673D-1735-467E-B0C8-06C49AC33E87(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" No. You're treating this like paid support. Go and find out the answer for yourself, this is not a FeeRADIUS question. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 6 Date: Tue, 13 Sep 2011 08:59:15 -0700 From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> Subject: RE: Quick enable/disable user account. To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <041301cc722e$1745e360$45d1aa20$(a)networkradius.com> Content-Type: text/plain; charset="us-ascii" Set Auth-Type := Reject in radcheck. http://deployingradius.com/documents/configuration/auth_type.html Tim From: freeradius-users-bounces+tim.sylvester=networkradius.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freer adius.org] On Behalf Of 2394263740 Sent: Tuesday, September 13, 2011 8:33 AM To: freeradius-users Subject: Quick enable/disable user account. Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 50 ************************************************ -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 53 ************************************************

1 0

Best Practices - maximum NAS entries in clients.conf
by Sallee, Stephen (Jake) 13 Sep '11

13 Sep '11

@ everyone We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use? Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR? Jake Sallee Godfather of Bandwidth Network Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221

8 20

Failure to activate mysql
by Majid Dadashi 13 Sep '11

13 Sep '11

Hi, I have the following platform: FreeRadius Version: freeradius-server-2.1.11 OS: Ubuntu 11.04 I did all the instructions in "http://wiki.freeradius.org/SQL-HOWTO" to activate mysql in free radius, but I get the following error: Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[166]: Failed to load module "sql". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. I just have a file named "rlm_sql_mysql.so" in the following address: "./src/modules/rlm_sql/drivers/rlm_sql_mysql" what do you think is the problem? Cheers

3 4