- Freeradius-Users - lists.freeradius.org

Re: MAX-Monthly-Traffic V2 Post
by Neville 21 Aug '09

21 Aug '09

Hi Alex, > You are expecting an interim update to send session-timeout to your nas > so it disconnect your user? > If so, two things seems incorrect to me. > > 1- You're measuring traffic volume and want disconnection to set > based on time (session-timout)... a bit tricky isn't it? So VERY True, Too many late nights and I really do appreciate your input as this gave me food for thought and I now have EVERYTHING Working. Both for Traffic & Session USAGE. For Usage, I still had to use Max-Monthly-Traffic as a Check := and based on sqlcounter calc, do a Reply = Sessions-Octets-Limit = XXXXXX on the Access-Accept as this is supported by the ppp 2.4.4 NAS. What I would like to know now, is how I can use sqlcounter to do a Month Calculation based on the date of the account being registered and NOT the Calander Month? Anyone? > 2- I think the attribute "Session-Timeout" cannot be found in > interim-updates packets (maybe I'm wrong), rfc 2869 specify that: "It > is envisioned that an Interim Accounting record (with Acct-Status-Type = > Interim-Update (3)) would contain all of the attributes normally found > in an Accounting Stop message with the exception of the > Acct-Term-Cause attribute." > > What you would need is an attribute known by your nas and representing > remaining traffic. That attrbute should be sent at acct-start time and > would trigger a disconnection from the NAS when traffic limit is > reached. If such a attribute does not exists for your NAS, you should > take a look at CoA server. > Maybe someone have better idea...? > > Le mercredi 19 ao?t 2009 ? 15:56 +0100, Neville a ?crit : > Cheers Nev ================ CentOS 5.3 pptpd 1.3.4 / ppp 2.4.4 freeradius2 2.1.6 radiusclient-ng 0.5.6 daloRadius 0.9-8-SVN ================

2 2

Re: MS 8021.x PEAP failing
by Gary Gatten 20 Aug '09

20 Aug '09

Yup, that line is there. Much of the doc online is WAY out of date, so I'm wondering if by actually RTFM first I broke something? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'FreeRadius users mailing list' <freeradius-users(a)lists.freeradius.org> Sent: Thu Aug 20 14:09:31 2009 Subject: RE: MS 8021.x PEAP failing > I've been playing around with conf/module files trying to strip the > DOMAIN out of my login request - but no luck! Have you tried "with_ntdomain_hack = yes" in the mschap module config? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 2

Kerberos Hardware Pre_auth
by Larry Ross 20 Aug '09

20 Aug '09

Good Morning All; I am looking for direction into correcting an issue with FR 2.X authenticating against a Krb5 directory with Hardware Pre-Auth enabled. Currently I am not finding any luck in getting this off the ground. Thank you Larry Ross Network Operations University California Davis http://www-noc.ucdavis.edu lfross(a)ucdavis.edu<mailto:lfross@ucdavis.edu>

2 1

freeradius with oracle
by shivashankar 20 Aug '09

20 Aug '09

hi , when i run radiusd -X facing below problem. Could not link driver rlm_sql_oracle: ld.so.1: radiusd: fatal: rlm_sql_oracle.so Make sure it (and all its dependent libraries!) are in the search path of your s /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[161]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section Errors initializing modules when i do googlin i found ========= $ vi src/modules/rlm_sql/drivers/rlm_sql_oracle/Makefile Set TARGET = rlm_sql_oracle, and edit the CFLAGS && LDFLAGS lines to ave the appropriate values: -I/opt/oracle/instantclient_11_1/sdk/include, and -L /opt/oracle/instantclient_11_1/ -loracle (?) After than, cd to the directory, and type "make". Alan DeKok ===================== but i don;t have instantclient_11_1/sdk/include directry struction in opt/oracle. plz help -- View this message in context: http://www.nabble.com/freeradius-with-oracle-tp25059683p25059683.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

(no subject)
by Irina 20 Aug '09

20 Aug '09

Hello, Could someone let me know if I can insert a new NAS in the following format insert into nas values('','xx.xx.xx.112/29','shortname',....) Or do I have to insert each IP individually insert into nas values('','xx.xx.xx.112','shortname',....) insert into nas values('','xx.xx.xx.113','shortname',....) etc... Thank you for your help in advance. Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== Hello, Sorry the same message (I posted yesterday) was posted today again. My emaiil program acted up. I will try to re-phrase of what I need I was given a set of new NASes (that I need to allow as 'NASNAME' in 'nas' table in MySQL) in the following format xx.xx.xx.112/29 xx.xx.xx.232/29 I am not sure if I can use it as it is in 'nas' table as 'nasname'. Or, do I have to enter each NAS IP individually? Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== ----- Original Message ----- From: Irina To: freeradius-users(a)lists.freeradius.org Sent: Monday, August 17, 2009 10:54 AM Subject: NAS IPs Hello, I need to allow a block of 8 IP addresses in nasname column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina =========================== ________________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Re: buffered_sql and detail module
by ramesh p 20 Aug '09

20 Aug '09

Got it. I was specifying detail file path incorrect and it's not finding it.one more question regarding this. sites-available/default have preprocess section. and same section in sites-enabled/buffered-sql present. Does preprocess section in buffered-sql needs to be commented out? Thanks. > > Message: 4 > Date: Thu, 20 Aug 2009 09:23:06 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: buffered_sql and detail module > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090820082306.GA5581(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I'm using the following configuration but it's not working. > ^^^^^^^^^^^^^^^^^^ > > whats not working? whats the symptoms? wheres the radiusd -X ? > > alan > > > ------------------------------ >

2 1

(no subject)
by Irina 20 Aug '09

20 Aug '09

Hello Gary, thank you very much for your reply. No, not the wildcards. Few IPs within the same class. I was not sure if I could use /29. Thanks again. Irina =================== If you're asking if you can use classless masks to represent a block of IP's, yes you can. If you're asking if you can use "wildcards" in the IP addresses - I don't know... I doubt it. -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Irina Sent: Thursday, August 20, 2009 9:52 AM To: freeradius-users(a)lists.freeradius.org Subject: Hello, Could someone let me know if I can insert a new NAS in the following format insert into nas values('','xx.xx.xx.112/29','shortname',....) Or do I have to insert each IP individually insert into nas values('','xx.xx.xx.112','shortname',....) insert into nas values('','xx.xx.xx.113','shortname',....) etc... Thank you for your help in advance. Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== Hello, Sorry the same message (I posted yesterday) was posted today again. My emaiil program acted up. I will try to re-phrase of what I need I was given a set of new NASes (that I need to allow as 'NASNAME' in 'nas' table in MySQL) in the following format xx.xx.xx.112/29 xx.xx.xx.232/29 I am not sure if I can use it as it is in 'nas' table as 'nasname'. Or, do I have to enter each NAS IP individually? Kindest Regards, Irina NetAccess Systems Inc. irina(a)nas.net =========================== ----- Original Message ----- From: Irina To: freeradius-users(a)lists.freeradius.org Sent: Monday, August 17, 2009 10:54 AM Subject: NAS IPs Hello, I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina =========================== ________________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius and Cisco
by Rokkhan 20 Aug '09

20 Aug '09

HelloI I have been testing with my freeradius and cisco devices, such as switches, firewalls, acces points, ... Now, I´m able to configure users validation through freeradius with Access Points and Peap. Get shell acces to cisco devices and establish the level privilege of them with freeradius. And configure dot1x interfaces on switches to validate users and configure ports on diferent VLAN through Freeradius. I want to know if there is anything more that can be managed, with Freeradius, on Cisco devices. I want to explore all the options that freeradius brings to us. Thanks in advance.

1 0

Thread create failed: Cannot allocate memory
by Omer Faruk SEN 20 Aug '09

20 Aug '09

Hi, I have lived the same problem depicted here. Alan De kok suggested to prevent the thread creation http://lists.cistron.nl/pipermail/freeradius-users/2007-October/msg00257.ht… . Is there another solution for that (maybe changing a sysctl value ) since machine has lots of memory and very less was used. We use freeradius 2.1.1 and rhel 5.3 x86 -- Best regards, Omer mailto:omer@faruk.net

1 0

Max Monthly Traffic
by Neville 20 Aug '09

20 Aug '09

Hi everyone, I'm trying to setup a new counter maxmonthlytraffic, but as soon as I connected, sql_counter sends reply to do a session timout and I get disconnected. This is what I've done so far... I've added to ./raddb/sql/mysql/counter.conf sqlcounter monthlytraffic { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT (sum(acctinputoctets)+sum(acctoutputoctets)) \ FROM radacct WHERE username='%{%k}' AND \ Month(acctstoptime) =(Month(NOW())) AND \ Year(acctstoptime) = Year(NOW())" } authorize { .. monthlytraffic } instantiate { monthlytraffic } created a dictionary entry in daloradius as.. id 9433 Type integer Attribute Max-Monthly-Traffic Value NULL Format NULL Vendor dictionary.freeradius.internal RecommendedOP := RecommendedTable check RecommendedHelper RecommendedTooltip Check Monthly Traffic Allowance User created as "testmaxm", with the following attributes set:- Check Simultaneous-Use := 1 Pool-Name := tvpool Cleartext-Password := testmaxm Max-Monthly-Traffic := 10490000 (10Mb) (If this is removed from the Check, the user connects fine, so everything else is working) Reply Framed-MTU = 1400 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 (Every 5 mins for testing) Some Debug... rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user testmaxm, check_item=10490000, counter=80411 rlm_sqlcounter: Sent Reply-Item for user testmaxm, Type=Session-Timeout, value=11601138 ++[monthlytraffic] returns ok rad_recv: Accounting-Request packet from host aaa.bbb.ccc.ddd port 53637, id=47, length=140 Acct-Session-Id = "4A8B6FA0721900" User-Name = "testmaxm" Acct-Status-Type = Interim-Update Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 600 Acct-Output-Octets = 37033544 Acct-Input-Octets = 906612 Acct-Output-Packets = 27837 Acct-Input-Packets = 15791 NAS-Port-Type = Async Framed-IP-Address = 192.168.0.29 NAS-Identifier = "aaa.bbb.ccc.ddd" NAS-Port = 1 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 193.33.186.190,NAS-IP-Address = aaa.bbb.ccc.ddd,Acct-Session-Id = "4A8B6FA0721900",User-Name = "testmaxm"' [acct_unique] Acct-Unique-Session-ID = "049e959019a363e4". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "testmaxm", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/aaa.bbb.ccc.ddd/detail-20090819 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/aaa.bbb.ccc.ddd/detail-20090819 [detail] expand: %t -> Wed Aug 19 03:31:04 2009 ++[detail] returns ok rlm_sql (sql): Reserving sql socket id: 1 [sqlippool] expand: %{User-Name} -> testmaxm [sqlippool] sql_set_user escaped user --> 'testmaxm' [sqlippool] expand: START TRANSACTION -> START TRANSACTION rlm_sql_mysql: query: START TRANSACTION [sqlippool] expand: UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}' -> UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = 'aaa.bbb.ccc.ddd' AND pool_key = '1' AND username = 'testmaxm' AND callingstationid = '' AND framedipaddress = '192.168.0.29' rlm_sql_mysql: query: UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = 'aaa.bbb.ccc.ddd' AND pool_key = '1' AND username = 'testmaxm' AND callingstationid = '' AND framedipaddress = '192.168.0.29' [sqlippool] expand: COMMIT -> COMMIT rlm_sql_mysql: query: COMMIT rlm_sql (sql): Released sql socket id: 1 ++[sqlippool] returns ok [sql] expand: %{User-Name} -> testmaxm [sql] sql_set_user escaped user --> 'testmaxm' [sql] expand: %{Acct-Input-Gigawords} -> [sql] expand: %{Acct-Input-Octets} -> 906612 [sql] expand: %{Acct-Output-Gigawords} -> [sql] expand: %{Acct-Output-Octets} -> 37033544 [sql] expand: UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET framedipaddress = '192.168.0.29', acctsessiontime = '600', acctinputoctets = '0' << 32 | '906612', acctoutputoctets = '0' << 32 | '37033544' WHERE acctsessionid = '4A8B6FA0721900' AND username = 'testmaxm' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: UPDATE radacct SET framedipaddress = '192.168.0.29', acctsessiontime = '600', acctinputoctets = '0' << 32 | '906612', acctoutputoctets = '0' << 32 | '37033544' WHERE acctsessionid = '4A8B6FA0721900' AND username = 'testmaxm' AND nasipaddress = 'aaa.bbb.ccc.ddd' rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> testmaxm attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 47 to aaa.bbb.ccc.ddd port 53637 Finished request 16. Cleaning up request 16 ID 47 with timestamp +1965 Going to the next request Ready to process requests. Given that the usages is now "37940156" e.g. 906612 + 3733544 and is more than the initial check value of Max-Monthly-Traffic := 10490000 I would have expected a Reply Timeout being sent to disconnect me. However on disconnecting and reconnecting I get... rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user testmaxm, check_item=10490000, counter=89021682 ++[monthlytraffic] returns reject Invalid user (rlm_sqlcounter: Maximum monthly usage time reached): [testmaxm/<via Auth-Type = mschap>] (from client VPN1-UK port 1) rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user testmaxm, check_item=10490000, counter=89021682 ++[monthlytraffic] returns reject Invalid user (rlm_sqlcounter: Maximum monthly usage time reached): [testmaxm/<via Auth-Type = mschap>] (from client VPN1-UK port 1) Any Ideas why I did not get disconnect during the original session as this is what I'm after. Thx Nev ================ CentOS 5.3 pptpd 1.3.4 / ppp 2.4.4 freeradius2 2.1.6 radiusclient-ng 0.5.6 daloRadius 0.9-8-SVN ================

4 5