- Freeradius-Users - lists.freeradius.org

RE: Unknown attribute "Max-All-Session"
by boroba -- 01 Aug '09

01 Aug '09

From: flache4(a)hotmail.com To: flache4(a)hotmail.com Subject: RE: Unknown attribute "Max-All-Session" Date: Fri, 31 Jul 2009 15:56:03 +0000 thanks for reply i have install freeradius2 and configure it like http://wiki.freeradius.org/Rlm_sqlcounter and i get error when i start it. Fri Jul 31 15:55:36 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Jul 31 15:55:36 2009 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/users[204]: Parse error (check) for entry test0001: Invalid octet string "540" for attribute name "Max-All-Session" Fri Jul 31 15:55:36 2009 : Error: Errors reading /etc/raddb/users Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/modules/files[7]: Instantiation failed for module "files" Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Fri Jul 31 15:55:36 2009 : Error: Failed to load virtual server inner-tunnel Fri Jul 31 15:55:36 2009 : Error: Errors initializing modules thanks in advance Avec Windows Live, vous organisez, retouchez et partagez vos photos. _________________________________________________________________ Sur Windows Live Ideas, découvrez en exclusivité de nouveaux services en ligne... si nouveaux qu'ils ne sont pas encore sortis officiellement sur le marché ! http://ideas.live.com

3 4

Script for logging out user from their session
by Deepak 01 Aug '09

01 Aug '09

Hi, I am a newbie trying to create a prepaid hotspot and I am using following. CentOS 5.3 freeradius2-2.1.6 mysql 5.0.45 daloradius-0.9-8 chillispot 1.0 (in dd-wrt) I have managed to put this all together and it is working fine so far. Now I wanted to try that if I will give a user 1 hour time (1 hour prepaid card is sold and assumed that user can consume that within infinite period of time without expiration), i want to limit that time strictly. For this I have implemented the "Max-All-Session" Attribute and so far it is working during login time (not during user session). So following is the problem: 1) User have 1 hour and if he is continuously logged in more than 1 hour, there is no way he will be automatically logged out. 2) For solution to this, I have implemented the "Session-Timeout" of 1 hour (3600) together with "Max-All-Session". This solution works given that user is not interrupted (or logged in continuously for 1 hour or more). This strategy fails when user logs out before 1 hour and logs in again. Supposing he still have 20 mins total time left, when he logs back in , his session timeout is again 1 hour so if continues to use until session timeout, he will end up using more than his time. This is worse if user logs in multiple time within credited time period. In this situation, what I wanted to do is - No matter what, when user reaches his time limit, he will be logged out from his session (if logged in) or not accept login request anymore ("Max-All-Session" already does this). 3) Now to implement the former condition I did some research and found out that freeradius is not designed to kick the user however we need to send the "Packet of Disconnect" to NAS (AP) by some means of script. It is also assumed (I guess) that we will monitor their account table and hand pick the user by ourselves and disconnect them manually. Instead I want to automate this thing. 4) After some research for this automation, I found out about the "radkill" untility (which is not exactly I wanted) but got some idea that we can do following step to logout user automatically (a) Find out about that user session and from which NAS he is logged in (radwho can be used for this purpose) (b) Send the packet of disconnect to that NAS for that particular user. Now before reinventing the wheel, I have been asking a question to myself for sometime (a) In the prepaid users scenario, there may be hundreds of users connected. Isn't that keeping track of each user's time in real time through some kind of daemon will be CPU intensive task? and overkill for the server? (b) Instead of keeping track in eating CPU cycles and memory, I though it would be nice to use and implement this logic when accounting packet arrives from chilli to radius (something like database triggerers). so when accounting packet arrives for any particular user, radius will check his "Max-All-Session" against used sum of used sessions and if necessary, send the packet of disconnect to the NAS. Well the problem is I don't know how to implement this since I am very new to freeradius and this whole hotspot thing. (c) Lastly, I am just wondering that somebody must have faced this problem before and made a solution considering many hotspot solutions available today. or am I seriously missing something (since new in this area), or there are more sleek approach to this problem than what I am thinking, which is readily available out of the box. In any case, can somebody guide me where to look for the solution on what I am trying to implement? Any suggestions, ideas most welcome Thanks and Regards P.S.: This is a cross post. Sorry I for that but I think this is the best place to post about this. This is also posted at Chilli forum http://www.chillispot.info/chilliforum/viewtopic.php?id=363 -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

2 2

Re: Freeradius-Users Digest, Vol 52, Issue 2
by Gilbert Lo 01 Aug '09

01 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Decoupled accounting
by Devinder Singh 01 Aug '09

01 Aug '09

Hi Ivan, I refeer only to version 1.0.4 for the serial file as its not there in /etc/raddb/certs/demoCA so i get the serial file from version 1.0.4 But i still get the errror message Bad Encrypt. What shoud i do next. I have created the certificates alomoist 5 times already . The massspord user for .CA.root myettelap .CA.server devin myettelap Pls help on this Regards Devinder } > rlm_eap: SSL error error:06065064:digital envelope > routines:EVP_DecryptFinal_ex:bad decrypt > rlm_eap_tls: Error reading private key file /etc/wireless-auth/linux-7v1x.pem > rlm_eap: Failed to initialize type tls > /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > /etc/raddb/sites-enabled/default[280]: Failed to find module "eap". > /etc/raddb/sites-enabled/default[227]: Errors parsing authenticate section. > } > Errors initializing modules 2009/8/1 Devinder Singh <devinbhullar(a)gmail.com>: > Hi Ivan > > Actually im am using version 2.1.1 Free Radius and i need the serial > file from 1.0.4 > > devinder > > 2009/7/31 Ivan Kalik <tnt(a)kalik.net>: >>> Hi Ivan >>> This is how generetd the certs and radiusd -X gives error >> ... >>> /home/palette/Desktop/freeradius-1.0.4/raddb/certs/demoCA/ >> ... >> >> Ah, this is 1.0.4! Don't use that for EAP. It's incompatible with Vista, >> XP SP2, SP3, ... Upgrade. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> > > > > -- > Devinder > -- Devinder

1 0

radwho error: Is this minor typo error in rpm packaging?
by Deepak 01 Aug '09

01 Aug '09

Hi, I have rpm based freeradius package installed in my CentOS 5.3 box. In the course of experimentation, I noticed that radwho gives me following error: ========== "/var/log/radius/sradutmp: No such file or directory" ========== I guess this is a minor typo error in rpm package. Actually radwho should be looking for "radutmp" file not "sradutmp". If this is true, when can I expect the new fixed package? Thanks and Regards -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

1 0

Re: Restart radiusd after new user added
by Alexandre Chapellon 31 Jul '09

31 Jul '09

Please reply to the list. Le vendredi 31 juillet 2009 à 16:17 -0500, Paul Blalock a écrit : > I tried the radmin> hup files, command, with no luck. The command was > accepted, but it did nothing. > > What version of freeradius are you runing? If you have 2.1.1 or greater, just activate the control socket as a virtual server (see in /etc/freeradius/sites-available) by linking it to /etc/freeradius/sites-enabled/ Check that the soket is in read/write mode (mode =rw) and it has correct uid/gid. Restart freeradius (yeah I know that's what we want to avoid :p) Then run radmin (as root), and try "hup files" This works properly on my setup... > > -- > Paul

1 0

Restart radiusd after new user added
by Blalock, Paul (NCC) 31 Jul '09

31 Jul '09

I am setting up freeradius, and am having issues with adding users and having to restart radiusd to pick up the new users. Is sql the only other way to go, or is there a way to point the users file to another directory? Also, is there a way to have username passwords formatted as (user pass) or (user, pass)?

2 1

load-balance behavior
by Alexandre Chapellon 31 Jul '09

31 Jul '09

Hello the list, Does the "load-balance" type in home_server_pool can handle when one the home_server of the pool is down? Does it loose tickets in such a situation or can i consider it as a "fail-over" pool too? thx

2 1

Unknown attribute "Max-All-Session"
by boroba -- 31 Jul '09

31 Jul '09

hi all ; i have installed freeradius on centos 5.2 he are packege installed: freeradius-1.1.3-1.4.el5 freeradius-mysql-1.1.3-1.4.el5 and i follow the document http://wiki.freeradius.org/Rlm_sqlcounter and when i start radius i get error [root@squid raddb]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files /etc/raddb/users[107]: Parse error (check) for entry test0001: Unknown attribute "Max-All-Session" Errors reading /etc/raddb/users radiusd.conf[1062]: files: Module instantiation failed. radiusd.conf[1840] Unknown module "files". radiusd.conf[1776] Failed to parse authorize section. thanks in advance _________________________________________________________________ Avec Windows Live, vous organisez, retouchez et partagez vos photos. http://www.microsoft.com/northafrica/windows/windowslive/products/photo-gal…

2 1

password encryption problem
by Hegedus Gabor 31 Jul '09

31 Jul '09

Hi all! I have a problem, I want to authenticate console users in cisco switches. In the 2960, the switch send the password in cleartext, nothing problem. User-Password="password" but int the 2950, the switch can only send in "crypted" version like this: NAS-Port-Type = Virtual User-Name = "test" Calling-Station-Id = "192.168.***" User-Password = "\\342\455\325]̍\322\tM~\237\616}\266\426" Service-Type = Login-User In the ldap database I tried all of the encription type (clear, md5, crypt, md5crypt) but every time reject the authentication: frad debug: Failed to authenticate the user. Login incorrect (rlm_ldap: Bind as user failed): [test/\\_\266\065]�?\663\tM~\667\354}\126\316] (from client switch port 1 cli 192.168.*** WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! What can I do in the freeradius, what I forgot? Thanks! Gabor

2 3