- Freeradius-Users - lists.freeradius.org

Robust proxy accounting
by Chris Howley 10 Jun '09

10 Jun '09

Alan, I used the example configuration and got the same result. >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file.++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } 1) The following is in the robust-proxy-accounting file. # (5) Define the virtual server to write the packets to the detail file # This will be called when ALL home servers are down, because of the # "fallback" configuration in the home server pool. server acct_detail.example.com { accounting { detail.example.com } } # (6) Define a virtual server to handle pre/post-proxy re-writing server home.example.com { pre-proxy { # Insert pre-proxy rules here } post-proxy { # Insert post-proxy rules here # This will be called when the CURRENT packet failed # to be proxied. This may happen when one home server # suddenly goes down, even though another home server # may be alive. # # i.e. the current request has run out of time, so it # cannot fail over to another (possibly) alive server. # # We want to respond to the NAS, so that it can stop # re-sending the packet. We write the packet to the # "detail" file, where it will be read, and sent to # another home server. # Post-Proxy-Type Fail { detail.example.com } } # Read accounting packets from the detail file(s) for # the home server. # # Note that you can have only ONE "listen" section reading # detail files from a particular directory. That is why the # destination host name is used as part of the directory name # below. Having two "listen" sections reading detail files # from the same directory WILL cause problems. The packets # may be read by one, the other, or both "listen" sections. listen { type = detail filename = "${radacctdir}/detail.example.com/detail-*:*" load_factor = 10 } # All packets read from the detail file are proxied back to # the home servers. # # The normal pre/post-proxy rules are applied to them, too. # # If the home servers are STILL down, then the server stops # reading the detail file, and queues the packets for a later # retransmission. The Post-Proxy-Type "Fail" handler is NOT # called. # # When the home servers come back up, the packets are forwarded, # and the detail file processed as normal. accounting { # You may want accounting policies here... update control { Proxy-To-Realm := "acct_realm.example.com" } } } 2. I moved the following from the robust-proxy-accounting file to the proxy.conf file. # (1) Define two home servers. home_server home1.example.com { type = acct ipaddr = 129.11.162.17 port = 1813 secret = <remvoved> # Mark this home server alive ONLY when it starts being responsive status_check = status-server #status_check = request #username = "test_user_status_check" # Set the response timeout aggressively low. # You MAY have to increase this, depending on tests with # your local installation. response_window = 6 } # (2) Define a virtual server to be used when both of the # home servers are down. home_server acct_detail.example.com { virtual_server = acct_detail.example.com } # Put all of the servers into a pool. home_server_pool acct_pool.example.com { type = load-balance # other types are OK, too. home_server = home1.example.com # add more home_server's here. # If all home servers are down, try a home server that # is a local virtual server. fallback = acct_detail.example.com # for pre/post-proxy policies virtual_server = home.example.com } # (3) Define a realm for these home servers. # It should NOT be used as part of normal proxying decisions! realm acct_realm.example.com { acct_pool = acct_pool.example.com } Chris Howley

3 2

RE: [freeradius] fail-over ldap + reply-item missing
by François Mehault 10 Jun '09

10 Jun '09

Hum, now all works perfectly. My reply-item are present now, I will try now to understand why it works. Thanks to Ivan Kalik for his help and all freeradius project. Ldap.attrmap: [...] checkItem Cleartext-Password userPassword Users: DEFAULT ldaplabobe2-Ldap-Group == administrateur, User-Profile := "cn=administrateur,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Administrateur", Fall-Through = yes DEFAULT ldaplabobe2-Ldap-Group == stagiaire, User-Profile := "cn=stagiaire,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Stagiaire", Fall-Through = yes DEFAULT ldaplabobe1-Ldap-Group == administrateur, User-Profile := "cn=administrateur,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Administrateur", Fall-Through = yes DEFAULT ldaplabobe1-Ldap-Group == stagiaire, User-Profile := "cn=stagiaire,ou=Profiles,dc=netplus,dc=fr" Reply-Message = "Utilisateur: %{User-name}, group: Stagiaire", Fall-Through = yes Radiusd.conf: Instantiate { [...] ldaplabobe2 ldaplabobe1 } /site-available/default: Redundant { ldaplabobe2 ldaplabobe1} in section authorize and authenticate

1 0

Gianni Socionovo ti ha lasciato un nuovo messaggio su Badoo!
by Badoo 10 Jun '09

10 Jun '09

Hai ricevuto un nuovo messaggio su Badoo! Gianni Socionovo ti ha lasciato un nuovo messaggio Segui questo link per leggerlo: http://eu1.badoo.com/0144529629/in/NadgY0lc--o/?lang_id=8 Inoltre, altra gente ti ha cercato: Omar Lloper (Valencia, Spagna)Princess (Ancona, Italia)Katia Fava (Ancona, Italia) Se cliccando sul link nel messaggio questo non dovesse funzionare, copialo e incollalo nella barra degli indirizzi del tuo browser. Questo è solo un messaggio informativo generato automaticamente. Sei pregato di non rispondere direttamente a questa e-mail. Se non vuoi più ricevere messaggi, clicca qui: http://eu1.badoo.com/impersonation.phtml?lang_id=8&mail_code=21&email=freer…

1 0

Re: Cisco-avpair
by Ivan Kalik 10 Jun '09

10 Jun '09

> Anybody knows how to configure freeradius to send access list > configuration back to a cisco router applied to Dialer 0. Cisco avpair is just another attribute for radius server - zou send it like anz other. Read Cisco documentation to find out how it should look like. Ivan Kalik Kalik Informatika ISP

1 0

Robust proxy accounting
by Chris Howley 10 Jun '09

10 Jun '09

Alan, Thank you for your help. I've removed the configuration from the proxy.conf and I'm now using the original robust-proxy-accounting file. However, the problem persists - the detail.work file is being erased. Chris -----Original Message----- From: freeradius-users-bounces+c.p.howley=leeds.ac.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+c.p.howley=leeds.ac.uk@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 10 June 2009 11:00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 50, Issue 56 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Robust proxy accounting (A.L.M.Buxey(a)lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Jun 2009 10:18:04 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Robust proxy accounting To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090610091804.GC7855(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > I used the example configuration and got the same result. ..... > 2. I moved the following from the robust-proxy-accounting file to the proxy.conf file. why? the robust-accounting stuff is a self-contained virtual server. by putting this into proxy.conf you have introduced (or reintroduced) a loop mechanism. I can think of no reason to have moved this configuration from the virtual server...this isnt plain config. the virtual server is a virtual instance. by putting this code into the main proxy.conf it may/will get triggered by other instances. alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 50, Issue 56 ************************************************

2 1

accounting and radutmp problem
by kalesameer 10 Jun '09

10 Jun '09

I want to use mysql only for accounting purposes.I have uncommented the "sql" and "sql_log" entries iin the various modules. While users try to login,entries are being entered into the "radpostauth" table of mysql.However, no entries are being made into the "radacct" table.Can anyone please tell me the reason for this?? Secondly,in order to check the users logged on currently,we must use the "radutmp" file.However,no file of this name exists at "/usr/local/var/log/radius".What may be the reason for this?? And what corrective action must i take for solving these problems?? -- View this message in context: http://www.nabble.com/accounting-and-radutmp-problem-tp23949734p23949734.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

libradius-1.1.7.so
by parlato 10 Jun '09

10 Jun '09

Hi, I'm new here. I installed freeradius 1.1.7 on a debian lenny. ./configure make make install when I tri to start radiusd -x I get the following error : radiusd: error while loading shared libraries: libradius-1.1.7.so: cannot open shared object file: No such file or directory (I dont have to use deb package and I have to use 1.1.7) can someone tell me how to install that library? thanks

3 3

Cannot get TTLS to work with inner protocol of mschap or PAP
by carferna 10 Jun '09

10 Jun '09

Hi, I am having trouble configuring free radius to use TTLS with inner protocol of either mschap or PAP. Currently, I have TTLS working with the default inner protocol of MD-5. But when I change the eap.conf file to use mschap or PAP then I can't even get radiusd -X to start. I see the following error: rlm_eap:ttls:unknown EAP type mschap rlm_eap:Failed to initialize type ttls I would most appreciate if anyone can give me some pointers on this -- View this message in context: http://www.nabble.com/Cannot-get-TTLS-to-work-with-inner-protocol-of-mschap… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Cisco-avpair
by Pallares, Jorge 10 Jun '09

10 Jun '09

Hi all, Anybody knows how to configure freeradius to send access list configuration back to a cisco router applied to Dialer 0. Thanks, Jorge Pallares ________________________________ Email disclaimer: The information contained in or attached to this communication may contain confidential or privileged information and is intended for the addressee only. If you are not the intended recipient of this email communication, you are notified that any use, dissemination, distribution or copying of this message or data is prohibited. If you have received this email in error, please notify the sender by return email and permanently delete the document. Any drawing provided with this communication is provided for general information purposes only. No person receiving or using that drawing should rely on it as a complete or accurate representation of the rail assets referred to in it. All written dimensions take precedence over scaled dimension. The drawing has been prepared by, or compiled from information provided by, persons other than VicTrack. To the maximum extent permissible by law, VicTrack takes no responsibility for, and makes no representations in relation to, the completeness, accuracy or quality of any information contained in the drawing. Each user of the drawing releases VicTrack from all and any loss, damage, cost, expense or liability in relation to the use of, or any reliance on, the drawing or the information contained in it. The drawing is provided only for the information of the person or organisation to whom VicTrack provides it. It may not be provided to, or used by, any other person without VicTrack's prior written consent. The views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of VicTrack. VicTrack does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference.

1 0

my freeradius-2.1.6 is not auth with PIN only
by Goke Aruna 10 Jun '09

10 Jun '09

I will be glad, if anyone can direct me to whare The log below is the part of the debug for the new test freeradius server 2.1.6 am testing with. However, the hotspotlogin,cgi is able to pass the param username to the radius but when the query is run against the database the "Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031" the value of the username sent is changed. I have disabled the chap in the /usr/local/etc/raddb/sites-enabled/default. kindly advise on what to do. ################### my radcheck has the info below. mysql> select * from radcheck; +-----+------------+--------------------+----+------------+ | id | username | attribute | op | value | +-----+------------+--------------------+----+------------+ | 5 | 2345678901 | Auth-Type | := | Accept | | 201 | 1234567890 | Cleartext-Password | := | 1234567890 | +-----+------------+--------------------+----+------------+ 4 rows in set (0.00 sec) ######################radiusd -XX (part of the debug) rad_recv: Access-Request packet from host 127.0.0.1 port 44600, id=0, length=189 ChilliSpot-Max-Input-Octets = 0x32333435363738393031 ChilliSpot-Max-Output-Octets = 0 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-1F-29-80-62-F3" Called-Station-Id = "00-50-DA-0C-C9-B0" NAS-Identifier = "nas01" Acct-Session-Id = "4a2e6a7700000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xf2ee6add34820fb96dcceef08c07bbc5 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Tue Jun 9 14:59:48 2009 : Info: +- entering group authorize {...} Tue Jun 9 14:59:48 2009 : Info: ++[preprocess] returns ok Tue Jun 9 14:59:48 2009 : Info: ++[mschap] returns noop Tue Jun 9 14:59:48 2009 : Info: [suffix] No '@' in User-Name = "2345678901", looking up realm NULL Tue Jun 9 14:59:48 2009 : Info: [suffix] No such realm "NULL" Tue Jun 9 14:59:48 2009 : Info: ++[suffix] returns noop Tue Jun 9 14:59:48 2009 : Info: [eap] No EAP-Message, not doing EAP Tue Jun 9 14:59:48 2009 : Info: ++[eap] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[unix] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[files] returns noop Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Info: [sql] sql_set_user escaped user --> '0x32333435363738393031' Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0x32333435363738393031' ORDER BY id Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0x32333435363738393031' ORDER BY priority Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] User 0x32333435363738393031 not found Tue Jun 9 14:59:48 2009 : Info: ++[sql] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[expiration] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[logintime] returns noop Tue Jun 9 14:59:48 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Jun 9 14:59:48 2009 : Info: ++[pap] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[validity] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[noresetcounter] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[hotspotcontrol] returns noop Tue Jun 9 14:59:48 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jun 9 14:59:48 2009 : Info: Failed to authenticate the user. Tue Jun 9 14:59:48 2009 : Info: Using Post-Auth-Type Reject Tue Jun 9 14:59:48 2009 : Info: +- entering group REJECT {...} Tue Jun 9 14:59:48 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 9 14:59:48 2009 : Info: ++[attr_filter.access_reject] returns updated Tue Jun 9 14:59:48 2009 : Info: Delaying reject of request 0 for 1 seconds Tue Jun 9 14:59:48 2009 : Debug: Going to the next request Tue Jun 9 14:59:48 2009 : Debug: Waking up in 0.9 seconds. Tue Jun 9 14:59:49 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 44600 Tue Jun 9 14:59:49 2009 : Debug: Waking up in 4.9 seconds. Tue Jun 9 14:59:54 2009 : Info: Cleaning up request 0 ID 0 with timestamp +187 Tue Jun 9 14:59:54 2009 : Debug: Ready to process requests.

3 4