- Freeradius-Users - lists.freeradius.org

Re: PPTPD Bandwidth Shaping
by Neville 09 Jun '09

09 Jun '09

Hi all again, Ok, I've got WISPr-Bandwidth-Max-Down in /var/run/radattr.ppp0 but the value is all wrong. I set WISPr-Bandwidth-Max-Down = 512000 (as a reply) and in /var/run/radattr.ppp0 its show as - WISPr-Bandwidth-Max-Down -1062731706 I just basically copied the dictionary.wispr to /usr/share/radiusclient-ng as in order to get it loaded in radattr.ppp0 :- [root@xxx radiusclient-ng]# more dictionary.wispr ATTRIBUTE WISPr-Location-ID 1 string ATTRIBUTE WISPr-Location-Name 2 string ATTRIBUTE WISPr-Logoff-URL 3 string ATTRIBUTE WISPr-Redirection-URL 4 string ATTRIBUTE WISPr-Bandwidth-Min-Up 5 integer ATTRIBUTE WISPr-Bandwidth-Min-Down 6 integer ATTRIBUTE WISPr-Bandwidth-Max-Up 7 integer ATTRIBUTE WISPr-Bandwidth-Max-Down 8 integer #ATTRIBUTE WISPr-Session-Terminate-Time 9 string #ATTRIBUTE WISPr-Session-Terminate-End-Of-Day 10 string ATTRIBUTE WISPr-Billing-Class-Of-Service 11 string Any ideas please. Thx Nev ----- Original Message ----- From: Neville To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, June 09, 2009 10:45 PM Subject: Re: PPTPD Bandwidth Shaping Hi Chuan, Thx for reply amongst this heated discussion on DHCP.... I've currently got install freeRadius 2.1.6 and Poptop 2.4.4 and I see no dictionary file in /etc/ppp/radius/dictionary. In fact I have no radius directory in /etc/ppp All freeradius dictionary's are located in /usr/share/freeradius.... The question is, how can I pass WISPr-Bandwidth-Max-Down to ip-up.local as I was hoping it would be in in /var/run/radattr.pppX, but all thats in there is:- Framed-IP-Address 192.168.0.70 Session-Timeout 1646690 MS-CHAP2-Success 7S=A8CF4948283C1C4BE11682787ADBD0EA9852E691 MS-MPPE-Recv-Key \220\265J\372\250\336\342nD\226o\272\007\030I\372'\313\267@J\36 1\370\266\212?_\377\262\324\215X\274\357 MS-MPPE-Send-Key \235\342\367\325\243\210\020\217|H\314WkU0\201\352\374\364\023\ 220\220\315z\364\277\254\361\356["Ce\002 MS-MPPE-Encryption-Policy MS-MPPE-Encryption-Types However we can see WISPr-Bandwidth-Max-Down being sucessfully passed to FreeRadius? ++[exec] returns noop Sending Access-Accept of id 198 to 127.0.0.1 port 53025 Framed-IP-Address := 192.168.0.70 WISPr-Bandwidth-Max-Down := 512000 Session-Timeout = 1646690 MS-CHAP2-Success = 0x37533d41384346343934383238334331433442453131363832373837414442443045413938353245363931 MS-MPPE-Recv-Key = 0x0b660d35b65015368d107e57d97e2b55 MS-MPPE-Send-Key = 0xc78164fb4478212fbd0d198389ee2d52 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 198 with timestamp +244 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 38836, id=199, length=98 Acct-Session-Id = "4A2EE3A302FB00" User-Name = "test99" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.0.70 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok I would love to use WISPr as suggested, but cannot find out how to get this to work. Currently I've just defaulted EVERYONE to the same bandwidth restrictions by using the follow script in /etc/ppp/ip-up.local ip-up.local DOWNSPEED=256 UPSPEED=768 /sbin/tc qdisc del dev $1 root > /dev/null /sbin/tc qdisc del dev $1 ingress > /dev/null ##### speed server->client if [ "$UPSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 root handle 1: htb default 20 r2q 1 /sbin/tc class add dev $1 parent 1: classid 1:1 htb rate ${UPSPEED}kbit burst 4k /sbin/tc class add dev $1 parent 1:1 classid 1:10 htb rate ${UPSPEED}kbit burst 4k prio 1 /sbin/tc class add dev $1 parent 1:1 classid 1:20 htb rate ${UPSPEED}kbit burst 4k prio 2 /sbin/tc qdisc add dev $1 parent 1:10 handle 10: sfq perturb 10 quantum 1500 /sbin/tc qdisc add dev $1 parent 1:20 handle 20: sfq perturb 10 quantum 1500 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip tos 0x10 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip protocol 1 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1: protocol ip prio 10 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u160x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:10 fi ##### speed client->server if [ "$DOWNSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 handle ffff: ingress /sbin/tc filter add dev $1 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate ${DOWNSPEED}kbit burst 12k drop flowid :1 fi /sbin/ifconfig $1 mtu 1400

2 1

Lower case
by Michel Bulgado 09 Jun '09

09 Jun '09

Hello everyone I migrated my freeradius version 1.1.3-1.4.el5 that came with CentOS 5.3 to version 2.1.6-2. I am looking for an option that I had in my previous configuration and does not find it on this new, maybe it is removed. the fact is that many of my users sometimes tend to write the username with the first letter in upper or miniscule. If someone could guide me, how i cant fix this. lower_user = after lower_pass = no Thanks Michel

2 1

Re: PPTPD Bandwidth Shaping
by Neville 09 Jun '09

09 Jun '09

Hi Chuan, Thx for reply amongst this heated discussion on DHCP.... I've currently got install freeRadius 2.1.6 and Poptop 2.4.4 and I see no dictionary file in /etc/ppp/radius/dictionary. In fact I have no radius directory in /etc/ppp All freeradius dictionary's are located in /usr/share/freeradius.... The question is, how can I pass WISPr-Bandwidth-Max-Down to ip-up.local as I was hoping it would be in in /var/run/radattr.pppX, but all thats in there is:- Framed-IP-Address 192.168.0.70 Session-Timeout 1646690 MS-CHAP2-Success 7S=A8CF4948283C1C4BE11682787ADBD0EA9852E691 MS-MPPE-Recv-Key \220\265J\372\250\336\342nD\226o\272\007\030I\372'\313\267@J\36 1\370\266\212?_\377\262\324\215X\274\357 MS-MPPE-Send-Key \235\342\367\325\243\210\020\217|H\314WkU0\201\352\374\364\023\ 220\220\315z\364\277\254\361\356["Ce\002 MS-MPPE-Encryption-Policy MS-MPPE-Encryption-Types However we can see WISPr-Bandwidth-Max-Down being sucessfully passed to FreeRadius? ++[exec] returns noop Sending Access-Accept of id 198 to 127.0.0.1 port 53025 Framed-IP-Address := 192.168.0.70 WISPr-Bandwidth-Max-Down := 512000 Session-Timeout = 1646690 MS-CHAP2-Success = 0x37533d41384346343934383238334331433442453131363832373837414442443045413938353245363931 MS-MPPE-Recv-Key = 0x0b660d35b65015368d107e57d97e2b55 MS-MPPE-Send-Key = 0xc78164fb4478212fbd0d198389ee2d52 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 198 with timestamp +244 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 38836, id=199, length=98 Acct-Session-Id = "4A2EE3A302FB00" User-Name = "test99" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.0.70 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok I would love to use WISPr as suggested, but cannot find out how to get this to work. Currently I've just defaulted EVERYONE to the same bandwidth restrictions by using the follow script in /etc/ppp/ip-up.local ip-up.local DOWNSPEED=256 UPSPEED=768 /sbin/tc qdisc del dev $1 root > /dev/null /sbin/tc qdisc del dev $1 ingress > /dev/null ##### speed server->client if [ "$UPSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 root handle 1: htb default 20 r2q 1 /sbin/tc class add dev $1 parent 1: classid 1:1 htb rate ${UPSPEED}kbit burst 4k /sbin/tc class add dev $1 parent 1:1 classid 1:10 htb rate ${UPSPEED}kbit burst 4k prio 1 /sbin/tc class add dev $1 parent 1:1 classid 1:20 htb rate ${UPSPEED}kbit burst 4k prio 2 /sbin/tc qdisc add dev $1 parent 1:10 handle 10: sfq perturb 10 quantum 1500 /sbin/tc qdisc add dev $1 parent 1:20 handle 20: sfq perturb 10 quantum 1500 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip tos 0x10 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip protocol 1 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1: protocol ip prio 10 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u160x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:10 fi ##### speed client->server if [ "$DOWNSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 handle ffff: ingress /sbin/tc filter add dev $1 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate ${DOWNSPEED}kbit burst 12k drop flowid :1 fi /sbin/ifconfig $1 mtu 1400

1 0

Robust proxy accounting
by Chris Howley 09 Jun '09

09 Jun '09

Alan, I hoping you can help me. We're currently testing FR2.1.6 and robust proxy accounting. We have two servers running FR2.1.6. When both servers are operational the relaying of accounting packets works. However, when one of the servers is down the other operational server fails to retain the accounting data. The software deletes the detail.work file and any other detail files stored in the listener's sub-directory. Looking at the debug output the only thing that's different after the last time that the detail.work file is accessed is shown below. A copy of the debug output is available at: http://netgrp-pc052.leeds.ac.uk/radiusd.debug.txt Thanks, Chris Howley >>> Sending proxied request internally to virtual server. server acct_detail.leeds.ac.uk { +- entering group accounting {...} [detail.leeds.ac.uk] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.leeds.ac.uk] returns noop } # server acct_detail.leeds.ac.uk Going to the next request <<< Received proxied response from internal virtual server.

2 1

[freeradius] fail-over ldap + reply-item missing
by François Mehault 09 Jun '09

09 Jun '09

Hi all I try to do a fail-over with two ldap on my freeradius. I read this article http://wiki.freeradius.org/Fail-over, I instantiated two openldap modules and i use the keyword redundant in my /raddb/site-available/default in authorize and authenticate section. redundant { Primary-ldap Secondary-ldap } I also enabled reply_log When the two ldap are launched, it works. reply log : Tue Jun 9 11:45:53 2009 Packet-Type = Access-Accept Reply-Message = "Utilisateur: fmehault, group: Administrateur" Cisco-AVPair = "shell:priv-lvl=15" Service-Type = NAS-Prompt-User But if i stop the Secondary-ldap, I have just : reply log : Tue Jun 9 11:49:19 2009 Packet-Type = Access-Accept I can see in my log that radiusd try to contact Secondary-ldap at first. Why ? Then it test 3 times, rather than test Primary-ldap, why ? I will be please to give you more information about my problem to help me to fix it, ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.4:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.4:389 rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 [...] rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server [...] rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server resume : Primary-ldap started Secondary-ldap started It works Primary-ldap stoped Secondary-ldap started It works Primary-ldap started Secondary-ldap stoped Access-Accept without reply-item ... If someone can explain me what is my problem Regards, François

2 3

freeradius mysql configuration problem
by kalesameer 09 Jun '09

09 Jun '09

hi, I am not able to configure freeradius to use mysql.The output of radiusd -X command is shown below. Can anyone tell me what my mistake is?? [root@localhost mysql]# radiusd -X FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Apr 5 2009 at 21:27:58 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 102.168.0.100 { require_message_authenticator = no secret = "testing123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 0 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[152]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } Errors initializing modules [root@localhost mysql]# -- View this message in context: http://www.nabble.com/freeradius-mysql-configuration-problem-tp23929645p239… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 5

h3c:Framed-IP-Address cisco:'Calling-Station-Id'
by miaowang 09 Jun '09

09 Jun '09

hello: i have a h3c route and a cisco route,i want to set a user only can telnet to this two route from a PC with ip address 192.168.1.22,but h3c route use Framed-IP-Address = 192.168.1.22, CISCO use Calling-Station-Id = "192.168.1.22" how to set in mysql radcheck? -------------------------------------------------------- 100, 'miaowang', 'Framed-IP-Address', '==', '192.168.1.21' 101, 'miaowang, 'Calling-Station-Id', '==', '192.168.1.21' ---------------------------------------------------- the value upon is error ,how to config ? thanks ! miaowang Packet-Type = Access-Request Tue Jun 9 13:24:15 2009 NAS-IP-Address = 192.168.1.4 NAS-Port = 1 Cisco-NAS-Port = "tty1" NAS-Port-Type = Virtual User-Name = "miaowang" Calling-Station-Id = "192.168.1.22" User-Password = "111111" Client-IP-Address = 192.168.1.4 Packet-Type = Access-Request Fri Jun 5 09:48:31 2009 NAS-IP-Address = 192.168.1.15 NAS-Identifier = "Quidway" NAS-Port = 40961 NAS-Port-Type = Ethernet Framed-IP-Address = 192.168.1.22 User-Name = "miaowang" Calling-Station-Id = "0000-0000-0000" Service-Type = Login-User Login-IP-Host = 192.168.1.15 Framed-MTU = 1500 User-Password = "111111" Client-IP-Address = 192.168.1.15 2009-06-09 miaowang

2 1

PPTPD Bandwidth Shaping
by Neville 09 Jun '09

09 Jun '09

Hi everyone, I was hoping for a few pointers on this... My setup is <internet><freeradius><ppp><work> This is working fine with the exception of Bandwidth Shaping. Basically, I want to create my own ATTRIBUTES for setting Max-UP / Max-Down and use ip-up.local to "AWK" these attributes from if [ -f /var/run/radattr.$1 ] then DOWNSPEED=`/bin/awk '/Max-Down-Limit/ {print $2}' /var/run/radattr.$1` UPSPEED=`/bin/awk '/Max-Up-Limit/ {print $2}' /var/run/radattr.$1` #echo $DOWNSPEED #echo $UPSPEED #echo $FILTERS /sbin/tc qdisc del dev $1 root > /dev/null /sbin/tc qdisc del dev $1 ingress > /dev/null ##### speed client->server if [ "$DOWNSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 handle ffff: ingress /sbin/tc filter add dev $1 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate ${DOWNSPEED }kbit burst 12k drop flowid :1 fi fi I've tried to use the following attributes from chillispot as a reply attribute, ChilliSpot-Bandwidth-Max-Down := 500, but I get the following error :- rlm_sql: Failed to create the pair: Invalid octet string "500" for attribute name "ChilliSpot-Bandwidth-Max-Down" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user I've also copied dictionary.chillspot to /usr/share/radiusclient-ng as:- VENDOR ChilliSpot 14559 BEGIN-VENDOR ChilliSpot ATTRIBUTE ChilliSpot-Max-Input-Octets 1 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Output-Octets 2 integer ChilliSpot ATTRIBUTE ChilliSpot-Max-Total-Octets 3 integer ChilliSpot ATTRIBUTE ChilliSpot-Bandwidth-Max-Up 4 integer ChilliSpot ATTRIBUTE ChilliSpot-Bandwidth-Max-Down 5 integer ChilliSpot ATTRIBUTE ChilliSpot-Config 6 string ChilliSpot ATTRIBUTE ChilliSpot-Lang 7 string ChilliSpot ATTRIBUTE ChilliSpot-Version 8 string ChilliSpot ATTRIBUTE ChilliSpot-OriginalURL 9 string ChilliSpot # Configuration management parameters (ChilliSpot Only) ATTRIBUTE ChilliSpot-UAM-Allowed 100 string ChilliSpot ATTRIBUTE ChilliSpot-MAC-Allowed 101 string ChilliSpot ATTRIBUTE ChilliSpot-Interval 102 integer ChilliSpot Not sure what else I'm missing as a majority of the internet search point to editing /etc/raddb/dictionary, but this is not there with freeradius 2.1.6 Any advise work be greatly recieved. Thx Nev

3 2

To proxy or not to proxy?
by Kanwar Ranbir Sandhu 09 Jun '09

09 Jun '09

Hi All, I'm going to have a fairly simple setup whereby two freeradius 2.1.6 servers will be configured as "primary" and "secondary" on the NAS. Each freeradius server will also be running mysql locally so that acct and auth will be handled on the same box. I'm going to use buffered-sql as well, just in case mysql goes down or has issues keeping up with updates. Based on what I've read and understood, it doesn't make much sense to me to use freeradius' proxy and home_server features in proxy.conf. I will have two realms, so I can configure those in proxy.conf. Other than that, I don't think I need any other feature (in proxy.conf). Is there a reason why I should consider using home servers and/or proxies? I guess I'm just trying to figure out if I'm shooting myself in the foot by not using them. Thanks, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 19:30:34 up 15 days, 20:40, 3 users, load average: 0.32, 0.13, 0.04

2 2

FreeBSD 7.2 vs Linux for mysql server
by Alexander Kosykh 08 Jun '09

08 Jun '09

Hi. Could you share your experience in question of choice an OS for mysql server and maybe some detail of configuration. Thank you. Best regards Alexander Kosykh

2 1