- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 49, Issue 51
by Sanhenra Sinaga 14 May '09

14 May '09

Dear all,, I'm a newbie.. In freeRadius, I read Station ID. Can you explain what the meaning of Station Id in freeRadius? Thank's ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Thursday, 14 May, 2009 4:27:33 PM GMT +07:00 Bangkok, Hanoi, Jakarta Subject: Freeradius-Users Digest, Vol 49, Issue 51 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Proposed release of 2.1.6 (A.L.M.Buxey(a)lboro.ac.uk) 2. Re: Proposed release of 2.1.6 (Alan DeKok) 3. Re: CoovaChilli - 'acctupdate' (Johan Meiring) 4. Re: Problems with IP address allocation, help needed (Ramm-Ericson, Johannes) 5. Re: Proposed release of 2.1.6 (A.L.M.Buxey(a)lboro.ac.uk) 6. Re: Problems with IP address allocation, help needed (A.L.M.Buxey(a)lboro.ac.uk) 7. Re: Proposed release of 2.1.6 (Alan DeKok) 8. Re: Building rlm_sql_oracle (Maxim Denisov) ---------------------------------------------------------------------- Message: 1 Date: Thu, 14 May 2009 09:32:47 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090514083247.GB6774(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > We plan on releasing 2.1.6 this week. > > Please test the pre release at: http://git.freeradius.org/pre/ > > If there are any concerns, problems, errors, etc., please let us know > before we release the final version. a quick request....the mschap module comes with example ntlm_auth line which now uses deprecated method - as the complaints when you try using it will testify...can this: #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challen ge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" be changed to #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" thanks alan ------------------------------ Message: 2 Date: Thu, 14 May 2009 10:36:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BD823.6000205(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, >> We plan on releasing 2.1.6 this week. >> >> Please test the pre release at: http://git.freeradius.org/pre/ >> >> If there are any concerns, problems, errors, etc., please let us know >> before we release the final version. > > a quick request....the mschap module comes with example ntlm_auth line > which now uses deprecated method - as the complaints when you try using > it will testify...can this: Ok... that's small enough that I think it can wait for the next version. Alan DeKok. ------------------------------ Message: 3 Date: Thu, 14 May 2009 10:48:25 +0200 From: Johan Meiring <jmeiring(a)pcservices.co.za> Subject: Re: CoovaChilli - 'acctupdate' To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BDAD9.60205(a)pcservices.co.za> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: > wlanmac wrote: >> For what it's worth, CoovaChilli supports an option called 'acctupdate' >> which will allow for "updated" provisioning attributes to be returned to >> the NAS in accounting response. Yes, it's not very RFC compliant, but >> certainly helpful when you don't have the ability to send CoA requests >> to the NAS. > > It's not actually forbidden by the RFC's, or by the (new) RADIUS > design guidelines document. It's not a bad idea, quite frankly. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > I for one use it quite extensively, and it works very well! Without it you cannot safely allow dual logins. (e.g. if a user with 100MB left, logs in twice at the same time, he will get 200MB) -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 ------------------------------ Message: 4 Date: Thu, 14 May 2009 10:53:10 +0200 From: "Ramm-Ericson, Johannes" <Johannes.Ramm-Ericson(a)sonyericsson.com> Subject: Re: Problems with IP address allocation, help needed To: "'freeradius-users(a)lists.freeradius.org'" <freeradius-users(a)lists.freeradius.org> Message-ID: <1B6DFC4AB624B04FBF99FF21371C88E40BEFA6F3(a)SELDMBX04.corpusers.net> Content-Type: text/plain; charset="us-ascii" Alan de Kok wrote: >Ramm-Ericson, Johannes wrote: > As (nearly) always, the debug output is instructive: > >> Following are extracts from the debug log that exemplify a working >> instance with GLANA and a failing instance with CBJN: >... >> **************** Failing instance with CBJN **************** >... >> +- entering group post-auth {...} >... >> ++[GLANA] returns noop > > ... and no reference to CBJN. > > Perhaps listing "CBJN" in the "post-auth" section would be a good >idea. If it's not listed, the module isn't called, and it doesn't >allocate IP addresses. > > Alan DeKok. OK, fair enough, I can agree that that is what it looks like. Trouble is though that CBJN is listed together with GLANA in the post-auth section where the ippools are configured. So, for some reason the server is not acknowledging that part of the configuration. Sure, I may definitely be doing something wrong. At this point I just don't have a clue as to where it is I'm going wrong... Thanks, Johannes ------------------------------ Message: 5 Date: Thu, 14 May 2009 10:14:07 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090514091407.GA6817(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Ok... that's small enough that I think it can wait for the next version. okay - by the way, the download link on deployingradius.com is for 2.1.1 - any reason for love of this old version rather than eg 2.1.3 ? :-) alan ------------------------------ Message: 6 Date: Thu, 14 May 2009 10:19:36 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Problems with IP address allocation, help needed To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090514091936.GD6817(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > OK, fair enough, I can agree that that is what it looks like. Trouble is > though that CBJN is listed together with GLANA in the post-auth section > where the ippools are configured. So, for some reason the server is not > acknowledging that part of the configuration. Sure, I may definitely be > doing something wrong. At this point I just don't have a clue as to where > it is I'm going wrong... copy of the config? is it reading the post-auth section you think it is - ie in the correct virtual server file or some other one? alan ------------------------------ Message: 7 Date: Thu, 14 May 2009 11:26:27 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Proposed release of 2.1.6 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A0BE3C3.8020604(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, > >> Ok... that's small enough that I think it can wait for the next version. > > okay - by the way, the download link on deployingradius.com is for 2.1.1 > - any reason for love of this old version rather than eg 2.1.3 ? :-) Lack of updates... I'll got fix that once 2.1.6 is released. Alan DeKok. ------------------------------ Message: 8 Date: Thu, 14 May 2009 13:27:25 +0400 From: Maxim Denisov <kbessmertniy(a)gmail.com> Subject: Re: Building rlm_sql_oracle To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <90ec93e70905140227y2f4a9134j33a8e7cf88d585cd(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Thank you for your reply. I alredy built it, the problem was in configure file logic - it tried to detect oracle version by looking for $ORACLE_HOME variable and if it is absent it mentioned that you have 8i. Also I didn't find where --with-oracle-include-dir used and I changed the pathes in configure file. Now I have successfully compiled freeradius with the following keys: ./configure --enable-shared --disable-static --with-gnu-ld --with-threads --with-thread-pool --disable-ltdl-install --without-rlm-sql_postgresql --without-rlm-sql_mysql --with-rlm-sql --with-rlm-sql_oracle --with-oracle-home-dir=/usr/lib/oracle/10.2.0.4/client64--with-oracle-lib-dir=/usr/lib/oracle/ 10.2.0.4/client64/lib --with-oracle-include-dir=/usr/include/oracle/ 10.2.0.4/client64 Everything works fine except oracle - radiusd is not linked to rlm_sql_oracle.so root@truba:~/freeradius-server-2.1.4# ldd /usr/local/sbin/radiusd libfreeradius-radius-2.1.5.so => /usr/local/lib/ libfreeradius-radius-2.1.5.so (0x0000002a95579000) libnsl.so.1 => /lib64/libnsl.so.1 (0x000000322bc00000) libresolv.so.2 => /lib64/libresolv.so.2 (0x0000003225100000) libpthread.so.0 => /lib64/tls/libpthread.so.0 (0x0000003224900000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x000000322b400000) libltdl.so.3 => /usr/lib64/libltdl.so.3 (0x0000003ab6700000) libssl.so.4 => /lib64/libssl.so.4 (0x0000003228000000) libcrypto.so.4 => /lib64/libcrypto.so.4 (0x0000003227900000) libc.so.6 => /lib64/tls/libc.so.6 (0x0000003223e00000) /lib64/ld-linux-x86-64.so.2 (0x0000003223c00000) libdl.so.2 => /lib64/libdl.so.2 (0x0000003224300000) libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x0000003227c00000) libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x0000003227e00000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x0000003227500000) libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x0000003227700000) libz.so.1 => /usr/lib64/libz.so.1 (0x0000003224f00000) root@truba:~/freeradius-server-2.1.4# ldd /usr/local/lib/ libfreeradius-radius-2.1.5.so libc.so.6 => /lib64/tls/libc.so.6 (0x0000002a95698000) /lib64/ld-linux-x86-64.so.2 (0x000000552aaaa000) Can anybody tell me what have I done wrong? 2009/5/14 Alan DeKok <aland(a)deployingradius.com> > Maxim Denisov wrote: > > Has enybody successfully built freeradius 2.1.4 with instant client? > > Yes. It sometimes takes a bit of fighting, but it works. > > > I have installed oracle instant client basic 10.2.0.4 + sqlplus + sdk > > for linux x86_64, everything from rpm. I can successfully connect with > > sqlplus64, paths are correct but when I execute configure in > > rlm_sql_oracle I am getting > > If configure doesn't work, don't worry. Just edit the file > ..../rlm_sql_oracle/Makefile directly. > > The only magic I've found is 32/64-bit issues. You might have to link > explicitly to a particular library, rather than using "-l". > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

rlm_perl to authenticate against data in ldap
by Vincent Arniego 14 May '09

14 May '09

Hi Everyone, I browsed the mailing list for possible solutions to the problem I have but unfortunately I didn't find any (or something I missed I dunno) We have this Cisco ISG 7301 router that we are using that are passing the Remote-ID av pair as its User-Name (just a copy not that it matters) Now, the remote ID format is ascii in format but hexadecimal in meaning 0000079d010100660000000000000000000050544e55544147303033000705000064 We would only want to authenticate the part after the 20 zeroes "50544e55544147303033000705000064". By the way the length before this substring is always fixed (18 bytes) so we only want the part after 18 bytes. is it possible to parse this string in perl then passing the result string to ldap for authentication? Or will we use ldap inside rlm_perl? Just to add, we also want to check the first 4 bytes (0000079d) if it is not in this format, we'll treat the whole user-id as a whole. Thank you in advanced. Vincent

3 2

Release 2.1.6 will be on Monday
by Alan DeKok 14 May '09

14 May '09

Unless any last-minute panics come up. The release candidate is available on: http://git.freeradius.org/pre/ If there are no other comments, that "tar" file will become the official 2.1.6 release. Alan DeKok.

1 0

Re: how to limiting user bandwidth by quota..
by Nizar Zulmi 14 May '09

14 May '09

thank you ahmed..which script??is that script belongs to freeradius or.. iam using chillispot, as alan sugest me there is no specified attribute to do limiting bandwidth by quota,.do you know what type attribut of chillispot can do this??or you can give simple or detailed tutorial to do so please.. --- On Thu, 5/14/09, ahmed adel <ahmedadel4eg(a)yahoo.com> wrote: From: ahmed adel <ahmedadel4eg(a)yahoo.com> Subject: Re: how to limiting user bandwidth by quota.. To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, May 14, 2009, 2:36 PM You can use a script that disconnect the user as soon as the user exceeds his limit. You should check for the bandwidth usage in the Input Octets and the Output Octets Fields Best Regards Ahmed Adel From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, May 13, 2009 11:22:38 PM Subject: Re: how to limiting user bandwidth by quota.. > dear all..i'am using freeradius 1.1.7 on ubuntu 8.04, i do implementing > sqlcounter like noresetcounter,dailycounter and montly counter and it > works properly. but i now i have 1 case how to limiting user bandwidth > usage with sqlcounter, i've read and learn how do sqlcounter work, but i > still dont have idea how to make a query to limiting user bandwidth. > i have 1 user and i want to limit the bandwidth for this user 300mb in a > week..how to perform this..clue please..really apreciate for your help Time counters work with Session-Timeout. There is no standard radius attribute for data counters - you have to use vendor specific ones. If your NAS vendor has data limiting attributes, then this can be done. If it doesn't - it can't. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Problems with IP address allocation, help needed
by Ramm-Ericson, Johannes 14 May '09

14 May '09

Alan de Kok wrote: >Ramm-Ericson, Johannes wrote: > As (nearly) always, the debug output is instructive: > >> Following are extracts from the debug log that exemplify a working >> instance with GLANA and a failing instance with CBJN: >... >> **************** Failing instance with CBJN **************** >... >> +- entering group post-auth {...} >... >> ++[GLANA] returns noop > > ... and no reference to CBJN. > > Perhaps listing "CBJN" in the "post-auth" section would be a good >idea. If it's not listed, the module isn't called, and it doesn't >allocate IP addresses. > > Alan DeKok. OK, fair enough, I can agree that that is what it looks like. Trouble is though that CBJN is listed together with GLANA in the post-auth section where the ippools are configured. So, for some reason the server is not acknowledging that part of the configuration. Sure, I may definitely be doing something wrong. At this point I just don't have a clue as to where it is I'm going wrong... Thanks, Johannes

2 1

Re: Freeradius-Users Digest, Vol 49, Issue 4
by wlanmac 14 May '09

14 May '09

For what it's worth, CoovaChilli supports an option called 'acctupdate' which will allow for "updated" provisioning attributes to be returned to the NAS in accounting response. Yes, it's not very RFC compliant, but certainly helpful when you don't have the ability to send CoA requests to the NAS. David On Mon, 2009-05-04 at 07:32 +0200, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re :checking authorization in the duration of connection (Eric) > 2. Re: Re :checking authorization in the duration of connection > (??????? ????????) > 3. Re: Re :checking authorization in the duration of connection > (Marinko Tarlac) > 4. Re: Re :checking authorization in the duration of connection > (Ivan Kalik) > 5. Re :checking authorization in the duration of connection (Eric) > 6. Re: Re :checking authorization in the duration of connection > (Fajar A. Nugraha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 3 May 2009 14:39:11 +0430 > From: Eric <bbahar3(a)gmail.com> > Subject: Re :checking authorization in the duration of connection > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <38a27c8c0905030309u44457388u2e55f5f2c9a5b1b8(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > NAS sends accounting update packets in periodic times. I want > freeradius use this updates and > check my online users periodically and send Disconnect packet if > user's traffic is above my > limit. > How can it do this? > any document about config ? > Eric wrote: > > Hi, > > My radius server use ldap server for authorize and authentication.I set an > attribute in ldap server that is the check-name in sqlcounter to limit users > Input traffic. I want when user traffic reaches to this amount the user > become stop but radius checks ldap attributes only at the first of > connection not in the middle. How can I set radius server check users > traffic with the amount of this attribute in ldap server in the duration of > connection? > > The radius server steps out of the way once authentication and authorization > is complete, nor does it have the ability to disconnect a user from a NAS. > You need to have the NAS disconnect the user itself when a threshold is > reached. This is accomplished by returning a vendor specific attribute > specifying the limit for the session which the NAS then maintains. Once the > limit on the NAS is reached the NAS terminates the session. You'll have to > check your NAS documentation for a traffic limiting parameter. In the other > common case of disconnect after a time duration it's handled by computing > the session length during authorization and returning attribute 194 with the > maximum number of seconds for the connection. This attribute is understood > by comon NAS devices and is known variously as Ascend-Maximum-Time, > Cisco-Maximum-Time > or Lucent-Maximum-Time. You'll need to apply the same logic for data volume. >

3 2

Re: Upgrading freeradius from source
by Ming-Ching Tiew 14 May '09

14 May '09

--- On Thu, 5/14/09, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: > From: A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Upgrading freeradius from source > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Date: Thursday, May 14, 2009, 7:45 AM > Hi, > > > Software will always have flaws, defects, bugs or > whatever > > we call it. The way I understand the rpmbuild > process, > > it is not difficult to add a little patch which fixes > > the problem. > > ..or just wait for 2.1.6 which fixes the problem + many > other small > issues > No issues. I have made myself a own rpm for 2.1.4/2.1.5 for adapting the older SPECS. It's not perfect but good enough for my own consumption for the time being. Cheerse.

1 0

Problems with IP address allocation, help needed debugging...
by Ramm-Ericson, Johannes 14 May '09

14 May '09

Hi Freeradius-users! I've run into a problem with my Freeradius 2.1.3 installation (on Suse Linux 10 - I'll be upgrading freeradius & migrating to Ubuntu Linux server during the weekend) that I'm hoping maybe someone on this list can help me with. There are several NASes from various vendors / service providers connecting to my Freeradius server. I have instances of IP address allocation managed by the vendors equipment and in some cases IP address allocation is managed by my server. IP address management by Freeradius works fine except for in one instance and I have been hitting my head against the wall trying to figure out where the problem is. Here is the radiusd.conf post-auth / ippool configuration for a working instance (GLANA) and for the instance that does not work (CBJN) ippool GLANA { range-start = 192.168.10.2 range-stop = 192.168.10.254 netmask = 255.255.255.0 cache-size = 252 session-db = ${db_dir}/db.GLANA.pool ip-index = ${db_dir}/db.GLANA.ipindex #override = yes maximum-timeout = 600 } ippool CBJN { range-start = 192.168.6.2 range-stop = 192.168.6.254 netmask = 255.255.255.0 cache-size = 252 session-db = ${db_dir}/db.CBJN.pool ip-index = ${db_dir}/db.CBJN.ipindex #override = yes maximum-timeout = 600 } Following are extracts from the debug log that exemplify a working instance with GLANA and a failing instance with CBJN: ************** Working instance with GLANA *************** Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.249 port 3886, id=80, length=126 NAS-IP-Address = 192.168.11.249 NAS-Identifier = "sh_ggsn_3" Called-Station-Id = "GLANA" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 64749880 User-Name = "048103" User-Password = "*****" Calling-Station-Id = "3333" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 250 [files] users: Matched entry DEFAULT at line 278 ++[files] returns ok Found Auth-Type = System +- entering group System {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <sel048103> ++[pam] returns ok Login OK: [048103] (from client GLANA port 64749880 cli 3333) +- entering group post-auth {...} [GLANA] expand: %{NAS-IP-Address} %{NAS-Port} -> 192.168.11.249 64749880 [GLANA] MD5 on 'key' directive maps to: 525f9fa7f7e5045b96ec4ad53f324087 [GLANA] Searching for an entry for key: '525f9fa7f7e5045b96ec4ad53f324087' rlm_ippool: Allocating ip to key: '525f9fa7f7e5045b96ec4ad53f324087' [GLANA] num: 1 [GLANA] Allocated ip 192.168.10.55 to client key: 525f9fa7f7e5045b96ec4ad53f324087 ++[GLANA] returns ok [reply_log] expand: /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply -detail-%Y%m%d -> /opt/freeradius/current/var/log/radius/radacct/192.168.11.249/reply-detail-2009 0513 [reply_log] /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m %d expands to /opt/freeradius/current/var/log/radius/radacct/192.168.11.249/reply-detail-20090513 [reply_log] expand: %t -> Wed May 13 11:10:21 2009 ++[reply_log] returns ok [sql] expand: %{User-Name} -> 048103 [sql] sql_set_user escaped user --> '048103' [sql] expand: %{User-Password} -> ***** [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdat e) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type} ', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '048103', '****', 'Access-Accept', '2009-05-13 11:10:21') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (userna me, pass, reply, authdate) VALUES ( '048103', '*****', 'Access-Accept', '2009-05-13 11:10:21') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok Sending Access-Accept of id 80 to 192.168.11.249 port 3886 MS-Primary-DNS-Server = 192.168.212.10 Framed-IP-Address = 192.168.10.55 Framed-IP-Netmask = 255.255.255.0 Finished request 90. ***************************************************** **************** Failing instance with CBJN **************** Ready to process requests. rad_recv: Access-Request packet from host 10.100.100.1 port 4415, id=170, length=136 NAS-IP-Address = 10.100.100.1 NAS-Identifier = "****" Called-Station-Id = "CBJN" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 9682712 User-Name = "100583" User-Password = "****" 3GPP-IMSI = "111111111111" Calling-Station-Id = "2222" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 236 [files] users: Matched entry DEFAULT at line 278 ++[files] returns ok Found Auth-Type = System +- entering group System {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <100583> ++[pam] returns ok Login OK: [100583] (from client CBJN port 9682712 cli 2222) +- entering group post-auth {...} ++[GLANA] returns noop [reply_log] expand: /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply -detail-%Y%m%d -> /opt/freeradius/current/var/log/radius/radacct/10.100.100.1/reply-detail-200905 14 [reply_log] /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m %d expands to /opt/freeradius/current/var/log/radius/radacct/10.100.100.1/reply-detail-20090514 [reply_log] expand: %t -> Thu May 14 07:52:51 2009 ++[reply_log] returns ok [sql] expand: %{User-Name} -> 100583 [sql] sql_set_user escaped user --> '100583' [sql] expand: %{User-Password} -> ****** [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdat e) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type} ', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '100583', '*****', 'Access-Accept', '2009-05-14 07:52:51') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (userna me, pass, reply, authdate) VALUES ( '100583', '****', 'Access-Accept', '2009-05- 14 07:52:51') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok Sending Access-Accept of id 170 to 10.100.100.1 port 4415 MS-Primary-DNS-Server = 192.168.212.10 Finished request 54. ************************************************** I'm hoping someone can provide some guidance as to why IP address allocation via Freeradius fails in the second (CBJN) instance.... Also; naturally I'll provide any further logs necessary to clarify anything I may have missed mentioning now (for obvious reasons I also had to clean the logs before posting them here, so I may have missed a relevant entry). Thanks and Regards, Johannes

2 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 14 May '09

14 May '09

--- On Wed, 5/13/09, John Dennis <jdennis(a)redhat.com> wrote: > BTW, the 2.1.4/2.1.5 snafu is why > the most recent > RPM is 2.1.3. > -- Software will always have flaws, defects, bugs or whatever we call it. The way I understand the rpmbuild process, it is not difficult to add a little patch which fixes the problem. Regards.

3 2

how to limiting user bandwidth by quota..
by Nizar Zulmi 14 May '09

14 May '09

dear all..i'am using freeradius 1.1.7 on ubuntu 8.04, i do implementing sqlcounter like noresetcounter,dailycounter and montly counter and it works properly. but i now i have 1 case how to limiting user bandwidth usage with sqlcounter, i've read and learn how do sqlcounter work, but i still dont have idea how to make a query to limiting user bandwidth. i have 1 user and i want to limit the bandwidth for this user 300mb in a week..how to perform this..clue please..really apreciate for your help

3 2