- Freeradius-Users - lists.freeradius.org

Looking to pay someone for a customization
by Eric Geier 13 Apr '09

13 Apr '09

Hi, if anyone is interested in customizing the source code for me, please check out either site: http://www.getacoder.com/projects/c_developer_radius_expe_102912.html http://www.odesk.com/jobs/Developer-with-RADIUS-Experience_~~f48a82c177d7e1b 3?tot=129&pos=7 I would like FreeRADIUS to check incoming requests based upon the domain (derived from the username), instead of the NAS IP addresses. Thanks! Eric

1 0

Offloading password verification
by Phil Meech 13 Apr '09

13 Apr '09

Hi All, I'm running version 1.18 currently on Ubuntu 2.6.24-19-server; configured to use MYSQL for all auth and accounting requests. I have been asked to move the password verification away from MySQL and use an external username/password DB (managed by another company), for which my only method of access is an http API (given a username and password the API returns either 1 or 0). All attributes will still be held in the current MySQL freeradius DB; and all the users that exist in the API DB will also exist in the same current MySQL DB. The password is passed as PAP through to freeradius currently from the NAS devices, and the API also expects a plaintext password. I was thinking I could use the perl module to achieve this; but am a little lost with where to start (writing the perl script is fine). I guess the point of my post is how to keep all the attributes in MySQL and only offload the password to the API; and where this change would fit in to the radiusd.conf file? Any advice would be gratefully received. Many Thanks, Phil

3 2

dynamic ip address allocation problem for wifi system
by kalesameer 13 Apr '09

13 Apr '09

I have implemented a wifi authentication system wherein users authenticate themselves using their username and password. I am using EAP-PEAP for this purpose.Further, I want to assign ip addresses to the users dynamically.From whatever documentation i have read, I gather that using rlm_ippool module does not work for EAP authentication.Also,FreeRADIUS does not support DHCP fully. I am using OpenLDAP as a database which stores entries of all the users authorised to use the wireless system.FreeRADIUS version is 2.1.1. So,first of all,am I correct in saying that rlm_ippool cannot be used with EAP authentication for assigning ip addresses to clients(not access points but end users of wifi system)?Also,is there any patch or sample code available for allocating ip addresses dynamically using DHCP?And if both the above methods are not possible, then is there any other way to assign ip addresses to clients dynamically? -- View this message in context: http://www.nabble.com/dynamic-ip-address-allocation-problem-for-wifi-system… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

rlm_perl don't support tagged attributes
by Igor Belikov 13 Apr '09

13 Apr '09

Hello Freeradius-users, FreeRADIUS Version 2.1.5 (it was downloaded as 2.1.4, but it writes about itself as 2.1.5) Portion from "radiusd -X" output Module: Linked to module rlm_perl Module: Instantiating erxlogontime perl erxlogontime { module = "/usr/local/freeradius-2.1.4/etc/raddb/servicelogintime.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth_erx" } File servicelogintime.pl use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle post_auth sub post_auth_erx { &radiusd::radlog(1, "***** custom post_auth procedure *****"); # For debugging purposes only #&log_request_attributes; #for (keys %RAD_REPLY) #{ # &radiusd::radlog(1, "RAD_REPLY: $_ = $RAD_REPLY{$_}"); #} return RLM_MODULE_NOOP; } procedure post_auth_erx executed as expected portion from debug output: +- entering group post-auth {...} GOT CLONE -1212740928 0x82bbaf0 rlm_perl: ***** custom post_auth procedure ***** but after returning from post_auth_erx all tags from attributes are resetted to zero: Sending Access-Accept of id 186 to 192.168.100.73 port 60654 ERX-Service-Login-Time:0 = "Al1800-2359,Al0000-0859" ERX-Qos-Profile-Name = "SP_WCL" ERX-Qos-Parameters += "world_value 1000000" ERX-Qos-Parameters += "assure_world_value 100000" ERX-Qos-Parameters += "city_value 10000000" ERX-Service-Statistics:0 += time-volume ERX-Service-Statistics:0 += time-volume ERX-Service-Activate:0 += "world(1000000)" ERX-Service-Activate:0 += "city(10000000)" ERX-Service-Activate:0 += "deny" ERX-Service-Interim-Acct-Interval:0 += 600 ERX-Service-Interim-Acct-Interval:0 += 600 If we comment out module servicelogintime.pl, we receive correct tagged attributes: Sending Access-Accept of id 154 to 192.168.100.73 port 65168 ERX-Service-Login-Time:1 = "Al1800-2359,Al0000-0859" ERX-Service-Activate:1 += "world(1000000)" ERX-Service-Statistics:1 += time-volume ERX-Service-Interim-Acct-Interval:1 += 600 ERX-Qos-Parameters += "world_value 1000000" ERX-Qos-Parameters += "assure_world_value 100000" ERX-Service-Activate:2 += "city(10000000)" ERX-Service-Statistics:2 += time-volume ERX-Service-Interim-Acct-Interval:2 += 600 ERX-Qos-Parameters += "city_value 10000000" ERX-Service-Activate:3 += "deny" ERX-Qos-Profile-Name = "SP_WCL" -- Best regards, Igor mailto:ivb@is.ua

1 0

Log and datatime
by peppeska 13 Apr '09

13 Apr '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is possible to log the date and time of connection and disconnection of each user? - -- <<<<---------------------------------------------------------->>>> |Giuseppe Moscato aka peppeska - Linux User - no html messages---| |ggippone(a)yahoo.it --------- http://peppeska.altervista.org------| |Fingerprint = 90DC 05A8 2D65 BC04 BD1B 4C07 C389 434B 3201 319D| <<<<---------------------------------------------------------->>>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkni/rQACgkQkA6hcnFZI/a1XACg1Y3VkjixKecvn9SYtOxWVNdE YtYAoJZKm27pygq7LcmkSF1dWgg4ERYZ =Tdgk -----END PGP SIGNATURE-----

2 1

Handling of duplicates in clients.conf
by Garber, Neal 13 Apr '09

13 Apr '09

I'm running FR 2.0.3 and I just found that if there is more than one client with the same IP address in clients.conf, then it will stop processing the remainder of the file and continue startup. The only indication it has done this are 2 error messages that are easily missed when running with debug on. I checked git.freeradius.org and noticed that the client.c committed on 09-March now ignores duplicates if they are exactly the same. In my case, everything was the same except the name. My question is, wouldn't it be better to continue processing the remainder of the file even when there are duplicates that aren't identical or alternatively to preclude the server from starting (I'd vote for the former). Ignoring what could be hundreds of clients that follow the error doesn't seem useful. I propose ignoring all duplicates and having client_add return ok (1). This would log the error for any duplicates (even duplicates that aren't completely identical), but allow processing to continue for the remainder of the file.

5 12

Re: billing using radius
by Eric 13 Apr '09

13 Apr '09

> > Thanks parham, I'm new in freeradius. could you please send me configs needed in freeradius files? I want to disconnect some users after receiving 8G and for others I want to calculate base on KB that they have used rather than 8G. In which file I should do changes? > > > Message: 1 > Date: Sun, 12 Apr 2009 14:45:21 +0430 > From: "Parham Beheshti" <p_beheshti(a)rasana.net> > Subject: RE: billing using radius > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org>, > <freeradius-users(a)lists.freeradius.org> > Message-ID: <ED57DEBBACDAFF43A9ABD14FF9CBD1E82BB823(a)mail.rasana.ir> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > Well, this can be very simple ... or very complicated ... > I'm doing traffic based accounting with freeradius and have been more then > happy. > Our scenario is pretty complicated, it involves different pricing KB for > day of week/time of day, users are able to purchase additional credit,etc. > to get you started: > > 1. you can get user's traffic (acctinputoctets+acctoutputoctets) for a > given time period and don't let the user login next time he/she wants to > access the service. This will take care of not letting users over the quota > to login... > > 2. you can check your online users periodically send COA (Disconnect > packet) if user's traffic is above your limit... > > 3. you may have very long sessions(days, weeks or months) that cross > bounderies for example: 10GB/week and have sessions longer then week. to > solve this issue you need to have interim-update packets from your NAS, the > nas will send you packets regularly... use this against your old data to > calculate how much traffic was used. create a daily traffic table and update > it with calculated amount. use counters based on the dailytraffic. > > depending on number of users you have you may need to partition your daily > traffic table. > > this solution scales pretty good: > we have about 50,000 broadband users, 5 minute interim-update and we have > hourly and daily traffic information tables. we are no where near our limits > and freeradius/mysql is scaling very well. (10% load) > > You will be better off to do all this calculation in stored procedures > instead of queries ... > Let me know if you need more info > > Cheers, > Parham > > > ------------------------------------------------------------------------------------------ > > > Hi, > I use freeradius server for accounting of vpn users.I use monthly counter > to limit users but now I want if user's traffic is rather than specific > amount, I will be able to have billing for them and to disconnect some of > them. Is it possible to have billing with config in freeradius or a new > software is needed? > could radius disconnect users based on amount of traffic not counters? > > > > End of Freeradius-Users Digest, Vol 48, Issue 48 > ************************************************ >

1 0

Help userpassword attribute requird
by Basant Agarwal 12 Apr '09

12 Apr '09

Hello, I am using freeradius-1.1.7 . i am using the default configuration with a local user whose entry is in users file . now when i try from localhost it works.. But when i try from laptop it shows error that user password attribute requird ..!!! what should i do...? rad_recv: Access-Request packet from host 172.16.1.205:3072, id=0, length=125 User-Name = "basant" NAS-IP-Address = 172.16.1.205 Called-Station-Id = "001a70aa5bee" Calling-Station-Id = "001b777bdffa" NAS-Identifier = "001a70aa5bee" NAS-Port = 30 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000b01626173616e74 Message-Authenticator = 0xda9d5f6bde06b199a7cbb321e26604cc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "basant", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry basant at line 100 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 172.16.1.205 port 3072 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 49dffaf3 Nothing to do. Sleeping until we see a request.

2 1

billing using radius
by Eric 12 Apr '09

12 Apr '09

Hi, I use freeradius server for accounting of vpn users.I use monthly counter to limit users but now I want if user's traffic is rather than specific amount, I will be able to have billing for them and to disconnect some of them. Is it possible to have billing with config in freeradius or a new software is needed? could radius disconnect users based on amount of traffic not counters?

2 1

rlm_perl behavior
by Apostolos Pantsiopoulos 12 Apr '09

12 Apr '09

I updated my server from 2.0.x to 2.1.4 and found out that the rlm_perl config now resides in the /module directory. I noticed that the following directives : max_clones = 10 start_clones = 5 min_spare_clones = 1 max_spare_clones = 5 max_request_per_clone = 100 for perl were not present in the file after the compiling. Are these directives obsolete? Also, in my perl script I make use of the CLONE function that according to the wiki is the ideal place to initialize database handlers. This seemed to work fine for the last 2 years with 1.x and 2.0.x freeradius. Using the parameters above and the CLONE function I could see 10 connections to my mysql server from the moment radiusd was up. When I migrated to 2.1.x the CLONE function seems to be called only after the first radius packet arrives (which is not an issue really). But when I check my connections to the mysql server there seems to be only one...! Was the behavior of rlm_perl altered in any way? I want to have multiple instances of rlm_perl so that I can connect to different databases simultaneously and spread the load. -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com R & D email: regs(a)kinetix.gr -------------------------------------------

2 4