- Freeradius-Users - lists.freeradius.org

can the modules cause 'Exiting normally'?
by switchport＠hotmail.com 20 Mar '09

20 Mar '09

i write a likely rlm_sql module. test radius by the below shell, the auth_test file contain 8000 users. --------------------------- #!/bin/bash i=0 while true do date time ../radclient -p 16 -q -s -f auth_test 127.0.0.1:1812 auth xxxxxx i=`expr $i \+ 1` echo $i done ---------------------------- when tested xk or 1xk cycles, radius can 'Exiting normally' without no detail log. what wrong? the test shell echo ---------------------------- 3872 Fri Mar 20 09:01:09 CST 2009 Total approved auths: 8000 Total denied auths: 0 Total lost auths: 0 real 0m3.344s user 0m0.793s sys 0m1.245s 3873 Fri Mar 20 09:01:12 CST 2009 Total approved auths: 8000 Total denied auths: 0 Total lost auths: 0 real 0m3.352s user 0m0.778s sys 0m1.266s 3874 Fri Mar 20 09:01:16 CST 2009 Total approved auths: 8000 Total denied auths: 0 Total lost auths: 0 real 0m3.359s user 0m0.764s sys 0m1.277s 3875 Fri Mar 20 09:01:19 CST 2009 radclient: no response from server for ID 195 socket 3 Total approved auths: 7999 Total denied auths: 0 Total lost auths: 1 real 0m20.599s user 0m0.836s sys 0m1.477s 3876 Fri Mar 20 09:01:40 CST 2009 radclient: no response from server for ID 46 socket 3 radclient: no response from server for ID 162 socket 3 radclient: no response from server for ID 132 socket 3 radclient: no response from server for ID 81 socket 3 ... ----------------------------------------------------------------------------------- radius log show --------------------------------------------------------------------------------- Fri Mar 20 08:58:03 2009 : Error: Discarding conflicting packet from client localhost port 55746 - ID: 32 due to recent request 30648083. Fri Mar 20 08:58:57 2009 : Error: Discarding conflicting packet from client localhost port 54935 - ID: 39 due to recent request 30759434. Fri Mar 20 08:59:09 2009 : Error: Discarding conflicting packet from client localhost port 60967 - ID: 103 due to recent request 30770305. Fri Mar 20 08:59:43 2009 : Error: Discarding conflicting packet from client localhost port 58098 - ID: 131 due to recent request 30839295. Fri Mar 20 09:00:00 2009 : Error: Discarding conflicting packet from client localhost port 55258 - ID: 182 due to recent request 30862096. Fri Mar 20 09:00:14 2009 : Error: Discarding conflicting packet from client localhost port 42660 - ID: 47 due to recent request 30880046. Fri Mar 20 09:00:44 2009 : Error: Discarding conflicting packet from client localhost port 53858 - ID: 222 due to recent request 30932873. Fri Mar 20 09:01:22 2009 : Error: Discarding conflicting packet from client localhost port 44717 - ID: 195 due to recent request 31006705. Fri Mar 20 09:01:24 2009 : Info: Exiting normally. --------------------------------------------------------------------------------- radiusd.conf ---------------------------------------------------------------------------- thread pool { start_servers = 8 max_servers = 64 min_spare_servers = 4 max_spare_servers = 12 max_requests_per_server = 0 } -----------------------------------------------------------------------------

1 0

LDAP ntPassword and lmPassword help
by Padam J Singh 20 Mar '09

20 Mar '09

Hello, I have a LDAP server which contains ntPassword and lmPassword attributes like following: dn: uid=subs, ou=accounts, dc=test, dc=com uid: subs userPassword:: e01ENX03MmIwMTViNDhlOTU5ZTlkYWQ3MTAxNjNiYjJhZDkyMQ== mac: "" lmPassword: {ENC}9846B736BDDA9E7CAAD3B435B51404EE ntPassword: {ENC}22D6ADD4E9AD37B87B8EDB2C91E1EE67 objectClass: objDevices objectClass: top FR 2.1.1 is configured for doing 802.1x authentication. While doing the authentication, I obviously get Invalid NT-Password and Invalid LM-Password error. The error stems from the fact that the length is incorrect because of the additional {ENC} prefix. Is there some configuration where I can set something so it ignores the initial {ENC} while doing the password comparison? I cannot get rid of the {ENC} prefix. Thanks, Padam -- PGP Id 9EED2E09

3 2

packet freeradius-mysql for RH
by Martin Silvero 19 Mar '09

19 Mar '09

Hi list! I need the packets freeradius-mysql... I have this: freeradius-mysql-1.1.3-1.2.el5.i386.rpm but my freeradius is 2.1.3 and this rpm don´t work. I have Red Hat 5.1 Somebody have any idea where I get this packet? My problem is this: **Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Errors initializing modules** I reed RedHat FAQ. I have "freeradius-mysql-2.1.3-1.fc9.i386.rpm", but is Fedora. I don´t find the solution. Any idea?

3 2

Reply-Name/Message with own values (FR 2.0.5)
by Jan Strauch 19 Mar '09

19 Mar '09

Hello world !!! First : I used the search, but it did not help me. I would like to change the reply-Messages of sqlcounter. Looked in the list and the www, but there was not really a useful info. And like always I can not solve the problem. Tried : sqlcounter Duration { counter-name = Duration check-name = Card-Duration sqlmod-inst = sql key = User-Name reset = never reply-message = "Hail Satan" query = "SELECT unix_timestamp(now())-min(unix_timestamp(acctstarttime)) FROM radacct WHERE UserName='%{%k}'" } and got : rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user test, check_item=1000, counter=20098 ++[Duration] returns reject Found Post-Auth-Type Reject <........> Sending Access-Reject of id 103 to 127.0.0.1 port 38075 Reply-Message = "Your maximum never usage time has been reached" the same with reply-name = Mikrotik-Xmit-Limit or reply-name = some other values Is there a list somewhere, where I can see the reply-names with corresponding reply-messages ? Is there a way to change these messages ? most of our customers are germans and their english is worse than mine. It would be nice to give them german messages and spanish for the spanish. Thanks Jan _______________________________________________________________________ DSL zum Nulltarif + 20 Euro Extraprämie bei Online-Bestellung über die DSL Freundschaftswerbung! http://dsl.web.de/?ac=OM.AD.AD008K15279B7069a

2 1

Mysql database on non standard port
by Guto Andreollo 19 Mar '09

19 Mar '09

Hello all! I'm trying to configure the mysql module to use a port different than 3306 to connect to the db server. I've tried setting the server string as "mysql-server.domain.com:12345" on sql.conf, but that's unfortunately not correct. Can anyone point me to the correct syntax? thanks all. --- Augusto G. Andreollo CCUEC/DCNET/SREDE Universidade Estadual de Campinas - UNICAMP +55 19 3521-2276 -- "Wit beyond measure is men's greatest treasure."

2 1

Re: A couple of NAS servers with same Port ID problem.
by Piero Giobbi 19 Mar '09

19 Mar '09

Thx for the answers Alan. p Piero Giobbi wrote: > This is probably a silly question but i can't solve it by myself. I > have > a couple of WLANS (Proxim AP4000), works great with FR but im having > some accounting trouble (guessing), i get a lot of these in my log: The AP's don't do accounting "well". > I tripplechecked the shared secret. That's not the problem. > The authentication works, clients can connect. > What does rlm_radutmp do? Could i turn it off in my config (what would > happened)? It shows who is currently logged in. If you don't need to know that, delete the references to radutmp from the configuration files. > Should i specify different NAS-PORTS for each NAS-server? No. > OR - could it just be that Proxim AP4000 is not handling these logouts > correctly, a hardware problem? The AP is giving different information for the accounting start && stop. Not surprisingly... this is allowed by the RADIUS RFC's. Alan DeKok.

1 0

how to prevent account to do multiple login
by Nizar Zulmi 19 Mar '09

19 Mar '09

i've configure freeradius and chillispot and running well, i jut have one user in radcheck table, the problem i use that account to login to the server from two client in same time both of computer got the access. how to prevent this..?? anyone help me. hope u understand. sorry for my very bad english really apreciate for your feedback

2 1

Re: freeradius and mikrotik auth problem pppoe error 691
by Lazar Cherveniakov 19 Mar '09

19 Mar '09

The machines are connected to cable and on 2 meters, in this case where to find the problem? What and how to get to see where the real problem? -- Lazar Cherveniakov Micro computers system - Lazkom LIVE FREE OR DIE ------------------------------------- Powered by Mail.BG - http://mail.bg

2 1

Re: FreeRadius with Postgresql
by Sunday Olutayo 19 Mar '09

19 Mar '09

I install the freeradius from the Ubuntu repo. Sunday Olutayo ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Thursday, 19 March, 2009 11:41:36 GMT +01:00 West Central Africa Subject: Freeradius-Users Digest, Vol 47, Issue 92 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: FreeRadius with Postgresql (A.L.M.Buxey(a)lboro.ac.uk) 2. Re: MacOS X Leopard version of FR crashing with segmentation fault (Alan DeKok) 3. Re: freeradius and mikrotik auth problem pppoe error 691 (tnt(a)kalik.net) 4. Re: Adding users in the database from a client computer (tnt(a)kalik.net) 5. Re: radclient: problem with exit code 0 and 1 (oz) 6. Re: FreeRadius with Postgresql (tnt(a)kalik.net) 7. Re: radclient: problem with exit code 0 and 1 (tnt(a)kalik.net) 8. Re: dear everyone.. (Nizar Zulmi) ---------------------------------------------------------------------- Message: 1 Date: Thu, 19 Mar 2009 09:40:55 +0000 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: FreeRadius with Postgresql To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090319094055.GC4883(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > On following the messages; this is what I get from running freeradius -X > but before point it to PostgreSQL it runs fine. <snip> > rlm_sql (sql): Could not link driver rlm_sql_postgresql: rlm_sql_postgresql.so: cannot open shared object file: No such file or directory > rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. fairly straight forward - did you build this server yourself? If so, did you check the output of the ./configure stage? looks like it hasnt built the postgres modules - probably because the required postgres devel package wasnt installed at the time. if this is from a package, check that there isnt some additional part package that provides the postgres functionality - I note that several distros split FR into multiple parts. alan ------------------------------ Message: 2 Date: Thu, 19 Mar 2009 11:08:11 +0100 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: MacOS X Leopard version of FR crashing with segmentation fault To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <49C2198B.3050706(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Randall Newman wrote: > I looked at the permissions but everything looks ok, so still not sure > why the -x and -xx options are not working, but that's not my main > problem. I did notice one strange thing in the log shortly before one of > the segmentation faults. Not sure if its related but perhaps someone > here can shed some light: > > radiusd(32122,0xa0479720) malloc: *** error for object 0x1d3610: > incorrect checksum for freed object - object was probably modified after > being freed. > *** set a breakpoint in malloc_error_break to debug Yes, that would be related. It's a bug. The simple suggestion is to upgrade to a recent version, which won't have this bug. Alan DeKok. ------------------------------ Message: 3 Date: Thu, 19 Mar 2009 11:08:33 +0100 From: <tnt(a)kalik.net> Subject: Re: freeradius and mikrotik auth problem pppoe error 691 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <ABOLfBNb.1237457313.6016940.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 >I don`t have firewall >How i solve the problem ? Yes, you do. Things like iptables are also firewalls. Use wireshark to find where are packets stopped. And then fix it. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Thu, 19 Mar 2009 11:20:26 +0100 From: <tnt(a)kalik.net> Subject: Re: Adding users in the database from a client computer To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <Xy7curVV.1237458026.1324940.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 >Again, I'm a relatively new freeradius user so I am not really an expert >with it. > >In our project, we need to "add" and "delete" users from the server database >from an authorized client computer. See: - dialup admin (included with the server) - daloRadius (same thing but under active development) - phpMy Admin (works directly with the database; requires for you to know what you are doing- if you don't use the admin tools above) Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 5 Date: Thu, 19 Mar 2009 11:23:53 +0100 From: oz <oz(a)bluemonk.de> Subject: Re: radclient: problem with exit code 0 and 1 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <49C21D39.9080304(a)bluemonk.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: > oz wrote: >> the normal behavior of radclient seems to get lost somewhere in the >> versions later than freeradius-0.7, where it worked: > > That's nice... but 1.1.x will NOT be fixed. > > I've committed a fix that will be in the next release of the server. > If you need this functionality, upgrade. Thanks, but for some reasons I cannot do updates to the upcoming release on that server. So I compiled 0.7 this morning, just to get the radclient tool from that release. It was succesfully built, yeay, but has another bug with masking the password when it is used in the radtest-script :-/ Sending Access-Request of id 110 to 192.168.X.X:1812 User-Name = "testuser" User-Password = "\360\213[p\224\212I\314\217\343\361\214\370\326\351$" Do you have an idea, which freeradius version after 0.7 has a working exit code 1, but is free from that other problem with the password-masking? Then I'd like to try that. Else I would have to test-compile the 19 releases between 0.7 and 1.1.7 for a possible workaround. oz ------------------------------ Message: 6 Date: Thu, 19 Mar 2009 11:31:43 +0100 From: <tnt(a)kalik.net> Subject: Re: FreeRadius with Postgresql To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <2MX3ZcOA.1237458703.3584630.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 >rlm_sql (sql): Could not link driver rlm_sql_postgresql: rlm_sql_postgresql.so: cannot open shared object file: No such file or directory >rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. >radiusd.conf[11]: sql: Module instantiation failed. >radiusd.conf[1860] Unknown module "sql". >radiusd.conf[1789] Failed to parse authorize section. http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#It_says_.22Could_n… Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 7 Date: Thu, 19 Mar 2009 11:37:47 +0100 From: <tnt(a)kalik.net> Subject: Re: radclient: problem with exit code 0 and 1 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <grm8YwoX.1237459067.9781960.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 >from that release. It was succesfully built, yeay, but has another bug with >masking the password when it is used in the radtest-script :-/ > > Sending Access-Request of id 110 to 192.168.X.X:1812 > User-Name = "testuser" > User-Password = "\360\213[p\224\212I\314\217\343\361\214\370\326\351$" > Not a bug. Shared secret is wrong. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 8 Date: Thu, 19 Mar 2009 03:41:30 -0700 (PDT) From: Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> Subject: Re: dear everyone.. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <820558.16835.qm(a)web30401.mail.mud.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" still can't get it. can u show me please which script to do benchmarking the RADIUS server, and how to running the script,. --- On Thu, 3/19/09, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: From: A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: dear everyone.. To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, March 19, 2009, 4:20 PM -----Inline Attachment Follows----- Hi, > iam a new bie freeradius user, i have a duty from my lecture to build a hotspot captive portal using chillispot and freeradius. now i make it, chilispot and freeradius working well on ubuntu machine, but the problem is my lecture want me to do stress test on the radius server to make sure that the system is still working well in any condition.. > > i still confused how to perform the stress test...anyone help me please..thank you for your attentionsorry for bad english :D there are a couple of scripts supplied with the server to allow benchmarking which hit the server fast and hard. run a couple of those whilst eg flood pinging the system.? but 'any condition' is hardly any kind of scientific or useful phrase. for example, is the system working well if half the packets get lost? does the system work well if packets are routed in different directions? does the system work well when an idiot logs into the box and runs other random processes that take up CPU time (nice bit of SETI or D2OL etc)?? quantify the scenarios before you can demonstrate behaviour. useful exercise as you might uncover some wierd corner case to help improve the server (I've found several Linux kernel issues over the years on very stressed servers) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

filter-id help
by Dana Teague 19 Mar '09

19 Mar '09

I am running freeradius 1.0 . My server has been running for several years and has worked great authenticating users with a PIX and dialup servers. We are adding a watchguard firewall. Freeradius needs to send the watchguard the following filter-id on successful authentication: IPSEC_RADIUS. It appears to just send RADIUS and causes the authentication to fail. I know this is simple but I am having trouble getting this to work. Please help Dan

2 1