- Freeradius-Users - lists.freeradius.org

unsubscribe
by freeradius-users 13 Jan '09

13 Jan '09

unsubscribe CompuLab - Consult Robert Schuster Am Karmelkloster 16 53229 Bonn mailto: robert.schuster(a)compulab-consult.de Tel. +49 228 97604-0 Fax. +49 228 97604-25 mobil +49 175 1606254

1 0

Multiple output pairs in rlm_exec - How to format the response pai string?
by Hanno Schupp 13 Jan '09

13 Jan '09

I try to determine some data externally through an PHP programme with the 'exec' module. Everything is fine as long as I do only return one value from PHP, the return attribute is duly accepted and processed. As soon as I return more than one the exec module gets confused, as everything is returned in one long string (see debug output). There is no documentation in the echo or exec module as far as I can see, so I tried spaces, \r\n, and commas ',' as delimiters. Nothing worked. Is this a limitation of the exec module, that it only accepts one reply value back? The name of the parameter 'output_pairs' seems to suggest otherwise. Can anyone advise on the proper delimitation of multiple return values? BTW, thanks everyone for all their help so far. Debug output: ... Tue Jan 13 13:38:40 2009 : Debug: expand: %{User-Name} -> yubvef24 Tue Jan 13 13:38:40 2009 : Debug: Exec-Program output: WISPr-Bandwidth-Max-Down := 256000 Reply-Message := "Connection speed has been reduced" WISPr-Bandwidth-Max-Up := 32000 Reply-Message := "Connection speed has been reduced" Tue Jan 13 13:38:40 2009 : Debug: Exec-Program-Wait: plaintext: WISPr-Bandwidth-Max-Down := 256000 Reply-Message := "Connection speed has been reduced" WISPr-Bandwidth-Max-Up := 32000 Reply-Message := "Connection speed has been reduced" Tue Jan 13 13:38:40 2009 : Debug: Exec-Program: returned: 0 Tue Jan 13 13:38:40 2009 : Info: +++[maxspeedrestrict] returns ok ... PHP code creating the response: ... $colname_Recordset1 = "-1"; if (isset($_ENV['USER_NAME'])) { $colname_Recordset1 = substr($_ENV['USER_NAME'], 1, strlen($_ENV['USER_NAME']) - 2); } $retval = 2; mysql_select_db($database_chilli, $chilli); $query_Recordset1 = sprintf("SELECT Value, op FROM radcheck WHERE UserName = %s AND Attribute = 'Download-Speed-Restricted'", GetSQLValueString($colname_Recordset1, "text")); $Recordset1 = mysql_query($query_Recordset1, $chilli) or die(mysql_error); $row_Recordset1 = mysql_fetch_assoc($Recordset1); $totalRows_Recordset1 = mysql_num_rows($Recordset1); $query_Recordset2 = sprintf("SELECT Value, op FROM radcheck WHERE UserName = %s AND Attribute = 'Upload-Speed-Restricted'", GetSQLValueString($colname_Recordset1, "text")); $Recordset2 = mysql_query($query_Recordset2, $chilli) or die(mysql_error); $row_Recordset2 = mysql_fetch_assoc($Recordset2); $totalRows_Recordset2 = mysql_num_rows($Recordset2); if ($totalRows_Recordset1 == '1') { echo 'WISPr-Bandwidth-Max-Down '.$row_Recordset1['op'].' '.$row_Recordset1['Value']." \r\n"; echo 'Reply-Message := "Connection speed has been reduced"'."\r\n"; $retval = 0; } if ($totalRows_Recordset2 == '1') { echo 'WISPr-Bandwidth-Max-Up '.$row_Recordset2['op'].' '.$row_Recordset2['Value']." \r\n"; echo 'Reply-Message := "Connection speed has been reduced"'."\r\n"; $retval = 0; } if ($retval == '2') { echo 'Reply-Message := "Time or Data allowance has been exhausted"'; } exit ($retval); ?>

1 0

Proxying: Multiple accounting hosts?
by Adam Bultman 12 Jan '09

12 Jan '09

I have Freeradius 2.1 built, and somehow, radrelay didn't get built. I was poking around on google, and it looks like proxy.conf might help me replace radrelay. Can you have multiple accthosts inside of proxy.conf realms? Like this: realm mydomain.com { type = radius authhost = LOCAL accthost = LOCAL accthost = 192.168.1.2:1813 accthost ... } On my FreeRADIUS 1.x server, I have a LOT of radrelay processes running, and it'd be nice to replace them all with proxy.conf. It'd make it much easier to manage for everybody else that might touch the server. I apologize if this is a dumb question, but I googled for a bit and didn't find anything. Adam

2 1

Error in test Freeradius
by Paulo César Naves Mota 12 Jan '09

12 Jan '09

Hello people, I`d like to know how to resolve this problem in configuration: [root@serverRH5 raddb]# radtest pc1 123456 localhost 0 mysecret Sending Access-Request of id 169 to 127.0.0.1 port 1812 User-Name = "pc1" User-Password = "123456" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=169, length=20 My clients.conf client localhost { ipaddr = 127.0.0.1 secret = mysecret require_message_authenticator = no shortname = localhost nastype = other } Thanks for all Best Regards Paulo Cesar

6 8

freeradius proxying to Juniper Steel-Belted - returning trailing \000 in attributes
by Jørn Kostøl 12 Jan '09

12 Jan '09

I'm running freeradius v2.1.1 that proxies to a Juniper Steel-Belted Radius. (NAS->freeradius->Juniper). The authentication works and the reply is sent to my NAS, but the Juniper sends back trailing \000 in the return attributes which my NAS obviously is not too fond of. The debug shows: rad_recv: Access-Accept packet from host <stripped> port 1812, id=94, length=289 Class = 0x53425232434c978dc5a3c1f6cbdbd4c011802c01800281988002801081aa91aab5a2d5a6c5a9908ab5a1b99ccc12800e81978dc5a3c1f6cbdbd4c289e48c84 Proxy-State = 0x3838 Cisco-AVPair = "+=lcp:interface-config= ip unnumbered lo10\000" Cisco-AVPair = "+=ip:addr-pool=testpool\000" Cisco-AVPair = "+=lcp:interface-config= ip vrf forwarding testvrf\000" Cisco-AVPair = "+=ip:dns-servers=x.x.x.x y.y.y.y\000" I'm having a problem figuring out where the trailing \000 is coming from. Has anyone experienced similar behavior or have experience proxying from freeradius to Juniper? Cheers, Jørn

2 1

3gpp2 parameter starts with '\0'
by lamersons 12 Jan '09

12 Jan '09

(debug listed below) Freeradius 2.x with Postgre database I need to store ESN value to my database, but it comes in format[3GPP2-ESN = "\000\000\000\000\000\000\00000BBF636"]. Freeradius counts '\0' as the end of the line and puts blank instead of actual parameter value. Not only ESN comes in that format but [Acct-Session-Id = "0000000\000"] does too. Does any1 have any ideas about this ? Thank You, Michael Zotov --------------------------------------------------------------------------------------------- main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 8192 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client PDSN { ipaddr = 192.168.145.1 netmask = 32 require_message_authenticator = no secret = "pdsn-key" shortname = "" nastype = "other" } client ltk1 { ipaddr = 80.232.227.87 require_message_authenticator = no secret = "cdma" shortname = "" nastype = "other" } client ltk2 { ipaddr = 80.232.227.88 require_message_authenticator = no secret = "cdma" shortname = "" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server ltk1 { ipaddr = 80.232.227.87 port = 1813 type = "acct" secret = "cdma" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server ltk2 { ipaddr = 80.232.227.88 port = 1813 type = "acct" secret = "cdma" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool ltk { type = fail-over home_server = ltk1 home_server = ltk2 } realm evdo.lattelecom { acct_pool = ltk nostrip } realm cdma.ltk.lv { acct_pool = ltk nostrip } realm lattelecom { acct_pool = ltk nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "Calling-Station-Id, Acct-Session-Id, 3GPP2-Correlation-Id" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "" password = "" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 48 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}', ' es es es est')" accounting_start_query_alt = "" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%{Event-Timestamp}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '%{Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', CDMABadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', CDMACorrelationId = '%{3GPP2-Correlation-Id}', CDMAActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /\" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radacc@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #31 rlm_sql (sql): Connected new DB handle, #31 rlm_sql (sql): starting 32 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #32 rlm_sql (sql): Connected new DB handle, #32 rlm_sql (sql): starting 33 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #33 rlm_sql (sql): Connected new DB handle, #33 rlm_sql (sql): starting 34 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #34 rlm_sql (sql): Connected new DB handle, #34 rlm_sql (sql): starting 35 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #35 rlm_sql (sql): Connected new DB handle, #35 rlm_sql (sql): starting 36 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #36 rlm_sql (sql): Connected new DB handle, #36 rlm_sql (sql): starting 37 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #37 rlm_sql (sql): Connected new DB handle, #37 rlm_sql (sql): starting 38 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #38 rlm_sql (sql): Connected new DB handle, #38 rlm_sql (sql): starting 39 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #39 rlm_sql (sql): Connected new DB handle, #39 rlm_sql (sql): starting 40 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #40 rlm_sql (sql): Connected new DB handle, #40 rlm_sql (sql): starting 41 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #41 rlm_sql (sql): Connected new DB handle, #41 rlm_sql (sql): starting 42 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #42 rlm_sql (sql): Connected new DB handle, #42 rlm_sql (sql): starting 43 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #43 rlm_sql (sql): Connected new DB handle, #43 rlm_sql (sql): starting 44 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #44 rlm_sql (sql): Connected new DB handle, #44 rlm_sql (sql): starting 45 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #45 rlm_sql (sql): Connected new DB handle, #45 rlm_sql (sql): starting 46 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #46 rlm_sql (sql): Connected new DB handle, #46 rlm_sql (sql): starting 47 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #47 rlm_sql (sql): Connected new DB handle, #47 } } radiusd: #### Opening IP addresses and Ports #### listen { type = "acct" ipaddr = 192.168.104.5 port = 1813 } Listening on accounting address 192.168.104.5 port 1813 Listening on proxy address * port 1489 Ready to process requests. Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823967" Framed-IP-Address = 192.168.173.4 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jan 9 2009 10:58:30 EET" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\00000BBF636" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "35067449" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "35067449",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823967"' rlm_acct_unique: Acct-Unique-Session-ID = "44d6e7436e38e449". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}','%{3GPP2-ESN}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('0000000', '44d6e7436e38e449', '247033715823967', 'Jan 9 2009 10:58:30 EET', NULL,'0', '0', '0', '192.168.173.4', trim('triatel(a)triatel.lv'), '0', '0', '35067449', '0', '192.168.145.1', '') rlm_sql (sql): Reserving sql socket id: 47 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 47 ++[sql] returns ok -------------------------------------------------------------------------------------------------- -- View this message in context: http://www.nabble.com/3gpp2-parameter-starts-with-%27%5C0%27-tp21409780p214… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 8

Re: Authentication Problem with PEAP and openldap
by Michael Poser 12 Jan '09

12 Jan '09

Hello Alan, thank you for your reply. The mapping of the NT-Password describe exactly our problem. We cannot find the right passage in the radius config to do this. Maybe you can give as a little hint, this would be very kindly. Best Regards, Michael > native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via > freeradius against openldap with an md4 encoded utf-16e password hash. The > authentication fails. If we use the hash instead of the clear-text password > with the xp client, the authentication works fine. There must be some > problems with the encryption of the password. How do we fix the problem? Any > help is appreciated. You may have the NT hash of the password in the LDAP database, but you're telling FreeRADIUS it's the clear-text password: ... > rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter > (uid=plisch01) > rlm_ldap: Added password 4183... in check items You want to map this to the NT-Password attribute. Alan DeKok. -- Michael Poser, HRZ - Abteilung Netze Tel.:069/798-28052

3 2

Disconnect packet
by Johan Meiring 12 Jan '09

12 Jan '09

Hi, This might be slightly off topic, but hoping I could get a pointer here. I am trying to use an openvpn talking to radius. I want the openvpn server to be able to receive a COA/DISCONNECT packet. The first idea I came up with was to try and get freeradius to receive the packet, then using rlm_perl do whatever I want after examining the packet. I realize that freeradius is not designed to do this, but I was hoping either the atuhentication of accounting module could give the packet to my own perl script to then "parse" and act upon. 1) Can anyone think of a way how freeradius might receive the packet for me and then pass it to perl for me to act on? or 2) Is anyone aware of other software that might listen on the coa port 1700/3799, receive a packet, parse it somehow and call my script to "disconnect" the client. i.e. a "disconnect server". as per http://wiki.freeradius.org/DM Thanks! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

3 8

Creation of User Accounts and Certificates
by mihir patankar 12 Jan '09

12 Jan '09

Hi, We want to know how to create EAP-TTLS User Accounts and Accounts specific Certificates in Free-Radius. As of now we have only created PAP Accounts. Mihir V Patankar

4 9

Re: Freeradius-Users Digest, Vol 45, Issue 31
by Hanno Schupp 12 Jan '09

12 Jan '09

> > > Dear All, > > > > > > > > I have a few questions regarding the rlm_sqlcounter module and its > > configuration. I have a freeradius 2.1.0 communicating with a router > running > > chillispot 1.1 I set up counters for time, data volume, and with > different > > reset periods. All works fine and as expected. > > > > > > > > Here my questions: > > > > > > > > 1) After the time or data volume for a period (say a month) is > reached > > the user is automatically disconnected – as expected. Rather them not > > allowing to log in , I would like freeradius to return some other > attributes > > (WISPr-Bandwidth-Max-Up and WISPr-Bandwidth-Max-Down work fine with > > ChilliSpot) to be sent to the router for the user, so that a connection > is > > still possible, but at a much lower maximum speed. Can that be done, and > if > > so, can someone give me a pointer. I was thinking maybe using unlang, but > I > > may be barking up the wrong tree. > > > > You might be better off making changes to your provisioning system > assuming you are using a database backend although > you might be able to get away with unlang. I know 'I might be able to get away with unlang'. I was hoping for a useful pointer as to how. I have followed this up further and have a new roadblock. I have put this code into my 'authorize' section: ... monthlytotal if (reject) { update control { Auth-Type := "Accept" } update reply { WISPr-Bandwidth-Max-Down := 256000 WISPr-Bandwidth-Max-Up := 32000 } } monthlyupload monthlydownload logintime ... Module monthlytotal is behaving as expected (definition below), throwing a reject, when the so far in the month used Octets exceed the set limit for the user. However, what appears to happen when looking through the debug (below), freeradius appears to stop processing any further modules in the authorise section. Is that what is expected? If so, can this behaviour be changed through configuration, or does this require a whole new module? ... sqlcounter monthlytotal { counter-name = Max-Monthly-Total-Octets check-name = Max-Monthly-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql02 key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } ... ... Mon Jan 12 11:49:28 2009 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Mon Jan 12 11:49:28 2009 : Debug: rlm_sqlcounter: Rejected user yubvef24, check_item=500000, counter=535178 Mon Jan 12 11:49:28 2009 : Info: ++[monthlytotal] returns reject Mon Jan 12 11:49:28 2009 : Info: Using Post-Auth-Type Reject Mon Jan 12 11:49:28 2009 : Info: +- entering group REJECT {...} Mon Jan 12 11:49:28 2009 : Debug: expand: %{User-Name} -> yubvef24 Mon Jan 12 11:49:28 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jan 12 11:49:28 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Jan 12 11:49:28 2009 : Info: Delaying reject of request 0 for 1 seconds ... > > > > > > > > 2) The reset = monthly method seem to the first of the current > > month. That is one way of doing it, but I would like the reset to occur > at > > the same date in the month every month. So if someone signs up, say on > the > > 12th of a month, the reset will occur every month on the 12th. Can that > be > > done with freeradius? > > > > > > rlm_sqlcounter only support calendar month or day or week. I am surprised to hear that, as this seems to be the standard way any ISP I came accross in this part of the world seems to define a 'month', including large internationals. If the final answer remains 'no, this cannot be done', who do I need to contact to discuss sponsoring the development of such a new feature within the module? > > > > > > 3) Currently I receive something like Reply-Message = "Your > maximum > > never usage time has been reached" when the counter reaches its limit – > > even when what was counted as not time but data volume. Can Reply-Message > > for sqlcounter be configured as in the expiration module? > > > > > > rlm_sqlcounter does not have provision for cusom reply messages. There > was a patch floating around to send custom reply messages from > rlm_sqlcounter. Probably you should look in mailing list archives. > I have done that, thanks. Neither search for 'rlm_sqlcounter' nor 'Reply-Message' yielded anything useful. > > > > > 4) One surprise I have had: I don't quite understand how the system > > calculates the day for the beginning of the reset = weekly. I appreciate > > that calculating the day of the week is not easy as for example first of > the > > current month or beginning of the day, so I was not surprised to not have > a > > Monday, but I was surprised to see the SQL query run with 'Fri Jan 09 > 2009 > > 00:00:00 GMT+1300 (New Zealand Daylight Time)' as beginning of the week, > > when running the query on a Saturday. BTW, SQL time is configured > correctly, > > and the UNIX_TIMESTAMP is giving a correct timestamp for local time. What > am > > I missing? > > (Note: When setting reset = 7d, I get something more explainable like > 'Sat > > Jan 10 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)', which is the > > beginning of the today's day. Should reset = weekly and reset =7d yield > the > > same result? If not, what is weekly vs 7d, and why does the week not > start > > on a Monday? > > > Interesting running it today, Monday, 12 January 2009 12:26:36 p.m. NZSTD, I get Tuesday, 6 January 2009 12:00:00 a.m. NZSTD as beginning of the time weekly period the system is checking. Can someone explain that logic? ---------- Forwarded message ---------- From: Eric <bbahar3(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Date: Sun, 11 Jan 2009 08:26:41 +0330 Subject: Re:freeradius doesn't sent information to mysql I had sent an instance of accounting request from my vpn server to radius server. you send me that I haven't got anything configured in the accounting section. do you mean that vpn server frame is correct but accounting section in radius server doesn't work? >rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, >length=260 > Acct-Status-Type = Start > Acct-Delay-Time = 0 > NAS-IP-Address = 10.10.10.3 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 4 > MS-RAS-Vendor = 311 > MS-RAS-Version = "MSRASV5.20" > NAS-Port-Type = Virtual > Tunnel-Type:0 = PPTP > Tunnel-Medium-Type:0 = IP > Calling-Station-Id = "192.168.201.59" > Tunnel-Client-Endpoint:0 = "192.168.201.59" > Microsoft-Attr-35 = 0x4d5352415356352e3130 > Microsoft-Attr-34 = 0x4d535241532d302d312d34304432 > 454332364243374334 > > Acct-Session-Id = "118382" > > User-Name = "school" > > Framed-IP-Address = 10.10.10.4 > > Framed-MTU = 1400 > > Session-Timeout = 389554 > > Idle-Timeout = 1200 > > Acct-Multi-Session-Id = "953" > > Acct-Link-Count = 1 > > Event-Timestamp = "Dec 31 2008 15:45:03 IRST" > > Acct-Authentic = RADIUS > > MS-MPPE-Encryption-Types = 0x00000000 > >Sending Accounting-Response of id 133 to 10.10.10.3 port 11858 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

2 2