- Freeradius-Users - lists.freeradius.org

Rlm sqlcounter -- Data Based Counter
by Marcel Grandemange 02 Dec '08

02 Dec '08

Good Day. Im wondering is someone could assist me here. I currently have freeradius setup and working somewhat. However I have following setup: sqlcounter monthlytraffic { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Mikrotik-Xmit-Limit-Gigawords sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT (sum(AcctInputOctets)+sum(AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND Month(AcctStopTime) =(Month(NOW() #query = "SELECT SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - UNIX_T #query = "SELECT SUM(AcctInputOctets + AcctOutputOctets) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'" #query = "SELECT SUM(OctetTotal) FROM thismonthsusage WHERE UsernameView='%{%k}'" } As you can see I have tried numerous queries to get this working correctly and decided finally to do my own query against a view that does my work for me. (Currently commented out because having issues with it) The view is called thismonthsusage And it's definition as follows.... select `radacct`.`UserName` AS `UsernameView`,`usergroup`.`GroupName` AS `GroupNameView`,`radacct`.`AcctStartTime` AS `AcctStartTimeView`,`radacct`.`AcctStopTime` AS `AcctStopTimeView`,`radacct`.`AcctInputOctets` AS `AcctInputOctetsView`,`radacct`.`AcctOutputOctets` AS `AcctOutputOctetsView`,(sum(`radacct`.`AcctInputOctets`) + sum(`radacct`.`AcctOutputOctets`)) AS `OctetTotal` from (`radacct` join `usergroup`) where ((month(`radacct`.`AcctStartTime`) >= month(curdate())) and (month(`radacct`.`AcctStopTime`) <= month(curdate())) and (`radacct`.`UserName` = `usergroup`.`UserName`) and (`usergroup`.`GroupName` <> _latin1'Mac')) group by `radacct`.`UserName`,`usergroup`.`GroupName`,`radacct`.`AcctStartTime`,`rada cct`.`AcctStopTime`,`radacct`.`AcctOutputOctets` order by `radacct`.`AcctStopTime` As you can see quite simply and efficient however there is one battle I am facing.. As soon as a new month rolls over there are NO accounting entries for that user for that month, hence no record and freeradius denies user as he hasn't got any entries, any body know how I should modify the view to display all users even if they don't have an entry for current month, but rather display them with value 0 as apposed to not at all?

2 1

Check on bytes used
by Saeed Akhtar 02 Dec '08

02 Dec '08

Hi all, I want to create a check on user monthly usage in (MB/GB etc.). Is there any module available to do so. yes or not what attribute will be sent to client, like session-timeout attribute gives the time in second. waiting for reply. thanks Regards, Saeed Akhtar

5 5

OT - Question about Switches
by Craig White 02 Dec '08

02 Dec '08

Sorry for the noise but this is actually related to my struggles with FreeRadius I am using FreeRadius and authenticating Windows RAS users (PPTP) Macintosh users via the same Windows RAS server using PPTP or L2TP, Macintosh WAP clients and iPhone clients without a problem. I am struggling with Windows clients both WAP and L2TP to the same Windows RAS server and I'm beginning to wonder if the problem is the switch I am using because endless google searching turned up a problem somewhere (I've forgotten which I read). I'm using a Dell PowerConnect 6248 switch which is a managed switch. Is it possible that it is interfering with some of the connections? My Windows WAP clients endlessly try to authenticate as 'anonymous' and my Windows L2TP connections don't seem to ever get to the Windows RAS server though a Macintosh using L2TP sailed right on through. I'm grasping at straws. Craig

1 0

WPA: Failed to get master session key from EAPOL state machines
by Alexandre Thieme Reis 02 Dec '08

02 Dec '08

After i upgrade my fedora core 9 (freeradius 2.02) to fedora core 10 (freeradius 2.1.1) i receive this message when i attempt to connect to freeradius server. EAPOL: EAP key not available WPA: Failed to get master session key from EAPOL state machines My configuration: Server: fedora core 10 with freeradius 2.1.1 AP: linksys wrt54g (configured to wpa2/enterprise authentication) Client: kubuntu 8.10 with wpasupplicant 0.6.4) With fedora core 9 and freeradis 2.0.2 all work fine (the configuration is the same - before upgrade fedora i make backup and after upgrade, restore) attached radiusd.tgz with the files: clients.conf eap.conf eapol_test.conf eapol_test.log radiusd.conf radiusd.log users wpa_supplicant.conf wpa_supplicant.log If configure the acces point and client to wpa2-psk and i run eapol_test with eapol_test.conf althentication succed! What is wrong? (the server configuration, the access point, the client or I)? Thanks for help! PS: Excuse my poor english.

1 0

Is FreeRADIUS 2.1.1 capable of handling NAI decorations
by Luca Adamo 02 Dec '08

02 Dec '08

Hi, I've been working and (also a little bit deploying) with FreeRADIUS 2.1.1 for a while and everything has been smooth enough. Today for the first time I step into a problem with the handling of NAI sent by the client through the NAS. The problem consists in the prensence of a WiMAX decoration inside the NAI. As stated by WiMAX Forum 1.2 Stage 3 a NAI can be composed by a Username, a realm and an optional part known as WiMAX decoration. To be more precise a valid NAI, according to WF is the following: {attribute=11}username@realm FreeRADIUS 2.1.1 seems to be unable to process the NAI decoration so the username is passed unaltered to the modules and of course there're a lot of problems arising for the presence of the curly braces and the equal sing inside the User-Name. If I hack the safe character list of Oracle (the database I chose to store user credentials and profiles) adding both the curly braces and the equal sign everything work fine but IMHO is not the solution. I tried also to use the attr_rewrite module trying to remove the unwanted prefix from the User-Name attrribute but this obviously breaks EAP (as Alan also has stated in a mail discussion I red on the Internet). Sorry if I've been too prolix, at the end my question is the one of the subject..."Is FreeRADIUS 2.1.1 capable of handling NAI decorations according to WiMaX Forum 1.2 St. 3?" And if not, can I have some suggestion on which one can be the starting point for the development of such functionality? Thank you for the cooperation, Luca Adamo LaRT - University of Florence

2 1

Re: Is FreeRADIUS 2.1.1 capable of handling NAI decorations
by A.L.M.Buxey＠lboro.ac.uk 02 Dec '08

02 Dec '08

hi, quick hack/fix would be to either 1) set 'prefix' to be } with this, anything before and including } (which may never appear as a realm or username) would be treated like a NT domain and be stripped off logically 2) use attr_rewrite or unlang to remove the {blah blah} stuff and set the output value as Stripped-User-Name (safe!) alan

1 0

problem with proxying
by Riccardo Veraldi 02 Dec '08

02 Dec '08

Hello, freeradius 1.1.3 on CentOS 5.2 I have problem with proxying. In a normal proxying configuration when the username contains a domain different from local defined one the request is proxied to the DEFAULT proxy entry. Here instead proxy does not happen and I have this warning in the logs: rlm_realm: Found DEFAULT, but skipping due to config. I do not know why this happens. to make proxy happen I have to force it on users file DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT EAP-Type == EAP-TTLS, Proxy-To-Realm := DEFAULT but after the proxying, the authentication always fails with login incorrect, and this is really misterious. thank you Rick

2 1

Freeradius 2.1.1 - locked processes
by George Chelidze 02 Dec '08

02 Dec '08

Hello, I have recently install freeradius 2.1.1 on our old RHEL (Red Hat Enterprise Linux ES release 4 (Nahant Update 2), libc-2.3.4) server which already runs multiple radiator instances. The last time I started freeradius was Friday. Since then there are 66 freeradius processes, among them 65 are locked: # strace -p 7833 Process 7833 attached - interrupt to quit futex(0x263ecc, FUTEX_WAIT, 2, NULL I have googled the issue and investigated the gdb backtrace, however the only idea I have right now is to upgrade a system to more recent one (I know, running outdated system is stupid idea, however why we still run it is a long story). As it's not an easy task, I'd like to be sure that the reason is old libraries or stuff like that. I have attached a gdb backtrace, ldd output, freeradius configuration. I am ready to debug a system further and provide more information, if this isn't enough. Any help is appreciated. Thanks in advace George Chelidze # /usr/local/freeradius/etc/raddb/sites-enabled/default preacct { fillrealm acct_unique } accounting { sql billing detail } # /usr/local/freeradius/etc/raddb/modules/acct_unique acct_unique { key = "Calling-Station-Id, Acct-Session-Id, 3GPP2-Correlation-Id" } # /usr/local/freeradius/etc/raddb/modules/detail detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } # /usr/local/freeradius/etc/raddb/modules/exec exec billing { wait = no program = "/usr/local/freeradius/scripts/billing.pl" input_pairs = request } # /usr/local/freeradius/etc/raddb/modules/realm realm fillrealm { format = suffix delimiter = "@" } # /usr/local/freeradius/etc/raddb/radiusd.conf ... thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE sql.conf } $INCLUDE sites-enabled/ # /usr/local/freeradius/scripts/billing.pl #!/usr/bin/perl use strict; use POSIX ':sys_wait_h'; require '/usr/local/freeradius/scripts/inc/common.pm'; require '/usr/local/freeradius/scripts/inc/mysql.pm'; require '/usr/local/freeradius/scripts/inc/tibrv.pm'; my $pid = fork(); unless (defined $pid) { common::log("Error: top level fork() failed: $!"); exit(1); } # exit in parent, become child of init exit(0) if ($pid); # 2nd level fork in child $pid = fork(); unless (defined $pid) { common::log("Error: 2nd level fork() failed: $!"); exit(1); } if ($pid > 0) { # wait for child exit code waitpid($pid, 0); exit(0); } # do the main job in 2nd level child ... #0 0x0087a7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x002103ce in __lll_mutex_lock_wait () from /lib/tls/libc.so.6 #2 0x001b89c9 in _L_mutex_lock_1945 () from /lib/tls/libc.so.6 #3 0xb75f4c32 in ?? () #4 0xb75f4718 in ?? () #5 0x009017e9 in fr_hash_table_finddata (ht=0xfffffffc, data=0x261ff4) at hash.c:491 #6 0x001b69dd in localtime_r () from /lib/tls/libc.so.6 #7 0x00904647 in vp_prints_value (out=0xb75f4c30 "", outlen=1008, vp=0x2103ce, delimitst=1) at print.c:267 #8 0x08053a28 in radius_exec_program (cmd=0x8dcae28 "/usr/local/freeradius/scripts/billing.pl", request=0xb4c00768, exec_wait=0, user_msg=0x0, msg_len=0, input_pairs=0xb4a03220, output_pairs=0x0, shell_escape=1) at exec.c:330 #9 0x003dae26 in exec_dispatch (instance=0x8dcae00, request=0xb4c00768) at rlm_exec.c:315 #10 0x0805bb8c in modcall (component=3, c=0xfffffffc, request=0xb4c00768) at modcall.c:285 #11 0x0805a91b in indexed_modcall (comp=3, idx=0, request=0xb4c00768) at modules.c:541 #12 0x0805b6b0 in module_accounting (acct_type=0, request=0xb4c00768) at modules.c:1221 #13 0x0804dda7 in rad_accounting (request=0xb4c00768) at acct.c:93 #14 0x08065f1f in radius_handle_request (request=0xb4c00768, fun=0x804dd0c <rad_accounting>) at event.c:3027 #15 0x0805fc3a in request_handler_thread (arg=0x8dd9060) at threads.c:490 #16 0x00a01341 in start_thread () from /lib/tls/libpthread.so.0 #17 0x002036fe in clone () from /lib/tls/libc.so.6 # ldd /usr/local/freeradius/sbin/radiusd libfreeradius-radius-2.1.1.so => /usr/local/freeradius/lib/libfreeradius-radius-2.1.1.so (0x00ae6000) libnsl.so.1 => /lib/libnsl.so.1 (0x00845000) libresolv.so.2 => /lib/libresolv.so.2 (0x00709000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x009fc000) libreadline.so.4 => /usr/lib/libreadline.so.4 (0x00111000) libtermcap.so.2 => /lib/libtermcap.so.2 (0x009ea000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00c19000) libltdl.so.3 => /usr/lib/libltdl.so.3 (0x00a10000) libdl.so.2 => /lib/libdl.so.2 (0x009bf000) libssl.so.4 => /lib/libssl.so.4 (0x005d2000) libcrypto.so.4 => /lib/libcrypto.so.4 (0x0061e000) libc.so.6 => /lib/tls/libc.so.6 (0x00893000) /lib/ld-linux.so.2 (0x0087a000) libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00608000) libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00730000) libcom_err.so.2 => /lib/libcom_err.so.2 (0x00dea000) libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x05eca000) libz.so.1 => /usr/lib/libz.so.1 (0x0071e000)

2 6

Authenticate against Active Directory
by Bashir Jahed 02 Dec '08

02 Dec '08

Hi, I am running Centos 5.2 with freeradius-2.1.1. Currently authenticating against mysql, what would be the best way to add active directory as an additional authentication source? A guide or how to would be great...

2 1

vlan assign - 3com guest vlan
by empirium 02 Dec '08

02 Dec '08

I would like to dynamic assign vlan to switch 3com , and i would like to mac based authentication. In 3com terminology it is called RADA. Every works fine, freeradius dynamically assign vlan for mac adresses includes in users.conf, But how to configure freeradius to work in this scenario: - freeradius check if it has proper mac addres in its users.conf, if it has it assign the proper vlan (it works !) - if it doesnt find a mac in a file it assign vlan for examle 15 (I dont know how to configure that in freeradius) in users.conf I have something: 00-0d-61-1b-6f-15 User-Password == "00-0d-61-1b-6f-15" Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id := 101, Tunnel-Type = VLAN Please help Thanks in advance

3 3