- Freeradius-Users - lists.freeradius.org

Can i modify radius property?
by yangcuilin 17 Nov '07

17 Nov '07

Hi, brothers Can administrator configure a value to a user (call him Jim) in FreeRadius. Jim will get the value when he assesses FreeRadius, and in the same time, Jim can modify it. For example: 1. Administrator configured (just store) two value (named 'lastChangePwdDate' and 'pwdExpiryDuration') to the user 'Jim'. 2. When Jim access FreeRadius, he can get the value of 'lastChangePwdDate' and 'pwdExpiryDuration'. 3. Jim modify one value (if Jim change his pwd, he will change the value of 'lastChangePwdDate') and save to FreeRadius. Notes: I just want to implements the change password function in FreeRadius. Could any one have the same requirement? Please tell me your advice or solutions. Thank you in advance. Rock

2 1

Radrelay Locking Issues
by Brian De Wolf 17 Nov '07

17 Nov '07

Hello, I'm using freeradius 1.1.7 on a RHEL4 (built by pkgsrc, though) amd64 box as a logger/relay for accounting packets. Unfortunately, it looks like it's not relaying all the accounting packets it receives, since lines such as these appear in its logs: Fri Nov 16 17:12:31 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:12:44 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:12:47 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:12:56 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:13:01 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:13:27 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:13:45 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate2.log, giving up Fri Nov 16 17:15:00 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate2.log, giving up Fri Nov 16 17:15:00 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Fri Nov 16 17:15:03 2007 : Error: rlm_detail: Failed to aquire filelock for /var/log/radiusd/replicate1.log, giving up Currently I'm trying to replicate the accounting logs to two separate servers using two separate files and two separate instances of radrelay, but as you can see, I appear to be losing some packets. While a majority of the accounting is passing, I'd much prefer all of it to pass. It's logged on the box, but other devices need to use the accounting packets as well. Are there any obvious fixes to resolve the locking contention that appears between radrelay and rlm_detail that causes rlm_detail to give up on logging? I may have missed something, finding radrelay itself was a journey (it's not in the wiki or on the site anywhere and the source distribution's doc/radrelay is pretty old). /var on the box is an ext3 partition, if that makes any difference. Thanks! Brian De Wolf

1 0

1.17 compilation errors
by Paul Bartell 17 Nov '07

17 Nov '07

Hello. when trying to compile freeradius under ubuntu 7.10, i get the following error: gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/paulb/build/freeradius-1.1.7/src/include -I/home/paulb/build/freeradius-1.1.7/src/modules/rlm_sql -c rlm_sqlippool.c -fPIC -DPIC -o .libs/rlm_sqlippool.o In file included from rlm_sqlippool.c:37: /home/paulb/build/freeradius-1.1.7/src/include/modpriv.h:7:18: error: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:37: /home/paulb/build/freeradius-1.1.7/src/include/modpriv.h:16: error: expected specifier-qualifier-list before 'lt_dlhandle' In file included from rlm_sqlippool.c:39: /home/paulb/build/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:15:18: error: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:39: /home/paulb/build/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:68: error: expected specifier-qualifier-list before 'lt_dlhandle' rlm_sqlippool.c: In function 'sqlippool_command': rlm_sqlippool.c:311: error: 'SQL_INST' has no member named 'module' rlm_sqlippool.c: In function 'sqlippool_query1': rlm_sqlippool.c:358: error: 'SQL_INST' has no member named 'module' rlm_sqlippool.c: In function 'sqlippool_postauth': rlm_sqlippool.c:539: warning: pointer targets in passing argument 2 of 'strNcpy' differ in signedness rlm_sqlippool.c:526: warning: unused variable 'self' make[6]: *** [rlm_sqlippool.lo] Error 1 make[6]: Leaving directory `/home/paulb/build/freeradius-1.1.7/src/modules/rlm_sqlippool' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/paulb/build/freeradius-1.1.7/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/paulb/build/freeradius-1.1.7/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/paulb/build/freeradius-1.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/paulb/build/freeradius-1.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/paulb/build/freeradius-1.1.7' make: *** [all] Error 2 I simply have no idea what it is referring to, and what i can do to fix it. Sorry if it seems a bit noobtistic, i haven't ever compiled something this complex. Thanks, Paul -- "If you are savvy and smart about the choices you make in life, The sky is not the limit!" Mark Shuttleworth Random quote of the week/month/whenever i get to updating it: "This is an incline plane. You roll stuff down it." Or is it one of those "incline planes have been used throughout the millenia, from the Egyptian pyramids to this stupid science class" videos?" - Jasmine Lee

2 2

Mikrotik and PPPoE queue prioirties
by Matthew Neumark 17 Nov '07

17 Nov '07

Hello, I use PPPoE connections through freeradius and mikrotik. What I would like to do is setup the customer's dynamic queue that is setup through the radgroupreply table setup so that when the customers log in I can also assign that queue to a priority based upon the group the customer is put in. Is this possible and how? Matt

2 3

DH and random
by stefek143 16 Nov '07

16 Nov '07

Hi. When i've configured my freeradius i've seen 2 metods to create files DH and random: first: DH: openssl dhparam -check -text -5 512 -out dh Random: dd if=/dev/urandom of=random count=2 second: DH: date >/etc/1x/DH Random date > /etc/1x/random And I wondering what is different in theory and practice? my freeradius is acting, but i wanna understand for what i need this two file and is it never mind when i use instead of first, second method. THX for answers

1 0

variables in 1.1.7
by Norbert Wegener 16 Nov '07

16 Nov '07

With version 1.1.7 I want to achieve the following, which is probably easy in 2.0: In the authorize section I have an ldap module and an sql module sp1. group { ldap1 sp1 } I want to get an attribute from AD and use the value of that attribute in a later call to a database radiusd -AX shows: rlm_ldap: looking for check items in directory... rlm_ldap: Adding mobile as Huntgroup-Name == "VL-SBS-AD02-0001" rlm_ldap: looking for reply items in directory... rlm_ldap: user host/28tef003.ww006.company.net authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 radius_xlat: 'host/28tef003.ww006.company.net' rlm_sql (sp1): sql_set_user escaped user --> 'host/28tef003.ww006.company.net' radius_xlat: 'call firstif ('0','host/28tef003.ww006.company.net','', '1.2.3.4','=','2')' Retrieving an attribute from AD obviously works. In sql.conf I have changed authorize_check_query to use a stored procedure: sql.conf: authorize_check_query = "call firstif ('0','%{SQL-User-Name}','%{Huntgroup-Name}', '%{NAS-IP-Address}','=','2')" I would have expected the %{Huntgroup-Name} to be "VL-SBS-AD02-0001", but this is not true. Is the desired assignment possible at all in 1.1.7 ? Norbert Wegener

2 1

Any ideas on this compile error ??
by Willem Gerber 16 Nov '07

16 Nov '07

Hey Guys I cant get radius to compile :/ Linux vaughan 2.6.20-1.2307.fc5 #1 Sun Mar 18 20:44:48 EDT 2007 i686 i686 i386 GNU/Linux /home/willem/freeradius-1.1.7/src/include/modpriv.h:7:18: error: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:37: /home/willem/freeradius-1.1.7/src/include/modpriv.h:16: error: expected specifier-qualifier-list before 'lt_dlhandle' In file included from rlm_sqlippool.c:39: /home/willem/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:15:18: error: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:39: /home/willem/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:68: error: expected specifier-qualifier-list before 'lt_dlhandle' rlm_sqlippool.c: In function 'sqlippool_command': rlm_sqlippool.c:311: error: 'SQL_INST' has no member named 'module' rlm_sqlippool.c: In function 'sqlippool_query1': rlm_sqlippool.c:358: error: 'SQL_INST' has no member named 'module' rlm_sqlippool.c: In function 'sqlippool_postauth': rlm_sqlippool.c:539: warning: pointer targets in passing argument 2 of 'strNcpy' differ in signedness rlm_sqlippool.c:526: warning: unused variable 'self' gmake[6]: *** [rlm_sqlippool.lo] Error 1 gmake[6]: Leaving directory `/home/willem/freeradius-1.1.7/src/modules/rlm_sqlippool' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/willem/freeradius-1.1.7/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/home/willem/freeradius-1.1.7/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/willem/freeradius-1.1.7/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/willem/freeradius-1.1.7/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/willem/freeradius-1.1.7' make: *** [all] Error 2 -- "The casing said 'Windows XP or better'... so I installed Linux" -- Anonymous

3 2

Re: freeradius auto-vlan 3com switch 4500G
by pbreton 16 Nov '07

16 Nov '07

Hi Krzysztof, Thanks for sharing your experience. >Please add here: > vlan-assignment-mode string > accounting optional An 3Com product engineer gave me the same instruction, unfortunqtly the 4500G does not support the vlan-assignment-mode and accounting does not take optional as argument. Maybe it shoud. The 4500G is new, and like many new product it must go thru a real world user trial phase to uncover birth defects. This said 3com is going to replace my 4500G with a 5500G at no cost. And this is a solution to my problem -which is not a freeradius one anymore. Thanks again, enjoy the day, Philippe. ----- Original Message ----- From: Krzysztof Olędzki <krzysztof.oledzki(a)axelspringer.pl> To: pbreton(a)wustl.edu Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: freeradius auto-vlan 3com switch 4500G Date: Fri, 16 Nov 2007 00:10:23 +0100 >On 2007-11-11 18:27, Philippe Breton wrote: >> On Sun, 2007-11-11 at 17:37 +0100, Krzysztof Olędzki >>> wrote: On 2007-11-10 17:30, Philippe Breton wrote: >>>>> Did you setup your switch properly: >>>>> >>>>> domain (...) >>>>> vlan-assignment-mode string >>>> Hard to give a 100% answer on this question. I believe >>>> I did with the help of 3com support. >>> This is the most important part. Please make sure it is >>> set up (display current-configuration). >> >> ... I agree with you. The 4500G is new to me. I believe I >> got it right. One important fact to keep in mind is the >> semantic is a litle different between the 5500g and 4500G >> , i.e. what's in this doc does not apply in the 4500G >> >http://www.3com.hu/download/switch_radius_setup.doc/switch_radius_setup.doc >> >> This is my current config: > >Please excuse me for the long delay. A day should be longer >than 24h. ;) > >> description VLAN181 >> # >> radius scheme system >> server-type extended >> primary authentication 127.0.0.1 1645 >> primary accounting 127.0.0.1 1646 >> user-name-format without-domain > >> radius scheme radius1 >> server-type standard >> primary authentication 192.168.181.18 >> key authentication sdfsdfsfsf >> user-name-format without-domain >> # >> domain system >> access-limit disable >> state active >> idle-cut disable >> self-service-url disable > > >> domain wustl.edu >> authentication default radius-scheme radius1 >> access-limit disable >> state active >> idle-cut disable >> self-service-url disable > >Please add here: > vlan-assignment-mode string > accounting optional > >It is required for 3c5500G, so it should also solve the >problem on 3c4500G. If not, please enable >radius/mac-authentication/port-security debugging on the >switch. > >Best regards, > > Krzysztof Olędzki >-- >Krzysztof Olędzki >Axel Springer Polska Sp. z o.o. >tel: +48-22-2320969 >fax: +48-22-2325530

1 0

Problems With Radwho
by Willem Gerber 16 Nov '07

16 Nov '07

Hi Guys/Gals I have problem where radwho only shows users logged in for two nas'es. Aswell as only their accounting info goes into the radacct table. I can see the other users authenticating and i can log into them. So they must be dailing up.... No idea why its happening. Im using radiusd: FreeRADIUS Version 1.1.7, for host i686-pc-linux-gnu, built on Oct 10 2007 at 08:13:06 Regards Willem Gerber -- "The casing said 'Windows XP or better'... so I installed Linux" -- Anonymous

2 4

running freeradius with xinetd....?
by obi-wan 16 Nov '07

16 Nov '07

i have taken delivery of a RHEL server with FreeRadius installed and running from XINETD. _the radius sever is not performing as expected and spews the following ERROR to the log file; " There appears to be another RADIUS server running on the authentication port 1645 " when i attempt to dial and log in. the /etc/xinetd.d/radius file # default: off # description: radius server service radius { protocol = udp wait = yes user = root server = /usr/local/sbin/radiusd server_args = -y -z log_on_success += USERID log_on_failure += USERID disable = yes } when i run the "radiusd" daemon in stand alone mode from the command line the Radius server performs as advertised. _i'm i missing some settings or maybe "radiusd" can't be run from xinetd.? hardware: HP proliant DL320 FreeRadius version 1.1.6 for host i686-pc-linux-gnu RHEL 4u2 any and all suggestions will be appreciated.........thanks to the opensource community. obi-wan

2 1