- Freeradius-Users - lists.freeradius.org

Freeradius Billing Account Management
by Pratchaya Chatuphian 06 Oct '07

06 Oct '07

Billing Account Management ======================= I 've successful about installation freeradius + mysql + dd-wrt ( using chillispot ). Now, i need you help. Would you like to suggestion me about "Hotspot Billing Account Management" ? that can provide postpaid/prepaid and register/sign up new user and can be refill internet time . Anybody have experience about this ? Thank you very much Best Regards., PT Ps. have it a opensource ?

1 0

freeradius error genrate CA.all certificate
by satish patel 06 Oct '07

06 Oct '07

Dear all I have installed openssl in /usr/local/openssl and installed radius with openssl support now what i going to genrate CA.all i got this error Certificate is to be certified until Oct 5 05:47:00 2008 GMT (365 days) Sign the certificate? [y/n]:y failed to update database TXT_DB error number 2 + openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out cert-srv.p12 -clcerts -passin pass:whatever -passout pass:whatever No certificate matches private key + openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin pass:whatever -passout pass:whatever 5829:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:140: + openssl x509 -inform PEM -outform DER -in cert-srv.pem -out cert-srv.der unable to load certificate 5830:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:642:Expecting: TRUSTED CERTIFICATE + echo -e '\n\t\t##################\n' $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Get the freedom to save as many mails as you wish. Click here to know how.

1 0

Re: Supplicant seems not to send password user (IT WORKED!!!)
by Sergio Belkin 05 Oct '07

05 Oct '07

2007/10/3, Alan DeKok <aland(a)deployingradius.com>: > Sergio Belkin wrote: > > Is 2.0.0-pre2 reliable for production usage? > > You *can* use the certificates it creates in 1.1.7. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > Well, finally I fixed the problem, issuing "real" certificates and importing cacert.pem in Windows. I used ttls. By other hand, I used DEFAULT Ldap-UserDN := `uid=%{User-Name},ou=people,dc=company,dc=com` in users file because I need to use LDAP and RADIUS *only* for authentication and authorization for a wireless network. Thanks everybody for your support! -- -- Sergio Belkin -

3 2

psql problem
by Budi Wibowo 05 Oct '07

05 Oct '07

dear all i have this problem on my freeradius ..and this make some field cant be inserted to db need advice for the proper configuration rlm_sql (sql): Reserving sql socket id: 21 rlm_sql_postgresql: query: UPDATE radacct ??SET AcctStopTime = ('2007-10-05 17:19:13'::timestamp - '0'::interval), ??AcctSessionTime = NULLIF('0', '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctTerminateCause = '3', AcctStopDelay = '0', ??FramedIPAddress = NULLIF('', '')::inet, ConnectInfo_stop = '', ??acctstatus = 'Stop', ??clientip = '2xxxxx.1', ??h323remoteaddress = '' ??WHERE AcctSessionId = 'a3e2e56a-e0f4b-b45ed37fT1' AND UserName = '203.130.218.1' ??AND NASIPAddress = '202.147.19.66' AND AcctStopTime IS NULL rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql_postgresql: query: UPDATE radacct ??SET AcctStopTime = ('2007-10-05 17:19:13'::timestamp - '0'::interval), ??AcctSessionTime = NULLIF('0', '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctTerminateCause = '3', AcctStopDelay = '0', ??FramedIPAddress = NULLIF('', '')::inet, ConnectInfo_stop = '', ??acctstatus = 'Stop', ??clientip = '2tttt.1', ??h323remoteaddress = '' ??WHERE AcctSessionId = 'a3e2e56a-e0f4b-b45ed37fT1' AND UserName = 'tttttt' ??AND NASIPAddress = ' 2tttt.66' AND AcctStopTime IS NULL rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't update SQL accounting STOP record - ERROR: invalid input syntax for type inet: "" rlm_sql (sql): Released sql socket id: 21 regards budi

2 1

Re: Freeradius-Users Digest, Vol 30, Issue 24
by wlan＠mac.com 05 Oct '07

05 Oct '07

> [...] > <sigh> You started asking questions on the FreeRADIUS list. Rather > than updating the FreeRADIUS Wiki, you've gone somewhere else. Nice. > Sorry about that. I intended to put it in the freeradius wiki (and still will, if desired), but thought it was too off-topic after all - the site otherwise being rather vendor agnostic. No disrespect intended... >> I took a perhaps less hostile classification than 'broken' - and >> labeled >> them as having a "AC" or "Client" perspective. > > Perhaps "non RFC compliant" would be a politer choice of words. > Indeed... >> Of course, the Access >> Controller/NAS is the right meaning as defined in this forum. > > Perhaps you haven't been reading my messages. This forum is NOT > defining anything. The definitions existed for years before > FreeRADIUS > existed. Stop trying to claim it's a disagreement between vendors. > It's not. > Of course, sorry 'bout that. What I meant was more like "as acknowledged as fact in this thread"... > The default should be the correct meaning. The documentation should > have big bold warnings that vendors doing it the other way are > non-compliant. > Yes. This is another reason why I ended up documenting this elsewhere -- where I can link it into the more relevant documentation - just as you suggest - acknowledging and high-lighting the non-compliance. >> Huh, I wonder if there was something originally 'lost in translation' > > The original RFC's were written the the designers and > implementors of > RADIUS, in Ann Arbour, Michigan, USA. They might be poorly > phrased, but > there is no confusion. > >> with how this got implemented. With some Googling, I came across: >> >> http://www.gsmworld.com/documents/wlan/ir61.pdf >> >> Which states for Acct-Input-Octets: "Volume of the downstream >> traffic of >> the User" and Output-Octets with "upstream traffic of the user". That >> sounds rather Client centric -- it's not to / from the User, for >> instance. Are we expecting too much from the (off-shore) out-sourcing >> companies? :) > > Apparently people implementing NAS equipment can't be bothered to > read > the spec, or to ask questions if they don't understand it, or to see > what the large vendors do. It would be interesting to know the history of this all. One vendor probably got it wrong and others followed the (wrong) vendor. Perhaps the lesson here is that if you follow a vendor, make it Cisco :) David

1 0

FreeRadius + ntlm_auth + blank character in the NT group name
by charles＠copel.com 05 Oct '07

05 Oct '07

Hi: I need to Configure my FreeRadius to authenticate NT users in a determinate NT Group that has a "blank character" in the name. My NT Group name is "COPEL\Acesso Remoto". When I execute the "ntlm_auth" program in the command line: it works. The command line is below: [root@FreeRADIUS /usr/local/etc/raddb]# ntlm_auth --require-membership-of='COPEL\Acesso Remoto' --request-nt-key --domain=COPEL --username=radius --password=radius NT_STATUS_OK: Success (0x0) [root@FreeRADIUS /usr/local/etc/raddb]# When I configure the "ntlm_auth" program in the radiusd.conf, my FreeRadius show the followings messages: ... auth: type "win_domain" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 radius_xlat: '--username=radius' radius_xlat: '--password=radius' [2007/10/05 09:10:42, 0] utils/ntlm_auth.c:get_require_membership_sid(237) Winbindd lookupname failed to resolve 'COPEL\Acesso Remoto' into a SID! Exec-Program output: Exec-Program: returned: 1 rlm_exec (win_domain): External script failed modcall[authenticate]: module "win_domain" returns fail for request 0 modcall: leaving group authenticate (returns fail) for request 0 auth: Failed to validate the user. Login incorrect: [radius/radius] (from client cerberus2 port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 239 to 10.4.3.248 port 32795 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 239 with timestamp 470629c2 Nothing to do. Sleeping until we see a request. My FreeRadius don´t get to find the NT group. It sounds like problem when FreeRadius find the "blank character" in the name of group. My environment is: FreeBSD 6.2 + Samba 3.0.24 + freeradius 1.1.6 Any Idea ? Best Regards, Charles.

1 0

Special Charactors in Username
by Kartik 05 Oct '07

05 Oct '07

I have my own radius client, communicting with a SBR radius server. The user name i send for authentication has special charactors - kärtïk The Hex dump in the access-request packet for the name is 6B C3 A4 72 74 C3 AF 6B [Attaching the snapshot of the dump]. Is it the correct format in which the name has to go? Bcos, even though it is in correct UTF-8 format, the server rejects it saying invalid username. http://www.nabble.com/file/p13054115/Dump.jpeg Dump.jpeg Now my question is, is my Dump correct ? Is there any restriction in sending non-ascii charactors ? If at all there is no restriction, then is there a special way of communicating the non-ascii charactors to the radius server. -- View this message in context: http://www.nabble.com/Special-Charactors-in-Username-tf4573354.html#a130541… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Re: in vs. out
by wlan＠mac.com 05 Oct '07

05 Oct '07

> > Acct-Input-Octets has one meaning: the right one. > > You don't have to interoperate with broken vendors. You tell > users to > throw the equipment away, and to buy working equipment. For some, that is not very economical - nor environmentally friendly :) I started the list; sorry, I couldn't help myself and started it here: http://coova.org/wiki/index.php/Template:NASVendorAccountingTable I took a perhaps less hostile classification than 'broken' - and labeled them as having a "AC" or "Client" perspective. Of course, the Access Controller/NAS is the right meaning as defined in this forum. As you can see, there is a bit of an issue. In a Gemtek manual, they mention the problem - explaining the Client and AC point's of view, but still ultimately defaults to the Client perspective with an option to reverse. As for coova-chilli, I actually (yes, I'm ready for the public ass-kicking) changed the accounting to be like that of Gemtek - with the option to toggle. At the time, my objective was purely compatibility with back-ends already built for some of the vendors in this list. If anyone has better information, which is highly likely, please do make changes. Huh, I wonder if there was something originally 'lost in translation' with how this got implemented. With some Googling, I came across: http://www.gsmworld.com/documents/wlan/ir61.pdf Which states for Acct-Input-Octets: "Volume of the downstream traffic of the User" and Output-Octets with "upstream traffic of the user". That sounds rather Client centric -- it's not to / from the User, for instance. Are we expecting too much from the (off-shore) out-sourcing companies? :) David

2 1

Slipstream dictionary
by Scott Lambert 05 Oct '07

05 Oct '07

I don't know if this is something that would be wanted in the freeradius source. I created a dictionary.slipstream for my dialup accelerator users based on slipstream_sp_6.0_installation_and_configuration_guide.pdf from slipstream's portal. It is extremely simple, and defines one VSA. -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

2 1

Change Password Request to FreeRADIUS from PAM RADIUS.
by Sridhar B 05 Oct '07

05 Oct '07

Greetings, Does the password change request from PAM RADIUS work with FreeRADIUS server? It doesn't seem like, as I see the following log at the RADIUS server: "Deprecated password change request from client copyia:8789 - ID 32 : IGNORED" Can someone provide inputs on why this is deprecated. Thanks in advance for you inputs. Best Regards, Bandi

3 2