- Freeradius-Users - lists.freeradius.org

How to configure MNID as a reply-item
by j v 14 Sep '07

14 Sep '07

Hi, We need to configure MNID as a string in the CallBack-Id attribute for Access-Accept message. Can you tell me the procedure. Regards, Jatin......... --------------------------------- Why delete messages? Unlimited storage is just a click away.

1 0

radsniff bug in 2.0.0-pre2?
by Geoffroy Arnoud 14 Sep '07

14 Sep '07

Hi all, I am testing radsniff, and I have the following behaviour: When launching radsniff with the following input, the program crashes (FreeRADIUS v2.0.0-pre2) [root@host bin]# ./radsniff -f udp Device: [eth0] PCAP filter: [udp] RADIUS secret: [testing123] *** glibc detected *** free(): invalid pointer: 0x08120dbc *** Aborted It seems that radsniff crashes when it tries to decode packets that are not RADIUS ones (dns requests for example). If the filter is very restrictive and matches only used RADIUS ports, it works fine. I just have a problem with a RADIUS request used by my RADIUS load balancer to test my servers status (server version 1.1.3). The request used is a Status-Server request. The content of the request is the following : [root@rafale ~]# tcpdump -X udp and host 10.67.106.3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 06:36:26.078778 IP 10.67.106.3.57084 > rafale.50812: UDP, length 26 0x0000: 4500 0036 0000 0000 ff11 d32b 0a43 6a03 E..6.......+.Cj. 0x0010: 0a43 6a02 defc c67c 0022 7932 0c01 001a .Cj....|."y2.... 0x0020: 0fc2 4720 8f36 9096 d8b9 f507 de5d 811d ..G..6.......].. 0x0030: 0406 0aa2 39c3 ....9. 06:36:26.079186 IP rafale.50812 > 10.67.106.3.57084: UDP, length 49 0x0000: 4500 004d 0000 4000 4011 5215 0a43 6a02 E..M..@.@.R..Cj. 0x0010: 0a43 6a03 c67c defc 0039 e8d5 0201 0031 .Cj..|...9.....1 0x0020: 8605 feab 8157 42de 0bad 532a c113 9148 .....WB...S*...H 0x0030: 121d 4672 6565 5241 4449 5553 2075 7020 ..FreeRADIUS.up. 0x0040: 3020 6461 7973 2c20 3232 3a34 34 0.days,.22:44 With this issue, to make radsniff work, I have to exclude my load-balancer source IP address from the CAP filter : "udp port 1812 or 1813 or 1814 and host not IP_SRC_LB" (my load-balancer performs NAT of the server, so I still see the packets from my clients) Furthermore, would the community be interested in having the date of the packet (in the same format as in radius.log) and the packet id? I think the patch is not much to do. _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 2

Configure hints in mysql
by Danilo Telebakovic 14 Sep '07

14 Sep '07

Hello, I'm using freeradius 1.1.5, which came bundled with Fedora 7. All users are kept in mysql database. I have to configure this so users can login with username (i.e. "service") and receive standard set of reply items based on group membership, and with username.local (i.e. "service.local") and receive different set of reply attributes. I tried this with hints and users files and it worked exactly as needed. This is excerpt from config files: hints DEFAULT Suffix == ".local", Strip-User-Name = Yes Hint = "LOCAL", Service-Type = Framed-User, Framed-Protocol = PPP users service Cleartext-Password := "password" Service-Type = Framed-User, Framed-Protocol = PPP, Rate-Limit = "256k/256k", Fall-Through = Yes DEFAULT Hint == "LOCAL" Rate-Limit := "2048k/2048k" Now I'm having troubles moving those settings into database. Here is some data from tables: radcheck +----+----------+--------------+----+------------+ | id | UserName | Attribute | op | Value | +----+----------+--------------+----+------------+ | 1 | service | Password | := | password | +----+----------+--------------+----+------------+ usergroup +----+----------+-----------+ | id | UserName | GroupName | +----+----------+-----------+ | 1 | service | wl256 | +----+----------+-----------+ radgroupreply +----+-----------+-----------------+----+-------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------------+ | 1 | wl256 | Service-Type | := | Framed-User | | 2 | wl256 | Framed-Protocol | := | PPP | | 3 | wl256 | Rate-Limit | := | 256k | +----+-----------+-----------------+----+-------------+ What to put where to have same functionality as with files? I tried different combinations with attribute Hint and group DEFAULT in radgroupreply and radreply but without success. Thanks in advance Danilo Telebakovic prijedor.com Internet

1 0

Possible bug in !* operator handling?
by Marcel De Boer 13 Sep '07

13 Sep '07

Hi! Today I noticed some strange problems on a number of RADIUS users in a test setup: I have a number of users in MySQL that contain a large number of attributes that should not occur in the Access-Request (i.e. attributes with the !* operator). When I tried to authenticate these users, I noticed that in some cases users were getting authenticated while they should have been rejected. Some investigation later, it turned out that after the first row in the radcheck table that contains a !* operator, all further attributes get ignored... I crawled through the code a bit more, and the problem appears to occur on line 287 of main/valuepair.c. This is in the function paircmp, which iterates over the list of check items to verify whether the incoming request matches: /* * Not found, it's not a match. */ if (auth_item == NULL) { /* * Didn't find it. If we were *trying* * to not find it, then we succeeded. */ if (check_item->operator == T_OP_CMP_FALSE) return 0; else return -1; } The 'return 0;' above causes paircmp to exit successfully (accepting the user) if it could not find the attribute and it should not find the attribute (because of the !* operator) instead of continuing to see if the rest of the attributes is correct too. I've changed the 'return 0;' to a 'continue;', so it does not break the for loop anymore. This appears to work, is this fix correct or would this introduce problems elsewhere? Gtnx Marcel

1 1

Multiple postgresql servers with radius
by Jigar Dani 13 Sep '07

13 Sep '07

Hello, I am currently using free radius to insert radius records in a postgresql database. I need to write the same records, simultaneously to two databases, both postgresql. In postgresql.conf I have defined the database server, the database, the access information and the table to use. How do I change both radius.conf and postgresql.conf to write to two databases simultaneously. I am very new to radius/databases. Thanks & Regards, Jigar

3 2

Error while building
by Sujatha Pelluru 13 Sep '07

13 Sep '07

Hi, I am getting the following error when i am tring to build the rpm files for the freeradius-1.1.7 Error is as below: error: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf RPM build errors: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf When I am trying to build using rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec, the above error is encountered. Can u please tell me the solution for this. Then I tried with the procedure ./configure , make and make install. But at that time when I am bringing up the deamon server using radiud -x , the output seen is like "command not found" Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

RE : LOGs of eap-tls authentication
by anoop_c＠sifycorp.com 13 Sep '07

13 Sep '07

hi I am not able to start server by service radiusd restart command/. I used to start by simply typing radiusd command Pls anyone no the command to stop the server Regards Anoop > > ------------------------------ > > Message: 6 > Date: Thu, 13 Sep 2007 10:01:53 +0200 (CEST) > From: HBA BOX <hba_box(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <132413.84624.qm(a)web27406.mail.ukl.yahoo.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > hello, > > To restart the radius I knew only one command which is service radiusd > restart;all what you have to do when you are in debuce mode is stoping > it by using service radiusd stop, then you can restart it . I hope that > this can help you. > > regards > habiba > > anoop_c(a)sifycorp.com a ?crit : > > Dear Thanks for the information.I am getting the logs when > stopped server in debug mode. But the commands service radiusd stop and > service radiusd restart is not working.So i killed the process radiusd > using kill command.Pls let me know the commands to stop and start the > server in normal mode. Regards Anoop > > Message: 2 > > Date: Tue, 11 Sep 2007 10:39:38 +0200 (CEST) > From: inelec > communication > Subject: RE : LOGs of eap-tls authentication (inelec > communication) > To: FreeRadius users mailing list > > Message-ID: > <980737.95433.qm(a)web26005.mail.ukl.yahoo.com> > Content-Type: > text/plain; charset=\"iso-8859-1\" > > Hello, > > you have no > logs in your radius.log file because you are running in > debug mode , > you have to run in normal mode to get the logs, so what you > have to > do is the following: > first stop your debug mode by this command: > service radiusd stop; then > restart the service radius by: service > radiusd > restart; doing that you > are in normal mode and you can do your wlan > loging without any problem > and you get your log. > > regards > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > --------------------------------- > Ne gardez plus qu\'une seule adresse mail ! Copiez vos mails vers Yahoo! > Mail >

2 1

Re: sometimes double records in radacct
by Nelson Serafica 13 Sep '07

13 Sep '07

Is it advisable that I uncomment the accounting_start_query_alt? Would there be conflict to other query commands like accounting_stop_query_alt, accounting_stop_query, etc. ----- Original Message ---- From: Nelson Serafica <ntserafica(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Wednesday, September 12, 2007 1:33:30 PM Subject: sometimes double records in radacct I notice in my radacct that there are double records. See sample below: +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | RadAcctId | AcctSessionId | AcctUniqueId | UserName | AcctStartTime | AcctStopTime | ConnectInfo_start | AcctStartDelay | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | 531828 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:32 | 2007-09-12 11:20:14 | | 0 | | 531826 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:33 | 2007-09-12 11:19:14 | 33333 LAPM/V42BIS | 0 | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ I noticed that the difference (AcctStartTime,AcctStartDelay,ConnectInfo_start) are indicated in the accounting_start_query_alt parameters. If you will noticed, there are identical AcctSessionId which was supposed to be none and the difference between them is the one that is updated by accounting_start_query_alt. It must not be identical. The problem is there are identical AcctSessionId. Would it be possible that the culprit is in the accounting_start_query_alt parameters? Is the accounting_start_query failing that's why accounting_start_query_alt take over? accounting_start_query is not broken and one line only. Is there a way to increase time before accounting_start_query_alt takes over? Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com ____________________________________________________ Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com

2 1

RE : LOGs of eap-tls authentication
by anoop_c＠sifycorp.com 13 Sep '07

13 Sep '07

Dear Thanks for the information.I am getting the logs when stopped server in debug mode. But the commands service radiusd stop and service radiusd restart is not working.So i killed the process radiusd using kill command.Pls let me know the commands to stop and start the server in normal mode. Regards Anoop > > Message: 2 > Date: Tue, 11 Sep 2007 10:39:38 +0200 (CEST) > From: inelec communication <inelec_communication(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication (inelec communication) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <980737.95433.qm(a)web26005.mail.ukl.yahoo.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > Hello, > > you have no logs in your radius.log file because you are running in > debug mode , you have to run in normal mode to get the logs, so what you > have to do is the following: > first stop your debug mode by this command: service radiusd stop; then > restart the service radius by: service radiusd restart; doing that you > are in normal mode and you can do your wlan loging without any problem > and you get your log. > > regards >

2 1

Re: Reply VSA Attributes in a list
by Faqeer ALI 13 Sep '07

13 Sep '07

I hope you have understand my problem right, but i will try to re explain it. i want to add the vp list in a VSA like following. (the way that NTRadping utility sends the vps) VSA ->vp ->vp ->vp This problem is my bottle line for me and i have to do it, because the client's application knows the attributes that way. please guide me where and what are the code changes that i have to make, and what structure i have to follow. special thanks. Regards FQ >Message: 6 >Date: Thu, 13 Sep 2007 07:28:45 +0200 >From: Alan DeKok <aland(a)deployingradius.com> >Subject: Re: Reply VSA Attributes in a list >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <46E8CA8D.5020606(a)deployingradius.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Faqeer ALI wrote: > > In the response packet i want to add the VPS such that the VSA of one > > vendor attaches in a specific vendor list, ie specify the vendor once > > and then the list of attributes in it. > > You mean inside of the RADIUS packet? > > > By pairadd(&request->reply->vps,vp) the vps are added one after the > > another, but i want it such that there would be the name of the specific > > vendor once and list of attributes to follow behind it.. > > The VALUE_PAIRs don't work that way. > > For a number of reasons, FreeRADIUS doesn't pack multiple VSA's into >one Vendor-Specific attribute. There are interoperability issues, and >it would also require code changes. > > Alan DeKok. > _________________________________________________________________ Gear up for Halo® 3 with free downloads and an exclusive offer. http://gethalo3gear.com?ocid=SeptemberWLHalo3_MSNHMTxt_1

2 1