- Freeradius-Users - lists.freeradius.org

Patch for >1 match in hints file
by Phil Mayers 23 Aug '07

23 Aug '07

All, I would appreciate comments on: http://bugs.freeradius.org/show_bug.cgi?id=477 This allows slightly more flexibility. Obviously tricks like this are obsolete in 2.x but we're not there yet. We'll be running this locally - I'd very much like it accepted upstream if possible. Usage would be: /etc/raddb/hints: # lookup the machine zone in SQL DEFAULT Zone = `%{sql:...}`, Fall-Through = yes # strip the leading 3 bytes from MAC addresses DEFAULT Calling-Station-Id =~ "(..):(..):(..):..:..:.." Vendor = `%{1}-%{2}-%{3}` /etc/raddb/eth2name (used in a "passwd" to map Vendor to VendorName): 00-0c-29:virtual-vmware 00-16-3e:virtual-xen /etc/raddb/users: # don't send banned vlan to virtual machines DEFAULT VendorName =~ "virtual.*", Zone == "banned", Auth-Type := Reject # real machines get a banned vlan as opposed to rejection DEFAULT Zone == "banned" Tunnel-Medium-Type = IEEE-802, Tunnel-Type = VLAN, Tunnel-Private-Group-Id = `%{sql:...}`

2 3

Re: [OpenSER-Users] Re: Prepaid acounts CDRTool
by Marc LEURENT 22 Aug '07

22 Aug '07

Ok, now it's a true question! When I start freeradius, it said that it can't find rlm_python.so, but this is normal because we added --with-static-modules=python Do you know how to correct it? Thanks rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) radiusd.conf[544] Failed to link to module 'rlm_python': rlm_python.so: cannot open shared object file: No such file or directory radiusd.conf[1884] Unknown module "python". radiusd.conf[1792] Failed to parse authorize section. zsh: exit 1 freeradius -X root@sd-7501:[~mleurent/../freeradius-1.1.3]# ls src/modules/rlm_python Makefile config.log configure* prepaid.py radiusd.py rlm_python.c rlm_python.lo Makefile.in config.status* configure.in prepaid.sql radiusd_test.py rlm_python.la rlm_python.o Marc LEURENT a écrit : > Oups , I simply forgot the src/modules/rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c patch > > Marc LEURENT a écrit : >> I have followed your advice, Freeradius is recompiled with rlm_python, >> byt know, rlm_sql seems to encountered troubles >> like : >> >> rlm_sql (sql): Reserving sql socket id: 2 >> rlm_sql_mysql: MYSQL check_error: 1312 received >> >> Any idea of how to repair this? >> Thanks >> >> >> I have added this in my debian/rules file: >> >> modulelist=krb5 ldap sql_mysql sql_iodbc python >> ... >> ... >> ./configure \ >> $(confflags) \ >> --prefix=/usr \ >> ... \ >> --with-static-modules=python >> >> >> >> Here is my freeradius debug: >> >> rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20070822 >> modcall[accounting]: module "detail" returns ok for request 5 >> modcall[accounting]: module "unix" returns noop for request 5 >> radius_xlat: '/var/log/freeradius/radutmp' >> radius_xlat: '' >> modcall[accounting]: module "radutmp" returns ok for request 5 >> radius_xlat: '' >> radius_xlat: ' CALL insert_radacct_record( 'radius', '52f74a-c0a80101-0-4(a)192.168.95.79', >> '36afb36cd5c82c34', 'sip:101@sd-7501.dedibox.fr:5060=3Buser=3Dphone', >> 'sip:101@sd-7501.dedibox.fr:5060=3Buser=3Dphone', '88.191.45.91', '5060', '2007-08-22 13:59:25', >> '0', '0', '0', '0', '', '', '200', >> 'Sip-Session', '', '', '0', '0', '200', >> 'INVITE', '', 'c0a80101-5766ea7', 'c0a80101-4e8244', '', '', >> '', 'sip:0033677832974@sd-7501.dedibox.fr:5060=3Buser=3Dphone', '', '' )' >> rlm_sql (sql): Reserving sql socket id: 2 >> rlm_sql_mysql: MYSQL check_error: 1312 received >> rlm_sql (sql): Couldn't insert SQL accounting START record - PROCEDURE radius.insert_radacct_record can't return a result set in the given context >> radius_xlat: '' >> rlm_sql (sql): Released sql socket id: 2 >> modcall[accounting]: module "sql" returns ok for request 5 >> >> >> >> >> >> Dan-Cristian Bogos a écrit : >>> Marc, >>> >>> I would suggest as first step reading about how prepaid works in >>> CDRTool. (see PREPAID.txt in doc folder). >>> >>> I personally use freeradius-cdrtool connector >>> (sourceforge.net/projects/frad-cdrtool) which I have written in >>> python and which needs rlm_python compiled into freeradius server. >>> >>> Have a look on all the info and let me know if u need any additional. >>> >>> Cheers, >>> DanB >>> >>> On 8/20/07, Marc LEURENT <lftsy(a)free.fr> wrote: >>>> No... >>>> Is it possible to do it with openser or is it compulsory to use asterisk? >>>> What do you use? >>>> >>>> Thanks >>>> >>>> >>>> Dan-Cristian Bogos a écrit : >>>>> Hi there Marc, >>>>> >>>>> are you using any application which locks, unlocks the prepaid >>>>> accounts, and instructs CDRTool to update the user's balance? Are you >>>>> aware that CDRTool uses separate applications for prepaid and postpaid >>>>> accounts? >>>>> >>>>> DanB >> _______________________________________________ >> Users mailing list >> Users(a)openser.org >> http://openser.org/cgi-bin/mailman/listinfo/users > > _______________________________________________ > Users mailing list > Users(a)openser.org > http://openser.org/cgi-bin/mailman/listinfo/users

1 0

Nas-Port-Type Attribute
by Amr el-Saeed 22 Aug '07

22 Aug '07

Hi, I put this line in the users file ( DEFAULT NAS-Port-Type == "PPPoEoA", Auth-Type = Accept ). I just want any user with that NAS-Port-Type to be accepted, but the RDAIUS doesn't start at all when i do this !! I know that this Value ( PPPoEoA ) is not a standard NAS-Port-Type value, but what is the problem ?? Is there any limitation on using a non standard value ?? regards, amr ali

2 1

customise dialup admin
by Carl aniams 22 Aug '07

22 Aug '07

Hi i'm presently using dialup admin for client connexion to the net. but my handicap is the time counter. i would like to know if it would be possible to set graphical time counter for a customer . also is it possible to increase the time limit for a customer that may require an hour more. if yes how please. thanks -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

3 2

strange problem with client certificate
by HBA BOX 22 Aug '07

22 Aug '07

Hello for every one, I'm using freeradius installed in an linux machine; I have generated my certificates (CA, client and cerver ) according to the HOWTO: EAP/TLS setup for FreeRADIUS and windows xp supplicant , until now every thing is ok, i have used my certs to secure my wi-fi network for 14 days after that I'm not able to use it again the radiuse.log file give the following Wed Aug 22 09:16:05 2007 : Info: rlm_eap_tls: Length Included Wed Aug 22 09:16:05 2007 : Error: TLS_accept:error in SSLv3 read client certi ficate A Wed Aug 22 09:16:05 2007 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Aug 22 09:16:05 2007 : Info: rlm_eap_tls: Received EAP-TLS ACK message when I have cheked my client certificate in windows xp certificate store (access using mmc) I have found that my certificate in giving the following problem: this certificate is not valide because one of the certificate authority in certification path does not appear to be allowed to issue certificates or this certificate can not be used as an end -entity certificat. NB: I have use this certificate for 14 days without any problem. can any one tell me what can be the problem. best regards --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Help me please
by hyunok 22 Aug '07

22 Aug '07

Help me please My linux box : Fedora core 5 service want ---> freeradius + mysql + pptpd My linux box visit Please rpm build install freeradius 1.1.7 rpm install pptpd 1.3.3 rpm install mysql 5.0.27 dialup admin install mysql db name --> radius ssh : vpn.itx.in user: help123 passwd:help123 root,mysql passwd --> help123 dialup admin url : http://vpn.itx.in/dialup/ passwd --> help123 Thank very much

2 1

Re: customise dialup admin + daloRADIUS Web Management
by liran tal 22 Aug '07

22 Aug '07

Hey Carl, I'm extensively working on a web management for RADIUS which you can use as a replacement for dialup admin. The project is called daloRADIUS and is much more comprehensive than dialup admin with support for accounting, reports, visual graphs, and even hotspots management integrated already into it. I hope you find it useful and you can feel free to always contact me at liran(a)enginx.com Website: http://sourceforge.net/projects/daloradius/ Yours, Liran Tal. On 8/21/07, Carl aniams <aniamss(a)gmail.com> wrote: > > > Hi > > i'm presently using dialup admin for client connexion to the net. > but my handicap is the time counter. i would like to know if it would be > possible > to set graphical time counter for a customer . also is it possible to > increase the time limit > for a customer that may require an hour more. > if yes how please. > thanks > -- > -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ > > ANIAMBOSSOU Carl > NIAMS TECHNOLOGIES > tel: +229 90 04 08 58 +229 97 48 01 33 > COTONOU > REPUBLIC OF BENIN > WEST AFRICA > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Freeradius, OpenLDAP and Cisco Switch
by Diego Woitasen 22 Aug '07

22 Aug '07

Hi, I am configuring a freeradius authenticating against a OpenLDAP. The tests with radtest and radclient worked fine, but I have problems with a Cisco Switch. Running radiusd -f -x I get the following output: rad_recv: Access-Request packet from host 10.0.0.72:1645, id=7, length=76 NAS-IP-Address = 10.0.0.72 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "diegows" Calling-Station-Id = "10.0.6.30" User-Password = "\023\r)N-\323\344\377q\257\350\316JK\224\364" rlm_ldap: - authorize rlm_ldap: performing user authorization for diegows rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value 3B317C5E7B68AB9D8F5715CFDC2B4B57 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value A6978BF97984FE13AAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user diegows authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "diegows" with password "? )N-��q��JK?�" rlm_ldap: user DN: uid=diegows,ou=Users,dc=iplan,dc=com,dc=ar rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=diegows,ou=Users,dc=iplan,dc=com,dc=ar/�tr;i4 ?��~��8� to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials Login incorrect (rlm_ldap: Bind as user failed): [diegows] (from client prueba-switches port 1 cli 10.0.6.30) rad_recv: Access-Request packet from host 10.0.0.72:1645, id=8, length=76 Why the password is garbage? What am I missing? regards, diegows -- ------------------- Diego Woitasen -------------------

2 1

Strange problem
by Sean Bracken 22 Aug '07

22 Aug '07

Hi, I am using Freeradius with a MySQL backend and the users log in through Chillispot running on Buffalo and Linksys routers running DD-WRT. The problem is that randomly users are recorded up to five times in radacct with one login. This is not a problem for users with expiration acccounts but users with max-all-session accounts are thrown out before they have really used up their time. Has anyone come accross this before? I'd appreiate any help. Sean ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, August 21, 2007 4:28 PM Subject: Freeradius-Users Digest, Vol 28, Issue 73 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: PAM Radius (Sayan S) > 2. customise dialup admin (Carl aniams) > 3. I am a first timer ! (Joshua Mashiane) > 4. Database Population problem with mysql (ram) > 5. RE: Database Population problem with mysql (Josh Howlett) > 6. Re: I am a first timer ! (Alan DeKok) > 7. Re: Database Population problem with mysql (ram) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 21 Aug 2007 04:22:20 -0700 (PDT) > From: Sayan S <sayann_u(a)yahoo.com> > Subject: RE: PAM Radius > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Cc: Josh Howlett <Josh.Howlett(a)ja.net> > Message-ID: <445430.39719.qm(a)web63910.mail.re1.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > yes josh, as you guessed it, it doesn't work with HP-UX and Solaris (to > some extent, as it provides a warning during useradd command with '@' in > the username). > We don't plan to use LDAP for NSS immediately. > > thanks to all. > > sayan > > Josh Howlett <Josh.Howlett(a)ja.net> wrote: Hi Sayan, > > I think I have tried this previously, and it was possible (on > Linux/glibc anyway - YMMV with other unices). > > TBH, I don't really see the point in using RADIUS when you'll (probably) > want to use LDAP anyway for nss resolution, so you might as well just > use LDAP for PAM. > > josh. > >> -----Original Message----- >> From: >> freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. >> org >> [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre > eradius.org] On Behalf Of Sayan S >> Sent: 20 August 2007 14:04 >> To: FreeRadius users mailing list >> Subject: Re: PAM Radius >> >> Thanks Alan for the quick response. >> I am referring to realm here, as RADIUS support realms, and >> we are using RADIUS to authenticate the users to Linux, so >> seems like we need to have all users contained in the same realm. >> >> Is having username in user@realm form a valid unix format? I >> was thinking the first part of the user@realm should be the >> unix username though the radius request is sent as >> user@realm. Otherwise we need to have a comprehensive >> RADIUS-username@realm to Unix-userid mapping. >> >> regards, >> sayan >> >> Alan DeKok wrote: >> >> Sayan S wrote: >> > Greetings, I am very new to RADIUS and PAM RADIUS. >> > I am trying to configure PAM Radius to authenticate >> users on a Linux >> > host. I would like to know, how to configure PAM >> Radius to authenticate >> > users from different realms, as the current >> configuration doesn't seem >> > to take realm. >> >> You don't use realms in Unix logins. >> >> > please help me with this as I have configured users >> to be part of >> > different realms on radius server and now want to >> authenticate all those >> > users to the same Linux host. >> >> You just login as "user@realm". That might work. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> >> ________________________________ >> >> Park yourself in front of a world of choices in alternative vehicles. >> Visit the Yahoo! Auto Green Center. >> n_center/;> > _ylc=X3oDMTE5cDF2bXZzBF9TAzk3MTA3MDc2BHNlYwNtYWlsdGFncwRzbGsDZ >> 3JlZW4tY2VudGVy> >> > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > --------------------------------- > Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, > news, photos & more. >

2 1

RE: Database Population problem with mysql
by Josh Howlett 21 Aug '07

21 Aug '07

Post mysql.sql to the list. josh. > -----Original Message----- > From: ram [mailto:talk2ram@gmail.com] > Sent: 21 August 2007 16:29 > To: FreeRadius users mailing list > Cc: Josh Howlett > Subject: Re: Database Population problem with mysql > > > > On 8/21/07, Josh Howlett <Josh.Howlett(a)ja.net> wrote: > > > (42000) at line 15: Invalid default value for 'AcctStartTime' > > Try using a valid value for this. > > > Hi > > what is the correct value for that record > > as per the document iam populating > > iam using mysql > > mysql Ver 14.12 Distrib 5.0.32, for pc-linux-gnu (i486) > using readline 5.2 > > on debian > > any suggestions > > ram > >

2 1