- Freeradius-Users - lists.freeradius.org

Re: SQL IP Pool maximum timeout.
by Hugh Messenger 11 Jul '07

11 Jul '07

Dave <dave(a)optionsdsl.ca> said: > I use the sqlippool setup for handling IP pools, and it works well, > except I want to rid of the expiry time, (maximum timeout=0). right now > its setting for 24 hours, and then it cleans itself out, and then > freeradius starts handing out already assigned/used IP addresses. Im > not sure where to put the maximum timeout=0 value when using sqlippool. That shouldn't happen, regardless of the expiry time. The expiry_time value in the radippool entries is derived from the 'lease-duraction' set in sqlippool.conf. But the expiry_time should only affect clearing unique sessions which have gotten "stuck" (like for lost 'stop' packets). It shouldn't just start handing out in-use IP's based on expiry time. What do you have $pool-key set to in sqlippool.conf? And are you sure whatever value you are using (usually either NAS-Port or Calling-Station-Id) is a unique value from the NAS? What flavor of db do you have - postgres or mysql? They use different configs, and depending where you got the query file from, you may have an earlier broken version (especially if you are using MySQL). What version of freeradius are you running? -- hugh

4 13

Re: SQL IP Pool maximum timeout.
by Hugh Messenger 11 Jul '07

11 Jul '07

Alan DeKok <aland(a)deployingradius.com> > > Dave wrote: > > Im still having trouble with this problem, I switched the pool key to > > NAS port, the expiry time is 24 hours, and it seems after 24 hours, it > > wipes all the existing entries from the database, > > That would seem to fit the 24-hour expiry time you set. > > > again re-assigning > > IP's that are already in use, these IPs could be used indefinitely by > > some customers assuming they don't disconnect, I guess the > > sqlippool.conf seems to think that the stop packets are lost..? > > No. The leases are set to expire after 24 hours, as you said. > > If you don't want the leases to expire, edit the SQL queries so that > they don't set or look for an expiry field. I should probably leave this one to Peter to answer, but ... that wasn't my understanding of how the expiration works in sqlippool. The 'allocate-clear' query looks like this: allocate-clear = "UPDATE radippool \ SET NASIPAddress = '', pool_key = 0, CallingStationId = '', \ expiry_time = NOW() - INTERVAL 1 SECOND \ WHERE pool_key = '${pool-key}'" Which, by my understanding, should only clear IP's for which we are seeing a REPEAT login on the same 'pool-key' (although I think it should probably add a test for the same NASIPAddress in the WHERE clause, I keep meaning to ask Peter about that). In other words, it should only be clearing IP's for which a 'stop' query has gone astray, on the basis that you can't have more than one connection to an individual NAS port. It certainly shouldn't just free up all IP's based on expiry_time. I did see one 'rogue' SQL file out there from a very early version of sqlippool which does seem to use expiry_time - not sure if it was an original, or a contributed version, but it was definitely broken. Dave - can you copy and paste your sqlippool.conf, so we can see what your actual queries look like? -- hugh

4 9

Operator rlm_sql question
by Dave 11 Jul '07

11 Jul '07

HI, I have a question regarding the rlm_sql module and the := operator. In going through the documentation, the rlm_sql module goes through the radcheck table, then pulls the reply items from the radreply table. Then the usergroup, radgroupcheck and radgroupreply table. So if I specify for example Framed-IP-Address = 192.168.1.1 in the radreply table for a user, then specify Framed-IP-Address := 255.255.255.254 in a particular group entry in the radgroupreply table, shouldn't the reply item become Framed-IP-Address = 255.255.255.254 in the reply? I was under the impression that the := operator would add the reply item if it didn't exist, or modify the value if it did already exist. I am trying to set up one group where the user gets a static address specified in the radreply table, then another group where they get dynamic specified in the radgroupreply table based upon the NAS-IP-Address check in the radgroupcheck table. But I always seem to get the static address, even though the other reply items are correct for the respective groups. This is with freeradius 1.1.6, with the standard mysql table schema. Thanks, Dave

1 0

RE: DB_MYSQL.SQL
by Joel Eddy 11 Jul '07

11 Jul '07

For those that need it, like I did you can add this to the end of http://wiki.freeradius.org/MySQL_DDL_script to get your database to create the userinfo table also # # Table structure for table 'userinfo' # CREATE TABLE userinfo ( id int(10) NOT NULL auto_increment, UserName varchar(30), Name varchar(200), Mail varchar(200), Department varchar(200), WorkPhone varchar(200), HomePhone varchar(200), Mobile varchar(200), PRIMARY KEY (id), KEY UserName (UserName), KEY Departmet (Department) );

2 1

R: db_mysql.sql
by Francesco Cristofori 11 Jul '07

11 Jul '07

> Is it possible to use the one from 1.0.1 or some other version? Yes, if you use the mathing sql.conf you can use any db schema (so you don't have to convert old databases to new schemas). > Joel HTH, Francesco.

1 0

RE: db_mysql.sql
by Joel Eddy 11 Jul '07

11 Jul '07

Is version 1.1.6 missing the db_mysql.sql script? Is it possible to use the one from 1.0.1 or some other version? Or is there a link I've missed somewhere to get it? By the way I APPRECIATE all that you programmers are doing. I can only imagine the long hours put in to make this product work. THANK YOU !! Joel

4 3

RE: Logging failed authentications....
by Ackbar Joolia 11 Jul '07

11 Jul '07

Thanks... I've got both working now. File-based logging and mysql too Regards Ackbar -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalplc.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalplc.com@lists.freeradius.org] On Behalf Of tnt(a)kalik.co.yu Sent: 10 July 2007 21:32 To: FreeRadius users mailing list Subject: Re: Logging failed authentications.... radiusd.conf # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = no It will be logged in radius.log file Ivan Kalik Kalik Informatika ISP Dana 10/7/2007, "Ackbar Joolia" <ackbar.joolia(a)bglobalplc.com> piše: >Hi, >I would like to be able to log failed authentications but I don't find >it anywhere. And ideally I would like to put it into a MySQL table. > >Can anyone advice on this please? >Thanks >AJ > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com

1 0

accounting exec when Acct-Status-Type == Stop
by Santiago Balaguer García 11 Jul '07

11 Jul '07

4 5

auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by E A 11 Jul '07

11 Jul '07

Hello I hav one authentificate problem between my Freeradius and NAT(for VOIP) what means that i have : No authenticate method (Auth-Type) so here is my debug : radiusd -X rad_recv: Access-Request packet from host 192.168.100.238:1912, id=2, length=684 User-Name = "192.168.100.180" User-Password = "\371\323\025[" NAS-IP-Address = 192.168.100.238 NAS-Port-Type = Async Service-Type = Login-User Called-Station-Id = "907100" Calling-Station-Id = "4002" Cisco-AVPair = "xpgk-request-type=number" Acct-Session-Id = "47306f08-1-b56089b1" h323-conf-id = "h323-conf-id=02B21F32 1DEB1BAB 26450001 A8045DEC" Cisco-AVPair = "h323-call-id=02B21F32 1DEB1BAB 26440001 A8045DEC" h323-gw-id = "h323-gw-id=192.168.100.180" Cisco-AVPair = "h323-gw-address=192.168.100.180" Cisco-AVPair = "h323-incoming-local-address=192.168.100.238" h323-remote-address = "h323-remote-address=194.6.239.4" Cisco-AVPair = "h323-remote-id=194.6.239.4" Cisco-AVPair = "xpgk-h323-id=4FXS-045dec" Cisco-AVPair = "xpgk-src-number-in=4002" Cisco-AVPair = "xpgk-src-number-out=4002" Cisco-AVPair = "xpgk-dst-number-in=907100" Cisco-AVPair = "xpgk-dst-number-out=907100" h323-setup-time = "h323-setup-time=11:05:05.000 CEST Wed Jul 11 2007" Cisco-AVPair = "xpgk-route-retries=1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "192.168.100.180", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 radius_xlat: '192.168.100.180' rlm_sql (sql): sql_set_user escaped user --> '192.168.100.180' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '192.168.100.180' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '192.168.100.180' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '192.168.100.180' ORDER BY id' query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '192.168.100.180' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): No matching entry in the database for request from user [192.168.100.180] modcall[authorize]: module "sql" returns notfound for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 2 to 192.168.100.238 port 1912 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 2 with timestamp 46949d41 Nothing to do. Sleeping until we see a request. any help? best regards!!! --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

Proxying doesn't work!
by Federico Giannici 11 Jul '07

11 Jul '07

We have a working FreeRADIUS 1.1.4 running since a lot of months. Now we have to proxy the requests for a realm (gtenet.it) to a given RADIUS server, but our server seems to ignore the proxy configuration! I have set "proxy_requests = yes" and included the "proxy.conf" file (I'm sure of these, looked at the debug output). Here it is our "proxy.conf" file: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm gtenet.it { type = radius authhost = 195.103.212.53:1645 accthost = 195.103.212.53:1646 secret = XXXXXXXXX } When a request for xxxx(a)gtenet.it is received, it goes through the authorization and then instead of being proxied it goes through authentication and obviously fail! Here it is the output of the server in debug mode: Jul 10 18:55:29 aragorn radiusd[23262]: Going to the next request Jul 10 18:55:29 aragorn radiusd[23262]: Waking up in 6 seconds... Jul 10 18:55:29 aragorn radiusd[23262]: rad_lowerpair: User-Name now 'neomedia(a)gtenet.it' Jul 10 18:55:29 aragorn radiusd[23262]: rad_lowerpair: User-Password now 'XXXXXXXX' Jul 10 18:55:29 aragorn radiusd[23262]: rad_rmspace_pair: User-Name now 'neomedia(a)gtenet.it' Jul 10 18:55:29 aragorn radiusd[23262]: rad_rmspace_pair: User-Password now 'XXXXXXXX' Jul 10 18:55:29 aragorn radiusd[23262]: Processing the authorize section of radiusd.conf Jul 10 18:55:29 aragorn radiusd[23262]: modcall: entering group authorize for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "preprocess" returns ok for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "nm" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "chap" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "mschap" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "pap" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall: leaving group authorize (returns ok) for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Jul 10 18:55:29 aragorn radiusd[23262]: auth: Failed to validate the user. Any hints of what could be the problem? Thanks. -- ___________________________________________________ __ |- giannici(a)neomedia.it |ederico Giannici http://www.neomedia.it ___________________________________________________

3 3