- Freeradius-Users - lists.freeradius.org

Re: Ascend-Data-Filter Issues
by Hugh Messenger 01 Jul '07

01 Jul '07

Jeff <jeffa(a)jahelpdesk.com> said > > Actually the best answer for me if I were alittle stronger in mysql to > create the import query would be > a script that I could run to convert the users and import them into the > radius database As you noticed, users2mysql is a good place to start. And don't be put off by the SQL itself. The queries and data structures in rlm_sql are very, straight forward. No funky "third normal forms" or complex relations. It's all very basic select, insert and update, on a really simple schema. > when our billing software adds removes locks accounts, then dealing with > the filters, etc. > That way billing program creates file, query imports to sql, radius > operates through the sql end and not users file > I have seen the one in the source, users2mysql just not sure its actually > the correct format to import usersfor what i need. I was thinking del all > imported items when a new users file is ready for import then repopulate > with the import query the new. As long as you selectively remove specific groups of users, rather than dropping entire tables, there's nothing wrong with that approach. Then you can have other groups (like 'staff') that might not be featured in the billing file, which don't get blown away when your import script runs. And as you grow your service, and start synchronizing SQL user data from other sources, you just use the same approach so that nothing is stomping on everyone elses toes by blowing the tables away. The user2mysql script is still a good place to start looking, though. It wouldn't take much modification to do what you need. Really just a 'garbage collection' pass back the other way, iterating through the db users and removing those that are no longer in the billing file. If you aren't familiar with perl, it's worth learning. It's not that hard, plenty of great online resources, and essential for the kind of work you need to do. > Then auths, etc would be handled through the sql end where the control is > alot easier and appears more effective > And I could be running things as freeradius is designed to run. > Thus my stuff adapts to the workiing model, instead of me trying to change > a working model to mine. Yes. That's the idea. Part of good provisioning is providing the 'shims' between different components, such that you minimize (and hopefully eliminate) any customization of the components themselves. It's a common issue when bolting together packages that deal with data that has no formal standard (like a RADIUS users file!). Which is why Alan's repeated advice was 'modify the source data'. I think he only mentioned modifying C code as a piece of negative reinforcement! -- hugh

1 0

Re: How to convert a users file into a rlm_sql one?
by Hugh Messenger 01 Jul '07

01 Jul '07

"Pshem Kowalczyk" <pshem.k(a)gmail.com> said > > I would prefer to avoid user files all together. Currently we have > over 100k customers (heaps of them have 'user-specific' setup, not > just static ips). Customers change connection properties through a > web-based interface and we need to speed up the propagation of those > changes (currently we re-create the files every 5 minutes). I'll try > to remove the unwanted ones with rlm_attr. I'm in the process of building a very similar setup in freeradius. Like you, my aim is to have everything in SQL, with the absolute minimum of file based config required. I have backend provisioning which updates my SQL tables in real time as connection details are changed. Note that right now, only the 'wireless' part of the following is being used live. My dialups are currently still handled thru another RADIUS server (Funk/Juniper) while I finish testing and migration to freeradius. But the following tests out just fine with a Cisco 5200 NAS for dialup testing, as well as the live wireless stuff (coming in through a clutch of Mikrotiks). Also note that I'm doing this on 2.0.0pre, but with some small exceptions, the config should be the same for 1.1.x. This setup assumes that wireless and dialup users can be distinguished by which NAS they are connecting through. If you use the same NAS's for dialup and your broadband, this won't work. I have two huntgroups: wireless NAS-IP-Address == x.x.x.1 wireless NAS-IP-Address == x.x.x.2 dialup NAS-IP-Address == y.y.y.1 dialup NAS-IP-Address == y.y.y.2 So far, this is the only file based config data I'll need to change on an ongoing basis, as NAS IP's are added and removed. All other file configs are one-off changes. In the users file, I reference those huntgroups: DEFAULT Huntgroup-Name == 'wireless', Auth-Type := pam Fall-Through = 1 DEFAULT Huntgroup-Name == 'dialup', Auth-Type := pam Fall-Through = 1 NOTE that I'm using PAM for authentication, you won't want to set Auth-Type. Conventional wisdom probably says that I shouldn't set it either, but it works for me, where I only do PAM auth, period. The important thing here seems to be that you need to reference the Huntgroup-Name in the users file for it to get recognized later on. I then have the usual usergroup (called radusergroup in 2.0.0) definitions in the db: mysql> select * from radusergroup; +------------+-----------+----------+ | UserName | GroupName | priority | +------------+-----------+----------+ | radiustest | wireless | 1 | | radiustest | dialup | 1 | NOTE that in my setup, users can belong to both groups, and 'priority' has no significance. Allowing users to be in both groups does present problems with per-user reply attributes, see comments further on. In radgroupcheck, I have this: mysql> select * from radgroupcheck; +----+-----------+----------------+----+----------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+----------+ | 5 | wireless | Huntgroup-Name | == | wireless | | 6 | dialup | Huntgroup-Name | == | dialup | And in radgroupreply, I have this: mysql> select * from radgroupreply; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 1 | wireless | Session-Timeout | = | 86400 | [all my other wireless defaults] | 12 | dialup | Session-Timeout | = | 3600 | [all my other dialup defaults] NOTE ... in order for the SQL group stuff to kick in, you have to do one of two things, as per the sql.conf file: ## If set to 'yes' (default) we read the group tables ## If set to 'no' the user MUST have Fall-Through = Yes in the radreply table # read_groups = yes Personally I leave this defaulting to 'no', and set Fall-Through in the per-user radreply table. The radcheck table looks like this: mysql> select * from radcheck; +----+------------+------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+------------+------------------+----+---------+ | 1 | radiustest | Pam-Auth | := | radiusd | | 3 | radiustest | Simultaneous-Use | := | 1 | [other checklist attributes] Again, the above is specific to my setup using PAM to authenticate (via Winbind to a Windows AD). You'll probably have your Password attribute here instead of Pam-Auth, judging by the users file samples you provided. Also note that if you want to do 'simultaneous use' checking, you'll need to uncomment the simul_count_query in the main rlm_sql query file for your db type (in my case, mysql-dialup.conf). You'll also need to decide on simul_verify_query, which if defined will cause rlm_sql to try and use 'checkrad' to talk to the NAS to verify any existing sessions for a user rlm_sql thinks has already reached the max. Which means making sure your 'naspasswd' config is set up correctly, and NAS type is correct in your clients.conf (or nas db table, depending on your sql.conf 'nasclients' setting). I'm still testing simultaneous use in my setup, and can't guarantee it works right now. The radreply table looks like this: mysql> select * from radreply; +----+------------+---------------------+----+-----------+ | id | UserName | Attribute | op | Value | +----+------------+---------------------+----+-----------+ | 1 | radiustest | Mikrotik-Rate-Limit | = | 512k/512k | [other per user reply attributes] | 4 | radiustest | Fall-Through | = | 1 | Note the Fall-Through attribute. This is what tells rlm_sql to check the group tables, if you haven't set "read_groups=yes" in sql.conf. The only gotcha with the above setup is that if a user is in both groups, it will return all the 'radreply' attributes regardless of which Huntgroup they connect through. So even if 'radiustest' is connecting through a dialup NAS, the accept response will include the wireless specific Mikrotik-Rate-Limit attribute. So far this doesn't seem to be a problem - the NAS's I use seem to ignore nonsensical return attributes. This isn't a huge problem, and if you don't allow multiple account types per username, it won't affect you. But I'm looking for a way of suppressing inappropriate responses. I'm also using sqlippool for wireless users doing PPPOE. From your example it looks like you are probably using an external DHCP server for IP's on your ADSL, so I won't detail my sqlippool config. Let me know if you'd like to have that info. My main config looks like this (minus a few site specific sqlippool directives using the new 'unlang'). The only item of note is that I'm rejecting logins which don't get handled by rlm_sql. Without that 'notfound = reject' my setup will authenticate anyone with a Windows AD login, regardless of the rlm_sql config. This way, if they aren't in the rlm_sql users/groups, they can't login. authorize { preprocess chap mschap files sql { notfound = reject noop = reject } pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } pam } preacct { preprocess acct_unique } accounting { detail sqlippool sql attr_filter.accounting_response } session { sql } post-auth { sql Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } And that's about it. OK, so it's not exactly the setup you need, but very close. > kind regards > pshem -- hugh

1 0

Re: Problems using freeradius+postgresql
by Daniel Bojczuk 30 Jun '07

30 Jun '07

Yes!!! You're right Freeradius doesn't have permission to select the tables. Now it's working fine. Thanks Daniel 2007/6/29, Pshem Kowalczyk <pshem.k(a)gmail.com>: Hi, You haven't pasted the whole log, but judging from the following lines: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN I suspect that freeradius can't talk to the database. Have a look at the beginning of the debug messages, you should be able to see the lines referring to the db connection. It's possible that even thought the connection is fine freeradius doesn't have rights to select from the tables. regards pshem - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: sqlippool reject authentication if no IP?
by Hugh Messenger 30 Jun '07

30 Jun '07

Peter Nixon <listuser(a)peternixon.net> said: > On Thu 28 Jun 2007, Hugh Messenger wrote: > > Peter Nixon <listuser(a)peternixon.net> said: > > > On Thu 28 Jun 2007, Alan DeKok wrote: > > > > Hugh Messenger wrote: > > > > > With my current configuration, if sqlippool cannot assign an IP, > the > > > > > authentication still succeeds. > > > > > > > > The module returns NOOP. It could arguable return "fail". > > > > Just a nitpick, but for pool depletion it returns 'notfound'. > > Can you suggest a better return code? Not at all. I was just responding to Alan's comment above that "the module returns NOOP". My bad, trying to respond to two people in one email. > I am assuming you have already read: > http://wiki.freeradius.org/Rlm_sqlippool > > If not please do so :-) I had read it (several times) but as is often the case I misunderstood some of it. I now realize the failover example does do what I'd expect (not failing over on a notfound). > > Speaking of which. What would be the simplest way of having an email > > alert if a 'notfound' happens? This is all for PPPOE wireless clients, > > which are carefully provisioned. So we should never end up running out > of > > dynamic pool space, and I need to know about it if we do. > > logwatch/swatch/splunk etc ;-) I'm a splunker, as it happens. Which was indeed what I figured I'd use if there was no built in mechanism. [inserted from your followup mail] > Of course you COULD write an external mail script and run it as a > radiusd "exec" module. (or something with rlm_perl/rlm_python) I've been looking for a simple test case to try out rlm_perl, I might give that a go. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc As usual, thanks for your help. -- hugh

4 8

compile problem
by ram 30 Jun '07

30 Jun '07

Hi iam compiling on FC5 radius 1.1.6 iam getting the following error any help s.lo proxy.lo radiusd.lo radius_snmp.lo request_list.lo session.lo smux.lo threads.lo util.lo valuepair.lo version.lo timestr.lo xlat.lo \ -dlpreopen ../modules/rlm_python/rlm_python.la -lnsl -lresolv -lpthread ../lib/libradius.la \ /usr/local/src/cdrtools/freeradius-1.1.6/libltdl/libltdl.la -lcrypto -lssl -lcrypto libtool: link: cannot find the library `../modules/rlm_python/rlm_python.la' or unhandled argument `../modules/rlm_python/rlm_python.la' gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6 /src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6'

1 1

How to convert a users file into a rlm_sql one?
by Pshem Kowalczyk 30 Jun '07

30 Jun '07

Hi I have a setup like this for most of the users in the users file: rokky Huntgroup-Name == "ADSL", Password == "xyx" Framed-Protocol = PPP, Framed-IP-Address = 203.173.162.107, IHUG-Speed-Down = 5000, Service-Type = Framed-User rokky Huntgroup-Name == "DIALUP", Password == "xyx" Framed-Protocol = PPP, Service-Type = Framed-User, Session-Timeout = 600 - so depending on the used method of connection they get different replies. Is it possible to store such a setup in the database? I know i can organise users into groups, but then the answer is group-specific, not group-and-user-specific. Or have I missed something obvious? kind regards pshem

2 2

Identity does not match User-Name, setting from EAP Identity.
by Giovanni Lovato 30 Jun '07

30 Jun '07

I'm trying to get Windows XP authenticating using logon username/password. # freeradius -X [...] rad_recv: Access-Request packet from host 192.168.12.3:1048, id=0, length=217 Message-Authenticator = 0xdbb... Service-Type = Framed-User User-Name = "TELPERION\\heruan" Framed-MTU = 1488 Called-Station-Id = "00-19-5B-XX-XX-XX:Telperion" Calling-Station-Id = "00-13-02-XX-XX-XX" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02... NAS-IP-Address = 192.168.12.3 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "heruan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 0 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for heruan radius_xlat: '(|(uid=heruan)(cn=heruan))' radius_xlat: 'dc=aldu,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=heruan)(cn=heruan)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 0DBF... & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value 5388... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user heruan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.12.3:1048, id=0, length=217 Sending Access-Reject of id 0 to 192.168.12.3 port 1048 I wonder what "Identity does not match User-Name, setting from EAP Identity." means... Enabling/disabling "ntdomain_hack" on mschap module didn't change anything :( G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

2 2

Problems using freeradius+postgresql
by Daniel Bojczuk 29 Jun '07

29 Jun '07

Hi, I'm using Freeradius 1.1.6 with PostgreSQL 8.1. When I try to do #radtest joao senhasecreta 127.0.0.1:1812 0 testing123 Te radiusd (in debug mode) returns: #rad_recv: Access-Request packet from host 127.0.0.1:32779, id=220, length=56 # User-Name = "joao" # User-Password = "senhasecreta" # NAS-IP-Address = 255.255.255.255 # NAS-Port = 0 # Processing the authorize section of radiusd.conf #modcall: entering group authorize for request 0 # modcall[authorize]: module "preprocess" returns ok for request 0 # rlm_realm: No '@' in User-Name = "joao", looking up realm NULL # rlm_realm: No such realm "NULL" # modcall[authorize]: module "suffix" returns noop for request 0 #radius_xlat: 'joao' #rlm_sql (sql): sql_set_user escaped user --> 'joao' #radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ??ORDER BY id' #rlm_sql (sql): Reserving sql socket id: 4 #rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ? ORDER BY id #rlm_sql_postgresql: Status: PGRES_FATAL_ERROR #rlm_sql_postgresql: affected rows = #rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN #rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 #rlm_sql (sql): Connected new DB handle, #4 #rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ??ORDER BY id #rlm_sql_postgresql: Status: PGRES_FATAL_ERROR #rlm_sql_postgresql: affected rows = #rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN #rlm_sql (sql): failed after re-connect #rlm_sql_getvpdata: database query error #rlm_sql (sql): SQL query error; rejecting user #rlm_sql (sql): Released sql socket id: 4 # modcall[authorize]: module "sql" returns fail for request 0 #modcall: leaving group authorize (returns fail) for request 0 #Finished request 0 When I saw the "??" int the queries i changed te query in postgresql.conf putting al the query on the same line (deleting the "/")... but it doesn't work. I'm new on using freeradius, I don't know what I can do. Thank you.. Daniel Bojczuk

2 1

Re: load balancing problem
by Hugh Messenger 29 Jun '07

29 Jun '07

"EXT / GFI REBOLJ Jean-Pierre" <ext.gfi.rebolj(a)sncf.fr> said: [snip] > ldflag = round_robin [snip] > the problem is that I see the Authentication request and response then > Accounting start on the fisrt back-end server and the accounting stop > on the second backend server. That sounds like round_robin is doing its job. >From the example proxy.conf: # If there is no ldflag attribute, or it is set to 'fail_over', then # the realms are treated as "fail-over". That is, the first matching # realm is used, unless it is down, in which case the realm "fails # over" to the second matching realm. The process continues until an # active matching realm is found, OR the DEFAULT realm is returned. # # If the ldflag attribute is set to 'round_robin', then all active # realms of the same name are put into a pool internally in the # server, and the proxied requests are evenly divided among the # realms in the pool. For this to work, all realms of the same name # MUST have the same value of their 'ldflag' attributes. Mixing up # different types of load balancing schemes for the same realm will # cause problems. If you are trying to truly load balance, rather than just failover, I don't think this can be done just in the realms config. You should probably read doc/load-balance.txt. > JPR -- hugh

1 0

load balancing problem
by EXT / GFI REBOLJ Jean-Pierre 29 Jun '07

29 Jun '07

hi, i've a proxy with freeradius 1.1.6 in load balacing with two back-end radius 1.1.6 my proxy is configured like this realm APPLI1 { type = radius authhost = xx.xx.xx.xx:1820 accthost = xx.xx.xx.xx:1821 ldflag = round_robin secret = mysecret } # Server Canna PROD Accellio GPRS de Test avec Realm realm APPLI1 { type = radius authhost = yy.yy.yy.yy:1820 accthost = yy.yy.yy.yy:1821 ldflag = round_robin secret = mysecret } I see the Authentication request and response then Accounting start an some hours later accounting stop on the proxy the problem is that I see the Authentication request and response then Accounting start on the fisrt back-end server and the accounting stop on the second backend server. is this a bug or a problem of configuration ? thanks in advance. Regards JPR

3 4