- Freeradius-Users - lists.freeradius.org

Big "VSA + Proxy" problem
by Guilherme Franco 13 Jun '07

13 Jun '07

Hello, Running Freeradius 1.1.4 on RHEL with an Oracle backend. I'm at a Carrier and every "@bar.com" request is configured to be proxied but I have a problem where a VSA (in radreply table) is not even sent to bar.com. In my database: select * from radcheck; ID USERNAME ATTRIBUTE OP VALUE --- ------------------ --------------------- ---- ----------- 1 foo(a)bar.com User-Password := temp123 select * from radreply; ID USERNAME ATTRIBUTE OP VALUE --- ------------------ ---------------------------- ---- ----------- 1 foo(a)bar.com ERX-Service-Bundle := test1 ID USERNAME ATTRIBUTE OP VALUE --- ------------------ ---------------------------- ---- ------------------------ 2 foo(a)bar.com Framed-IP-Address := 192.168.254.199 Disabling the proxying for this realm works correctly (freeradius auths the user locally and sends the VSA to the router). With proxy configured, the user gets authenticated by bar.com but the VSA is not sent to bar.com (no traces of it in pre_proxy logs nor in radiusd -X debugs). I've already added ERX-Service-Bundle =* ANY in both attrs and attrs.pre-proxy and enabled the filters in radiusd.conf, but still no luck. Question: if that issue gets fixed and the VSA goes to bar.com, is there any way to bar.com return that same VSA untouched (considering that bar.com doesn't knows a thing about that VSA, i.e: it doesn't has any VSA info on it's database)? In fact, I don't need to send that VSA to bar.com, I just need to send it directly to my router(just like in the unproxied realm) but the proxy feature doesn't allow that. Please consider that I can't simply add "ERX-Service-Bundle := test1" in attrs (like I do with DNS VSAs) because the value of that VSA is chained with the user in radreply and each user has it's own different value (test2, test5, etc.). I'm very worried. Can anyone please shed some light on this? Thank you very much!

2 5

To check Simultaneous against 2 NASes
by Irina 13 Jun '07

13 Jun '07

Hello, 2 identical servers (CentOS release 5 (Final) running FreeRADIUS Version 1.1.3 with MySQL (Ver 14.12 Distrib 5.0.22) MySQL on both - master and slave to each other 2 NASes authenticate and do accounting to either FreeRadius server. checkrad is used to handle Simultaneous Logins How can I set up to check Simultaneous Logins against of both NASes? For example, a user goes through NAS1, freeradius server checks only that NAS1 if the user is connected. How can I make it to check against of both NASes? Thank you for your help in advance. Irina

3 5

same error: radiusd
by Mahalakshmi Vijayakumar 13 Jun '07

13 Jun '07

Hi, i even downloaded the freeradius-1.1.6 and installed it.... again when i give the cmd radiusd -X, i get the same error Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1788] Failed to parse authorize section. thanks.................

3 2

Indexing the database
by Irina 12 Jun '07

12 Jun '07

Hello all, I have another question... In radiusd.conf it says: ------------- then it probably means that you haven't indexed the database ------------- I don't think I did any indexing. I only used mysql.sql to create tables. Then inserted data. Did I have to do anything special? Thank you for your help in advance. Irina ================

2 1

RE: Run 2 FreeRadius simultanously
by Josh Howlett 12 Jun '07

12 Jun '07

Hi Jaume, > Can my machine run 2 FreeRadius at the same time? Each > FreeRadius in a diferent IP but simultanously in the same CPU > and O.S.? Somebody tell me thats possible if each radius is > reading from a diferent PATH... > > Thanks for any documentacion, link or kind of help. $ man radiusd ... -d config directory Defaults to /etc/raddb. Radiusd looks here for its configuration files such as the dictionary and the users files. You can start another instance of freeradius and point it to another config directory. > Jaume, trying to start eduRoam in Peru! Excellent! There are plenty of other eduroamers on this list too :-) josh.

1 0

Post
by Randy Evans 12 Jun '07

12 Jun '07

randy(a)vsswireless.net I want to be able to post to the freeradius users list

1 0

Fwd: Help for Jradius and Frreradius
by lisa laam 12 Jun '07

12 Jun '07

---------- Forwarded message ---------- From: lisa laam <laam.lisa(a)gmail.com> Date: 11 juin 2007 12:53 Subject: Help for Jradius and Frreradius To: freeradius-users(a)lists.freeradius.org Hi all, t rried to install jradius patch for freeradius. I can't use the root account so i installed radius in another directory. (note I'm newbie to Freeradius) 1- first i used freeradius-1.1.3.tar.gz with freeradius-1.1.2.patch. i got no error but the installation dosn't succeed. all the directory are empty bin, sbin, etc, .. 2-secondly i used freeradius-1.1.6.tar.gz with freeradius-1.1.5.patch and here are the errors i got here the commands i used for installation : tar xzf freeradius-1.1.6.tar.gz cd freeradius-1.1.6 #I install the the freeradius-1.1.5.patch wget http://jradius.cvs.sourceforge.net/*che ... .1.5.patch<http://jradius.cvs.sourceforge.net/*checkout*/jradius/jradius/freeradius/pa…> patch -p1 < freeradius-1.1.5.patch # whene i patch the files i got this failed : patching file raddb/jradius.conf patching file raddb/Makefile Hunk #1 FAILED at 7. 1 out of 1 hunk FAILED -- saving rejects to file raddb/Makefile.rej patching file raddb/radiusd.conf.in patching file raddb/radiusd.conf.in.rej patching file share/dictionary patching file share/dictionary.chillispot patching file share/dictionary.jradius patching file share/dictionary.lancom patching file share/dictionary.ser patching file src/modules/rlm_jradius/configure patching file src/modules/rlm_jradius/jradius.conf patching file src/modules/rlm_jradius/Makefile patching file src/modules/rlm_jradius/rlm_jradius.c patching file src/modules/stable # I follow the installation instructions ./configure --prefix=/software/freeradius make # whene i execute make I got this errors *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/ouahiba/download/freeradius- 1.1.6/src/lib/.libs -Wl,--rpath -Wl,/software/freeradius/lib /home/ouahiba/download/freeradius-1.1.6/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl- 1.1.6.so -o .libs/rlm_perl- 1.1.6.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6 /src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6 /src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6 /src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6' make: *** [all] Error 2 # when i execute make install i got sudo make install make[6]: *** [install] Error 1 make[6]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6 /src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6 /src/modules' make[4]: *** [install] Error 2 make[4]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6 /src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6' make: *** [install] Error 2 Please, can somebody tell witch version of freeradius to use with with patch and jradius version. and help me to find out the solution. thanks in advance Lisa.

6 8

Pre built packages
by Liam Farr 12 Jun '07

12 Jun '07

Hi, I'm about to setup FreeRADIUS and use it in conjunction with MikroTik's RouterOS, I was wondering if anyone makes an "off the shelf" package that looks after accounting and administration for FreeRADIUS? Particularly one that allows me to limit user traffic (upload & download)? Cheers Liam

1 0

V2 pre2 Switch blocks ?
by Arran Cudbard-Bell 12 Jun '07

12 Jun '07

Hi Alan, Just wondering whether you had put these in and i'd missed it :) If not, no hastle, they just make the config file look slightly neater.. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 5

error while executing the command radiusd -X
by Mahalakshmi Vijayakumar 12 Jun '07

12 Jun '07

Hi, i downloaded freeradius-1.0.2 and installed it.... when i give the cmd radiusd -X, i get the foll, can anyone tell me where things are going wrong...... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1788] Failed to parse authorize section. WS1A170L:/home/ushustech/rad-downloads/freeradius-1.0.2 # cd ../freeradius-1.1.6/ WS1A170L:/home/ushustech/rad-downloads/freeradius-1.1.6 # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1788] Failed to parse authorize section. thanks.................

3 2