- Freeradius-Users - lists.freeradius.org

Acct-Type behaviour
by Milan Holub 16 May '07

16 May '07

Hi Alan, with cvs head from May 10: I had following accounting section: accounting { detail sql attr_filter.accounting_response } where all modules were invoked to process the request. then I've changed it to: accounting { detail Acct-Type RELAY { radrelay-detail } sql attr_filter.accounting_response } where radrelay-detail is defined in modules correctly and Acct-Type is set in acct_users file: DEFAULT Client-IP-Address != <SOME_IP>, Acct-Type := RELAY The goal is to log all accounting packets except of those sent from certain IP(another radius). The log file is then to be processed by "radrelay personality" of freeradius. My "problem" is that if the Acct-Type is set to RELAY then no other module from accounting{} gets called except of radrelay-detail. I thought that correct behaviour is that all modules from accounting{} should be called and if Acct-Type is set to RELAY then radrelay-detail should be called as well. In order to achieve desired behaviour my accounting{} looks now: accounting { Acct-Type RELAY { radrelay-detail detail sql attr_filter.accounting_response } detail sql attr_filter.accounting_response } Is this a bug or a feature? Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 1

EAP-SIM : symbol lookup error
by deepak kumar 16 May '07

16 May '07

Hi Alan I have downloaded freeradius 1.1.6 and configured for EAP-SIM and run successfully. but when i send a request using radeapclient to radius server i get this error " ./radiusd: symbol lookup error: /usr/local/lib/rlm_sim_files- 1.1.6.so: undefined symbol: rad_assert" I have set LD_LIBRARY_PATH, reconfigured and and rebuilt server with share disable option , but still get the same error. what is the problem, what should I do? this is log of radius ------------------------- Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:37454, id=33, length=89 User-Name = "232420100000015" NAS-IP-Address = 255.255.255.255 Message-Authenticator = 0x42014f09257d6d91d04b6e145e251adb NAS-Port = 0 EAP-Message = 0x0220001401323332343230313030303030303135 ./radiusd: symbol lookup error: /usr/local/lib/rlm_sim_files-1.1.6.so: undefined symbol: rad_assert thanks Deepak

3 5

no session showed by radwho, but user still could not login
by Trio Yulistianto 16 May '07

16 May '07

Hi all I'm newbie in freeradius, i've already installed freeradius-1.1.6, Mysql and MikroTik NAS. I'm configuring my radius 1 session for every 1 user : +----+---------------+---------------------------+-----+-------------+ | id | UserName | Attribute | op | Value | +----+---------------+---------------------------+-----+--------------+ | 57 | rsa@idola | Simultaneous-Use | := | 0 | | 42 | rsa@idola | Password | == | denpasar | +----+---------------+---------------------------+----+---------------+ The problem is sometimes user cannot login even no session rsa@idola user in Mikrotik NAS connected, I check with radwho, its shown below : [root@ladps ~]# radwho Login Name What TTY When From Location tyl@idola tyl@idola PPP S232 Mon 17:43 129.47.26 172.16.30.79 awn@idola awn@idola PPP S245 Mon 19:53 129.47.26 172.16.30.246 gde@idola gde@idola PPP S189 Mon 13:12 129.47.26 172.16.30.255 afy@idola afy@idola PPP S218 Mon 13:20 129.47.26 172.16.30.252 no session rsa@idola in that list… is'nt it ? but rsa@idola still couldnot login, this is the log from radiusd –X : Ready to process requests. Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 129.47.26.123:1088, id=8, length=179 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 252 NAS-Port-Type = Ethernet User-Name = "rsa@idola" Calling-Station-Id = "00:18:DE:69:F1:F3" Called-Station-Id = "VLAN TEST" NAS-Port-Id = "vlan_TEST" MS-CHAP-Domain = "idola" CHAP-Challenge = 0x0270131ced4933d4f26646e2946b2192 CHAP-Password = 0x016806e0edb33d434bc59078e233381b6c NAS-Identifier = "ROUTER INDUK" NAS-IP-Address = 129.47.26.123 Mikrotik-Realm = "idola" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "idola" for User-Name = "rsa@idola" rlm_realm: No such realm "idola" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 163 users: Matched entry DEFAULT at line 183 users: Matched entry DEFAULT at line 195 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'rsa@idola' rlm_sql (sql): sql_set_user escaped user --> 'rsa@idola' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rsa@idola' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'rsa@idola' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'rsa@idola' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'rsa@idola' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "mbcounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailymbcounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlymbcounter" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'rsa@idola' modcall[session]: module "radutmp" returns ok for request 1 modcall: leaving group session (returns ok) for request 1 Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'rsa@idola' rlm_sql (sql): sql_set_user escaped user --> 'rsa@idola' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('','rsa@idola', 'Chap-Password', 'Access-Reject', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass,reply, date) values ('', 'rsa@idola', 'Chap-Password', 'Access-Reject', NOW()) rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 modcall[post-auth]: module "sql" returns ok for request 1 modcall: leaving group REJECT (returns ok) for request 1 Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 129.47.26.123:1088, id=8, length=179 Sending Access-Reject of id 8 to 129.47.26.123 port 1088 Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" Waking up in 1 seconds... I have already checked my NAS and there is no session for rsa@idola, I try with radzap and still not working… Any help please… thanks trio

6 13

RE: Freeradius-Users Digest, Vol 25, Issue 68
by khursheed Ahmed 16 May '07

16 May '07

1 0

None
by Александр Никулин 16 May '07

16 May '07

Hello How can I get all values of Cisco AVpair from NAS if there are multiple values, for example May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 54 "faxrelay-start-time=16:03:58.021 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 59 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 53 "faxrelay-stop-time=16:04:37.161 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 38 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 32 "faxrelay-max-jit-buf-depth=506" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 33 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 27 "faxrelay-jit-buf-ovflow=0" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 41 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 35 "faxrelay-init-hs-mod=V.27ter/4800" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 39 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 33 "faxrelay-mr-hs-mod=V.27ter/4800" and so on.

4 7

FreeRadius 2.0 proxy question - home_server auth and acct server?
by Brian Walters 16 May '07

16 May '07

With the new 2.0 release do we have to make 2 entries for each home server? 1 for auth packets and 1 for acct packets? -- Brian

3 4

FreeRadius 2.0 Radrelay to multiple servers?
by Brian Walters 16 May '07

16 May '07

Currently I have 3 FR 1.1.3 servers that proxy for a couple of ISP customers. Right now I have radrelay processes point from 1->3, 2->3 and 3->1, 3->2. This allows me to have reasonably matched accounting data on all 3 servers for all my ISP customers while allowing me to load balance my NAS gear across my servers. In the new 2.0 release it appears that we are using the proxy.conf to tell radiusd -n radrelay where to send those packets. Wouldn't I need to set up a separate proxy.conf with a DEFAULT entry in order to send ALL realm acct packets to my two other servers as described above otherwise it would seem the packets would try to forward to the ISP customer again instead of my own servers? How do I get it to send the data to both servers in a server_pool like I did with the old radrelay: 3->1 & 3->2. -- Brian

2 3

Support for MySQL Stored Procedures in FreeRADIUS 2.0?
by Gunther 16 May '07

16 May '07

Will there be support for MySQL Stored Procedures in 2.0? FreeRADIUS 2.0.0-pre1 does not yet support SP in MySQL. Gunther

2 1

HUP stops radiusd
by John Horne 16 May '07

16 May '07

Hello, This is a 'me too' message I'm afraid. From the list archives I saw: ====================================================== > Date: Mon, 02 Apr 2007 20:20:47 +0200 > From: Alan DeKok <aland at deployingradius.com> > Subject: Re: HUP in freeradius-1.1.5 + CVS results in process death. > To: FreeRadius users mailing list > <freeradius-users at lists.freeradius.org> > Message-ID: <4611497F.3000500 at deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: > >> I know theres a bug report for this already, >> but when I HUP the process freeradius doesn't die in the same place. >> > > If it's an issue due to incorrectly free'd memory, the crashes will be > random. > > There may be a fix in 1.1.6, but I'm not sure. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Looks more like a bug in rlm_tls . Dies every time on HUP, deffinatly not random... ====================================================== In our case, using freeradius 1.1.6, if I HUP the radiusd process it crashes/stops. Running 'radiusd -X', the tail part shows: ========================================================= security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Mon May 14 13:38:54 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon May 14 13:38:54 2007 : Error: radiusd.conf[230] Auth-Type PAP already configured - skipping Mon May 14 13:38:54 2007 : Error: radiusd.conf[234] Auth-Type MS-CHAP already configured - skipping Mon May 14 13:38:54 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon May 14 13:38:54 2007 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Mon May 14 13:38:54 2007 : Error: rlm_eap_tls: Error reading certificate file Mon May 14 13:38:54 2007 : Error: rlm_eap: Failed to initialize type tls Mon May 14 13:38:54 2007 : Error: radiusd.conf[1]: eap: Module instantiation failed. Mon May 14 13:38:54 2007 : Error: radiusd.conf[238] Unknown module "eap". Mon May 14 13:38:54 2007 : Error: radiusd.conf[229] Failed to parse authenticate section. ========================================================= This was running radiusd as the root user, running it as our usual non-root user caused the same output. Starting up radiusd normally shows no such error messages, so I'm not sure why it should now complain about the Auth-Type's or the certificate. Using the original radiusd.conf produces the same error messages, with a couple of extras (for the Auth-Types's system and CHAP). Any ideas? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

8 11

Attributes mapping between LDAP and RADIUS
by Jian Wang 16 May '07

16 May '07

Is there an RFC standardizing the attribute mapping between LDAP and RADIUS? Thanks.

2 1