- Freeradius-Users - lists.freeradius.org

some issues in sqlippool, branch_1_1
by Alexander V. Klepikov 17 Apr '07

17 Apr '07

Hello! 1. During setup of rlm_sqlippool module, I found some compatibility issues with PostgreSQL server. I remind that rlm_sqlippool uses transactions. In that case all of queries and commands including "BEGIN", "COMMIT" and "ROLLBACK" in PostgreSQL must ends with ";" or query will fail. I have this issue (is it an issue?) on PostgreSQL 7.3.15 but it should be true for 8.x versions too. I think it should be documented. 2. In sqlippool.conf %{reply:Pool-Name} is used, but in documentation said that Pool-Name is check attribute. In my tests reply:Pool-Name was empty string, so I replaced it with Pool-Name. 3. In doc/examples/postgresql.sql in radippool table definition some fields are defined as NOT NULL (and vice versa), which should not be - it causes problems when one add IP-addresses to radippool. 4. In src/include/modpriv.h , src/modules/rlm_eap/rlm_eap.h , src/modules/rlm_sql/rlm_sql.h I replaced #include "ltdl.h" with #include "../../libltdl/ltdl.h" to compile FreeRadius. My OS is FreeBSD 6.2-RELEASE, GNU Make 3.81 Patch for items 2 and 3 attached. With best regards, Alexander V. Klepikov. E-mail: klepikov_a(a)up.ua

2 1

AW: FW: Login for any user
by Galuschka Christoph 17 Apr '07

17 Apr '07

Hello, well so far it seems to works partly as I get the following error: >> auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message >> Currently working on that. regards Christoph --------------------------------------------------- Ing. Christoph Galuschka TIWAG-Tiroler Wasserkraft AG ITT LAN/WAN - VPN-/Firewallsysteme Eduard-Wallnöfer-Platz 2 6010 Innsbruck T: +43 (0)50607 21832 F: +43 (0)50607 41832 www.tiroler-wasserkraft.at Ti.econet: Hotline: +43 (0)50607 21405 eMail: econet(a)tiwag.at www.tieconet.at --------------------------------------------------- -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+christoph.galuschka=tiwag.at(a)lists.freeradius.o rg [mailto:freeradius-users-bounces+christoph.galuschka=tiwag.at@lists.free radius.org]Im Auftrag von inverse Gesendet: Dienstag, 17. April 2007 15:49 An: FreeRadius users mailing list Betreff: Re: FW: Login for any user > Anybody got an idea on how the entry in the users-file has to look like something like DEFAULT Auth-Type := Eap, User-Password == "blah" with deafult eap type set to md5. I've yet to try it tho, may you report back if it works? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

unsubscribe
by Tseveendorj Ochirlantuu 17 Apr '07

17 Apr '07

1 0

Login for any user
by Galuschka Christoph 17 Apr '07

17 Apr '07

Hello, I would like to create a login user on my database backend which allows everybody - regardless of username - to login as long as the password is correct. Is there a way to create such a user? thanks and regards Christoph --------------------------------------------------- Ing. Christoph Galuschka TIWAG-Tiroler Wasserkraft AG ITT LAN/WAN - VPN-/Firewallsysteme Eduard-Wallnöfer-Platz 2 6010 Innsbruck T: +43 (0)50607 21832 F: +43 (0)50607 41832 www.tiroler-wasserkraft.at Ti.econet: Hotline: +43 (0)50607 21405 eMail: econet(a)tiwag.at www.tieconet.at ---------------------------------------------------

1 0

PAM Radius Authentication
by daniel 17 Apr '07

17 Apr '07

Hi, I have been trying to set up the pam_radius_auth pam module to authenticate my users through my freeradius server. The radius server is working fine as I can get and Access-Accept packet with radtest and also my wireless hotspot authenticates fine through it. The problem I have is that pam seems to be having a problem loading the module. The auth.log shows the following: Apr 15 22:03:51 bill sshd[7861]: PAM unable to dlopen(/lib/security/pam_radius_auth.so) Apr 15 22:03:51 bill sshd[7861]: PAM [dlerror: /lib/security/pam_radius_auth.so: undefined symbol: __stack_chk_fail_local] Apr 15 22:03:51 bill sshd[7861]: PAM adding faulty module: /lib/security/pam_radius_auth.so I am running pam_radius_auth 1.3.16 and freeradius 1.1.6 on Ubuntu 6.10 The pam_radius_auth module seems to be quite old, does anyone know if it still works? Regards, Daniel Davis

3 8

Radius accounting
by markus.wintruff＠linde.com 17 Apr '07

17 Apr '07

Hy all, i use freeradius 1.1.3 here is my problem: i use radiusaccounting into a mysql database. I want to extract information out of the accounting packet and insert it into the sql database: My Acct-Session-Id looks like this. Acct-Session-Id = "domain\\user"Thu Mar 1 14:29:58 2007"NC" the last field, here NC is one of this NC|WSAM|JSAM So i put this to acct_users: DEFAULT Acct-Session-Id =~ "^.*(NC|JSAM|WSAM).*" My-ST == `%{1}` My-ST is defined in dictionary ATTRIBUTE My-ST 3004 string i see that rad_xlat gives the correct value to My-ST but i cant use it in the sql statement. Its empty. acct_users: Matched entry DEFAULT at line 23 radius_xlat: 'WSAM' How can i define new Attributes? And use them in sql.conf Thanks a lot

2 1

rlm_sql: Bug in stripping output of dynamic strings {sql:...}
by Milan Holub 17 Apr '07

17 Apr '07

Hi all, - latest CVS head - mysql Ver 14.7 Distrib 4.1.8, for pc-linux-gnu (i386) - FreeRADIUS Version 2.0.0-pre0, for host i386-pc-linux-gnu, built on Apr 13 2007 at 10:11:51 I'm using dynamic variables like {sql:<sql statement>} throughout my configuration to fetch data from the DB. For example acct_users: DEFAULT Acct-Status-Type == Start session_count := "%{sql:select count(*) from radacct where username='%{SQL-User-Name}'" or radgroupcheck table: +----+-----------+---------------+----+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+---------------+----+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 44 | config | session_count | := | `%{sql:select count(*) from radacct where username='%{SQL-User-Name}'}` | | 47 | config | product_code | := | `%{sql:<retun_some_string>}` | +----+-----------+---------------+----+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ or even in sqlcounter: sqlcounter noresetcounterflat { counter-name = Max-All-Session-Time-Flat check-name = Max-All-Session-Flat sqlmod-inst = sql key = User-Name reset = never query = "SELECT UNIX_TIMESTAMP()-UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE username='%{%k}' ORDER BY radacctid limit 1" } Unfortunately I'm getting the output stripped by last character(byte): instead of getting 37 for session_count I get 3, instead of getting 1563 for noresetcounterflat I get 156, instead of getting "S3H" for product_code I get "S3". When the query returns 1 character I get empty output. >>> BEGIN DEBUG radius_xlat: Running registered xlat function of module sql for string 'select count(*) from radacct where username='%{SQL-User-Name}'' rlm_sql (sql): - sql_xlat radius_xlat: 'fkafvt' rlm_sql (sql): sql_set_user escaped user --> 'fkafvt' radius_xlat: 'select count(*) from radacct where username='fkafvt'' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 2 radius_xlat: '3' >>>END DEBUG DB query clearly shows: mysql> select count(*) from radacct where username = 'fkafvt'; +----------+ | count(*) | +----------+ | 37 | +----------+ 1 row in set (0.00 sec) This behaviour is the same no matter in which part of config the dynamic string appears(radgroupcheck, acct_users, sqlcounter configuration). My workaround for this was to output some additional dummy character from within mysql by surrounding the queries by mysql concat function: %{sql:select concat((select count(*) from radacct where %username='%{SQL-User-Name}'),'\n')} ie: %{sql: select concat((<your query>), '\n')} I hope this could help someone until the code is fixed... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

4 13

FR + AD + Vlans + LDAP help
by Jacob Jarick 17 Apr '07

17 Apr '07

Hello, Im currently trying to configure freeradius to authenticate via a win2k3 server, check the users group and then return a confirmation/ denial + vlan id for the cisco WAP to process. Questions: 1: Is ldap the only way of retreiving the users group/s 2 - Can I talk directly to the ADS using the ldap client (or however its done) instead of setting up a linux openldap server. 3: Does users entry look correct it is ment to disallow people in the group rejects, assign priv students to 1 vlan and students to the other vlan: # !! testing groups DEFAULT LDAP-Group == "rejects", Auth-Type := Reject DEFAULT Auth-Type = ntlm_auth Fall-Through = 1 DEFAULT LDAP-Group == "staff" Service-Type = Framed-User, Tunnel-Type = :1:VLAN, Tunnel-Medium-Type = :1:6, Tunnel-Private-Group-ID = :1:140 DEFAULT LDAP-Group == "students" Service-Type = Framed-User, Tunnel-Type = :1:VLAN, Tunnel-Medium-Type = :1:6, Tunnel-Private-Group-ID = :1:141

2 7

O'Reillys Radius Book - Worth buying
by Jacob Jarick 17 Apr '07

17 Apr '07

Hi, Im just getting started with freeradius (trying to nut out dynamic vlans atm) and I was wondering if this book would be a worth while purchase. I had a great experience with O'reillys bind and perl cookbook books. Have any FR users used this book and if so your comments would be appreciated. http://www.oreilly.com/catalog/radius/index.html

7 15

LDAP server per realm
by Sean McNamara 17 Apr '07

17 Apr '07

Hello everyone, I'm working on finding a way to define multiple local realms and have each have a unique ldap profile associated with them. We want one associated with a particular realm, and the other to be the catchall/default case. In addition to this, we're also using EAP/TTLS, which may or not complicate the situation.. After googling a bit, I was under the impression that something along the following lines should work: Here are the relevant parts of the the files I modified: in proxy.conf: realm VLS { type = radius authhost = LOCAL accthost = LOCAL } in dictionary: VALUE Auth-Type VU 1 VALUE Auth-Type VLS 2 VALUE Autz-Type VU 1 VALUE Autz-Type VLS 2 in users: DEFAULT Domain == "VLS", Autz-Type := VLS in radiusd.conf: ldap vlsldap { .... set_auth_type = yes } ldap vuldap { .... set_auth_type = yes } authorize { ... ... Autz-Type VLS { vlsldap } vuldap ... } authenticate { ... Auth-Type VLS { vlsldap } vuldap ... } When I attempt to authenticate, regardless of whether I specify a realm or not, it only checks the vuldap servers. Any suggestions would be greatly appreciated! Thank you.. ..Sean.

2 1