- Freeradius-Users - lists.freeradius.org

Custom queries
by Dariusz Dwornikowski 28 Feb '07

28 Feb '07

Hi, I am using freeradius 1.0.2 on debian and i want to integrate it with openser. What is my question is how to use my own sql queries in authentication and authorization. I do not want/I can't use the database schema provided with freeradius. -- Pozdrowienia, Dariusz Dwornikowski tel. 0601596474

3 2

sql and interim update packets
by Andrew D 28 Feb '07

28 Feb '07

Hi there, We're running freeradius 1.1.4 on freebsd 5.5, using unixodbc and freetds to talk to mssql. According to the default mssql file file the _alt queries are only supposed to run if there is an error when doing the first sql query. # accounting_update_query - query for Accounting update packets # accounting_update_query_alt - query for Accounting update packets # (alternate in case first query fails) However this isn't the case. User-Name = "aliencroc" NAS-Port-Type = ADSL-DMT Attr-103 = 0x45e50bfe rad_lowerpair: User-Name now 'aliencroc' rad_rmspace_pair: User-Name now 'aliencroc' Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 1851,Client-IP-Address = 203.132.224.35,NAS-IP-Address = 203.220.236.246,Acct-Session-Id = "00152C4F",User-Name = "aliencroc"' rlm_acct_unique: Acct-Unique-Session-ID = "b577760b95764125". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "aliencroc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/radacct/203.132.224.35/detail-20070228' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/203.132.224.35/detail-20070228 modcall[accounting]: module "detail" returns ok for request 0 radius_xlat: '/var/log/radutmp' radius_xlat: 'aliencroc' modcall[accounting]: module "radutmp" returns ok for request 0 radius_xlat: 'aliencroc' rlm_sql (sql): sql_set_user escaped user --> 'aliencroc' radius_xlat: 'UPDATE CallsOnline SET DataIn = '262653',DataOut = '354385', LastHit = getdate() WHERE AcctSessionId = '00152C4F' AND UserName = 'aliencroc' AND NASIdentifier= '203.220.236.246'' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'INSERT into accounting (LogTime, LogDate, UserName, NasIPAddress, NasPortID, ServiceType, FramedProtocol, FramedAddress, CallingStation ID, NasIdentifier,AcctStatusType, NasPortType, ConnectInfo, ConnectInfo2, AcctUniqueID, CalledStationID, Connection_ID) values (getdate(),getdate(),' aliencroc','203.220.236.246','1851','Framed-User', 'PPP', '125.168.108.242','sfy211300202027','LNS02-WAYM-ADL.comindico.com.au','Start','ADSL-DMT','15 5520000','155520000','b577760b95764125','','00152C4F') ' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 67 to 203.132.224.35 port 35240 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... The first update query didn't fail. Any ideas or would this be a bug? Cheers cya Andrew

1 0

Redundant Ldap Configuration + More groups
by nikitha 28 Feb '07

28 Feb '07

Hi All, Authentication take more time when 2 ldap servers are configured and one is not reachable. I have configured the redundant ldap module as specified in the doc. authorize { ;; ;; redundant { ldap-server-1 ldap-server-2 } } authenticate { ;; ;; Auth-Type LDAP { redundant { ldap-server-1 ldap-server-2 } } The corresponding ldap-server module confiugration is, ldap ldap-server-1 { .. .. } ldap ldap-server-2 { .. .. } 1. In the users file, added some 20 DEFAULT entry for ldap-server-1-Ldap-Group for ex., DEFAULT ldap-server-1-Ldap-Group == "g1" 2. After that added 30 DEFAULT entry for ldap-server-2-Ldap-Group, each DEFAULT entry is like, DEFAULT ldap-server-2-Ldap-Group == "g21" .. .. DEFAULT ldap-server-2-Ldap-Group == "g50" The ldap-server-1 is down now. only ldap-server-2 is reachable. When the request comes to the radius server, it goes one entry by entry in "users" file, ie., It connects to ldap-server-1 with the Ldap-Group tries from g1 till g20, and then connects to ldap-server-2 with Ldap-Group from "g21' till g50. If the user is part of Ldap-group "g50" it takes more time to return success, before itself the request times out, and received eap start again from wireless client. If the "number of DEFAULT entry for ldap-server-1" is less than 10, then it works fine. If the default entry increases, the server takes more time to process. I think redundant ldap server configuration is not correct or in some otherway we can fix it. Is it possible to configure the radius server in such a way that, try ldap-server-1 for the first policy, if its reachable then check it against the next policy. If its not reachable mark this server as dead or whatever and ignore processing the next coming DEFAULT entries which matches with ldap-server-1 and try to process ldap-server-2 entries. Please help me in solving this issue. Thanks for any help. Regards, Nikitha

2 3

[SOLVED] FreeRADIUS + LVS problem
by Sam Schultz 27 Feb '07

27 Feb '07

Brief Review: I had a working FreeRADIUS configuration doing EAP-TTLS wireless authentication that broke when put behind a 1:1 NAT/LVS. No faults were found in the FreeRADIUS configuration, so the NAT configuration was suspect. It likewise was found to have no faults (it's just a single SNAT & a single DNAT rule). After tcpdumping from the server, I discovered that FR was receiving requests via the correct interface/IP, but trying to send them out of a different (virtual) interface/IP. Obviously, this won't work, NAT or otherwise. The original test box was multi-homed, but the interfaces were bonded, so it didn't suffer from the same problem. The NAT just added an extra layer of complexity. The solution was to specifically bind to the correct interface/IP, just as you would with most daemons on a multi-homed box. This would seem to further prove that often the solution is simpler than you'd think :) -- Click to learn how to become a world famous writer or poet http://tagline.hushmail.com/fc/CAaCXv1P6EzvmffHZgm792Hv8Cn74zWV/

1 0

Compile error -- HELP
by ken 27 Feb '07

27 Feb '07

I am trying to install freeradius 1.1.4 on solaris 10 using the following commands. ../configure --without-rlm-x99-token configure creates the Makefile I then run make and get the following error:gcc -shared -Wl,-h -Wl,libradius-1.1.4.so -o .libs/libradius-1.1.4.so .libs/crypt.o ..libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o ..libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o ..libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o ..libs/snprintf.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o -lcrypt -lc (cd .libs && rm -f libradius.so && ln -s libradius-1.1.4.so libradius.so) false cru .libs/libradius.a crypt.o dict.o filters.o hash.o hmac.o hmacsha1.o isaac.o log.o misc.o missing.o md4.o md5.o print.o radius.o rbtree.o sha1.o snprintf.o token.o udpfromto.o valuepair.o make[4]: *** [libradius.la] Error 1 make[4]: Leaving directory `/export/home/freeradius-1.1.4/src/lib' make[3]: *** [common] Error 2 make[3]: Leaving directory `/export/home/freeradius-1.1.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/export/home/freeradius-1.1.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/export/home/freeradius-1.1.4' make: *** [all] Error 2 Thanks _________________________________________________________________ Win a Zunemake MSN® your homepage for your chance to win! http://homepage.msn.com/zune?icid=hmetagline

3 2

Set Pool-Name based on Framed-Pool
by Pasi Kärkkäinen 27 Feb '07

27 Feb '07

Hi list! I'm having problems setting Freeradius internal "Pool-Name" attribute based on "Framed-Pool" attribute (in proxy auth reply). users file: DEFAULT Framed-Pool == "tech", Pool-Name := tech_ippool Fall-Through = 1 I can see the "Framed-Pool" attribute in proxy auth reply (with correct value), but when freeradius is processing "users" file, the above line does not match.. What's wrong with that line? Thanks! -- Pasi

2 3

test Radius with XSupplicant
by Amin BEN ABDALLAH 27 Feb '07

27 Feb '07

in order to test my FreeRadius, I wanted to install XSupplicant-1.2.8, however the installation process failed because of a iwlib.h problem checking for iwlib.h... no configure: error: header file <iwlib.h> is required for Xsupplicant despite that I have already wireless-tools-devel installed. It means that the header iwlib.h exists in /usr/include Please help .. thanks in advance Amin BEN ABDALLAH

2 1

huntgroups & Calling-Station-ID
by tnt＠kalik.co.yu 26 Feb '07

26 Feb '07

We have a problem with filtering users from a telco exchange that isn't sending us CallerID's. We have on-line account opening, and all new accounts have 5 hours access. Users with full CallerID's are easily stopped from abusing the system and using extra accounts. If the exchange isn't sending full Calling-Station-ID, but only 4 or 5 numbers we can filter the users by using hungroups: goodone Calling-Station-ID = 12345, User-Name = gooduser SQL-Group = dial (this will let that user connect) banthem Calling-Station-ID = 12345 SQL-Group = reject (this will stop all others) What can we do when NAS doesn't have any Calling-Station-ID to send? Ivan

2 4

Re: Installing Error
by Erol Toksöz 26 Feb '07

26 Feb '07

İt does not produce any error. Configure proccess does not recognize that gcc-3.46 is installed, only says that there is no gcc installed. ---------------------------------------------------------------------------- -------------- Date: Thu, 22 Feb 2007 17:11:03 +0200 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: ?nstalling error To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200702221711.03940.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-9" On Thu 22 Feb 2007 09:21, Erol Toks?z wrote: > Hi, > > I am trying to install Freeradius server on my SUN Solaris 2.8 unix > server. After installed gcc.2.95. During ./configure it gives error below > > .... > .... > checking for gmake... no > checking for make... /usr/ccs/bin/make > configure: error: GNU Make is not installed. Please download and install > it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing. > > > I visited this site and found make.3.81 but it needs gcc3.46 or higher > version. > But freeradius installer doesn't like gcc3.46. I am happily compiling with many different gcc versions. My notebook runs gcc-4.1.3 for example. What error message did you receive with gcc-3.46? ---------------------------------------------------------------------------- -------------------------------------- Erol Toksöz Araştırmacı TÜBİTAK MAM Bilişim Teknolojileri Enstitüsü Tel: +90(262)677 2625 Fax:+90(262)646 3187 <mailto:erol.toksoz@bte.mam.gov.tr> www.mam.gov.tr

2 1

Latest CVS - compilation error - conffile.c:902: error: conflicting types for 'cf_section_parse'
by tzieleniewski 26 Feb '07

26 Feb '07

Hi ! I tried to install the latest cvs version of freeradius, I did make clean ./configure make - and here I got the following error: conffile.c:902: error: conflicting types for 'cf_section_parse' /home/radius/src/radiusd/src/freeradius-devel/conffile.h:56: error: previous declaration of 'cf_section_parse' was here conffile.c: In function 'cf_section_parse': conffile.c:933: warning: passing argument 1 of 'cf_section_parse' discards qualifiers from pointer target type conffile.c: In function 'cf_pair_find': conffile.c:1312: warning: assignment discards qualifiers from pointer target type conffile.c: In function 'cf_pair_find_next': conffile.c:1395: warning: passing argument 1 of 'cf_pairtoitem' discards qualifiers from pointer target type make[4]: *** [conffile.lo] Błąd 1 make[3]: *** [common] Błąd 2 make[2]: *** [all] Błąd 2 make[1]: *** [common] Błąd 2 make: *** [all] Błąd 2 I have never had such problem before. What did I miss?? Bests -Tomasz

2 1