- Freeradius-Users - lists.freeradius.org

Freeradius + DHCP server ?
by Rafał Kamiński 23 Jan '07

23 Jan '07

Hi, Is it works ? If yes, can somebody tell me how i can do that ? My users is auth. and i want get him some address IP. BR -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

5 9

RE: Access-Accept ONLY on every second try
by Miguel Reategui 23 Jan '07

23 Jan '07

Thanks for your reply Alan, I believe I found the problem and I will describe it here as it might help others Looks like for some reason the only access-request that was issued, was being resent endlessly: The block below would be repeated 192 times (I don't know why) each time adding one more Proxy-State line <log> modcall[authorize]: module "sql" returns ok for request {/*1 to 192* ) modcall: leaving group authorize (returns updated) for request (/*1 to 192*/) Sending Access-Request of id (/*1 to 192*/ to xx.xx.xx.xx8 port 1812 User-Name = "18xxxxxxxx" User-Password = "xeexxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Proxy-State = 0x313230 Proxy-State = 0x30 Proxy-State = 0x31 Proxy-State = 0x32 Proxy-State = 0x33 </log> Finally the authentication realm would be marked as DEAD for each request <log> marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 2. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 3. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 4. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 5. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 6. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead Server rejecting request 7. marking authentication server 66.46.144.238:1812 for realm xxx.xx dead {go on until all requests would be dead} </log> As this realm was marked dead, the next request (the second one) would go through another (default?) realm and this time, it would work normally. So, I took the proxy.conf file and commented out the offending realm information, forcing the "first request" to go to the next realm (default?) and it worked!!! I still need to see what I might be affecting as this is probably a Hack I hope this makes sense to someone....actually I got the idea from checking an old mailing list archived message about missing proxies Thanks to everyone, Mig

2 1

Rewrite accounting request/Proxy-To-Realm
by Rohaizam Abu Bakar 23 Jan '07

23 Jan '07

i) How rewrite accounting request to insert certain attribute in order for billing engine to process futher.?? ii) Tried to set Proxy-To-Realm to force proxy accounting using rlm_perl.. But failed... $RAD_REPLY{'Proxy-To-Realm'} = "infranet2"; --haizam

1 0

Proxy accounting after query LDAP
by Rohaizam Abu Bakar 23 Jan '07

23 Jan '07

FR: freeradius-1.1.2 OD: FreeBSD 6.0 trying to query LDAP for certain attribute.. if found, then proxy accounting to other server if not store accounting locally. trying using rlm_perl as below:- i) radiusd.conf perl y5perl { module = /usr/local/etc/raddb/y5perl.pl } accounting { ...... y5perl } ii) y5perl.pl sub accounting { # For debugging purposes only &log_request_attributes; # You can call another subroutine from here &test_call; &wifi_infranet; return RLM_MODULE_OK; } sub wifi_infranet { ## some code to query ldap for attribute A if (A) { ## What should i put here to force proxy accounting to other server?? } Any other method?? TQ.. --haizam

1 2

match client's shortname in huntgroups file
by Jakob Hirsch 23 Jan '07

23 Jan '07

Hi, is there an easy/good way to determine the huntgroup depending on the the shortname from clients.conf? We have more than 100 clients configured (with a "ProviderLocationCounter" pattern), so the information is duplicated in the huntgroups file (multiple times, as the huntgroup is also determined by Called-Station-Id). So it would really simplify things to have the shortname available for matching in the huntgroups file. I could extend one of our custom modules to put the name into a VSA and use that like 'Client-Shortname == "blub"' (already did it in a test environment and it works fine), but that seems a little clumsy to me, so I wondered if there's an easier way. unrelated side note: As I see, client_find() walks linearly through the client list. Shouldn't we keep this in a more appropriate data structure, like a btree or a trie, and/or save the once found RADCLIENT* pointer in the REQUEST struct? I understand that it doesn't matter for most installations (and we don't have any performance problems, either), it just does not feel right to waste so many cpu cycles :) regards, J

3 2

3ComSwitch Login
by Alexandre Soares 23 Jan '07

23 Jan '07

Hi All, Sorry team, but I still problem to authenticate a valid Administrator User in 3Com Swithc, my question is anyone implemented this feature ? I really don't know where to start the solution in freeradius

4 5

Freeradius(.net) and Oracle
by Brian Atkins 22 Jan '07

22 Jan '07

I am working on setting up a wireless hotspot using Chillispot on DD-WRT. I have installed Freeradius on a W2K server that runs an Oracle database. After reading the documentation and various howtos, I wanted to see if someone could offer some pointers on authenticating to Oracle using a pre-existing database and not the db/tables built from the sql file in the example docs. For example: I have a list of users listed in the database as 'barcode' (20 Char) and the password is stored in plain text as 'pin' (4 Char). I don't care about updating or creating users through Freeradius nor do I care about accounting (simultaneous connections). The defaults in the oraclesql.conf are: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM \ ${authcheck_table} WHERE Username = '%{SQL-User-Name}' ORDER \ BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM \ ${authreply_table} WHERE Username = '%{SQL-User-Name}' ORDER \ BY id" Which I assumed might be able to be trimmed down to: authorize_check_query = "SELECT barcode,pin FROM ${authcheck_table} \ WHERE barcode = '%{SQL-User-Name}'" Am I incorrect in this assumption? Thanks, Brian

3 2

Access-Accept ONLY on every second try
by Miguel Reategui 22 Jan '07

22 Jan '07

Greetings Listers, On testing a development FreeRadius Server we found out that everything is working, except that the Access-Accept comes only on every second attempt (!) As we can safely discard all network and database problems, I wonder if there is a flag that is being set on the first attempt that allows the second one to work. But how about the third attempt? It will fail and then the fourth will go in. Has anyone experienced something similar? Any tips? Configuration specs: - FreeRADIUS Version 1.1.2, for host - Oracle DB - All settings are kept as default - Running modes tried * radiusd -X * radiusd -xxyz -l stdout * radiusd - Only problem seems to be this one rlm_sql (sql): Couldn't insert SQL accounting STOP record - ORA-00001: unique constraint (FREE_RADIUS.IDX_RADACCT_SESSIONID_UNIQUEID) violated Thanks in advance - Mig

2 1

Read root certificates....
by Polyxronopoulos Adreas 22 Jan '07

22 Jan '07

Hi list , Is it possible for a client-user when he/she tries to connect to the network over freeradius to read the root certificates of freeradius? Does the root-certificates stored somewhere on the users machine? thanks ___________________________________________________________ Yahoo! Messenger - with free PC-PC calling and photo sharing. http://uk.messenger.yahoo.com

2 3

Cisco-AVpair rate-limit attributes
by satish patel 22 Jan '07

22 Jan '07

Dear all i have cisco VPDN with freeradius ( 1.1.4 ) on Suse 10.2 my users connect throgh the xp client useig vpn connection and useing Internet Services but now thing is that i wann restrict user base bandwidth means i want to set bandwidth 64kbps for user1 and 128 kbps for user2 so is it possible through the Cisco-Avpair attributes. i have find lots of document regarding cisco-AVpair attributes then i test it on my network but i dont know it will working or not my test exmple #cat /etc/raddb/users DEFAULT Service-Type := Framed-User Framed-Protocol = PPP, Cisco-Avpair = "lcp:interface-config#1=rate-limit output 512000 10000 10000 conform-action continue exceed-action drop" This rate-limt use for output what about input what rate-limit direction i use for it and how to verifying is it ok or not Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 8