- Freeradius-Users - lists.freeradius.org

dailup admin and badusers
by jerrrry＠voila.fr 30 Dec '06

30 Dec '06

hi, i don't understand why dialup admin need its own sql table "badusers" and a script to get bad logins whereas rejected users can be found in the freeradius table "radpostauth" ? Regards, Thomas

3 2

Possible to define range of users?
by Ran Shenhar 29 Dec '06

29 Dec '06

Hi All, I was wondering if the users file can hold some definition for a group of users, for example users with IP 192.168.1.*? I've seen the group example (http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_spec ific_user.2C_or_group_of_users.3F), but didn't understand if that also helps to my case. I've also seen http://www.freeradius.org/doc/users.5.html and the =~ for regex, but trying to use that with a User-Name attribute (User-Name =~ 10.100.0.*, Auth-Type := Local, User-Password == "my pass"), the config file couldn't be parsed, with this message: /usr/local/etc/raddb/users-grande-ATM[1]: Parse error (check) for entry User-Name: expecting '=' /usr/local/etc/raddb/users[6]: Could not open included file /usr/local/etc/raddb/users-grande-ATM: Success Errors reading /usr/local/etc/raddb/users radiusd.conf[1035]: files: Module instantiation failed. Am I missing something here, or is this not supported? TIA,

1 0

Repost: Properly using the := and = operators?
by Mike 29 Dec '06

29 Dec '06

Dear list, I'm having a hard time learning how to use the attribute properties correctly in my mysql/radius database and my test enviroment is freeradius 1.1.3 / debian etch. What I'm trying to do is to establish a 'suspended' user group which receives a Framed-IP-Address attribute of 10.10.0.2+, and which overrides any previously assigned Famed-IP-Address, if present. I know that group processing is happening, because I can add attributes to the suspended group and my test user gets those attributes. I am adding the Framed-IP-Address attribute in the radreply table, but it is not being overwritten from the one set by radgroupreply. If I remove this from radreply, then the ip assigned in suspended group is applied. If I change the one in radgroupreply to use the += operator, then it returns both ip addresses in the reply. But I can't seem to get := to overwrite like the docs says it does. Here is a dump of my sample sql tables: mysql> select * from radcheck ; +----+----------+---------------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-----------------+ | 2 | joe.user | User-Password | == | ididntpaymybill | +----+----------+---------------+----+-----------------+ mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup ; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupcheck ; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 3 | dynamic | Framed-Protocol | == | PPP | | 4 | suspended | Framed-Protocol | == | PPP | +----+-----------+-----------------+----+-------+ mysql> select * from radgroupreply ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ | | 7 | dynamic | Framed-IP-Address | := | 255.255.255.255 | +----+-----------+-------------------+----+-----------------+ Here is the results of running radtest on this user: > radtest joe.user ididntpaymybill localhost 0 testing123 Sending Access-Request of id 140 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=140, length=32 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255 What I am trying to accomplish is simply to allow us to put overdue users into the 'suspended' group, which will hand out a different set of ip addresses than their normal non-suspended configuration. I realise I could be approaching this all wrong but right now I simply set those items (framed-ip-address, framed-route, and etc) in the radreply table and I don't want to remove those items from the database, just override them. Any pointers would be greatly appreciated. Mike- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 3

Freeradius, MySQL and unique accounting records.
by Mark J Elkins 29 Dec '06

29 Dec '06

I'm getting multiple "accounting_start_query" records in my "radacct" table. When a "Stop" arrives, each gets the same accounting info (time online, bytes in, bytes out - etc)... However - when I run SQL queries - I do not get true stats - which is a problem. My "accounting_start_query" are stock standard (I'm running an oldish version of radius though). What is happening is that I'm getting multiple Start Records - and logging each one. accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'ade8e732c3a7aef6', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:25', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '0', '0'); INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'ade8e732c3a7aef6', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:29', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '5', '0'); INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'e71dbe474c39274d', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:35', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '15', '0'); INSERT into radacct_rad2 (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('7/0/3/5.117_18EB0F13', 'db5198a07e9ebe18', 'scubaw(a)pop.co.za', 'pop.co.za', '196.43.27.19', '1929707637', 'Virtual', '2006-12-20 06:03:39', '0', '0', 'RADIUS', 'AutoShapedVC', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '41.242.241.194', '10', '0'); [the stop record] UPDATE radacct_rad2 SET AcctStopTime = '2006-12-20 06:37:09', AcctSessionTime = '2040', AcctInputOctets = '2371574', AcctOutputOctets = '93521334', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = 'AutoShapedVC' WHERE AcctSessionId = '7/0/3/5.117_18EB0F13' AND UserName = 'scubaw(a)pop.co.za' AND NASIPAddress = '196.43.27.19'; The Acct-Delay-Time is different for each record - increases by 5 seconds - etc. So what do people do to maintain accurate accounting records? For example - to get the current monthly data-in+out total for an individual - I run.... MBYTE=$(mysql -u$USR -p$SQLPASS -h$DBHOST -B --skip-column-names $DB -e \ "SELECT ROUND(SUM((AcctInputOctets + AcctOutputOctets)/1048576)) FROM radacct WHERE AcctStartTime > '$monthstart' AND username = '$username@$realm'") Currently - this is quite quick - but would give me the wrong results for the above! What about making the column "AcctSessionId" unique? (somehow) - or maybe a new column which contains AcctSessionId, UserName and NASIPAddress - or what do people suggest? -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

PEAP+PAM or MySQL possible?
by Matt Goebel 28 Dec '06

28 Dec '06

I'd like to move to WPA Enterprise EAP/PEAP from EAP/TLS. That way there are no client certificates to deal with and I can instead just use usernames/passwords. I don't, however, want either OpenLDAP or AD to do it. Both would be overkill for my needs and just add an extra layer to maintain. Instead I want to use either PAM or MySQL in their place. Is this even possible? If so how? I haven't seen any documentation that definitively explains this one way or another. Testing I'm able to successfully authenticate using the radtest program. From a client (both Windows and Linux) I get invalid username/password errors. Debug mode I see the username being passed correctly along with other information but no password, encrypted or otherwise. Maybe this is by design? I haven't seen what working PEAP debug messages look like so I have no frame of reference.

2 1

RE: FreeRadius overview
by David Covert 28 Dec '06

28 Dec '06

Ok, I almost get it... question: The mssql.conf file has an entry like this: #Database table configutation radius_db = "radius" I assume that "radius" refers to a pre-determined schema that freeRadius assumes the auth db is going to use. Thing is, I want to reference a different schema, one that is used by my current customer care system (Platypus). Can I refer to a different schema? If so, where do I go to define it? Does anyone happen to know if a Platypus schema already exists? Or would I be better off to write triggers in my current Platypus db to copy data from various tables to the radius tables every time a customer record is updated? Thank you for your time, Dave Covert I am serious... and don't call me Shirley! _____ From: freeradius-users-bounces+dcovert=erfwireless.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+dcovert=erfwireless.com@lists.freeradiu s.org] On Behalf Of Hernan Antolini Sent: Thursday, December 28, 2006 11:29 AM To: FreeRadius users mailing list Subject: Re: FreeRadius overview David, start with "rlm_sql" at source_directory/doc, check also your sql.conf in your installation etc/raddb directory....it help me also this one to start http://www.frontios.com/freeradius.html (for mysql). I hope it helps....if you're about using ms-sql check also "mssql" at source_directory/doc. Regards freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on 12/28/2006 01:37:51 PM: > > I have gotten freeRadius working with a mikrotik NAS using the users > flat file (hooray for me! <g>). Now I need to have the freeRadius server > reference a MS-SQL db server rather than the users file on the > freeRadius server. I am quite fuzzy about the process tho. I am hoping > for some basic edukashun. > > How do you tell freeRadius to reference an external MS-SQL db rather > than the local users flat file? > How do you issue the query to the db? (what file contains the connection > string and query) > How do the returning fields get mapped into RADIUS attributes? (what do > you do when the db calls the field "uname" and RADIUS calls it > "user-name") > > Thank you for your time, > Dave Covert > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Very big user database (solved)
by Felipe Neuwald 28 Dec '06

28 Dec '06

Oops, sorry.. solved: [root@mercury /usr/local/etc/raddb]# cat sql.conf | grep num_sql_socks num_sql_socks = 15 Increased from 5 to 15. Thanks, Felipe. ------------------- Hi folks, I put to work our new freeradius server, and I'm getting this message on my /var/log/radius.log: Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Our user database is big, something about 120k users. Does anybody knows how to solve this problem? Thank you, Felipe Neuwald.

1 0

NAS support for disconnect methods
by Daniel Lark 28 Dec '06

28 Dec '06

I am in the process of developing a generalized disconnect methodology for disconnects. While I know definitely that Cisco NAS with an IOS => 12.1 will support POD, does anyone out there know what equipment supports disconnects through SNMP or POD. I have equipment all over the map and need to plan accordingly. Obviously radkill is my ultimate back-up ;-) Thanks! _ _____ Daniel Lark Applications Developer Spirit Telecommunications 1500 Hampton St., Suite 101 Columbia, SC 29201 (803) 726-4755

2 1

Very big user database
by Felipe Neuwald 28 Dec '06

28 Dec '06

Hi folks, I put to work our new freeradius server, and I'm getting this message on my /var/log/radius.log: Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Dec 28 15:47:15 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Our user database is big, something about 120k users. Does anybody knows how to solve this problem? Thank you, Felipe Neuwald.

1 0

FreeRadius overview
by David Covert 28 Dec '06

28 Dec '06

I have gotten freeRadius working with a mikrotik NAS using the users flat file (hooray for me! <g>). Now I need to have the freeRadius server reference a MS-SQL db server rather than the users file on the freeRadius server. I am quite fuzzy about the process tho. I am hoping for some basic edukashun. How do you tell freeRadius to reference an external MS-SQL db rather than the local users flat file? How do you issue the query to the db? (what file contains the connection string and query) How do the returning fields get mapped into RADIUS attributes? (what do you do when the db calls the field "uname" and RADIUS calls it "user-name") Thank you for your time, Dave Covert

5 5