- Freeradius-Users - lists.freeradius.org

Reset sql counter
by Bishal 24 Dec '06

24 Dec '06

Is it possible to reset the sql counter manually or by any scripts in freeradius?

2 1

radius+mysql weird problem
by Jorge Minassian - Comintec 23 Dec '06

23 Dec '06

Hello all !, After upgrading Fedora from FC2 to FC4, I got what is described below from log (radiusd -X) If I query database manually, I get all info about users (all users are correctly on DB), but radius still says "No matching entry in the database ...". If using "files", it works OK. I tried to downgrade DB (from 4.1 to 3.23), also reinstal freeradius from rpm or compiled by me, but problem persists. Have someone any ad about this ?. I will apreciate any help to troubleshoot this problem !. Thank you very much, Jorge. ---- Ready to process requests. rad_recv: Access-Request packet from host localhost:56607, id=27, length=55 User-Name = "000" User-Password = "1234" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "000", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: '000' rlm_sql (sql): sql_set_user escaped user --> '000' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '000' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '000' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '000' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '000' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [000] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [000/1234] (from client gabriel port 1) Sending Access-Reject of id 27 to localhost:56607 Finished request 0 Going to the next request

2 2

dialup admin coding - help required
by Cory Robson 22 Dec '06

22 Dec '06

Ok I have tried and tried to get this to work how I want but obviously need more sleep, not being a code genius and trying to learn this mix and mash is confusing enough. Anyway this is my code for my failed login page, my sql query does parse all information into the array ok but I just cannot seem to get it to output on screen. Any way here is what I have so far anyone able to assist in showing me where I'm going wrong. <?php require('../conf/config.php3'); ?> <html> <?php if (is_file("../lib/sql/drivers/$config[sql_type]/functions.php3")) include_once("../lib/sql/drivers/$config[sql_type]/functions.php3"); else{ echo <<<EOM <title>Failed logins</title> <link rel="stylesheet" href="style.css"> </head> <body bgcolor="#80a040" background="images/greenlines1.gif" link="black" alink="black"> <center> <b>Could not include SQL library functions. Aborting</b> </body> </html> EOM; exit(); } $now = time(); $start = $now - ($last*60); $now_str = date($config[sql_full_date_format],$now); $prev_str = date($config[sql_full_date_format],$start); ?> <head> <title>Failed Logins</title> <link rel="stylesheet" href="style.css"> </head> <body bgcolor="#80a040" background="images/greenlines1.gif" link="black" alink="black"> <center> <table border=0 width=550 cellpadding=0 cellspacing=0> <tr valign=top> <td align=center><img src="images/title2.gif"></td> </tr> </table> <table border=0 width=400 cellpadding=0 cellspacing=2> </table> <br> <table border=0 width=840 cellpadding=1 cellspacing=1> <tr valign=top> <td width=65%></td> <td bgcolor="black" width=35%> <table border=0 width=100% cellpadding=2 cellspacing=0> <tr bgcolor="#907030" align=right valign=top><th> <font color="white">Failed Logins</font>  </th></tr> </table> </td></tr> <tr bgcolor="black" valign=top><td colspan=2> <table border=0 width=100% cellpadding=12 cellspacing=0 bgcolor="#ffffd0" valign=top> <tr><td> <?php echo <<<EOM EOM; ?> <p> <table border=1 bordercolordark=#ffffe0 bordercolorlight=#000000 width=100% cellpadding=2 cellspacing=0 bgcolor="#ffffe0" valign=top> <tr bgcolor="#d0ddb0"> <th>#</th><th>login</th><th>Password</th><th>Time</th><th>Terminate cause</th><th>Caller ID</th> </tr> <?php $link = @da_sql_pconnect($config); $search = @da_sql_query($link,$config, "SELECT id, user,pass,reply,date,callingid FROM radpostauth ORDER BY date;"); $num = 0; *// Here is where my array collects the records - This is working *// while( $row = @da_sql_fetch_array($search,$config) ){ $num++; $acct_login = $row[user]; $acct_password = $row[pass]; $acct_terminate_cause = $row[reply]; $acct_time = $row[date]; $acct_callingid = $row[callingid]; } ?> *// Here is my screen output, obviously I need to loop through the array and output the lines but just can't figure it out. *// <tr align=center bgcolor="white"> <td>$num</td> <td>$acct_login</td> <td>$acct_password</td> <td>$acct_time</td> <td>$acct_terminate_cause</td> <td>$acct_callingid</td> </tr> </table> </td></tr><tr><td> </td></tr> </table></td></tr></form> </table> </tr> </table> </body> </html>

3 2

User authentication using Mysql table - radacct
by N S 22 Dec '06

22 Dec '06

I have the radacct table populated with a few users. But the radius is not checking this table for user info. The only users being allowed/authenticated are those that are in the users.conf file.How do I make the radius look for the user info in the mysql database. Thanks. _________________________________________________________________ Type your favorite song. Get a customized station. Try MSN Radio powered by Pandora. http://radio.msn.com/?icid=T002MSN03A07001

5 11

Re: Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

Alan, Thank you very much for the information. What I am looking for is to allow a user ("bob") to authenticate from any system he uses UNLESS that system is blocked from authenticating. I mean "bob" could authenticate from "server1" but not from "server2" - restricting it (somehow) by the IP address of the source - not by the user account. Nobody could authenticate from "server2" - anyone could authenticate from "server1" (with valid credentials). It seems that AIX RADIUS cannot do this - can FreeRADIUS? Someone else suggested using IPTables to not allow "server2" to talk to the RADIUS server - but I thought that the communication was from the firewall to the RADIUS server, not from the user system (although I will be looking into this). Anyway - to recap/summarize: Can FreeRADIUS be configured to allow/disallow authentication based on the source IP address that the user is coming from and NOT the user account itself (allowing "bob" to authenticate from "server1" which is not 'banned', but not allowing "bob" to authenticate from "server2" which is 'banned')? And, if so - how? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 12:48:50 PM Subject: Re: Questions from a totally ignorant n00b Gene Mosley wrote: > Alan, > Could you perhaps give me a hint about how one would go about > allowing any user from any system (_unless_ that system is listed for > the specific purpose of not allowing anyone to authenticate from it) to > authenticate? You've phrased the problem in a very complicated way. By default, any user is allowed to authenticate from any NAS. You don't have to do anything to enable this behavior. If you want NO ONE to authenticate from a particular NAS, then don't list the NAS IP address in clients.conf. If you want only SOME people to authenticate from a particular NAS, see the FAQ. http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_specific… Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

no DB handles ,How to solve this ?
by 梁增辉 21 Dec '06

21 Dec '06

hi all I've seen many of these messages in the radius.log (I am using freeradius 1.1.1 mysql version :5.1.11) There are no DB handles to use! skipped 0, tried to connect 0 There are no DB handles to use! skipped 0, tried to connect 0 There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? -------------- liangzh 2006-12-21

2 1

Re: Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

Alan, Could you perhaps give me a hint about how one would go about allowing any user from any system (_unless_ that system is listed for the specific purpose of not allowing anyone to authenticate from it) to authenticate? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 11:47:47 AM Subject: Re: Questions from a totally ignorant n00b Gene Mosley wrote: > Users are authenticating from systems that they should not be > authenticating from - we need to block authentication on a per system > (IP address) basis, not a per user basis. You can do this in FreeRADIUS. Put users into different groups, and block the group from accessing particular systems. > Users should be allowed to authenticate from any system that they are > using _except_ a certain, specific list of IP addresses which would > basically be banned/blocked from authenticating. This can be done, too. > Is this something that FreeRADIUS can do? Yes. > I just started reading about it - and if nothing else it looks like > exec-program-wait might be used to test the IP address and return an > authentication failure? That will work, too, but will be less efficient. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

I thought that the user system only talked to the firewall/nas and that it talked to the RADIUS server? I mean, I thought that using IPTables on the RADIUS server would not work because only the firewalls ever communicated with it directly - am I worng about this? ----- Original Message ---- From: Jan Mulders <lastchancehotel(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 11:46:44 AM Subject: Re: Questions from a totally ignorant n00b Freeradius can do this, I believe (please correct me if I'm wrong, List). However, you might want to consider firewalling those certain addresses on your radius server so authentication/accounting packets never reach your existing radius server daemon. Look into iptables, it should be fairly easy to do. It'd also save what is probably an unnecassary change of software for your purposes! Hope this helps, Jan On 21/12/06, Gene Mosley <freeradius(a)mosleyfamily.org> wrote: I am currently running RADIUS under AIX (the AIX version of RADIUS) and having a problem. It appears that the AIX RADIUS cannot be configured to work around this problem. I was wondering if switching to FreeRADIUS would help? The problem is this: Users are authenticating from systems that they should not be authenticating from - we need to block authentication on a per system (IP address) basis, not a per user basis. Users should be allowed to authenticate from any system that they are using _except_ a certain, specific list of IP addresses which would basically be banned/blocked from authenticating. Is this something that FreeRADIUS can do? I just started reading about it - and if nothing else it looks like exec-program-wait might be used to test the IP address and return an authentication failure? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

I am currently running RADIUS under AIX (the AIX version of RADIUS) and having a problem. It appears that the AIX RADIUS cannot be configured to work around this problem. I was wondering if switching to FreeRADIUS would help? The problem is this: Users are authenticating from systems that they should not be authenticating from - we need to block authentication on a per system (IP address) basis, not a per user basis. Users should be allowed to authenticate from any system that they are using _except_ a certain, specific list of IP addresses which would basically be banned/blocked from authenticating. Is this something that FreeRADIUS can do? I just started reading about it - and if nothing else it looks like exec-program-wait might be used to test the IP address and return an authentication failure?

3 2

Multiple ISPs and big user database
by Felipe Neuwald 21 Dec '06

21 Dec '06

Hi Folks, My MySQL database is working ok, thank you all of you guys. More one problem: I have two ISPs here, each one with 3 NAS IP addresses: ISP1: NAS 1: 10.1.1.1 NAS 2: 10.1.1.2 NAS 3: 10.1.1.3 ISP2: NAS 1: 10.2.2.1 NAS 2: 10.2.2.2 NAS 3: 10.2.2.3 And my radcheck table is like this: id: (incremental) username: the user name attribute: (always Password) op: (always ==) value: the password isp: (can be 1 or 2) A simple example: id: 33934 username: john attribute: Password op: == value: smith isp: 1 The question is. When a user come from ISP1, can I pass one SQL paramether, and whan a user come from ISP2, can I pass other SQL paramether? Thanks, Felipe Neuwald.

2 2