- Freeradius-Users - lists.freeradius.org

problem with mysql accounting
by basile 21 Dec '06

21 Dec '06

hi i try to account with mysql here are the mysql start stop and update definition accounting_start_query = "INSERT into radaact SET\ `User-Name` = '%{User-Name}',\ `Calling-Station-Id` = '%{Calling-Station-Id}',\ `Called-Station-Id` = '%{Called-Station-Id}',\ `NAS-IP-Address` = '%{NAS-IP-Address}',\ `NAS-Port` = %{NAS-Port},\ `Timestamp Start` = NOW(),\ `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}' " accounting_update_query = "UPDATE radaact SET\ `Acct-Session-Time` = '%{Acct-Session-Time}',\ `Acct-Input-Octets` = '%{Acct-Input-Octets}',\ `Acct-Output-Octets` = '%{Acct-Output-Octets}',\ `Acct-Input-Packets` = '%{Acct-Input-Packets}',\ `Acct-Output-Packets` = '%{Acct-Output-Packets}'\ WHERE `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}'\ LIMIT 1 " accounting_stop_query = "UPDATE radaact SET\ `Timestamp Stop` = NOW(),\ `Acct-Session-Time` = '%{Acct-Session-Time}',\ `Acct-Input-Octets` = '%{Acct-Input-Octets}',\ `Acct-Output-Octets` = '%{Acct-Output-Octets}',\ `Acct-Input-Packets` = '%{Acct-Input-Packets}',\ `Acct-Output-Packets` = '%{Acct-Output-Packets}',\ `Acct-Terminate-Cause` = '%{Acct-Terminate-Cause}'\ WHERE `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}'\ LIMIT 1 " update works fine rlm_sql (sql): sql_set_user escaped user --> 'xxxx' radius_xlat: 'UPDATE radaact SET??`Acct-Session-Time` = '292',??`Acct-Input-Octets` = '94237',??`Acct-Output-Octets` = '937628',??`Acct-Input-Packets` = '597',??`Acct-Output-Packets` = '816'?WHERE `Acct-Unique-Session-Id` = '814b38bc0e9c60f4'?LIMIT 1 ' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: '' rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sql" returns ok for request 61 modcall: leaving group accounting (returns ok) for request 61 but start and stop not rlm_sql (sql): sql_set_user escaped user --> 'yyyy' radius_xlat: 'INSERT into radaact SET ' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): Couldn't insert SQL accounting START record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 59 modcall: leaving group accounting (returns ok) for request 59 rlm_sql (sql): sql_set_user escaped user --> 'yyyy' radius_xlat: 'UPDATE radaact SET ' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): Couldn't update SQL accounting STOP record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 rlm_sql (sql): Released sql socket id: 3 modcall[accounting]: module "sql" returns fail for request 60 modcall: leaving group accounting (returns fail) for request 60 i use mysql 4.1 , freeradius 1.1 thanks for help basile

3 2

Re: Huntgroups, Users and Proxy
by Walt Reynolds 21 Dec '06

21 Dec '06

Just checking back to see if anyone can let me know if I am on the right track. Thanks. -------- Original Message -------- Subject: Re: Huntgroups, Users and Proxy Date: Wed, 13 Dec 2006 15:17:44 -0500 From: Walt Reynolds <waltr(a)umich.edu> To: freeradius-users(a)lists.freeradius.org > Date: Wed, 13 Dec 2006 08:05:32 +0000 > From: B Thompson <bt4(a)york.ac.uk> > Subject: Re: Huntgroups, Users and Proxy > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20061213080532.GA2261(a)grande.york.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Tue, Dec 12, 2006 at 04:23:43PM -0500, Walt Reynolds wrote: >> I am going in circles here and not getting anywhere. I will try to >> describe what I want to do starting with huntgroups. >> >> huntgroup: >> All NAS-IP-Address == 10.213.226.1 >> All NAS-IP-Address == 10.213.226.2 >> All NAS-IP-Address == 10.213.226.3 >> All NAS-IP-Address == 192.168.224.5 >> All NAS-IP-Address == 192.168.224.36 >> All NAS-IP-Address == 172.213.226.46 >> >> Bldg1 NAS-IP-Address == 10.213.226.1 >> Bldg1 NAS-IP-Address == 10.213.226.2 >> Bldg1 NAS-IP-Address == 10.213.226.3 >> Bldg1 NAS-IP-Address == 192.168.224.5 >> Bldg1 NAS-IP-Address == 192.168.224.36 >> >> Bldg2 NAS-IP-Address == 172.213.226.46 > > You can't have the same IP address in more than one huntgroup - See bug > #233. > > http://bugs.freeradius.org/show_bug.cgi?id=233 > > The solution is to use rlm_passwd instead. Ok, Thanks for that info. Now lets say I put each NAS in one huntgroup (I added the extra groups for possibilities. So lets say I have the following: UnitA NAS-IP-Address == 10.213.226.1 UnitA NAS-IP-Address == 10.213.226.2 UnitA NAS-IP-Address == 10.213.226.3 UnitB NAS-IP-Address == 192.168.224.5 UnitAB NAS-IP-Address == 172.213.226.46 TypeVPN NAS-IP-Address == 192.168.224.5 TypeGW NAS-IP-Address == 192.168.224.36 So this sets each NAS into a single group. The rest of my question I am still confused about. "UnitA" Authenticate with user(a)unita.generic.edu or Authenticate with Null Realm or Authenticate user(a)generic.edu But NOT user(a)unitb.generic.edu "UnitB" Authenticate with user(a)unitb.generic.edu or Authenticate with Null Realm or Authenticate user(a)generic.edu but NOT user(a)unita.generic.edu "UnitAB" Authenticate with user(a)unita.generic.edu or Authenticate with user(a)unitb.generic.edu or user(a)generic.edu or Null realm "TypeVPN" Authenticate ONLY with Null Realm "TypeGW" authenticate with Null realm or generic.edu So would I add the following to the users file: (Not sure about UnitAB and TypeVPN with Fall-Through = No. I think the rest is right though) DEFAULT Huntgroup-Name == UnitAB, User-Name =~ *(a)unita.generic.edu", Proxy-To-Realm := unita.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == UnitAB, User-Name =~ *(a)unitb.generic.edu", Proxy-To-Realm := unitb.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == UnitA, Proxy-To-Realm := unita.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == UnitB, Proxy-To-Realm := unitb.generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == TypeGW, Proxy-To-Realm := generic.edu Fall-Through = Yes DEFAULT Huntgroup-Name == TypeVPN, Proxy-To-Realm := NULL Fall-Through = No Then in the proxy.conf proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = yes } realm unita.generic.edu { type = radius authhost = radius.unita.generic.edu:1812 accthost = radius.unita.generic.edu:1813 nostrip } realm unitb.generic.edu { type = radius authhost = radius.unita.generic.edu:1812 accthost = radius.unita.generic.edu:1813 nostrip } realm generic.edu { type = radius authhost = LOCAL accthost = LOCAL strip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = radius.highered.edu:1812 accthost = radius.highered.edu:1812 secret = XXXX nostrip } Thanks. There are so many things our there that I got a little lost. I guess that is a problem with so many options and ways to do things. Sorry for the resend, but wanted the same subject for threading > -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438 -- Walter Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734)615-9438

1 0

sql and password
by jerrrry＠voila.fr 21 Dec '06

21 Dec '06

Hi, i'd like to athenticate user in ldap and put them in groups using sql. so i don't want to check their password in the radcheck table. my issue is that i don't see how not to check the password using the web GUI dialup admin ? thanks for your help regards jerrrry > Message du 21/12/06 à 08h56 > De : "Kostas Kalevras" > A : "FreeRadius users mailing list" > Copie à : > Objet : Re: Dialup admin Display users online (suggestion) > > Cory Robson wrote: > > >I am slowly getting around this interface and notice many things that could > >be improved upon but I'm lacking in the coding department. > > > >For example the user_finger.php page, this does a nice job once you have > >manually entered all of the pops into the separate naslist file but can > >become a royal pain to maintain. > > > >If someone could rewrite the code to extract the users online from the > >raddact table and simply group them by the independent nas's this would be a > >far simpler method. As you added additional pops to your range nothing to > >add/remove in the code, it simply regenerates as people log in from that > >pool. > > > > > If you are using sql to keep radius client info then you don't need to > do any extra work, since you already have your clients added in the > table for freeradius to function correctly. What you are suggesting > isn't a lot of work. The idea was to have more information than just the > ip of the nas server though (like description, ports available). In any > case it could be added as a configuration option > > >I have done a very similar thing with the failed logins page. Have the sql > >query dumping failed logins into the postauth table from the radius process > >and then have dialup admin failed logins script running an sql query against > >that table instead. Alas my coding is not that good so I'm not getting all > >records just the last one. Again help would be needed for me to finish this. > > > > > It's a nice thought. > > >Anyone up to the task to assist in this matter > > > > > > > >Regards > > > >Cory Robson > > > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

huntgroups, sql and dialup admin
by jerrrry＠voila.fr 21 Dec '06

21 Dec '06

hi, i configured freeradius using configuration files( user, huntgroups, clients, ...). it works great. now i 'd like to be able to manage my radius server with the web GUI dailup admin. my issue is that i don't see how i can put a nas ip in a huntgroup with this GUI. Can i have my nasip list / huntgroup in an sql DB to be able to manage it with dialup admin or can i only use the huntroups file ? with more than 400 nas it it could be usefull. thank you for your help, regards, jerrrry

1 0

Dialup admin Display users online (suggestion)
by Cory Robson 21 Dec '06

21 Dec '06

I am slowly getting around this interface and notice many things that could be improved upon but I'm lacking in the coding department. For example the user_finger.php page, this does a nice job once you have manually entered all of the pops into the separate naslist file but can become a royal pain to maintain. If someone could rewrite the code to extract the users online from the raddact table and simply group them by the independent nas's this would be a far simpler method. As you added additional pops to your range nothing to add/remove in the code, it simply regenerates as people log in from that pool. I have done a very similar thing with the failed logins page. Have the sql query dumping failed logins into the postauth table from the radius process and then have dialup admin failed logins script running an sql query against that table instead. Alas my coding is not that good so I'm not getting all records just the last one. Again help would be needed for me to finish this. Anyone up to the task to assist in this matter Regards Cory Robson

3 2

Re: Send atributes to the client
by fjlagos＠vtr.net 20 Dec '06

20 Dec '06

James: Can you send an example. Saludos y Gracias Francisco

2 1

attrs behind a realm
by Santiago Balaguer García 20 Dec '06

20 Dec '06

Hi people, I am using freeradius 1.0.4 for sereral years and I do proxy radius successfully with my roaming patners. However, now I have a roaming patner with the BABEL realm. So, when a BABEL user authenticates in my RADIUS I do proxy radius and BABEL radius server gives me the user attributes. Althought, I want to modify the "WISPr-Redirection-URL" of BABEL user by my value: http://www.akiwifi.es. I try to use attrs file and as I only want to modify BABEL realm. Any suggestion about how to do that?? Example: BABEL ME WISPr-Redirection-URL = http://some.web.com --> WISPr-Redirection-URL = http://akiwifi.es _________________________________________________________________ Prueba algunos de los nuevos servicios en línea que te ofrece Windows Live Ideas: tan nuevos que ni siquiera se han publicado oficialmente todavía. http://ideas.live.com

1 0

freeradius brake down
by S.L. 20 Dec '06

20 Dec '06

Hi, >What platform are you running on?Debian Sarge --------------------------Hirdetés----------------------------- Karib-szigeteki hajóút 194.800 Ft

1 0

ntlm fall-through
by Stieven.Struyf＠komatsu.eu 20 Dec '06

20 Dec '06

All, Does anyone know how i can configure ntlm fall-through, eg. try to authenticate the user local (via password entry in users file) and if the user isn't found use ntlm-auth(or first ntlm and afterwards userfile is also ok)? If i comment out the ntlm-auth line in the mschap section of radiusd.conf the user is authenticate local. I searched the archives and found the same question below, but no answer to the problem. Anyone who can help me with this? http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-August/0466… Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551

2 2

Send atributes to the client
by fjlagos＠vtr.net 20 Dec '06

20 Dec '06

Hello: What file i must set for send some atributes to a Radius client, for example, how can i send the VLAN for some user as soon as he was authenticated? In whish file i must set the attributes for a specific vendor like Juniper ERX atributes? Saludos y Gracias Francisco

2 1