- Freeradius-Users - lists.freeradius.org

RE: SQLcounter patch - Addition of reply-attribute
by Jonathan De Graeve 22 Oct '06

22 Oct '06

> That's really what multiple module are for. Have the sqlcounter > module return a special return code when the user is over the limit, > and use module failover to switch on that return code, and run another > module. Ok, any idea on the return code to be used? > > > - char *counter_name; /* Daily-Session-Time */ > > - char *check_name; /* Max-Daily-Session */ > > - char *key_name; /* User-Name */ > > + char *counter_name; /* Daily-Session-Time */ > > Why? Gratuitous whitespace changes don't belong in a patch. My bad, sorry > > > - if ((reply_item = pairfind(request->reply->vps, > > PW_SESSION_TIMEOUT)) != NULL) { > > + /* if ((reply_item = pairfind(request->reply->vps, > > PW_SESSION_TIMEOUT)) != NULL) { */ > > If you're changing code PLEASE do not leave the old code in > comments. It's confusing, and pointless. CVS will tell you what the > old code was. This practice is just unnecessary. This was for internal purposes only. I'll submit the patch in the form you want it to bugs.freeradius.org. I hope its compatible with the CVS code. J.

1 0

authenicate internet access through MACs
by Ali Jawad 22 Oct '06

22 Oct '06

Hi Ive got a debian router and a switch through which I provide internet access to some of the residents of my building...I want to implement a mechanism so that only the computers I specify can access the Internet...I could do it through squid but if I do so it would allow me only to restrict traffic going through port 80 what about Internet applications that use other ports such as ftp, smtp, yahoo and msn. I want to use a mechanism that allows me to authenicate PCs based on mac address and only those computers are allowed to access the internet. One particular solution could be blocking all access to the router unless the request have the source mac from an authorised PC..but I would prefer another approach if available...since Iam not going to operate the router..and the firewall script was written using VIM and the oprerator needs a web interface to operate the router. I ve got a freeradius server setup and running on the router with the dialup admin interface..I have done this setup previoulsy with pppoe and freeradius. I can not use pppoe this time..so I would like to know if there is a mechanism that allows me to redirect all the requests coming to the router through radius and access is granted upon the authenication info found in the radius database. I use to do that by loading radius.so each time a request to the pppoe server is made by including radius.so in the pppoe.options file..but I have no clue on how to do it this time. Any suggestions are welcome -- With Regards Ali Jawad

1 0

authenicate internet access through MACs
by Ali Jawad 22 Oct '06

22 Oct '06

Hi Ive got a debian router and a switch through which I provide internet access to some of the residents of my building...I want to implement a mechanism so that only the computers I specify can access the Internet...I could do it through squid but if I do so it would allow me only to restrict traffic going through port 80 what about Internet applications that use other ports such as ftp, smtp, yahoo and msn. I want to use a mechanism that allows me to authenicate PCs based on mac address and only those computers are allowed to access the internet. One particular solution could be blocking all access to the router unless the request have the source mac from an authorised PC..but I would prefer another approach if available...since Iam not going to operate the router..and the firewall script was written using VIM and the oprerator needs a web interface to operate the router. I ve got a freeradius server setup and running on the router with the dialup admin interface..I have done this setup previoulsy with pppoe and freeradius. I can not use pppoe this time..so I would like to know if there is a mechanism that allows me to redirect all the requests coming to the router through radius and access is granted upon the authenication info found in the radius database. I use to do that by loading radius.so each time a request to the pppoe server is made by including radius.so in the pppoe.options file..but I have no clue on how to do it this time. Any suggestions are welcome -- With Regards Ali Jawad

1 0

SQLcounter patch - Addition of reply-attribute
by Jonathan De Graeve 22 Oct '06

22 Oct '06

I just made a patch against 1.1.3 for the SQLcounter module. This patch allows to set the reply-name variable in the sqlcounter.conf file per instance. In this way the default behaviour of Session-Timeout can be overridden by your own reply-attribute. The system will set the session-timeout attribute if you omit the reply-name var in your config for backwards compatibility. I'm planning the following additions: The ability to override the reject behaviour with an accept but adding attributes. For example: if the user has reached his volume limit, accept the user but add speed-limitation attributes. <BEGIN OF PATCH> --- rlm_sqlcounter.c.orig 2006-10-21 23:18:04.147404980 +0200 +++ rlm_sqlcounter.c 2006-10-21 23:01:30.190552948 +0200 @@ -65,17 +65,19 @@ * be used as the instance handle. */ typedef struct rlm_sqlcounter_t { - char *counter_name; /* Daily-Session-Time */ - char *check_name; /* Max-Daily-Session */ - char *key_name; /* User-Name */ + char *counter_name; /* Daily-Session-Time */ + char *check_name; /* Max-Daily-Session */ + char *key_name; /* User-Name */ + char *reply_name; /* Authorized Reply, defaults to Session-Timeout */ char *sqlmod_inst; /* instance of SQL module to use, usually just 'sql' */ char *query; /* SQL query to retrieve current session time */ - char *reset; /* daily, weekly, monthly, never or user defined */ + char *reset; /* daily, weekly, monthly, never or user defined */ char *allowed_chars; /* safe characters list for SQL queries */ time_t reset_time; time_t last_reset; int key_attr; /* attribute number for key field */ int dict_attr; /* attribute number for the counter. */ + int reply_attr; /* attribute number for the authorized OK reply, defaults to Session-Timeout */ } rlm_sqlcounter_t; /* @@ -91,6 +93,7 @@ { "counter-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,counter_name), NULL, NULL }, { "check-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,check_name), NULL, NULL }, { "key", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,key_name), NULL, NULL }, + { "reply-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,reply_name), NULL, NULL }, { "sqlmod-inst", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,sqlmod_inst), NULL, NULL }, { "query", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,query), NULL, NULL }, { "reset", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,reset), NULL, NULL }, @@ -480,6 +483,27 @@ data->key_attr = dattr->attr; /* + * Discover the attribute number of the reply. + * If not set, set it to Session-Timeout + * for backward compatibility + */ + if (data->reply_name == NULL) { + DEBUG2("rlm_sqlcounter: 'reply' set to Session-Timeout for counter name %s",data->counter_name); + data->reply_attr = PW_SESSION_TIMEOUT; + } + else { + dattr = dict_attrbyname(data->reply_name); + if (dattr == NULL) { + radlog(L_ERR, "rlm_sqlcounter: No such attribute %s", + data->reply_name); + return -1; + } + data->reply_attr = dattr->attr; + DEBUG2("rlm_sqlcounter: Reply attribute %s is number %d", + data->reply_name, dattr->attr); + } + + /* * Check the "sqlmod-inst" option. */ if (data->sqlmod_inst == NULL) { @@ -666,11 +690,12 @@ res += check_vp->lvalue; } - if ((reply_item = pairfind(request->reply->vps, PW_SESSION_TIMEOUT)) != NULL) { + /* if ((reply_item = pairfind(request->reply->vps, PW_SESSION_TIMEOUT)) != NULL) { */ + if ((reply_item = pairfind(request->reply->vps, data->reply_attr)) != NULL) { if (reply_item->lvalue > res) reply_item->lvalue = res; } else { - if ((reply_item = paircreate(PW_SESSION_TIMEOUT, PW_TYPE_INTEGER)) == NULL) { + if ((reply_item = paircreate(data->reply_attr, PW_TYPE_INTEGER)) == NULL) { radlog(L_ERR|L_CONS, "no memory"); return RLM_MODULE_NOOP; } @@ -682,8 +707,8 @@ DEBUG2("rlm_sqlcounter: Authorized user %s, check_item=%d, counter=%d", key_vp->strvalue,check_vp->lvalue,counter); - DEBUG2("rlm_sqlcounter: Sent Reply-Item for user %s, Type=Session-Timeout, value=%d", - key_vp->strvalue,reply_item->lvalue); + DEBUG2("rlm_sqlcounter: Sent Reply-Item for user %s, Type=%d, value=%d", + key_vp->strvalue,data->reply_attr,reply_item->lvalue); } else{ char module_fmsg[MAX_STRING_LEN]; @@ -722,6 +778,7 @@ free(data->sqlmod_inst); free(data->counter_name); free(data->allowed_chars); + free(data->reply_name); allowed_chars = NULL; free(instance); </END OF PATCH> Enjoy this patch, J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

2 1

Decreasing connection time (Session-Timeout)
by micobros 22 Oct '06

22 Oct '06

Hello, I have a wisp solution working with mysql+freeradius and chillispot (ver 1.1) working pretty well together (bandwdth limit, user/password, connection time, etc.). But. there's one more thing I need. Lets say a user has 1 hour of connection time (Session-Timeout := 3600) and stays on the network for 20 minutes than disconnects. Chillispot is informed of this and sends freeradius an "Accounting-Request" message with "Acct-Status-Type=stop" attribute and "Acct-Session-Time=1200" attribute. Now, how could I subtract the elapsed time from the original Session-Timeout time? So that the user will, at the next login, only have 40minutes left. Cheers, mico "The only way to get rid of a temptation is to yield to it." (Oscar Wilde)

1 0

radutmp and/or SQL Accounting
by Matt Harlum 22 Oct '06

22 Oct '06

Hey guys, I've got my radiusd setup to work from an SQL Database for WPA Enterprise encryption, However i cannot get radutmp or SQL accounting to work, i'm running it on OSX 10.4.8 My Radiusd.conf is attached

2 3

EAP-TTLS problem at phase 1
by Rafiqul Ahsan 21 Oct '06

21 Oct '06

Hi all, I have been trying to figure this out for couple days, but could not get any clue. My test is about authentication with EAP-TTLS/MSCHAPV2. I am using freeradius v - 1.1.3, on Solaris 10. No matter what I do, I get "rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request" at the server. Anybody can help me what went wrong ? Here is my configs..and logs (truncated) Awaits some solution... Rafi Here is my eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { rsa_key_exchange = yes dh_key_exchange = no rsa_key_length = 1024 dh_key_length = 1024 verify_depth = 2 pem_file_type = yes private_key_password = "wimax i2 test certs" private_key_file = /etc/freeradius/etc/certs/key2.pem certificate_file = /etc/freeradius/etc/certs/cert2.pem CA_file = /etc/freeradius/etc/certs/cacert.pem dh_file = /etc/freeradius/etc/certs/dh random_file = /etc/freeradius/etc/certs/random fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } ttls { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no } peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } mschapv2 { } } Here is my users file : "testuser" Auth-Type := EAP, User-Password := "testuser" DEFAULT Auth-Type := EAP Here is my supplicant config : # cat supplicant.conf ctrl_interface=/var/tmp/supplicant.ctl eap_trace=1 enableWiMAXauth=1 validateFNECerts=1 checkCRL=1 ignoreTimeOfDay=0 update_config=0 data_interface=/var/tmp/supplicant_data.ctl ap_scan=0 fast_reauth=1 load_dynamic=/usr/lib/wpa_supplicant/eap_ttls.so network={ eap=TTLS eap_workaround=1 anonymous_identity="anonymous_identity" ca_path="/var/tmp/truststore" ca_cert="/var/tmp/root.crt" client_cert="/var/tmp/cpe.crt" private_key="/var/tmp/key" private_key_passwd="wimax i2 test certs" phase2="auth=MSCHAPV2" } Here is the radius log (only shown the failed part) rlm_fastusers: checking defaults^M fastusers: Matched DEFAULT at 6^M modcall[authorize]: module "fastusers" returns updated for request 1^M modcall: leaving group authorize (returns updated) for request 1^M rad_check_password: Found Auth-Type EAP^M auth: type "EAP"^M Processing the authenticate section of radiusd.conf^M modcall: entering group authenticate for request 1^M rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request^M rlm_eap: Failed in handler^M modcall[authenticate]: module "eap" returns invalid for request 1^M modcall: leaving group authenticate (returns invalid) for request 1^M

2 4

how to force "Accept" and override default and null proxy realms?
by Mike 21 Oct '06

21 Oct '06

I would like to always send an Accept unconditionally if the User-Name is test[0-9], but proxy request to default or null realm for all other user names. I tried a configuration with authorize { files suffix } the "suffix" will match on default and null realms. I currently have a line in users file that looks like this: DEFAULT User-Name =~ "test[0-9]", Auth-Type: Accept however regardless of which user makes the request, even the "test" user (which does match), the request is still proxied. If I change "Auth-Type: Reject", then the test user is always rejected, but I am looking for the opposite behavior. Thanks in advance for any help or pointers.

2 1

CVS make error
by Jan Mulders 20 Oct '06

20 Oct '06

Hello all, After much trouble I've managed to get CVS to download the right version of freeradius (not radiusd-cistron...doh), and now I'm having some problems with making it. >From what I can see, there's some problems with EAP (which I happen to not need). Is it possible (or even recommended) to remove EAP from the compilation process? If so, how do I go about doing this? Failing that, if somebody is feeling really nice they could code a fix for CVS :) Regards, Jan /root/installs/radiusd-cvs/radiusd/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c -fPIC -DPIC -o .libs/radeapclient.o radeapclient.c: In function `radlog': radeapclient.c:111: warning: implicit declaration of function `va_start' radeapclient.c:111: warning: nested extern declaration of `va_start' radeapclient.c:113: warning: implicit declaration of function `va_end' radeapclient.c:113: warning: nested extern declaration of `va_end' radeapclient.c: In function `log_debug': radeapclient.c:124: warning: nested extern declaration of `va_start' radeapclient.c:111: warning: redundant redeclaration of 'va_start' radeapclient.c:111: warning: previous implicit declaration of 'va_start' was here radeapclient.c:126: warning: nested extern declaration of `va_end' radeapclient.c:113: warning: redundant redeclaration of 'va_end' radeapclient.c:113: warning: previous implicit declaration of 'va_end' was here radeapclient.c: In function `radlog': radeapclient.c:106: warning: 'ap' might be used uninitialized in this function radeapclient.c: In function `log_debug': radeapclient.c:121: warning: 'ap' might be used uninitialized in this function gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c -o radeapclient.o >/dev/null 2>&1 /root/installs/radiusd-cvs/radiusd/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libeap.la -lnsl -lresolv -lpthread -lcrypto -lssl -lcrypto gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/libeap.so -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,--rpath -Wl,/usr/local/lib .libs/radeapclient.o(.text+0x13b): In function `radlog': /root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:111: undefined reference to `va_start' .libs/radeapclient.o(.text+0x15a):/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:113: undefined reference to `va_end' .libs/radeapclient.o(.text+0x193): In function `log_debug': /root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:124: undefined reference to `va_start' .libs/radeapclient.o(.text+0x1b2):/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:126: undefined reference to `va_end' collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/installs/radiusd-cvs/radiusd' make: *** [all] Error 2

2 1

freeradius-snapshot-20061020 make error
by Velikanov 20 Oct '06

20 Oct '06

Good Day. Such error in freeradius-snapshot-20061020 during "make" What to do? Making all in rlm_acct_unique... gmake[6]: Entering directory `/u01/data/freeradius-snapshot-20061020/src/modules/rlm_acct_unique' /u01/data/freeradius-snapshot-20061020/libtool --mode=compile gcc -g -O2 -I/u01/data/freeradius-snapshot-20061020/src -c rlm_acct_unique.c mkdir .libs gcc -g -O2 -I/u01/data/freeradius-snapshot-20061020/src -c rlm_acct_unique.c -fPIC -DPIC -o .libs/rlm_acct_unique.o In file included from rlm_acct_unique.c:28: /u01/data/freeradius-snapshot-20061020/src/freeradius-devel/radiusd.h:390: error: syntax error before "va_list" Thanks

3 2