- Freeradius-Users - lists.freeradius.org

configure options
by Seferovic Edvin 23 Oct '06

23 Oct '06

Hello, wouldn't it be useful to publish all configure options ( like modules options ) in WIKI ? I am trying to build debian packages for my machines with only those modules I need. And at the moment I don't have a clue how to deactivate the modules I don't need. Regards, E:S

4 5

Weird behaviour of the windows client
by Jack Daniels 23 Oct '06

23 Oct '06

Hi there, I've configured freeradius to do ms-chap and using wireless. When I type in my credentials, freeradius lets me in and everybody is happy, but when I check the checkbox "Automatically use my Windows logon name and password (and domain if any)", ntlm_auth responds with a logon failure. Has anybody of you run into the same problem? Did you find a solution? Please help Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Hints, Attr_rewrite - Add session timeout with Framed IP?
by Breuer Nicolas 23 Oct '06

23 Oct '06

Hello I'm looking for a solution to add in the accept packets a session timeout value when framed ip address is assigned in the users file. I tried to add "hints" rules but doesn't seems to work. I also tried to rewrite the packet : not works. Can you help me to do this ?

1 0

Two querys for accounting_stop_query (sql.conf)
by micobros 23 Oct '06

23 Oct '06

Hello, I'm running freeradius with mysql module. How could I add a second query to the statement accounting_stop_query in sql.conf ? I found this: http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048711.html So I add a section to sql.conf (myTEST {}) and copy all from section sql to the new one. Than I modifiy my accouting section in radiusd.conf and add "myTEST" I launch freeradius again and I get the error: "Failed to link module rlm_myTEST". Is there anyway I could have a second query executed after the default one in accounting_stop_query????? Thanks, Cheers, mico "The only way to get rid of a temptation is to yield to it." (Oscar Wilde)

1 0

sole remaining configure error [utmpx]
by Andrew Long 23 Oct '06

23 Oct '06

Well, I'm on the way to building my first freeradius server and have one remaining configure error. Can anyone tell me about this one, how to fix it and will it break anything? Test build is being done on Ubuntu 6.06 dapper. Below is the config.log --Andrew ---- configure:750: checking for gcc configure:863: checking whether the C compiler (gcc ) works configure:879: gcc -o conftest conftest.c 1>&5 configure:905: checking whether the C compiler (gcc ) is a cross-compiler configure:910: checking whether we are using GNU C configure:938: checking whether gcc accepts -g configure:971: checking how to run the C preprocessor configure:1051: checking for AIX configure:1077: checking whether gcc needs -traditional configure:1123: checking whether we are using SUNPro C configure:1143: checking for ranlib configure:1178: checking whether byte ordering is bigendian configure:1271: checking for gmake configure:1302: checking for make configure:1422: checking for lt_dlinit in -lltdl configure:1546: checking for Cygwin environment configure:1579: checking for mingw32 environment configure:1683: checking host system type configure:1704: checking build system type configure:1733: checking for ld used by GCC configure:1801: checking if the linker (/usr/bin/ld) is GNU ld configure:1818: checking for /usr/bin/ld option to reload object files configure:1830: checking for BSD-compatible nm configure:1868: checking whether ln -s works configure:1889: checking how to recognise dependant libraries configure:2072: checking for object suffix configure:2098: checking for executable suffix configure:2139: checking command to parse /usr/bin/nm -B output configure:2322: checking for dlfcn.h configure:2500: checking for ranlib configure:2567: checking for strip configure:2812: checking for objdir configure:2843: checking for gcc option to produce PIC configure:2995: checking if gcc PIC flag -fPIC works configure:3065: checking if gcc static flag -static works configure:3111: checking if gcc supports -c -o file.o configure:3159: checking if gcc supports -c -o file.lo configure:3235: checking if gcc supports -fno-rtti -fno-exceptions configure:3248: gcc -c -g -O2 -fno-rtti -fno-exceptions -c conftest.c conftest.c 1>&5 cc1: warning: command line option "-fno-rtti" is valid for C++/ObjC++ but not for C cc1: warning: command line option "-fno-rtti" is valid for C++/ObjC++ but not for C configure:3279: checking whether the linker (/usr/bin/ld) supports shared libraries configure:3967: checking how to hardcode library paths into programs configure:3999: checking whether stripping libraries is possible configure:4017: checking dynamic linker characteristics configure:4418: checking if libtool supports shared libraries configure:4426: checking whether to build shared libraries configure:4453: checking whether to build static libraries configure:4496: checking for shl_load configure:4542: checking for shl_load in -ldld configure:4580: checking for dlopen configure:4626: checking for dlopen in -ldl configure:4777: checking whether a program can dlopen itself configure:4871: checking whether a statically linked program can dlopen itself configure:4993: checking whether -lc should be explicitly linked in configure:5656: checking logdir configure:5678: checking radacctdir configure:5700: checking raddbdir configure:5923: checking for perl configure:5962: checking for snmpget configure:6001: checking for snmpwalk configure:6040: checking for rusers configure:6076: checking for working aclocal configure:6089: checking for working autoconf configure:6102: checking for working autoheader configure:6118: checking for locate configure:6153: checking for dirname configure:6188: checking for grep configure:6232: checking for pthread.h configure:6271: checking for pthread_create in -lpthread configure:6364: checking for library containing sem_init configure:6428: checking for getsockname in -lsocket configure:6476: checking for inet_aton in -lresolv configure:6524: checking for inet_ntoa in -lnsl configure:6577: checking for DH_new in -lcrypto configure:6687: checking for dirent.h that defines DIR configure:6725: checking for opendir in -ldir configure:6808: checking for ANSI C header files configure:6912: checking whether time.h and sys/time.h may both be included configure:6947: checking for sys/wait.h that is POSIX.1 compatible configure:7024: checking for unistd.h configure:7024: checking for crypt.h configure:7024: checking for errno.h configure:7024: checking for resource.h configure:7024: checking for getopt.h configure:7024: checking for malloc.h configure:7024: checking for utmp.h configure:7024: checking for utmpx.h configure:7024: checking for signal.h configure:7024: checking for sys/select.h configure:7024: checking for syslog.h configure:7024: checking for inttypes.h configure:7024: checking for stdint.h configure:7024: checking for stdio.h configure:7024: checking for netdb.h configure:7024: checking for semaphore.h configure:7024: checking for arpa/inet.h configure:7024: checking for netinet/in.h configure:7024: checking for sys/types.h configure:7024: checking for sys/socket.h configure:7024: checking for sys/time.h configure:7024: checking for sys/wait.h configure:7024: checking for sys/security.h configure:7024: checking for fcntl.h configure:7024: checking for sys/fcntl.h configure:7024: checking for sys/stat.h configure:7024: checking for sys/prctl.h configure:7024: checking for prot.h configure:7024: checking for sia.h configure:7024: checking for siad.h configure:7064: checking for regex.h configure:7234: checking for off_t configure:7267: checking for pid_t configure:7300: checking for size_t configure:7333: checking for uid_t in sys/types.h configure:7369: checking for socklen_t configure:7412: checking for uint8_t configure:7455: checking for uint16_t configure:7498: checking for uint32_t configure:7567: checking for getopt_long configure:7567: checking for lockf configure:7567: checking for strsignal configure:7567: checking for sigaction configure:7567: checking for sigprocmask configure:7567: checking for pthread_sigmask configure:7567: checking for snprintf configure:7567: checking for vsnprintf configure:7567: checking for setsid configure:7567: checking for strncasecmp configure:7567: checking for strcasecmp configure:7567: checking for localtime_r configure:7567: checking for ctime_r configure:7567: checking for gmtime_r configure:7567: checking for strsep configure:7567: checking for inet_aton configure:7567: checking for inet_pton configure:7567: checking for inet_ntop configure:7567: checking for gethostname configure:7567: checking for setlinebuf configure:7567: checking for setvbuf configure:7567: checking for getusershell configure:7567: checking for initgroups configure:7567: checking for closefrom configure:7631: checking whether crypt must be declared configure:7631: checking whether strncasecmp must be declared configure:7631: checking whether strcasecmp must be declared configure:7631: checking whether inet_aton must be declared configure:7631: checking whether gethostname must be declared configure:7631: checking whether setlinebuf must be declared configure:7631: checking whether getusershell must be declared configure:7631: checking whether endusershell must be declared configure:7718: checking return type of signal handlers configure:7763: checking for ut_xtime in struct utmpx configure:7779: gcc -c -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c 1>&5 configure: In function 'main': configure:7775: error: 'struct utmpx' has no member named 'ut_xtime' configure: failed program was: #line 7767 "configure" #include "confdefs.h" #include <utmpx.h> #ifndef offsetof #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER) #endif int main() { int foo = offsetof(struct utmpx, ut_xtime) ; return 0; } configure:7810: checking for ipi_addr in struct in_pktinfo configure:7826: gcc -c -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c 1>&5 configure:7856: checking for working const configure:7932: checking type of OS configure:7947: checking for developer gcc flags configure:7962: checking for crypt in -lcrypt configure:8062: checking for setkey in -lcipher configure:8110: checking for asn1.h,snmp.h,snmp_impl.h configure:8139: gcc -c -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG conftest.c 1>&5 configure: In function 'main': configure:8135: warning: unused variable 'a' configure:8309: checking for snmp_build_var_op in -lsnmp configure:8321: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG conftest.c -lnsl -lresolv -lpthread -lsnmp 1>&5 configure:8425: checking gethostbyaddr_r() syntax configure:8448: gcc -o conftest -g -O2 conftest.c -lnsl -lresolv -lpthread 1>&5 configure:8530: checking gethostbyname_r() syntax configure:8542: gcc -o conftest -g -O2 conftest.c -lnsl -lresolv -lpthread 1>&5 configure:8623: checking ctime_r() syntax configure:8634: gcc -o conftest -g -O2 conftest.c -lnsl -lresolv -lpthread 1>&5 configure: In function 'main': configure:8630: error: too many arguments to function 'ctime_r' configure: failed program was: #line 8625 "configure" #include "confdefs.h" #include <time.h> int main() { ctime_r(NULL, NULL, 0) ; return 0; } configure:8659: gcc -o conftest -g -O2 conftest.c -lnsl -lresolv -lpthread 1>&5 ------------------------

2 3

Support for Sub-TLVs within VSA TLVs
by Santhosh Thodupunoori 22 Oct '06

22 Oct '06

Hi All, I am trying to make a dictionary for Wimax attributes(defined by Wimax forum/NWG). Few of the attributes they defined have sub-attributes. Format for one such attribute is given below: RadiusType = 26 Length Value -->Wimax Type = 10 -->Length -->Sub-type = 1 or 2 or 3 ---->Length ---->Value Does Freeradius have support for Sub-TLVs inside VSA TLVs today? If yes, can someone please give me an example of one such entry in dictionary. If Freeradius does not currently support sub-attributes, is there a plan to support this in future? Thanks in advance Santosh

2 1

RE: SQLcounter patch - Addition of reply-attribute
by Jonathan De Graeve 22 Oct '06

22 Oct '06

> That's really what multiple module are for. Have the sqlcounter > module return a special return code when the user is over the limit, > and use module failover to switch on that return code, and run another > module. Ok, any idea on the return code to be used? > > > - char *counter_name; /* Daily-Session-Time */ > > - char *check_name; /* Max-Daily-Session */ > > - char *key_name; /* User-Name */ > > + char *counter_name; /* Daily-Session-Time */ > > Why? Gratuitous whitespace changes don't belong in a patch. My bad, sorry > > > - if ((reply_item = pairfind(request->reply->vps, > > PW_SESSION_TIMEOUT)) != NULL) { > > + /* if ((reply_item = pairfind(request->reply->vps, > > PW_SESSION_TIMEOUT)) != NULL) { */ > > If you're changing code PLEASE do not leave the old code in > comments. It's confusing, and pointless. CVS will tell you what the > old code was. This practice is just unnecessary. This was for internal purposes only. I'll submit the patch in the form you want it to bugs.freeradius.org. I hope its compatible with the CVS code. J.

1 0

authenicate internet access through MACs
by Ali Jawad 22 Oct '06

22 Oct '06

Hi Ive got a debian router and a switch through which I provide internet access to some of the residents of my building...I want to implement a mechanism so that only the computers I specify can access the Internet...I could do it through squid but if I do so it would allow me only to restrict traffic going through port 80 what about Internet applications that use other ports such as ftp, smtp, yahoo and msn. I want to use a mechanism that allows me to authenicate PCs based on mac address and only those computers are allowed to access the internet. One particular solution could be blocking all access to the router unless the request have the source mac from an authorised PC..but I would prefer another approach if available...since Iam not going to operate the router..and the firewall script was written using VIM and the oprerator needs a web interface to operate the router. I ve got a freeradius server setup and running on the router with the dialup admin interface..I have done this setup previoulsy with pppoe and freeradius. I can not use pppoe this time..so I would like to know if there is a mechanism that allows me to redirect all the requests coming to the router through radius and access is granted upon the authenication info found in the radius database. I use to do that by loading radius.so each time a request to the pppoe server is made by including radius.so in the pppoe.options file..but I have no clue on how to do it this time. Any suggestions are welcome -- With Regards Ali Jawad

1 0

authenicate internet access through MACs
by Ali Jawad 22 Oct '06

22 Oct '06

Hi Ive got a debian router and a switch through which I provide internet access to some of the residents of my building...I want to implement a mechanism so that only the computers I specify can access the Internet...I could do it through squid but if I do so it would allow me only to restrict traffic going through port 80 what about Internet applications that use other ports such as ftp, smtp, yahoo and msn. I want to use a mechanism that allows me to authenicate PCs based on mac address and only those computers are allowed to access the internet. One particular solution could be blocking all access to the router unless the request have the source mac from an authorised PC..but I would prefer another approach if available...since Iam not going to operate the router..and the firewall script was written using VIM and the oprerator needs a web interface to operate the router. I ve got a freeradius server setup and running on the router with the dialup admin interface..I have done this setup previoulsy with pppoe and freeradius. I can not use pppoe this time..so I would like to know if there is a mechanism that allows me to redirect all the requests coming to the router through radius and access is granted upon the authenication info found in the radius database. I use to do that by loading radius.so each time a request to the pppoe server is made by including radius.so in the pppoe.options file..but I have no clue on how to do it this time. Any suggestions are welcome -- With Regards Ali Jawad

1 0

SQLcounter patch - Addition of reply-attribute
by Jonathan De Graeve 22 Oct '06

22 Oct '06

I just made a patch against 1.1.3 for the SQLcounter module. This patch allows to set the reply-name variable in the sqlcounter.conf file per instance. In this way the default behaviour of Session-Timeout can be overridden by your own reply-attribute. The system will set the session-timeout attribute if you omit the reply-name var in your config for backwards compatibility. I'm planning the following additions: The ability to override the reject behaviour with an accept but adding attributes. For example: if the user has reached his volume limit, accept the user but add speed-limitation attributes. <BEGIN OF PATCH> --- rlm_sqlcounter.c.orig 2006-10-21 23:18:04.147404980 +0200 +++ rlm_sqlcounter.c 2006-10-21 23:01:30.190552948 +0200 @@ -65,17 +65,19 @@ * be used as the instance handle. */ typedef struct rlm_sqlcounter_t { - char *counter_name; /* Daily-Session-Time */ - char *check_name; /* Max-Daily-Session */ - char *key_name; /* User-Name */ + char *counter_name; /* Daily-Session-Time */ + char *check_name; /* Max-Daily-Session */ + char *key_name; /* User-Name */ + char *reply_name; /* Authorized Reply, defaults to Session-Timeout */ char *sqlmod_inst; /* instance of SQL module to use, usually just 'sql' */ char *query; /* SQL query to retrieve current session time */ - char *reset; /* daily, weekly, monthly, never or user defined */ + char *reset; /* daily, weekly, monthly, never or user defined */ char *allowed_chars; /* safe characters list for SQL queries */ time_t reset_time; time_t last_reset; int key_attr; /* attribute number for key field */ int dict_attr; /* attribute number for the counter. */ + int reply_attr; /* attribute number for the authorized OK reply, defaults to Session-Timeout */ } rlm_sqlcounter_t; /* @@ -91,6 +93,7 @@ { "counter-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,counter_name), NULL, NULL }, { "check-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,check_name), NULL, NULL }, { "key", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,key_name), NULL, NULL }, + { "reply-name", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,reply_name), NULL, NULL }, { "sqlmod-inst", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,sqlmod_inst), NULL, NULL }, { "query", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,query), NULL, NULL }, { "reset", PW_TYPE_STRING_PTR, offsetof(rlm_sqlcounter_t,reset), NULL, NULL }, @@ -480,6 +483,27 @@ data->key_attr = dattr->attr; /* + * Discover the attribute number of the reply. + * If not set, set it to Session-Timeout + * for backward compatibility + */ + if (data->reply_name == NULL) { + DEBUG2("rlm_sqlcounter: 'reply' set to Session-Timeout for counter name %s",data->counter_name); + data->reply_attr = PW_SESSION_TIMEOUT; + } + else { + dattr = dict_attrbyname(data->reply_name); + if (dattr == NULL) { + radlog(L_ERR, "rlm_sqlcounter: No such attribute %s", + data->reply_name); + return -1; + } + data->reply_attr = dattr->attr; + DEBUG2("rlm_sqlcounter: Reply attribute %s is number %d", + data->reply_name, dattr->attr); + } + + /* * Check the "sqlmod-inst" option. */ if (data->sqlmod_inst == NULL) { @@ -666,11 +690,12 @@ res += check_vp->lvalue; } - if ((reply_item = pairfind(request->reply->vps, PW_SESSION_TIMEOUT)) != NULL) { + /* if ((reply_item = pairfind(request->reply->vps, PW_SESSION_TIMEOUT)) != NULL) { */ + if ((reply_item = pairfind(request->reply->vps, data->reply_attr)) != NULL) { if (reply_item->lvalue > res) reply_item->lvalue = res; } else { - if ((reply_item = paircreate(PW_SESSION_TIMEOUT, PW_TYPE_INTEGER)) == NULL) { + if ((reply_item = paircreate(data->reply_attr, PW_TYPE_INTEGER)) == NULL) { radlog(L_ERR|L_CONS, "no memory"); return RLM_MODULE_NOOP; } @@ -682,8 +707,8 @@ DEBUG2("rlm_sqlcounter: Authorized user %s, check_item=%d, counter=%d", key_vp->strvalue,check_vp->lvalue,counter); - DEBUG2("rlm_sqlcounter: Sent Reply-Item for user %s, Type=Session-Timeout, value=%d", - key_vp->strvalue,reply_item->lvalue); + DEBUG2("rlm_sqlcounter: Sent Reply-Item for user %s, Type=%d, value=%d", + key_vp->strvalue,data->reply_attr,reply_item->lvalue); } else{ char module_fmsg[MAX_STRING_LEN]; @@ -722,6 +778,7 @@ free(data->sqlmod_inst); free(data->counter_name); free(data->allowed_chars); + free(data->reply_name); allowed_chars = NULL; free(instance); </END OF PATCH> Enjoy this patch, J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

2 1