- Freeradius-Users - lists.freeradius.org

Accounting stopped
by sean＠swarmhotspots.com 29 Sep '06

29 Sep '06

Hi All, Since a power cut last Sunday FreeRadius has stopped writing to its log files and updating radacct in MySQL. It is continuing to authenticate users. It gives no error messages running radiusd -X. I've tried upgrading from 1.0.3 to 1.1.3 with no effect. I've been working round the clock for five days now and seem no closer to a solution. Any hints, tips or advice would be very welcome. Regards, Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

mysql radacct table no query
by Collen Blijenberg 29 Sep '06

29 Sep '06

Hmm, i was testing the mysql backend with freeradius 1.1.3. looks good at first glance, but i bumped into something essential (for us that is). We like to link MAC addresses with the user account's. what did i do: I added a user in table radcheck. worked! next step, added same user in table: radacct. username:gebruiker CalledStationId: 00166f980e79 did not work! I change the MAC address to a wrong one, and i still get in.?? also in debug (radiusd -X) no radacct query is done?, so no attribute checkings are done !!?? So my question is, how can i make the attributes work with the mysql backend.. are we missing some mysql queries in the sql.conf ?? (btw, this all did worked with the 'users' file from freeradius) Cheers Collen

3 2

dumb humble question about sqlippool
by Guilherme Franco 29 Sep '06

29 Sep '06

Hi, I know you guys must be angry with all the questions I'm posting here. In Devel-List, I found this: "Is it usefull to community? (SQLIPPOOL and NASCATS)" by Roman M. Bibikov on Thu, 16 Oct 2003 17:36:26 +1100. He says that created a sucessfull ip pool in Oracle (exactly what I'm trying to do) and also that developed stored functions and procedures handling in rlm_oracle (sql_runfunction() and sql_runprocedure()) I didn't found out those functions and I'm wondering if it's because of this that I can't make sqlippool work in oracle... Thanks in advance

2 5

peap client constantly re-authenticating
by Rob Shepherd 29 Sep '06

29 Sep '06

Dear list, This may not be the right place to discuss this issue, but radiusd -X is the only info i've got to go on. The windows PEAP client re-authenticates every 10-20 seconds or so. Has anybody else seen this? is it normal behavour? I have a cisco wlan controller, and freeradius 1.1.2. my OS X 802.1x client doesn't do this. Cheers for any pointers, Rob

1 0

rpl_perl and housekeeping
by Pshem Kowalczyk 29 Sep '06

29 Sep '06

Hi, We are building a proxy system using rlm_perl. Proxy is reposible for IP allocation, attributes rewriting and keeping the session database. The system works fine if all the NASes (and other proxies) behave properly (ie they send all the packets they supposed to send etc). Obviously real situation is a bit worse and sometimes we get stuck with a non-existent session in our session db (because the 'Stop' record never arrived). This situation can be easily detected as we timestamp all db opeartions, so in theory we could expire all outdated sessions or allocated IPs, but so far I can see only one option to do that - use an external program. We're not very keen to do it in the packet-handling functions as some of the opeartions can be very time consuming, and as a result that would live the packet without any answer. Ideally we would like to see an ability to run some functions on defined time intervals (not only when a packet comes) so the housekeeping is done then. I'm not sure if I'm not streetching the applications of rlm_perl a bit too far, if such functionality existed - that would be great. Or perhaps is there a different method of doing this? kind regards pshemko

2 2

RE: v1.1.3 - Logging Levels / Syslog / logging passwords
by Garber, Neal 29 Sep '06

29 Sep '06

> Is there any way to squish the user password in the -xx output? Are there any hidden/undocumented setting for radiusd.conf that do that? radiusd -Xx | sed -e "s/\([pP]\)assword.*/\1assword <masked>/" This is a tweak from something Alan suggested to me... It gets rid of most of the passwords (it leaves the password rlm_ldap uses to bind and it removed some other info. - but I think it's pretty close to what you want)..

1 0

v1.1.3 - Logging Levels / Syslog / logging passwords
by Lin Richardson 28 Sep '06

28 Sep '06

Hello All, I've been working to configure logging as an aide to supporting our Freeradius installation. I'm familiar with logging level flags -x and -xx, as well as the big debug -X flag. My first observation is that ALL of these flags output to console by default. Is there any way to make the -xx or -x log to the logfile? I have toyed with setting logdir to 'syslog' in the radiusd.conf file. Alan said in a note to the list on Sept 6 that this feature didn't work in 1.1.3, but would in 2.0 I find it actually works pretty well IF you use the -x -xx or -X flag. The output that usually goes to the screen (most of it anyway) gets dumped to the syslog on my Solaris box just fine. It must be because either stderr or stdout get redirected to syslog, but not both. The actual requests still scroll on the console. I figure I can use >/dev/null 2>&1 & or some variant to kill the output still going to console and background the process... All of this is good, because I WANT a very verbose log file... my only problem is that user passwords are logged in clear text as part of the output - specifically from the pap module. This presents a security problem. (Never mind why I'm using clear text pap if I'm concerned with security.) Is there any way to squish the user password in the -xx output? Are there any hidden/undocumented setting for radiusd.conf that do that? suggestions from those who know? I seem to recall seeing a related thread a few weeks back, but cannot find it... my apologies in advance if this is repetitive. Regards, Lin Richardson

2 1

Re: How to deny user with changed username when using EAP-TLS
by Marcos González 28 Sep '06

28 Sep '06

>> I think as I'm using digital certificates (EAP-TLS) to authenticate >> users, and the user has a valid one, if there aren't any aditional >> checks in radcheck, the user has already been authenticated due to the >> certificate, and is allowed to enter the network. Is that right? > > Yes. But you can still reject them before the certificate is >validated. Or, you can have a Certificate Revocation List that marks >their certificate as invalid. Yes, I'm using them to reject users that, although having a valid certificate, I want to be out of the network, and works OK. Only wanted to aditionally prevent users that bypass my access control system changing their 'UserName' to an unused one, accessing the network. The revocation list is something I'll give a look, thanks! > > If that's the case, I think about using the exec module to call a > external shell script which checks if 'UserName' is included in my > database, and if it's not, modify 'UserName' to something like > 'Unauthorized', user that will be in a group with an 'Auth-Type = Deny'. > Do you think there's an easier way? > > See "rlm_exec". Run the script, and have the script print >"Auth-Type := Reject" to stdout if the user isn't found. That should >cause them to be rejected. Yes, It seems a good solution. Thank you very much! > Alan DeKok.

1 0

Re: Re: How to deny user with changed username when using EAP-TLS
by Marcos González 28 Sep '06

28 Sep '06

=?ISO-8859-1?Q?Marcos_Gonz=E1lez?= <mgtroyas(a)gmail.com> wrote: >> Is there any way to allow known users (those whose UserName appears in >> radcheck) access, but deny unknown (all other) users? > >Huh? If the user & password aren't known to the server, the default >*is* to reject them. If that isn't happening, then something in your >config is allowing them in. > >As always, run the server in debugging mode to see what's going on. > >Alan DeKok. I think as I'm using digital certificates (EAP-TLS) to authenticate users, and the user has a valid one, if there aren't any aditional checks in radcheck, the user has already been authenticated due to the certificate, and is allowed to enter the network. Is that right? If that's the case, I think about using the exec module to call a external shell script which checks if 'UserName' is included in my database, and if it's not, modify 'UserName' to something like 'Unauthorized', user that will be in a group with an 'Auth-Type = Deny'. Do you think there's an easier way? Thank you for your help.

2 1

Radrelay - Duplicate records...
by Etienne Pretorius 28 Sep '06

28 Sep '06

Hello List, I would like to know if it is possible to setup FreeRAIUS not to log accounting info from a specific server to the detail file and still log the accounting info into the local mysql database. Some background on the subject: I have recently taken over the maintenance of a couple of FreeRADIUS servers. I'll be frank, I am not an experienced FreeRADIUS admin, so my first priority was to get the accounting information synced at all times between our servers. After some searching I found a couple of documents and posts about radrelay and I have proceeded to set it up on the servers hoping to achieve a two-way accounting replication service. +-----------+ +-----------+ | Primary | <===================== | Secondary | | RADIUS | =====================> | RADIUS | +-----------+ +-----------+ As the documentation is quite brief - I assume everything is working fine. I kept my eye on the logs and started to see the following appearing. Wed Sep 27 17:37:45 2006 : Info: rlm_radutmp: Login entry for NAS <1> port 1090715896 duplicate Wed Sep 27 17:37:46 2006 : Info: rlm_radutmp: Login entry for NAS <1> port 1090716313 duplicate (Also please note that I am aware of record duplication coming from my upstream provider's RADIUS proxy) When I killed radrelay on the Secondary then everything was OK except I now only have a one-way replication happening. Looking at the sql tables showed that there are about double the amount of records on the primary then on the secondary for that time period. As I have little experience on configuring FreeRadius (We all have to start somewhere), I would greatly appreciate the any help or comments about the subject at hand. Thank you. Etienne Pretorius

1 1