- Freeradius-Users - lists.freeradius.org

RADIUS + MySQL + decisionmaking?
by Jan Mulders 27 Sep '06

27 Sep '06

Hello, I am trying to set up some decision-making logic into FreeRADIUS, to assign users a different speed of service depending on how much bandwidth they've used since their billing started. I want to issue 512k speed to users in group A, who have used less than 20GB of bandwidth (monthlybytecounter is working fine at the moment and totals this up nicely). However, if they've used more than 20GB, I want to issue 256k speed to users. For group B, I want users to get 10Mbps as long as they've used less than 50GB of bandwidth, and 1Mbps if they're over. I want to assign the values for speed to some vendor-specific variable, let's say Max-User-Speed. I am using MySQL for this. Here is a snippet from my database: radcheck table: username, attribute, op, value testuser1, Password, ==, testing usergroup table: username, groupname testuser1, groupa Here is a snippet from my radiusd.conf file: instantiate { monthlybytecounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess } accounting { #acct_unique #detail sql radutmp # ? } session { radutmp # ? sql } My question is... how do I implement this? Can anyone write down a few examples of how I'd go about making these rules? Would I perhaps be better off making a cronjob or something that changes the user's group to one of the following? groupA_belowcap, groupA_overcap, groupB_belowcap, groupB_overcap? Regards, Jan Mulders

2 2

ULTRA IMPORTANT! Proxy - Assertion failed in listen.c, line 558 error
by Guilherme Franco 27 Sep '06

27 Sep '06

HI, Please, this is a very important problem that is affecting thousands of customers of mine: I have 2 realms for send proxy requests (foo.com and bar.net) If the proxy server foo.com goes down (for whatever reason) this happens: rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 User-Name = "user(a)foo.com" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 rlm_realm: Looking up realm "foo.com" for User-Name = "user(a)foo.com" rlm_realm: Found realm "foo.com" rlm_realm: Proxying request from user user to realm foo.com rlm_realm: Adding Realm = "foo.com" rlm_realm: Preparing to proxy authentication request to realm "foo.com" rlm_eap: No EAP-Message, not doing EAP modcall: group authorize returns noop for request 20 Sending Access-Request of id 16 to foo.com port 1645 User-Name = "user(a)foo.com" User-Password = "password" NAS-IP-Address = 192.168.1.1 Proxy-State = 0x3231 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 Sending duplicate proxied request to home server foo.com port 1645 - ID: 16 Assertion failed in listen.c, line 558 Aborted Then my radiusd dies and I need to bring it up again. This is incredibly critical because if domain foo.com dies, my freeradius server dies too, and in consequence, I can't proxy requests to bar.net (which have more than 21.000,00 users!) Thanks!

3 7

syslog.conf
by sean＠swarmhotspots.com 27 Sep '06

27 Sep '06

Hi, I've been running a trouble free Radius server for over a year. Last weekend a local power company substation went on fire. This resulted in a massive power surge and a major system crash. Since then Radius has been validating users from MySQL no problem. However it is not updating its log files or radacct in the database. After a lot of searching I discovered that the Linux (Mandriva 2006) syslog.conf was corrupted. I've created a new syslog and reinstalled Radius version 1.0.5. The problem has persisted. I reckon I must be missing something in the log config. Any advice or help would be very much appreciated. Two nights now with no sleep. Regards and thanks in advance. Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Show Groups in dialup_admin
by Evert 27 Sep '06

27 Sep '06

Hi all! This question has been asked (but not answered?) before: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11278.… I do the following: * click on 'Show Groups' * click on a group * select a member of the group * click on 'Administer selected user' I am then supposed to get the user info on that specific user. Instead the group administration page reloads... How do I make it so that I actually get the selected user info page? Greetings, Evert

2 2

Accounting issues in Oracle solved
by Guilherme Franco 27 Sep '06

27 Sep '06

Hello, I had to modify oracle-dialup.conf to make accounting on/off to work. In AcctSessionTime, the original query would generate "expected NUMBER, got INTERVAL" error. Here is the original: accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime=TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), AcctSessionTime=((TO_DATE('%S','yyyy-mm-dd hh24:mi:ss') - AcctStartTime)*86400), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time:-0} WHERE AcctSessionTime=0 AND AcctStopTime IS NULL AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStartTime <= TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')" So I modified it to: accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime=TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), AcctSessionTime=(to_number(TO_DATE('%S','yyyy-mm-dd hh24:mi:ss') - cast(AcctStartTime as date))*86400), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time:-0} WHERE AcctSessionTime=0 AND AcctStopTime IS NULL AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStartTime <= TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')" And it works great now.

1 0

Source IP address for proxy requests
by Angel L. Mateo 27 Sep '06

27 Sep '06

Hello, I have a cluster of two servers running freeradius (the cluster is monitored by heartbeat). Each of the two members of the cluster has its own IP address (192.168.1.2 and 192.168.1.3) and one of the (the active member) has the IP address in which it runs freeradius (192.168.1.1), so freeradius only listen in this address, not in the owned by the server. Freeradius is working fine with this configuration, except the proxy module. The problema I have is that proxy requests are originated with the IP address of the member, not the IP of the cluster. And I haven't found any configuration option to configure this. Is there any way to do it? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

7 18

Autoreply: Reid Canavan is out of the office.
by Reid Canavan 27 Sep '06

27 Sep '06

I will be out of the office starting 09/27/2006 and will not return until 09/28/2006. I will respond to your message when I return.

1 0

mod_auth_radius-2.0
by William 27 Sep '06

27 Sep '06

Greetings, I am having some probles with mod_auth_radius-2.0 on apache 2.0.54. The error I am receiving is: Cannot load /usr/local/apache/modules/mod_auth_radius-2.0.so into server: /usr/local/apache/modules/mod_auth_radius-2.0.so: undefined symbol: ap_snprintf I am running on suse 10.1-x86_64 and apache is compiled from source. Any suggestions? Help? -- William Server Administrator NetOne Communications, Inc. 231-734-2917

2 1

Prefixing Topics with Mailing list name
by Graham Beneke 26 Sep '06

26 Sep '06

Hi Guys Something thats been bugging me about this list for a while is the fact that the post subjects have no indication which mailing list they are from. All the other mailing lists I'm on prefix subjects with something like "[freeradius]" but since this list (as well as freeradius-devel) don't do this it makes it quite difficult to figure out what is going on in my inbox. Could we get this changed? regards -- Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> Cell: 082-432-1873 <callto://+27824321873> Skype: grbeneke <callto://grbeneke> WEB: www.apolix.co.za <http://www.apolix.co.za/>

5 5

RE: Hiding Passwords in Debug Output
by Garber, Neal 26 Sep '06

26 Sep '06

> Insulting me because I disagree with you pretty much guarantees that > I will never agree with you. Please accept my apology as it was not my intent to offend or insult you.

1 0