- Freeradius-Users - lists.freeradius.org

non existing account can still login / freeradius only runs in debugmode ?
by Tom De Wispelaere 15 Sep '06

15 Sep '06

Hello guys, we have a server setup running freeradius (= 1.1.2-2) with a mysql backend on debian Linux. We receive a lot of authorization requests and accounting requests from the equipment of an isp. Setup is as follows : server A with master freeradius and mysql, server B with backup radius that uses mysql on server A. The mysql is of course still single point of failure. We tried it first with a local mysql server on server B but did find it difficult to process the accounting records in an easy and simple way when they are scattered over two databases on two different servers. Any suggestions on this setup would be greatly appreciated. Everything seems to work except for the following: - if we try to start the server threaded and as it is supposed to work (ie /etc/init.d/freeradius start), it crashes regularly under load without any further explanation... If we run freeradius in debugmode (/usr/sbin/freeradius -X) , everything keeps working just fine... I have done several upgrades (coming from version 0.9) but i still see the same problem and i cannot get it to work without a crash (sooner or later) in threaded mode. Do any of you experience similar problems ? Is there a remedy or things i could try to find the cause ? - usernames that can't (and should not be able to) login (username not present anymore in the mysql database, nor any passwd file) and get a "Login incorrect" most of the time, sometimes get through and get authenticated (!)... Its very strange behavior and i have been trying to find a cause for this. At first i thought the culprit would be the equipment at the other side that did something wrong, but apparently it receives explicitly a Login OK from our radius (togheter with profile info etc) as i see in the packetflow. I cannot find a single Login OK for these specific users in the debuginfo however, only the login incorrects and acct records (see below). rlm_chap: login attempt by "USERNAME1" with CHAP password rlm_chap: Could not find clear text password for user USERNAME1 Login incorrect (rlm_chap: Clear text password not available): [USERNAME1/<CHAP-Password>] (from clie nt adsl port xxxxxxx) The mysql acct records do show traffic and alive records for these logins (a few) and a lot of Login Failures. Is there an easy way to dig deeper into this problem and find the cause for these spooky logins that should not happen ? Any help or suggestions greatly appreciated, Best regards, Tom

1 0

MySQL.conf
by Dan Massey 15 Sep '06

15 Sep '06

Hi List I'm running Freeradius with MySQL I am trying to log parts of the accounting data to a different table than 'radacct', but am struggling to get the sysntax for adding an 'INSERT INTO XXXX' line to the 'accounting_update_query', is there a way to get it to execute 2 SQL commands? Thanks in advance Dan

2 1

FreeRadius autentication delay
by Josep Martí Colomina 15 Sep '06

15 Sep '06

Hi, I am using the version of Free Radius 1.0.5 to authenticate the users of a net wireless, with eDirectory. Since the first day, I am experimenting problems of delays on the freeRadius authentication of the wireless net. There are moments that it works well, itauthenticates in 2 seconds, this happens after restarting the FreeRadius, but during the normal operation one time delay 2 seconds and two more times delay 30 seconds, it seems that some timeout expires, it is late of the order of 30 seconds on authenticating. The configuration is the following one: - Red Hat Enterprise Linux AS release 3 (Taroon Update 5) - FreeRadius 1.0.5 - The ldap server is eDirectory in (two nodes) with load balancing. I can discard that the problem is from the load balancing since I have reconfigured the Freeradius with the ip of each eDirectory and reacts in the same way in both nodes. Have you can make some suggestion in order to solve this problem, maybe him the parametrization of the FreeRadius?, any help will be from great value for me, thank you -- josep.colominaATgmail.com

1 0

URGENT! User does not get VSA attribute If override = yes and in radiusd.conf and using PROXY
by Guilherme Franco 15 Sep '06

15 Sep '06

Hi, I need to set override = yes in radiusd.conf in order to the user get an IP. This way because it's a proxy request. i.e: user(a)realm.com -> proxy to realm -> realm authorize user -> myradius sets the IP The IP assignment does not work with override = no, because the proxy radius tends to set the IP 255.255.255.254. Ok, if override = yes, the users get the correcty ip from the pool, but not the VSA, as below: DEFAULT Pool-Name := test X-Ascend-Client-Primary-DNS = x.x.x.x, X-Ascend-Client-Secondary-DNS = x.x.x.x, X-Ascend-Client-Assign-DNS = 1, ERX-Virtual-Router-Name = "default", Framed-Routing == None, Framed-Protocol = PPP, Service-Type = Framed-User note: those vsa works correctly when I specify local users like this (not proxy): testuser Auth-Type := local, User-Password == "foo", Pool-Name := test X-Ascend-Client-Primary-DNS = x.x.x.x, X-Ascend-Client-Secondary-DNS = x.x.x.x, X-Ascend-Client-Assign-DNS = 1, ERX-Virtual-Router-Name = "default", Fall-Through = Yes Please HELP! THANKS!

1 0

RE: Radius with SNMP -- Urgent
by Kshitij Korde 15 Sep '06

15 Sep '06

Hi Ø Actually I tried to compile net-snmp-5.1.1 and tried to run "snmpd" but it was giving error as init_kmem: kvm_open failed: Permission denied Ø after that I came to know that there is already one server(snmpd) running of version NET-SNMP version: 5.0.9 Web: http://www.net-snmp.org/ Email: net-snmp-coders(a)lists.sourceforge.net Ø So using /usr/sfw/bin/snmpconf -> command I configured snmpd.conf. But I am not sure whether I have answered properly for all questions it asked. Ø Did you setup your snmp agent accoding to documentation? Did you restart your snmp agent? I didnt referred any document , so I am not very sure about this configuration , please provide some useful information about this Regards kshitij -----Original Message----- From: freeradius-users-bounces+kshitijk=techmahindra.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+kshitijk=techmahindra.com@lists.freeradius.org] On Behalf Of Michael Schwartzkopff Sent: Friday, September 15, 2006 12:53 PM To: FreeRadius users mailing list Subject: Re: Radius with SNMP -- Urgent Am Freitag, 15. September 2006 07:46 schrieb Kshitij Korde: > After compiling freeradius with "--with-snmp" option and when i try > to run the server in the debug mode I see. > (...) > Can't connect to SNMP agent with SMUX: Connection refused Hi, did you setup your snmp agent accoding to documentation? Did you restart your snmp agent? -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42 ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

CVS web access links on the website broken...
by Luca Corti 15 Sep '06

15 Sep '06

http://www.freeradius.org/development.html#cvs ciao Luca

1 0

why pam_radius library send pakcet twice??? Why?
by 나종현 15 Sep '06

15 Sep '06

1 0

Radius with SNMP -- Urgent
by Kshitij Korde 15 Sep '06

15 Sep '06

After compiling freeradius with "--with-snmp" option and when i try to run the server in the debug mode I see. Module: Instantiated radutmp (radutmp) main: smux_password = "verysecret" main: snmp_write_access = no SMUX connect try 1 Can't connect to SNMP agent with SMUX: Connection refused Listening on authentication *:1918 Listening on accounting *:1919 Ready to process requests. ________________________________________________________________________ ___________________ I am still trying to figure out what step should i take next......... Can anybody help me -Kshitij ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

RE: Attribute Operators
by Edward.Shih＠rcc.edu 15 Sep '06

15 Sep '06

Thank you, Peter. You are so kind! Truly appreciated!! -----Original Message----- From: freeradius-users-bounces+edward.shih=rcc.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+edward.shih=rcc.edu@lists.freeradius.or g] On Behalf Of Peter Nixon Sent: Thursday, September 14, 2006 2:48 PM To: FreeRadius users mailing list Subject: Re: Attribute Operators On Thu 14 Sep 2006 19:09, Cliff Hayes wrote: > Hello everyone, > > Does anyone know of a good reference site for the attribute operators (:=, > ==, +=) that shows what each means? http://wiki.freeradius.org/index.php/Operators -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

How to return AV pairs from within an rlm module?
by Ali Majdzadeh 14 Sep '06

14 Sep '06

Hi all I want to return AV pairs (Cisco VoIP) from within an rlm module. I tried to printf them into stdout, but it didn't work. Should I use the structures accessible within the rlm module? for example, REQUEST. Then, how should I pass them to Cisco? Regards Ali

3 3