- Freeradius-Users - lists.freeradius.org

SQL User in multiple group
by Pavel D. Kuzin 04 Sep '06

04 Sep '06

Hello! I`m have strange trouble. Radius using Oracle as backend. in sql i`m have 2 users 500 User belongs in two groups Local and Users I`m trying to check Service-Type in groups When User Appears in group Users, auth is ok, but seems it aslo check group Local Becouse Reply items from this group have in radius answer Help please. Why radius checks Local group? SELECT a.id, a.username, a.attribute, a.value, a.op FROM hosting.voip_user_check_attrs a 500 User-Password 12345 == 400 User-Password 12345 == SELECT a.id, a.username, a.groupname FROM hosting.voip_user_group a 2 500 Local 1 500 Users SELECT a.id, a.groupname, a.attribute, a.op, a.value FROM hosting.voip_group_check_attrs a 2 Local Service-Type == SIP-Caller-AVPs 1 Users Service-Type == Sip-Session SELECT a.id, a.groupname, a.attribute, a.op, a.value FROM hosting.voip_group_reply_attrs a 3 Local SIP-AVP += next_gw:192.168.39.253 4 Local SIP-AVP += have_local:1 Debug: rad_recv: Access-Request packet from host 127.0.0.1:46998, id=188, length=234 User-Name = "500(a)panda.nodex.ru" Digest-Attributes = "\n\005500" Digest-Attributes = "\001\020panda.nodex.ru" Digest-Attributes = "\002*44fbfed76560873b8901225aab710aeb385d84ed" Digest-Attributes = "\004\024sip:panda.nodex.ru" Digest-Attributes = "\003\nREGISTER" Digest-Response = "9917dd6f660e3a05c6337e0c808f6faa" Service-Type = Sip-Session Sip-URI-User = "500" User-Name = "call-id=0-13c4-3881eda0-1b1c-21d" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Mon Sep 4 14:19:23 2006 : Debug: Processing the authorize section of radiusd.conf Mon Sep 4 14:19:23 2006 : Debug: modcall: entering group authorize for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Mon Sep 4 14:19:23 2006 : Debug: hints: Matched DEFAULT at 39 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '/usr/local/radius/var/log/radius/radacct/127.0.0.1/auth-detail-20060904' Mon Sep 4 14:19:23 2006 : Debug: rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct/127.0.0.1/auth-detail-20060904 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rlm_digest: Adding Auth-Type = DIGEST Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "digest" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '500' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> '500' Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM VOIP_USER_CHECK_ATTRS WHERE Username = '500' ORDER BY id' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT VOIP_GROUP_CHECK_ATTRS.id,VOIP_GROUP_CHECK_ATTRS.GroupName,VOIP_GROUP_CHECK_ATTRS.Attribute,VOIP_GROUP_CHECK_ATTRS.Value,VOIP_GROUP_CHECK_ATTRS.op FROM VOIP_GROUP_CHECK_ATTRS,VOIP_USER_GROUP WHERE VOIP_USER_GROUP.Username = '500' AND VOIP_USER_GROUP.GroupName = VOIP_GROUP_CHECK_ATTRS.GroupName ORDER BY VOIP_GROUP_CHECK_ATTRS.id' Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM VOIP_USER_REPLY_ATTR WHERE Username = '500' ORDER BY id' Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT VOIP_GROUP_REPLY_ATTRS.id,VOIP_GROUP_REPLY_ATTRS.GroupName,VOIP_GROUP_REPLY_ATTRS.Attribute,VOIP_GROUP_REPLY_ATTRS.Value,VOIP_GROUP_REPLY_ATTRS.op FROM VOIP_GROUP_REPLY_ATTRS,VOIP_USER_GROUP WHERE VOIP_USER_GROUP.Username = '500' AND VOIP_USER_GROUP.GroupName = VOIP_GROUP_REPLY_ATTRS.GroupName ORDER BY VOIP_GROUP_REPLY_ATTRS.id' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): Released sql socket id: 1 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall: leaving group authorize (returns ok) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rad_check_password: Found Auth-Type DIGEST Mon Sep 4 14:19:23 2006 : Debug: auth: type "digest" Mon Sep 4 14:19:23 2006 : Debug: Processing the authenticate section of radiusd.conf Mon Sep 4 14:19:23 2006 : Debug: modcall: entering group authenticate for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authenticate]: calling digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "500" Digest-Realm = "panda.nodex.ru" Digest-Nonce = "44fbfed76560873b8901225aab710aeb385d84ed" Digest-URI = "sip:panda.nodex.ru" Digest-Method = "REGISTER" Mon Sep 4 14:19:23 2006 : Debug: A1 = 500:panda.nodex.ru:12345 Mon Sep 4 14:19:23 2006 : Debug: A2 = REGISTER:sip:panda.nodex.ru Mon Sep 4 14:19:23 2006 : Debug: KD = 519a37878f13e1a70683019d3507c065:44fbfed76560873b8901225aab710aeb385d84ed:dc143550193dc2a4ad1c2f68d31dac39 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authenticate]: returned from digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authenticate]: module "digest" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall: leaving group authenticate (returns ok) for request 3 Mon Sep 4 14:19:23 2006 : Debug: Processing the post-auth section of radiusd.conf Mon Sep 4 14:19:23 2006 : Debug: modcall: entering group post-auth for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: calling reply_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '/usr/local/radius/var/log/radius/radacct/127.0.0.1/reply-detail-20060904' Mon Sep 4 14:19:23 2006 : Debug: rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct/127.0.0.1/reply-detail-20060904 Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: returned from reply_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[post-auth]: module "reply_log" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: calling sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): Processing sql_postauth Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '500' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> '500' Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: returned from sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[post-auth]: module "sql" returns noop for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall: leaving group post-auth (returns ok) for request 3 Sending Access-Accept of id 188 to 127.0.0.1 port 46998 SIP-AVP += "next_gw:192.168.39.253" SIP-AVP += "have_local:1" Mon Sep 4 14:19:23 2006 : Debug: Finished request 3 -- Pavel D.Kuzin System Administrator Nodex ISP St. Petersburg, Russia pk(a)nodex.ru http://nodex.ru

1 0

Dynamic port assignment to exec program
by Shankar Ganesh C 04 Sep '06

04 Sep '06

Hi , I have a requirment to have a socket communication in the exec program from freeradius for an accounting start. I understand that for evey accounting request from free radius a exec program will be executed. How can i assign the exec program a dynamic port from the freeradius when it is invoked ? Is there any configuration needs to be done ? Thanks and regards Shankar ganesh

1 0

freeradius for cisco network device login authentication
by Vinay Kumar 04 Sep '06

04 Sep '06

I am trying to move my network device authentication from Microsoft IAS and Active directory. To Freeradius and AD. I have followed the freeradius AD integration document. Is anybody using freeradius and AD combination for login authentication into cisco network devices ? Can they share there freeradius configuration, or any tips to make this work ? thanks /vinay

4 3

AP point support 802.1x but only with WPA
by luigi natalino 04 Sep '06

04 Sep '06

Hello, I would like to know whether someone uses Freeradius with the Access Point Dlink DWL-3200. I must exclusively use the Radius server (802.1x) for the authentication without any type of WPA-*. The last firmware versions of this Access Point allow to use the Radius server only in combination of several kinds of Wpa,but this is not what serves to me. Someone would know to tell me what Firmware use to be able exclusively to use 802.1x without using for WPA (and from where I can download it)? Many Thanks Best Regards, Luigi _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

3 2

Interface binding problem
by Marcel.De_Boer＠alcatel.be 04 Sep '06

04 Sep '06

Hello, I'm trying to setup FreeRADIUS in a testing setup where the IP address to which it binds needs to be set. The RADIUS server is loaded on-demand on a number of machines, where almost all configuration is the same, except for the IP address to which it needs to listen. Normally this would be setup in the configuration file, but this means that either I can't have a centralized configuration file (which makes things very complicated, as I'm trying to provide a standard service in an experimental environment), or the configuration file needs to be changed before every FreeRADIUS startup, which also is very inconvenient. I'd like to set it up with the commandline switch (-i <ip-addr>), but this does not seem to work (tested on versions 0.2, 1.0.1 and 1.2): the server only takes the address from the configuration file and completely ignores the commandline switch. I do realise that the commandline switch is deprecated, but is it possible to get this to work somehow? Kind regards, Marcel de Boer

5 6

huntgroups, sql, and users
by jfr＠e4x.net 04 Sep '06

04 Sep '06

Greetings, we're migrating over from xtradius (yet another cistron derivative) to FreeRadius, and so far, basic authentication seem to work, but onto the huntgroups we're running into a big of a snag. We're using FreeRadius 1.1.2 on Debian w/2.6.12 Kernel, and MySQL 5.0.22 installed FreeRadius stuff via training wheels (apt-get install freeradius freeradius-mysql freeradius-dialupadmin) What we're trying to do is send spacific attributes based on the NAS sending the request... for example: huntgroups file: tc1 NAS-IP-Address = 1.2.3.4 GP NAS-IP-Address = 1.2.3.5 for tc1, which only has 48 lines, we used to assign an IP based on port: users file: DEFAULT Service-Type = Framed-User, Huntgroup-Name = "tc1" Framed-IP-Address = 1.2.3.100+, Framed-IP-Netmask = 255.255.255.255, Fall-Through = Yes #(and for the GP, which is actually globalpop): DEFAULT Service-Type = Framed-User, Huntgroup-Name = "GP" Ascend-Data-Filter = "ip in forward tcp est", Ascend-Data-Filter = "ip in forward dstip 1.2.3.25/32 0", Ascend-Data-Filter = "ip in drop tcp dstport = 25", Ascend-Data-Filter = "ip in forward 0", Fall-Through = Yes so, in theory, a request coming in via a GP nas, should get all those silly Ascend-Data-Filter attributes, and the tc1 box should not, but instead have an IP based on 1.2.3.100 plus the port number. in the authorize section in radiusd.conf, there is an entry for "files" which does indeed point to the users file in the files section. Also turned on "compat=yes" but no luck there. huntgroups is in the preprocess area, and preprocess is in authorize. Am I missing something somewhere? This whole chain of events gets rather confusing. Before (with xtradius) everything was done in the users file, which just fired off an external app which I wrote, that manually checks the database to see if username/password exists.. but freeradius is a little more detailed. - - - Jon

2 2

Proxy IP Address
by Doug Hardie 02 Sep '06

02 Sep '06

I have a situation where all my authentication requests are proxied to me. I have 4 different groups of users that require unique local polieies and have been using a fairly complicated parsing of the Called ID phone number and a couple other fields to figure out which group a request is in. However, I just found out that each of the 4 groups is being proxied through different proxy servers. It would be real easy to distinguish the group from the IP address that the proxy request is being sent from. However, I have not been able to find a variable that contains that information. Have I missed it?

2 2

Regarding handling of threads
by Ravi S M 02 Sep '06

02 Sep '06

Hi I have some doubts regarding free radius server. 1) When we run server parent exits by spawning a child to handle client's requests, so during this time purify also exits but shows 95 leaks. (leak report shows from "src/main/modules.c" from line num "207") * My doubt is whether these leaks which are shown with purify are freed in child or how these leaks get rid off?? * Or when parents calls exit(0), do all memory are freed ?? 2) For handling multiple requests, is threads implemented? If so how? 3) If threads are not implemented how multiple requests are handled? Please I am grateful if you can provide some information. Thanks & Regards Ravi.S.M ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

Re: Is it possible to log connection details in MySQL?
by Sean 01 Sep '06

01 Sep '06

Hi, Saving your log files in mySQL would seem to be a huge waste of disk space. Why not access your log files from an application that can parse them and present them in whatever format you want. I can send you some PHP examples that I've scripted if you like. Regards, Sean http://swarmhotspots.com

1 0

certificate issue
by Kartthik 01 Sep '06

01 Sep '06

1 0