- Freeradius-Users - lists.freeradius.org

download of 1.1.2.tar.gz broken
by Elizabeth Murray 24 Aug '06

24 Aug '06

I've been trying to download your latest and greatest. The link is not working. Error message is 550 /pub/radius/freeradius-1.1.2.tar.gz: No such file or directory The same is true for the PGP Signature V. Elizabeth Murray, CNE5, CNE6, MCP Information Technology Specialist V Information Technology Bureau Iowa Department of Natural Resources 515-281-8565 elizabeth.murray(a)dnr.state.ia.us

3 2

User-Password and regular expression problem
by V.Kukushkin 24 Aug '06

24 Aug '06

Hi I want to disable login users with empty passwords So, the entry in my "users" file is: --------------------------------- DEFAULT User-Password !~ "^$" Framed-MTU = 576, Acct-Interim-Interval := 60 DEFAULT Auth-Type := Reject Reply-Message = "Unknown user subscription type" --------------------------------- And I expected Access-Reject with reply message. Instead I got Access-Reject but for another reason - Incorrect password (see debugging output below). Password is not empty and stored in MySQL database as clear text. Same result I saw when used simple (not regular) expression: ---------------------------------------- DEFAULT User-Password != "" Framed-MTU = 576, Acct-Interim-Interval := 60 DEFAULT Auth-Type := Reject Reply-Message = "Unknown user subscription type" --------------------------------------- 1) If I remove this check from users file, the user can log in successfuly. 2) Regular expression for User-Name is working well, e.g. DEFAULT User-Name =~ "^[-_[:alnum:]]+$", NAS-Port-Type == Ethernet Framed-MTU = 576, Acct-Interim-Interval := 60 It seems to me that the Value of User-Password is broken during check and not equal to Value taken from database. My questions is: Is User-Password handled in the same way as another attributes in "user" file OR not ? How to disable users with empty passwords ? PS: The problem occured with versions 1.0.1 and 1.0.5 My backend - MySQL with standard radius database. OS - Redhat 9.x, i386. Debugging output of "radiusd -X" looks like this: --------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:1112, id=47, length=65 User-Name = "cftest" User-Password = "1234567890" Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "r9999" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060824' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20060824 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cftest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 14 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'cftest' rlm_sql (sql): sql_set_user escaped user --> 'cftest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username=(SELECT distinct username FROM usergroup WHERE groupname&(SELECT regionid FROM regionslist WHERE routerid='r9999') AND username='cftest') ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: num_fields 5 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'cftest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: num_fields 5 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'cftest' ORDER BY id' rlm_sql_mysql: num_fields 5 radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'cftest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: num_fields 5 rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 -- regards, Vladimir

2 1

Re: Help to modify the reply list for accounting response packets.
by Shankar Ganesh C 24 Aug '06

24 Aug '06

Hi Allan, I understand from the mail archive and the source code that i need to use the paircreate and pairadd functions to add the value pairs to the radius packet and use the Rad_send library call to send the accounting packets. Can i use the above approach to send the accounting response packet with attributes? Pls let me know if the understanding is correct or do i need to adopt some other mechnasism to add the support of sending the accounting response packets with attributes? Thanks for your time. Rgds Shankar ganesh

1 0

RE: Report Generator
by Edward.Shih＠rcc.edu 24 Aug '06

24 Aug '06

Yes, Sean. May I have a copy? Thanks a bunch. Edward -----Original Message----- From: freeradius-users-bounces+edward.shih=rcc.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+edward.shih=rcc.edu@lists.freeradius.or g] On Behalf Of Sean Sent: Wednesday, August 23, 2006 12:58 PM To: freeradius-users(a)lists.freeradius.org Subject: Report Generator Hi, Ive written a report generator in PHP and HTML that will allow your clients to generate usage reports from the FreeRadius log files. When the user logs in he/she is asked for their IP address and the Month that they want to display. If anyone wants a copy let me know. If there is enough interest I'll make it available for public download. Regards, Sean Bracken http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Need Help Configuration "Freeradius-MySQL"
by Albis Nunez 24 Aug '06

24 Aug '06

Hi everyone, I'm trying to configure mysql to work together with the freeradius but I'm getting the following error show below, can someone help me to resolve this issue, thanks in advance. rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1824] Unknown module "sql". radiusd.conf[1753] Failed to parse authorize section. Regards, AL --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

1 0

Autz-Type Config Clarification
by Nathan L. Cable 24 Aug '06

24 Aug '06

I'm setting up a Radius environment which covers several physical sites. Usernames and passwords come from an Active Directory server via ntlm_auth. Each site has a group in the NT domain. So, it would be nice to have multiple auth-types for each area. For clarification, I've tested my server without the Autz-type arguments (ie, only using the one mschap instance), and everything works fine. Everything also works great if I declare multiple instances of mschap, and just have the radius server search through them in order - however, this seems to be a rather inefficient way of doing things. The debug output of radiusd indicates that my modules are being loaded, but when the client authenticates, it's not done so against an auth-type. Any thoughts as to why this is not working? Here are the relevant portions of my config files: # radiusd.conf: . . . modules { . . . mschap group1 { authtype = group1 ...some config stuff... } mschap group2 { authtype = group2 ...some config stuff... } } . . . authorize { preprocess files Autz-Type group1 { group1 } Autz-Type group2 { group2 { } eap } authenticate { Auth-Type group1 { group1 } Auth-Type group2 { group2 { } eap } . . . # users DEFAULT Called-Station-Id == "00-11-22-33-44-55-66",Autz-Type := group1 DEFAULT Autz-Type = group2

4 5

using DN from previous default entry
by Rohaizam Abu Bakar 24 Aug '06

24 Aug '06

FreeBSD 6.1 with FR 1.1.2 I'm trying to detect user that has attribute Service=REAL and search through different LDAP tree as below config in users file. The problem happened when both tree (DIALUP & LDAP) has user's entry with same uid. So although first DEFAULT entry is not match when searching for attribute Service=REAL... the 2nd DEFAULT will use DN from first DEFAULT for authenticate... Why Feeradius not using the DN from 2nd query?? It should use ou=RADIUS not ou=DIALUP for auth. Please refer below debug log.. thanks.. ####################################### users:- DEFAULT ldapdialup1-Ldap-Group == "REAL", Autz-Type := DIALUP ## NORMAL DIALUP DEFAULT Autz-Type := LDAP rad_recv: Access-Request packet from host 192.228.137.77:55146, id=13, length=46 User-Name = "bacang" User-Password = "xxxxxxxxx" rad_rmspace_pair: User-Name now 'bacang' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '/' in User-Name = "bacang", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 0 rlm_realm: No '@' in User-Name = "bacang", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "bacang" rlm_realm: Proxying request from user bacang to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=DIALUP,ou=AAA,ou=People,dc=xxxxx,dc=xxxx' radius_xlat: '(uid=bacang)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=Sysadmin,ou=Applications,dc=xxxxxx,dc=xxxx/xxxxxxxxxx to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=DIALUP,ou=AAA,ou=People,dc=xxxxx,dc=xxxx, with filter (uid=bacang) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(uid=bacang)(objectclass=radiusprofile))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=DIALUP,ou=AAA,ou=People,dc=xxxxxxx,dc=xxxx, with filter (&(jaringService=REAL)(&(uid=bacang)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group REAL not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=DIALUP,ou=AAA,ou=People,dc=xxxxx,dc=xxx' radius_xlat: '(&(uid=bacang)(objectclass=radiusprofile))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 61.6.32.201:389, authentication 0 rlm_ldap: bind as cn=Sysadmin,ou=Applications,dc=xxxxxxx,dc=xxxxx/xxxxxxxxxxxxxx to xxxxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=DIALUP,ou=AAA,ou=People,dc=xxxxxx,dc=xxxx, with filter (&(jaringService=REAL)(&(uid=bacang)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group REAL not found or user is not a member. users: Matched entry DEFAULT at line 23 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for bacang radius_xlat: '(uid=bacang)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxxxx,dc=xxx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=Sysadmin,ou=Applications,dc=xxxxx,dc=xxx/xxxxxxxxxxxxx to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxxxx,dc=xxxx, with filter (uid=bacang) rlm_ldap: checking if remote access for bacang is allowed by dialupAccess rlm_ldap: Added password {CRYPT}Y3EhshegMNPxA in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: Setting Auth-Type = ldap1 rlm_ldap: user bacang authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: leaving group LDAP (returns ok) for request 0 rad_check_password: Found Auth-Type ldap1 auth: type "ldap1" Processing the authenticate section of radiusd.conf modcall: entering group ldap1 for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "bacang" with password "xxxxxxxx" rlm_ldap: user DN: uniqueIdentifier=10614,ou=DIALUP,ou=AAA,ou=People,dc=xxxxx,dc=xxx rlm_ldap: (re)connect to 127.0.0.1:389, authentication 1 rlm_ldap: bind as uniqueIdentifier=10614,ou=DIALUP,ou=AAA,ou=People,dc=xxxxxx,dc=xxx/xxxxxx to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user bacang authenticated succesfully modcall[authenticate]: module "ldap1" returns ok for request 0 modcall: leaving group ldap1 (returns ok) for request 0 Login OK: [bacang] (from client sysadmin port 0) Sending Access-Accept of id 13 to 192.228.137.77 port 55146 Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Framed-Protocol = PPP Service-Type = Framed-User

1 0

RE: No memory
by Hasan Ovuc 24 Aug '06

24 Aug '06

It is working good without the sql backend. I assume you are right there is a problem about sql driver. I am searching it. Tesekkurler... > -----Original Message----- > From: > freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.free > radius.org > [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@li > sts.freeradius.org] On Behalf Of Peter Nixon > Sent: Thursday, August 24, 2006 11:08 AM > To: FreeRadius users mailing list > Subject: Re: No memory > > The filesystem you choose should not affect radiusd in > anything but filesystem performance. Maybe there is a problem > with your sql drivers. Does radiusd start ok if you disable > the sql backend? > > Regards > > Peter > > On Wed 23 Aug 2006 17:10, Hasan Ovuc wrote: > > I believe to solve my problem. I installed linux machine > with xfs file > > system. Xfs file system gives all memory to radius and > cached it. Even > > I try to start radiusd it gives no memory error. > > > > I set > > > > echo 2 > /proc/sys/vm/overcommit_memory > > > > onto the my system. > > > > Related link: > > > > http://www.win.tue.nl/~aeb/linux/lk/lk-9.html > > > > > -----Original Message----- > > > From: > > > freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.free > > > radius.org > > > [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@li > > > sts.freeradius.org] On Behalf Of Hasan Ovuc > > > Sent: Friday, August 18, 2006 6:10 PM > > > To: Peter Nixon; freeradius-users(a)lists.freeradius.org > > > Subject: RE: No memory > > > > > > > > > FC5 > > > kernel-smp-2.6.15-1.2054_FC5 > > > > > > Additional info: > > > Sybase ODBC-12_5 odbc drivers > > > > > > Which db connection type do you suggest to connect SYBASE > database ? > > > > > > Rlm_unixodbc, rlm_iodbc or rlm_perl > > > > > > > -----Original Message----- > > > > From: Peter Nixon [mailto:listuser@peternixon.net] > > > > Sent: Friday, August 18, 2006 3:22 PM > > > > To: freeradius-users(a)lists.freeradius.org > > > > Cc: Hasan Ovuc > > > > Subject: Re: No memory > > > > > > > > On Fri 18 Aug 2006 14:39, Hasan Ovuc wrote: > > > > > Dear Members, > > > > > > > > > > I am trying to use > > > > > freeradius-snapshot-20060817 > > > > > unixODBC-2.2.11 > > > > > ODBC-12_5 > > > > > > > > > > Radiusd successfully started, after first sql query it > > > > > > dies with no > > > > > > > > memory error. > > > > > > > > Which Linux version? > > > > > > > > -- > > > > > > > > Peter Nixon > > > > http://www.peternixon.net/ > > > > PGP Key: http://www.peternixon.net/public.asc > > > > > > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma > > > ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, > bu mesajin > > > yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde > kullanilmasi > > > yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, > SUPERONLINE'a > > > degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere > > > karsi test edilmistir. > > > > > > This e-mail and any files transmitted with it are > confidential and > > > intended solely for the use of the individual or entity > to whom they > > > are addressed. If you are not the intended recipient you > are hereby > > > notified that any dissemination, copying or use of the > information > > > is prohibited. The opinions expressed in this message belong to > > > sender alone. There is no implied endorsement by SUPERONLINE.This > > > e-mail has been scanned for all known computer viruses. > > > > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya > kuruma ozeldir. > > Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin > > yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde > kullanilmasi > > yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a > > degil sadece gondericiye aittir. Bu mesaj bilinen tum > viruslere karsi test edilmistir. > > > > This e-mail and any files transmitted with it are confidential and > > intended solely for the use of the individual or entity to > whom they > > are addressed. If you are not the intended recipient you are hereby > > notified that any dissemination, copying or use of the > information is prohibited. > > The opinions expressed in this message belong to sender > alone. There > > is no implied endorsement by SUPERONLINE.This e-mail has > been scanned > > for all known computer viruses. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

1 0

remember visited pages
by ego seek 24 Aug '06

24 Aug '06

how can I write in my db which pages are watched by a user? thank

1 0

Max ATPS
by Guido 24 Aug '06

24 Aug '06

Hello everybody, I have installed up and running FreeRADIUS Version 1.0.2. The server is an Intel Pentium 4 Xeon 3.0 Ghz, 1GB DDR, HDD 120 SATA. I need know how many ATPS (attemps per seconds) or haw many minutes per months can this scenario support working under stress. Somebody can help me? Thanks in advanced, Guido

4 4