- Freeradius-Users - lists.freeradius.org

Limiting Bandwidth Usage !?!?
by Calode 16 Aug '06

16 Aug '06

I know that this question was answered so many times cause i read almost all the q/a but i am very a beginner to all Linux world and especially custom configuration , compiling editing and so on ... but i am very interested in learning all of this new technic but i need some help ... can u guys teach me in some way ?! cause i understood some of the answers but couldn't really apply the code ... i seem to be An idiot when it comes to customizing ... I've managed to make the configuration work @ its default settings with some text readings but again i am stuck (configuration is Nas + Freeradius + MySql + Dialup_admin ) plz help me ! Perhaps some clarification on how to reconfigure rlm_sqlcounter ... i couldn't really understand what is in the docs . Best Regards Claude Rizkallah.

1 0

how to input data in radius MySQL database for using MAC address authentication
by Edward.Shih＠rcc.edu 16 Aug '06

16 Aug '06

Hi everyone, I read through some of threads about using MAC address authentication, but the issue still wasn't solved. I am new to this field, and I want to implement a FreeRadius server to communicate with Cisco Aironet 1200 Access Point using MAC address authentication method. The network environment: 1. Set up Cisco AP to use Radius server, and MAC Address Authentication 2. Set up freeRadius (Ver.1.1.2) on FreeBSD server (Ver 6.1), and use MySQL database (not users file) 3. I insert a record into radcheck table: use MAC address as user name 1 000b6b54a738 Password := '' 4. Use Ntradping.exe to test the radius server with above user account (leave password as blank), and get Access-Reject. Obviously, I guess the issue is in the password. If I put the some characters into the password field in radcheck table and test it again with the same password in Ntradoing.exe, I do get Access-Accept. But, I don't think Cisco AP will send a password when using MAC address authentication. I am wondering how to input data in radius database for AP using MAC address authentication, and where I should fill in all relating settings. Any input from the members of this list would be much appreciated. Thanks & Regards, Edward

1 0

Freeradius doesn't read vendor specific dictionary
by SusePersonalTrainer 16 Aug '06

16 Aug '06

Hi to all! I have a problem. My freeradius Version 1.0.2 (debian) server doesn't read dictionary.mikrotik file. My configuration includes /usr/share/freeradius/disctionary wich includes dictionary.mikrotik. The dictionary.mikrotik contains the attribute Rate-Limit I use to manage the user's bandwith. Moreover the rlm_sql module says: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'steve' ORDER BY id' rlm_sql: unknown attribute Rate-Limit Why?

3 2

Rép. : Re: Comments problem in huntgroups file
by Thomas BAUDELET 16 Aug '06

16 Aug '06

Thanks, I'm not able to change the parser. Is there a problem to use the comments with the comma like this ? FreeRadius may think that #test is an attribute as it follows a comma ? Switchs NAS-IP-Address == 10.195.132.7 ,# test Can I use it like this ? Or maybe a ";" or "//" will work ? Thomas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. **********************************************************************

3 2

RE: sql segmentaiton fault
by Hasan Ovuc 16 Aug '06

16 Aug '06

Try to start with strace tool, maybe it helps you. strace radiusd -d /etc/raddb > -----Original Message----- > From: > freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.free > radius.org > [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@li > sts.freeradius.org] On Behalf Of Nicolas Baradakis > Sent: Wednesday, August 16, 2006 12:09 PM > To: FreeRadius users mailing list > Subject: Re: sql segmentaiton fault > > YvesDM wrote: > > > Created my own debs of freeradius 1.0.5 > > Please upgrade to 1.1.2. > > > Everything works, but when i try to use mysql i get a segmentation > > fault running radiusd -X > > See http://freeradius.org/radiusd/doc/bugs > > > I used the rules file in the debian dir of the tar.gz, but added > > --with-experimental modules as a configure option in it > cause i need > > the sqlcounter. > > sqlcounter is in the stable modules list in versions >= 1.1.0. > > -- > Nicolas Baradakis > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

1 0

Second reload Error with module rlm_eap
by Thomas BAUDELET 16 Aug '06

16 Aug '06

When I reload my configuration files with "rc.radiusd reload", the first reload is ok, but the second one fails with an SSL error. First Reload: Wed Aug 16 11:59:59 2006 : Info: Reloading configuration files. Wed Aug 16 11:59:59 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Aug 16 11:59:59 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Aug 16 11:59:59 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Aug 16 11:59:59 2006 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Aug 16 11:59:59 2006 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Aug 16 11:59:59 2006 : Info: Ready to process requests. Second Reload: Wed Aug 16 12:00:07 2006 : Info: Reloading configuration files. Wed Aug 16 12:00:07 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Aug 16 12:00:07 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Aug 16 12:00:07 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Aug 16 12:00:07 2006 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Wed Aug 16 12:00:07 2006 : Error: rlm_eap_tls: Error reading certificate file Wed Aug 16 12:00:07 2006 : Error: rlm_eap: Failed to initialize type tls Wed Aug 16 12:00:07 2006 : Error: radiusd.conf[10]: eap: Module instantiation failed. Wed Aug 16 12:00:07 2006 : Error: radiusd.conf[1920] Unknown module "eap". Wed Aug 16 12:00:07 2006 : Error: radiusd.conf[1867] Failed to parse authenticate section. Does anyone has an idea ? ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. **********************************************************************

1 0

Expiration account
by Ludovic Toussaint 16 Aug '06

16 Aug '06

Hi, I got Freeradius working with Chillispot and Mysql. I would like to create account with expiration attribute. For example, I would like to create account with a validity of 24 hours after the first connection. And i would like do to the same with validity of à week. I tryed to done it with PhpMyprepaid, but the way to do it is not clear for me. If someone can explain me how to handle this problem. I know that i have to activate "POSTAUTH" in Radius.conf and to insert a query in Mysql.conf. Thanks in advance

1 0

RE: access reject replies
by Hasan Ovuc 16 Aug '06

16 Aug '06

Dear Alan, I added below line after line 458 in src/main/util.c and everything is OK. pairmove2(&vps, &(packet->vps), PW_VENDOR_SPECIFIC); Thank you... Hasan Ovuc & Levent Kurt Superonline.net >-----Original Message----- >From: freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@lists.freera dius.org] On Behalf Of Alan DeKok >Sent: Tuesday, August 15, 2006 5:47 PM >To: FreeRadius users mailing list >Subject: Re: access reject replies > >"Hasan Ovuc" <hasan.ovuc(a)superonline.net> wrote: >> I am using FR-1.0.1, unixODBC 2.2.11, Sybase ODBC-12_5 drivers on FC5. >>I have problem version of FR because of I couldn't upgrade it. New >> versions of FR does not send cisco attributes in access reject replies. > > See src/main/util.c, function rfc_clean(). You will have to edit & recompile. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

1 0

RE: access reject replies
by Hasan Ovuc 16 Aug '06

16 Aug '06

>-----Original Message----- >From: freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@lists.freera dius.org] On Behalf Of Alan DeKok >Sent: Tuesday, August 15, 2006 5:47 PM >To: FreeRadius users mailing list >Subject: Re: access reject replies >"Hasan Ovuc" <hasan.ovuc(a)superonline.net> wrote: >> I am using FR-1.0.1, unixODBC 2.2.11, Sybase ODBC-12_5 drivers on FC5. >>I have problem version of FR because of I couldn't upgrade it. New >> versions of FR does not send cisco attributes in access reject replies. See src/main/util.c, function rfc_clean(). You will have to edit & recompile. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

1 0

pair_cmp overwrites user file instance data [sec: unclas]
by Ranner, Frank MR 16 Aug '06

16 Aug '06

Hello, In my users file I have rules that link ldap groups to hunt groups, possibly with suffixes. They look something like this: DEFAULT Ldap-Group == `%{Huntgroup-Name}` Access-Level := RW, Service-Type = Administrative-User, Cisco-AVPair := "shell:priv-lvl=15", Passport-Command-Impact = configuration # Check passport access groups DEFAULT Ldap-Group == `%{Huntgroup-Name}_configuration` Passport-Command-Impact = configuration DEFAULT Ldap-Group == `%{Huntgroup-Name}_systemadmin` Passport-Command-Impact = systemAdministration DEFAULT Ldap-Group == `%{Huntgroup-Name}_passive` Passport-Command-Impact = passive # These checks cover Nortel switches, et al. DEFAULT Ldap-Group == `%{Huntgroup-Name}_RWA` Service-Type = Administrative-User, Access-Level := RWA DEFAULT Ldap-Group == `%{Huntgroup-Name}_RO` Access-Level := RO, Service-Type = Nas-Prompt-User On the first request that comes in, the system worked fine. In the radiusd output you would see and ldap group search for, say, QLD_South, then QLD_South_configuration, etc. Eventually one would match (or all would fail) and the request would complete. Now a second request for a different huntgroup would come in, but the ldap search would stil be for QLD_South and so on. After tracing through with gdb I discovered that pair_cmp when xlating the config item was actually overwriting the source data with the xlat result. I didn't want to fiddle with pair_cmp so i looked at rlm_files with the intention of supplying pair_cmp with a copy of the user record rather than the original. It turns out that pl->check was already being copied, so all that needed to be done was make the copy earlier, and supply check_tmp rather than pl->check to pair_cmp. Long story short, this fixes the problem. here is the patch: *** src/modules/rlm_files/rlm_files.c~ Thu Oct 21 03:14:38 2004 --- src/modules/rlm_files/rlm_files.c Tue Aug 15 12:48:22 2006 *************** *** 313,324 **** continue; } /* * If the current request matches against the * check pairs, then add the reply pairs from the * entry to the current list of reply pairs. */ ! if ((paircmp(request, request_pairs, pl->check, reply_pairs) == 0)) { if ((mainconfig.do_usercollide) && (strcmp(pl->name, "DEFAULT"))) { --- 313,327 ---- continue; } + /* Don't let paircmp overwrite original record when expanding variables */ + check_tmp = paircopy(pl->check); + /* * If the current request matches against the * check pairs, then add the reply pairs from the * entry to the current list of reply pairs. */ ! if ((paircmp(request, request_pairs, check_tmp, reply_pairs) == 0)) { if ((mainconfig.do_usercollide) && (strcmp(pl->name, "DEFAULT"))) { *************** *** 331,337 **** check_save = paircopy(request->config_items); /* Copy this users check pairs to the request */ - check_tmp = paircopy(pl->check); pairmove(check_pairs, &check_tmp); pairfree(&check_tmp); --- 334,339 ---- *************** *** 367,373 **** DEBUG2(" users: Matched entry %s at line %d", pl->name, pl->lineno); found = 1; - check_tmp = paircopy(pl->check); reply_tmp = paircopy(pl->reply); pairxlatmove(request, reply_pairs, &reply_tmp); pairmove(check_pairs, &check_tmp); --- 369,374 ---- *************** *** 379,384 **** --- 380,387 ---- */ if (!fallthrough(pl->reply)) break; + } else { + pairfree(&check_tmp); } }

1 0