- Freeradius-Users - lists.freeradius.org

Implimenting Capping with FreeRadius
by Shawn Hamman 04 Apr '06

04 Apr '06

Hi, OS: Fedora C4 FR: 1.0.2-2 DB: MySQL 4.1.11-2 I was wondering if anybody has a more elegant solution to implementing capping with FreeRadius than writing a script that totals the bytes in/out in the radacct table every couple of minutes and updates the radcheck table to deny further logins? Shawn

4 3

(no subject)
by Bugneac Constantin 04 Apr '06

04 Apr '06

Hi! I have Freeradius ver. 1.1.1 running with MySQL and configured for EAP-PEAP to work with Cisco AP1231AG Wi-Fi Access Point. It is used for user authentication and accounting. I configured AP for accounting updates every 1 minute. I observed a strange behavior. This I get when user is logged in: rad_recv: Accounting-Request packet from host 193.100.101.230:1646, id=11, length=298 Acct-Session-Id = "00000002" Called-Station-Id = "0012.7fce.63d0" Calling-Station-Id = "0004.238b.f5e5" Cisco-AVPair = "ssid=Registru_Networks" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=Sala_de_Sedinte_et2" WISPr-Location-Name = "Sala_de_Sedinte_et2" User-Name = "cisco" Cisco-AVPair = "connect-progress=Call Up" Acct-Session-Time = 566 Acct-Input-Octets = 1853338 Acct-Output-Octets = 1811068 Acct-Input-Packets = 3317 Acct-Output-Packets = 2230 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "257" NAS-Port = 257 Service-Type = Framed-User NAS-IP-Address = 193.100.101.230 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 20 modcall[preacct]: module "preprocess" returns noop for request 20 rlm_acct_unique: Hashing 'NAS-Port = 257,Client-IP-Address = 193.100.101.230,NAS-IP-Address = 193.100.101.230,Acct-Session-Id = "00000002",User-Name = "cisco"' rlm_acct_unique: Acct-Unique-Session-ID = "08f82868ccd223c7". modcall[preacct]: module "acct_unique" returns ok for request 20 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 20 modcall: leaving group preacct (returns ok) for request 20 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 20 radius_xlat: 'cisco' rlm_sql (sql): sql_set_user escaped user --> 'cisco' radius_xlat: 'UPDATE radacct SET FramedIPAddress = if(''='VoIP','',''), AcctInputOctets = '1853338', AcctOutputOctets = '1811068' WHERE AcctSessionId = '00000002' AND UserName = 'cisco' AND NASIPAddress= '193.100.101.230' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 After 10 minutes of working AP sends Access-Request to Radius with Service-Type = Authenticate-Only: rad_recv: Access-Request packet from host 193.100.101.230:1645, id=11, length=119 User-Name = "cisco" Framed-MTU = 1400 Called-Station-Id = "0012.7fce.63d0" Calling-Station-Id = "0004.238b.f5e5" Service-Type = Authenticate-Only Message-Authenticator = 0x022a4d954819b3fd4dc515c7041f6335 EAP-Message = 0x0201000a01636973636f NAS-Port-Type = Wireless-802.11 NAS-Port = 257 NAS-IP-Address = 193.100.101.230 and after authenticating I get: Processing the preacct section of radiusd.conf modcall: entering group preacct for request 28 modcall[preacct]: module "preprocess" returns noop for request 28 rlm_acct_unique: Hashing 'NAS-Port = 257,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 193.100.101.230,Acct-Session-Id = "00000002",User-Name = "cisco"' rlm_acct_unique: Acct-Unique-Session-ID = "006880115bf32fe3". modcall[preacct]: module "acct_unique" returns ok for request 28 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 28 modcall: leaving group preacct (returns ok) for request 28 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 28 radius_xlat: 'cisco' rlm_sql (sql): sql_set_user escaped user --> 'cisco' radius_xlat: 'UPDATE radacct SET RX='', TX='', AcctStopTime = '2006-04-04 11:45:21', AcctSessionTime = '0', AcctInputOctets = '0', AcctOutputOctets = '0', AcctTerminateCause = if(''='VoIP','',''), AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '00000002' AND UserName = 'cisco' AND NASIPAddress = '193.100.101.230' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 This clears the accounting with zero and I loose statistics. Why I get Client-IP-Address = 127.0.0.1 in second accounting hash calculation? In first accounting request Client-IP-Address is 193.100.101.230. I think this causes hases not to be the same (006880115bf32fe3 visa 08f82868ccd223c7) and the result is interim accounting clearing. Is this a BUG? Where I am wrong? Please help me to find the problem. Constantin.

1 0

Install freeradius 1.1.1 get error
by 杨呈飞 04 Apr '06

04 Apr '06

After ./configure �Cprefix=/usr/local/freeradius make make install I get: /home/test/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /usr/local/freeradius/libradius-1.1.1.so (cd /usr/local/freeradius && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /home/test/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /usr/local/freeradius/libradius.la /home/test/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /usr/local/freeradius/libradius.a ranlib /usr/local/freeradius/libradius.a chmod 644 /usr/local/freeradius/libradius.a libtool: install: warning: remember to run `libtool --finish /usr/local/freeradius/lib' rm -f /usr/local/freeradius/lib/libradius-1.1.1.la; ln -s libradius.la /usr/local/freeradius/lib/libradius-1.1.1.la ln: creating symbolic link `/usr/local/freeradius/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/home/test/freeradius-1.1.1/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/test/freeradius-1.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/test/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/test/freeradius-1.1.1' make: *** [install] Error 2 how can I fix that?

3 2

Why must clients exist when radius starts?
by Douglas Phillipson 03 Apr '06

03 Apr '06

Is there a configuration option that will allow me to put a client IP in the clients file without the client actually existing yet? It seems when radius starts, if a client doesn't exist the daemon dies. I looked in the archives but I don't quite know what to query for. Also is it the case that when the log is rolled, the daemon re-reads the config files and would die if it can't contact a client at this time? Regards Doug P

3 2

Segmentation fault due to bind_address = 0.0.0.0
by Rainer Poisel 03 Apr '06

03 Apr '06

Hi, I got a segmentation fault when i tried to run freeradius (Versions 1.0.4, 1.0.5, 1.1.0 and 1.1.1) on Debian (Sarge) or Suse (10.0) with options enabled in the attached config-file. Meanwhile I found out that the segmentation fault happened because of the following setting: > bind_address = 0.0.0.0 No I replaced it with the default value > bind_address = * and everything is fine :) Thanks for reading, best regards, Rainer

2 1

(no subject)
by Oliver.Stutzke＠atosorigin.com 03 Apr '06

03 Apr '06

Hi all, i want to use FreeRADIUS (1.0.5) as an RADIUS Proxy, and must change the NAS-IP-Address and the User-Realm before sending it to an other Rasius Server. I tried it within the preproxy_users file with DEFAULT User-Name := `%{Stripped-User-Name:-%{User-Name}}@mycompany.com`, NAS-IP-Address := x.x.x.x The change of the User-Realm works, but not the NAS-IP-Address. The server sends the authentication requests with its hostname (in detail with the aoutput of the /etc/hostname command). Any ideas of helpfull information are welcome. Regards Oliver Stutzke

1 0

Other attributes
by JVUVANT Yahoo 03 Apr '06

03 Apr '06

Hi all Does freeradius integer specific attributes from boxes as redback ? if yer, how can we use it ? Thanks Jacques ___________________________________________________________________________ Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international. Téléchargez sur http://fr.messenger.yahoo.com

1 0

Setup Freeradius for Challenge response authentication
by Yizhi Lao 03 Apr '06

03 Apr '06

Dear all, I am a new user of freeradius, currently using freeradius 1.1.0 on Redhat Linux. I wish to setup freeradius for a 2 factor authentication, such that: NAS issue an Access-Request to Radius server Radius server authenticate against LDAP once successful -- Radius server then issue an Access-Chanllenge to NAS (second factor, asking for an additional password/token) NAS reply with an Acces-Request Radius server then authenticate the second Access-request and reply to NAS. The above is roughly the authentication flow I wish to achieve. After reading the configuration setup instructions, I still have no clue where to start with the configuration, can some one please enlighten me? Is there a custom built radius module required? Thanks in advance for all the help regards Kaden --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC for low, low rates.

2 4

MACs
by Mordor Networks 03 Apr '06

03 Apr '06

Hello I\'m trying to log the users MAc address using pppoe and FR + mysql i added AVpair to the users file "calling-station-id" but checkval could not find iten rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 21

1 0

Separate query for authentication and authorization
by vignesh 03 Apr '06

03 Apr '06

Hello I want to have multiple queries in RADIUS (e.g. one for prepaid and one for postpaid users). can I do this in Free Radius, if yes how do I specify free radius to execute particular query. Also the authentication and authorization seems to call the same query. Can I have different query fro authentication and authorization. Thanks Vignesh

3 2