- Freeradius-Users - lists.freeradius.org

Accounting-Response packet with invalid signature!
by Ryan Melendez 21 Mar '06

21 Mar '06

Hello, I am getting Accounting-Response packets from one particular NAS with an invalid signature. I verified the shared secret is correct. Radiusd is configured to proxy Accounting-Request packets the following way. proxy server { synchronous = no retry_delay = 10 retry_count = 30 dead_time = 300 } This particular NAS take about 25 seconds to send the Accounting-Response. By the time it's sent its response freeradius has moved on to the second or third retry. The authenticator calculated by the NAS is for the initial accounting packet and is invalid for the second request due to a change in the Acct-Delay-Time (and possibly proxy-state). Freeradius then bails out: Received Accounting-Response packet from with invalid signature! Server rejecting request 1. Finished request 1 Going to the next request rl_next: returning NULL Cleaning up request 1 ID 11 with timestamp 44206de3 If I change the config to: retry_delay = 30 retry_count = 1 then freeradius sleeps for 30 seconds and does not send a second packet. Waking up in 31 seconds... rad_recv: Accounting-Response packet from host :1813, id=1, length=25 Proxy-State = 0x323233 Sending Accounting-Response of id 223 to :51818 Finished request 0 What is the correct way to do this according to the RFC? 25 seconds is an extremely long delay but it seems there should be a way to handle this. I tried playing with cleanup_delay, but I'm not getting anywhere. Do I have to set the retry_delay very high to have a better chance? 25 seconds is a long time to wait if the host is actually down. Thanks, Ryan

2 1

Limiting number of EAP connexion
by JVUVANT Yahoo 21 Mar '06

21 Mar '06

Hi people Someone can tell me how to limit number of simultaneous EAP connexions with same login/password ? Thanks Jacques

2 1

Using a LDAP attribute value as the complete HA1 digest string
by Alan 21 Mar '06

21 Mar '06

I would like to use encrypted passwords stored as an attribute value in LDAP. How can I tell the rlm_digest driver to use the complete User-Password attribute value as the full Digest-HA1 string? Instead it takes the value and appends it to the end of the of the A1 string. Please help. ~Alan -- This hash value placed in the LDAP User-Password attribute: $ echo -n 'alan:sip.host.com:test' | md5sum eeee888a05bbdb4b18a5ab5abd3b37c2 Authentication from a SIP server to FreeRadius rlm_ldap and rlm_digest modules: rlm_ldap: - authorize rlm_ldap: performing user authorization for alan radius_xlat: '(uid=alan)' radius_xlat: 'ou=People,o=host.com,o=isp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,o=host.com,o=isp, with filter (uid=alan) rlm_ldap: Added password eeee888a05bbdb4b18a5ab5abd3b37c2 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user alan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3634 modcall: leaving group authorize (returns ok) for request 3634 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3634 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "alan" Digest-Realm = "sip.host.com" Digest-Nonce = "44202102581bdded7ea02108890770e6ad22e27e" Digest-URI = "sip:sip.host.com" Digest-Method = "REGISTER" A1 = alan:sip.host.com:eeee888a05bbdb4b18a5ab5abd3b37c2 A2 = REGISTER:sip:sip.host.com KD = 263c616981c1331d745557f8c7685613:442025f0efb6eb92635e3b938327dfee91ea8b12:f0 8bbaef30f8f1f7c252330c693a3bb3 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 3634 modcall: leaving group authenticate (returns reject) for request 3634 auth: Failed to validate the user.

3 2

Mod_auth_radius
by Cris Boisvert 21 Mar '06

21 Mar '06

I have a couple macs running apache (Preconfigured via Apple) The source is not supplied and the apple didn't apxs.. Has anyone installed mod_auth_radius on a Apple running osx? Thanx

1 0

MySQL and Gigawords help
by Daniel 21 Mar '06

21 Mar '06

Hi I have been trying to get a accounting_update_query accounting_stop_query that will work with MySQL and record over the 4gig for data transfers. Can anyone help? We are needing to record AcctInputOctets and AcctOutputOctets over the 4 gig amount therefore we need to use the Acct-Input-Gigawords and Acct-Output-Gigawords in to account. We are receiving them from our suppliers. We need this because these days we are seeing very long session times for ADSL links and high speed. We can record up to the 4gig mark. I have tried: AcctInputOctets = '%{Acct-Input-Octets}+(%{Acct-Input-Gigawords}*4294967296)' Doesn't seem to work. Any pointing in the right direction would br greatly appreciated. Freeradius 1.1.0 MySQL 4.0.26 Regards Daniel

3 2

sql.conf
by Atkins, Dwane P 21 Mar '06

21 Mar '06

Why is it that when I run a radiusd -X, I always come back with errors on saying that it cannot connect to the mysql server: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user 'radius'@'localhost' (using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. I have put this in my sql.conf like so: # Connect info server = "localhost" login = "radius" password = "xxxxxxxxx" # Database table configuration radius_db = "radius" <mailto:atkinsd@uthscsa.edu> What am I doing wrong? I have followed a number of whitepapers to install this and most of them say the same thing. I downloaded freeradius and mysql-server using the 'yum install' option. Now, when I do a ./configure on freeradius, do I need to do it with a -with-mysql option? Should I try this on something other than FC4? I am opened to options. Thanks Dwane

5 4

connection pool
by Miguel 21 Mar '06

21 Mar '06

Hi, i have configured a connection pool of 200, i think its too much for my application, doing a netstat -an | grep ESTABLISHED it showe mee 200, how can i be sure how many slot of that pool are really used? thanks

1 0

Module not loading
by "Tomás A. Rossi" 21 Mar '06

21 Mar '06

I have something like this on 'radiusd.conf': ... modules{ ... pgping { } ... } ... Where 'rlm_pgping' is a module compiled and installed following the manual. My question is why does it not appear to load (i.e. not showing any messages with 'radiusd -X')? _the module code is on the end of the message_ I have other custom modules that works fine. Am I doing something wrong? On the other hand, I've been playing around with 'radiusd.conf' I've discovered that if I add some random module name in the module instantiation section, radiusd doesn't complain at all about it's non-existence! This is a little inconvenient. Thanks in advance, --- Tomás A. Rossi Ministerio de Economía Proyecto de Informática Buenos Aires, Argentina /* * rlm_pgping.c * * Este módulo se encarga de "pinguear" la base de datos primaria e informa si * la misma está caída (FAIL) o funcionando normalmente (OK). */ #include "autoconf.h" #include "libradius.h" #include <stdio.h> #include <stdlib.h> #include "radiusd.h" #include "modules.h" #include "conffile.h" #include "libpq-fe.h" /* * Estructura para la configuración del módulo. */ typedef struct rlm_pgping_t { char *host; char *dbname; char *user; char *password; char *port; int timeout; } rlm_pgping_t; /* * No hay parámetros de configuración. */ static CONF_PARSER module_config[] = { { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,host), NULL, "localhost" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,dbname), NULL, "" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,user), NULL, "" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,password), NULL, "" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,port), NULL, "" }, { "integer", PW_TYPE_INTEGER, offsetof(rlm_pgping_t,timeout), NULL, "30" }, { NULL, -1, 0, NULL, NULL } /* end the list */ }; static int mandar_pgping(void *inst, REQUEST *req) { char condata[256]; /* Buffer para guardar los datos de conexión. */ PGconn *con; /* Conexión a la base. */ DEBUG("PGPING: Empieza el modulo"); /*req = req;*/ #define INST ((rlm_pgping_t *)inst) snprintf(condata, sizeof(condata)-1, "host=%s port=%s dbname=%s user=%s " "password='%s' connect_timeout=%d", INST->host, INST->port, INST->dbname, INST->user, INST->password, INST->timeout); con = PQconnectdb(condata); DEBUG("Intentando conectar a la base primaria con datos de conexión: '%s'", condata); if (PQstatus(con) == CONNECTION_BAD) { radlog(L_AUTH, "Falló la conexión a la base primaria."); return RLM_MODULE_FAIL; } return RLM_MODULE_OK; } static int pgping_init(void) { return 0; } /* * Hay que leer los parámetros de configuración para la instancia. */ static int pgping_instantiate(CONF_SECTION *conf, void **instance) { rlm_pgping_t *conf_data; /* * Pedir memoria para los parámetros de configuración. */ conf_data = rad_malloc(sizeof(*conf_data)); if (!conf_data) { return RLM_MODULE_FAIL; } memset(conf_data, 0, sizeof(*conf_data)); /* * Si falla el "parseo" del archivo de configuración para el módulo, CHAU!. */ if (cf_section_parse(conf, conf_data, module_config) < 0) { free(conf_data); return RLM_MODULE_FAIL; } *instance = conf_data; return RLM_MODULE_OK; } static int pgping_detach(void *inst) { free(INST->host); free(INST->port); free(INST->dbname); free(INST->user); free(INST->password); free(inst); return 0; } /* * The module name should be the only globally exported symbol. * That is, everything else should be 'static'. * * If the module needs to temporarily modify it's instantiation * data, the type should be changed to RLM_TYPE_THREAD_UNSAFE. * The server will then take care of ensuring that the module * is single-threaded. */ module_t rlm_pgping = { "pgping", RLM_TYPE_THREAD_SAFE, /* type */ pgping_init, /* initialization */ pgping_instantiate, /* instantiation */ { mandar_pgping, /* authentication */ mandar_pgping, /* authorization */ mandar_pgping, /* preaccounting */ mandar_pgping, /* accounting */ NULL, /* checksimul */ NULL, /* pre-proxy */ NULL, /* post-proxy */ NULL /* post-auth */ }, pgping_detach, /* detach */ NULL, /* destroy */ };

4 21

Duplicate Accounting Start Packets
by Gunther 21 Mar '06

21 Mar '06

Due to some network problems today, my FreeRadius 1.1.0 server and NAS (wrt54g+Chilli) had problems with duplicate accounting packets. The NAS sent a Start packet, the reply from the radius server did not reach and the NAS sent it again. I got up to 3 identical rows in the radacct table. To avoid this I changed the 'AcctUniqueId' column to UNIQUE and it seems to work fine. I just get an error message in my debug log and instead of an INSERT an UPDATE is done. Tue Mar 21 04:36:46 2006 : Debug: rlm_sql_mysql: query: INSERT into Tue Mar 21 04:36:46 2006 : Debug: rlm_sql_mysql: MYSQL check_error: 1062 received Tue Mar 21 04:36:46 2006 : Error: rlm_sql (sql): Couldn't insert SQL accounting START record - Duplicate entry 'af40ee210a7c0400' for key 2 Tue Mar 21 04:36:46 2006 : Debug: radius_xlat: 'UPDATE ... That is exactly what I need. If the Start packet is able to write 3 identical rows, all Interim-Updates are written to the 3 rows. That means my prepaid cards are running off the time three times faster. I also tried ... INSERT (.....) ON DUPLICATE KEY UPDATE ...., but it seems not to be necessary. Are there any implications setting the 'AcctUniqueId' column to UNIQUE? Gunther

1 0

Associating username to a specific NAS only
by Alex M 21 Mar '06

21 Mar '06

Is it possible to set directives for some users so that they only can login to the specific NAS (by the NAS Called Station Id [NAS MAC Address])? Thanks!

1 0