- Freeradius-Users - lists.freeradius.org

MySQL and Gigawords help
by Daniel 21 Mar '06

21 Mar '06

Hi I have been trying to get a accounting_update_query accounting_stop_query that will work with MySQL and record over the 4gig for data transfers. Can anyone help? We are needing to record AcctInputOctets and AcctOutputOctets over the 4 gig amount therefore we need to use the Acct-Input-Gigawords and Acct-Output-Gigawords in to account. We are receiving them from our suppliers. We need this because these days we are seeing very long session times for ADSL links and high speed. We can record up to the 4gig mark. I have tried: AcctInputOctets = '%{Acct-Input-Octets}+(%{Acct-Input-Gigawords}*4294967296)' Doesn't seem to work. Any pointing in the right direction would br greatly appreciated. Freeradius 1.1.0 MySQL 4.0.26 Regards Daniel

3 2

sql.conf
by Atkins, Dwane P 21 Mar '06

21 Mar '06

Why is it that when I run a radiusd -X, I always come back with errors on saying that it cannot connect to the mysql server: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user 'radius'@'localhost' (using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. I have put this in my sql.conf like so: # Connect info server = "localhost" login = "radius" password = "xxxxxxxxx" # Database table configuration radius_db = "radius" <mailto:atkinsd@uthscsa.edu> What am I doing wrong? I have followed a number of whitepapers to install this and most of them say the same thing. I downloaded freeradius and mysql-server using the 'yum install' option. Now, when I do a ./configure on freeradius, do I need to do it with a -with-mysql option? Should I try this on something other than FC4? I am opened to options. Thanks Dwane

5 4

connection pool
by Miguel 21 Mar '06

21 Mar '06

Hi, i have configured a connection pool of 200, i think its too much for my application, doing a netstat -an | grep ESTABLISHED it showe mee 200, how can i be sure how many slot of that pool are really used? thanks

1 0

Module not loading
by "Tomás A. Rossi" 21 Mar '06

21 Mar '06

I have something like this on 'radiusd.conf': ... modules{ ... pgping { } ... } ... Where 'rlm_pgping' is a module compiled and installed following the manual. My question is why does it not appear to load (i.e. not showing any messages with 'radiusd -X')? _the module code is on the end of the message_ I have other custom modules that works fine. Am I doing something wrong? On the other hand, I've been playing around with 'radiusd.conf' I've discovered that if I add some random module name in the module instantiation section, radiusd doesn't complain at all about it's non-existence! This is a little inconvenient. Thanks in advance, --- Tomás A. Rossi Ministerio de Economía Proyecto de Informática Buenos Aires, Argentina /* * rlm_pgping.c * * Este módulo se encarga de "pinguear" la base de datos primaria e informa si * la misma está caída (FAIL) o funcionando normalmente (OK). */ #include "autoconf.h" #include "libradius.h" #include <stdio.h> #include <stdlib.h> #include "radiusd.h" #include "modules.h" #include "conffile.h" #include "libpq-fe.h" /* * Estructura para la configuración del módulo. */ typedef struct rlm_pgping_t { char *host; char *dbname; char *user; char *password; char *port; int timeout; } rlm_pgping_t; /* * No hay parámetros de configuración. */ static CONF_PARSER module_config[] = { { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,host), NULL, "localhost" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,dbname), NULL, "" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,user), NULL, "" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,password), NULL, "" }, { "string", PW_TYPE_STRING_PTR, offsetof(rlm_pgping_t,port), NULL, "" }, { "integer", PW_TYPE_INTEGER, offsetof(rlm_pgping_t,timeout), NULL, "30" }, { NULL, -1, 0, NULL, NULL } /* end the list */ }; static int mandar_pgping(void *inst, REQUEST *req) { char condata[256]; /* Buffer para guardar los datos de conexión. */ PGconn *con; /* Conexión a la base. */ DEBUG("PGPING: Empieza el modulo"); /*req = req;*/ #define INST ((rlm_pgping_t *)inst) snprintf(condata, sizeof(condata)-1, "host=%s port=%s dbname=%s user=%s " "password='%s' connect_timeout=%d", INST->host, INST->port, INST->dbname, INST->user, INST->password, INST->timeout); con = PQconnectdb(condata); DEBUG("Intentando conectar a la base primaria con datos de conexión: '%s'", condata); if (PQstatus(con) == CONNECTION_BAD) { radlog(L_AUTH, "Falló la conexión a la base primaria."); return RLM_MODULE_FAIL; } return RLM_MODULE_OK; } static int pgping_init(void) { return 0; } /* * Hay que leer los parámetros de configuración para la instancia. */ static int pgping_instantiate(CONF_SECTION *conf, void **instance) { rlm_pgping_t *conf_data; /* * Pedir memoria para los parámetros de configuración. */ conf_data = rad_malloc(sizeof(*conf_data)); if (!conf_data) { return RLM_MODULE_FAIL; } memset(conf_data, 0, sizeof(*conf_data)); /* * Si falla el "parseo" del archivo de configuración para el módulo, CHAU!. */ if (cf_section_parse(conf, conf_data, module_config) < 0) { free(conf_data); return RLM_MODULE_FAIL; } *instance = conf_data; return RLM_MODULE_OK; } static int pgping_detach(void *inst) { free(INST->host); free(INST->port); free(INST->dbname); free(INST->user); free(INST->password); free(inst); return 0; } /* * The module name should be the only globally exported symbol. * That is, everything else should be 'static'. * * If the module needs to temporarily modify it's instantiation * data, the type should be changed to RLM_TYPE_THREAD_UNSAFE. * The server will then take care of ensuring that the module * is single-threaded. */ module_t rlm_pgping = { "pgping", RLM_TYPE_THREAD_SAFE, /* type */ pgping_init, /* initialization */ pgping_instantiate, /* instantiation */ { mandar_pgping, /* authentication */ mandar_pgping, /* authorization */ mandar_pgping, /* preaccounting */ mandar_pgping, /* accounting */ NULL, /* checksimul */ NULL, /* pre-proxy */ NULL, /* post-proxy */ NULL /* post-auth */ }, pgping_detach, /* detach */ NULL, /* destroy */ };

4 21

Duplicate Accounting Start Packets
by Gunther 21 Mar '06

21 Mar '06

Due to some network problems today, my FreeRadius 1.1.0 server and NAS (wrt54g+Chilli) had problems with duplicate accounting packets. The NAS sent a Start packet, the reply from the radius server did not reach and the NAS sent it again. I got up to 3 identical rows in the radacct table. To avoid this I changed the 'AcctUniqueId' column to UNIQUE and it seems to work fine. I just get an error message in my debug log and instead of an INSERT an UPDATE is done. Tue Mar 21 04:36:46 2006 : Debug: rlm_sql_mysql: query: INSERT into Tue Mar 21 04:36:46 2006 : Debug: rlm_sql_mysql: MYSQL check_error: 1062 received Tue Mar 21 04:36:46 2006 : Error: rlm_sql (sql): Couldn't insert SQL accounting START record - Duplicate entry 'af40ee210a7c0400' for key 2 Tue Mar 21 04:36:46 2006 : Debug: radius_xlat: 'UPDATE ... That is exactly what I need. If the Start packet is able to write 3 identical rows, all Interim-Updates are written to the 3 rows. That means my prepaid cards are running off the time three times faster. I also tried ... INSERT (.....) ON DUPLICATE KEY UPDATE ...., but it seems not to be necessary. Are there any implications setting the 'AcctUniqueId' column to UNIQUE? Gunther

1 0

Associating username to a specific NAS only
by Alex M 21 Mar '06

21 Mar '06

Is it possible to set directives for some users so that they only can login to the specific NAS (by the NAS Called Station Id [NAS MAC Address])? Thanks!

1 0

Authentication problem if CHAP is not used
by Alex M 20 Mar '06

20 Mar '06

Hi, I have a problem; I always get Access Reject saying that password is invalid. But when I'm using NTRadPing Test Utility, the same username and password works fine if I check to use CHAP, but when the CHAP check box is not selected then I'm getting the same problem as I have with my NAS. So can some one tell me how to make FreeRadius work so that if I'm using NTRadPing without CHAP it would still work! Thanks!!!

2 7

pppoe+mysql+Framed-IP-Address
by Norbert Grochal 20 Mar '06

20 Mar '06

I have just run pppoe server with freeradius pppeo user radius.so and radattr.so modules It works ok, but clients gets 'random' IP addreses... I need static IP (like that in /etc/ppp/chap-secrets last column). I try to add 1 record to my mysql, so I have: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'norbert' ORDER BY id -> ; +-----+----------+-------------------+---------------+----+ | id | UserName | Attribute | Value | op | +-----+----------+-------------------+---------------+----+ | 77 | norbert | User-Password | xxxxxxxx | == | | 258 | norbert | Framed-IP-Address | 82.177.xx.yy | := | +-----+----------+-------------------+---------------+----+ but I still gets IP addresses like 10.67.15.1 ..., not 82.177.xx.yy my example access-request contains Framed-Protocol = PPP: Packet-Type = Access-Request Fri Mar 17 15:25:22 2006 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "norbert" CHAP-Challenge = 0x4aaccdf7f520730e84f58bc4018c04217b97 CHAP-Password = 0xb6fe48120b0aed82ffdb4d782f3b51cd6a NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Client-IP-Address = 10.10.10.248 What I should do? norbert

4 8

Proxy Question (default_fallback)
by christian meutes 20 Mar '06

20 Mar '06

Hello list, i got a proxy configuration in which all auth requests for a specific realm is proxied to another radius server. The problem is that if this radius server isnt reachable the server is marked as dead and every further auth request is sucessfully authenticated locally in cause of a user default accept configuration. In proxy.conf i have set for the proxy realm a default_fallback=no, but this doesnt help. Anybody with an idea why this is happening? I dont want that the auth requests are tried locally if the real radius server isnt answering. best regards, Christian Meutes systems engineer -- claranet gmbh internet service provider tel +49 (0) 69 - 40 80 18 - 300 email: christian.meutes(a)de.clara.net http://www.claranet.de/

2 1

Backend Retry option
by Craig T. Hancock 20 Mar '06

20 Mar '06

When configuring your backend authentication and authorization system how does the retry option work. What I want to know is when connecting to the backend server and if it fails to connect given a specified time does freeradius cache the IP address after the first DNS lookup of the. server DNS name specified in the radiusd.conf file. Or does it attempt to do a DNS lookup on the server IP address on each retry. I am trying to investigate the possibility of load balancing my authentication backend through Round Robin DNS. -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

3 4