- Freeradius-Users - lists.freeradius.org

Question about a configuration entry in the eap.conf file.
by Terry Zarelli 18 Mar '06

18 Mar '06

Hello, I have a question about a configuration entry in the eap.conf file. What does the following entry mean: A list is maintained to correlate EAP-Response packets with EAP-Request packets. After a configurable length of time, entries in the list expire, and are deleted. timer_expire = 60 What will happen if I change the timer value? Thanks Terry Zarelli

2 2

detail Files
by Lisa Casey 18 Mar '06

18 Mar '06

Hi, I sent this email a couple of hours ago but it hasn't appeared on the list yet so I'm resending it. If it comes through twice, accept my apologies. Currently my Freeradius server writes new accounting detail files each day. In radiusd.conf, if I were to change detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d to detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m Would it then write one detail file for each month? Lisa Casey

2 1

Question about a configuration entry in the eap.conf file
by Terry Zarelli 18 Mar '06

18 Mar '06

Hello, I have a question about a configuration entry in the eap.conf file. What does the following entry mean: A list is maintained to correlate EAP-Response packets with EAP-Request packets. After a configurable length of time, entries in the list expire, and are deleted. timer_expire = 60 What will happen if I change the timer value? Thanks Terry Zarelli

2 2

primary backup configuration
by Maqbool Hashim 17 Mar '06

17 Mar '06

Hi, I have two radius servers one primary and one backup one, on different ip addresses. They both have a mysql backend which runs on the same physical machine. I need the sql database and radius configuration files to be synchronised periodically (probably every 24hours). I guess this is a common setup, so I'd appreciate some ideas as to the best way to achieve this? Thanks

3 2

check-Item checked by ldap
by Florian Prester 17 Mar '06

17 Mar '06

Hi, I am using a LDAP-Directory as Information-DB for authorisation. Now my question is: I want to grant access, if a user fullfills a LDAP-attribute, for example: users-file: ... test LDAP-Group == "test" Service-Type = "Administrative-User", cisco-avpair= "shell:priv-lvl=15" ... ldap.attrmap: ... checkItem LDAP-Group Userid ... In LDAP the Iserid for the user test is test, therfore it should be mapped to the LDAP-Group-attribute and therfore the user should be granted access, or not? But the debug output shows something different: ###################################### ./radiusd -XXX rad_recv: Access-Request packet from host 232.122.28.222:2084, id=59, length=47 User-Name = "test" User-Password = "XXX" Fri Mar 17 08:31:44 2006 : Debug: Processing the authorize section of radiusd.conf Fri Mar 17 08:31:44 2006 : Debug: modcall: entering group authorize for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Mar 17 08:31:44 2006 : Debug: radius_xlat: 'ou=AAAuse ... ' Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: attempting LDAP reconnection Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: (re)connect to 232.122.3.22:400, authentication 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: bind as cn= Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: waiting for bind result ... request done: ld 3501a58 msgid 1 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: Bind was successful Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: performing search in ou=AA ... request done: ld 3501a58 msgid 2 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Mar 17 08:31:44 2006 : Debug: radius_xlat: '(|(&(objectClass=GroupOfNames)(member=...' Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: performing search in ou=AAA ... request done: ld 3501a58 msgid 3 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: object not found or got ambiguous search result ############################### Now, somemore questions: 1.) why is there a reconnect? I thought I connect to the ldap once, retrieve user-information and then all comparsion iis done by the RADIUS? 2.) why is there no mapping from the Userid to the LDAP-Group, but a new search for the ldap-attribute: Fri Mar 17 08:31:44 2006 : Debug: radius_xlat: '(|(&(objectClass=GroupOfNames)(member=...'??? Thanks Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 1

Re: Freeradius & Mysql initial install
by Atkins, Dwane P 17 Mar '06

17 Mar '06

My mistake on the working. I had checked the clients.conf and it was correct. Does the login user need to have an account on the local radius server? In other words, do I need to create a user in mysql and link it to the radius database and ALSO complete a useradd statement on the Fedora box? No matter how I try it, I cannot get it to see past the shared key of the localhost. Thanks for all your help. Dwane

3 2

freebsd module rlm_sql Segmentation fault
by Vasco Santos 17 Mar '06

17 Mar '06

Hi folks, I have freebsd 4.10-RELEASE and freeradius version 1.0.1 and radiusd -x give me this error: The Debug: Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Segmentation fault I disable the sql module its works fine. I tested this in freeradius 1.0.1 and version 1.1.0 its give me the same "Segmentation fault". Is this a bug in freeradius? if yes, give-me a old version of freeradius that dont have this bug, or ways to correct it. Tanks.

1 0

Mysql problem
by Fabiano Rodrigo Boscatto 17 Mar '06

17 Mar '06

Hi there, i have freeradius working fine with mysql authentication. The problem is that the User-Password is stored in mysql table as clear text. Is there a way to crypt that? Thanx

4 4

Assigning DNS servers
by Tony Spencer 17 Mar '06

17 Mar '06

Hi I want to be able to assign DNS servers for each user to use as part of the users radius entry. If I use: MS-Primary-DNS-Server ="<ip address>", MS-Secondary-DSN-Server="<ip address> For each users radius config will this work? These users are ADSL users using DSL modems and routers. Thanks Tony -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

5 5

Re: Freeradius & Mysql initial install
by AM 17 Mar '06

17 Mar '06

I thought shared secret was in clients.conf

1 0