- Freeradius-Users - lists.freeradius.org

Problems configuring Free Radius
by Atkins, Dwane P 15 Mar '06

15 Mar '06

Is there a free radius for Dummies book out there? I know that most of the instruction probably make sense to everyone, but me. I am trying to configure Freeradius 1.1 on a mysql database using fedora 4. I can get to a point where I do the radiusd -X and it starts the radius server. Is there something I need to do with the sql.conf file to tie all of this together? How do I enter my users in mysql? Is there a web interface for the users? Can I put in a start date for a user and a stop date for a user? Is there a web site that I can go to for answers to these questions? I have been to the archives. Thank you and if this all cannot be done, please let me know so I can scrap this project and move onto something different. Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

4 3

Pool-Name attribute missing
by S. K Rahman 15 Mar '06

15 Mar '06

Hello all, After solving the permission issue for rlm_ippool the radius was not assigning the IP from the pool that I defined in the conf file. After doing search in the list archives I realized that I need to assign the poolname to the user or group of user but was not sure where . After doing some more search I found that I need to set the Pool-Name attribute in the radcheck table (Yes I am using Mysql Database) but in the php dialup admin tool does not has the attribute pool-name neither the sql or sql schema mentioned anything about it. I downloaded the dialup admin from the current release version but it also does seem to have the attribute listed. So I was wondering is the poolname deliberately not provided in the dialup admin tool? Do I have to hand edit it to add it? Also does freeradius supports the pool management via sql instead of conf file? Regards

1 0

Error: There are no DB handles to use!
by Vasco Santos 15 Mar '06

15 Mar '06

Hi Folks, I have freebsd 4.10-RELEASE with mysql 4.1.1-alpha and freeradius 1.1.0 Radius give me this error: There are no DB handles to use! what this error means ? radiusd -X ql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1845 Listening on accounting *:1846 Listening on proxy *:1847 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.11:2919, id=83, length=57 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 192.168.1.11 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "teste", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user teste to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'teste' rlm_sql (sql): sql_set_user escaped user --> 'teste' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'teste' ORDER BY id' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 My mysql.log show only connections but querys no. What is the min System Requerements to freeradius work, mem and processor ? Try to install a old version of radius?

1 0

ippool module permission denied
by S. K Rahman 15 Mar '06

15 Mar '06

Hello all, I am prototyping a wifi net access system using prebuilt version of freeradius that came with opensuse. The version is 1.0.4-4 Inorder to have control over the IP assigned when a user authenticates itself I have uncommented the mail_pool from the post auth and accounting section and kept the ippool main_pool section as it is the config. Unfortunately it does not work. When I run the raddius -X it throws me an error rlm_ippool: Failed to open file /etc/raddb/db.ippool: Permission denied The entire rml_pool error is listed below I thought the issue would be related to write access so I checked for the permission. The /etc/raddb directory owner is radiusd I am not sure what I am doing wrong Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/etc/raddb/db.ippool" ippool: ip-index = "/etc/raddb/db.ipindex" ippool: range-start = 192.168.1.1 IP address [192.168.1.1] ippool: range-stop = 192.168.3.254 IP address [192.168.3.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 rlm_ippool: Failed to open file /etc/raddb/db.ippool: Permission denied radiusd.conf[1483]: main_pool: Module instantiation failed. Regards

2 2

RE: Accounting Cisco VSA attributes
by Caines, Max 15 Mar '06

15 Mar '06

Hi I have now upgraded to 1.1.0, and yes, it now converts Cisco AV pairs to new attributes. Many thanks. I thought it was worth mentioning that I had a few problems building Freeradius, which I should have brought up before, because I have dim memories of getting the same ones with 0.9.3. It's making rlm_sql_mysql hat gave me problems, and they were of two sorts. First, "configure" reckoned that MySQL was not usable on my system and didn't create the module in the first place. Then, when I fixed that, the run-time linker failed when the module was first loaded. I was able to fix both these problems, but I thought it might be worth letting you know, because I compiled it on two systems and got the same problems. One is an ancient Sun Ultra 1 running Solaris 5.9, while the other is a SunFire V240s running 5.8, so other Solaris users may see them as well. The "configure" problem I fixed by modifying "src/modules/rlm_sql/drivers/rlm_sql_mysql/configure. This is the output from "diff": 978c978 < LIBS="-L$try -lmysqlclient_r $old_LIBS" --- > LIBS="-L$try -lmysqlclient_r $old_LIBS -lsocket -lm -lz -lnsl" Without that compiling and linking of "conftest.c" in "configure" fails, and it assumes that that's because your MySQL is absent or wrongly set up. The other problem is in "Makefile.in". Here's the "diff" output: 6c6 < RLM_SQL_LIBS = @sql_mysql_ldflags@ --- > RLM_SQL_LIBS = @sql_mysql_ldflags@ -lm -lz The need for "libz" is the result of using MySQL 5.0, which has a new "archive" storage type that uses compression routines from a separate library, so I guess you have this issue on any architecture. "libm" is required because somewhere in the MySQL library there's a call to "floor", and that's probably only an issue with Suns. I realise that this may all be down to something odd about our Solaris systems, and if so please ignore this, but I thought it might be useful. Max Caines > -----Original Message----- > From: > freeradius-users-bounces+max.caines=wlv.ac.uk(a)lists.freeradius.org > [mailto:freeradius-users-bounces+max.caines=wlv.ac.uk@lists.fr > eeradius.o > rg]On Behalf Of Alan DeKok > Sent: 09 March 2006 19:37 > To: FreeRadius users mailing list > Subject: Re: Accounting Cisco VSA attributes > > > "Caines, Max" <Max.Caines(a)wlv.ac.uk> wrote: > > I'm using FreeRadius (0.9.3) > > Oh dear, you *really* should upgrade. See > http://www.freeradius.org/security.html. > > As for the rest of your message, I recall issues with cisco_vsa_hack > in older versions of the server. Maybe a newer version works better. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

detail log
by José Berenguer 15 Mar '06

15 Mar '06

Hello, in the logs of the module auth_log you can suppress the log of the passord? Thanks!

1 0

Replying attribute value regarding a check-item or Hunt-group...
by Florian Prester 15 Mar '06

15 Mar '06

Hi, how can I achieve, that the radius-server is replying IP-address A, if comming from NAS A, and IP-address B, if comming from NAS B? Altough: IP A is stored in LDAP as IP-A and IP B is stored in LDAP as IP-B But unfortunately I do only have one Framed-IP-Address-attribute which should be mapped to either of above, depending of the NAS-IP. Any Ideas or further reading? Thank you! Regards Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

1 0

Howto reload raddb/users file?
by Chris Leavoy 15 Mar '06

15 Mar '06

How do I reload raddb/users file? Please embarrass me thoroughly by pointing out where this is documented. -- Chris

4 3

MAC/VLAN with HP Procurve
by Jim Potter 15 Mar '06

15 Mar '06

Hi all, Part 2 of my problems - has anyone got a radius server to hand out dynamic VLANs to an access point? I've got the following from various sites, but it doesn't seem to work (users file): 00-0e-35-31-5c-1b Auth-Type == Local,User-Password == "00-0e-35-31-5c-1b" Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 20, Tunnel-Type = VLAN - this is meant to make the laptop with the given VLAN join to the network on vlan 20, but there is no sign of this working... any clues? cheers Jim Potter -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 3

unsubscribe
by Joseph Francis Medina Gonzalez 14 Mar '06

14 Mar '06

1 0