- Freeradius-Users - lists.freeradius.org

Wrapping @2GB why?
by Jonathan De Graeve 04 Mar '06

04 Mar '06

I am programming my own nas and I keep having the problem that my input-octets and output-octets wrap @2GB instead of 4GB I use rad_put_int(struct rad_handle *h, int type, u_int32_t value) so that's unsigned and in fact should work. I keep getting this in the detail file and in my database: Fri Mar 3 17:26:39 2006 NAS-IP-Address = x.x.x.x NAS-Identifier = "hotspot-2.wlan.imz.be" User-Name = "jonathan" Acct-Status-Type = Stop Acct-Session-Time = 1599 Acct-Authentic = RADIUS Service-Type = Outbound-User NAS-Port-Type = Ethernet NAS-Port = 6 Acct-Session-Id = "c8a1d1e3b8cd5dce" Framed-IP-Address = 192.168.2.255 Called-Station-Id = "00:13:21:cf:fe:02" Calling-Station-Id = "00:c0:9f:84:9e:c8" Acct-Input-Packets = 1345474 Acct-Input-Octets = 53843836 Acct-Input-Gigawords = 0 Acct-Output-Packets = 2041756 Acct-Output-Octets = 2147483648 Acct-Output-Gigawords = 0 Acct-Terminate-Cause = Admin-Reboot Client-IP-Address = x.x.x.x Acct-Unique-Session-Id = "3165ff1f761edd81" Stripped-User-Name = "jonathan" Realm = "NULL" Timestamp = 1141403199 It stops at 2147483648, even if my own NAS internal data is bigger then that. My database has the same problem: +-----------------+------------------+ | AcctInputOctets | AcctOutputOctets | +-----------------+------------------+ | 53843836 | 2147483648 | +-----------------+------------------+ The Mysql AcctInputOctets and AcctOutputOctets are bigint(12) Anyone knows why this happens? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be

2 1

Proxy or not based on Client-IP-Address
by Dennis Skinner 03 Mar '06

03 Mar '06

Hello all, Looking for a pointer in the right direction. I want to reject requests from a particular realm that are not coming from a particular set of Client-IP-Addresses. This realm is normally proxied through my servers, so I don't authorize/authenticate them at the moment, they are simply passed to the next RADIUS server. However, some of those users are not using the proper upstream modem provider that they should be and I want to stop that. Other realms coming through that modem provider should be handled like normal. I have looked at the rlm_passwd module, but I'm not sure that is the way to go. I'm thinking that whatever I do should be in the pre_proxy section rather than the post_proxy so the downstream RADIUS server isn't sending back ACCEPT and the user getting REJECT. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 0

Sending Access-Accept for everyone.
by Robert Myers 03 Mar '06

03 Mar '06

Is there a way to send access-accept all of the time? I've tried to do the DEFAULT in username, but that didn't seem to work for me. -Bob

1 0

virus through freeradius-user-request mail??
by Seferovic Edvin 03 Mar '06

03 Mar '06

I've got 2 mail containing viruses sent through freeradius-user-request.. was this email spoofed ( my antivirus software deleted the email so I had no chance to look at the headers etc ) or were email really sent through mailman? Regards, Edvin

2 1

type of lvalue in VALUE_PAIR
by Seferovic Edvin 03 Mar '06

03 Mar '06

Hi, I know this question is probably for the developer list, but I think someone can answer me without any further complications ;) As I "promised", I am patching freeradius ( sqlcounter actually ) so it can do traffic accounting. I have patched it but since I want to have the ability to set the limit by entering the amount of bytes ( in my backend ), I am limited by lvalue of value_pair struct. So values above a (ca) 4 GB are above the limit of uint32 right? What can I do to increase the limit without crashing the freeradius functions. Can I simply change it to uint64_t ( 2 ^64 should be enough ;) ) ??? Regards, Edvin PS: the patched freeradius is working and is able to account traffic, but I think it would not be RFC compliant because I haven't found the needed attributes in the dictionaries

2 4

Dual Server free radius
by Vasco Santos 03 Mar '06

03 Mar '06

Hi, I have question, its possible to put two radius servers runnig in same server with diferents ports?

3 2

RE: EAP module Problem
by King, Michael 03 Mar '06

03 Mar '06

> -----Original Message----- > > > yes ssl, is fun :-) > > now i have another problem, it seems that the the peap module > isnt loading... because when i will compile ./configure > rlm_eap_tls or other ssl modules he says me that iv not > installed openssl but i have installed it. > whats the problem??? > /usr/local/openssl i compiled it by myself... its > openssl-0.9.8a, and later ive installed with apt-get but the > same error... > > >alan I think you just said the magic words. (apt-get) Your using Debian. Are you using th Debian FreeRADIUS package? If so, OpenSSL support is not in the Debian Binary. (It's against the OpenSSL license to distribute it, there is a fun conversation on this in the Debian bug reports) I"ve got a doc on how to create your own local Debian package that includes OpenSSL and all the steps nesscary to install it. Email me directly, and I'll send it to you. I want to go over it a bit, it's still very rough in the later phases. (Joining to an Active Directory Domain) but it's pretty close to done in the building package statge. When I'm finished with it, I'm going to put it up on the Wiki.

1 0

Adding attributes to the reply of a proxied request
by Kristofer Sigurdsson 03 Mar '06

03 Mar '06

Hi list, I have a Linux box running FreeRADIUS 1.0.4. What I'd like to do is receive authentication requests for many groups of users from the same NAS boxes. The identifier for the different types of users would be the @domain part of their username. I'd like to proxy requests to different RADIUS servers based on their domain, which is fairly easy, but what I'd also like to do, is that when the reply from the other RADIUS server comes, add an attribute to the reply. For example: 1. A request comes in, it's user@dadada 2. FreeRADIUS sends a request to RADIUS server 192.168.2.1, because of the @dadada part. 3. RADIUS 192.168.2.1 replies with, "OK, accepted, Framed-IP-Address is this, Framed-Route is that..." 4. FreeRADIUS adds "cisco-avpair: lcp:ip vrf dadada-vrf" and sends the reply back to the NAS. Also, if at all possible, I'd like to be able to strip out attributes sent by the other RADIUS server, eg. if that server includes any cisco-avpair stuff (other than name servers), I'd like to strip that from the reply before it gets to the NAS. Any pointers would be appreciated. I've been looking through the archives, but I can't seem to find a way to modify the replies from the other RADIUS server. Thanks in advance, Kristo

2 2

Ldap-Group and EAP
by Benoît Bianchi 03 Mar '06

03 Mar '06

I have trouble to set up some authorization upon ldap attribute of the user: I have different SSID for my wireless LAN, using WPA or WPA2 with EAP/TTLS and ldap auth which work fine right now with Freeradius How can I prevent user without some ldap special attribute to get authenticated on a special SSID (which is send with the access request as: Called-Station-Id = "00-12-34-56-78-90:SSID" ) ???

1 0

realms in DB
by Santiago Balaguer García 03 Mar '06

03 Mar '06

1 0