- Freeradius-Users - lists.freeradius.org

Duplicate AccSessionId + AcctUniqueId from NAS (which I don't want)
by Mark Elkins 09 Feb '06

09 Feb '06

I've got a problem where sometimes I'm getting duplicate accounting records entered into my Accounts file. The customer is on an ADSL line and the NAS is owned by the local monopoly operator. We need accurate traffic counts for each user - as thats what they are billed on. The Telco has sent multiple accounting records for the same person - due to some error on their side - and this seems to be happening more frequently. The Accounting Data is an attached TXT file - cause its wide... The IP's, Realm and UserName have been changed to protect the innocent. What I don't understand is that the AcctUniqueId sometimes changes for the same AcctSessionId. To fix the problem of getting duplicate accounting entries - I was thinking about making either AcctUniqueId or AcctSessionId a unique key in the MySQL table?... but which should I use - listening to the news that some NAS's don't always seny unique AcctUniqueId info. Does setting AcctSessionId to a unique value make more sense? Does it ever duplicate itself by accident? If I make AcctSessionId a unique key (index?) and radius tries to add a duplicate - what will happen? (I'm hoping the answer is it'll be silently ignored - and not that the whole accounting table will be corrupted as radius dies...). Still - it would seem more useful to have AcctSessionId as a unique index - as its actually used as a value for updating the accounting info when a STOP record arrives. Suggestions? Being really lazy - what would the appropriate MySQL command be? .. and wouldn't this generally be a "Good Thing" to do anyway??? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

A little problem - FR with Mysql Stored Procedure
by Saeed Ahmed 09 Feb '06

09 Feb '06

Dear Sir, I was wondering on mailing list for last 3 days and I didn't get proper response, I am really in problem. I am getting problem to use Mysql Stored procedures with Freeradius. After exploring web It came to know that, (this text I got from mysql.com forum:) the result's of SP execution are sent as result sets over the protocol. Once you call a SP you get at least 1 return code and could get many result sets. The execution of a stored procedure is very similar to execution of a multi-query. MySQL 5.0 supports the execution of multiple statements specified in a single query string. To use this capability with a given connection, you must specify the CLIENT_MULTI_STATEMENTS option in the flags parameter to mysql_real_connect() when opening the connection. You can also set this for an existing connection by calling mysql_set_server_option(MYSQL_OPTION_MULTI_STATEMENTS_ON). By default, mysql_query() and mysql_real_query() return only the first query status and the subsequent queries status can be processed using mysql_more_results() and mysql_next_result(). /* Connect to server with option CLIENT_MULTI_STATEMENTS */ mysql_real_connect(..., CLIENT_MULTI_STATEMENTS); /* Now execute multiple queries */ mysql_query(mysql,"DROP TABLE IF EXISTS test_table;\ CREATE TABLE test_table(id INT);\ INSERT INTO test_table VALUES(10);\ UPDATE test_table SET id=20 WHERE id=10;\ SELECT * FROM test_table;\ DROP TABLE test_table"); Means I need to use CLIENT_MULTI_STATEMENTS in mysql_real_connect(), so, for now, I just need this little guidance that which file should I edit to get SP working with Freeradius. I hope I'll get response this time thanking you in advance Best Regards

3 3

log files not generated!
by DilipSimha.N.M 09 Feb '06

09 Feb '06

hi, i am running freeradius 1.04 on redhat 9.0 linux. i see that log file radius.log is not getting created. but accounting(detail) files are created normally. also the radiusd.pid file doesn't contain the pid of the radius that is currently running. it contains some other pid. also.....only for the first time.....this file gets changed.... after the first time, if u restart RADIUS, then the pid file is not at all modified. Note: i have enabled logging for all possible combinations available and permissions for the log files are full. am i missing something? --DilipSimha

2 2

mschap-v2 - freeradius(proxy) -mschap-v1
by Dmitry S. Vlasov 09 Feb '06

09 Feb '06

Hello! I wanna use mschap-v2 AUTH between windoze VPN clients and NAS, but my billing system use old radius, which can use mschap-v1 ONLY. Can I proxy RADIUS packets through FreeRADIUS and convert mschap-v2 <--> mschap-v1 ? windoze --- (v2)--- freeradius ---(v1) --- billing radius Thanks. Dmitry

2 1

LDAP module locks
by Peter Manckok 09 Feb '06

09 Feb '06

Hy all, I was reading the messages in the forum looking for some information for a problem I have. And I found this post: On August 30, 2005 6:42:39 PM -0400 Alan DeKok <aland at ox.org> wrote: > Frank Cusack <fcusack at fcusack.com> wrote: >> > In ldap_get_conn(), conns[i].locked must >> > not be tested until after a lock is obtained. >> >> fixed in rlm_ldap.c#1.156 but I don't know how to propagate this change >> to 1.0.5 candidate. > > Looking at the code, I'm not even sure that the "locked" member is > appropriate for a threaded environment. It could probably be deleted. > > For non-threading mode, the LDAP module can't be using multiple > connections, because it can only be called once. For threading mode, > the mutexes protect the data structure. > > The "locked" member should be deleted, unless I'm missing something. I have a question: In the ldap_get_conn I see that you use a pthread_mutex_trylock. So if you try to get connection and all the connections are locked, the module fails. Why don´t you use the pthread_mutex_lock function instead in order to wait until the connection is unlocked? Thanks a lot Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Compiling without threads
by Peter Manckok 09 Feb '06

09 Feb '06

Hy all, I am going to compile FR without threads. And I would like to know: How will FR handle simultaneous requests? Does it create new processes using fork functions? Thanks a lot Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

PEAP error with 1.1.0
by hazed＠xs4all.nl 09 Feb '06

09 Feb '06

Hi, I'm trying to get Freeradius 1.1.0 running on a Debian Sarge box. I compiled and built the deb packages from the tarball according to the FAQ instructions. After installing and configuring according to the 802.1X Port-Based Authentication HOWTO on tldp.org, the daemon refuses to start. Freeradius -x gives the following output: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls rlm_eap: Failed to link EAP-Type/peap: rlm_eap_peap.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. I hope someone can shed some light on this. Thanks in advance. Regards Matthew Smith

3 4

sqlcounter design for prepaid
by Rusma 09 Feb '06

09 Feb '06

dear all, I need your advice for my prepaid billing, i have several scenario : 1. prepaid for 4 hours and expire in 2 days after login. 2. prepaid for 8 hours and expire in 4 days after login. 3. prepaid for 24 hours and expire in 1 day. i have configured my freeradius and mysql using rlm_sqlcounter, i have tested with sample account from sqlcounter doc and its works. . i need to make or change default scripts for above schemes. can any body help me. best regards, rusma permana

1 1

PEAP with sql - plain Identity
by Norbert Grochal 09 Feb '06

09 Feb '06

In 'Ralink Wireless Utility' -> '802.1x Setting' I can choose 'PEAP' and foll 3 fields (with my example values): 1. Identyty = myidentyty 2. Login = mylogin 3. Password = mypass (I set protocol as EAP-MSCHAP v2) in freeradius users file I can write: mylogin Auth-Type = EAP, User-Password := "mypassword" So identity can by any word. I hope mylogin and mypassword is sent to radius encrypted, not as plain text. But when I clear the users file and use sql I have a recerd in radcheck table: id UserName Attribute op Value ... (other fields) 1 mylogin User-Password == mypassword ... (other values) and in "Ralink...' I MUST (?) set (Identity = Login = mylogin) and Password = mypassword to be authorized in freeradius. But isn't Identity sent as clear text ??? I want to set Identity as Client Name, not as his login, is it possible? SQL queries check User-Name attribute and *I don't know how* put it to rlm_eap_peap and it says: Tunneled data is valid. (...) Success. But I don't want to login be equals to identity... Norbert

2 3

User passwords in 127.0.0.1/auth-detail file
by Walter Reynolds 09 Feb '06

09 Feb '06

I am currently running freeradius 1.0.4 I have the following line set log_auth_goodpass = no I am also using krb5 module under PAM. The problem I am having is while I do not get the User-Password in the <NAS>/auth-detail log, it does show up in the 127.0.0.1/auth-detail file. I have tried to search the archive and feel I must me mising something. Can someone please help me figure out what is going on? I want logs and details, just not the user passwords. Thanks. -- Walter Reynolds University of Michigan

2 1