- Freeradius-Users - lists.freeradius.org

FR - Writing own queries in sql.conf - help
by Saeed Ahmed 06 Feb '06

06 Feb '06

Hi Everyone, I am sending this message at very first time, and I hope that I'll get response. My Question is that: In sql.conf's Authorization section, can I write my own queries and can I use the result of my own query. For detailed elaboration I will give you following example: I want something like that: authorize_check_query = "SELECT id, UserName, Attribute, Value, op, uid \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" in query above I created another field `uid` in my radcheck table and suppose here I am getting some kind of user-id. Then I want to use this value in next authorize_reply_query something like that: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' AND uid= '%{authorize_check_query[5]}' \ ORDER BY id" Instead of authorize_check_query I can also use my own query if possible example my_own_query = "SELECT uid from mytable where Username='%{SQL-User-Name}' and then I should be able to use the result of my_own_query. Like my_own_query[0]; etc etc I am using: freeradius-1.0.5 with MySql 5.0 Hope I will get help soon. Thanks in advance for your time. Regards Saeed Ahmed FR - User; currently Helpless;

1 0

Re: How to kick a logged user
by John C. Koen 06 Feb '06

06 Feb '06

On Mon, Feb 06, 2006 at 11:47:38AM -0500, Eduardo Bejar wrote: > > Hi, > > I?ve been searching a while about how to kick a logged user or force > terminate it?s session. It seems that this has been asked before on the > list, but I didn?t find an answer different from "radius can?t do that". The > only answer that I?ve found is that it?s required an external script for > this. > > Section 4.3 of the Freeradius FAQ mentions a radkill program, but the link > included is dead. And also says "try using SNMP". I haven?t also been able > to find information on how to use SNMP for this, so I ask the list: > > Can anyone post a link to download radkill? Here is a link I found on google. This site posts a copy of radkill dated from 2000/04/26: http://slava.parma.ru:8100/Linux-Soft/Billing/radkill/ --johnk > > Or > > Can anyone explain me how to do this with SNMP? > > Or perhaps, > > Can anyone post a procedure to kick a logged user? > > Thanks for your replies, > > Edo > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Multiple ippools with a singe group problem
by Georgi Alexandrov 06 Feb '06

06 Feb '06

Hello list, I'm using freeradius 1.1.0 with dialup_admin and mysql 5.0.x I need different ip pools to be accessible only by one name, e.g. : ippool 1 { ... } ippool 2 { ... } ippool 3 { ... } post-auth { 1 2 3 } accounting { 1 2 3 ... } That way it's working if i add a user to one of 1, 2 or 3 pools. But i need him added to all of the pools. Putting "DEFAULT" won't even asign ip address. post-auth { group all { 1 2 3 } } and putting user in pool "all" doesn't work, freeradius says invalid module "group". So i generally need all the pools to be accessible like one pool name ;-) Thanks in advance -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

1 0

freeradius-1.1.0 - compile error
by Jon 06 Feb '06

06 Feb '06

Using freeradius-1.1.0 version. compile with nothing special other than defining log dir when 'make' receive error like following: gcc -shared rlm_unix.lo cache.lo compat.lo -Wl,--whole-archive /usr/lib/libshadow.a -Wl,--no-whole-archive -lcrypt /usr/lib/libshadow.a -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_unix-1.1.0.so -o .libs/rlm_unix-1.1.0.so /usr/lib/libshadow.a: member /usr/lib/libshadow.a(libmisc.a) in archive is not an object collect2: ld returned 1 exit status gmake[6]: *** [rlm_unix.la] Error 1 Any ideas that can help me to solve this, sorry if my English is bad... i found nothing on the website, Wiki, or Google (only Russian forum post about it). Thanks in advance guys, Jon

1 0

Segmentation fault v1.1.0 after requiring client certificate. Server crash.
by Pascal Huisman 06 Feb '06

06 Feb '06

Server crashes, have no clue why. Installed from a debian binary package. I couldn't find rlm_eap_tls.so anywhere in my system. I did various searches. So I got tar.bz v1.1.0, compiled the source, made it and copied the various rlm_eap_tls files to the freeradius directory. Server started up fine. After connection to wlan from the XP machine I get warning messages about fragmentated packages. Check the freeradius server, which crashed with a segmantation fault. What went wrong? Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.3:1812, id=7, length=135 User-Name = "client" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Identifier = "USR5450\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Calling-Station-Id = "00-60-b3-9d-ef-dd" EAP-Message = 0x0201000b01636c69656e74 NAS-IP-Address = 192.168.0.3 Message-Authenticator = 0x70375d88fd54fcf3adb87b7293bd15fe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate Segmentatie fout Thx.

2 1

Stripping part of the login before authentication?
by Garry Glendown 05 Feb '06

05 Feb '06

Hi, we have multiple ways of getting connections, all in the format user#somestring@morechars Is it possible to define something in FreeRadius to just compare the part before the "#" and authenticate based on that? Tnx,-gg

2 1

Server has no response
by openbsd shen 05 Feb '06

05 Feb '06

After I install freeradius 1.1.0, and I have not changed radiusd.conf, I start freeradius: ./radiusd -X it shows: Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Then I use the command to test: ./radtest test teset localhost 0 testing123 It shows: Sending Access-Request of id 71 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "teset" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 71 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "teset" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 ........ radclient: no response from server for ID 65 and the server has not any response. I don't know why?

2 1

Where is login.radius ?
by openbsd shen 05 Feb '06

05 Feb '06

In "radiusclient.conf", there are lines: # program to call for a RADIUS authenticated login # (default /usr/sbin/login.radius) login_radius /usr/local/sbin/login.radius But I cannot find login.radius in the hole linux system, I installed freeradius in /usr/local/freeradius, there're no this file in this dir. Thanks for help.

2 1

dial up users authentication problem
by Mohsen A. Momeni 04 Feb '06

04 Feb '06

Hi, I have two group of users connected to internet through a firewall for traffic control. Both should be authenticated by firewall through a RADIUS server before connecting to internet and there are different user policies for different users in firewall. 1) LAN users. 2) Dial-up users which are connected to a router, and are authenticated by a RADIUS server (for logging in) The problem is that I don't want a second authentication in firewall. I want the users logged in, can be automatically authenticated by the firewall. Firewall should somehow know their username to apply the policies. I think there should be a mapping from IP to username in RADIUS server. Is this possible? If yes, please tell me how.

1 0

Usage instead of time accounting
by Sean 03 Feb '06

03 Feb '06

Hi' I've been using FreeRadius authorisation and accounting for my Internet Hotspot service for some time. It performs perfectly. Up to now all of my clients use time based tickets(One hour, one day, one week and one month) I now have a client that wants to supply tickets that will limit the usage in bytes of a user. Can this be done and if so can anyone recommend a source for documentation. I've Googled for the last few days and checked the DD-WRT and Chillispot forums to no avail. Regards and rhanks in advance, Sean Bracken http://swarmhotspots.com On Fri, 2006-02-03 at 17:55 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. (Fwd) Detail Filter method (Breuer Nicolas) > 2. Re: Detail Filter method (Nicolas Baradakis) > 3. R: SQL.conf new query (Carlo Prestopino) > 4. Re: how to log username in uppercase in radacct > (Nicolas Baradakis) > 5. Root Certificate via ADS (Armin Kr?mer) > 6. Re: FDS + Freeradius = pain. (Joey McDonald) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 03 Feb 2006 14:14:54 +0100 > From: "Breuer Nicolas" <Nicolas.Breuer(a)Belcenter.biz> > Subject: (Fwd) Detail Filter method > To: freeradius-users(a)lists.freeradius.org > Message-ID: <43E3655E.29093.29B17267(a)Nicolas.Breuer.Belcenter.biz> > Content-Type: text/plain; charset="iso-8859-1" > > In /etc/raddb/acct_users file: > > DEFAULT Acct-Status-Type == Interim-Update, Acct-Type := empty > > And in /etc/raddb/radiusd.conf: > > modules { > > always ok { > rcode = ok > } > > ... > } > > ... > > accounting { > > # Log start & stop > detail > > Acct-Type empty { > ok > } > } > > -- > Nicolas Baradakis > > > > Can i also put the empty section only in detail module > because i have a sql line in account (to log everything) > > I wouldlike only to disable it in detail accounting. > > > > > > ------- Forwarded message follows ------- > From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> > To: freeradius-users(a)lists.freeradius.org > Subject: Detail Filter method > Send reply to: Nicolas.Breuer(a)BelCenter.biz > Date sent: Fri, 03 Feb 2006 10:54:43 +0100 > > > Hello all, > > I'm using the "detailled" logs with FreeRadius. > > I wouldlike to filter the interim updates to not logged > them. Is it possible ?? > > I wouldlike to only have a logs files with start & stop.. > > It would be a nice option, i think.. > > > > ------- End of forwarded message ------- > > Breuer Nicolas > Content & Marketing Manager. > Network Supervisor. > > BELCENTER ISP & PORTALS > Avenue Henri Conscience, 94 > B -1140 Bruxelles > Tl. :+32 2 243 0 243 > Fax :+32 2 243 0 244 > Mobile :+32 486 50 27 87 > E-Mail : Nicolas.Breuer(a)Belcenter.biz > http://www.BelCenter.be | http://www.BelCenter.net > http://www.BelCenter.lu | http://www.BelCenter.nl > >

3 2