- Freeradius-Users - lists.freeradius.org

router dies, takes radius with it
by RH Lists 09 Jan '06

09 Jan '06

Hi all, Has anyone experienced this? I have a Cisco router which is being used to terminate pppovpdn sessions over l2tp tunnels. It crashed and rebooted the other day, and took my radius servers down too! I have identified the problem with the router and will be upgrading it first chance I get, but I'm concerned that the router would cause radiusd to crash. Any thoughts? I'm using radiusd: FreeRADIUS Version 1.0.1, for host , built on Nov 2 2004 at 19:55:49 and will be upgrading that shortly. Thanks Rob --- Checked for viruses by Transact Bermuda

1 0

Exec-Program-Wait multiple reply items
by wrath＠geo.net.ge 09 Jan '06

09 Jan '06

Hello, I have recently migrated to freeradius (latest stable on debian sarge - 1.0.2-4) and faced with the following problem: I use Exec-Program-Wait attribute as a reply item in users file. It returns 3 attributes: NAS-Identifier, Framed-IP-Address and Framed-Route. These attributes are printed on stdout with trailing "\n". However they are not returned to the NAS as are not comma separated. Is there any known workaround for this problem? Thanks in advance. Best Regards, George

4 3

Freeradius as Proxy
by Nicola Iotti 09 Jan '06

09 Jan '06

Hi, I'm using freeradius 1.0.5 just as proxy to do a realm based messages redirection... I want freeradius does not change any attribute in communication messages from home server and nas, so I've commented all lines of attrs file, default realm attributes too....Is it correct ? And what about other particular configurations or suggestions Thank you Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

1 0

RE: MS LDAP connect OK users not found
by Dickson, John 09 Jan '06

09 Jan '06

In fact it is. My review of the debug shows that the radiusd.conf ldap connects (binds) yet the testing user is not located. -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Dennis Skinner Sent: Friday, January 06, 2006 4:33 PM To: FreeRadius users mailing list Subject: Re: MS LDAP connect OK users not found Dickson, John wrote: > rlm_ldap: performing search in ou=Users,dc=XXXX1,dc=XXXX2,dc=edu, with > filter (uid=testing) > rlm_ldap: object not found or got ambiguous search result > rlm_ldap: search failed I read that as... uid=testing is not in the ldap database. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

User accounts that expire and timeout
by Jon Pipitone 09 Jan '06

09 Jan '06

Hey all, I'm working to set up a wireless hotspot using mikrotik, freeradius, and mysql. Actually the initial setup went pretty smoothly, so a big thank you to everyone that contributed to the documentation and mailing lists. Right now I'm looking to set up user accounts that are only valid for a certain date range (for instance, from today at noon until tomorrow at noon). In essence I want to set some sort of expiry date on the user account. But, as well, I'd like the session time limit for the user to be set so that the user can't stay logged in after the expire date (i.e. log in just before the expiry time and stay logged in for a few more hours.). During the time when the account is valid (i.e. hasn't expired) the user should be able to log in and out as much as the'd like, or stay logged in for the entire time. In other words, the Session-Timeout ought to be exactly the difference in time from when they log in to when the account expires. I've done a bit of reading through the mailing list archives and the documentation. I wasn't able to get the Expiration attribute to work (i can elaborate if need be), but then even if it did it isn't fine-grained enough (only down to the day) and I still wasn't sure how to automatically adjust the Session-Timeout. I was toying with using a sqlcounter somehow, but I thought it best to ask for ideas before I dive in again. Thanks in advance, Regards, jon

2 2

GPRS
by alfonso 09 Jan '06

09 Jan '06

Hello to all. This is a theorically question Im working to validate GPRS users with freeradius( WIFI users goes ok). I want to know the state of this machines, when they are logged. For that Im using nagios, to check the state. I must join both solutions. The AAA solution and the check Solution. I should write a custom script for the authorization section, retrieve the parameters of the Access-Request. User-Name, ip is passed as an arguments, or passed as additional arguments or another posibilitie is to make a sql query to insert all the values needed to a nagios database, so nagios can check it periodically I haven't clear wich is the way. Another question is how can I run scripts after the user is validated Thank you for your opinion Alfonso Guerendiain oliver

2 1

SQL Authentication (mainly @Alan!)
by florian broder 09 Jan '06

09 Jan '06

Hi. Some weeks ago I was asking for this, but didn't receive an answer. Subject is MySQL Authentication based on a Calling-Station-ID. The problem is, that the cisco Switch doesn't send a user-name&user-password in his access-request, and mysql doesn't like! --> *Error: rlm_sql *>* (sql): zero length username not permitted" I tried to comment out this part in the sql-module source-code, and recompile freeradius. To my surprise, this actually DOES work. --> rad_recv: Access-Request packet from host 127.0.0.1:1046, id=134, length=52 User-Name = "" User-Password = "michael" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'michael' rlm_sql (sql): sql_set_user escaped user --> 'michael' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck ? WHERE Username = 'michael' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'michael' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 134 to 127.0.0.1:1046 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 134 with timestamp 43bc1274 Nothing to do. Sleeping until we see a request. Sql.conf was told, to check for the password, not username. It works! So, my question is, like in the subject, mainly directed to alan, or some other developper of the sql-module. WHY was it done like that, i.e. that you HAVE to use a username in sql? Thanks for your help, I really appreciate it! Bye. *

2 4

radiusd.c (Is it a bug??)
by Leo Lai 09 Jan '06

09 Jan '06

when reloading config file, there's a section of code that is supposed to wait for all threads to stop, however the condition is like this: if (!spawn_flag) for(;;) { // wait for thread here... } when I check where spawn_flag is set, I found that it's TRUE when multithread is supported, and FALSE when there is no thread. In this case, shouldn't here be "if (spawn_flag)" instead?? if (need_reload) { #ifdef HAVE_PTHREAD_H /* * Threads: wait for all threads to stop * processing before re-loading the * config, so we don't pull the rug out * from under them. */ int max_wait = 0; if (!spawn_flag) for(;;) { /* * Block until there are '0' threads * with a REQUEST handle. */ sig_hup_block = TRUE; if( (total_active_threads() == 0) || (max_wait >= 5) ) { sig_hup_block = FALSE; break; } sleep(1); max_wait++; } #endif Thanks, leo

2 1

thread pool information
by DilipSimha.N.M 09 Jan '06

09 Jan '06

hi, can anyone please tell me abt the thread pool configurations? start_servers = 5 ... but 5 RADIUS servers aren't started initially. then what is this attribute for?? --DilipSimha

3 2

Connection TimeOut!!!
by Kirti S. Bajwa 08 Jan '06

08 Jan '06

Hello: RH 9.0, freeRADIUS 1.4 I have been using freeRADIUS for the last 10 Months. Works great. I like to setup a maximum connection time of 120 minutes for each user. I am a complete newbie. Can somebody direct me to the file I need to set the timeout time? I also need to know the exact command, if possible. Thanks in Advance. Kirt

2 4