- Freeradius-Users - lists.freeradius.org

Multiple accounting hosts for one realm?
by Johan Ramm-Ericson 21 Dec '05

21 Dec '05

Hello Freeradius-users! While configuring freeradius 1.0.5 on Solaris 9 I began to look at setting up different accounting hosts for users depending on which realm users orginated from. That worked fine. However; I have now come across a situation where it might be valuable to send the same accounting information to multiple accounting hosts. I am hoping to do this by changing the accthost variable in etc/raddb/proxy.conf. Does anyone on the list know if (a) this is possible, and if it is possible (b) how to do it - i.e can I add further hosts in a list to the existing variable or do I need to use some other method? Thanks! /jre

2 1

bug or feature? attr_rewrite rule in post-proxy cannot create config items
by Bastiaan Bakker 21 Dec '05

21 Dec '05

Hi, We have a freeradius 'frontend' server that proxies requests to several legacy radius servers. The frontend server is responsible for IP pool management, but the backend radius server should be able to determine on a per user basis from which IP pool the frontend server should allocate IP addresses. The backend servers return the name of the desired pool in the reply attribute Framed-Pool. On the frontend server I've added a rewrite rule to the post-proxy section in order to copy the Framed-Pool value to the Pool-Name attribute used by rlm_ippool: modules { ... attr_rewrite framedpool2poolname { attribute = Pool-Name searchin = config new_attribute=yes searchfor="" replacewith="%{proxy-reply:Framed-Pool}" append=no } } post-proxy { framedpool2poolname ... } If I run freeradius in debuging mode 'radiusd -X -y', it says it sets the Framed-Pool attribute: rlm_attr_rewrite: Added attribute Pool-Name with value 'eln1' modcall[post-proxy]: module "framedpool2poolname" returns ok for request 0 However the 'eln1' IP pool module fails to find the Pool-Name config item and consequently does not assign an address. Do I misunderstand how the attr_rewrite module is supposed to work or is this a bug? I'm using freeradius-1.0.1-3.RHEL4 on CentOS 4.2. BTW, I did manage to get freeradius to do what I wanted but the 'solution' looks very much like an ugly kludge: I changed the framedpool2poolname module to add a Pool-Name attribute as reply item instead of config item and copy the reply item to the config item in post-auth: modules { ... attr_rewrite poolname2poolname { attribute = Pool-Name searchin = config new_attribute=yes searchfor="" replacewith="%{reply:Pool-Name}" append=no } attr_rewrite framedpool2poolname { attribute = Pool-Name searchin = reply new_attribute=yes searchfor="" replacewith="%{proxy-reply:Framed-Pool}" append=no } } post-auth { poolname2poolname ... } The reason why I can't directly copy Framed-Pool to Pool-Name in post-auth is that I don't want to send the Framed-Pool attribute to the client and the last place where I can filter it out AFAIK is in an attr_filter in post-proxy. Any help in simplifying this setup or confirmation that the current behaviour is indeed a bug would be appreciated very much. Best regards, Bastiaan Bakker E.Novation Lifeline Networks bv

1 0

Problem with rlm_counter in compiling
by Rafael Roldán 21 Dec '05

21 Dec '05

Hy all, I am trying to install freeradius 1.0.5 in a solaris 8 machine. When I run make, I obtain the following error: ... rlm_counter.c:38:18: gdbm.h: No such file or directory rlm_counter.c:84: parse error before "GDBM_FILE" rlm_counter.c:84: warning: no semicolon at end of struct or union rlm_counter.c:88: parse error before '}' token rlm_counter.c:88: warning: type defaults to `int' in declaration of `rlm_counter_t' rlm_counter.c:88: warning: data definition has no type or storage class rlm_counter.c:116: parse error before ')' token rlm_counter.c:116: initializer element is not constant rlm_counter.c:116: (near initialization for `module_config[0].offset') rlm_counter.c:116: warning: missing initializer rlm_counter.c:116: warning: (near initialization for `module_config[0].offset') rlm_counter.c:116: initializer element is not constant rlm_counter.c:116: (near initialization for `module_config[0]') rlm_counter.c:117: parse error before ')' token rlm_counter.c:117: initializer element is not constant rlm_counter.c:117: (near initialization for `module_config[1].offset') rlm_counter.c:117: warning: missing initializer rlm_counter.c:117: warning: (near initialization for `module_config[1].offset') rlm_counter.c:117: initializer element is not constant rlm_counter.c:117: (near initialization for `module_config[1]') rlm_counter.c:118: parse error before ')' token rlm_counter.c:118: initializer element is not constant rlm_counter.c:118: (near initialization for `module_config[2].offset') rlm_counter.c:118: warning: missing initializer rlm_counter.c:118: warning: (near initialization for `module_config[2].offset') rlm_counter.c:118: initializer element is not constant rlm_counter.c:118: (near initialization for `module_config[2]') rlm_counter.c:119: parse error before ')' token rlm_counter.c:119: initializer element is not constant rlm_counter.c:119: (near initialization for `module_config[3].offset') rlm_counter.c:119: warning: missing initializer rlm_counter.c:119: warning: (near initialization for `module_config[3].offset') rlm_counter.c:119: initializer element is not constant rlm_counter.c:119: (near initialization for `module_config[3]') rlm_counter.c:120: parse error before ')' token rlm_counter.c:120: initializer element is not constant rlm_counter.c:120: (near initialization for `module_config[4].offset') rlm_counter.c:120: warning: missing initializer rlm_counter.c:120: warning: (near initialization for `module_config[4].offset') rlm_counter.c:120: initializer element is not constant rlm_counter.c:120: (near initialization for `module_config[4]') rlm_counter.c:121: parse error before ')' token rlm_counter.c:121: initializer element is not constant rlm_counter.c:121: (near initialization for `module_config[5].offset') rlm_counter.c:121: warning: missing initializer rlm_counter.c:121: warning: (near initialization for `module_config[5].offset') rlm_counter.c:121: initializer element is not constant rlm_counter.c:121: (near initialization for `module_config[5]') rlm_counter.c:122: parse error before ')' token rlm_counter.c:122: initializer element is not constant rlm_counter.c:122: (near initialization for `module_config[6].offset') rlm_counter.c:122: warning: missing initializer rlm_counter.c:122: warning: (near initialization for `module_config[6].offset') rlm_counter.c:122: initializer element is not constant rlm_counter.c:122: (near initialization for `module_config[6]') rlm_counter.c:123: parse error before ')' token rlm_counter.c:123: initializer element is not constant rlm_counter.c:123: (near initialization for `module_config[7].offset') rlm_counter.c:123: warning: missing initializer rlm_counter.c:123: warning: (near initialization for `module_config[7].offset') rlm_counter.c:123: initializer element is not constant rlm_counter.c:123: (near initialization for `module_config[7]') rlm_counter.c:124: initializer element is not constant rlm_counter.c:124: (near initialization for `module_config[8]') rlm_counter.c: In function `counter_cmp': rlm_counter.c:138: `data' undeclared (first use in this function) rlm_counter.c:138: (Each undeclared identifier is reported only once rlm_counter.c:138: for each function it appears in.) rlm_counter.c:138: parse error before ')' token rlm_counter.c:139: `datum' undeclared (first use in this function) rlm_counter.c:156: `key_datum' undeclared (first use in this function) rlm_counter.c:159: `count_datum' undeclared (first use in this function) rlm_counter.c:159: warning: implicit declaration of function `gdbm_fetch' rlm_counter.c:133: warning: unused parameter `instance' rlm_counter.c: At top level: rlm_counter.c:171: parse error before '*' token rlm_counter.c:172: warning: function declaration isn't a prototype rlm_counter.c: In function `add_defaults': rlm_counter.c:173: `datum' undeclared (first use in this function) rlm_counter.c:173: parse error before "key_datum" rlm_counter.c:180: `key_datum' undeclared (first use in this function) rlm_counter.c:180: warning: cast discards qualifiers from pointer target type rlm_counter.c:182: `time_datum' undeclared (first use in this function) rlm_counter.c:182: `data' undeclared (first use in this function) rlm_counter.c:185: warning: implicit declaration of function `gdbm_store' rlm_counter.c:185: `GDBM_REPLACE' undeclared (first use in this function) rlm_counter.c:187: warning: implicit declaration of function `gdbm_strerror' rlm_counter.c:187: `gdbm_errno' undeclared (first use in this function) rlm_counter.c:187: warning: format argument is not a pointer (arg 4) rlm_counter.c:192: warning: cast discards qualifiers from pointer target type rlm_counter.c:199: warning: format argument is not a pointer (arg 4) rlm_counter.c: At top level: rlm_counter.c:208: parse error before '*' token rlm_counter.c:209: warning: function declaration isn't a prototype rlm_counter.c: In function `reset_db': rlm_counter.c:210: `data' undeclared (first use in this function) rlm_counter.c:214: warning: implicit declaration of function `gdbm_close' rlm_counter.c:219: warning: implicit declaration of function `gdbm_open' rlm_counter.c:220: `GDBM_NEWDB' undeclared (first use in this function) rlm_counter.c:226: warning: implicit declaration of function `gdbm_setopt' rlm_counter.c:226: `GDBM_CACHESIZE' undeclared (first use in this function) rlm_counter.c: At top level: rlm_counter.c:242: parse error before '*' token rlm_counter.c:243: warning: function declaration isn't a prototype rlm_counter.c: In function `find_next_reset': rlm_counter.c:250: `timeval' undeclared (first use in this function) rlm_counter.c:254: `data' undeclared (first use in this function) rlm_counter.c: In function `counter_instantiate': rlm_counter.c:320: `data' undeclared (first use in this function) rlm_counter.c:327: `datum' undeclared (first use in this function) rlm_counter.c:327: parse error before "key_datum" rlm_counter.c:463: `GDBM_WRCREAT' undeclared (first use in this function) rlm_counter.c:470: `GDBM_CACHESIZE' undeclared (first use in this function) rlm_counter.c:486: `key_datum' undeclared (first use in this function) rlm_counter.c:486: warning: cast discards qualifiers from pointer target type rlm_counter.c:489: `time_datum' undeclared (first use in this function) rlm_counter.c:507: warning: cast discards qualifiers from pointer target type rlm_counter.c:320: warning: statement with no effect rlm_counter.c: In function `counter_accounting': rlm_counter.c:546: `data' undeclared (first use in this function) rlm_counter.c:546: parse error before ')' token rlm_counter.c:547: `datum' undeclared (first use in this function) rlm_counter.c:632: `key_datum' undeclared (first use in this function) rlm_counter.c:637: `count_datum' undeclared (first use in this function) rlm_counter.c:676: warning: comparison between signed and unsigned rlm_counter.c:676: warning: signed and unsigned type in conditional expression rlm_counter.c:699: `GDBM_REPLACE' undeclared (first use in this function) rlm_counter.c:703: `gdbm_errno' undeclared (first use in this function) rlm_counter.c:703: warning: format argument is not a pointer (arg 4) rlm_counter.c:544: warning: unused parameter `instance' rlm_counter.c: In function `counter_authorize': rlm_counter.c:719: `data' undeclared (first use in this function) rlm_counter.c:719: parse error before ')' token rlm_counter.c:721: `datum' undeclared (first use in this function) rlm_counter.c:721: parse error before "key_datum" rlm_counter.c:769: `key_datum' undeclared (first use in this function) rlm_counter.c:781: `count_datum' undeclared (first use in this function) rlm_counter.c:827: warning: comparison between signed and unsigned rlm_counter.c:725: warning: `key_vp' might be used uninitialized in this function rlm_counter.c: In function `counter_detach': rlm_counter.c:873: `data' undeclared (first use in this function) rlm_counter.c:873: parse error before ')' token make[6]: *** [rlm_counter.o] Error 1 make[6]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules/rlm_counter' make[5]: *** [common] Error 2 make[5]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5' make: *** [all] Error 2 It is the first time I use a UNIX machine. How can I resolve this problem? Thank you very much, Rafa

2 2

users file logic?
by Maqbool Hashim 21 Dec '05

21 Dec '05

Hi, I have this in my users file: user Auth-Type := Local, User-Password = "pass" Tunnel-Type = 13, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 4016, Fall-Through = No I would like to assign a different vlan-id if the user doesn't authenticate successfully, i.e. the username is the same but he enters the wrong password. Is this actually possible, as the processing will stop once it matches the first entry for the user "user"? Regards, Maqbool Hashim

1 0

Cisco WLSE status?
by Jeffrey C. Ollie 21 Dec '05

21 Dec '05

Ok, I know that the problems getting Cisco WLSE to authenticate properly with FreeRadius is a problem with the Cisco supplicant, but I'm wondering: 1) Has anyone opened up a ticket with Cisco trying to get them to fix the problem? If so, what is the status of the ticket? 2) Has anyone polished up a patch that will allow WLSE to authenticate agianst FreeRadius? It'd be nice to have a hack that could be enabled conditionally so it doesn't break other hosts but if I have to run a separate server on a different host or port that'd probably work until we can get Cisco to fix their problem. Jeff Ollie

1 0

EAP-PEAP (mschapv2) & ssid restriction
by Sergey Velikanov 21 Dec '05

21 Dec '05

Hi I've implemented wi-fi access (EAP-PEAP with ms-chap v2), it works fine, now I want that users from one ssid could not connect to another ssid, my AP can include this infrmation in Access-Request packet rad_recv: Access-Request packet from host 192.168.232.3:1645, id=215, length=274 User-Name = "user1" Framed-MTU = 1400 Called-Station-Id = "0013.1a4b.ae50" Calling-Station-Id = "0002.2d37.249f" Cisco-AVPair = "ssid=is_client" in my raddb/users I've changed user1 User-Password == "123456" to user1 Cisco-AVPair =~ "ssid=is_client", User-Password == "123456" it works fine with EAP-TLS, but it fails with EAP-PEAP (it uses mschap), rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 18 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for user1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect It seems that rlm_mschap do not include Cisco-AVPair = "ssid=is_client" in its auth request How can I solve this situation?

2 2

"make install" error with FreeRadius 1.0.5 on RH8.0
by Vineet Verma 21 Dec '05

21 Dec '05

I completed the configure and make successfully but "make install" gives me the following error: Making install in rlm_eap_gtc... gmake[11]: Entering directory `/data/software/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_gtc' if [ "xrlm_eap_gtc" != "x" ]; then \ /data/software/freeradius-1.0.5/libtool --mode=install /data/software/freeradius-1.0.5/install-sh -c -c \ rlm_eap_gtc.la /usr/local/lib/rlm_eap_gtc.la; \ rm -f /usr/local/lib/rlm_eap_gtc-1.0.5.la; \ ln -s rlm_eap_gtc.la /usr/local/lib/rlm_eap_gtc-1.0.5.la || exit ; \ fi gmake[11]: execvp: /bin/sh: Argument list too long gmake[11]: *** [install] Error 127 gmake[11]: Leaving directory `/data/software/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_gtc' gmake[10]: *** [common] Error 2 I understand that the "Argument list too long" error is from the OS because the argv list is probably exceeding the 128K buffer. Usually the workaround is to rewrite the offending commands so that the argument lists are shorter. Has anyone run into this problem before and do you have any tips on how I can workaround this?

2 2

Re: rlm_sqlcounter and something else than Session-Timeout
by Alan DeKok 21 Dec '05

21 Dec '05

"Seferovic Edvin" <edvin.seferovic(a)kolp.at> wrote: > I do NOT want to limit or change the limit during a session. I just want to > limit it for a session As I was trying to say that in general, you CANNOT do this. You can check if they're over the limit at the START of a session. The NAS will *not* check the limit during a session, and the server can't check the limit during a session. So if they're under the limit at the start of the session, they can go over during the session, and no one will notice. This has NOTHING to do with changing the limits during a session. > 3. freeradius returns Session-Octets-Limit with the value from sqlcounter > which is the actual limitation. If the NAS supports this, it may work. But 99.9999% of the NASes do NOT support this. It's not a standard, and it's not a common vendor extension to RADIUS. > Alan, I think you are far more better programmer then I am. It shouldn't be > a big trouble to allow another config parameter for sqlcounter. This one > could be named "Reply-Attribute" and people could use to enter > "Session-Timeout" or "Session-Octets-Limit" depending on their need and > usage of freeradius. I can't test that, sorry. I'd rather see a patch that works. Alan DeKok.

2 2

Client-IP-Address in detail files
by freeradius＠list.coretech.ro 20 Dec '05

20 Dec '05

hello, I have recently upgraded from CVS version as of 2005-02-19 with the one from 2005-12-17 and I no longer get the "Client-IP-Address" attribute in the files produced by the detail module. on the other hand the "Client-IP-Address" attribute is expanded correctly in sql querys. is there something different ? how can I add "Client-IP-Address" attribute back to the detail files ? and something else. where can I find the syntax of the "listen" directive ? (to remove bind_address and port directives) thanks, Razvan Radu

3 4

Problem with CHAP, users file and radclient
by Andreas Engler 20 Dec '05

20 Dec '05

Hello, i try to test a new freeradius (1.0.5) installation with radclient (Version 1.72.2.1)and an existing auth-log detailfile. The authentication failed in rlm_check_password. Please take a look at the radius.log sequence at bottom. In the auth-log file are accepted requests of a different server, wich gets the user-password via mysql. In the auth-log file are Chap-Password and Chap-Challenge attributes. The new installation should use the users file for storing the password. So i exctracted the data from mysql-db and created the users file. The passwords are stored cleartext. Did i somthing missing in the configuration (see log)? Couldn't i use radclient this way to test real packets? Did you need mor information? Thank you for help Andreas Engler the users file entry: hubba User-Password == "bubba", NAS-Port-Id == 1/0/0/8.32 the radius.log sequence: Thread 1 handling request 0, (1 handled so far) Framed-Protocol = PPP User-Name = "hubba" CHAP-Password = 0x2c98390c540135e0bbf1024d3dff4a71ef NAS-Port-Type = Virtual NAS-Port = 268959776 NAS-Port-Id = "1/0/0/8.32" Connect-Info = "pppoe4atm" Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx CHAP-Challenge = 0x3fc1d8dc7b393459a292d664a9054a92 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_passwd: Added Grp-Name: 'test##all##' to request_items modcall[authorize]: module "etc_group" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20051220' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20051220 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 users: Matched entry DEFAULT at line 11 users: Matched entry hubba at line 31 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "hubba" with CHAP password rlm_chap: Using clear text password bubba for user hubba authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [hubba/<CHAP-Password>] (from client localhost port 268959776)

2 1