- Freeradius-Users - lists.freeradius.org

detail files and accounting Alive packets
by Christopher Carver 15 Nov '05

15 Nov '05

Several NAS's we lease, whose configurations we cannot change, authenticate through our freeradius server. The Alive packets we are receiving from these machines are filling up our hard drive. Is there any way to deny just these Alive type packets and continue to accept Start and Stop packets? Everything I read seems to indicate this is impossible. Can someone please confirm or deny? Thanks

2 2

Accounting-Response
by Ruslan A Dautkhanov 15 Nov '05

15 Nov '05

Hello ! Short question ------------------ My FR 1.0 doesn't send Accounting-Response when sql module fail. Is it correct? I think it must always send response packets as an indication that acct packet just recieved. My NAS send acct-request packets in infinity loop until response pkt recived. Explanation --------------- Is it normal behaviour of FreeRADIUS when it does not send Accounting-Response packet to Accounting-Request? My sql module fails to insert data to DB because server due to different reasons send duplicated accounting-stop packet, and I have unique index on sessions table. We use Nomadix HSG as an our central access server for wireless connections. Nomadix send acct-request packets in infinity loop until response pkt recived. Radius debug ----------------- Tue Nov 15 12:40:33 2005 : Error: rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (WIFI.RADACCT_UNIQUEID) violated Tue Nov 15 12:40:33 2005 : Error: rlm_sql (sql): failed after re-connect Tue Nov 15 12:40:33 2005 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - ORA-00001: unique constraint (WIFI.RADACCT_UNIQUEID) violated Tue Nov 15 12:40:33 2005 : Debug: rlm_sql (sql): Released sql socket id: 1 Tue Nov 15 12:40:33 2005 : Debug: modsingle[accounting]: returned from sql (rlm_sql) for request 17 Tue Nov 15 12:40:33 2005 : Debug: modcall[accounting]: module "sql" returns fail for request 17 Tue Nov 15 12:40:33 2005 : Debug: modcall: group accounting returns fail for request 17 Tue Nov 15 12:40:33 2005 : Debug: Finished request 17 Tue Nov 15 12:40:33 2005 : Debug: Going to the next request Tue Nov 15 12:40:33 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:33 2005 : Debug: Waking up in 2 seconds... Tue Nov 15 12:40:35 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:35 2005 : Debug: Cleaning up request 14 ID 2 with timestamp 437974c7 Tue Nov 15 12:40:35 2005 : Debug: Waking up in 1 seconds... Tue Nov 15 12:40:36 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:36 2005 : Debug: Cleaning up request 15 ID 6 with timestamp 437974c9 Tue Nov 15 12:40:36 2005 : Debug: Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 213.24.217.233:1025, id=8, length=162 Thanks a lot for your help -- Ruslan A Dautkhanov

2 1

Interaction between accounting data and radutmp
by TK Lew 15 Nov '05

15 Nov '05

hi all :: I have a weird problem. If I am not mistaken sessions are logged and remove on accouting-start and accouting-stop but I have encountered where an active session for a particular users have been deleted from the session database without the corresponding accounting stop packet. I am running Freeradius 1.0.4 on Solaris 9. Is there a problem with radutmp ?? My config file for radutmp under radiusd.conf :: =========================== radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = no # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } Thanks !

2 5

RE: Problem using exec module
by Mitchell, Michael J 15 Nov '05

15 Nov '05

Hi Nan0, The authorize section of radiusd.conf is actually run twice when an Access-Request is received by the server. The first time, Autz-Type is not set. During the first run through the authorize section, one of the modules may set Autz-Type, for example, a module may set Autz-Type to MY_AUTZ_TYPE. The second time through the authorize section only modules contained within the subsection defined by the Autz-Type variable will be run. eg: Autz-Type MY_AUTZ_TYPE { echo } Hope that helps, Mike > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 15 November 2005 8:38 AM > To: 'FreeRadius users mailing list' > Subject: Problem using exec module > > Hi, I'm trying to use the next exec module: > > radius.conf ------------------- > > modules { > exec { > wait = yes > input_pairs = request > } > exec echo { > wait = yes > program = "/bin/echo %{Autz-Type}" > input_pairs = request > output_pairs = reply > } > } > > authorize { > suffix > echo > files > sql > auth_log > } > > ------------------------------- > > > And the Radiusd gave me the next output: > > radiusd -X -------------------- > > WARNING: Attempt to use unknown xlat function, or > non-existent attribute in string %{Autz-Type} > radius_xlat: '/bin/echo ' > Exec-Program: /bin/echo > Exec-Program output: > Exec-Program-Wait: plaintext: > Exec-Program: returned: 0 > > ------------------------------- > > > I hope someone can help me. Thanks and bye, > > > NanO > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Problem using exec module
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to use the next exec module: radius.conf ------------------- modules { exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{Autz-Type}" input_pairs = request output_pairs = reply } } authorize { suffix echo files sql auth_log } ------------------------------- And the Radiusd gave me the next output: radiusd -X -------------------- WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Autz-Type} radius_xlat: '/bin/echo ' Exec-Program: /bin/echo Exec-Program output: Exec-Program-Wait: plaintext: Exec-Program: returned: 0 ------------------------------- I hope someone can help me. Thanks and bye, NanO

2 2

Juniper buys Funk
by Alan DeKok 15 Nov '05

15 Nov '05

http://www.juniper.net/company/presscenter/pr/2005/pr-051114.html Alan DeKok.

3 3

Radius Server
by tarun sharma 15 Nov '05

15 Nov '05

Dear All, We are making a new Radius Server for our billing purpose so please kindly send me the installation procedure of new radius and necessary requirements of system. Waiting for your reply Thanks & Regards, Amit __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

3 3

Re: Radius Server
by Sean 15 Nov '05

15 Nov '05

Hi Tarun, I've written a how to for FreeRadius that might help you, You will find it here http://swarmhotspots.com/faq.html BTW You should be very explicit with questions posted to the mailing list. You will find people very helpful but don't ask questions if the answer can be found in the docs. Regards, Sean Bracken

1 0

Blank User-name attribute
by Gustave Nylander 15 Nov '05

15 Nov '05

Hello all, I have freeradias 1.0.5 installed with the rlm_perl module, and the trouble I'm having is that the user-name attribute is an empty string within the 'authenticate' routine I have for the perl script. My goal is to have the perl script handle the authentication, so this is obviously a problem. I'm guessing I have something misconfigured. Freeradius *definitely* runs the perl script, as you'll see from the debug info below. I have the perl script explicitely checking for an empty user-name string, and rejecting on that situation. Any hints would be much appreciated! In the .conf file, I have the following relevant sections: modules { perl{ module = /home/goose/radperl.pl func_authenticate = authenticate func_authorize = authorize } ... authorize { perl ... authenticate { perl And here is the debug from radiusd: rad_recv: Access-Request packet from host 127.0.0.1:33480, id=31, length=55 User-Name = "gus" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 perl_pool: item 0x9d35538 asigned new request. Handled so far: 1 found interpetator at address 0x9d35538 we did something with the perl module! perl_pool total/active/spare [5/0/5] Unreserve perl at address 0x9d35538 modcall[authorize]: module "perl" returns ok for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "gus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry gus at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type perl auth: type "perl" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 perl_pool: item 0x9e8b308 asigned new request. Handled so far: 1 found interpetator at address 0x9e8b308 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair User-Password = 123 rlm_perl: Added pair Auth-Type = perl perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x9e8b308 modcall[authenticate]: module "perl" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 127.0.0.1:33480 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 436d5cab Nothing to do. Sleeping until we see a request.

2 3

Send Cisco AVPair Attribute in Access-Accept Response
by Mehdi Torki 15 Nov '05

15 Nov '05

Hi all I have a Cisco AS5350 and I writed a custom TCL IVR script for voice application. When a call occures, then my script collects a 10 digit number and sends it to my freeRadius for authorization. my freeRadius configured with MySql db. I inserted (VENDOR: CISCO) and (ATTRIBUTE: Cisco-AVPair) in dictionary table. also in radreply table I have below record: <a 10 digit number> (user FIELD) Cisco-AVPair (Attribute FIELD) := (op FIELD) h323-ivr-in=A:B (Value FIELD) In debug output of Cisco AS5350, after sending authorization request, I saw: ************************************************************************ ROUTER#Received from id 42 192.168.230.110:1645<http://192.168.230.110:1645>, Access-Accept, len 56 4w5d: RADIUS: authenticator 06 3A 4D BB 2C AA 28 B8 - B7 11 CE DA B0 66 B2 66 4w5d: RADIUS: Vendor, Cisco [26] 24 4w5d: RADIUS: Cisco AVpair [1] 18 "h323-ivr-in=A:B" 4w5d: RADIUS: Service-Type [6] 6 Framed [2] 4w5d: RADIUS: Framed-Protocol [7] 6 PPP [1] ************************************************************************ It doesn't show any "Attribute 26 ..." in debug output. Also in my TCL script: "infotag get aaa_avpair_exists h323-ivr-in" returns False and could not found h323-ivr-in avpair in Access-Accept message! Please help me and guide me if I take a mistake on freeRadius configuration or MySql configuration for sending Cisco AVPair (VSA) to AS5350. Tank you in Advanced.

1 0