- Freeradius-Users - lists.freeradius.org

Re: FreeRADIUS - FreeBSD - Segmentation fault
by Dusty Doris 13 Oct '05

13 Oct '05

> > a few thing would be nice to know to maybe localize the problem further: > Are you running FreeBSD 5.4-Release or 5.4-Stable? > Which MySQL version are you running and do you have compiled it with native > threads or with linuxthreads? I installed freebsd 5.4-release and then updated the source about one week ago with the following: cvsup standard-supfile (tag=RELENG_5_4) cd /usr/src make buildworld make buildkernel KERNCONF=mykernel (didn't change much in the kernel) -added options SMP -added device CARP -removed all cpu accept I686_CPU -changed ident make installkernel KERNCONF=mykernel reboot mergemaster -p make installworld mergemaster reboot I installed everything except freeradius from ports with all the defaults (eg: make install clean) # pkg_info -Ea bash-3.0.16_1 cvsup-without-gui-16.1h_2 gdbm-1.8.3_1 gettext-0.14.5 gmake-3.80_2 libiconv-1.9.2_1 libltdl-1.5.20 libtool-1.3.5_2 libtool-1.5.20 mysql-client-4.1.14 mysql-server-4.1.14 openssh-portable-4.2.0.0,1 perl-5.8.6_2 # uname -a FreeBSD radsql1.soc.int 5.4-RELEASE-p7 FreeBSD 5.4-RELEASE-p7 #0: Tue Sep 27 14:14:11 EDT 2005 root@radacctm.lab.soc.int:/usr/obj/usr/src/sys/carp i386 Installed freeradius last from source simply doing ./configure --prefix=/usr/local/freeradius105. My radiusd.conf is very stripped down. Basically this machines only purpose is to do radius accounting to mysql, so almost everything is commented out or blank (such as users). However, I did test authentication with it briefly with an out of the box configuration only modifying sql.conf username/password and uncommenting all instances of sql in radiusd.conf. Hope that is helpful. If you have any more questions, fire away. -Dusty

3 3

RE: Counter reset
by Jonathan De Graeve 13 Oct '05

13 Oct '05

Octet values are in bytes So just calculated what it would be in MB or in GB. I recalculate the value to be in MB so I force the max octets to like 1024MB for 1GB Divide your end result with 1024*1024 or something J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 15:13 Aan: 'FreeRadius users mailing list' Onderwerp: AW: Counter reset Sorry.... Which value. What query???? Thanks for helping me, but i don´t really understand andi -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Jonathan De Graeve Gesendet: Donnerstag, 13. Oktober 2005 11:59 An: FreeRadius users mailing list Betreff: RE: Counter reset Yes there's a 4GB limit in the counter You have to use smaller values (change your sql query to divided all values by a given value) J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 9:37 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Counter reset Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

WG: Problem conversion of User-Name
by marcus.koestler＠polizei.bayern.de 13 Oct '05

13 Oct '05

> Hello, > > I have a Problem after converting a User-Name of the Form 27180769 to > 27180769(a)apfelbaum.de. > > After radius-server authorized the request i want to convert my user to an > @-Form to pass it to the rlm_krb5-module for authentication, because we > have different Kerberos-Realms and the Name 27180769 is probably not > enough to pick the right Kerberos-Server from krb5.conf. > > For this shake my external Programm gives back a value Pair in the Form > "User-Name := 27180769(a)apfelbaum.de", after I feed it with the LDAP-DN > from the LDAP-request, to pick the right realm. > > It seems that the memory allocated for User-Name is not reallocated, so > vals of other vars were overwritten after the program returns. > > here is my debug-output from radiusd -s -xx: > > Exec-Program: /usr/local/bin/convert.php > CN=27180769,CN=Users,DC=apfelbaum,DC=de > Exec-Program output: User-Name := 27180769(a)APFELBAUM.DE > Exec-Program-Wait: value-pairs: User-Name := 27180769(a)APFELBAUM.DE > Exec-Program: returned: 0 > modcall[authorize]: module "convert_name" returns ok for request 0 > rlm_ldap: Entering ldap_groupcmp() > radius_xlat: 'dc=apfelbaum,dc=de' > radius_xlat: > '(|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))( > &(objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apf > elbaum,DC=de)))' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in cn=modemuser,cn=Users,dc=apfelbaum,dc=de, > with filter > (|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))(& > (objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfe > lbaum,DC=de))) > rlm_ldap::ldap_groupcmp: User found in group > cn=modemuser,cn=Users,dc=apfelbaum,dc=de > rlm_ldap: ldap_release_conn: Release Id: 0 > users: Matched entry DEFAULT at line 219 > radius_xlat: 'number=08912124447 direction=outgoing' > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type Kerberos > auth: type "Kerberos" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_krb5: > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfelbaum,DC= > de)`] krb5_g_i_t_w_p failed: Cannot resolve network address for KDC in > requested realm > modcall[authenticate]: module "krb5" returns reject for request 0 > modcall: group authenticate returns reject for request 0 > auth: Failed to validate the user. > Login incorrect: > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users/ROrt9670] (from > client localhost port 0) > > > a snap from radiusd.conf: > > > exec convert_name { > wait=yes > program ="/usr/local/bin/convert.php %{Ldap-UserDn}" > input_pairs = request > output_pairs = request > } > > authorize { > ldap { > notfound = return > } > convert_name > files > } > > my users-file: > > DEFAULT Ldap-Group == "cn=modemuser,cn=Users,dc=apfelbaum,dc=de", > Auth-Type:=Kerberos > DIALT := "number=%{reply:DIALT} direction=outgoing", > PPPT := "callback=ppp_offered blocktime=3 Layer1Protocol=modem", > Idle-Timeout = 900, > Framed-Protocol = PPP, > User-Service := 2, > Fall-Through = 0, > Framed-Netmask := 255.255.255.255 > > DEFAULT Ldap-Group == "cn=isdnuser,cn=Users,dc=apfelbaum,dc=de", > Auth-Type:=Kerberos > DIALT := "number=%{reply:DIALT} direction=outgoing", > PPPT := "callback=ppp_offered blocktime=3", > Idle-Timeout = 900, > Framed-Protocol = PPP, > User-Service := 2, > Fall-Through = 0, > Framed-Netmask := 255.255.255.255 > > > DEFAULT Auth-Type := Reject > Reply-Message = "Your account has been disabled." > > > greetings > Marcus Koestler > Bayerisches Landeskriminalamt > SG 343, Netztechnik

2 1

AW: WG: Problem conversion of User-Name
by marcus.koestler＠polizei.bayern.de 13 Oct '05

13 Oct '05

yes. -----Ursprüngliche Nachricht----- Von: Kenneth Grady [mailto:klg@lanl.gov] Gesendet: Donnerstag, 13. Oktober 2005 16:20 An: FreeRadius users mailing list Betreff: Re: WG: Problem conversion of User-Name in your /etc/krb5.conf do you have ... [realms] apfelbaum.de ={ kdc = kerberos... On Thu, 2005-10-13 at 07:58, marcus.koestler(a)polizei.bayern.de wrote: > > Hello, > > > > I have a Problem after converting a User-Name of the Form 27180769 to > > 27180769(a)apfelbaum.de. > > > > After radius-server authorized the request i want to convert my user to an > > @-Form to pass it to the rlm_krb5-module for authentication, because we > > have different Kerberos-Realms and the Name 27180769 is probably not > > enough to pick the right Kerberos-Server from krb5.conf. > > > > For this shake my external Programm gives back a value Pair in the Form > > "User-Name := 27180769(a)apfelbaum.de", after I feed it with the LDAP-DN > > from the LDAP-request, to pick the right realm. > > > > It seems that the memory allocated for User-Name is not reallocated, so > > vals of other vars were overwritten after the program returns. > > > > here is my debug-output from radiusd -s -xx: > > > > Exec-Program: /usr/local/bin/convert.php > > CN=27180769,CN=Users,DC=apfelbaum,DC=de > > Exec-Program output: User-Name := 27180769(a)APFELBAUM.DE > > Exec-Program-Wait: value-pairs: User-Name := 27180769(a)APFELBAUM.DE > > Exec-Program: returned: 0 > > modcall[authorize]: module "convert_name" returns ok for request 0 > > rlm_ldap: Entering ldap_groupcmp() > > radius_xlat: 'dc=apfelbaum,dc=de' > > radius_xlat: > > '(|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))( > > &(objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apf > > elbaum,DC=de)))' > > rlm_ldap: ldap_get_conn: Checking Id: 0 > > rlm_ldap: ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in cn=modemuser,cn=Users,dc=apfelbaum,dc=de, > > with filter > > (|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))(& > > (objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfe > > lbaum,DC=de))) > > rlm_ldap::ldap_groupcmp: User found in group > > cn=modemuser,cn=Users,dc=apfelbaum,dc=de > > rlm_ldap: ldap_release_conn: Release Id: 0 > > users: Matched entry DEFAULT at line 219 > > radius_xlat: 'number=08912124447 direction=outgoing' > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: group authorize returns ok for request 0 > > rad_check_password: Found Auth-Type Kerberos > > auth: type "Kerberos" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 0 > > rlm_krb5: > > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfelbaum,DC= > > de)`] krb5_g_i_t_w_p failed: Cannot resolve network address for KDC in > > requested realm > > modcall[authenticate]: module "krb5" returns reject for request 0 > > modcall: group authenticate returns reject for request 0 > > auth: Failed to validate the user. > > Login incorrect: > > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users/ROrt9670] (from > > client localhost port 0) > > > > > > a snap from radiusd.conf: > > > > > > exec convert_name { > > wait=yes > > program ="/usr/local/bin/convert.php %{Ldap-UserDn}" > > input_pairs = request > > output_pairs = request > > } > > > > authorize { > > ldap { > > notfound = return > > } > > convert_name > > files > > } > > > > my users-file: > > > > DEFAULT Ldap-Group == "cn=modemuser,cn=Users,dc=apfelbaum,dc=de", > > Auth-Type:=Kerberos > > DIALT := "number=%{reply:DIALT} direction=outgoing", > > PPPT := "callback=ppp_offered blocktime=3 Layer1Protocol=modem", > > Idle-Timeout = 900, > > Framed-Protocol = PPP, > > User-Service := 2, > > Fall-Through = 0, > > Framed-Netmask := 255.255.255.255 > > > > DEFAULT Ldap-Group == "cn=isdnuser,cn=Users,dc=apfelbaum,dc=de", > > Auth-Type:=Kerberos > > DIALT := "number=%{reply:DIALT} direction=outgoing", > > PPPT := "callback=ppp_offered blocktime=3", > > Idle-Timeout = 900, > > Framed-Protocol = PPP, > > User-Service := 2, > > Fall-Through = 0, > > Framed-Netmask := 255.255.255.255 > > > > > > DEFAULT Auth-Type := Reject > > Reply-Message = "Your account has been disabled." > > > > > > greetings > > Marcus Koestler > > Bayerisches Landeskriminalamt > > SG 343, Netztechnik > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Counter reset
by Jonathan De Graeve 13 Oct '05

13 Oct '05

Yes there's a 4GB limit in the counter You have to use smaller values (change your sql query to divided all values by a given value) J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 9:37 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Counter reset Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Accounting attribute rewriting
by Christian Meutes 13 Oct '05

13 Oct '05

Hello, simple question: is there any possibility to rewrite accounting attributes apart from using rlm_attr_rewrite? -christian

1 0

Counter reset
by Andreas Korber 13 Oct '05

13 Oct '05

Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks

1 0

dialup admin - problem with users
by Matt Vollmar 12 Oct '05

12 Oct '05

Hi, I searched the archives briefly, but I wasn't sure how to even phrase this issue. I have Freeradius authenticating Chillispot through a MySQL DB. One of the features of Chillispot is to authenticate based on MAC address first before checking username. This sends the MAC as Username and a pre-determined password. I have this working fine, but the problem is that Dialup Admin will not accept usernames with "dashes" in them. Every time I try to edit a user like "00-0E-35-A8-25-9F", it changes the name to "000E35A8259F" which of course does not exist. Anyone know of a quick fix for this? If not, I will send some patches for this and a few other problems I found with Dialup Admin. I just hate delving into a project like this when there is the possibility of a fix existing. Thanks, Matt

2 1

Re: Diameter Server
by David Mitton 12 Oct '05

12 Oct '05

err.. umm.. there is the OpenDiameter project which is more of a tool kit, but you can put together a server from it. A number of people have. http://www.opendiameter.org/ And there are a couple commerical servers; including HP and Interlink Dave. ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Diameter Server Date: Wed, 12 Oct 2005 10:43:21 -0400 > > "Ashwin Gobind" <Ashwin.Gobind(a)vodacom.co.za> wrote: > > Hi all. Does anyone know of a stable implantation of a Diameter server ? > > No. There's "wire diameter", which was a student project in Taiwan, > from what I recall. But there's no real open source diameter server. > > Why do you need a diameter server? Are there any diameter clients > you're using? > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Using MySQL with Freeradius
by Sonesh Patel 12 Oct '05

12 Oct '05

Hi, I have got Freeradius working on a linux machine. It is authenticating users using a standard flat file in the /etc/raddb/users file. However, I now want to use MySQL to enter all the user criteria for authentication. Can someone help me with the following questions: 1) What is the schema of the MySQL database that has to be created 2) How do I include this database into the /etc/raddb/radiusd.conf file Many thanks in advance, Rgds, Sonesh Patel VC-NET 107-112 Leadenhall Street London EC3A 4AH Tel: 0207 398 3529 Fax: 0207 491 9511

2 1