- Freeradius-Users - lists.freeradius.org

RE: [m0n0wall] RE: access for 24 hours after first login?
by Jonathan De Graeve 12 Oct '05

12 Oct '05

And here the query in case you don't like seconds ;) SELECT HOUR(SEC_TO_TIME(UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime))) FROM radacct WHERE UserName = '%{%k}' LIMIT 1; Then All-Secs-Passed/Max-Secs-Passed should be All-Hours-Passed/Max-Hours-Passed and Max-Hours-Passed specified in Hours instead of seconds Also note this is for MySQL. Don't know if it also works on oracle and Postgres.... -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: Jonathan De Graeve [mailto:Jonathan.De.Graeve@imelda.be] Verzonden: donderdag 6 oktober 2005 15:51 Aan: FreeRadius users mailing list CC: m0n0wall(a)lists.m0n0.ch Onderwerp: [m0n0wall] RE: access for 24 hours after first login? This is how I do this Use SQLcounter module Put this in sqlcounter.conf (expecting that sqlcounter is already configged in the radiusd.conf) sqlcounter validity { counter-name = All-Secs-Passed check-name = Max-Secs-Passed sqlmod-inst = sql key = User-Name reset = never query = "SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) secs_passed_since_start FROM radacct WHERE UserName = '%{%k}' LIMIT 1" Create in the config dictionary file an attribute of Max-Secs-Passed For example: #ATTRIBUTE My-Local-String 3000 string #ATTRIBUTE My-Local-IPAddr 3001 ipaddr #ATTRIBUTE My-Local-Integer 3002 integer ATTRIBUTE Max-Secs-Passed 3000 integer In radiusd.conf: Authorize {} section: Put this: validity The Max-Secs-Passed var is defined in seconds. So if you want a user only to be able to logon in the first 24hours after his first logon, Max-Secs-Passed should be set to 86400 (60secs * 60minutes * 24) Hope this helps the question I think many people will have. You could use other check or counter-names, its just an example.... You also could combine this with volume limits, max total session time etc... Kind Regards -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Markus Krause Verzonden: donderdag 6 oktober 2005 12:57 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Re: access for 24 hours after first login? Zitat von Alan DeKok <aland(a)ox.org>: > Markus Krause <krause(a)biochem.mpg.de> wrote: > > i set up freeradius succesfully for authentification against pam and users > file > > :-) > > Please don't use "authentification". It's "authentication". sorry for my poor english, it's not my mother-tongue ... > > now i want to enhance the functionality about the following feature: > > setting up several predefined (guest) accounts with a generated username > and > > password. this account should be valid from the first time it is used > (first > > login) for 24 hours (or even better until 23:59 that day). > > rlm_counter. Set it for 24 hours of access, and "reset=never". i read about this, but does this not mean that the user has an online time of 24 hours (or whatever i set in Max-All-Session-Time), so he can login until he has been active for 24 hours in sum? thanks in advance for your help! markus > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------------------------------------------- To unsubscribe, e-mail: m0n0wall-unsubscribe(a)lists.m0n0.ch For additional commands, e-mail: m0n0wall-help(a)lists.m0n0.ch

3 3

Microsoft SQL 2000 interface
by Cliff Hayes 12 Oct '05

12 Oct '05

All, Sorry to have to bring up the "M" word, but that's what we have - Microsoft SQL 2000 interfacing with Platypus and Radiator. I searched the FAQ and archives and found no reference to a Microsoft SQL interface. Can I populate my Microsoft SQL DB with freeRadius? If so, how? Thanks, Cliff

4 4

i want to add new attributs
by Harish Gupta 12 Oct '05

12 Oct '05

Hello All, I m Harish Gupta from india, i m working in a Telecom & ISP company as system Administator and I m using freeradius application on linux platform(CentOS4.0) for my dialup users . its working fine, but i want to add a new attribute like "caller-id and calling-id " how can add these attributs plz. help me . Thanx & Regards Harish Gupta System Aministrator India +919828032258

4 6

Diameter Server
by Ashwin Gobind 12 Oct '05

12 Oct '05

Hi all. Does anyone know of a stable implantation of a Diameter server ? �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

authentication problem
by helmy＠bdg.jalawave.com 12 Oct '05

12 Oct '05

I am currently using freeradius to hotspot service. i have a trouble when authenticate user. For username i used handphone number (example : +65994567), this is based on policy. When i try to login user with that username it was failed. I try to debug, the result is the '+' sign was change to HEXA mode '2B'. I dont have any idea but this. Hope anyone can help me... Thanks, my2 Debug result : ----cut---- modcall[authorize]: module "auth_log" returns ok for request 9 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "+123", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 9 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 9 radius_xlat: '=2B123' rlm_sql (sql): sql_set_user escaped user --> '=2B123' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '=3D2B123' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User =2B123 not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '=3D2B123' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '=3D2B123' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User =2B123 not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 9 modcall: group authorize returns ok for request 9 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 9 rlm_chap: login attempt by "+123" with CHAP password rlm_chap: Could not find clear text password for user +123 modcall[authenticate]: module "chap" returns invalid for request 9 modcall: group Auth-Type returns invalid for request 9 auth: Failed to validate the user.

2 1

rlm_exec question
by Vicor M. Polukcht 12 Oct '05

12 Oct '05

Hi all. I have a hardware that sends me accounting using radius protocol i have two records: (Acct-Session-Id, Start Record) 14346//testgw@voip/40AB4B43 ADA86932 80450002 401E622/originate/VoIP////62.152.64.32 (Acct-Session-Id, Stop Record) 14346///40AB4B43 ADA86932 80450002 A401E622/answer/VoIP/13:08:48.000 GMT Tue Oct 11 2005/13:09:03.000 GMT Tue Oct 11 2005/16/62.152.64.203 You see that the only common part of records is first 5 digits at the beginning. I need to change these attribute to 14346 before it is uploaded to the database. I have a script that cuts digits: #!/bin/bash echo $1 | awk -F / {'print "Acct-Session-Id = " $1'} exit 0 But i don't know what to write in radiusd.conf Now i did: radiusd.conf ... exec { wait = yes program = "/opt/gk/radius/bin/acct_parse %{Acct-Session-Id}" input_pairs = request output_pairs = request packet_type = Accounting-Request } accounting { exec ..... } But it doesn't work In debug mode i see: radius_xlat: '/opt/gk/radius/bin/acct_parse 14405///22CE4B43 EF5D8704 806B0002 A401E622/answer/VoIP/15:37:36.000 GMT Tue Oct 11 2005/15:37:50.000 GMT Tue Oct 11 2005/16/62.152.64.203' Exec-Program: /opt/gk/radius/bin/acct_parse 14405///22CE4B43 EF5D8704 806B0002 A401E622/answer/VoIP/15:37:36.000 GMT Tue Oct 11 2005/15:37:50.000 GMT Tue Oct 11 2005/16/62.152.64.203 Exec-Program output: Acct-Session-Id = 14405 Exec-Program-Wait: value-pairs: Acct-Session-Id = 14405 Exec-Program: returned: 0 modcall[accounting]: module "exec" returns ok for request 1 What am i doing wrong and what should i do? PS: Sorry for terrible english -- Victor M. Polukcht mailto:vpolukcht@gmail.com callto://vpolukcht/

2 1

Re: MySQL Logging and radacct directory
by Curt LeCaptain 12 Oct '05

12 Oct '05

That was exactly my problem. My mistake for not looking closer, thank you very much! Curt LeCaptain >>> aland(a)ox.org >>> "Curt LeCaptain" <lecaptainc(a)infinitytechnology.com> wrote: > What I'm wondering is, why, if I'm logging accounting to MySQL, are > entries showing up in /var/log/radius/radacct/? Because you told it to. The "radiusd.conf" file still contains references to radutmp. > Shouldn't I be avoiding those entries by logging to mysql? Logging to MySQL is *additive*, because you *added* SQL entries to "radiusd.conf". Delete the "radutmp" entries, and you will delete all log messages coming from radutmp. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

MySQL Logging and radacct directory
by Curt LeCaptain 11 Oct '05

11 Oct '05

I'm currently running FreeRADIUS in this setup: Unix authentication with logging to mysql for accounting. What I'm wondering is, I'm currently seeing the occasional message like this: Tue Oct 11 10:06:32 2005 : Error: rlm_radutmp: Logout for NAS sb-ent2 port 24, but no Login record What I'm wondering is, why, if I'm logging accounting to MySQL, are entries showing up in /var/log/radius/radacct/? Shouldn't I be avoiding those entries by logging to mysql? Any thoughts are appriciated, if you need debug, I will get that. Thanks, Curt LeCaptain

3 3

Value of Calling-station-id on ethernet
by Jonathan De Graeve 11 Oct '05

11 Oct '05

Is this value the mac or the ip address on Ethernet networks. I need to know since I'm programming a radiusclient. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be

3 2

(no subject)
by nagaraj 11 Oct '05

11 Oct '05

Hi, Has any body had any experience implementing CHAP-PASSWORD to authenticate http clients against a radius server ? I read a document that says The CHAP-Challenge and CHAP-PASSWORD attributes are not suitable since the CHAP algorithm is not compatible with HTTP digest. If that is the case, Please let me know if there is a work around. Regards, Nagaraj

2 1