- Freeradius-Users - lists.freeradius.org

problem with using rlm_sql for accounting only
by John Donagher 09 Aug '05

09 Aug '05

Hi all- I've recently deployed freeradius at my employer to replace our old radius server which lacked native LDAP support which we've moved to for authentication and authorization. Thanks for a great application. I have one problem: I've configured freeradius to send accounting data to an SQL database for ease of reporting. It works fine, with one exception, which after extensive googling I don't find anyone else complaining about. If the SQL server is inaccessible (i.e. down, or locked), freeradius rejects all radius requests. In my case, since the SQL database is being used only for accounting, this is not desired behavior. I can see how it may have been to the designer given that rlm_sql can be used for auth. So my question is that: is that behavior by design, or is it due to some misconfiguration on my part? I figured I'd start with a simple question before I post configs/logging output. Thanks John

3 5

sql.conf (update query)
by Michel Bélanger 09 Aug '05

09 Aug '05

Hi, I try to add an additional query in the query update in sql.conf. This is possible to make it ? Here what I have test: accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}', \ AcctOutputOctets = '%{Acct-Output-Octets}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}'; INSERT into radtempo (AcctInputOctets, AcctOutputOctets, AcctSessionId) values('%{Ac ct-Input-Octets}', '%{Acct-Output-Octets}', '%{Acct-Session-Id}')" rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): Couldn't update SQL accounting ALIVE record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '; INSERT into radtempo (AcctInputOctets, AcctOutputOctets, AcctSessionId) values' at line 1 -- ------------------------------------------------------------ Michel Bélanger

1 0

FreeRadius EAP-TLS quesitons
by Hamid Salim 09 Aug '05

09 Aug '05

Hello, Two part question: 1. Is it critical to have certificates, dh and random files in etc/raddb/certs directory for eap-tls to work. 2. Is it ok to generate random file as date > random thanks a lot. Hamid.

2 1

Newbie: General Questions About Installation
by Waylock WISP 09 Aug '05

09 Aug '05

I'm attempting to get my hands around installing FreeRadius-1.0.4 on a Debian Linux machine while also trying learn Linux better. I've been reading through all the various documentation, but had a few general questions that I was hoping someone would be so kind to reply on. 1. All the docs show installation starting with the tar file, but no one really specifies what directory to begin from. Should I create a new user "raduser" and copy the tar file into /home/raduser or is there somewhere else that is the proper place to begin? 2. After I installed this all (in /home/raduser), is there a quick test to see if the basic functionality works properly? I read the /doc/performance&testing but reached a problem while going through the process because I couldn't find or run the /user/local/sbin/radiusd There are zero files in the /user/local/sbin directory. If it would be helpful for me to post snippets of certain log files, please let me know which ones and what parts and I'll do it. Thank you! -Chad

8 9

rlm_ldap: Attribute "User-Password" is required for authentication
by melvin 09 Aug '05

09 Aug '05

Hi all, Currently I need to use ldap to authenticate my users and I keep encountering the same problem "rlm_ldap: Attribute "User-Password" is required for authentication". I have tried adding "checkItem User-Password userPassword" into ldap.attrmap but it still doesn't work. Anyone have any ideas how I can enable radius to authenticate thru ldap? rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. cheers, melvin

4 12

problems with mac address authentication
by robin rapa 09 Aug '05

09 Aug '05

I have linux fedora 3 and one lan wifi. I need to install a server freeradius for mac address authentication (only, without certificates). You can help me to configure the server Thank you _________________________________________________________________ ¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en MSN Motor. http://motor.msn.es/researchcentre/

1 0

unixodbc: Query sending problem
by Mykhaylo Tyulchenko 09 Aug '05

09 Aug '05

Hi, I'm having some problem with sending SQL query to MSSQL 7.0 Server through UnixODBC driver of FreeRadius (module rlm_sql_unixodbc) with error: rlm_sql_unixodbc: ' [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark before the character string ''.' My SQL query is a stored procedure executed on MSSQL server with some parameters: exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2 FreeTDS and UnixODBC configured fine, so i have normal MSSQL server execution of that query testing by tsql and isql programms. But when i try to use that query as Authorization Query in mssql.conf i get next screen: radius_xlat: 'exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2' rlm_sql (sql): Reserving sql socket id: 4 query: exec sp_authenticate 'setup','123456',null,0,'255.255.255.255','L3',2 radius_xlat: '' radius_xlat: 'exec sp_authenticate '' query: exec sp_authenticate ' rlm_sql_unixodbc: ' [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark before the character string ''.' rlm_sql_getvpdata: database query error radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 Please help. FreeRadius 1.0.4, UnixODBC 2.2.11, MSSQL 7.0 Regards, Mykhaylo Tyulchenko

1 0

freeradius + chillispot + PDA
by yuniva wati 09 Aug '05

09 Aug '05

I have some problem, can we use freeradius and chillispot as a login window show at PDA?? because that i know, freeradius use at personal computer or notebook. thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: different eap/tls config for different interfaces
by ragan_davis＠colstate.edu 08 Aug '05

08 Aug '05

Makes sense. I'm doing EAP-TTLS with LDAP. I probably wouldn't need to define 2 diff ldap instances, since they'd both point to the same ldap server. However, I wonder if the ":=" operator would cause freeradius to ignore any other auth methods (such as ldap)? Doesn't that act as an "override" of sorts, or am I way off? thanks! ----- Original Message ----- From: Michael Griego <mgriego(a)utdallas.edu> Date: Monday, August 8, 2005 5:53 pm Subject: Re: different eap/tls config for different interfaces > By its Client-IP-Address attribute or NAS-IP-Address attribute. > > Also, you can use the Packet-Dst-IP-Address attribute if you're > certain > that the clients are split up by interface. You can match up > based on > incoming interface like you were thinking about doing with two > different > servers. So, if your server is listening on 10.0.0.1 and > 10.0.1.1, and > your EAP modules are named EAPauth1 and EAPauth2, you could do: > > DEFAULT Packet-Dst-IP-Address == 10.0.0.1, EAP-Message =* "", Auth- > Type > := EAPauth1 > > DEFAULT Packet-Dst-IP-Address == 10.0.1.1, EAP-Message =* "", Auth- > Type > := EAPauth2 > > This functionality may only be CVS snapshots, though. I'm not > sure as I > haven't looked to see if it exists in the production releases. > > --Mike > > ragan_davis(a)colstate.edu wrote: > > >Mike, > > > >Sounds good, thanks for the info. Just curious: In the dual eap- > tls > >configuration that you mentioned in the second paragraph, how > would > >the radius server know which one to use for a given client? > > > >thanks! > > > >----- Original Message ----- > >From: Michael Griego <mgriego(a)utdallas.edu> > >Date: Friday, August 5, 2005 11:34 pm > >Subject: Re: different eap/tls config for different interfaces > > > > > > > >>After I'm done with the rlm_eap_tls rewrites and rlm_eap > updates, > >>there > >>will be functionality to have multiple EAP submodules of the > same > >>type > >>with different configurations. With this, you'll be able to > force > >>the > >>use of a specific EAP type instance by its instance name. > >> > >>In the meantime, if you want to avoid bringing up two servers, > you > >>*can* > >>configure two EAP module instances, each with a different tls > >>submodule > >>configuration. Force the Auth-Type to the EAP module with the > >>correct > >>tls configuration based on your criteria. I've used this > scenario > >>in > >>the past. > >> > >>--Mike > >> > >> > >>ragan_davis(a)colstate.edu wrote: > >> > >> > >> > >>>Oh...duh...that makes sense. Should have considered that. I > >>> > >>> > >>have since > >> > >> > >>>tested the behavior of the scenario I described, and Alan's on > >>> > >>> > >>target. > >> > >> > >>>Doesn't really seem to matter which interface I enter on, or which > >>>common-name I use. Seems to work either way. > >>> > >>>thanks for the help! > >>> > >>>----- Original Message ----- > >>>From: Kris Benson <kbenson(a)sd57.bc.ca> > >>>Date: Friday, August 5, 2005 5:28 pm > >>>Subject: Re: different eap/tls config for different interfaces > >>> > >>> > >>> > >>> > >>> > >>>>>ragan_davis(a)colstate.edu wrote: > >>>>> > >>>>> > >>>>> > >>>>> > >>>>>>If so, is it possible to have 2 different tls sections that > >>>>>> > >>>>>> > >>service>>>>the 2 different interfaces? > >> > >> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>No. FreeRADIUS supports only 1 TLS module at a time. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>What Alan forgot to mention is a solution. > >>>> > >>>>If you run two copies of the Radius server, with one bound to > >>>>either a > >>>>different set of ports, or one to each IP, you could have > >>>> > >>>> > >>separate > >> > >> > >>>>configs. > >>>>-kb > >>>>-- > >>>>Kris Benson, CCP, I.S.P. > >>>>Technical Analyst, District Projects > >>>>School District #57 (Prince George) > >>>> > >>>>- > >>>>List info/subscribe/unsubscribe? See > >>>>http://www.freeradius.org/list/users.html > >>>> > >>>> > >>>> > >>>> > >>>- > >>>List info/subscribe/unsubscribe? See > >>> > >>> > >>http://www.freeradius.org/list/users.html> > >> > >> > >>- > >>List info/subscribe/unsubscribe? See > >>http://www.freeradius.org/list/users.html > >> > >> > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html> > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: different eap/tls config for different interfaces
by ragan_davis＠colstate.edu 08 Aug '05

08 Aug '05

Mike, Sounds good, thanks for the info. Just curious: In the dual eap-tls configuration that you mentioned in the second paragraph, how would the radius server know which one to use for a given client? thanks! ----- Original Message ----- From: Michael Griego <mgriego(a)utdallas.edu> Date: Friday, August 5, 2005 11:34 pm Subject: Re: different eap/tls config for different interfaces > After I'm done with the rlm_eap_tls rewrites and rlm_eap updates, > there > will be functionality to have multiple EAP submodules of the same > type > with different configurations. With this, you'll be able to force > the > use of a specific EAP type instance by its instance name. > > In the meantime, if you want to avoid bringing up two servers, you > *can* > configure two EAP module instances, each with a different tls > submodule > configuration. Force the Auth-Type to the EAP module with the > correct > tls configuration based on your criteria. I've used this scenario > in > the past. > > --Mike > > > ragan_davis(a)colstate.edu wrote: > > >Oh...duh...that makes sense. Should have considered that. I > have since > >tested the behavior of the scenario I described, and Alan's on > target. > >Doesn't really seem to matter which interface I enter on, or which > >common-name I use. Seems to work either way. > > > >thanks for the help! > > > >----- Original Message ----- > >From: Kris Benson <kbenson(a)sd57.bc.ca> > >Date: Friday, August 5, 2005 5:28 pm > >Subject: Re: different eap/tls config for different interfaces > > > > > > > >>>ragan_davis(a)colstate.edu wrote: > >>> > >>> > >>>>If so, is it possible to have 2 different tls sections that > service>>>>the 2 different interfaces? > >>>> > >>>> > >>> No. FreeRADIUS supports only 1 TLS module at a time. > >>> > >>> > >>What Alan forgot to mention is a solution. > >> > >>If you run two copies of the Radius server, with one bound to > >>either a > >>different set of ports, or one to each IP, you could have > separate > >>configs. > >>-kb > >>-- > >>Kris Benson, CCP, I.S.P. > >>Technical Analyst, District Projects > >>School District #57 (Prince George) > >> > >>- > >>List info/subscribe/unsubscribe? See > >>http://www.freeradius.org/list/users.html > >> > >> > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html> > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 3