- Freeradius-Users - lists.freeradius.org

Аccounting two databases
by Юрий Колесник 06 Feb '14

06 Feb '14

Hello! Have FreeRADIUS Version 2.1.10 and Oracle database. Is it possible to configure sql accounting is to write two different databases ? I need to duplicate accounting recording on two different servers .

2 1

Re: Does FreeRADIUS 2.1.12's ECDH support include ECDH-RSA-AES128-SHA?
by William M. Koos Jr. 05 Feb '14

05 Feb '14

I'm having exactly the same "no shared cipher" problem with freeradius 2.1.12 running under Centos6. Like you, I verified the suites on both ends and in the client hello message. Among the many (22) that are present on both ends and in the client hello I see cipher 0xc00a, ECDHE-ECDSA-AES256-SHA. Did you resolve the issue? Billy

1 0

Core dump on start of FR3.0.1
by Palmer J.D.F. 05 Feb '14

05 Feb '14

Hello, I've just compiled FR3.0.1 from source but it is core dumping on start-up, I have copied the debug output below. I'm using the same config as I was with FR3.0.0. Has anyone else encountered such issues? [root@radauth3 raddb]# pkill radiusd ; radiusd -XX Fri Jan 17 11:10:50 2014 : Info: radiusd: FreeRADIUS Version 3.0.1, for host i686-pc-linux-gnu, built on Jan 17 2014 at 11:06:21 Fri Jan 17 11:10:50 2014 : Debug: Server was built with: Fri Jan 17 11:10:50 2014 : Debug: accounting Fri Jan 17 11:10:50 2014 : Debug: authentication Fri Jan 17 11:10:50 2014 : Debug: ascend binary attributes Fri Jan 17 11:10:50 2014 : Debug: coa Fri Jan 17 11:10:50 2014 : Debug: control-socket Fri Jan 17 11:10:50 2014 : Debug: detail Fri Jan 17 11:10:50 2014 : Debug: dhcp Fri Jan 17 11:10:50 2014 : Debug: dynamic clients Fri Jan 17 11:10:50 2014 : Debug: proxy Fri Jan 17 11:10:50 2014 : Debug: regex-posix Fri Jan 17 11:10:50 2014 : Debug: session-management Fri Jan 17 11:10:50 2014 : Debug: stats Fri Jan 17 11:10:50 2014 : Debug: tcp Fri Jan 17 11:10:50 2014 : Debug: threads Fri Jan 17 11:10:50 2014 : Debug: tls Fri Jan 17 11:10:50 2014 : Debug: unlang Fri Jan 17 11:10:50 2014 : Debug: vmps Fri Jan 17 11:10:50 2014 : Debug: Server core libs: Fri Jan 17 11:10:50 2014 : Debug: talloc : 2.0.* Fri Jan 17 11:10:50 2014 : Debug: ssl : OpenSSL 1.0.0e-fips 6 Sep 2011 Fri Jan 17 11:10:50 2014 : Info: Copyright (C) 1999-2014 The FreeRADIUS server project and contributors Fri Jan 17 11:10:50 2014 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Jan 17 11:10:50 2014 : Info: PARTICULAR PURPOSE Fri Jan 17 11:10:50 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Jan 17 11:10:50 2014 : Info: GNU General Public License Fri Jan 17 11:10:50 2014 : Info: For more information about these matters, see the file named COPYRIGHT Fri Jan 17 11:10:50 2014 : Info: Starting - reading configuration files ... Fri Jan 17 11:10:50 2014 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/mods-enabled/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/preprocess Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/detail Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/utf8 Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/detail.log Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/echo Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/soh Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/linelog Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/pap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/exec Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/always Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/ldap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/unix Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/passwd Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/files Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/realm Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/chap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/radutmp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/mschap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/replicate Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/dhcp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/logintime Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/expiration Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/digest Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/expr Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/sql Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/policy.d/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/accounting Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/operator-name Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/filter Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/cui Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/control Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/dhcp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/canonicalization Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/SetRealm.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/format-callstaid.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/poolacc.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/SetRealm.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/format-callstaid.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/poolacc.conf Fri Jan 17 11:10:50 2014 : Debug: main { Fri Jan 17 11:10:50 2014 : Debug: security { Fri Jan 17 11:10:50 2014 : Debug: allow_core_dumps = no Fri Jan 17 11:10:50 2014 : Debug: } Fri Jan 17 11:10:50 2014 : Debug: } Fri Jan 17 11:10:50 2014 : Debug: main { Fri Jan 17 11:10:50 2014 : Debug: name = "radiusd" Segmentation fault (core dumped) Many thanks, Jezz.

4 20

Problem with expire_on_login module and users with large connection periods
by Antonio Fernández Pérez 05 Feb '14

05 Feb '14

Hi list, Sorry, the last email had subject empty. I think that there are a mistake in sqlcounter_expire_on_login module with large uses. I have detected that users with three duration months could navigate more than three months. The problem is with the use of TIME_DIFF function that is limited to the range allowd for TIME's values. By default, TIME's range is '-838:59:59' to '838:59:59', thirty four days, more or less. So if you have a username of two months and this uses expre_on_login module, there are a problem! I have fixed the problem modifying the query on module file: I have replaced "TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))" by "TIMESTAMPDIFF(SECOND, acctstarttime, NOW())" and now works fine. Please, let me know if this is a bug in FreeRADIUS or If I have a mistake in my configuration (In MySQL or FreeRADIUS services). Thanks in advance. Regards, Antonio.

2 2

(no subject)
by Antonio Fernández Pérez 05 Feb '14

05 Feb '14

Hi list, I think that there are a mistake in sqlcounter_expire_on_login module with large uses. I have detected that users with three duration months could navigate more than three months. The problem is with the use of TIME_DIFF function that is limited to the range allowd for TIME's values. By default, TIME's range is '-838:59:59' to '838:59:59', thirty four days, more or less. So if you have a username of two months and this uses expre_on_login module, there are a problem! I have fixed the problem modifying the query on module file: I have replaced "TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))" by "TIMESTAMPDIFF(SECOND, acctstarttime, NOW())" and now works fine. Please, let me know if this is a bug in FreeRADIUS or If I have a mistake in my configuration (In MySQL or FreeRADIUS services). Thanks in advance. Regards, Antonio.

1 0

Authenticate users different Domain using LDAP group search
by Luis Diaz 05 Feb '14

05 Feb '14

Hi there! First of all, I'd like to thank everybody in this forum for the help you provide. This forum has been very helpful for me in order to deploy and make my FreeRADIUS server work. However, I'm facing a config problem that I couldn't solve just searching on this forum. So, I need a little bit of help with it. I'm running FreeRADIUS Version 2.2.0 and I've managed to make the server work to authenticate users against our AD. I'm using ntlm_auth + mschap + ldap. Everything works very fine with domain users. I have no problem. I use the ldap module in order to authenticate just some users inside specific groups and also, assigning the VLAN dynamically. The issue comes when I try to authenticate users from a different domain. I highlight that both domains share a trust relationship. I read on the forum that just configuring NTLM module adding the trusted domain would work, but for the moment, it doesn't work. I'll show you part of my config for this purpose: NTLM_AUTH Module: exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-MAIN-DOMAIN} --domain=%{%{mschap:NT-Domain}:-TRUSTED-DOMAIN}--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } If I exec the command: ntlm_auth --request-nt-key --domain=TRUSTED-DOMAIN --username=USER-TURSTED-DOMAIN --password=******** NT_STATUS_OK: Success (0x0) As you can see, ntlm module works. However, when the request comes through the radius I get a prompt from ldap module saying "object (user) not found". This is the error from the debug output: [ldap] object not found rlm_ldap::ldap_groupcmp: search failed The user from the trusted domain is inside the same group for users from my domain. The ldap search works for user form my domain, but fails when it tries to search a user from the trusted domain. I guess the problem lies on the ldap module. However, I don't fully understand where the config problem can be. Any help would be appreciate it very much. Thank you so much in advance. And have a great day!

2 3

Wimax-AAA-Session-Id
by Khalid Tawfik Kasem 04 Feb '14

04 Feb '14

Dears, Is "WiMAX-AAA-Session-Id" generated by the NAS and sent to freeRADIUS or generated by freeRADIUS and sent to the NAS? Best Regards, Khaled Qasem

2 1

Virtual server clients collision
by Stanislav Lorenc 04 Feb '14

04 Feb '14

Hi, i have two (and more) virtual servers. Each server has own business logic, port and defined separate clients. I completely use SQL modules. Clients are stored in database. I have one client using two different freeradius virtual server First for ppp. Second for login into device. Adding client into NAS 1 : rlm_sql (overovani_sql): Read entry nasname=192.168.1.10,shortname=rb1_pentagon::wlan1::192.168.1.10,secret=heslo rlm_sql (overovani_sql): Adding client 192.168.1.10 (rb1_pentagon::wlan1::192.168.1.10, server=overovani) to clients list Adding client into NAS 2: lm_sql (auth_cernovice_net_sql): Read entry nasname=192.168.1.10,shortname=rb1_pentagon::wlan1::192.168.1.10,secret=cernovice_net_nas_device rlm_sql (auth_cernovice_net_sql): Adding client 192.168.1.10 (rb1_pentagon::wlan1::192.168.1.10, server=auth_cernovice_net) to clients list Failed to add duplicate client rb1_pentagon::wlan1::192.168.1.10 rlm_sql (auth_cernovice_net_sql): Released sql socket id: 4 rlm_sql (auth_cernovice_net_sql): Failed to add client 192.168.1.10 (rb1_pentagon::wlan1::192.168.1.10) to clients list. Maybe there's a duplicate? Virtual server name in debug message is right. I think, clients are shared between virtual servers. Clients aren`t duplicates. Clients has different passwords and are placed within different virtual servers. How I get separate client list? Regards, Stanislav Lorenc

2 1

SQL statements for CUI with sqlite
by Stefan Winter 04 Feb '14

04 Feb '14

Hello, in 3.0.x, the queries.conf for the cuisql module / post-auth / dialect sqlite state: INSERT IGNORE INTO ${..cui_table} \ This breaks (gracefully) for me, and I'm told it's a syntax error. This page here: https://www.sqlite.org/lang_insert.html says it should be INSERT OR IGNORE Might be worth fixing for 3.0.2. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 3

Issue for mailing list
by 亚坤李 04 Feb '14

04 Feb '14

This mailing list help me so much for my project, but now, I have finished all of them. There are too many email everyday that I can not handle, so I want to quit this mailing list. Could anyone tell me how to quit this mailing list, thank you so much.

4 3