- Freeradius-Users - lists.freeradius.org

sqlippool querries
by Bill Schoolfield 02 Dec '13

02 Dec '13

Hello, I have a couple of things going on. (1) My mysql based ippool is out of sync with the ips actually in use. This is leading to ip conflicts and immediate drops after successful login. (2) take a look at the sql errors. It apparently doesn't like "expiry_time IS NULL" in the update. For (1) how can I get the ippool in sync? Is the only way to reset the radippool table and drop all the connections from the NAS? For (2) is this an error a by product of the immediate disconnect? Is the mysql version of sqlippool known to work. Also for number (2) one problem I see is the schema doesn't account for callingstationid that are this large. I assume I''ll need to change the schema for this. Happy to send config file setup and/or radiusd -X output if it will help. Though the setup is very basic. Bill > tail -f /var/log/radius/radius.log > Mon Dec 2 14:21:40 2013 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 > Mon Dec 2 14:21:40 2013 : Info: rlm_sql (sql): Connected new DB handle, #4 > Mon Dec 2 14:21:40 2013 : Info: Loaded virtual server <default> > Mon Dec 2 14:21:40 2013 : Info: Ready to process requests. > Mon Dec 2 14:28:24 2013 : Auth: Login OK: [abraham1078(a)epsiton.com] (from client ERX2 port 21068 cli GigabitEthernet 3/0/6.3220146:322-146#587449101#801 GE1 TOROON4415W-TOROON4425W##pppoe 68:15:90:3e:0b:81#) > Mon Dec 2 14:28:24 2013 : Error: sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '204.101.13.1'' > Mon Dec 2 14:28:24 2013 : Error: rlm_radutmp: Logout for NAS ERX2 port 21068, but no Login record > Mon Dec 2 14:28:24 2013 : Error: sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '204.101.13.1' AND pool_key = '21068' AND username = 'abraham1078(a)epsiton.com' AND callingstationid = 'GigabitEthernet 3/0/6.3220146:322-146=23587449101=23801 GE1 TOROON4415W-TOROON4425W=23=23pppoe 68:15:90:3e:0b:81=23' AND framedipaddress = ''' > Mon Dec 2 14:28:24 2013 : Info: Released IP (did cli GigabitEthernet 3/0/6.3220146:322-146#587449101#801 GE1 TOROON4415W-TOROON4425W##pppoe 68:15:90:3e:0b:81# user abraham1078(a)epsiton.com) > Mon Dec 2 14:28:24 2013 : Info: [sql] stop packet with zero session length. [user 'abraham1078(a)epsiton.com', nas '204.101.13.1'] > Mon Dec 2 14:40:57 2013 : Auth: Login OK: [abraham1078(a)epsiton.com] (from client ERX2 port 21070 cli GigabitEthernet 3/0/6.3220146:322-146#587449101#801 GE1 TOROON4415W-TOROON4425W##pppoe 68:15:90:3e:0b:81#) query error here: > Mon Dec 2 14:40:57 2013 : Error: sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '204.101.13.1'' > Mon Dec 2 14:40:57 2013 : Error: rlm_radutmp: Logout for NAS ERX2 port 21070, but no Login record > Mon Dec 2 14:40:57 2013 : Error: sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '204.101.13.1' AND pool_key = '21070' AND username = 'abraham1078(a)epsiton.com' AND callingstationid = 'GigabitEthernet 3/0/6.3220146:322-146=23587449101=23801 GE1 TOROON4415W-TOROON4425W=23=23pppoe 68:15:90:3e:0b:81=23' AND framedipaddress = ''' > Mon Dec 2 14:40:57 2013 : Info: Released IP (did cli GigabitEthernet 3/0/6.3220146:322-146#587449101#801 GE1 TOROON4415W-TOROON4425W##pppoe 68:15:90:3e:0b:81# user abraham1078(a)epsiton.com) > Mon Dec 2 14:40:57 2013 : Info: [sql] stop packet with zero session length. [user 'abraham1078(a)epsiton.com', nas '204.101.13.1']

2 3

LDAP Module : basedn empty -> error
by Dominique Fournier 02 Dec '13

02 Dec '13

Hi I try to connect my Freeradius to a Zimbra LDAP server with multidomain. In Zimbra, the LDAP tree is something like : "ou=people,dc=domain,dc=tld". I have some domains in ".fr" and some other in ".org". If I configure with the basedn = "dc=fr", Freeradius works well for all the domains in ".fr". But if I try to allow all my domains (with a basedn=""), Freeradius don't accept to authenticate the users. In the logs, when there is a reject, I can see : [ldap-inner-tunnel] performing user authorization for XXXXX [ldap-inner-tunnel] expand: (mail=%{User-Name}) -> (mail=XXXXX.fr) [ldap-inner-tunnel] expand: -> [ldap-inner-tunnel] unable to create basedn. ++[ldap-inner-tunnel] returns invalid Invalid user: [XXXXX.fr] (from client localhost port 0 via TLS tunnel) I found a topic in the list http://freeradius.1045715.n5.nabble.com/Sending-null-BaseDN-td5716006.html in 2012, but there is no solution. I am on a Debian stable Freeradius 2.1.12 Thanks a lot. Dom

3 10

Re: Freeradius/LDAP/MySQL/Huntgroup - 2 Profiles for same equipment
by Alan DeKok 02 Dec '13

02 Dec '13

Francislaine Moreno wrote: > I'm trying to find some way to differentiate the same IP / switch in 2 > different huntgroups. Don't use huntgroups. They're not meant to do multiple group membership. You can put the group membership as a property in an SQL database. Then, write a query to get it. Alan DeKok.

1 0

FreeRadius, 802.1x authentication via PEAP-MsChapv2
by Esma 02 Dec '13

02 Dec '13

Hello, We are using Freeradius server via 802.1x authentication with PEAP-MsChapv2. We want to use our own server certificate and we have three certificate files server.key, server.pem and server.crt. We kindly ask you how to configurate the radius server in order to use following certificate files in 802.1x authentication. Server.crt Bag Attributes localKeyID: ... friendlyName: ... subject... issuer=... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- Server.key -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY----- Server.pem Bag Attributes ... localKeyID: ... friendlyName: ... Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider Key Attributes ... -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: ... ... -----END RSA PRIVATE KEY----- Regards,

2 1

Freeradius/LDAP/MySQL/Huntgroup - 2 Profiles for same equipment
by Francislaine Moreno 02 Dec '13

02 Dec '13

I'm using google translator, I apologize. I'm using Freeradius with a database in MySQL and groups in OpenLDAP. Huntgroup'm using to create profiles of equipment. And the NAS table to record the switches. My problem is that when authenticating switches the Ciscos, the ENABLE profile, access works perfectly, but in the EXEC profile, no. The conflict is that signed up as the IP switch, ENABLE the first group, even if that user is logging in, belongs only to the EXEC group, FreeRadius to do the research, get the information that the switch belongs to ENABLE. I'm trying to find some way to differentiate the same IP / switch in 2 different huntgroups. Thank you for your help. Francislaine Aquino

1 0

copy-acct to home server from specific NAS
by Johansson, Daniel 02 Dec '13

02 Dec '13

Hi Freeradius-users We have configured copy-acct-to-home-serverA and copy-acct-to-home-serverB in our radius Configured two realms, two home_servers and have two detail files. This works fine it copies the accounting hitting FR to the two home_servers. However we have 20NAS servers sending accounting to the FR and we only want to copy-acct from two of the NAS servers How can we configure FR to only copy acct to home servers when it comes from NAS1 and NAS2? We can identify the NASes by Called-Station-Id == nas1 We have tried using check-items like below, but it doesn't work as we expected, nothing is sent to the home server. server copy-acct-to-home-serverA { listen { type = detail update control { Called-Station-Id == nas1, Proxy-To-Realm := realmA } I guess we are doing something wrong with check items and attributes? Server: Freeradius version 2.2.0 Ubuntu 12.04 BR /Daniel

4 3

Fwd: Setting up Radius proxy - Urgent request
by khali singh 02 Dec '13

02 Dec '13

Hi I wish to use a freeradius server which proxies all requests for users from test.com to another radius server. I read up a lot and configured the proxy.conf to have new realm as follows: realm test.com { type = radius authhost = 193.234.219.146:8180 secret = my_secret_with_other_radius_server nostrip } However, when I get a request from a user from that domain, I see the following output: Mon Dec 1 08:22:50 2013 : Info: [suffix] Looking up realm "test.com" for User-Name = "testuser(a)test.com" Mon Dec 1 08:22:50 2013 : Info: [suffix] No such realm "test.com" Mon Dec 1 08:22:50 2013 : Info: ++[suffix] returns noop Can someone help me with this. I would be really very grateful. I think I am missing some configuration but I am new to freeradius. Thanks to all!

4 5

Freeradius as DHCP server with option 82
by brijesh shingadiya 02 Dec '13

02 Dec '13

Hi All, I am a newbie trying to configure freeradius as DHCP server to authenticated DHCP requests with option 82 and assign IP addresses. I am not sure how to parse the DHCP option 82 from request validate that value and then return the DHCP offer if the option 82 has valid value. I couldnt find any documentation on that. Any help from you guys or any documentation for that will be really helpful. Regards, Brijesh

2 1

freeradius accounting disable
by scolamariano＠tiscali.it 01 Dec '13

01 Dec '13

hello, it is possible to disable accounting functionality only for a specific user? thank you Invita i tuoi amici e Tiscali ti premia! Il consiglio di un amico vale più di uno spot in TV. Per ogni nuovo abbonato 30 € di premio per te e per lui! Un amico al mese e parli e navighi sempre gratis http://freelosophy.tiscali.it/ [1] Links: ------ [1] http://freelosophy.tiscali.it/ Invita i tuoi amici e Tiscali ti premia! Il consiglio di un amico vale più di uno spot in TV. Per ogni nuovo abbonato 30 € di premio per te e per lui! Un amico al mese e parli e navighi sempre gratis http://freelosophy.tiscali.it/

2 1

Reply with Access-Reject from exec
by Adnan Miljkovic 01 Dec '13

01 Dec '13

Hello, I am using exec to check users again an external script. Up until now I am able to successfully authenticating the user and send back several attributes that are used by the NAS. So when user data are OK, everything is fine. My problem is how to deny access to the user, how to send "Access-Reject"? What should I send back in my exec program. Possible my setup is wrong? my current setup: authorize { ..... update control { Auth-Type := CheckUser } ..... } authenticate { .... Auth-Type CheckUser { checkuser } ..... } The output "Access-Accept" is always send back to NAS: ================================================== ++[sql] = notfound ++update control { ++} # update control = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = CheckUser # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group CheckUser { [checkuser] expand: %{User-Name} -> student.name [checkuser] expand: %{User-Password} -> password Exec output: fail = 1 Exec plaintext: fail = 1 [checkuser] Exec: program returned: 0 ++[checkuser] = ok +} # group CheckUser = ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 117 to 127.0.0.1 port 57009 ================================================== I am using version 2.2.2. All help is much appreciated.

2 1