- Freeradius-Users - lists.freeradius.org

FW: MSSQL using unixodbc and truncation of characters
by Franks Andy (RLZ) IT Systems Engineer 12 Jun '13

12 Jun '13

Sorry, FR version 2.2.1. Thanks andy _____________________________________________ From: Franks Andy (RLZ) IT Systems Engineer Sent: 12 June 2013 17:43 To: freeradius-users(a)lists.freeradius.org Subject: MSSQL using unixodbc and truncation of characters Hi all, I may again being doing something wrong but I've noticed an odd problem. I've connected up using the freetds libraries to an MSSQL server. iSQL works fine and I can do a query thus : Select NetworkCardID from Audit_NetworkCard where macaddress='00:14:22:53:de:58' +--------------+ | NetworkCardID| +--------------+ | 96375 | So, the query comes back with 96375, which is the correct query response. However the same query in FR, using the following unlang : update control { SQLNetworkCardID := "%{sql_test_mssql:Select NetworkCardID from Audit_NetworkCard where macaddress='%{control:DelimitedMac}'}" } Returns 9637 I'm using an external program "MacToDelimitedMac" to delimit the mac address, but it's coming back with the correct value so I don't think this is the problem : Output : [MacToDelimitedMac] expand: %{User-Name} -> 00142253de58 Exec output: DelimitedMac := "00:14:22:53:de:58" [MacToDelimitedMac] Exec output: DelimitedMac := "00:14:22:53:de:58" [MacToDelimitedMac] Exec: program returned: 0 ++[MacToDelimitedMac] returns ok ++? if (control:DelimitedMac) ? Evaluating (control:DelimitedMac) -> TRUE ++? if (control:DelimitedMac) -> TRUE ++- entering if (control:DelimitedMac) {...} sql_xlat expand: %{User-Name} -> 00142253de58 sql_set_user escaped user --> '00142253de58' expand: Select NetworkCardID from Audit_NetworkCard where macaddress='%{control:DelimitedMac}' -> Select NetworkCardID from Audit_NetworkCard where macaddress='00:14:22:53:de:58' rlm_sql (sql_test_mssql): Reserving sql socket id: 4 sql_xlat finished rlm_sql (sql_test_mssql): Released sql socket id: 4 expand: %{sql_test_mssql:Select NetworkCardID from Audit_NetworkCard where macaddress='%{control:DelimitedMac}'} -> 9637 +++[control] returns ok Anyone any ideas why it's returning a truncated value? I've tried a few SQL queries to return values and it's truncating any integer values (doesn't seem to happen where sql fields are not integer) over 4 digits. Any return value of less than digits returns properly! I guess it's me but I'm stumped. Thanks Andy

2 1

MSSQL using unixodbc and truncation of characters
by Franks Andy (RLZ) IT Systems Engineer 12 Jun '13

12 Jun '13

Hi all, I may again being doing something wrong but I've noticed an odd problem. I've connected up using the freetds libraries to an MSSQL server. iSQL works fine and I can do a query thus : Select NetworkCardID from Audit_NetworkCard where macaddress='00:14:22:53:de:58' +--------------+ | NetworkCardID| +--------------+ | 96375 | So, the query comes back with 96375, which is the correct query response. However the same query in FR, using the following unlang : update control { SQLNetworkCardID := "%{sql_test_mssql:Select NetworkCardID from Audit_NetworkCard where macaddress='%{control:DelimitedMac}'}" } Returns 9637 I'm using an external program "MacToDelimitedMac" to delimit the mac address, but it's coming back with the correct value so I don't think this is the problem : Output : [MacToDelimitedMac] expand: %{User-Name} -> 00142253de58 Exec output: DelimitedMac := "00:14:22:53:de:58" [MacToDelimitedMac] Exec output: DelimitedMac := "00:14:22:53:de:58" [MacToDelimitedMac] Exec: program returned: 0 ++[MacToDelimitedMac] returns ok ++? if (control:DelimitedMac) ? Evaluating (control:DelimitedMac) -> TRUE ++? if (control:DelimitedMac) -> TRUE ++- entering if (control:DelimitedMac) {...} sql_xlat expand: %{User-Name} -> 00142253de58 sql_set_user escaped user --> '00142253de58' expand: Select NetworkCardID from Audit_NetworkCard where macaddress='%{control:DelimitedMac}' -> Select NetworkCardID from Audit_NetworkCard where macaddress='00:14:22:53:de:58' rlm_sql (sql_test_mssql): Reserving sql socket id: 4 sql_xlat finished rlm_sql (sql_test_mssql): Released sql socket id: 4 expand: %{sql_test_mssql:Select NetworkCardID from Audit_NetworkCard where macaddress='%{control:DelimitedMac}'} -> 9637 +++[control] returns ok Anyone any ideas why it's returning a truncated value? I've tried a few SQL queries to return values and it's truncating any integer values (doesn't seem to happen where sql fields are not integer) over 4 digits. Any return value of less than digits returns properly! I guess it's me but I'm stumped. Thanks Andy

2 1

buffered-sql, radsqlrelay and fault resilience
by Yann Belin 12 Jun '13

12 Jun '13

Hi all, First a good day to you, since this is my first mail in this list. I am trying to build a multi-server setup, where each server uses a local user database (replicated from a central management server) and buffers its accounting data before pushing it back to the management server. I have tried two different methods, but none fully satisfied me so far. - First method uses "buffered-sql" and two sql modules: the first one points to local database and is used for auth, the other points to management server and is used by buffered-sql for accounting. This works very well except for one thing - by design, if the management sql server is unavailable for some reason, freeradius will refuse to launch. It should not be an issue in 99% of the cases but still bugs me a little bit. - Second method uses a cron'd "radsqlrelay" and "sql_log". It will accept to launch regardless of the status of management server, but in return it is much less smarter on the SQL part due to its inability get feedback from the sql server at the time the query is written (it basically cant fallback on an INSERT should an UPDATE fail due to non-existing record). On many aspects method #1 is better, but I would like to find a way to make the connection to management server optional at start-up, as I in my case accounting is secondary and should not be interfering with auth. Thanks in advance for your help, Yann

3 7

Freeradius dpkg-buildpackage: error: unknown type name 'lt_dladvise'
by Clement Ogedengbe 12 Jun '13

12 Jun '13

Can someone please help give solution to the problem arising from building Freeradius with dpkg-buildpackage -b -uc. The builder returned the error below modules.c: In function 'fr_dlopenext': modules.c:216:2: error: unknown type name 'lt_dladvise' modules.c:218:2: warning: implicit declaration of function 'lt_dladvise_init' [-Wimplicit-function-declaration] modules.c:218:2: warning: nested extern declaration of 'lt_dladvise_init' [-Wnested-externs] modules.c:219:6: warning: implicit declaration of function 'lt_dladvise_ext' [-Wimplicit-function-declaration] modules.c:219:6: warning: nested extern declaration of 'lt_dladvise_ext' [-Wnested-externs] modules.c:220:6: warning: implicit declaration of function 'lt_dladvise_global' [-Wimplicit-function-declaration] modules.c:220:6: warning: nested extern declaration of 'lt_dladvise_global' [-Wnested-externs] modules.c:221:3: warning: implicit declaration of function 'lt_dlopenadvise' [-Wimplicit-function-declaration] modules.c:221:3: warning: nested extern declaration of 'lt_dlopenadvise' [-Wnested-externs] modules.c:221:10: warning: assignment makes pointer from integer without a cast [enabled by default] modules.c:224:2: warning: implicit declaration of function 'lt_dladvise_destroy' [-Wimplicit-function-declaration] modules.c:224:2: warning: nested extern declaration of 'lt_dladvise_destroy' [-Wnested-externs] modules.c: In function 'setup_modules': modules.c:1412:3: warning: nested extern declaration of 'lt_preloaded_symbols' [-Wnested-externs] make[5]: *** [modules.lo] Error 1 make[5]: Leaving directory `/home/clement/freeradius-server-2.2.0/src/main' make[4]: *** [main] Error 2 make[4]: Leaving directory `/home/clement/freeradius-server-2.2.0/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/clement/freeradius-server-2.2.0/src' make[2]: *** [src] Error 2 make[2]: Leaving directory `/home/clement/freeradius-server-2.2.0' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/clement/freeradius-server-2.2.0' make: *** [build-arch-stamp] Error 2 dpkg-buildpackage: error: debian/rules build gave error exit status 2

2 1

IPv6 Pool
by William DELORAINE 12 Jun '13

12 Jun '13

Hello, I'm running FreeRadius 2.1.12 and I would like to know if it is able to manage IPv6 address pool? I would like my freeradius to provide IPv6 Prefix to the clients. If so, could you point me the way to do it? I checked ip_pool and sql_ippool with no luck. Best regards, William

2 1

Freeradius dpkg-buildpackage: error: unknown type name 'lt_dladvise'
by Clement Ogedengbe 12 Jun '13

12 Jun '13

Can someone please help give solution to the problem arising from building Freeradius with dpkg-buildpackage -b -uc. The builder returned the error below modules.c: In function 'fr_dlopenext': modules.c:216:2: error: unknown type name 'lt_dladvise' modules.c:218:2: warning: implicit declaration of function 'lt_dladvise_init' [-Wimplicit-function-declaration] modules.c:218:2: warning: nested extern declaration of 'lt_dladvise_init' [-Wnested-externs] modules.c:219:6: warning: implicit declaration of function 'lt_dladvise_ext' [-Wimplicit-function-declaration] modules.c:219:6: warning: nested extern declaration of 'lt_dladvise_ext' [-Wnested-externs] modules.c:220:6: warning: implicit declaration of function 'lt_dladvise_global' [-Wimplicit-function-declaration] modules.c:220:6: warning: nested extern declaration of 'lt_dladvise_global' [-Wnested-externs] modules.c:221:3: warning: implicit declaration of function 'lt_dlopenadvise' [-Wimplicit-function-declaration] modules.c:221:3: warning: nested extern declaration of 'lt_dlopenadvise' [-Wnested-externs] modules.c:221:10: warning: assignment makes pointer from integer without a cast [enabled by default] modules.c:224:2: warning: implicit declaration of function 'lt_dladvise_destroy' [-Wimplicit-function-declaration] modules.c:224:2: warning: nested extern declaration of 'lt_dladvise_destroy' [-Wnested-externs] modules.c: In function 'setup_modules': modules.c:1412:3: warning: nested extern declaration of 'lt_preloaded_symbols' [-Wnested-externs] make[5]: *** [modules.lo] Error 1 make[5]: Leaving directory `/home/clement/freeradius-server-2.2.0/src/main' make[4]: *** [main] Error 2 make[4]: Leaving directory `/home/clement/freeradius-server-2.2.0/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/clement/freeradius-server-2.2.0/src' make[2]: *** [src] Error 2 make[2]: Leaving directory `/home/clement/freeradius-server-2.2.0' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/clement/freeradius-server-2.2.0' make: *** [build-arch-stamp] Error 2 dpkg-buildpackage: error: debian/rules build gave error exit status 2

1 0

Retrieving eDirectory VLAN attributes
by Dan Lietz 11 Jun '13

11 Jun '13

Hello, I'm pretty much a noob when it comes to freeradius as I still don't completely understand what files are used for authorization and authentication and where to put different certain pieces of configuration. I'm trying to set up dynamic vlans for a wireless network with a Ruckus Zone Director backend and a freeradius backend authenticating via LDAP to eDirectory running on the same box. So far I've managed to configure 802.11x authentication using PEAP and that is working well. Now I want to be able to retrieve the radius attribute in eDirectory for the vlan tag so the Ruckus Zone Directory will automatically place the user on the correct vlan once they are authenticated. I did some initial testing without using LDAP by adding the following lines to my users file: DEFAULT Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 85, Fall-Through=Yes By changing the value of "Tunnel-Private-Group-ID" (set to 85 in the above example) the Zone Director will move users to the vlan ID I specify here, but it is obviously static and does not change based on the user. The next step is to configure FreeRadius to pull the info from eDir via LDAP and that's the part I'm not getting. Part of my problem is that I don't know which attributes mappings are built in and which aren't. According to this document: Integrating Novell eDirectory with FreeRadius<https://www.netiq.com/documentation/edir_radius/radiusadmin/?page=/document…> the listed radius attributes are available for use, but does that mean I don't need to add them to ldap.attr or the dictionary file at all? Or that I don't need to add an LDAP attribute map to the LDAP Group object in iManager? The other thing I don't understand is where (i.e. what file) to put the ldap call for said attributes and what the syntax would look like. I've configured my eap.conf to include 'copy_request_to_tunnel = yes' and 'use_tunneled_reply = yes' Any help is greatly appreciated and if I'm asking Thanks. Dan

2 2

Re: Free Radius SNMP support
by manjunath uthappa ponnachana 11 Jun '13

11 Jun '13

Hi, Can i know the reason why SNMP support was broken in Free Radius version 2 and later. Thanks & Regards ManjunathFrom: Alan DeKok <aland(a)deployingradius.com>Sent: Sat, 01 Jun 2013 04:13:03 To: pu_manjunath(a)rediffmail.com, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>Subject: Re: Free Radius SNMP supportmanjunath uthappa ponnachana wrote:> As per freeradius website freeradius.org> Native SNMP support in FreeRADIUS version 2 and later is broken. Version 2 does support SNMP via a Perl script.  It's not perfect, butit works.> I wanted to know whether in newer/latest versions of free radius SNMP> support will be there. If someone supplies a patch, sure.> Also wanted to know whether using free Radius> traps can be send to NMS. If possible what are the options available. See raddb/trigger.conf in the git "master" branch. Alan DeKok.

1 0

MAC authentication succeeds, port stays unauthorized (allied telesis)
by Stijn D'haese 11 Jun '13

11 Jun '13

Hi, I'm trying to do MAC based authentication on our switches, but for some strange reason the port doesn't want to authenticate, even though the radius server sends an Access-Accept package to the port. I did a capture on the port and the Access-Accept package is received by the port, but it port status stays unauthorized. I'm running FreeRADIUS Version 2.2.0 and the switch is an Allied Telesis AT-9000/28 Any ideas where I need to start looking? Regards Stijn

3 3

Q: Define realms per virtual server.
by David Mitchell 10 Jun '13

10 Jun '13

Greetings, I'm hitting a situation where I would like to be able to define different realms in my virtual servers. Simply including realm definitions inside of the virtual servers doesn't work. It doesn't generate an error either, but the defined realm doesn't work. server internal { realm DEFAULT { authhost = remote1.com accthost = remote1.com nostrip } listen { ipaddr = * port = 1814 type = auth } listen { ipaddr = * port = 1815 type = acct } . . . } The 'realm' keyword is overloaded, being used both for the definitions of the delimiters and of the realms themselves. And while the former is loaded via a module syntax and can be loaded per-virtual-server (via suffix, ipass, etc.) I can't find any way to restrict the actual realm definitions to a virtual server. They are all global configuration loaded via proxy.conf. Is there some method I'm missing for making the realm definitions per-server? Thanks in advance, -David Mitchell ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 2