- Freeradius-Users - lists.freeradius.org

RE: Volume limit/data limit with Mikrotik NAS on FreeRADIUS
by Angel Elena 05 Oct '12

05 Oct '12

the volume limit, across / nat the mikrotik ? -----Mensaje original----- De: Antonio Fernández Pérez <antoniofernandez(a)fabergames.com> Enviado: Vie 05-10-2012 13:44 Asunto: Volume limit/data limit with Mikrotik NAS on FreeRADIUS Para: freeradius-users(a)lists.freeradius.org; > Hi everybody, > > I'm interested in configuring data limit/volume limit with RADIUS users using > Mikrotik NAS. I have read that maybe configuring some attributes like > Mikrotik-Rate-Limit is possible, but I could not to get it after done some > tests. I have gotten to configure data limit by session with > Mikrotik-Xmit-Limit and Mikrotik-Recv-Limit. Anybody can help me? Anybody has > the same problem? > > Thank you very much. > > Best regards, > > Antonio. > > -- > > Antonio Manuel Fernández Pérez > > Ingeniero Técnico en Informática > Dpto. Programación y Sistemas Fabergames S.L. > TLF:966261111 / FAX:966551801 > www.fabergames.com <http://www.fabergames.com/> > > > <http://www.facebook.com/fabergames> > > * * * ADVERTENCIA LEGAL * * * > > Le informamos, como destinatario de este mensaje, que el correo electrónico y > las comunicaciones por medio de Internet no permiten asegurar ni garantizar la > confidencialidad de los mensajes transmitidos, así como tampoco su integridad o > su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad > alguna por tales circunstancias. Si no consintiese en la utilización del correo > electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y > ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de > manera exclusiva, a su destinatario y contiene información confidencial y > sujeta al secreto profesional, cuya divulgación no está permitida por la ley. > En caso de haber recibido este mensaje por error, le rogamos que, de forma > inmediata, nos lo comunique mediante correo electrónico remitido a nuestra > atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su > eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, > le comunicamos que la distribución, copia o utilización de este mensaje, o de > cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están > prohibidas por la ley. > > > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Volume limit/data limit with Mikrotik NAS on FreeRADIUS
by Antonio Fernández Pérez 05 Oct '12

05 Oct '12

Hi everybody, I'm interested in configuring data limit/volume limit with RADIUS users using Mikrotik NAS. I have read that maybe configuring some attributes like Mikrotik-Rate-Limit is possible, but I could not to get it after done some tests. I have gotten to configure data limit by session with Mikrotik-Xmit-Limit and Mikrotik-Recv-Limit. Anybody can help me? Anybody has the same problem? Thank you very much. Best regards, Antonio. -- *Antonio Manuel Fernández Pérez* *Ingeniero Técnico en Informática *Dpto. Programación y Sistemas Fabergames S.L. TLF:966261111 / FAX:966551801 www.fabergames.com [image: Imágenes integradas 1] [image: Imágenes integradas 3]<http://www.facebook.com/fabergames> [image: Imágenes integradas 4] <https://twitter.com/#!/Fabergames> [image: Imágenes integradas 5] * * * ADVERTENCIA LEGAL * * * Le informamos, como destinatario de este mensaje, que el correo electrónico y las comunicaciones por medio de Internet no permiten asegurar ni garantizar la confidencialidad de los mensajes transmitidos, así como tampoco su integridad o su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad alguna por tales circunstancias. Si no consintiese en la utilización del correo electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de manera exclusiva, a su destinatario y contiene información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por la ley. En caso de haber recibido este mensaje por error, le rogamos que, de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley.

1 0

getting rejected, please give me some light.
by Eliezer Croitoru 05 Oct '12

05 Oct '12

I am new with freeradius and I probably didnt understood something yet about how to configure everything: I can authenticate using command line but and on radius wifi but not on NAS\LNS that I' m getting rejected. the logs with couple comments on it: rad_recv: Access-Request packet from host 192.168.10.159 port 54933, id=211, length=43 User-Name = "bob" User-Password = "Hello" # Executing section authorize from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry bob at line 204 ++[files] returns ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' ############### what is that means? what it refers to? i dont have the word loca at all in my files else then the defaults WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. # Executing section post-auth from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 211 to 192.168.10.159 port 54933 Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 10 ID 211 with timestamp +2391 ##this is the rejected request Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.131 port 19606, id=134, length=152 NAS-Identifier = "NAS" NAS-IP-Address = 192.168.10.131 Acct-Session-Id = "9358763-re0-3" NAS-Port = 3 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "00270e08e1c0" NAS-Port-Id = "re0" Vendor-12341-Attr-12 = 0x7265302d33 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:27:0e:08:e1:c0" User-Name = "bob" User-Password = "Hello" # Executing section authorize from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user #it's the basic as before so why the software saying that?what is the difference between the logins (a lot) that makes it's not work with users file? Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Thanks, Eliezer

3 5

bugs.freeradius.org unavailable?
by endo mitsuharu 05 Oct '12

05 Oct '12

Hello, First of all, I would like to express my utmost appreciation for being able to use FreeRADIUS, most especially to everyone involved in the development. In this regard, I tried accessing the "Report a Bug" link (http://bugs.freeradius.org/) posted in FreeRADIUS official web site. However, there seems to be a problem reaching the "Report a Bug" link. I've tried from two different local ISPs without any luck. I would like to refer to the existing bug report, so I would like to ask if bugs.freeradius.org is dead or if the URL has been changed. (or is it just me.) Any information regarding the access problem would greatly help. Please also inform me if this inquiry has been directed to the incorrect recipients and as to where this inquiry be posted. Thank you and hoping for your feedback. --- Thanks, Endo

4 15

rebuilding a FR server
by Andrew Precht 04 Oct '12

04 Oct '12

Hi users, I'm attempting to setup a new virtual FR server on centos6, to replace an aging FR 1.13-1.6.el5 server. I have got the new server setup per the docs at freeradius.org. I've run the simple test using radtest locally and I get an Access-Accept. Also, using NTradPing remotely I get an Access-Accept. So, I think I've got the basic freeradius and firewall setup correctly. Now the hard part... I have no documentation or knowledge base for the old FR setup. It is used to authenticate WiFi users against a proprietary system using a Sybase DB. From what I can tell, it's using a perl script to talk to the db. I say this because of two lines in the radiusd.conf. One is: Auth-Type Perl { perl } and the other is: perl { module = /etc/raddb/sjsu.pl } My question is: Is it as easy as adding the same two lines to my new FR 2.1.12 radiusd.conf and copying over the sjsu.pl to get it to use the perl script? Please advise, thanks for any help...

2 1

Multi-valued attributes
by Lorenzo Milesi 04 Oct '12

04 Oct '12

Hi. Is it possible to use Multi-valued attributes? I have group1 NAS-Identifier =~ nas01|nas02 group2 NAS-Identifier =~ nas03|nas04 I'd like some users which are in group1 to access ALSO group2 nases. Is it possible to do that, without creating a dedicated group? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 1

Dialup Admin and PPPoE
by Serge Paquin 04 Oct '12

04 Oct '12

Hello, I've setup FreeRadius and Dialup Admin to manage it. One item I haven't been able to figure out is how to have the Upload and Download statistics updated on a regular basis. With PPPoE my users stay always on. Looking at the code it seems that transfer statistics are only updated if there is a complete session with a log off. Ideally I'd like something we could run every day or 12 hours or something that would update the transfer statistics even if the user is still online. I've done a lot of searching and read all the documents so if I've missed something I apologize. If somebody has some insight and can point me in the right direction it would be much appreciated. Thanks, Serge.

4 5

sqlcounter instance not found in modules section
by Russell Stockhammer 04 Oct '12

04 Oct '12

Hey Everyone, I'm trying to create a new sqlcounter instance that counts octets. I think what I've done is correct but I get the following error when I start FreeRadius... -------- Mon Oct 1 21:09:41 2012 : Error: /usr/local/etc/raddb/sites-enabled/default[203]: Failed to find "dailyoctetcounter" in the "modules" section. Mon Oct 1 21:09:41 2012 : Error: /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. Mon Oct 1 21:09:41 2012 : Error: Failed to load virtual server <default> -------- This error also occurs when I change the name of "dailycounter" to be "dailytimecounter". My relivant config is as follows... ---- radius.conf ---- instantiate { dailycounter dailyoctetcounter } --------- ---- sql/mysql/counter.conf ---- sqlcounter dailyoctetcounter { counter-name = Daily-Session-Octet check-name = Max-Daily-Session-Octet reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctinputoctets + acctoutputoctets) \ FROM radacct WHERE username = '%{%k}' \ AND UNIX_TIMESTAMP(acctstarttime) > '%b'" } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } -------- ---- sites-enabled/default ---- authorize { dailycounter { reject = 1 } if (reject) { update reply { Reply-Message := "Your daily time limit is up!" } ok = reject } dailyoctetcounter { reject = 1 } if (reject) { update reply { Reply-Message := "Your daily transfer limit is up!" } ok = reject } } -------- Is there a set of keywords that are only valid for sqlcounters? Or like I think anything that isn't already another instance should be vaild. Please tell me where I'm going wrong with my config. Thanks Russ

3 7

*** glibc detected *** /usr/local/sbin/radiusd: malloc(): memory corruption: 0x000000000e253360 ***
by Armando Oliveira 03 Oct '12

03 Oct '12

Hello Got this on 2.1.5. The server was ok until now (it's running without problems within the last 2 years), and now it crashes several time per day. Any help ?

2 2

simple accounting proxy setup.
by Bill Schoolfield 02 Oct '12

02 Oct '12

Looking for help in setting up simple (single) accounting relay (forward). Its been awhile since I last used freeradius and I'm use to the old radrelay program. I see that has been replaced with internal based methods. I've read what documents and comments I could find, but haven't been able to see the entire picture. I've set things up but so far no luck at getting the accounting packets forwarded. In keeping with recommended practice, I have modified very little. I edited the proxy.conf file and enabled the copy-acct-to-home-server server. What else do I need to do? Could someone provide a working example configuration? I'm a little shaky on the realm processing. Perhaps that's the issue. The sever log appears to show just a normal (local) receipt of the accounting record: Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 44057, id=153, length=102 Acct-Session-Id = "6000006B" User-Name = "Fnord" NAS-IP-Address = 192.168.3.5 NAS-Port-Id = "32" NAS-Port-Type = Async Acct-Status-Type = Start Connect-Info = "46000 LAPM/V42BIS" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.5.66 Acct-Delay-Time = 0 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',Client-IP-Address = 127.0.0.1,NAS-IP-Address = 192.168.3.5,Acct-Session-Id = "6000006B",User-Name = "Fnord"' [acct_unique] Acct-Unique-Session-ID = "cce9407c7efa55eb". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "Fnord", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/detail-20121001 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/detail-20121001 [detail] expand: %t -> Mon Oct 1 20:00:15 2012 ++[detail] returns ok ++[unix] returns noop [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> Fnord rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[radutmp] returns noop [sql] expand: %{User-Name} -> Fnord [sql] sql_set_user escaped user --> 'Fnord' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, na sportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, conn ectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedp rotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acc t-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', N ULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> Fnord attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 153 to 127.0.0.1 port 44057 Finished request 0. Cleaning up request 0 ID 153 with timestamp +178 Going to the next request Ready to process requests. TIA, Bill

3 7