Hi, I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool. Can someone explain me how can I do this? i've set up a pool called 'main_pool' in my database: select * from radippool; +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationID | expiry_time | username | pool_key | +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | 1 | main_pool | 172.16.254.1 | | | | 0000-00-00 00:00:00 | | | +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ 1 row in set (0.01 sec) and I have this user: select * from radcheck; +----+----------+---------------+----+-------+-------+ | id | UserName | Attribute | op | Value | ativo | +----+----------+---------------+----+-------+-------+ | 1 | modesto | User-Password | == | 12345 | S | +----+----------+---------------+----+-------+-------+ 1 row in set (0.00 sec) I've already tried to associate the Pool-Name attribute with this user, but it didn't work. Can someone explain me how this stuff works or send me a more detailed documentation? Thanks in advance. Regards.
Antonio Modesto wrote:
I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool.
Set: update control { Pool-Name := "main_pool" } That sets the pool to use.
and I have this user:
select * from radcheck; +----+----------+---------------+----+-------+-------+ | id | UserName | Attribute | op | Value | ativo | +----+----------+---------------+----+-------+-------+ | 1 | modesto | User-Password | == | 12345 | S | +----+----------+---------------+----+-------+-------+
That's wrong. Use "Cleartext-Password :=" instead of "User-Password =="
I've already tried to associate the Pool-Name attribute with this user, but it didn't work.
See the FAQ for "it doesn't work". Alan DeKok.
On Tue, 2012-01-31 at 21:00 +0100, Alan DeKok wrote:
Antonio Modesto wrote:
I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool.
Set:
update control { Pool-Name := "main_pool" }
Ok, I will try it.
That sets the pool to use.
and I have this user:
select * from radcheck; +----+----------+---------------+----+-------+-------+ | id | UserName | Attribute | op | Value | ativo | +----+----------+---------------+----+-------+-------+ | 1 | modesto | User-Password | == | 12345 | S | +----+----------+---------------+----+-------+-------+
That's wrong. Use "Cleartext-Password :=" instead of "User-Password =="
The problem is that my production server is running Freeradius 1.8, and it uses the Attribute User-Password, but the module rlm_sqlippool is not working in this version of freeradius. Then if I decide to use sqlippool, will I need to upgrade to freeradius 2.x and change this Attribute in all my MySQL database? Thanks.
I've already tried to associate the Pool-Name attribute with this user, but it didn't work.
See the FAQ for "it doesn't work".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, 2012-02-01 at 09:19 -0200, Antonio Modesto wrote:
On Tue, 2012-01-31 at 21:00 +0100, Alan DeKok wrote:
Antonio Modesto wrote:
I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool.
Set:
update control { Pool-Name := "main_pool" }
Ok, I will try it.
Sorry for the ignorance, but where must I put this section? Can I just put it anywhere in radiusd.conf or it must be inside another section?
That sets the pool to use.
and I have this user:
select * from radcheck; +----+----------+---------------+----+-------+-------+ | id | UserName | Attribute | op | Value | ativo | +----+----------+---------------+----+-------+-------+ | 1 | modesto | User-Password | == | 12345 | S | +----+----------+---------------+----+-------+-------+
That's wrong. Use "Cleartext-Password :=" instead of "User-Password =="
The problem is that my production server is running Freeradius 1.8, and it uses the Attribute User-Password, but the module rlm_sqlippool is not working in this version of freeradius. Then if I decide to use sqlippool, will I need to upgrade to freeradius 2.x and change this Attribute in all my MySQL database?
Thanks.
I've already tried to associate the Pool-Name attribute with this user, but it didn't work.
See the FAQ for "it doesn't work".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2012/2/1 Antonio Modesto <modesto@isimples.com.br>:
On Wed, 2012-02-01 at 09:19 -0200, Antonio Modesto wrote:
On Tue, 2012-01-31 at 21:00 +0100, Alan DeKok wrote:
Antonio Modesto wrote:
I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool.
Set:
update control { Pool-Name := "main_pool" }
Ok, I will try it.
Sorry for the ignorance, but where must I put this section? Can I just put it anywhere in radiusd.conf or it must be inside another section?
It depends. Basically Pool-Name is a control item, similar to Cleartext-Password. Where do you put cleartext-password for your user? That's also the place where you put pool-name, if you want per-user pool setting. Another way is to set pool-name unconditionally for all user with unlang. In this case the place to do it is authorize section. But then again the example Alan wrote is using unlang, and AFAIK it's not available in FR 1.x. You need to upgrade. There might (as in I haven't tested it) also the possiblity of using users file to set default check items. Something like this on top uf users file: DEFAULT Pool-Name := "main_pool" Fall-Through = Yes -- Fajar
On Wed, 2012-02-01 at 19:53 +0700, Fajar A. Nugraha wrote:
2012/2/1 Antonio Modesto <modesto@isimples.com.br>:
On Wed, 2012-02-01 at 09:19 -0200, Antonio Modesto wrote:
On Tue, 2012-01-31 at 21:00 +0100, Alan DeKok wrote:
Antonio Modesto wrote:
I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool.
Set:
update control { Pool-Name := "main_pool" }
Ok, I will try it.
Sorry for the ignorance, but where must I put this section? Can I just put it anywhere in radiusd.conf or it must be inside another section?
It depends.
Basically Pool-Name is a control item, similar to Cleartext-Password. Where do you put cleartext-password for your user? That's also the place where you put pool-name, if you want per-user pool setting.
Another way is to set pool-name unconditionally for all user with unlang. In this case the place to do it is authorize section. But then again the example Alan wrote is using unlang, and AFAIK it's not available in FR 1.x. You need to upgrade.
There might (as in I haven't tested it) also the possiblity of using users file to set default check items. Something like this on top uf users file:
DEFAULT Pool-Name := "main_pool" Fall-Through = Yes
I use MySQL to store the users information, my database is still with the "User-Password" attribute instead of "Cleartext-Password", it is in the radcheck table. But I don't want to use per-user pools, if it is possible, the better solution for me would be setting the pool based on some information of the NAS, because my routing topology doesn't permit a single pool for all cities that we attend. I am sorry for my lack of knowledge about freeradius, but I didn't find some place where explain how freeradius configuration files works together, and what it's the order of the authentication process. I know that it's because it's a very flexible tool.
2012/2/1 Antonio Modesto <modesto@isimples.com.br>:
But I don't want to use per-user pools, if it is possible, the better solution for me would be setting the pool based on some information of the NAS, because my routing topology doesn't permit a single pool for all cities that we attend.
It depends. If your NAS sends some attribute that you can use (e.g NAS-IP-Address), AND the number of possible values for that attribute is small, AND you use FR2, you can just use unlang in authorize or post-auth section to set pool-name. Manpage of unlang: http://freeradius.org/radiusd/man/unlang.html Look at "if" and "update" keyword. Alan already wrote the "update" example. Another possibility is to store the NAS-IP-Address (or whatever attribute you use) <-> Pool-Name mapping in your own sql table, and using unlang you can do something like update control { Pool-Name := "%{sql: SELECT pool_name FROM nas_pool_name WHERE nas_ip_address='%{NAS-IP-Address}'" } ... where nas_pool_name is your own custom table. -- Fajar
On Wed, 2012-02-01 at 20:59 +0700, Fajar A. Nugraha wrote:
2012/2/1 Antonio Modesto <modesto@isimples.com.br>:
But I don't want to use per-user pools, if it is possible, the better solution for me would be setting the pool based on some information of the NAS, because my routing topology doesn't permit a single pool for all cities that we attend.
It depends.
If your NAS sends some attribute that you can use (e.g NAS-IP-Address), AND the number of possible values for that attribute is small, AND you use FR2, you can just use unlang in authorize or post-auth section to set pool-name. Manpage of unlang: http://freeradius.org/radiusd/man/unlang.html Look at "if" and "update" keyword. Alan already wrote the "update" example.
Another possibility is to store the NAS-IP-Address (or whatever attribute you use) <-> Pool-Name mapping in your own sql table, and using unlang you can do something like
update control { Pool-Name := "%{sql: SELECT pool_name FROM nas_pool_name WHERE nas_ip_address='%{NAS-IP-Address}'"
Yes, good idea, I can create a custom table for that. I just need to understand how this stuff (authorize, post-auth) works, I'm a little lost with these things. So far I didn't get setting the pool_name to a custom name, I am testing with the default "sqlippool". My production radius server is running freeradius 1.1.8, I installed freeradius 2 in another server with another SQL database and copied the configuration files from the production server to the test server and changed some stuff to get it running, then I am doing these tests in this server. I don't know if Freeradius 2.x are compatible with freeradius 1.1.8 configuration files. Thanks and sorry for the amount of questions. Regards.
}
... where nas_pool_name is your own custom table.
Antonio Modesto wrote:
My production radius server is running freeradius 1.1.8, I installed freeradius 2 in another server with another SQL database and copied the configuration files from the production server to the test server and changed some stuff to get it running, then I am doing these tests in this server. I don't know if Freeradius 2.x are compatible with freeradius 1.1.8 configuration files.
It's mostly compatible. There are a few changes, but nothing major.
Thanks and sorry for the amount of questions.
It's OK to ask good questions. Alan DeKok.
2012/2/2 Antonio Modesto <modesto@isimples.com.br>:
My production radius server is running freeradius 1.1.8, I installed freeradius 2 in another server with another SQL database and copied the configuration files from the production server to the test server and changed some stuff to get it running, then I am doing these tests in this server. I don't know if Freeradius 2.x are compatible with freeradius 1.1.8 configuration files.
An advice from someone who has done similar migration: don't copy the config files :) While Alan said it's mostly compatible, FR2 restructured some files to make it more logical and easy to understand. My advice is to look at your old config files, and: - note what changes you made from the original (copying an original config directory from a fresh installation and do "diff -Naru" can help) - list what functionalities you need After that, implement the changes/functionality in the new config. The benefit is that the config is cleaner, plus you know exactly what changes you made, so there will be no "unknown magic" in your new setup. -- Fajar
On Thu, 2012-02-02 at 08:26 +0700, Fajar A. Nugraha wrote:
2012/2/2 Antonio Modesto <modesto@isimples.com.br>:
My production radius server is running freeradius 1.1.8, I installed freeradius 2 in another server with another SQL database and copied the configuration files from the production server to the test server and changed some stuff to get it running, then I am doing these tests in this server. I don't know if Freeradius 2.x are compatible with freeradius 1.1.8 configuration files.
An advice from someone who has done similar migration: don't copy the config files :)
While Alan said it's mostly compatible, FR2 restructured some files to make it more logical and easy to understand. My advice is to look at your old config files, and: - note what changes you made from the original (copying an original config directory from a fresh installation and do "diff -Naru" can help) - list what functionalities you need
After that, implement the changes/functionality in the new config. The benefit is that the config is cleaner, plus you know exactly what changes you made, so there will be no "unknown magic" in your new setup.
I think that now I got to set Freeradius 2.x working with a equivalent configuration of my Freeradius 1.1.8, I configured the update control in the authorize section to seek the pool_name in a MySQL table based on NAS-IP-Address (As Fajar told me) : update control { Pool-Name := "%{sql: SELECT nas_pool_name FROM naspool WHERE nas_ip=INET_ATON('%{NAS-IP-Address}')}" } I will continue my tests, but I would like your opinion about sqlippool with MySQL Database, our average of active users is about 1000 active users or more. Thanks a lot. Regards.
On Wed, 2012-02-01 at 14:24 +0100, Alan DeKok wrote:
Antonio Modesto wrote:
Sorry for the ignorance, but where must I put this section? Can I just put it anywhere in radiusd.conf or it must be inside another section?
You don't. I had assumed you were running version 2.
Not in my production server, the server I'm using to test is running version 2.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Antonio Modesto wrote:
That's wrong. Use "Cleartext-Password :=" instead of "User-Password =="
The problem is that my production server is running Freeradius 1.8, and it uses the Attribute User-Password
No. The change to Cleartext-Password was done in 1.1.4. The 1.1.8 version was released long after that.w
, but the module rlm_sqlippool is not working in this version of freeradius. Then if I decide to use sqlippool, will I need to upgrade to freeradius 2.x and change this Attribute in all my MySQL database?
It's better if you upgrade, *and* if you change the attribute. Alan DeKok.
On Wed, 2012-02-01 at 13:31 +0100, Alan DeKok wrote:
Antonio Modesto wrote:
That's wrong. Use "Cleartext-Password :=" instead of "User-Password =="
The problem is that my production server is running Freeradius 1.8, and it uses the Attribute User-Password
No. The change to Cleartext-Password was done in 1.1.4. The 1.1.8 version was released long after that.w
, but the module rlm_sqlippool is not working in this version of freeradius. Then if I decide to use sqlippool, will I need to upgrade to freeradius 2.x and change this Attribute in all my MySQL database?
It's better if you upgrade, *and* if you change the attribute.
I find that the pool_name is not set, it's trying to find "sqlippool", I changed the name of my pool to this name and it worked. Maybe I am putting the update control in the wrong place, I've put it in the post-auth section. [sqlippool] expand: SELECT FramedIPAddress FROM radippool WHERE pool_name = 'sqlippool' AND expiry_time < NOW() ORDER BY RAND() LIMIT 1 FOR UPDATE -> SELECT FramedIPAddress FROM radippool WHERE pool_name = 'sqlippool' AND expiry_time < NOW() ORDER BY RAND() LIMIT 1 FOR UPDATE
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Antonio Modesto -
Fajar A. Nugraha