building 1.4 (CentOS 4.4) MYSQL
I have the server running and can now authenticate remotely and records are correctly added to radacct. Part of our setup requires the rlm_sqlcounter module. I inserted the $INCLUDE line and the output tells me it is loading. However, I read in rlm_sqlcounter doc that you must ./configure --with-experimental-modules. I did not do this. Is it necessary to re-compile? (I DO see our daypasscounter queries loading, with the session-timout we need, being run in the debug). I think (off the top of my head) it is no longer necessary to compile with experimental modules in order to use rlm_sqlcounter... Will I be able to test it via ntradping assuming I create entries for a test group in usergroup/radgroupreply (I need to see the full reply with all sent strings). BTW- I am a bit fuzzy on rlm_sql_log. As I am getting accounting without it, can someone briefly elaborate on it's function. IE, if accounting works in sql without it, what other function does it provide? (Yes, I read the doc and am still fuzzy). Andrew
Andrew Long wrote:
I have the server running and can now authenticate remotely and records are correctly added to radacct. Part of our setup requires the rlm_sqlcounter module. I inserted the $INCLUDE line and the output tells me it is loading. However, I read in rlm_sqlcounter doc that you must ./configure --with-experimental-modules. I did not do this. Is it necessary to re-compile? (I DO see our daypasscounter queries loading, with the session-timout we need, being run in the debug).
If it works, it works.
Will I be able to test it via ntradping assuming I create entries for a test group in usergroup/radgroupreply (I need to see the full reply with all sent strings).
If ntradping sends access-request and accounting-request packets.
BTW- I am a bit fuzzy on rlm_sql_log. As I am getting accounting without it, can someone briefly elaborate on it's function. IE, if accounting works in sql without it, what other function does it provide? (Yes, I read the doc and am still fuzzy).
It decouples the RADIUS server from your SQL server. Think of your car. If the axle was welded to the frame, you would feel it as you drove over every pebble. The shocks decouple the axle from the rest of the car, so you can drive over potholes at speed, and only feel small bumps. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
It decouples the RADIUS server from your SQL server. Think of your car. If the axle was welded to the frame, you would feel it as you drove over every pebble. The shocks decouple the axle from the rest of the car, so you can drive over potholes at speed, and only feel small bumps.
Nice... Now I must read a Chilton's guide to understand the analogy! Seriously... on to the tables... The schema has changed since 0.9.3. Where radgroupreply contained a "prio" (priority) field (int(10)) default '0', 1.4 now moves it to usergroup "priority" (int(11)) with default '1'. We used all defaults and am wondering if I'm overlooking any details (from the Colubris' point of view) in migrating to the new schema. And... There are a couple cases where I want to assign a user to 2 groups, picking up reply items from each. Should I leave the default priorities or cascade them (1,2), using op := (I think). Andrew
two hours ago I was able to ntradping and receive an accept. Now, I am rejected. All I did was load the sql tables with data. (Before, my only record was the one you see returned below). Shouldn't this still authorize? Is this due to (2nd to last line) "no authenticate method"? rlm_sql (sql): sql_set_user escaped user --> 'along' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'along' ORDER BY id' mysql> +----+----------+-----------+------------+----+ -> | id | username | attribute | value | op | -> +----+----------+-----------+------------+----+ -> | 1 | along | password | testing123 | == | -> +----+----------+-----------+------------+----+ -> 1 row in set (0.00 sec) -> ; rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'along' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' --> empty set (0.00 sec) radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'along' ORDER BY id' --> empty set (0.00 sec) radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'along' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' --> empty set (0.00 sec) rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [along] modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "daypasscounter" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user.
Andrew Long wrote:
two hours ago I was able to ntradping and receive an accept. Now, I am rejected. All I did was load the sql tables with data. (Before, my only record was the one you see returned below). Shouldn't this still authorize? Is this due to (2nd to last line) "no authenticate method"?
rlm_sql (sql): sql_set_user escaped user --> 'along' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'along' ORDER BY id'
mysql> +----+----------+-----------+------------+----+ -> | id | username | attribute | value | op | -> +----+----------+-----------+------------+----+ -> | 1 | along | password | testing123 | == | -> +----+----------+-----------+------------+----+ -> 1 row in set (0.00 sec)
op should be ":=" for User-Password. This should be in the FAQ, and if I can be bothered to register for the Wiki I'll put it in.
Thanks to help from many folks here, tonight I got one property up and running on our new server. THANK YOU! Now, another question. When I start radius with > radiusd or /usr/local/sbin/radiusd, I get a brief message "reading configuration file..."; then, doing >ps aux | grep radiusd returns nothing but my grep. If I start radius with >radiusd -X all runs smoothly. Clearly, I need to be able to start it in normal mode and be able to verify its process; what am I doing wrong here? Version 1.4. - ANdrew
Probably a file or directory has the wrong permissions. When you run in debug with -X the server runs as root. When you run for real it changes to user radiusd or whatever you set up. Try strace -e open,stat -f radiusd and look for EPERM lines. Frank
-----Original Message----- From: freeradius-users-bounces+frank.ranner=defence.gov.au@lists.fre eradius.org [mailto:freeradius-users-> bounces+frank.ranner=defence.gov.au@lists.freeradius.org] On Behalf Of Andrew Long Sent: Wednesday, 17 January 2007 10:51 To: FreeRadius users mailing list Subject: building 1.4 (CentOS 4.4) MYSQL 99% home
Thanks to help from many folks here, tonight I got one property up and running on our new server. THANK YOU!
Now, another question. When I start radius with > radiusd or /usr/local/sbin/radiusd, I get a brief message "reading configuration file..."; then, doing >ps aux | grep radiusd returns nothing but my grep. If I start radius with >radiusd -X all runs smoothly. Clearly, I need to be able to start it in normal mode and be able to verify its process; what am I doing wrong here? Version 1.4.
- ANdrew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Thanks to help from many folks here, tonight I got one property up and running on our new server. THANK YOU!
Now, another question. When I start radius with > radiusd or /usr/local/sbin/radiusd, I get a brief message "reading configuration file..."; then, doing >ps aux | grep radiusd returns nothing but my grep. If I start radius with >radiusd -X all runs smoothly. Clearly, I need to be able to start it in normal mode and be able to verify its process; what am I doing wrong here? Version 1.4.
read /var/log/radiusd/radiusd.log or wherever the log files go. possibly file permissions - do you run as radiusd user? can the files be read by radiusd? alan
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Andrew Long -
Phil Mayers -
Ranner, Frank MR