Nabble - Gnu - Radius

RE: Re: Forcing GNU-Radius to change authentication type

2009-09-17T04:09:36Z

Thanks, Sergey.

Regards,
____________________________________________________________________________
_____
Paul

-----Message d'origine-----
De : Sergey Poznyakoff [mailto:gray@...]
Envoyé : jeudi 17 septembre 2009 10:04
À : Paul Cole
Cc : help-gnu-radius@...
Objet : [?? Probable Spam] Re: Forcing GNU-Radius to change authentication
type

Hi Paul,

> I've foud out that my NAS was sending the same NAS-Port-ID attribute
> which is `0/0/0/0' for my pppoe users (normal because I have only one
> port from where all the users are connected, physical port 0 on the
> NAS). But the problem with that setting is that the radwho command will
> obviously show only the last user getting connected and disconnect the
> previous one...In my understanding, the session in GNU-Radius is
> defined by the couple of `NAS-Port / Nas IP address' which explains
> that behavior when issuing the radwho command.

Yes, that's right.

> I am trying now to set the session to use only the session ID rather
> than that couple which won't make radwho work for me. Need your help
> hare implementing this...

The usual solution is to implement a rewriting function that would
create a unique NAS-Port ID from another pieces of information in the
request. This approach is described in section 10.2.4 "Rewriting Incoming
Requests" of the documentation (available online at
http://www.gnu.org/software/radius/manual/html_node/Rewriting-Incoming-Req
uests.html).

The examples/ directory contains some working samples, which might help
you implement your own rewriting procedure:

examples/cisco.rw: function cisco_pid, called from cisco_fixup.
examples/c3620.rw: function c3620_decode, called from c3620_fixup.
examples/ascend.rw: function max_decode_port, called from max_fixup.

If you need any further help, please do not hesitate to write.

> Another thing : does radzap physically disconnect the customer from the
> NAS

No, of course it does not. It has no way of doing so: there is no
general interface which would connect to NAS and tell it to drop a line.

Radzap is a last resort utility for bringing the system database in
synch with the actual state of user pools. It operates only on
rad[wu]tmp files. Normally, you rarely need to use it, if at all.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: Forcing GNU-Radius to change authentication type

2009-09-17T03:03:33Z

Hi Paul,

> I've foud out that my NAS was sending the same NAS-Port-ID attribute
> which is `0/0/0/0' for my pppoe users (normal because I have only one
> port from where all the users are connected, physical port 0 on the
> NAS). But the problem with that setting is that the radwho command will
> obviously show only the last user getting connected and disconnect the
> previous one...In my understanding, the session in GNU-Radius is
> defined by the couple of `NAS-Port / Nas IP address' which explains
> that behavior when issuing the radwho command.

Yes, that's right.

> I am trying now to set the session to use only the session ID rather
> than that couple which won't make radwho work for me. Need your help
> hare implementing this...

The usual solution is to implement a rewriting function that would
create a unique NAS-Port ID from another pieces of information in the
request. This approach is described in section 10.2.4 "Rewriting Incoming
Requests" of the documentation (available online at
http://www.gnu.org/software/radius/manual/html_node/Rewriting-Incoming-Req
uests.html).

The examples/ directory contains some working samples, which might help
you implement your own rewriting procedure:

examples/cisco.rw: function cisco_pid, called from cisco_fixup.
examples/c3620.rw: function c3620_decode, called from c3620_fixup.
examples/ascend.rw: function max_decode_port, called from max_fixup.

If you need any further help, please do not hesitate to write.

> Another thing : does radzap physically disconnect the customer from the
> NAS

No, of course it does not. It has no way of doing so: there is no
general interface which would connect to NAS and tell it to drop a line.

Radzap is a last resort utility for bringing the system database in
synch with the actual state of user pools. It operates only on
rad[wu]tmp files. Normally, you rarely need to use it, if at all.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Forcing GNU-Radius to change authentication type

2009-09-16T11:52:07Z

Dear Sergey and all,

I've foud out that my NAS was sending the same NAS-Port-ID attribute which
is '0/0/0/0' for my pppoe users (normal because I have only one port from
where all the users are connected, physical port 0 on the NAS). But the
problem with that setting is that the radwho command will obviously show
only the last user getting connected and disconnect the previous one.In my
understanding, the session in GNU-Radius is defined by the couple of
'NAS-Port / Nas IP address' which explains that behavior when issuing the
radwho command.

I am trying now to set the session to use only the session ID rather than
that couple which won't make radwho work for me. Need your help hare
implementing this.

Another thing : does radzap physically disconnect the customer from the NAS
or just shut the session in Radius when the customer remains still connected
to the NAS ?

Thanks for your guidance.

Regards,

____________________________________________________________________________
_____

Paul T. COLE

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU Radius and 'NAS has wrong ID' problem

2009-09-01T01:52:55Z

Hi Sergey,

Many thanks for your guidance on this.

I am seing this error :

1) logout: entry for NAS %s port %d has wrong ID (expected %s found %s)

Any idea how to set this to work ?

Sergey Poznyakoff-2 wrote:

Hi Paul,

> I am in a testing phase and I am currently dealing with a serious issue
> concerning this error : 'NAS has wrong ID'...

There are two possible cases:

1) logout: entry for NAS %s port %d has wrong ID (expected %s found %s)

Somehow the start accounting record of the next session for this
NAS/port combination has been processed before the stop accounting
record reached the server. Usually this means the original start
record was lost, and the NAS retransmitted it later, but by the
time the record was received, the entry was already marked as
being used by another session.

2) login: entry for NAS %s port %d wrong order

While writing a start entry, radiusd discovered that this NAS/port
combination is already marked with stop for the same session id.
This means that the stop record reached radius server before the
start record (possibly due to network issues or high server load).
Usually the corresponding session has zero Acct-Session-Time
attribute.

Which one do you see in your logs?

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@gnu.org
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU Radius and 'NAS has wrong ID' problem

2009-08-27T10:21:47Z

Hi Paul,

> I am in a testing phase and I am currently dealing with a serious issue
> concerning this error : 'NAS has wrong ID'...

There are two possible cases:

1) logout: entry for NAS %s port %d has wrong ID (expected %s found %s)

Somehow the start accounting record of the next session for this
NAS/port combination has been processed before the stop accounting
record reached the server. Usually this means the original start
record was lost, and the NAS retransmitted it later, but by the
time the record was received, the entry was already marked as
being used by another session.

2) login: entry for NAS %s port %d wrong order

While writing a start entry, radiusd discovered that this NAS/port
combination is already marked with stop for the same session id.
This means that the stop record reached radius server before the
start record (possibly due to network issues or high server load).
Usually the corresponding session has zero Acct-Session-Time
attribute.

Which one do you see in your logs?

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU Radius and 'NAS has wrong ID' problem

2009-08-27T01:31:29Z

Hi Lambert,

Yes, the Cisco has a conf like that. Where it is sending accounting to the radius correctly.

With my two tested users, they can both connect through the cisco PPPoE server and authenticate with radius but the radius seems to record only one connection (when issuing the radwho command, I see only one user connected at a time...) and the radius log shows the message of 'NAS has wrong ID..'.

I've seen many posts about this issue and some of them are suggesting to fix the NAS so it will send same set of information when users connect and disconnect...but none of them is actually suggesting how...

Scott Lambert wrote:

On Wed, Aug 26, 2009 at 09:25:26AM -0700, Paul Cole wrote:
> Hi everyone,
>
> I have set up a 7206 vxr cisco router to act as a PPPoE server having an
> radius to authenticate customers.
>
> I am in a testing phase and I am currently dealing with a serious issue
> concerning this error : 'NAS has wrong ID'...
>
> I am testing with 2 users and each of them can access to the server and get
> connected bu when I am trying to see in radius if they are connected, I can
> only see one user connected (radwho command) and the other user's connection
> is flapping but I can't see them connected both when physically they are
> connected on the PPPoE server...the radius log shows them connected
> (connection OK) but is showing the message about the wrong NAS ID...
>
> Any idea about what could cause this and how to solve it ?

I'm not exactly certain I'm barking up the right tree here, but here is
a guess.

Does the cisco have a config entry similar to ?:

ip radius source-interface (interface with the IP address which is in
your clients configuration)

i.e.

ip radius source-interface Loopback0

Where Loopback0 has been configured with your management IP for the
router.

If not, the Cisco will talk to your radius server with the IP of the
interface closest to the radius server, which may not be the IP you
configured in your radius clients configuration.

--
Scott Lambert KC5MLE Unix SysAdmin
lambert@lambertfam.org

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@gnu.org
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU Radius and 'NAS has wrong ID' problem

2009-08-26T10:50:12Z

On Wed, Aug 26, 2009 at 09:25:26AM -0700, Paul Cole wrote:

> Hi everyone,
>
> I have set up a 7206 vxr cisco router to act as a PPPoE server having an
> radius to authenticate customers.
>
> I am in a testing phase and I am currently dealing with a serious issue
> concerning this error : 'NAS has wrong ID'...
>
> I am testing with 2 users and each of them can access to the server and get
> connected bu when I am trying to see in radius if they are connected, I can
> only see one user connected (radwho command) and the other user's connection
> is flapping but I can't see them connected both when physically they are
> connected on the PPPoE server...the radius log shows them connected
> (connection OK) but is showing the message about the wrong NAS ID...
>
> Any idea about what could cause this and how to solve it ?

I'm not exactly certain I'm barking up the right tree here, but here is
a guess.

Does the cisco have a config entry similar to ?:

ip radius source-interface (interface with the IP address which is in
your clients configuration)

i.e.

ip radius source-interface Loopback0

Where Loopback0 has been configured with your management IP for the
router.

If not, the Cisco will talk to your radius server with the IP of the
interface closest to the radius server, which may not be the IP you
configured in your radius clients configuration.

--
Scott Lambert KC5MLE Unix SysAdmin
lambert@...

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

NAS has wron ID

2009-08-26T09:30:11Z

Hi everyone,

I have set up a 7206 vxr cisco router to act as a PPPoE server having a
radius to authenticate customers.

I am in a testing phase and I am currently dealing with a serious issue
concerning this error : 'NAS has wrong ID'...

I am testing with 2 users and each of them can access the server and get
connected but when I am trying to see in radius if they are connected, I can
only see one user connected (radwho command) and the other user's connection
is flapping but I can't see them connected both when physically they are
connected on the PPPoE server...the radius log shows them connected
(connection OK) but is showing the message about the wrong NAS ID...

Any idea about what could cause this and how to solve it ?

Regards,
____________________________________________________________________________
_____
Paul COLE

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

GNU Radius and 'NAS has wrong ID' problem

2009-08-26T09:25:24Z

Hi everyone,

I have set up a 7206 vxr cisco router to act as a PPPoE server having a radius to authenticate customers.

I am in a testing phase and I am currently dealing with a serious issue concerning this error : 'NAS has wrong ID'...

I am testing with 2 users and each of them can access the server and get connected but when I am trying to see in radius if they are connected, I can only see one user connected (radwho command) and the other user's connection is flapping but I can't see them connected both when physically they are connected on the PPPoE server...the radius log shows them connected (Login OK) but is showing the message about the wrong NAS ID...

Any idea about what could cause this and how to solve it ?

From forum: Gnu - Radius - General

problem of authorisation of users on radius 1.6 (Fedora 11)

2009-08-25T00:27:11Z

Hello!

At transition with radius 1.4 (CentOS 5) on radius 1.6 (Fedora 11) there
was a problem of authorisation of users.
*
File "rewrite" identical on both servers:*
integer
cisco_pid(string A)
{
<------>if (A =~ ".*$[0-9][0-9]*$:[A-Z]:$[0-9][0-9]*$") {
<------><------>return (integer)\2;
<------>}
<------>return -1;
}

integer
set_service() {
# Unknown service
%[Auth-Data] = "0";
return 1;
}

#<-----> if ( substr(%[Calling-Station-Id],0,7) == "8902430" ) {
# logit(substr(%[Calling-Station-Id],0,7));

integer
set_service1() {
....
# logit("Radius hangs without this -)");

if ( %[User-Name] == "" ) {
<------># Empty logins: will check CLI
<------>%[User-Name] = "cli#" + %[Calling-Station-Id];
}

# Private fix
if ( %[Called-Station-Id] == "221285" ) { %[Called-Station-Id] =
"86121285"; }
if ( %[Called-Station-Id] == "228285" ) { %[Called-Station-Id] =
"86128285"; }

# DialUp
if ( %[NAS-Port-Type] == 0 ) { %[Auth-Data] = "1"; return 1; }

# PPPoE
if ( %[NAS-Port-Type] == 5 ) { %[Auth-Data] = "2"; return 1; }

# ISDN
if ( %[NAS-Port-Type] == 2 ) { %[Auth-Data] = "3"; return 1; }

# Unknown service
%[Auth-Data] = "0";
return 1;
}

integer
set_service2() {
# Known fixed service
%[Auth-Data] = "1";
return 1;
}

*File "hint" identical on both servers:*
DEFAULT Rewrite-Function = restore_nas_ip Fall-Through = Yes

# check if user still alowed and break sessions otherwise
DEFAULT NULL Acct-Ext-Program = "/home/stbs/radius/checkrad
%C{Acct-Session-Id} %C{NAS-IP-Address} %R{Acct-Status-Type} %C{Class:=0}
\"%D\""

*
File checkrad identical on both servers:*
LOG=/home/stbs/radius/log/podclient.log

PODDIR=/usr/sbin
PODBIN=podclient

ROOT=/home/stbs/radius
#ROOT=$PWD

#Обрывать сессии
[ -f "$ROOT/killflag" ] || echo 0 > $ROOT/killflag
DOKILL=$(cat $ROOT/killflag)

#echo "$@" >> $LOG
pushd $ROOT > /dev/null
. connect
[ -f "$ROOT/checkrad.stop" ] || . podclient.sh $@
popd > /dev/null

radius-debug.log on radius 1.6
Aug 19 16:43:45 [21801]: debug: auth.c:761:rad_authenticate: auth:
53orgremgaz
Aug 19 16:43:45 [21801]: debug: postgres.c:250:rad_postgres_exec: query:
SELECT AtrName, Value, Cmp from rad_check('53orgremgaz', '', '2009-08-19
16:43:45','')
Aug 19 16:43:45 [21801]: debug: postgres.c:264:rad_postgres_exec:
status: PGRES_TUPLES_OK
Aug 19 16:43:45 [21801]: debug: postgres.c:250:rad_postgres_exec: query:
SELECT AtrName, Value from rad_reply('53orgremgaz', '', 0, '2009-08-19
16:43:45','')
Aug 19 16:43:45 [21801]: debug: postgres.c:264:rad_postgres_exec:
status: PGRES_TUPLES_OK
Aug 19 16:43:45 [21801]: debug: postgres.c:174:rad_postgres_getpwd:
query: SELECT rad_password('53orgremgaz', 'xxx');
Aug 19 16:43:45 [21801]: debug: postgres.c:188:rad_postgres_getpwd:
status: PGRES_TUPLES_OK
Aug 19 16:43:45 [21801]: debug: auth.c:602:rad_check_password:
auth_type=0, userpass=xxx, name=53orgremgaz, password=xxx
Aug 19 16:43:45 [21801]: debug: auth.c:648:rad_check_password: auth: Local
Aug 19 16:43:45 [21801]: debug: auth.c:1233:sfn_ack: ACK: 53orgremgaz

radius-debug.log on radius 1.4
Aug 19 16:45:50 [4795]: debug: auth.c:762:rad_authenticate:
auth:53orgremgaz
Aug 19 16:45:50 [4795]: debug: postgres.c:251:rad_postgres_exec: query:
SELECT AtrName, Value, Cmp from rad_check('53orgremgaz', '',
'2009-08-1916:45:50','')
Aug 19 16:45:50 [4795]: debug: postgres.c:267:rad_postgres_exec:
status:PGRES_TUPLES_OK
Aug 19 16:45:50 [4795]: debug: postgres.c:251:rad_postgres_exec: query:
SELECT AtrName, Value from rad_reply('53orgremgaz', '', 2,
'2009-08-1916:45:50','')
Aug 19 16:45:50 [4795]: debug: postgres.c:267:rad_postgres_exec:
status:PGRES_TUPLES_OK
Aug 19 16:45:50 [4795]: debug: postgres.c:173:rad_postgres_getpwd:
query: SELECT rad_password('53orgremgaz', 'xxx');
Aug 19 16:45:50 [4795]: debug: postgres.c:189:rad_postgres_getpwd:
status:PGRES_TUPLES_OK
Aug 19 16:45:50 [4795]: debug: auth.c:603:rad_check_password:
auth_type=0, userpass=xxx, name=53orgremgaz, password=xxx
Aug 19 16:45:50 [4795]: debug: auth.c:649:rad_check_password: auth:Local
Aug 19 16:45:50 [4795]: debug: auth.c:1235:sfn_ack: ACK: 53orgremgaz

*On a server radius 1.4 such line comes*
Aug 19 16:45:50 [4795]: debug: postgres.c:251:rad_postgres_exec: query:
SELECT AtrName, Value from rad_reply('53orgremgaz', '', 2,
'2009-08-1916:45:50','')

*And on a server 1.6 such line comes*
Aug 19 16:43:45 [21801]: debug: postgres.c:250:rad_postgres_exec: query:
SELECT AtrName, Value from rad_reply('53orgremgaz', '', 0, '2009-08-19
16:43:45','')

Why function rewrite returns "0" instead of "2" for PPPoE connection?

What options are still necessary to help me
_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: RADIUS V1.3 sending syslogs

2009-08-13T23:46:43Z

Daniel Daniels <daniel65456@...> ha escrit:

> I cannot get radius to send syslogs. I'd prefer not to upgrade as this is
> outside my responsibiity and that of the project. Does anyone have V1.3
> syslogging properly?

Yes, of course.

> I've tried "syslog local5.info;" as well as "syslog
> auth.info;" in the "channel default" stanza both with and without 'file
> "radius.log";'

You should use either 'syslog' or 'file', not both.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

RADIUS V1.3 sending syslogs

2009-08-13T20:27:04Z

I cannot get radius to send syslogs. I'd prefer not to upgrade as this is
outside my responsibiity and that of the project. Does anyone have V1.3
syslogging properly? I've tried "syslog local5.info;" as well as "syslog
auth.info;" in the "channel default" stanza both with and without 'file
"radius.log";'

Cheers
D
_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: Radiator: Block multi Login!

2009-08-12T03:21:42Z

Arshiyan Ahmed <arshiyan_a@...> ha escrit:

> Pls. help me to block multiple login on radius server. i am using
> radiator 3.12 version.

Your question has nothing to do with this list. Please, post it to
radiator team/help list.

Regards,
Sergey

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

Re: GNU radius using an existing db

2009-07-30T05:06:01Z

Hi Jordi,

if I understand your problem correctly, you seem to wonder how to tell
radius where your db is located and what type of database you have. You
can find that in the file raddb/sqlserver. (full path may be
/etc/raddb/sqlserver, depending on your configuration). Documentation of
that can be found here:

http://www.gnu.org/software/radius/manual/radius.html#SEC141

Maybe that helps...

Regards,
Chris

Jordi Prats schrieb:

> Hi Sergey,
> Auth-Type shoudn't be SQL instead of "Local"?
>
> My users file is the following:
>
> DEFAULT Auth-Type = SQL,
> Simultaneous-Use = 1
> Service-Type = Framed-User,
> Framed-Protocol = PPP
>
> I've tryed this two configurations without luck.
>
> DEFAULT Auth-Type = Local,
> Simultaneous-Use = 1,
> Password-Location = SQL,
> User-Password = plaintext
>
>
> DEFAULT Auth-Type = Local,
> Simultaneous-Use = 1,
> Password-Location = SQL,
>
>
> I'm not understanding how to specify the type and location of the
> database. Could you please help me?
>
> Thank you!!!
> Jordi
>
>
> On Wed, Jul 29, 2009 at 10:11 AM, Sergey Poznyakoff<gray@...> wrote:
>
>> Jordi Prats <jordi.prats@...> ha escrit:
>>
>>
>>> Should auth_query return some kind of hash instead of a plaintext
>>> password? How could I know what's going wrong?
>>>
>> Hola Jordi,
>>
>> Apologies for not being able to reply earlier.
>>
>> Handling of the password depends on the setting of Auth-Type attribute
>> in your users file. If its value is "Local", the password is treated as
>> plaintext. If it is "Crypt-Local", it is treated as a DES or MD5 hash
>> (recognized automatically). It also has lots of other values. Please,
>> see
>>
>> http://www.gnu.org/software/radius/manual/html_node/Authentication.html
>>
>> for more details.
>>
>> Regards,
>> Sergey
>>
>>
>>
>
>
>
>

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU radius using an existing db

2009-07-30T04:16:55Z

Jordi Prats <jordi.prats@...> ha escrit:

> Auth-Type shoudn't be SQL instead of "Local"?

It depends on your configuration. FWIW, when using "SQL", as in your
users file:

> DEFAULT Auth-Type = SQL,
> Simultaneous-Use = 1
> Service-Type = Framed-User,
> Framed-Protocol = PPP

Radius treats the returned passwords as DES or MD5 hashes.

> I'm not understanding how to specify the type and location of the
> database. Could you please help me?

What exactly do you want to achieve? In what form passwords are kept
in your database?

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU radius using an existing db

2009-07-30T03:57:41Z

Hi Sergey,
Auth-Type shoudn't be SQL instead of "Local"?

My users file is the following:

DEFAULT Auth-Type = SQL,
Simultaneous-Use = 1
Service-Type = Framed-User,
Framed-Protocol = PPP

I've tryed this two configurations without luck.

DEFAULT Auth-Type = Local,
Simultaneous-Use = 1,
Password-Location = SQL,
User-Password = plaintext

DEFAULT Auth-Type = Local,
Simultaneous-Use = 1,
Password-Location = SQL,

I'm not understanding how to specify the type and location of the
database. Could you please help me?

Thank you!!!

Jordi

On Wed, Jul 29, 2009 at 10:11 AM, Sergey Poznyakoff<gray@...> wrote:

> Jordi Prats <jordi.prats@...> ha escrit:
>
>> Should auth_query return some kind of hash instead of a plaintext
>> password? How could I know what's going wrong?
>
> Hola Jordi,
>
> Apologies for not being able to reply earlier.
>
> Handling of the password depends on the setting of Auth-Type attribute
> in your users file. If its value is "Local", the password is treated as
> plaintext. If it is "Crypt-Local", it is treated as a DES or MD5 hash
> (recognized automatically). It also has lots of other values. Please,
> see
>
> http://www.gnu.org/software/radius/manual/html_node/Authentication.html
>
> for more details.
>
> Regards,
> Sergey
>
>

--
Jordi

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: GNU radius using an existing db

2009-07-29T01:11:59Z

Jordi Prats <jordi.prats@...> ha escrit:

> Should auth_query return some kind of hash instead of a plaintext
> password? How could I know what's going wrong?

Hola Jordi,

Apologies for not being able to reply earlier.

Handling of the password depends on the setting of Auth-Type attribute
in your users file. If its value is "Local", the password is treated as
plaintext. If it is "Crypt-Local", it is treated as a DES or MD5 hash
(recognized automatically). It also has lots of other values. Please,
see

http://www.gnu.org/software/radius/manual/html_node/Authentication.html

for more details.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

GNU radius using an existing db

2009-07-21T06:30:37Z

Hi all,
I'm trying to use GNU radius with a existing MySQL database, in this
case is vpopmail's database

I'm using this parameters on sqlserver configuration file

# Query to select the password for the given user. Should return one string.
auth_query select pw_clear_passwd as password from vpopmail where
CONCAT(pw_name,'@',pw_domain)='%u'

# This query returns groups the user belongs to
group_query select pw_domain as user_group from vpopmail where
CONCAT(pw_name,'@',pw_domain)='%u'

But all I'm getting is this error:

Jul 21 14:55:19 [23608]: (Access-Request local 32
"jprats@..."): Login incorrect
[jprats@.../tatatata]

Should auth_query return some kind of hash instead of a plaintext
password? How could I know what's going wrong?

regards,
--
Jordi

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

RADIUS accounting

2009-07-18T15:16:29Z

Dears,

what's the meaning of accounting in radius aaa ?
is it means measuring of consumed resources only or users' activities like
executed commands for example on an ssh service is being logged ?
i did read the wikipedia article about radius which contains description of
the Accounting protocol and also i did read the Accounting RFC of RADIUS,
but still i can't understand this point.

if any one can help me to clarify this point, his help is more than
appriciated.

Thanks & Best Regards,

--
Mohamed M. Hagag
محمد محمود حجاج
http://www.linkedin.com/in/mohamedhagag
http://bintoo.sf.net/drpl/
http://mohamedhagag.wordpress.com
_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: idle timeout questions

2009-07-02T12:04:00Z

Hi Hendrik,

> Now we are thinking about the technical
> realization of that issue - what does radius server do to detect a
> timeout, let's say 10 minutes? Is the server collecting traffic
> statistics on the interface(s) and decides depending on those stats
> what to do?

Radius does not collect any data from interfaces. It's only purpose
is to receive requests from network access servers, process them and
answer them back. Once the request is answered, Radius has no way
of further control over the NAS or the session.

Session timeouts are normally controlled by returnint the
Session-Timeout attribute in the answer to Access-Requests. Idle
timeouts are set by returning the Idle-Timeout attribute in the same
response. Additionally, particular NAS vendors may supply their own
vendor attributes to control these.

The GNU Radius Manual will supply a more detailed information on the
subject. It is avialable online in various formats from
http://www.gnu.org/software/radius/manual.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

idle timeout questions

2009-07-02T06:26:38Z

Hi *,

we're evaluating radius for authentication and logging purposes in a
multi-homed environment. Due to legal issues it is necessary to log
_and_ to really timeout sessions which are idle - looks like radius
would be the solution for us. Now we are thinking about the technical
realization of that issue - what does radius server do to detect a
timeout, let's say 10 minutes? Is the server collecting traffic
statistics on the interface(s) and decides depending on those stats what
to do? Or how is this implemented?

Thanks in advance,
hendrik

Freundliche Grüße,

i.A. Hendrik Pahl
Systemingenieur
--
LWsystems GmbH & Co. KG ++ http://www.lw-systems.de/impressum
Tel: +49 (0)5403 / 5556 ++ Fax: +49 (0)5403 / 7 95 89 97

Ihr Spezialist für Linux, Open Source & IT-Sicherheit

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

LWsystems GmbH & Co. KG
Sitz der Gesellschaft: Tegelerweg 11, 49186 Bad Iburg
Telefon +49 (0)5403 5556
Telefax +49 (0)5403 7958997
Handelsregister: Amtsgericht Osnabrück, HRA 110668
USt.-ID-Nr. DE244573220

Persönlich haftende Gesellschafterin: LWsystems Verwaltungs GmbH
Sitz der Gesellschaft: Tegelerweg 11, 49186 Bad Iburg
Handelsregister: Amtsgericht Osnabrück, HRB 111163

Geschäftsführer:
Dipl.-Ing. Ansgar H. Licher, Bad Iburg
Dipl.-Ing. Martin Werthmöller, Ibbenbüren

Für weitere Firmendetails zu LWsystems siehe /
For further company details please look at:
http://www.lw-systems.de/impressum

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

signature.asc (204 bytes) Download Attachment

From forum: Gnu - Radius - General

Re: Gnu Radius IP Pools and PPPoE sessions

2009-06-10T04:38:50Z

Hi Paul,

> I am trying to set up a new Cisco PPPoE server in my network to terminate my
> customers DSL connections. The server is working fine except that my
> customers can't get their IP from the radius(which I want to give IP to
> customers during the authentication).

The simplest way to do so is by returning Framed-IP-Address attribute
offset by the value of the NAS-Port-Id attribute, e.g.:

Framed-IP-Address = 10.10.0.1+

(see
http://www.gnu.org/software/radius/manual/html_node/Framed_002dIP_002dAddress.html#SEC309)

More sofisticated ways may include using some rewrite function to
produce new IP address, e.g.:

Framed-IP-Address = "=getip(%C{NAS-Identifier}, %C{NAS-Port-Id})"

(for details, see
http://www.gnu.org/software/radius/manual/html_node/Attribute-Creation-Functions.html#SEC210)

Finally, you can use the ipalloc.scm module, which uses the SQL table
you mentioned. It is described in detail in doc/README.ipalloc. See
chapter "Usage", for usage instructions.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Gnu Radius IP Pools and PPPoE sessions

2009-06-10T03:54:21Z

Hi all,

I am trying to set up a new Cisco PPPoE server in my network to terminate my
customers DSL connections. The server is working fine except that my
customers can't get their IP from the radius(which I want to give IP to
customers during the authentication). I've seen in my sql server (radius
database) a table called IPPool where there is columns having a shape of
giving IP to users but so far, my tests have been unsuccessful and I've
started to look over the Internet to find a similar config and understand
how to set my radius to assign IP to customers, from a defined IP Pools
initially created. Any idea would be much appreciated.

Thanks.

-------------------------------------------------------------------

Paul

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

How do I build radius database

2009-06-09T06:10:43Z

Hi:
I have installed radius on FreeBSD 7.2 via use ports(cd /usr/ports/net/gnu-radius;make install clean). How do I install radius database(MySQL) or build SQL?
Thanks.
_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

Re: radius mysql table struct

2009-06-09T06:02:56Z

=?gb2312?B?SmlhbnBpbmcgU3VuKNbQufrBqs2outOxscqhs9C1wrfWuavLvik=?= <sunjp8@...> ha escrit:

> Hi,I have used ports mode install radius in FreeBSD.I want to it support
> mysql Authentication Authorization Accounting,I have read README,but it

Please, read the GNU Radius Manual. See sections 4.11.3 and 4.11.4 for
a detailed description of SQL authentication and accounting.

Regards,
Sergey

_______________________________________________
Help-gnu-radius mailing list
Help-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/help-gnu-radius

From forum: Gnu - Radius - General

New Dutch PO file for 'radius' (version 1.6.1)

2009-05-16T07:27:04Z

Hello, gentle maintainer.

This is a message from the Translation Project robot.

A revised PO file for textual domain 'radius' has been submitted
by the Dutch team of translators. The file is available at:

http://translationproject.org/latest/radius/nl.po

(This file, 'radius-1.6.1.nl.po', has just now been sent to you in
a separate email.)

All other PO files for your package are available in:

http://translationproject.org/latest/radius/

Please consider including all of these in your next release, whether
official or a pretest.

Whenever you have a new distribution with a new version number ready,
containing a newer POT file, please send the URL of that distribution
tarball to the address below. The tarball may be just a pretest or a
snapshot, it does not even have to compile. It is just used by the
translators when they need some extra translation context.

The following HTML page has been updated:

http://translationproject.org/domain/radius.html

If any question arises, please contact the translation coordinator.

Thank you for all your work,

The Translation Project robot, in the
name of your translation coordinator.
<coordinator@...>

_______________________________________________
Radius-i18n mailing list
Radius-i18n@...
http://lists.gnu.org/mailman/listinfo/radius-i18n

From forum: Gnu - Radius - I18N

Contents of PO file 'radius-1.6.1.nl.po'

2009-05-16T07:27:04Z

The Translation Project robot, in the
name of your translation coordinator.
<coordinator@...>

_______________________________________________
Radius-i18n mailing list
Radius-i18n@...
http://lists.gnu.org/mailman/listinfo/radius-i18n

radius-1.6.1.nl.po.gz (25K) Download Attachment

From forum: Gnu - Radius - I18N

Re: new rewrite function suggestion + patch, use case: DHCP assignment based on switch and port

2009-05-02T02:45:42Z

Josef Li¡ka <jl@...> ha escrit:

> Rewrite includes function qprn, which
> I simply modified to new function tohex.
[...]
> I would like to ask to include tohex function in next release, as this
> might be useful.

Hi Josef,

Thanks for your contribution. Of course I will include it in the nearest
release.

Regards,
Sergey

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

new rewrite function suggestion + patch, use case: DHCP assignment based on switch and port

2009-04-23T15:35:16Z

Hello,
I have chosen GNU radius as backend for my dhcp servers on mikrotik
routeros 3.x,
because it is probably most flexible implementation of radius server.

I need to do special rewriting of request in order to achieve IP address
assignment based on
switch and port and not mac address. For this i use dhcp option 82 on
switches, which sets
Agent-Remote-Id and Agent-Circuit-Id.

Agent-Remote-Id is basically mac address of the switch, and Circuit-Id
is basically port number and vlan.

Rewrite language is strong enough to do the transformation in case of
text fields. But Agent-Remote-Id
and Agent-Circuit-Id are binary. Rewrite includes function qprn, which I
simply modified to new function tohex.
tohex encodes all characters, so that field and gsub can be used to
separate useful bytes from
Agent-Remote-Id and Agent-Circuit-Id.

My rewrite configuration is:

string
decode_agent_remote_id()
{
string agent;
string newagent;

agent = gsub("%"," ",tohex(%[Agent-Remote-Id]));

newagent =
field(agent,3)+":"+field(agent,4)+":"+field(agent,5)+":"+field(agent,6)+":"+field(agent,7)+":"+field(agent,8);
%[Orig-User-Name] = %[User-Name];
%[User-Name] = newagent+"port:"+field(gsub("%","
",tohex(%[Agent-Circuit-Id])),6);
return 0;
}

This return user names like "00:15:77:B1:D7:10port:03"

I would like to ask to include tohex function in next release, as this
might be useful.

--

Best regards
Josef Liška

CHL | system care

Phone: +420.272048055
Fax: +420.272048064
Cell: +420.776026526 denně 9:00 - 17:30 CEST

<https://www.chl.cz/>

--- radius-1.6.1/radiusd/rewrite.y 2008-12-15 09:03:24.000000000 +0100
+++ radius-1.6.1-phokz/radiusd/rewrite.y 2009-04-17 17:09:15.000000000 +0200
@@ -5519,6 +5519,34 @@
*p = 0;
}

+/* Phokz's hack */
+
+static void
+bi_tohex()
+{
+ grad_string_t arg;
+ char *p, *s, *end;
+ size_t count;
+ RWSTYPE *sp;
+
+ mem2string(&arg, (RWSTYPE*)getarg(1));
+ end = arg.data + arg.size;
+
+ /* Each encoded character takes 3 bytes. */
+ sp = heap_reserve(sizeof(RWSTYPE) + 3*arg.size + 1);
+ sp[0] = 3*arg.size;
+ pushn((RWSTYPE) sp);
+
+ for (p = (char*)(sp + 1), s = arg.data; s < end; s++) {
+ char buf[3];
+ snprintf(buf, sizeof buf, "%02X", *(unsigned char*)s);
+ *p++ = '%';
+ *p++ = buf[0];
+ *p++ = buf[1];
+ }
+ *p = 0;
+}
+
static void
bi_quote_string()
{
@@ -5667,6 +5695,8 @@
/* Time functions */
{ bi_time, "time", Integer, "" },
{ bi_strftime, "strftime", String, "si" },
+ /* Phokz's hack */
+ { bi_tohex, "tohex", String, "s" },
{ NULL }
};

[jl.vcf]

begin:vcard fn;quoted-printable:Josef Li=C5=A1ka n;quoted-printable:Li=C5=A1ka;Josef org;quoted-printable:CHL po=C4=8D=C3=ADta=C4=8De, s.r.o. adr;quoted-printable:;;Karla Majera 93;V=C5=A1enory;;252 31;Czech Republic email;internet:jl@... title:root tel;work:+420 272 048 055 tel;fax:+420 272 048 064 tel;cell:+420 776 026526 note:jabber: jl@... x-mozilla-html:FALSE url:http://www.chl.cz version:2.1 end:vcard

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

Mijn profiel op Facebook bekijken

2009-03-01T02:52:58Z

facebook

Colemont Bert has:
247 vrienden
12 photos
0 notities
49 wall posts
29 groepen

Mijn profiel op Facebook bekijken

Dag Bug-gnu-radius,

Ik heb een profiel op Facebook aangemaakt, waar ik mijn foto's, filmpjes en evenementen kan achterlaten. Ik wil ook jou toevoegen als vriend zodat jij ze kan bekijken. Eerst moet je lid worden van Facebook! Eenmaal je lid bent, kan je ook een eigen profiel aanmaken.

Bedankt,
Colemont

Om je te registreren op Facebook, gelieve de onderstaande link te volgen:
http://www.facebook.com/p.php?i=1074273038&k=52D6ZXQRWXVM5F1AQK36RW&r

Deze e-mail kan promotiemateriaal bevatten. Als je in de toekomst geen commerciële mails meer wil ontvangen van Facebook, gelieve te uitschrijven. De kantoren van Facebook zijn gelegen te 156 University Ave., Palo Alto, CA 94301.

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

Re: make error

2009-02-09T00:37:19Z

d.henman <dhenman@...> ha escrit:

> I am wondering if this is a possible configure type error that may be
> overlooked for when building radius on a "clean system", meaning a
> system with no previous radius include files loaded in /usr/include
> ... or due to my cygwin platform?

Looks like a configure bug on cygwin. Check if RADIUS_INCLUDE_PATH is
defined (grep RADIUS_INCLUDE_PATH config.log and grep
RADIUS_INCLUDE_PATH config.status).

Regards,
Sergey

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

make error

2009-02-08T17:14:56Z

Sergey, et al,

I have run into what I believe my be a configure related logic bug, but am not sure.

An attempt to "make" produces the following error messages..

-------- make error output
....
Making all in radiusd
make[2]: Entering directory `/usr/src/radius/radius-1.6.1/radiusd'
make all-am
make[3]: Entering directory `/usr/src/radius/radius-1.6.1/radiusd'
/usr/local/bin/gcc -g -O2 -I/usr/local/include radiusd.c -o radiusd
radiusd.c:34:21: error: radiusd.h: No such file or directory
radiusd.c:35:28: error: radius/radargp.h: No such file or directory
radiusd.c:36:28: error: radius/radutmp.h: No such file or directory
radiusd.c:37:26: error: radius/argcv.h: No such file or directory
radiusd.c:38:21: error: rewrite.h: No such file or directory
radiusd.c:39:23: error: snmp/asn1.h: No such file or directory
radiusd.c:40:23: error: snmp/snmp.h: No such file or directory
radiusd.c:41:21: error: timestr.h: No such file or directory
radiusd.c:43: error: expected ',' or ';' before 'PACKAGE'
radiusd.c:44: error: invalid initializer
radiusd.c:49: error: array type has incomplete element type
radiusd.c:131: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'radiusd_user'
radiusd.c:132: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'exec_user'
radiusd.c:146: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token
-------- end of error output paste

The needed include ".h" files do exist however within the package dir structure.

I note that the line in the error message above,
"/usr/local/bin/gcc -g -O2 -I/usr/local/include radiusd.c -o radiusd"

does not contain the package local include directories.

Looking the the configure code, there is reference to $(top_srcdir) $(top_builddir) and I don't believe they are getting set properly.

Or possibly, that the RADIUS_INCLUDE_PATH variable is not being set completely.

I am wondering if this is a possible configure type error that may be overlooked for
when building radius on a "clean system", meaning a system with no previous radius include files loaded in /usr/include ... or due to my cygwin platform?

Any help or suggestions is appreciated.

Regards,
Darel Henman

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

Re: Dropping packet maximum number of childs

2009-01-06T06:55:09Z

Bert Colemont <bert.colemont@...> ha escrit:

> You mean this or so?
> INSERT INTO connections VALUES(1,'username','2009-01-05
> 18:00:11','10.10.10.10',3908692444,'E8F9E9DC-49624A2F',0,0,0,0,0,0,'198
> .198.198.198','','*BAS-SOMEWHERE*19/0*243*72','0');

No, Bert, that's accounting, not authentication. It is not relevant in
your case, at least for now. Your problems are related to
authentication. What happens is that authentication sub-processes take
too long to reply to requests. This can happen due to the following two
reasons:

1. Request time-to-live is too short[1].

This cannot be the reason, because your raddb/config does not override
time-to-live, so its default value of 60 seconds remains in effect, and,
I suppose, this time is more than enough for any real-life application.

2. Authentication scheme takes too long to complete.

This is the most probable reason for your problem. I don't know how
exactly you authenticate your users (you didn't supply your
raddb/users, nor huntgroups, nor hints), so I can only make guesses. If
you are using *only* SQL authentication, it can be the reason of the slowdown.
To verify if this is so, you have to: 1. measure average time of connecting
to the SQL database, 2. measure average time of completing SQL
authentication. Then, you'll obtain average time of authentication
bu adding these two values.

To measure (2), either look in your SQL logs for a series of
authentication queries, or execute these queries manually from a mysql
console. I don't know how you configured SQL authentication (because you
didn't supply your raddb/sqlserver either), so I can't tell exactly what
queries you should be looking for/executing. You will find a detailed
description of SQL authentication and authorization process in [2] and
[3], which in conjunction with your actual raddb/sqlserver will help you
determine the exact sequence of queries.

Regards,
Sergey

[1]. http://www.gnu.org/software/radius/manual/html_node/auth.html
[2]. http://www.gnu.org/software/radius/manual/html_node/Authentication-Server-
Parameters.html
[3]. http://www.gnu.org/software/radius/manual/html_node/Authorization-Paramete
rs.html

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

Re: Dropping packet maximum number of childs

2009-01-06T01:55:50Z

You mean this or so?

INSERT INTO connections VALUES(1,'username','2009-01-05 18:00:11','10.10.10.10',3908692444,'E8F9E9DC-49624A2F',0,0,0,0,0,0,'198.198.198.198','','*BAS-SOMEWHERE*19/0*243*72','0');

2009/1/5 Sergey Poznyakoff <gray@...>

Bert Colemont <bert.colemont@...> ha escrit:

> I have also tested this from home, and sometimes I can connect in a
> second, sometimes it takes me up to 5 min :(

That's not what I meant. How long does it take for the *SQL*
authentication queries to complete? You can easily measure it by looking
into your mysql.log files.

Regards,
Sergey

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs

Re: Dropping packet maximum number of childs

2009-01-05T12:18:14Z

Bert Colemont <bert.colemont@...> ha escrit:

> I have also tested this from home, and sometimes I can connect in a
> second, sometimes it takes me up to 5 min :(

That's not what I meant. How long does it take for the *SQL*
authentication queries to complete? You can easily measure it by looking
into your mysql.log files.

Regards,
Sergey

_______________________________________________
Bug-gnu-radius mailing list
Bug-gnu-radius@...
http://lists.gnu.org/mailman/listinfo/bug-gnu-radius

From forum: Gnu - Radius - Bugs