Hi Tihomir,<br><br>Sorry, i missed your mail in gmail before, just now saw it, and after using your dictionary.all, the dictionary issue was resolved, very appreciated for your kindly help! however, it did not fully functional yet,<br>
<br>Attached are configuration files that i used, when i dial 601 to trigger to auth, the freeradius server shows log below, the supecious log is the value User-Password, it should be '1111' that i've set in the mysql db of freeradisu server for the user 1001 .<br>
<br>i searched in google, f<span style="background-color: rgb(255, 255, 255);">or "known good" password issue, i suggest change user-password to cleartext-password, however, i did not find where it is.</span><br style="background-color: rgb(255, 255, 255);">
<span style="background-color: rgb(255, 255, 255);">and also the Auth-Type, where to configure it...</span><br><br>Freeradius server log:<br><br>rad_recv: Access-Request packet from host 127.0.0.1 port 52684, id=49, length=111<br>
User-Name = "1001"<br> User-Password = "<span style="background-color: rgb(255, 255, 0);">?\210\365@\263\t\306\343\243iT?\311C\t\002</span>"<br> Called-Station-Id = "888"<br>
h323-conf-id = "749d2b5a-16ad-48e4-af58-24011949d1b5"<br> Calling-Station-Id = "1001"<br> NAS-Port = 0<br> NAS-IP-Address = 127.0.0.1<br># Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default<br>
+- entering group authorize {...}<br>++[preprocess] returns ok<br>[auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/<a href="http://127.0.0.1/auth-detail-20110803">127.0.0.1/auth-detail-20110803</a><br>
[auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/<a href="http://127.0.0.1/auth-detail-20110803">127.0.0.1/auth-detail-20110803</a><br>[auth_log] expand: %t -> Wed Aug 3 12:06:33 2011<br>
++[auth_log] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>++[digest] returns noop<br>[suffix] No '@' in User-Name = "1001", looking up realm NULL<br>[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>[eap] No EAP-Message, not doing EAP<br>++[eap] returns noop<br>++[unix] returns notfound<br>++[files] returns noop<br>[sql] expand: %{User-Name} -> 1001<br>[sql] sql_set_user escaped user --> '1001'<br>
rlm_sql (sql): Reserving sql socket id: 4<br>[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1001' ORDER BY id<br>
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1001' ORDER BY priority<br>
rlm_sql (sql): Released sql socket id: 4<br>[sql] User 1001 not found<br>++[sql] returns notfound<br>++[expiration] returns noop<br>++[logintime] returns noop<br><span style="background-color: rgb(255, 255, 0);">[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.</span><br>
++[pap] returns noop<br><span style="background-color: rgb(255, 255, 0);">ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user</span><br>Failed to authenticate the user.<br> WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!<br>
Using Post-Auth-Type Reject<br># Executing group from file /usr/local/etc/raddb/sites-enabled/default<br>+- entering group REJECT {...}<br>[attr_filter.access_reject] expand: %{User-Name} -> 1001<br> attr_filter: Matched entry DEFAULT at line 11<br>
++[attr_filter.access_reject] returns updated<br>Delaying reject of request 8 for 1 seconds<br>Going to the next request<br>Waking up in 0.9 seconds.<br>Sending delayed reject for request 8<br>Sending Access-Reject of id 49 to 127.0.0.1 port 52684<br>
Waking up in 4.9 seconds.<br>Cleaning up request 8 ID 49 with timestamp +7674<br>Ready to process requests.<br>WARNING! No "known good" password found for the user<br><br>Regards,<br>Charles<br><br><div class="gmail_quote">
2011/8/3 Tihomir Culjaga <span dir="ltr"><<a href="mailto:tculjaga@gmail.com">tculjaga@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
did u use the dictionary i have attached ?<div><div></div><div class="h5"><br><br><div class="gmail_quote">On Tue, Aug 2, 2011 at 10:08 AM, fieldpeak <span dir="ltr"><<a href="mailto:fieldpeak@gmail.com" target="_blank">fieldpeak@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
i tried change to 'h323-conf-id' to 'h323-call-origin' in 02_unitest_rad-ANI-auth.xml, rad_auth.conf.xml, however, it still prompt '[ERR] mod_rad_auth.c:428 Unknown attribute: key:<span style="background-color:rgb(255, 255, 0)">h323-conf-id</span>, not found in dictionary', so where the mod_rad_auth read out the 'h323-conf-id'? very very strange, which dictionary it was using...<br>
<br>Regards,<br>Charles<div><div></div><div><br><br><div class="gmail_quote">2011/8/2 fieldpeak <span dir="ltr"><<a href="mailto:fieldpeak@gmail.com" target="_blank">fieldpeak@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span style="color:#5b1094">Hi Tihomir</span>,<br><br>Finally the answer coming, i see the hope, thanks for your reply, :)<br><br>As your advise, i only use one attribute(h323-conf-id) in my dialplan, and only one attribute(h323-conf-id) in rad_auth.conf.xml, and using the attached dictionary (from ciso) which contains this attribute, however, it still prompt 'unknown attribute', so i suspected if it was reading /usr/local/etc/radiusclient/dictionary, so i copy the same dictionary to /usr/local/freeswitch/radius/, it did not any help at all... very strange...<br>
<br>Log:<br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:318 set default_realm := .<br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:318 set radius_timeout := 3.<br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:318 set radius_retries := 2.<br>
2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:318 set radius_deadtime := 0.<br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:318 set bindaddr := *.<br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:371 ... radius: User-Name: 38516060333<br>
2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:380 ... radius: User-Password: 003282<br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:396 ... radius: Called-station-Id: <a href="tel:16094191500" value="+16094191500" target="_blank">16094191500</a><br>
2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:413 Handle attribute: h323-conf-id<br>
<span style="background-color:rgb(255, 255, 0)">2011-08-02 15:37:26.578217 [ERR] mod_rad_auth.c:428 Unknown attribute: key:h323-conf-id, not found in dictionary</span><br>2011-08-02 15:37:26.578217 [DEBUG] mod_rad_auth.c:538 abort sending radius packet.<br>
2011-08-02 15:37:26.578217 [ERR] mod_rad_auth.c:546 An error occured during RADIUS Authentication(RC=-1)<br>2011-08-02 15:37:26.578217 [ERR] mod_rad_auth.c:702 An error occured during radius authorization.<div>
<br>EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> log(INFO AUTH_RESULT=)<br>
<br><br><br></div><div> <extension name="unitest_rad-ANI-auth"><br> <condition field="destination_number" expression="^601$"><br> <!-- <action application="log" data="INFO Before Auth "/> --><br>
<br> <action inline="true" application="set" data="CALLID=<span style="background-color:rgb(255, 255, 0)">h323-conf-id</span>=${uuid}"/><br><br></div> <action inline="true" application="set" data="USERNAME=1001"/><br>
<action inline="true" application="set" data="PASSWD=1111"/><div><br><br> <action application="sleep" data="2000"/><br> <action application="auth_function" data="in ${DIALED_NUMBER}, in ${USERNAME}, in ${PASSWD}, out AUTH_RESULT"/><br>
<br></div> </condition><br> </extension><div><br><br><br><configuration name="rad_auth.conf" description="radius authentification module"><br></div> <settings><br>
<br> </settings><br>
<br> <client><br> <param name="authserver" value="127.0.0.1:1812:gateway"/><br> <param name="dictionary" value="/usr/local/etc/radiusclient/dictionary"/><br>
<param name="seqfile" value="/var/run/radius.seq"/><br> <param name="mapfile" value="/usr/local/etc/radiusclient/port-id-map"/><br> <param name="default_realm" value=""/><br>
<param name="radius_timeout" value="3"/><br> <param name="radius_retries" value="2"/><br> <param name="radius_deadtime" value="0"/><br>
<param name="bindaddr" value="*"/><br> </client><br><br> <vsas><div><br> <br> <param name="<span style="background-color:rgb(255, 255, 0)">h323-conf-id</span>" id="24" value="CALLID" pec="9" expr="1" direction="in"/><br>
<br></div> </vsas><br> </configuration><div><div></div><div><br><br><br><div class="gmail_quote">2011/8/2 Tihomir Culjaga <span dir="ltr"><<a href="mailto:tculjaga@gmail.com" target="_blank">tculjaga@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
hi, <br><br>dictionary.all is just the name of a file containing all attributes i needed at that time.<br><br>you can include other dictionaries by putting #INCLUDE <pathname> at the end of the dictionary file you reference in rad_auth.conf.xml.<br>
if the INCLUDE doesn't work, just append dictionary.cisco to your dictionary file... and make your own file.<br><br><br>check inline comments down below...<br><br><br>T.<br><br><br><div class="gmail_quote"><div>
On Sun, Jul 31, 2011 at 10:46 AM, fieldpeak <span dir="ltr"><<a href="mailto:fieldpeak@gmail.com" target="_blank">fieldpeak@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Gurus,<br>
<br>
i met a issue when using<br>
mod_rad_auth(<a href="http://wiki.freeswitch.org/wiki/Mod_rad_auth" target="_blank">http://wiki.freeswitch.org/wiki/Mod_rad_auth</a>) to works<br>
with freeradius server+mysql for AAA, the details is below, Could<br>
anyone give any hints, Thanks in advance.<br>
<br>
i setup a dial plan "unitest_rad-ANI-auth" as wiki above, however,<br>
when i dialed 601 to trigger the dial plan, the console show errors,<br>
it looks "h323-conf-id" is not in the directory, then i tried to add<br>
this attribute to the dictionary, however, it does not help, in the<br>
wiki, it mentioned the rad_auth.conf.xml contains <param<br>
name="dictionary"<br>
value="/usr/local/etc/radiusclient/dictionary.all"/>, however i did<br>
not find the file "dictionary.all" at that directory, so i use<br>
dictionary. BTW, the freeradius server + mysql works well.<br></blockquote></div><div><br>i just appended the information needed into dictionary.all file... (vendor and attribute definition).<br><br> </div><div><div></div>
<div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204, 204, 204);padding-left:1ex">
<br>
console errors:<br>
<br>
EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> auth_function(in , in<br>
38516060333, in 003282, out AUTH_RESULT)<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:301 allocate initial<br>
structure.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:313 initialzed configuration.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set authserver<br>
:= 127.0.0.1:1812:gateway.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set dictionary<br>
:= /usr/local/etc/radiusclient/dictionary.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set seqfile :=<br>
/var/run/radius.seq.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set mapfile :=<br>
/usr/local/etc/radiusclient/port-id-map.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set default_realm := .<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set radius_timeout := 3.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set radius_retries := 2.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set radius_deadtime := 0.<br>
2011-07-31 16:23:24.717088 [DEBUG] mod_rad_auth.c:318 set bindaddr := *.<br>
2011-07-31 16:23:24.737004 [DEBUG] mod_rad_auth.c:371 ... radius:<br>
User-Name: 38516060333<br>
2011-07-31 16:23:24.737004 [DEBUG] mod_rad_auth.c:380 ... radius:<br>
User-Password: 003282<br>
2011-07-31 16:23:24.737004 [DEBUG] mod_rad_auth.c:391 ... radius:<br>
Called-station-Id is empty, ignoring...<br>
2011-07-31 16:23:24.737004 [DEBUG] mod_rad_auth.c:413 Handle<br>
attribute: h323-conf-id<br>
2011-07-31 16:23:24.737004 [ERR] mod_rad_auth.c:428 Unknown attribute:<br>
key:h323-conf-id, not found in dictionary<br>
2011-07-31 16:23:24.737004 [DEBUG] mod_rad_auth.c:538 abort sending<br>
radius packet.<br>
2011-07-31 16:23:24.737004 [ERR] mod_rad_auth.c:546 An error occured<br>
during RADIUS Authentication(RC=-1)<br>
2011-07-31 16:23:24.737004 [ERR] mod_rad_auth.c:702 An error occured<br>
during radius authorization.<br>
EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> log(INFO AUTH_RESULT=)<br>
2011-07-31 16:23:24.737004 [INFO] mod_dptools.c:1202 AUTH_RESULT=<br>
EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> log(INFO billing_model=)<br>
2011-07-31 16:23:24.737004 [INFO] mod_dptools.c:1202 billing_model=<br>
EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> log(INFO credit_amount=)<br>
2011-07-31 16:23:24.737004 [INFO] mod_dptools.c:1202 credit_amount=<br>
EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> log(INFO currency=)<br>
2011-07-31 16:23:24.737004 [INFO] mod_dptools.c:1202 currency=<br>
EXECUTE sofia/internal/<a href="mailto:1001@124.193.106.104" target="_blank">1001@124.193.106.104</a> log(INFO preffered_lang=)<br>
2011-07-31 16:23:24.737004 [INFO] mod_dptools.c:1202 preffered_lang=<br>
<br>
added below in the dictionary(/usr/local/etc/radiusclient/dictionary):<br>
<br>
ATTRIBUTE h323-conf-id 1008 string<br></blockquote></div></div><div><br>you need the vendor definition as well<br> </div><div><div></div><div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204, 204, 204);padding-left:1ex">
<br>
<br>
dial plan:<br>
<extension name="unitest_rad-ANI-auth"><br>
<condition field="destination_number" expression="^601$"><br>
<action application="log" data="INFO Before Auth "/><br>
<br>
<action inline="true" application="set"<br>
data="CALLID=h323-conf-id=${uuid}"/><br>
<action inline="true" application="set"<br>
data="SERVICENUM=h323-prompt-id=${destination_number}"/><br>
<action inline="true" application="set"<br>
data="TRANSACTIONID=h323-ivr-out=transactionID:1234"/><br>
<!-- <action inline="true" application="set"<br>
data="CALLINGNUMBER=${caller_id_number}"/> --><br>
<action inline="true" application="set" data="CALLINGNUMBER=38516060333"/><br>
<action inline="true" application="set" data="USERNAME=38516060333"/><br>
<!-- <action inline="true" application="set" data="USERNAME=209354"/> --><br>
<action inline="true" application="set" data="PASSWD=003282"/><br>
<!-- <action inline="true" application="set"<br>
data="DIALED_NUMBER=<a href="tel:16094191500" value="+16094191500" target="_blank">16094191500</a>"/> --><br>
<br>
<action application="sleep" data="2000"/><br>
<action application="auth_function" data="in ${DIALED_NUMBER},<br>
in ${USERNAME}, in ${PASSWD}, out AUTH_RESULT"/><br>
<br>
<br>
<action application="log" data="INFO AUTH_RESULT=${AUTH_RESULT}"/><br>
<action application="log" data="INFO billing_model=${billing_model}"/><br>
<action application="log" data="INFO credit_amount=${credit_amount}"/><br>
<action application="log" data="INFO currency=${currency}"/><br>
<action application="log" data="INFO preffered_lang=${preffered_lang}"/><br>
<action application="log" data="INFO credit_time=${credit_time}"/><br>
<action application="log" data="INFO<br>
h323_ivr_duration=${h323_ivr_duration}"/><br>
<action application="log" data="INFO return_code=${return_code}"/><br>
<!-- <action application="execute_extension" data="AUTH XML default"/> --><br>
</condition><br>
</extension><br>
<br>
radius_cdr.conf.xml:<br>
<configuration name="radius_cdr.conf" description="RADIUS CDR Configuration"><br>
<br>
<settings><br>
<br>
<!-- location of the radius dictionary files --><br>
<br>
<param name="dictionary"<br>
value="/usr/local/freeswitch/conf/radius/dictionary"/><br>
<br></blockquote></div></div><div><br>your dictionary file need to contain all the attributes you are trying to use or to include other dictionaries (In this case dictionary.cisco) from the dictionary file you are referencing here.<br>
</div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204, 204, 204);padding-left:1ex"><div>
<!-- number of retries for each server --><br>
<br>
<param name="radius_retries" value="3"/><br>
<br>
<!-- number of seconds to wait between retries --><br>
<br>
<param name="radius_timeout" value="5"/><br>
<br>
<!-- accounting servers, up to 8 allowed --><br>
<br>
<!-- value is "host:port:secret", port is optional --><br>
<br>
<!-- use IP ADDRESSES, not hostnames --><br>
<br>
<param name="acct_server" value="127.0.0.1:1813:testing123"/><br>
<br>
<br>
</settings><br>
<br>
</configuration><br>
<br>
the FS version:<br>
FreeSWITCH Version 1.0.head (git-492bc6b 2011-07-23 12-53-04 -0400)<br>
<br>
Regards,<br>
Charles<br>
<br></div>
_______________________________________________<br>
Join us at ClueCon 2011, Aug 9-11, Chicago<br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a> 877-7-4ACLUE<br>
<br>
FreeSWITCH-users mailing list<div><br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
</div><a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
</blockquote></div><br>
<br>_______________________________________________<br>
Join us at ClueCon 2011, Aug 9-11, Chicago<br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a> 877-7-4ACLUE<br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<br></blockquote></div><br>
</div></div></blockquote></div><br>
</div></div><br>_______________________________________________<br>
Join us at ClueCon 2011, Aug 9-11, Chicago<br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a> 877-7-4ACLUE<br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<br></blockquote></div><br>
</div></div><br>_______________________________________________<br>
Join us at ClueCon 2011, Aug 9-11, Chicago<br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a> 877-7-4ACLUE<br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<br></blockquote></div><br>