megadron 0 Posted 2009-10-02 11:53:22 Share Posted 2009-10-02 11:53:22 Подскажите кто может с такой проблемой: собрал stg-2.406 на Suse 11.1. все собралось и установилось без проблем. СТГ запустился вместе с модулем скула на ура. stgconf_xml тоже собрался без проблем. Но при попытке запускать WEB интерфейс в логах апача вылезает такая ошибка: ./sgconf_xml: symbol lookup error: //usr/lib/stg/libstg_common.so: undefined symbol: stgTime все библиотеки стоят и были собраны именно с этой версией стг Link to post Share on other sites
borin 0 Posted 2009-10-02 14:06:58 Share Posted 2009-10-02 14:06:58 Подскажите кто может с такой проблемой: собрал stg-2.406 на Suse 11.1. все собралось и установилось без проблем. СТГ запустился вместе с модулем скула на ура. stgconf_xml тоже собрался без проблем. Но при попытке запускать WEB интерфейс в логах апача вылезает такая ошибка: ./sgconf_xml: symbol lookup error: //usr/lib/stg/libstg_common.so: undefined symbol: stgTime все библиотеки стоят и были собраны именно с этой версией стг Скопируй эту библиотеку из stg-2.406/lib/ в /usr/lib/stg и будет те счастье. На сколько я знаю web-интерфейс Алферова не работает с версией 2.406, а sgconf_xml норм собирается и работает с новой версией. Link to post Share on other sites
megadron 0 Posted 2009-10-05 04:28:08 Share Posted 2009-10-05 04:28:08 я уже пробовал копировать эту библиотеку - не помогает. А что значит sgconf_xml собирается и работает, а вебморда нет? Вроде как раз этот модуль и отвечает за работу морды Link to post Share on other sites
Neelix 33 Posted 2009-10-05 04:53:43 Share Posted 2009-10-05 04:53:43 за работу веб морды много чего отвечает. там ушли от классической архитектуры управления Php Link to post Share on other sites
megadron 0 Posted 2009-10-05 05:55:05 Share Posted 2009-10-05 05:55:05 у меня при любом обращении к sgconf_xml вылезает ошибка : ./sgconf_xml: symbol lookup error: //usr/lib/stg/libstg_common.so: undefined symbol: stgTime вручную копирую все библиотеки - тоже самое Link to post Share on other sites
trinux 3 Posted 2009-10-05 06:55:23 Share Posted 2009-10-05 06:55:23 такая жо картинка. Link to post Share on other sites
yKpon 8 Posted 2009-12-01 17:26:20 Share Posted 2009-12-01 17:26:20 не собирается sgconf_xml stg:/stg-2.406/projects/sgconf_xml# ./build ############################################################################# Building sgconf_xml for Linux ############################################################################# Makeing crypto.lib rm -f deps libstg_crypto.so *.o *.a *.so tags *.*~ for file in ag_md5.h blowfish.h; do \ rm -f /stg-2.406/projects/stargazer/../../include/$file; \ done cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c ag_md5.cpp ag_md5.cpp: In function ‘char* libshadow_md5_crypt(const char*, const char*)’: ag_md5.cpp:324: warning: deprecated conversion from string constant to ‘char*’ cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c blowfish.cpp g++ -L/usr/local/lib -shared -Wl,-rpath,/usr/lib/stg -Wl,-soname,libstg_crypto.so ag_md5.o blowfish.o -o libstg_crypto.so -L /stg-2.406/projects/stargazer/../../lib ar rc libstg_crypto.a ag_md5.o blowfish.o ranlib libstg_crypto.a cp *.so /stg-2.406/projects/stargazer/../../lib cp *.a /stg-2.406/projects/stargazer/../../lib mkdir -m 0755 -p /usr/lib/stg install -m 0755 -o root -s libstg_crypto.so /usr/lib/stg/libstg_crypto.so Makeing common.lib rm -f deps libstg_common.so *.o *.a *.so tags *.*~ for file in debug.h stg_error.h common.h; do \ rm -f /stg-2.406/projects/stargazer/../../include/$file; \ done cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c debug.c cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c stg_error.c gmake: *** Нет правила для сборки цели `blowfish.h', требуемой для `common.o'. Останов. stg:/stg-2.406/projects/sgconf_xml# Link to post Share on other sites
madf 279 Posted 2009-12-01 18:16:59 Share Posted 2009-12-01 18:16:59 не собирается sgconf_xml stg:/stg-2.406/projects/sgconf_xml# ./build ############################################################################# Building sgconf_xml for Linux ############################################################################# Makeing crypto.lib rm -f deps libstg_crypto.so *.o *.a *.so tags *.*~ for file in ag_md5.h blowfish.h; do \ rm -f /stg-2.406/projects/stargazer/../../include/$file; \ done cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c ag_md5.cpp ag_md5.cpp: In function ‘char* libshadow_md5_crypt(const char*, const char*)’: ag_md5.cpp:324: warning: deprecated conversion from string constant to ‘char*’ cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c blowfish.cpp g++ -L/usr/local/lib -shared -Wl,-rpath,/usr/lib/stg -Wl,-soname,libstg_crypto.so ag_md5.o blowfish.o -o libstg_crypto.so -L /stg-2.406/projects/stargazer/../../lib ar rc libstg_crypto.a ag_md5.o blowfish.o ranlib libstg_crypto.a cp *.so /stg-2.406/projects/stargazer/../../lib cp *.a /stg-2.406/projects/stargazer/../../lib mkdir -m 0755 -p /usr/lib/stg install -m 0755 -o root -s libstg_crypto.so /usr/lib/stg/libstg_crypto.so Makeing common.lib rm -f deps libstg_common.so *.o *.a *.so tags *.*~ for file in debug.h stg_error.h common.h; do \ rm -f /stg-2.406/projects/stargazer/../../include/$file; \ done cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c debug.c cc -W -Wall -I/usr/local/include -DARCH_LE -fPIC -I /stg-2.406/projects/stargazer/../../include -I ./ -DLINUX -DSTG_TIME -c stg_error.c gmake: *** Нет правила для сборки цели `blowfish.h', требуемой для `common.o'. Останов. stg:/stg-2.406/projects/sgconf_xml# Стремный какой-то сборочный скрипт. Удаляет заголовочные файлы, сам библиотеки инсталлирует... Link to post Share on other sites
Kucher2 122 Posted 2009-12-06 10:05:15 Share Posted 2009-12-06 10:05:15 Да, беда прямо с вэб-мордой: в соседней ветке зазендили, непонятная лицензия на пол-года там зачем-то. А в этой даже сайт не пашет, скачать неоткуда. Да и не хотелось бы переходить с файлового хранилища на MySQL. :/ Хоть самому садись и пиши всё с нуля. Задача-то тривиальная: клиенту поставить роутер, за ним пару машин. Нужна авторизация. Придётся видимо "Всегда Онлайн" пользовать и примязку IP+MAC. С VPN пока не хочется связываться. Link to post Share on other sites
madf 279 Posted 2009-12-07 09:16:15 Share Posted 2009-12-07 09:16:15 Да, беда прямо с вэб-мордой: в соседней ветке зазендили, непонятная лицензия на пол-года там зачем-то. А в этой даже сайт не пашет, скачать неоткуда. Да и не хотелось бы переходить с файлового хранилища на MySQL. :/ Хоть самому садись и пиши всё с нуля. Задача-то тривиальная: клиенту поставить роутер, за ним пару машин. Нужна авторизация. Придётся видимо "Всегда Онлайн" пользовать и примязку IP+MAC. С VPN пока не хочется связываться. Как-то один знакомый админ говорил мне: "Хороший сисадмин должен быть немножечко программистом" Link to post Share on other sites
MiZtEriX 0 Posted 2010-02-04 20:33:20 Share Posted 2010-02-04 20:33:20 так как alf.uzlovaya.ru/stg/stg-web/ недоступна, может кто-нибудь выложит последние/предпоследние версии сборки? или дайте мне, я выложу... или они переехали? Link to post Share on other sites
yKpon 8 Posted 2010-03-31 07:05:31 Share Posted 2010-03-31 07:05:31 так как alf.uzlovaya.ru/stg/stg-web/ недоступна, может кто-нибудь выложит последние/предпоследние версии сборки? или дайте мне, я выложу... или они переехали? тоже присоединяюсь к вопросу!!! Link to post Share on other sites
invictius 0 Posted 2010-05-04 10:33:53 Share Posted 2010-05-04 10:33:53 Я с вами ребят, есть у кого SGCONF_XML? дайте ссылку плз. А то от 2.4-2007 сборки не подходит и не компилируется Link to post Share on other sites
madf 279 Posted 2010-05-05 07:17:01 Share Posted 2010-05-05 07:17:01 Я с вами ребят, есть у кого SGCONF_XML? дайте ссылку плз. А то от 2.4-2007 сборки не подходит и не компилируется А что говорит? Link to post Share on other sites
invictius 0 Posted 2010-05-05 18:50:02 Share Posted 2010-05-05 18:50:02 Я с вами ребят, есть у кого SGCONF_XML? дайте ссылку плз. А то от 2.4-2007 сборки не подходит и не компилируется А что говорит? # ./build ############################################################################# Building sgconf_xml for Linux ############################################################################# Makeing crypto.lib rm -f deps libstg_crypto.so *.o *.a *.so tags *.*~ for file in ag_md5.h blowfish.h; do \ rm -f /usr/local/stargazer/projects/sgconf/../../include/$file; \ done cc -DARCH_LE -fPIC -I /usr/local/stargazer/projects/sgconf/../../include -I ./ -DLINUX -DSTG_TIME -c ag_md5.cpp ag_md5.cpp: In function ‘char* libshadow_md5_crypt(const char*, const char*)’: ag_md5.cpp:324: warning: deprecated conversion from string constant to ‘char*’ cc -DARCH_LE -fPIC -I /usr/local/stargazer/projects/sgconf/../../include -I ./ -DLINUX -DSTG_TIME -c blowfish.cpp g++ -shared -Wl,-rpath,//usr/lib/stg -Wl,-soname,libstg_crypto.so ag_md5.o blowfish.o -o libstg_crypto.so -L /usr/local/stargazer/projects/sgconf/../../lib ar rc libstg_crypto.a ag_md5.o blowfish.o ranlib libstg_crypto.a cp *.so /usr/local/stargazer/projects/sgconf/../../lib cp *.a /usr/local/stargazer/projects/sgconf/../../lib mkdir -m 0755 -p //usr/lib/stg install -m 0755 -o root -s libstg_crypto.so //usr/lib/stg/libstg_crypto.so Makeing common.lib rm -f deps libstg_common.so *.o *.a *.so tags *.*~ for file in debug.h stg_error.h common.h; do \ rm -f /usr/local/stargazer/projects/sgconf/../../include/$file; \ done cc -DARCH_LE -fPIC -I /usr/local/stargazer/projects/sgconf/../../include -I ./ -DLINUX -DSTG_TIME -c debug.c cc -DARCH_LE -fPIC -I /usr/local/stargazer/projects/sgconf/../../include -I ./ -DLINUX -DSTG_TIME -c stg_error.c gmake: *** No rule to make target `blowfish.h', needed by `common.o'. Stop. # Версия СТГ Сервер, версия 2.406, от - 2009.09.16 SgConf_XML брал из сборки Alferov'a stg-2.4-2007.01.20-13.47.20 http://local.com.ua/forum/topic/9838-stargazer-mysql-freeradius-mysql-vpn-stg-web/ Теперь по поводу vpn: Пробую подключиться пользователем, который существует в MySQL. Стоит всегда On-Line, Денег 0, прописан ИП 192.168.100.236. # freeradius -X rad_recv: Access-Request packet from host 127.0.0.1 port 44741, id=85, length=152 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "qwertyu" MS-CHAP-Challenge = 0xdd5e4980410dd6a90943c2618f546ab0 MS-CHAP2-Response = 0xb000b9b17020482345e53992ba65bda3c2ee00000000000000007c89b543c45b7321c22b23279dca78d2587abb1dc96b08cc Calling-Station-Id = "192.168.100.236" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "qwertyu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for qwertyu with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> qwertyu attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 85 to 127.0.0.1 port 44741 Waking up in 4.9 seconds. Cleaning up request 7 ID 85 with timestamp +401 Ready to process requests. /etc/pptpd.conf logwtmp option /etc/ppp/options.pptpd #Диапазоны ВПНщиков remoteip 192.168.100.5-10 localip 192.168.100.4 /etc/ppp/options.pptpd name pptpd refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 # Два следующих параметра - адреса ДНС серверов ms-dns 192.168.100.3 ms-dns 212.152.60.4 debug proxyarp defaultroute lock nobsdcomp # Если все хорошо в п.2.2.5 то следующую строку нужно раскоментировать! plugin radius.so /etc/radiusclient/radiusclient.conf auth_order radius,local login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue # RADIUS settings authserver localhost acctserver localhost servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login /etc/radiusclient/servers # Make sure that this file is mode 600 (readable only to owner)! localhost wrh45wtrnw4u445n45n /etc/freeradius/radius.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius # Should likely be ${localstatedir}/lib/radiusd db_dir = ${raddbdir} # # libdir: Where to find the rlm_* modules. # # This should be automatically set at configuration time. # # If the server builds and installs, but fails at execution time # with an 'undefined symbol' error, then you can use the libdir # directive to work around the problem. # # The cause is usually that a library has been installed on your # system in a place where the dynamic linker CANNOT find it. When # executing as root (or another user), your personal environment MAY # be set up to allow the dynamic linker to find the library. When # executing as a daemon, FreeRADIUS MAY NOT have the same # personalized configuration. # # To work around the problem, find out which library contains that symbol, # and add the directory containing that library to the end of 'libdir', # with a colon separating the directory names. NO spaces are allowed. # # e.g. libdir = /usr/local/lib:/opt/package/lib # # You can also try setting the LD_LIBRARY_PATH environment variable # in a script which starts the server. # # If that does not work, then you can re-configure and re-build the # server to NOT use shared libraries, via: # # ./configure --disable-shared # make # make install # libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid #user = radius #group = radius max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # proxy IP to use for sending proxied packets # detail Read from the detail file. For examples, see # raddb/sites-available/copy-acct-to-home-server # type = auth # Note: "type = proxy" lets you control the source IP used for # proxying packets, with some limitations: # # * Only ONE proxy listener can be defined. # * A proxy listener CANNOT be used in a virtual server section. # * You should probably set "port = 0". # * Any "clients" configuration will be ignored. # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = * # OR, you can use an IPv6 address, but not both # at the same time. # ipv6addr = :: # any. ::1 == localhost # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" port = 0 # Some systems support binding to an interface, in addition # to the IP address. This feature isn't strictly necessary, # but for sites with many IP addresses on one interface, # it's useful to say "listen on all addresses for eth0". # # If your system does not support this feature, you will # get an error if you try to use it. # # interface = eth0 # Per-socket lists of clients. This is a very useful feature. # # The name here is a reference to a section elsewhere in # radiusd.conf, or clients.conf. Having the name as # a reference allows multiple sockets to use the same # set of clients. # # If this configuration is used, then the global list of clients # is IGNORED for this "listen" section. Take care configuring # this feature, to ensure you don't accidentally disable a # client you need. # # See clients.conf for the configuration of "per_socket_clients". # # clients = per_socket_clients } # This second "listen" section is for listening on the accounting # port, too. # listen { ipaddr = * # ipv6addr = :: port = 0 type = acct # interface = eth0 # clients = per_socket_clients } # hostname_lookups: Log the names of clients or just their IP addresses # e.g., www.freeradius.org (on) or 206.47.27.232 (off). # # The default is 'off' because it would be overall better for the net # if people had to knowingly turn this feature on, since enabling it # means that each client request will result in AT LEAST one lookup # request to the nameserver. Enabling hostname_lookups will also # mean that your server may stop randomly for 30 seconds from time # to time, if the DNS requests take too long. # # Turning hostname lookups off also means that the server won't block # for 30 seconds, if it sees an IP address which has no name associated # with it. # # allowed values: {no, yes} # hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' # if you're debugging a problem with the server. # # allowed values: {no, yes} # allow_core_dumps = no # Regular expressions # # These items are set at configure time. If they're set to "yes", # then setting them to "no" turns off regular expression support. # # If they're set to "no" at configure time, then setting them to "yes" # WILL NOT WORK. It will give you an error. # regular_expressions = yes extended_expressions = yes # # Logging section. The various "log_*" configuration items # will eventually be moved here. # log { # # Destination for log messages. This can be one of: # # files - log to "file", as defined below. # syslog - to syslog (see also the "syslog_facility", below. # stdout - standard output # stderr - standard error. # # The command-line option "-X" over-rides this option, and forces # logging to go to stdout. # destination = files # # The logging messages for the server are appended to the # tail of this file if destination == "files" # # If the server is running in debugging mode, this file is # NOT used. # file = ${logdir}/radius.log # # If this configuration parameter is set, then log messages for # a *request* go to this file, rather than to radius.log. # # i.e. This is a log file per request, once the server has accepted # the request as being from a valid client. Messages that are # not associated with a request still go to radius.log. # # Not all log messages in the server core have been updated to use # this new internal API. As a result, some messages will still # go to radius.log. Please submit patches to fix this behavior. # # The file name is expanded dynamically. You should ONLY user # server-side attributes for the filename (e.g. things you control). # Using this feature MAY also slow down the server substantially, # especially if you do thinks like SQL calls as part of the # expansion of the filename. # # The name of the log file should use attributes that don't change # over the lifetime of a request, such as User-Name, # Virtual-Server or Packet-Src-IP-Address. Otherwise, the log # messages will be distributed over multiple files. # #requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log # # Which syslog facility to use, if ${destination} == "syslog" # # The exact values permitted here are OS-dependent. You probably # don't want to change this. # syslog_facility = daemon # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # stripped_names = no # Log authentication requests to the log file. # # allowed values: {no, yes} # auth = no # Log passwords with the authentication requests. # auth_badpass - logs password if it's rejected # auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # auth_badpass = no auth_goodpass = no } # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad # SECURITY CONFIGURATION # # There may be multiple methods of attacking on the server. This # section holds the configuration items which minimize the impact # of those attacks # security { # # max_attributes: The maximum number of attributes # permitted in a RADIUS packet. Packets which have MORE # than this number of attributes in them will be dropped. # # If this number is set too low, then no RADIUS packets # will be accepted. # # If this number is set too high, then an attacker may be # able to send a small number of packets which will cause # the server to use all available memory on the machine. # # Setting this number to 0 means "allow any number of attributes" max_attributes = 200 # # reject_delay: When sending an Access-Reject, it can be # delayed for a few seconds. This may help slow down a DoS # attack. It also helps to slow down people trying to brute-force # crack a users password. # # Setting this number to 0 means "send rejects immediately" # # If this number is set higher than 'cleanup_delay', then the # rejects will be sent at 'cleanup_delay' time, when the request # is deleted from the internal cache of requests. # # Useful ranges: 1 to 5 reject_delay = 1 # # status_server: Whether or not the server will respond # to Status-Server requests. # # When sent a Status-Server message, the server responds with # an Access-Accept or Accounting-Response packet. # # # Useful ranges: 1 to 5 reject_delay = 1 # # status_server: Whether or not the server will respond # to Status-Server requests. # # When sent a Status-Server message, the server responds with # an Access-Accept or Accounting-Response packet. # # This is mainly useful for administrators who want to "ping" # the server, without adding test users, or creating fake # accounting packets. # # It's also useful when a NAS marks a RADIUS server "dead". # The NAS can periodically "ping" the server with a Status-Server # packet. If the server responds, it must be alive, and the # NAS can start using it for real requests. # status_server = yes } # PROXY CONFIGURATION # # proxy_requests: Turns proxying of RADIUS requests on or off. # # The server has proxying turned on by default. If your system is NOT # set up to proxy requests to another server, then you can turn proxying # off here. This will save a small amount of resources on the server. # # If you have proxying turned off, and your configuration files say # to proxy a request, then an error message will be logged. # # To disable proxying, change the "yes" to "no", and comment the # $INCLUDE line. # # allowed values: {no, yes} # proxy_requests = yes $INCLUDE proxy.conf # CLIENTS CONFIGURATION # # Client configuration is defined in "clients.conf". # # The 'clients.conf' file contains all of the information from the old # 'clients' and 'naslist' configuration files. We recommend that you # do NOT use 'client's or 'naslist', although they are still # supported. # # Anything listed in 'clients.conf' will take precedence over the # information from the old-style configuration files. # $INCLUDE clients.conf # THREAD POOL CONFIGURATION # # The thread pool is a long-lived group of threads which # take turns (round-robin) handling any incoming requests. # # You probably want to have a few spare threads around, # otherwise they'll be sitting there taking up resources, and # not doing anything productive. # # The numbers given below should be adequate for most situations. # thread pool { # Number of servers to start initially --- should be a reasonable # ballpark figure. start_servers = 5 # Limit on the total number of servers running. # # If this limit is ever reached, clients will be LOCKED OUT, so it # should NOT BE SET TOO LOW. It is intended mainly as a brake to # keep a runaway server from taking the system with it as it spirals # down... # # You may find that the server is regularly reaching the # 'max_servers' number of threads, and that increasing # 'max_servers' doesn't seem to make much difference. # # If this is the case, then the problem is MOST LIKELY that max_servers = 32 # Server-pool size regulation. Rather than making you guess # how many servers you need, FreeRADIUS dynamically adapts to # the load it sees, that is, it tries to maintain enough # servers to handle the current load, plus a few spare # servers to handle transient load spikes. # # It does this by periodically checking how many servers are # waiting for a request. If there are fewer than # min_spare_servers, it creates a new spare. If there are # more than max_spare_servers, some of the spares die off. # The default values are probably OK for most sites. # min_spare_servers = 3 max_spare_servers = 10 # There may be memory leaks or resource allocation problems with # the server. If so, set this value to 300 or so, so that the # resources will be cleaned up periodically. # # This should only be necessary if there are serious bugs in the # server which have not yet been fixed. # # '0' is a special value meaning 'infinity', or 'the servers never # exit' max_requests_per_server = 0 } # MODULE CONFIGURATION # # The names and configuration of each module is located in this section. # # After the modules are defined here, they may be referred to by name, # in other sections of this configuration file. # modules { # # Each module has a configuration as follows: # # name [ instance ] { # config_item = value # ... # } # # The 'name' is used to load the 'rlm_name' library # which implements the functionality of the module. # # The 'instance' is optional. To have two different instances # of a module, it first must be referred to by 'name'. # The different copies of the module are then created by # inventing two 'instance' names, e.g. 'instance1' and 'instance2' # # The instance names can then be used in later configuration # INSTEAD of the original 'name'. See the 'radutmp' configuration # for an example. # # # As of 2.0.5, most of the module configurations are in a # sub-directory. Files matching the regex /[a-zA-Z0-9_.]+/ # are loaded. The modules are initialized ONLY if they are # referenced in a processing section, such as authorize, # authenticate, accounting, pre/post-proxy, etc. # $INCLUDE ${confdir}/modules/ # Extensible Authentication Protocol # # For all EAP related authentications. # Now in another file, because it is very large. # # $INCLUDE eap.conf # Include another file that has the SQL-related configuration. # This is another file only because it tends to be big. # $INCLUDE sql.conf # # This module is an SQL enabled version of the counter module. # # Rather than maintaining seperate (GDBM) databases of # accounting info for each counter, this module uses the data # stored in the raddacct table by the sql modules. This # module NEVER does any database INSERTs or UPDATEs. It is # totally dependent on the SQL module to process Accounting # packets. # $INCLUDE sql/mysql/counter.conf #$INCLUDE sql/postgresql/counter.conf # # IP addresses managed in an SQL table. # #$INCLUDE sqlippool.conf # OTP token support. Not included by default. # $INCLUDE otp.conf } # Instantiation # # This section orders the loading of the modules. Modules # listed here will get loaded BEFORE the later sections like # authorize, authenticate, etc. get examined. # # This section is not strictly needed. When a section like # authorize refers to a module, it's automatically loaded and # initialized. However, some modules may not be listed in any # of the following sections, so they can be listed here. # # Also, listing modules here ensures that you have control over # the order in which they are initalized. If one module needs # something defined by another module, you can list them in order # here, and ensure that the configuration will be OK. # instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` exec expr # # We add the counter module here so that it registers # the check-name attribute before any module which sets # it # daily expiration logintime # subsections here can be thought of as "virtual" modules. # # e.g. If you have two redundant SQL servers, and you want to # use them in the authorize and accounting sections, you could # place a "redundant" block in each section, containing the # exact same text. Or, you could uncomment the following # lines, and list "redundant_sql" in the authorize and # accounting sections. # #redundant redundant_sql { # sql1 # sql2 #} } ###################################################################### # # Policies that can be applied in multiple places are listed # globally. That way, they can be defined once, and referred # to multiple times. # ###################################################################### $INCLUDE policy.conf ###################################################################### # # As of 2.0.0, the "authorize", "authenticate", etc. sections # are in separate configuration files, per virtual host. # ###################################################################### ###################################################################### # # Include all enabled virtual hosts. # # The following directory is searched for files that match # the regex: # # /[a-zA-Z0-9_.]+/ # # The files are then included here, just as if they were cut # and pasted into this file. # # See "sites-enabled/default" for some additional documentation. # $INCLUDE sites-enabled/ /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" # # Меняем следующие переменные: login, password, radius_db в зависимости от того, какой логин, пароль и название # базы данных вы выбрали в пункте 2.1.2 # login = "login" password = "parol" radius_db = "stg" deletestalesessions = yes sqltrace = no sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 connect_failure_retry_delay = 60 sql_user_name = "%{User-Name}" authorize_check_query = "SELECT id, login, 'User-Password' AS \"Attribute\", Password AS \"Value\", '==' AS \"op\" FROM users WHERE login = '%{SQL-User-Name}'" authorize_reply_query = "SELECT id, login, 'Framed-IP-Address' as \"Attribute\", IP as \"Value\", ':=' as \"op\" FROM users WHERE login = '%{SQL-User-Name}'" authorize_group_check_query = "SELECT '1' as \"id\",'default' AS \"GroupName\", 'Auth-Type' as \"Attribute\", 'MS-CHAP' as \"Value\", ':=' as \"op\" FROM users WHERE login='%{SQL-User-Name}'" /etc/stargazer/stargazer.conf ... <StoreModule store_mysql> dbuser = login rootdbpass = parol dbname = stg dbhost = localhost </StoreModule> ... <Module radius> Password = wrh45wtrnw4u445n45n ServerIP = 127.0.0.1 Port = 6666 AuthServices = Login-User AcctServices = Framed-User </Module> ... Link to post Share on other sites
madf 279 Posted 2010-05-06 07:08:14 Share Posted 2010-05-06 07:08:14 По первому пункту: собрать stg_crypto.lib и проверить что в lib появилась libstg_crypto.so, а в include - blowfish.h Link to post Share on other sites
invictius 0 Posted 2010-05-06 07:12:31 Share Posted 2010-05-06 07:12:31 По первому пункту: собрать stg_crypto.lib и проверить что в lib появилась libstg_crypto.so, а в include - blowfish.h Хм, а как это сделать? извиняюсь наверное за глупый вопрос. Link to post Share on other sites
madf 279 Posted 2010-05-06 07:12:51 Share Posted 2010-05-06 07:12:51 По второму пункту: Стоит определиться что все-таки использовать: rlm_stg + mod_radius (который включен в приведенном конфиге Stargazer'а) или rlm_sql с непосредственным доступом в базу Stargazer'а (который включен в приведенном конфиге радиуса). Замечу, что rlm_stg не работает с FreeRADIUS 2-й ветки (а судя по конфигам используется именно она). Хотя rlm_sql указан в modules, но судя по логу он не участвует в процессе авторизации/аутентификации и эти конфиги не приведены (sites-available/sites-enabled). Link to post Share on other sites
madf 279 Posted 2010-05-06 07:14:13 Share Posted 2010-05-06 07:14:13 По первому пункту: собрать stg_crypto.lib и проверить что в lib появилась libstg_crypto.so, а в include - blowfish.h Хм, а как это сделать? извиняюсь наверное за глупый вопрос. Ну после выполнения build в каталоге Stargazer она точно будет собрана и файлы будут в нужных местах. Link to post Share on other sites
invictius 0 Posted 2010-05-06 08:15:35 Share Posted 2010-05-06 08:15:35 1 пункт: Дык все установлено и сбилдино. Но этих библиотек нет. 2 пункт: Совсем запутался. Хочу использовать уже встроенный модуль радиуса, но не совсем понимаю как правильно это сделать. В папке /projects/...radius все скомпилил... В папке /projects/rlm_stg скомпили все... Настроил pptpd.conf и options.pptp включил Старгазер с поддержкой мускул_стор + радиус Запустил radiusclient Пробую подключиться и вот сыпиться.. все..., если не сложно, объясните как это все должно работать, думаю, будет всем это интересно, даже тем кто это сделал и понял, мб что-то подчерпнут... Link to post Share on other sites
madf 279 Posted 2010-05-06 09:21:35 Share Posted 2010-05-06 09:21:35 1 пункт: Дык все установлено и сбилдино. Но этих библиотек нет. 2 пункт: Совсем запутался. Хочу использовать уже встроенный модуль радиуса, но не совсем понимаю как правильно это сделать. В папке /projects/...radius все скомпилил... В папке /projects/rlm_stg скомпили все... Настроил pptpd.conf и options.pptp включил Старгазер с поддержкой мускул_стор + радиус Запустил radiusclient Пробую подключиться и вот сыпиться.. все..., если не сложно, объясните как это все должно работать, думаю, будет всем это интересно, даже тем кто это сделал и понял, мб что-то подчерпнут... По п.1: Есть ли в каталоге lib проекта файл libstg_crypto.so? Есть ли в каталоге include проекта файл blowfish.h? Если нет - нужно выполнить build проекта stargazer. По п.2: rlm_stg не работает с FreeRADIUS версий 2.x, а судя по логу используется именно эта ветка. Описание настроек модуля mod_radius есть в документации к Stargazer на странице 15. Описание настроек модуля rlm_stg есть в документации к Stargazer на странице 23. Примеры файлов конфигурации Stargazer, FreeRADIUS и pptpd есть в архиве с исходниками в каталоге projects/stargazer/scripts/shaper_vpn_radius. Еще раз отмечу, что это все будет работать только с FreeRADIUS версий 1.7.x. Другой вариант настройки (который будет работать как со старой так и с новой версией FreeRADIUS) - использование модуля rlm_sql. Судя по приведенным конфигам этот вариант и используется. Для него не нужен ни mod_radius, ни rlm_stg, ни, собственно, сам Stargazer. FreeRADIUS в этом варианте берет данные для авторизации клиента непосредственно из базы, минуя Stargazer. Судя по всему этот вариант недоконфигурирован, т.к. модуль rlm_sql не участвует ни в процессе авторизации (судя по логу FreeRADIUS): +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "qwertyu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Рекомендую почитать документацию на FreeRADIUS и разобраться как происходит авторизация и как включить в ее процесс модуль rlm_sql. Примеры настроек лежат в sites-available. Link to post Share on other sites
invictius 0 Posted 2010-05-06 09:32:06 Share Posted 2010-05-06 09:32:06 1 пункт: Дык все установлено и сбилдино. Но этих библиотек нет. 2 пункт: Совсем запутался. Хочу использовать уже встроенный модуль радиуса, но не совсем понимаю как правильно это сделать. В папке /projects/...radius все скомпилил... В папке /projects/rlm_stg скомпили все... Настроил pptpd.conf и options.pptp включил Старгазер с поддержкой мускул_стор + радиус Запустил radiusclient Пробую подключиться и вот сыпиться.. все..., если не сложно, объясните как это все должно работать, думаю, будет всем это интересно, даже тем кто это сделал и понял, мб что-то подчерпнут... По п.1: Есть ли в каталоге lib проекта файл libstg_crypto.so? Есть ли в каталоге include проекта файл blowfish.h? Если нет - нужно выполнить build проекта stargazer. По п.2: rlm_stg не работает с FreeRADIUS версий 2.x, а судя по логу используется именно эта ветка. Описание настроек модуля mod_radius есть в документации к Stargazer на странице 15. Описание настроек модуля rlm_stg есть в документации к Stargazer на странице 23. Примеры файлов конфигурации Stargazer, FreeRADIUS и pptpd есть в архиве с исходниками в каталоге projects/stargazer/scripts/shaper_vpn_radius. Еще раз отмечу, что это все будет работать только с FreeRADIUS версий 1.7.x. Другой вариант настройки (который будет работать как со старой так и с новой версией FreeRADIUS) - использование модуля rlm_sql. Судя по приведенным конфигам этот вариант и используется. Для него не нужен ни mod_radius, ни rlm_stg, ни, собственно, сам Stargazer. FreeRADIUS в этом варианте берет данные для авторизации клиента непосредственно из базы, минуя Stargazer. Судя по всему этот вариант недоконфигурирован, т.к. модуль rlm_sql не участвует ни в процессе авторизации (судя по логу FreeRADIUS): +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "qwertyu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Рекомендую почитать документацию на FreeRADIUS и разобраться как происходит авторизация и как включить в ее процесс модуль rlm_sql. Примеры настроек лежат в sites-available. Спасибо, буду ковыряться. 1 пункт Есть libstg_crypto.so нет файла blowfish.h. Сделал Билд... но ничего не изменилось. 2 пункт А не подскажете, какой вариант лучше и стабильнее? с rlm_stg или c rlm_sql? Link to post Share on other sites
madf 279 Posted 2010-05-06 09:58:43 Share Posted 2010-05-06 09:58:43 Скопируй blowfish.h из stg_crypto.lib в include По п.2 - хз. Сам эту схему не использую. Link to post Share on other sites
RnR 0 Posted 2014-01-20 13:13:29 Share Posted 2014-01-20 13:13:29 Доброго всем, сорри за никропост, У КОГО ОСТАЛСЯ STG-WEB ???? Слезно прошу выложить!!!!!! Link to post Share on other sites
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now