August 2005 - Freeradius-Users - lists.freeradius.org

freeradius + chillispot + PDA
by yuniva wati 09 Aug '05

09 Aug '05

I have some problem, can we use freeradius and chillispot as a login window show at PDA?? because that i know, freeradius use at personal computer or notebook. thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: different eap/tls config for different interfaces
by ragan_davis＠colstate.edu 08 Aug '05

08 Aug '05

Makes sense. I'm doing EAP-TTLS with LDAP. I probably wouldn't need to define 2 diff ldap instances, since they'd both point to the same ldap server. However, I wonder if the ":=" operator would cause freeradius to ignore any other auth methods (such as ldap)? Doesn't that act as an "override" of sorts, or am I way off? thanks! ----- Original Message ----- From: Michael Griego <mgriego(a)utdallas.edu> Date: Monday, August 8, 2005 5:53 pm Subject: Re: different eap/tls config for different interfaces > By its Client-IP-Address attribute or NAS-IP-Address attribute. > > Also, you can use the Packet-Dst-IP-Address attribute if you're > certain > that the clients are split up by interface. You can match up > based on > incoming interface like you were thinking about doing with two > different > servers. So, if your server is listening on 10.0.0.1 and > 10.0.1.1, and > your EAP modules are named EAPauth1 and EAPauth2, you could do: > > DEFAULT Packet-Dst-IP-Address == 10.0.0.1, EAP-Message =* "", Auth- > Type > := EAPauth1 > > DEFAULT Packet-Dst-IP-Address == 10.0.1.1, EAP-Message =* "", Auth- > Type > := EAPauth2 > > This functionality may only be CVS snapshots, though. I'm not > sure as I > haven't looked to see if it exists in the production releases. > > --Mike > > ragan_davis(a)colstate.edu wrote: > > >Mike, > > > >Sounds good, thanks for the info. Just curious: In the dual eap- > tls > >configuration that you mentioned in the second paragraph, how > would > >the radius server know which one to use for a given client? > > > >thanks! > > > >----- Original Message ----- > >From: Michael Griego <mgriego(a)utdallas.edu> > >Date: Friday, August 5, 2005 11:34 pm > >Subject: Re: different eap/tls config for different interfaces > > > > > > > >>After I'm done with the rlm_eap_tls rewrites and rlm_eap > updates, > >>there > >>will be functionality to have multiple EAP submodules of the > same > >>type > >>with different configurations. With this, you'll be able to > force > >>the > >>use of a specific EAP type instance by its instance name. > >> > >>In the meantime, if you want to avoid bringing up two servers, > you > >>*can* > >>configure two EAP module instances, each with a different tls > >>submodule > >>configuration. Force the Auth-Type to the EAP module with the > >>correct > >>tls configuration based on your criteria. I've used this > scenario > >>in > >>the past. > >> > >>--Mike > >> > >> > >>ragan_davis(a)colstate.edu wrote: > >> > >> > >> > >>>Oh...duh...that makes sense. Should have considered that. I > >>> > >>> > >>have since > >> > >> > >>>tested the behavior of the scenario I described, and Alan's on > >>> > >>> > >>target. > >> > >> > >>>Doesn't really seem to matter which interface I enter on, or which > >>>common-name I use. Seems to work either way. > >>> > >>>thanks for the help! > >>> > >>>----- Original Message ----- > >>>From: Kris Benson <kbenson(a)sd57.bc.ca> > >>>Date: Friday, August 5, 2005 5:28 pm > >>>Subject: Re: different eap/tls config for different interfaces > >>> > >>> > >>> > >>> > >>> > >>>>>ragan_davis(a)colstate.edu wrote: > >>>>> > >>>>> > >>>>> > >>>>> > >>>>>>If so, is it possible to have 2 different tls sections that > >>>>>> > >>>>>> > >>service>>>>the 2 different interfaces? > >> > >> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>No. FreeRADIUS supports only 1 TLS module at a time. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>What Alan forgot to mention is a solution. > >>>> > >>>>If you run two copies of the Radius server, with one bound to > >>>>either a > >>>>different set of ports, or one to each IP, you could have > >>>> > >>>> > >>separate > >> > >> > >>>>configs. > >>>>-kb > >>>>-- > >>>>Kris Benson, CCP, I.S.P. > >>>>Technical Analyst, District Projects > >>>>School District #57 (Prince George) > >>>> > >>>>- > >>>>List info/subscribe/unsubscribe? See > >>>>http://www.freeradius.org/list/users.html > >>>> > >>>> > >>>> > >>>> > >>>- > >>>List info/subscribe/unsubscribe? See > >>> > >>> > >>http://www.freeradius.org/list/users.html> > >> > >> > >>- > >>List info/subscribe/unsubscribe? See > >>http://www.freeradius.org/list/users.html > >> > >> > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html> > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: different eap/tls config for different interfaces
by ragan_davis＠colstate.edu 08 Aug '05

08 Aug '05

Mike, Sounds good, thanks for the info. Just curious: In the dual eap-tls configuration that you mentioned in the second paragraph, how would the radius server know which one to use for a given client? thanks! ----- Original Message ----- From: Michael Griego <mgriego(a)utdallas.edu> Date: Friday, August 5, 2005 11:34 pm Subject: Re: different eap/tls config for different interfaces > After I'm done with the rlm_eap_tls rewrites and rlm_eap updates, > there > will be functionality to have multiple EAP submodules of the same > type > with different configurations. With this, you'll be able to force > the > use of a specific EAP type instance by its instance name. > > In the meantime, if you want to avoid bringing up two servers, you > *can* > configure two EAP module instances, each with a different tls > submodule > configuration. Force the Auth-Type to the EAP module with the > correct > tls configuration based on your criteria. I've used this scenario > in > the past. > > --Mike > > > ragan_davis(a)colstate.edu wrote: > > >Oh...duh...that makes sense. Should have considered that. I > have since > >tested the behavior of the scenario I described, and Alan's on > target. > >Doesn't really seem to matter which interface I enter on, or which > >common-name I use. Seems to work either way. > > > >thanks for the help! > > > >----- Original Message ----- > >From: Kris Benson <kbenson(a)sd57.bc.ca> > >Date: Friday, August 5, 2005 5:28 pm > >Subject: Re: different eap/tls config for different interfaces > > > > > > > >>>ragan_davis(a)colstate.edu wrote: > >>> > >>> > >>>>If so, is it possible to have 2 different tls sections that > service>>>>the 2 different interfaces? > >>>> > >>>> > >>> No. FreeRADIUS supports only 1 TLS module at a time. > >>> > >>> > >>What Alan forgot to mention is a solution. > >> > >>If you run two copies of the Radius server, with one bound to > >>either a > >>different set of ports, or one to each IP, you could have > separate > >>configs. > >>-kb > >>-- > >>Kris Benson, CCP, I.S.P. > >>Technical Analyst, District Projects > >>School District #57 (Prince George) > >> > >>- > >>List info/subscribe/unsubscribe? See > >>http://www.freeradius.org/list/users.html > >> > >> > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html> > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 3

hot spot, each additional minute scenario
by Will Carter 08 Aug '05

08 Aug '05

Hi, I am wondering if anyone out there has implemented freeradius in a wifi hotspot where you bill a user's credit card for amount for a certain amount of time that they purchase upfront and then for each additional minute that they want to continue, its an additional charge per minute? I am kind of hung up on how the additional minutes can be added for a user in freeradius in conjunction with how the credit card processing would work in this type of scenario. Currently we have it so that once the user hits their expiration in radius, they have to buy more time to keep going. Any ideas would be great. -will

2 1

Question on sql.conf -> accounting_start_query <-> accounting_start_query_alt
by Andreas Engler 08 Aug '05

08 Aug '05

Hello, to prevent duplicate entries in the radacct table, shouldn't the accounting_start_query be the "UPDATE" query and the accounting_start_query_alt be the "INSERT into" query as it is the case on stop and update. In which case would the accounting_start_query fail and the accounting_start_query_alt work? Could someone point me in the right direction? I know, that freeradius manages handled retransmitted Acct-Requests, so duplicate entries only would show up if at some point it wouldn't remember. I don't know if this is impossible. Thank you. Andreas

3 4

Freeradius as Authenticator
by Florian Prester 08 Aug '05

08 Aug '05

Hi, after testing and reading a lot of documentation, I have some questions. First my szenario: I want to use a freeradiusserver fpr authentication. The Users are stored in a LDAP-service. I have different user classes: 1.) Dialin-users: using PAP 2.) VPN-users: using PAP 3.) WLAN-Users: should work with EAP-TTLS/PEAP and MSCHAPV2 of PAP Why PAP? because I have an unix-community to supply and we do not want to have cleartext-passwords anywhere in our network (I know with PAP the cleartextpassword is sent to the radiusserver! But the radiusserver has none!) With MSCHAP we are using the NT-password ( I know it is not realy crypted, but still better than cleartext!) Now, how can I use PAP authentication with EAP-TTLS? - I read some mail before, but I still cannot get it working!! Meaning if I have an local user, defined in the useres.conf it works, but if I try to get the Informations from the LDAP-Server, the following error occours: rlm_ldap: user unrz148 authorized to use remote access Thu Aug 4 08:44:33 2005 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Aug 4 08:44:33 2005 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 5 Thu Aug 4 08:44:33 2005 : Debug: modcall[authorize]: module "ldap" returns ok for request 5 Thu Aug 4 08:44:33 2005 : Debug: modcall: group authorize returns ok for request 5 Thu Aug 4 08:44:33 2005 : Debug: rad_check_password: Found Auth-Type LDAP Thu Aug 4 08:44:33 2005 : Debug: auth: type "LDAP" Thu Aug 4 08:44:33 2005 : Debug: ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. Thu Aug 4 08:44:33 2005 : Debug: auth: Failed to validate the user. Any hints for me? Also I have the problem with the difference between local and LDAP informations in generell. If I use a local-user everything works fine. If I use a LDAP-user he/she can authenticate, but later on the wpa_supplicant (supplicant fpr teh WLAN-users trying to do WPA) is accepting the authentication but not initiating the WPA-connection? With local-users and the same client-configuration everything works fine? Is it a problem within freeradius or wpa-supplicant?? Thanks Florian -------------------------------------------------------------- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Germany Tel.: +499131 8527813

2 3

tacacs+ support
by Alan DeKok 08 Aug '05

08 Aug '05

http://bugs.freeradius.org/show_bug.cgi?id=254 It's not integrated into FreeRADIUS, but it appears to work. It runs as a separate daemon, and has certin limitations. But it does work... The next step is to integrate the code into the server core. It's only a few thousand lines (with comments), so it shouldn't be too hard. Alan DeKok.

5 5

IPv6
by gennaro amelio 08 Aug '05

08 Aug '05

Hi, can i send IPv6 packets to FreeRadius(i use 1.0.2)? Thanks in advance. Gennaro.

2 1

Message-Authenticator and Proxy
by Xavier 07 Aug '05

07 Aug '05

Hi All. We are experiencing a problem with our Radius proxy server which is running FreeRADIUS 1.0.2 : When FR poxies the request, it resets the Message-Authenticator attribute to zero in a Access-Request packet. therefore the radius server (third party) answers sometimes Accept and sometimes reject. We suppose that this server is buggy or does not support the Message-Authenticator attribute. I looked in the RFCs but none discuss about Message-Authenticator and proxy. I suppose the proxy should re-calculate the Message-Authenticator and rewrite it to the forwarded packet, but this is not the case of FreeRADIUS. In order to solve this problem I need to know if FreeRADIUS has the good behaviour. I tried also to suppress the Message-Authenticator attribute with the attr_rewrite module, but I didn't manage to. Below is the debug output of FreeRADIUS : Accepted Request : rad_recv: Access-Request packet from host 132.113.29.88:13165, id=211, length=181 Acct-Session-Id = "73a67d36" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x63f6f96ba2bf5891c93e86ba3438422c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy authentication request to realm "wifi" modcall[authorize]: module "suffix" returns updated for request 12 modcall[authorize]: module "degrade" returns notfound for request 12 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "tempacc" returns ok for request 12 modcall: group authorize returns updated for request 12 Sending Access-Request of id 11 to 192.168.2.23:1812 Acct-Session-Id = "73a67d36" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323131 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Accept packet from host 192.168.2.23:1812, id=11, length=49 Session-Timeout = 35666 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x323131 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 12 modcall[authorize]: module "degrade" returns notfound for request 12 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "tempacc" returns ok for request 12 modcall: group authorize returns ok for request 12 rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [JOHN@wifi] (from client Nomadix port 1 cli 00-0C-F1-38-14-AA) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 12 rlm_sql (sql): Processing sql_postauth radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 12 modcall: group post-auth returns ok for request 12 Sending Access-Accept of id 211 to 132.113.29.88:13165 Session-Timeout = 35666 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Idle-Timeout = 60 Finished request 12 Going to the next request Waking up in 1 seconds... rad_recv: Accounting-Request packet from host 132.113.29.88:13165, id=0, length=150 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Start Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:15 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Framed-IP-Address = 10.0.0.10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 13 modcall[preacct]: module "preprocess" returns noop for request 13 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 132.113.29.88,NAS-IP-Address = 192.168.1.250,Acct-Session-Id = "73a67d36",User-Name = "JOHN@wifi"' rlm_acct_unique: Acct-Unique-Session-ID = "876079519f963dc1". modcall[preacct]: module "acct_unique" returns ok for request 13 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy accounting request to realm "wifi" modcall[preacct]: module "suffix" returns updated for request 13 modcall: group preacct returns updated for request 13 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 13 radius_xlat: '/var/log/freeradius/radacct/132.113.29.88/detail-20050805' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/132.113.29.88/detail-20050805 rlm_detail: Freeradius-Proxied-To set to 192.168.2.23 modcall[accounting]: module "detail" returns ok for request 13 radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('73a67d36', '876079519f963dc1', 'JOHN@wifi', 'wifi', '192.168.1.250', '1', 'Wireless-802.11', '2005-08-05 16:49:36', '0', '0', 'RADIUS', '', '', '0', '0', '00-03-52-01-8E-25', '00-0C-F1-38-14-AA', '', '', '', '10.0.0.10', '0', '0')' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 modcall[accounting]: module "sql" returns ok for request 13 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'JOHN@wifi' modcall[accounting]: module "radutmp" returns ok for request 13 modcall: group accounting returns ok for request 13 Sending Accounting-Request of id 1 to 192.168.2.23:1813 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Start Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:15 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Framed-IP-Address = 10.0.0.10 Proxy-State = 0x30 Waking up in 1 seconds... rad_recv: Accounting-Response packet from host 192.168.2.23:1813, id=1, length=41 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x30 Sending Accounting-Response of id 0 to 132.113.29.88:13165 Finished request 13 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Accounting-Request packet from host 132.113.29.88:13165, id=115, length=198 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Stop Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:25 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Acct-Session-Time = 11 Acct-Input-Octets = 5342 Acct-Input-Gigawords = 0 Acct-Input-Packets = 8 Acct-Output-Octets = 682 Acct-Output-Gigawords = 0 Acct-Output-Packets = 7 Acct-Terminate-Cause = User-Request Framed-IP-Address = 10.0.0.10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 14 modcall[preacct]: module "preprocess" returns noop for request 14 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 132.113.29.88,NAS-IP-Address = 192.168.1.250,Acct-Session-Id = "73a67d36",User-Name = "JOHN@wifi"' rlm_acct_unique: Acct-Unique-Session-ID = "876079519f963dc1". modcall[preacct]: module "acct_unique" returns ok for request 14 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy accounting request to realm "wifi" modcall[preacct]: module "suffix" returns updated for request 14 modcall: group preacct returns updated for request 14 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 14 radius_xlat: '/var/log/freeradius/radacct/132.113.29.88/detail-20050805' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/132.113.29.88/detail-20050805 rlm_detail: Freeradius-Proxied-To set to 192.168.2.23 modcall[accounting]: module "detail" returns ok for request 14 radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2005-08-05 16:49:47', AcctSessionTime = '11', AcctInputOctets = '5342', AcctOutputOctets = '682', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '73a67d36' AND UserName = 'JOHN@wifi' AND NASIPAddress = '192.168.1.250'' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 modcall[accounting]: module "sql" returns ok for request 14 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'JOHN@wifi' rlm_radutmp: Logout for NAS Nomadix port 1, but no Login record modcall[accounting]: module "radutmp" returns ok for request 14 modcall: group accounting returns ok for request 14 Sending Accounting-Request of id 2 to 192.168.2.23:1813 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Stop Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:25 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Acct-Session-Time = 11 Acct-Input-Octets = 5342 Acct-Input-Gigawords = 0 Acct-Input-Packets = 8 Acct-Output-Octets = 682 Acct-Output-Gigawords = 0 Acct-Output-Packets = 7 Acct-Terminate-Cause = User-Request Framed-IP-Address = 10.0.0.10 Proxy-State = 0x313135 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Accounting-Response packet from host 192.168.2.23:1813, id=2, length=43 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x313135 Sending Accounting-Response of id 115 to 132.113.29.88:13165 Finished request 14 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 14 ID 115 with timestamp 42f37c8b Nothing to do. Rejected request : rad_recv: Access-Request packet from host 132.113.29.88:13165, id=1, length=181 Acct-Session-Id = "41705ece" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x97c0f2889372bfd63d04904e75dde9c9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy authentication request to realm "wifi" modcall[authorize]: module "suffix" returns updated for request 15 modcall[authorize]: module "degrade" returns notfound for request 15 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "tempacc" returns ok for request 15 modcall: group authorize returns updated for request 15 Sending Access-Request of id 12 to 192.168.2.23:1812 Acct-Session-Id = "41705ece" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x31 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Reject packet from host 192.168.2.23:1812, id=12, length=41 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x31 Login incorrect (Home Server says so): [JOHN@wifi/mypass] (from client Nomadix port 1 cli 00-0C-F1-38-14-AA) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 15 rlm_sql (sql): Processing sql_postauth radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Reject', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Reject', NOW()) rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 modcall[post-auth]: module "sql" returns ok for request 15 modcall: group Post-Auth-Type returns ok for request 15 Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 1 to 132.113.29.88:13165 Waking up in 4 seconds. Regards, Xavier.

2 1

Re. Max-Daily-Session
by Shannon Sariman 06 Aug '05

06 Aug '05

Nick White wrote: "Can I set "Max-Daily-Session = 1800" in the radgroupcheck table (MySQL), and if so is the max of 1800 set for the entire group, or for each user in that group?" The max of 1800 will be set for the entire group. I you want to apply max of 1800 for certain users that don't belong to the group then use radcheck table. Cheers, Shannon "From the land of the unexpected".

2 1