June 2006 - Freeradius-Users - lists.freeradius.org

Mikrotik & Simultaneous Use
by Italo Morellato 06 Jun '06

06 Jun '06

Hi, I have more than twenty Mikrotik RouterBoard, all device calling same freeradius server... now.. can I use "Simultaneous Use:=1" for check if a user is connected or not from another device? Thanks in advance.. Italo Morellato

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 19
by Gilbert Lo 06 Jun '06

06 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 18
by Gilbert Lo 05 Jun '06

05 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Excellent Position for a Sr. Software Engineer (Radius Applications) || GA || 6 months Contract
by Dharmendra Sachdeva 05 Jun '06

05 Jun '06

Hi, I have an urgent position for a Sr. Software Engineer in Atlanta, GA for a 6 months Contract. Please go through the requirement once you feel comfortable please reply me back with your Updated Resume in Word Format , Present Location , Expected Rate on hourly basis and Availability. Key Words: Radius (c or java) unix administration shell (cvs or ant or gdb or sh or "gnu c" or "sun java" ) ospf bgp (wan or "wide area network") (rf or microwave) (wireless or isp or adelphia) Required Skills: . C or Java system programming skills in a Unix environment. . Debugging multithreaded applications. . Knowledge of some Unix system administration skills. . Understanding of software development life cycle i.e. requirement, design, development, testing, deployment, and support. . Knowledge of basic software development tools and Unix shell script(s) i.e. .CVS, make, ant, gdb, sh, gnu C compiler, Sun Java compiler, and others. . Knowledge and experience with the RADIUS application. . Complex OSPF and BGP design in a large Wide Area Network environment. . RF/Microwave and Communication Systems, GIS Systems, and/or web portal-based authentication systems. Desired: Complex networks - both wired and wireless and in a large Internet Service Provider context. Job Description: Atlanta, GA # Of Openings: 1 6 months . Reports to Software Engineer Team Lead. . Core responsibility to troubleshoot and debug multithreaded applications. Thanks & Regards, Dharmendra Sachdeva cyberThink Inc. Tel : (908) 429-8008 x 390 Fax : (908) 429-8005 dharmendra(a)cyberThink.com mr.dharmendra(a)msn.com www.cyberThink.com cyberThink has been recognized as one of the fastest growing IT Services and Staffing companies in the U.S. by INC. magazine, Deloitte & Touche and Purple Squirrel.cyberThink Inc. is an Equal Opportunity Employer""We are open to hire US Citizens, Green Card holders & H1b Visa Holders"

2 1

Log files not being updated (version 2)
by Hugo Heriz-Smith 05 Jun '06

05 Jun '06

Hello, I meant to send this the other day, I goofed and just sent the output at the bottom - my apologies. I am running version 1.1.1 on FedoraCore 4. I am trying to get freeradius to work with our SkyPilot Extender DualBand AP as part of 802.1x. This is a very new to subject to me, but so far I've been able to install freeradius and I even had it running using MySQL successfully - I was able to test it using ntradping, and it responded as expected and the logs were added to properly. As part of the 802.1x setup, it turns out we need to be using eap and a few other things that I did not have running in this initial setup. The vendor was kind enough to send me a copy of a working raddb directory that they had along with some instructions. Because they were running version 1.1, I didn't want to just dump their files over mine.I first turned of the MySQL integration, tested again and it worked fine reading the text config files. I then compared their files to mine and made the changes that seemed appropriate. Now, when I start freeradius with 'radiusd -Xyfff', it boots up, and responds to requests as it should - but nothing gets added to the log file anymore. When this was originally working as expected, i was running radius as root. When I was comparing our files with the vendors and making the changes, my reading of the comments in the radius.conf file led me to believe I should run it as nobody instead. My first thought was that maybe I then had permission wrong on the log file -but changing the owner:group to nobody on the log didn't make a difference. I then changed it back to root and run radius as root (as I had been before) but no luck there either. I wonder if there's anything obvious to anyone in the output I get when I start freeradius (pasted below). I am hoping that don't have to revert to 1.1,but if that's the best way to get this to work, I'll do it for sure. Thanks for any suggestions. Hugo # radiusd -Xyfff Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = yes peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.

2 3

Excellent Position for a Sr. Software Engineer (Radius Applications) || GA || 6 months Contract
by Dharmendra Sachdeva 05 Jun '06

05 Jun '06

Hi, I have an urgent position for a Sr. Software Engineer in Atlanta, GA for a 6 months Contract. Please go through the requirement once you feel comfortable please reply me back with your Updated Resume in Word Format , Present Location , Expected Rate on hourly basis and Availability. Key Words: Radius (c or java) unix administration shell (cvs or ant or gdb or sh or "gnu c" or "sun java" ) ospf bgp (wan or "wide area network") (rf or microwave) (wireless or isp or adelphia) Required Skills: . C or Java system programming skills in a Unix environment. . Debugging multithreaded applications. . Knowledge of some Unix system administration skills. . Understanding of software development life cycle i.e. requirement, design, development, testing, deployment, and support. . Knowledge of basic software development tools and Unix shell script(s) i.e. .CVS, make, ant, gdb, sh, gnu C compiler, Sun Java compiler, and others. . Knowledge and experience with the RADIUS application. . Complex OSPF and BGP design in a large Wide Area Network environment. . RF/Microwave and Communication Systems, GIS Systems, and/or web portal-based authentication systems. Desired: Complex networks - both wired and wireless and in a large Internet Service Provider context. Job Description: Atlanta, GA # Of Openings: 1 6 months . Reports to Software Engineer Team Lead. . Core responsibility to troubleshoot and debug multithreaded applications. Thanks & Regards, Dharmendra Sachdeva cyberThink Inc. Tel : (908) 429-8008 x 390 Fax : (908) 429-8005 dharmendra(a)cyberThink.com mr.dharmendra(a)msn.com www.cyberThink.com cyberThink has been recognized as one of the fastest growing IT Services and Staffing companies in the U.S. by INC. magazine, Deloitte & Touche and Purple Squirrel.cyberThink Inc. is an Equal Opportunity Employer""We are open to hire US Citizens, Green Card holders & H1b Visa Holders"

1 0

Accounting Stop time is not inserting in radacct tables in Radius by using openser
by raviprakash sunkara 05 Jun '06

05 Jun '06

Hi please this Issuse ....... Radius server debug mode....... rad_recv: Accounting-Request packet from host 192.168.2.55:32807, id=58, length=221 Acct-Status-Type = Failed Service-Type = IAPP-AP-Check Sip-Response-Code = 0 Sip-Method = INVITE User-Name = "555(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> " Calling-Station-Id = "sip:555@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> " Called-Station-Id = "sip:666@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> " Sip-Translated-Request-URI = "sip:666@192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> " Acct-Session-Id = "E54D81BC-C463-446F-B0AF-DE1C3C6EC33D(a)192.168.2.21<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> " Sip-To-Tag = "n/a" Sip-From-Tag = "3693743074" Sip-Cseq = "34571" NAS-Port = 5060 Acct-Delay-Time = 0 NAS-IP-Address = 192.168.2.55 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 11 modcall[preacct]: module "preprocess" returns noop for request 11 rlm_realm: Looking up realm "192.168.2.55" for User-Name = "555(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> " rlm_realm: No such realm "192.168.2.55" modcall[preacct]: module "suffix" returns noop for request 11 modcall: leaving group preacct (returns noop) for request 11 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 11 rlm_acct_unique: Hashing 'NAS-Port = 5060,Client-IP-Address = 192.168.2.55,NAS-IP-Address = 192.168.2.55,Acct-Session-Id = "E54D81BC-C463-446F-B0AF-DE1C3C6EC33D(a)192.168.2.21<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…>",User-Name = "555(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> "' rlm_acct_unique: Acct-Unique-Session-ID = "ef0513de749b7034". modcall[accounting]: module "acct_unique" returns ok for request 11 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.2.55/detail-20060605' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.55/detail-20060605 rlm_detail: Failed to create directory /usr/local/var/log/radius/radacct/192.168.2.55: Permission denied modcall[accounting]: module "detail" returns fail for request 11 modcall: leaving group accounting (returns fail) for request 11 Finished request 11 Going to the next request Below one is openser.cfg file please help me #************************************************************************************************* modparam("usrloc", "db_mode", 2) modparam("auth_db", "password_column", "password") modparam("auth_db", "calculate_ha1", yes) modparam("usrloc|acc|auth_db|group|msilo", "db_url", "mysql://openser:openserrw@localhost/openser") ########333333 modparam("acc","log_level",1) modparam("acc","log_flag",1) modparam("acc","log_missed_flag",2) modparam("acc", "log_fmt", "cdfimorstup") modparam("acc", "failed_transaction_flag",3) modparam("acc", "report_cancels", 1) modparam("acc","report_ack",0) modparam("acc", "db_flag", 1) modparam("acc", "db_missed_flag", 2) modparam("acc","radius_flag",1) modparam("acc","radius_missed_flag",2) modparam("acc","service_type",16) modparam("acc","radius_config","/usr/local/etc/radiusclient-ng/radiusclient.conf") ##########33 modparam("nathelper","natping_interval",30) modparam("nathelper","ping_nated_only",1) modparam("nathelper", "rtpproxy_sock", "unix:/var/run/rtpproxy.sock") #################33 modparam("rr", "enable_full_lr", 1) ############################################### route { # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("13")) { sl_send_reply("483","Too Many Hops........................!"); exit; }; if ( msg:len > max_len ) { sl_send_reply("513", "Message too big"); exit; }; # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol record_route(); # loose-route processing if (loose_route()) { t_relay(); setflag(1); exit; }; # account completed transactions via syslog setflag(1); setflag(2); if(uri==myself) { if(method=="REGISTER") { if(!radius_www_authorize("192.168.2.55")) { www_challenge("192.168.2.55","1"); exit; }; save("location"); if (m_dump()) { log("MSILO: offline messages dumped - if they were\n"); }else{ log("MSILO: no offline messages dumped\n"); }; exit; }; if(method=="INVITE"|| method=="ACK") { acc_rad_request("Start"); record_route(); force_rtp_proxy(); #setflag(1); t_on_reply("1"); }; if (method=="BYE") { record_route(); }; if (method=="MESSAGE") { log(1, "MESSAGE\n"); setflag(1); /* set for accounting (the same value as in log_flag!) */ }; if (method=="BYE" || method=="CANCEL") { #log (1, "BYE or CANCEL\n"); #setflag(1); acc_rad_request("Stop"); setflag(1); }; if(!lookup("location")) { sl_send_reply("404","Woo......... NOt found"); }; }; lookup("aliases"); setflag(2); if(!t_relay()) { sl_reply_error(); }; } onreply_route[1] { if(status=~"[0-9][0-9][0-9]") { force_rtp_proxy(); }; } ....................... Naslist file in raddb(radius_server..... 192.168.2.55 radiustest other 192.168.2.20 hyperion1 other 192.168.2.21 hyperion2 other .........................hintsGroups.......... 555(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> NAS-IP-ADDRESS == 192.168.2.21 666(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> NAS-IP-ADDRESS == 192.168.2.20 ...................................... .................radiusclient.conf ........ authserver 192.168.2.55 acctserver 192.168.2.55 ......................servers.................. 192.168.2.55 radiustest 192.168.2.20 hyperion1 192.168.2.21 hyperion2 ...................Radacct tables.......... id UserName Attribute op value --------------------------------------------------- 4 555(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> Password == test2 5 666(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> Password == test3 -------------------------------------------------------- RadgroupCheck...... id GroupName Attribute op value 5 voip Auth-Type := Digest ************************************************************ RadgroupReply... id GroupName Attribute op Value 56 voip Service-Type := Sip-Session ............................................................ UserGroup UserName Group Priority 555(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> Voip 4 666(a)192.168.2.55<https://email.secureserver.net/view.php?folder=INBOX.Sent_Items&uid=69#Comp…> voip 5 ---------------------------------------------------------- -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com <b>

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 17
by Gilbert Lo 05 Jun '06

05 Jun '06

I am on holiday between June 3 to June 10. I will return to my office on June 11. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

How to make a persistent counter?
by Kenneth Marshall 05 Jun '06

05 Jun '06

Dear FreeRADIUS users: I am trying to implement some load balancing for our wireless network. Each user needs to be placed in a different VLAN to distribute the use of each one. If I had a persistent counter that I could access, I could use the rlm_expr module to take the modulus of the counter and use that to generate the next candidate VLAN. Does anyone have any idea about how that could be accomplished? Ken

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 16
by Gilbert Lo 05 Jun '06

05 Jun '06

I am on holiday between June 3 to June 10. I will return to my office on June 11. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0