September 2006 - Freeradius-Users - lists.freeradius.org

WPA/RADIUS Problems
by Loukas Kalenderidis 07 Sep '06

07 Sep '06

Hi list, I'm a FreeRADIUS noob, and I've been charged with getting some WiFi APs authenticating against an existing FreeRADIUS server being used for dialup users. I've configured FreeRADIUS as best I can figure from what I've found on the web, but I'm having no success with getting WPA to work. I'm using a D-Link 2100AP access point, and a Mac OS X 10.4 client. From what I can gather it seems that I might have misconfigured FreeRADIUS, based on the error message below. I've configured a test user as follows: pants Auth-Type := Accept Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1 The last 3 lines I found in a tutorial on the web, but I'm not sure if they are necessary or not (and commenting them out makes no difference). When I run radtest everything looks OK: $ radtest pants "" localhost 1 XXXXXX Sending Access-Request of id 141 to 127.0.0.1:1812 User-Name = "pants" User-Password = "" NAS-IP-Address = newdeewhy NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=141, length=35 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" When I try to connect from my Mac OS X client I get the following error: And the following appears in the radius.log: Fri Sep 1 15:50:59 2006 : Auth: Login OK: [pants] (from client testap port 1 cli 00-0D-93-86-48-8E) Fri Sep 1 15:51:02 2006 : Error: Authentication reply packet code 2 sent to a non-proxy reply port from client testap:1025 - ID 0 : IGNORED Watching the traffic shows the Access-Accept packet being sent back to the AP, but confusingly the AP sends an Access-Accept back to the RADIUS server! (10.0.0.100 is the AP, 10.0.0.101 is the RADIUS server): # tcpdump -nXi eth1 -s 65535 host 10.0.0.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 16:08:43.990613 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x00 length: 193 0x0000: 4500 00dd 0008 0000 4011 6540 0a00 0064 E.......@.e@...d 0x0010: 0a00 0065 0403 0714 00c9 0613 0100 00c1 ...e............ 0x0020: 3daa 0458 77d9 5edd 5149 6230 7717 7c71 =..Xw.^.QIb0w.|q 0x0030: 5012 091d 4b11 cb44 3587 c0cd d27e c929 P...K..D5....~.) 0x0040: 2bbd 0606 0000 0002 0108 7061 6e74 7300 +.........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0000 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:08:43.992271 IP 10.0.0.101.1812 > 10.0.0.100.1027: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 0015 4000 4011 25d1 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0403 002b fc7c 0200 0023 ...d..... +.|...# 0x0020: a6d5 7da7 33d8 c5a1 b0d4 f206 098f 1394 ..}. 3........... 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:08:46.987506 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 0009 0000 4011 65dd 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0403 0714 002b 1ab7 0200 0023 ...e..... +.....# 0x0020: 3daa 0458 77d9 5edd 5149 6230 7717 7c71 =..Xw.^.QIb0w.|q 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:08:48.382840 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x01 length: 193 0x0000: 4500 00dd 000a 0000 4011 653e 0a00 0064 E.......@.e>...d 0x0010: 0a00 0065 0403 0714 00c9 bedd 0101 00c1 ...e............ 0x0020: 0489 1566 53aa 5f00 1842 47e4 38e0 661d ...fS._..BG.8.f. 0x0030: 5012 46a9 7407 9185 bbc4 4d10 7445 1df2 P.F.t.....M.tE.. 0x0040: 301d 0606 0000 0002 0108 7061 6e74 7300 0.........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0100 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:08:48.384472 IP 10.0.0.101.1812 > 10.0.0.100.1027: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 0016 4000 4011 25d0 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0403 002b e581 0201 0023 ...d..... +.....# 0x0020: fcf6 b690 11e0 81d6 d8ca 90b4 c0f3 833e ...............> 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:08:51.370904 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 000b 0000 4011 65db 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0403 0714 002b 0eb4 0201 0023 ...e..... +.....# 0x0020: 0489 1566 53aa 5f00 1842 47e4 38e0 661d ...fS._..BG.8.f. 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:02.626769 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x00 length: 193 0x0000: 4500 00dd 000c 0000 4011 653c 0a00 0064 E.......@.e<...d 0x0010: 0a00 0065 0404 0714 00c9 03eb 0100 00c1 ...e............ 0x0020: 32b4 2a4d 2ac5 2831 0ba6 120d 3064 6cf9 2.*M*. (1....0dl. 0x0030: 5012 f943 27f4 f8c4 d74c b014 6c59 69e2 P..C'....L..lYi. 0x0040: bc6d 0606 0000 0002 0108 7061 6e74 7300 .m........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0000 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:09:02.628391 IP 10.0.0.101.1812 > 10.0.0.100.1028: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 0017 4000 4011 25cf 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0404 002b 310c 0200 0023 ...d..... +1....# 0x0020: 0f90 831a 311e 14e3 2b1e ce7b 7b42 5bdd ....1...+.. {{B[. 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:05.620998 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 000d 0000 4011 65d9 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0404 0714 002b 6f69 0200 0023 ...e..... +oi...# 0x0020: 32b4 2a4d 2ac5 2831 0ba6 120d 3064 6cf9 2.*M*. (1....0dl. 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:06.912295 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x01 length: 193 0x0000: 4500 00dd 000e 0000 4011 653a 0a00 0064 E.......@.e:...d 0x0010: 0a00 0065 0404 0714 00c9 efec 0101 00c1 ...e............ 0x0020: 25b0 0c0b 4bde 0758 193b 59e7 19fb 7f5e %...K..X.;Y....^ 0x0030: 5012 8626 e5d6 1f1e 6d3f ca86 5fd6 5f64 P..&....m?.._._d 0x0040: 9e83 0606 0000 0002 0108 7061 6e74 7300 ..........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0100 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:09:06.913952 IP 10.0.0.101.1812 > 10.0.0.100.1028: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 0018 4000 4011 25ce 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0404 002b 43c4 0201 0023 ...d..... +C....# 0x0020: b02e 5ba5 c0a4 59b4 ee06 063d 6d18 0f23 .. [...Y....=m..# 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:07.627117 arp who-has 10.0.0.100 tell 10.0.0.101 0x0000: 0001 0800 0604 0001 0080 c8cf df7e 0a00 .............~.. 0x0010: 0065 0000 0000 0000 0a00 0064 .e.........d 16:09:07.627526 arp reply 10.0.0.100 is-at 00:11:95:db:37:0b 0x0000: 0001 0800 0604 0002 0011 95db 370b 0a00 ............7... 0x0010: 0064 0080 c8cf df7e 0a00 0065 0000 0000 .d.....~...e.... 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. 16:09:09.904367 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 000f 0000 4011 65d7 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0404 0714 002b 4903 0201 0023 ...e..... +I....# 0x0020: 25b0 0c0b 4bde 0758 193b 59e7 19fb 7f5e %...K..X.;Y....^ 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 Anybody know what is going on here? What have I misconfigured? Thanks, Loukas

7 15

sqlcounter for rechargeable account
by bishal＠baayu.com.np 07 Sep '06

07 Sep '06

Hi all, Can anybody guide me how to make sql counter for rechargeable account. like user "test01" subscribe for total of 25hours and after finishing 25hours if he wants to recharge his account again to 25hrs. Bisal

1 1

one attribute with more values
by Fonci 07 Sep '06

07 Sep '06

Hi! I have to make a dictionary file, but I have a little problem: There is an attribute in the vsa attributes, which has more than one value. Is it possible to separate it in the dictionary file? Is there a class attribute, or something? How can I separate the items of the attribute? Thank you for your advice! F! ____________________________________________________________________ Ne csak a lakást nézze, hanem a környéket is! Válogasson több ezer ingatlanból légifotós-kereső segítségével! http://ad.adverticum.net/b/cl,1,6022,110356,177661/click.prm

2 2

Regarding using freeradius in cluster
by Ravi S M 07 Sep '06

07 Sep '06

Hi Is free radius can be used in cluster?? , If so please provide some links to go through in detail. Thanks & Regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

1 0

windowsXP+LDAP+freeradius
by Muthu 07 Sep '06

07 Sep '06

Dear all, I have Link sys wireless router, windows XP clients, freeradius and LDAP server (Linux). I want to make the user authentication for the windows XP clients against freeradius to connect to Link sys router. I have all the users in LDAP. The LDAP server is set as user database for freeradius sever. Is this possible?. If possible, can you please give me the idea how to do this. Thanks and Regards, Muthu.

2 1

Support for disconnect request and ACK messages
by Shankar Ganesh C 06 Sep '06

06 Sep '06

Hi All, Can any body help me how to add the support for disconnect request and ack in freeradius ? Thanks and regards Shankar ganesh

3 12

Possible Rlm_sql issues
by Lawrence Dudley 06 Sep '06

06 Sep '06

Hi there, Really new to Radius, only managed to start playing with it tonight. Had a lot of issues with it, but have managed to sort the vast majority of them. If I run sudo radiusd -X from a terminal, I am presented with a load of output followed by: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. And then the server sits there and waits. So far, so good. However, when an authentication request is received, the following occurs: rad_recv: Access-Request packet from host 192.168.4.36:2051, id=0, length=228 User-Name = "bigtoc11@hotspot" CHAP-Challenge = 0x02b726656ced1242cf5923c5481f0e4b CHAP-Password = 0x00aab0ad1434ef8bccb0c3632e1d2a1526 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-30-65-0F-87-C2" Called-Station-Id = "00-16-01-10-1D-B6" NAS-Identifier = "hotspot" Acct-Session-Id = "44ff9ab800000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x2fbec7ec4ff9392a17b6d894850925a6 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Segmentation fault At which point the server is (obviously) pretty dead. I am using Rlm_sql with MySql 5.0.2 on Ubuntu 6.0.6. I tried downgrading to MySql 4 but you can't do a downgrade from 5->4 it seems :-( But that may be part of the issue, so if anyone knows how to do that it could be a good way of starting to troubleshoot the issue. Full output from sudo radiusd -X is posted below: grayfin@hotspotserver:/usr/src/src/modules/rlm_sql$ sudo radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = yes main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no Bad value "1" for boolean variable log_auth_badpass read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter sqlcounter: counter-name = "Max-All-Session-Time" sqlcounter: check-name = "Max-All-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" sqlcounter: reset = "never" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 1830 rlm_sqlcounter: Check attribute Max-All-Session is number 1831 rlm_sqlcounter: Current Time: 1157594692 [2006-09-07 03:04:52], Next reset 0 [2006-09-07 03:00:00] rlm_sqlcounter: Current Time: 1157594692 [2006-09-07 03:04:52], Prev reset 0 [2006-09-07 03:00:00] Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "127.0.0.1" sql: port = "" sql: login = "root" sql: password = "xxxxxxx" sql: radius_db = "hotspot2" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id, radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id, radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value, radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@127.0.0.1:/hotspot2 rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.

1 0

Wiki problems
by Luca Corti 06 Sep '06

06 Sep '06

The wiki main page is empty and it seems there is no content at all in the Wiki.

3 3

HOW-TO for Linux radius client
by J. C. Desai 06 Sep '06

06 Sep '06

Hi, I am looking for a Linux client side HOW-TO for radius authentication without requiring presence of the login id on client side locally. The following is the authentication scenario I am trying: 1) I have freeRadius server installed on a RedHat Linux machine 2) I would like users logging into other RedHat Linux machines in our network to have their login/passwd authenticated using freeRadius server (for login, su, ssh, telnet, ftp etc. ways of accessing local client machines in the network) 3) I do not want to use LDAP on server or client side 4) I am using PAM and have experimented with pam_radius_auth module without success 5) The problem I am facing is that the login id has also to be defined locally on client Linux machines --- otherwise, for example, the su command fails indicating that the id does not exist (if I create the login id on client locally, then it queries freeRadius server) 6) I do not want to add "ldap" to nsswitch.conf file of client --- just want to stick to radius for now In summary, is there a Linux client side HOW-TO for radius authentication without requiring presence of the login id on client side locally? Regards ... J. C. Desai

4 3

EAP + SQL
by Velikanov 06 Sep '06

06 Sep '06

Good day. Say, please, is it possible to use EAP-MD5(or other type of EAP) with SQL backend database. Thanks.

2 1