November 2007 - Freeradius-Users - lists.freeradius.org

unlang question
by Norbert Wegener 14 Nov '07

14 Nov '07

Something like if ("%{sqlnastype:SELECT Value from radcheck where UserName = '%{User-Name}' and otherconditions}" == 'bla' ) works, whereas I have problems with: if ("%{sqlnastype:SELECT Value from radcheck where UserName = '%{User-Name}' and other conditions.. " is not null ) Am I doing something wrong or is "is not null" not (yet) implemented? Norbert Wegener

2 1

Freeradius 1.1.7 no DB handles
by steven meyer 14 Nov '07

14 Nov '07

I have searched now for several weeks, but do not find a solution: Installed freeradius 1.1.7 on suse configured mysql on the same server I can start radiusd fine, I can login into nas, but I want accounting put into mysql and that just does not work. My DB-tables are empty, just accounting should be put into it. I do not need anything in usergroup for accounting etc, or do I? radiusd -X | grep sql : Config: including file: /usr/local/etc/raddb/sql.conf sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "" sql: radius_db = "radiusLOG" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/rzf/protokolle/radiusd/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Gigawords: -0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '% {Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Gigawo rds:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radiusLOG rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 1 rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 2 rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 3 rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 4 rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 5 rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 6 rlm_sql (sql): sql_set_user escaped user --> 'kristin' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[accounting]: module "sql" returns fail for request 7 .... I tried to create and put sqltrace into my db. That was no problem at all. But whats the Problem of radiusd? It connects to DB, but cannot insert when accounting-Data comes in!? I do not know where else to look at. Please help me! -- View this message in context: http://www.nabble.com/Freeradius-1.1.7-no-DB-handles-tf4757305.html#a136043… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

Service-Type=Framed-User translated to Service-Type=Framed?
by Jon SK Phang 14 Nov '07

14 Nov '07

Hi All, Not sure if anyone else saw this. I’m using freeradius-server-pre-2.0.0-8.1 and have got everything to work so far. The backend is a MySQL database. >From a debug instance of FreeRADIUS, it reads Sending Access-Accept of id 44 to 10.152.54.138 port 3129 Framed-IP-Address := 0.0.0.101 Cisco-AVPair += "lcp:interface-config=ip vrf forwarding VRF-PUBLIC" Cisco-AVPair += "lcp:interface-config=peer default ip address pool VRF-PUBLIC" Cisco-AVPair += "lcp:interface-config=ip unnumbered Loopback 99" Service-Type := Framed-User Finished request 0 state 5 Going to the next request But in the Cisco debug log, the word “-User” at the reply in Service-Type=Framed-User is missing. I can only see Service-Type=Framed In NTRadPing utility, the results are the same. Have tried putting the attributes both in radreply and radgroupreply with no difference. Regards Jonathan __________________________________________________________________ Yahoo! Singapore Answers Real people. Real questions. Real answers. Share what you know at http://answers.yahoo.com.sg

2 1

RLM_python patch to enable postproxy - Not work need a little help
by Mike O'Connor 13 Nov '07

13 Nov '07

Hi Guys I wrote the attached patch for Freeradius 1.1.7 to enabled calling python in the post-proxy, it compiles but will not run when the hook is listed in post-proxy because Freeradius complains that there is no support for post-proxy in rlm_python. My question is where in the source is the list of allowed call per module ? Once I know this I can fix this attached and supply as a tested patch. Thanks Mike --- src/modules/rlm_python/rlm_python.c.orig 2007-03-06 00:45:28.000000000 +1030 +++ src/modules/rlm_python/rlm_python.c 2007-10-10 15:36:51.000000000 +0930 @@ -54,6 +54,7 @@ char *mod_authenticate; char *mod_preacct; char *mod_accounting; + char *mod_post_proxy; char *mod_checksimul; char *mod_detach; @@ -63,6 +64,7 @@ char *func_authenticate; char *func_preacct; char *func_accounting; + char *func_post_proxy; char *func_checksimul; char *func_detach; @@ -71,6 +73,7 @@ PyObject *pModule_authenticate; PyObject *pModule_preacct; PyObject *pModule_accounting; + PyObject *pModule_post_proxy; PyObject *pModule_checksimul; PyObject *pModule_detach; @@ -80,6 +83,7 @@ PyObject *pFunc_authenticate; PyObject *pFunc_preacct; PyObject *pFunc_accounting; + PyObject *pFunc_post_proxy; PyObject *pFunc_checksimul; PyObject *pFunc_detach; }; @@ -120,6 +124,11 @@ { "func_accounting", PW_TYPE_STRING_PTR, offsetof(struct rlm_python_t, func_accounting), NULL, NULL}, + { "mod_post_proxy", PW_TYPE_STRING_PTR, + offsetof(struct rlm_python_t, mod_post_proxy), NULL, NULL}, + { "func_post_proxy", PW_TYPE_STRING_PTR, + offsetof(struct rlm_python_t, func_post_proxy), NULL, NULL}, + { "mod_checksimul", PW_TYPE_STRING_PTR, offsetof(struct rlm_python_t, mod_checksimul), NULL, NULL}, { "func_checksimul", PW_TYPE_STRING_PTR, @@ -490,6 +499,7 @@ python_objclear(&data->pFunc_authenticate); python_objclear(&data->pFunc_preacct); python_objclear(&data->pFunc_accounting); + python_objclear(&data->pFunc_post_proxy); python_objclear(&data->pFunc_checksimul); python_objclear(&data->pFunc_detach); @@ -498,6 +508,7 @@ python_objclear(&data->pModule_authenticate); python_objclear(&data->pModule_preacct); python_objclear(&data->pModule_accounting); + python_objclear(&data->pModule_post_proxy); python_objclear(&data->pModule_checksimul); python_objclear(&data->pModule_detach); } @@ -566,6 +577,12 @@ &data->pFunc_accounting) < 0) goto failed; + if (python_load_function(data->mod_post_proxy, + data->func_post_proxy, + &data->pModule_post_proxy, + &data->pFunc_post_proxy) < 0) + goto failed; + if (python_load_function(data->mod_checksimul, data->func_checksimul, &data->pModule_checksimul, @@ -633,6 +650,14 @@ "accounting"); } +static int python_post_proxy(void *instance, REQUEST *request) +{ + return python_function( + request, + ((struct rlm_python_t *)instance)->pFunc_post_proxy, + "post-proxy"); +} + static int python_checksimul(void *instance, REQUEST *request) { return python_function( @@ -663,7 +688,7 @@ python_accounting, /* accounting */ python_checksimul, /* checksimul */ NULL, /* pre-proxy */ - NULL, /* post-proxy */ + python_post_proxy, /* post-proxy */ NULL /* post-auth */ }, python_detach, /* detach */

2 4

1.1.7 on Debian sarge ?
by oz 13 Nov '07

13 Nov '07

Hello list, doesn't freeradius-1.1.7 no longer compile on Debian sarge (oldstable)? I get these errors on after ./configure and make: [...] Making all in rlm_perl... make[6]: Entering directory `/usr/local/src/freeradius-1.1.7/src/modules/rlm_perl' /usr/local/src/freeradius-1.1.7/libtool --mode=compile gcc -g -O2 -I/usr/local/src/f reeradius-1.1.7/src/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -f no-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I /usr/lib/perl/5.8/CORE -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-st rict-aliasing -I/usr/local/include -c rlm_perl.c mkdir .libs gcc -g -O2 -I/usr/local/src/freeradius-1.1.7/src/include -D_REENTRANT -D_GNU_SOURCE - DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOU RCE -D_FILE_OFFSET_BITS=64 -I/usr/lib/perl/5.8/CORE -D_REENTRANT -D_GNU_SOURCE -DTHREA DS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include -c rlm_perl.c -fPIC - DPIC -o .libs/rlm_perl.o rlm_perl.c: In function `perl_xlat': rlm_perl.c:658: parse error before `*' rlm_perl.c:660: `handle' undeclared (first use in this function) rlm_perl.c:660: (Each undeclared identifier is reported only once rlm_perl.c:660: for each function it appears in.) make[6]: *** [rlm_perl.lo] Error 1 make[6]: Leaving directory `/usr/local/src/freeradius-1.1.7/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/usr/local/src/freeradius-1.1.7/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/usr/local/src/freeradius-1.1.7/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/local/src/freeradius-1.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/local/src/freeradius-1.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/local/src/freeradius-1.1.7' make: *** [all] Error 2 /usr/local/src/freeradius-1.1.7# But I can compile 1.1.7 on Debian etch (stable) and Debian lenny (testing). Am I just missing a Debian developement package or something? I'd like to update our productive sarge installations before I try distro updates. Any ideas or known issues with Debian sarge? Thanks.

2 2

Some users can't login after upgrade!
by Dean, Barry 13 Nov '07

13 Nov '07

The configuration I had was FreeRADIUS 1.1.4 running on NetBSD_3.0 (STABLE) authenticating to Novell eDirectory using LDAP. All was fine... I upgraded to FreeRADIUS 1.1.7 and all seemed OK, until two of my users found they can no longer login to the Cisco VPN3000 which uses this RADIUS. The log files simply show: Tue Nov 6 15:06:40 2007 : Auth: Login incorrect: [<user>] (from client vpn3000 port 13712 cli X.X.X.X) We also use RADIUS with EZProxy. I used a spare EZProxy test box and asked the user to login using that, failed with 1.1.7 RADIUS, changed it to use a spare 1.1.4 server and they could login! User names are alphabetic only and less than 8 characters, passwords are alpha-numeric only and 8 characters. I am reasonably new to RADIUS and cannot figure out why these two users are being singled out! I thought at first it might be because we have "edir_account_policy_check=yes" and that given the ChangeLog for 1.1.7 says "Added more eDirectory support.", and the two users possibly have extra attributes as they are sysadmins, that something was being checked that was not with 1.1.4 and that was preventing login. However later in radiusd.conf in the post-auth section the LDAP server entries are commented out. and it says: # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. So does this mean this feature is not in operation? Has anyone any ideas where I should start looking? Thanks. --------------- Barry Dean Networks Team University of Liverpool

2 5

FreeRadius returns the same attribute value twice
by VM 13 Nov '07

13 Nov '07

Hi, I have a problem with the Filter-ID attribute : When a switch (Enterasys) gets the filter-ID in an 'access-accept' reply, its value is written twice : ..... AVP: l=6 t=Service-Type(6): Framed-User(2) AVP: l=39 t=Filter-ID(11): Enterasys:version=1:policy=test-policy Filter-ID: Enterasys:version=1:policy=test-policy AVP: l=39 t=Filter-ID(11): Enterasys:version=1:policy=test-policy Filter-ID: Enterasys:version=1:policy=test-policy AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) AVP: l=6 t=EAP-Message(79) Last Segment [1] ..... And this comportment confuses the switch (an old one). This happens only in an EAP negociation. Not in clear Radius. Do you know where this may come from ? Something to do with the fact that I set "use_tunnelled_reply=yes" in EAP.conf ? Thanks in advance, Vincent MAZARD

2 1

Re: Mikrotik ignores Framed-IP-Address
by Marinko Tarlac 12 Nov '07

12 Nov '07

Well I'm trying to use it. When I enter for example ID | UserName | Attribute | op 32 | user | Framed-IP-Address | 192.168.8.152 | := in radreply table, user should get static IP address (in this case 192.168.8.152) but this is ignored by Mikrotik because Framed-Pool is also available because user is inside specific group which has defined IP pool. When I delete IP pool from Mikrotik everything works fine... It seem that finally I will wrote specific perl or php script who will be dedicated to decide if framed-ip-address exist send it to MT else send IP-pool name Re: Mikrotik ignores Framed-IP-Address (tnt(a)kalik.co.yu) > > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 12 Nov 2007 12:55:14 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Mikrotik ignores Framed-IP-Address > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <fXF2NwKz.1194868514.1514360.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Use one way to assign IP addresses: DHCP or radius. If you want to give > static addresses to devices use dhcp pools (dynamic IP) and reservations > (static IP); if you want to give static IPs to users than use radius > ippool (dynamic IP) and (static) IP address assignment. > > Ivan Kalik > Kalik Informatika ISP > > Dana 12/11/2007, "Marinko Tarlac" <mangia81(a)gmail.com> pi?e: > > >> Hello >> >> I have freeradius and Mikrotik combination and here is the problem. >> Freeradius is configured to use mysql database. When I add >> Framed-IP-Address for certain user (in radreply table) For example >> >> 32 user Framed-IP-Address 10.51.8.152 := >> >> It works but only if I don't have IP pool created on Mikrotik. If I >> create IP pool than Framed-IP-Address is ignored. Framed-Pool is >> specified for every group and attributes for every group is added in >> radgroupreply table. >> >> Log without IP pool >> >> rad_recv: Access-Request packet from host 192.168.1.7:1026, id=229, length=149 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 870 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> CHAP-Challenge = 0x89a28dc77659b6311a88c16eb7500767 >> CHAP-Password = 0x01d385ce5c814c1d1db9cafadb4736c351 >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> rlm_chap: Setting 'Auth-Type := CHAP' >> rlm_sql (sql): Reserving sql socket id: 4 >> rlm_sql (sql): Released sql socket id: 4 >> rlm_chap: login attempt by "admin-test" with CHAP password >> rlm_chap: Using clear text password "perica" for user admin-test >> authentication. >> rlm_chap: chap user admin-test authenticated succesfully >> Sending Access-Accept of id 229 to 192.168.1.7 port 1026 >> Framed-IP-Address := 192.168.8.152 >> Framed-MTU = 576 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-Compression = Van-Jacobson-TCP-IP >> Ascend-Data-Rate := 0 >> Ascend-Xmit-Rate := 0 >> Framed-Pool := "radius" >> >> Log with created IP pool called "radius" >> >> rad_recv: Access-Request packet from host 192.168.1.7:1027, id=240, length=149 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 872 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> CHAP-Challenge = 0x5293ac8321ad51693a5e3109f8887511 >> CHAP-Password = 0x01b0a9f7bca1f632878bee51c13d667f5c >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> rlm_chap: Setting 'Auth-Type := CHAP' >> rlm_sql (sql): Reserving sql socket id: 4 >> rlm_sql (sql): Released sql socket id: 4 >> rlm_chap: login attempt by "admin-test" with CHAP password >> rlm_chap: Using clear text password "perica" for user admin-test >> authentication. >> rlm_chap: chap user admin-test authenticated succesfully >> Sending Access-Accept of id 240 to 192.168.1.7 port 1027 >> Framed-IP-Address := 192.168.8.152 >> Framed-MTU = 576 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-Compression = Van-Jacobson-TCP-IP >> Ascend-Data-Rate := 0 >> Ascend-Xmit-Rate := 0 >> Framed-Pool := "radius" >> rad_recv: Accounting-Request packet from host 192.168.1.7:1027, >> id=241, length=146 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 872 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> Acct-Session-Id = "81d00316" >> Framed-IP-Address = 192.168.8.159 >> Acct-Authentic = RADIUS >> Acct-Status-Type = Start >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> Acct-Delay-Time = 0 >> rlm_sql (sql): Reserving sql socket id: 3 >> rlm_sql (sql): Released sql socket id: 3 >> Sending Accounting-Response of id 241 to 192.168.1.7 port 1027 >> >> Any ideas? >> > >

2 1

Two more reasons to upgrade to 2.0
by Alan DeKok 12 Nov '07

12 Nov '07

Download CVS head, and: $ man radiusd ... In short: "-C" now works. Sort of. The server doesn't open any sockets. It doesn't check SQL, LDAP, etc. But modules which don't depend on anything (i.e. chap), and modules which only read flat-text files are checked for sanity when "-C" is used. The "man" page describes the limitations of "-C". $ kill -HUP `psgrep radiusd` This works. Sort of. For now, HUP *only* reloads the "files" module. it doesn't change ANYTHING else in the server. It doesn't reload, re-open, or examine ANY of the configuration files such as "radiusd.conf", "eap.conf", etc. With tiny amounts more work, a few other modules can be made to reload on HUP. i.e. preprocess, passwd, linelog, and a few others. Just as with "-C", SQL and LDAP won't be reloaded on HUP. Also, EAP won't be reloaded on HUP. If you *really* need that functionality, it's a large amount of work, and will need to be funded. Alan DeKok.

1 0

How to return Reply-Message when user submitted wrong password
by Lee Sing Chyun 12 Nov '07

12 Nov '07

Hi, Is there a way to reply with a intuitive Reply-Message (for e.g., 'Wrong Password') when the user tries to authenticate with a wrong password? My current configuration is using rlm_pap and rlm_sql for authorization and authentication. FreeRADIUS version is 1.1.7. Thanks in advance! -- Best Regards, SC

3 5