July 2007 - Freeradius-Users - lists.freeradius.org

NAS restart without proper client logout on radius (mysql)
by Nataniel Klug 18 Jul '07

18 Jul '07

Hello all, I have a question: when a nas restart without sending client logout to the freeradius server the clients stay connected in radacct table (AcctStopTime=0). What can I do to solve this kind of problem? What could happen is that when a nas reboot my clients keep logged and when the nas start again they will get "You are already logged in" (simultaneous-use). -- Att, NATANIEL KLUG nata(a)cnett.com.br Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay -- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois. Sistema de email Cyber Nett - v2.0

6 10

RLM_PERL Integration Issue
by FreeRadius-ML 18 Jul '07

18 Jul '07

Well, I've reached a few conclusions here, and according to the following log I can deduce the following: Cleaning up request 253 ID 35 with timestamp 469a18da Sending Access-Reject of id 36 to 192.168.2.80 port 47588 Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.2.80:47589, id=37, length=194 User-Name = "101(a)192.168.2.80" Digest-Attributes = 0x0a05313031 Digest-Attributes = 0x010e3139322e3136382e322e3830 Digest-Attributes = 0x022a34363961323238356338303335366239633531383533353961623933373332303364333931366635 Digest-Attributes = 0x04127369703a3139322e3136382e322e3830 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "1c40cdddbc1dafeaea453f1f2a726e15" Service-Type = Authenticate-Only X-Ascend-PW-Lifetime = 0x313031 NAS-Port = 5060 NAS-IP-Address = 192.168.2.80 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 255 perl_pool: item 0xa459b10 asigned new request. Handled so far: 8 found interpetator at address 0xa459b10 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 0x313031 rlm_perl: RAD_REQUEST: Digest-Response = 1c40cdddbc1dafeaea453f1f2a726e15 rlm_perl: RAD_REQUEST: User-Name = 101(a)192.168.2.80 rlm_perl: RAD_REQUEST: Service-Type = Authenticate-Only rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0xa592764) perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa459b10 modcall[authorize]: module "perl" returns ok for request 255 modcall: leaving group authorize (returns ok) for request 255 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [101(a)192.168.2.80/<no User-Password attribute>] (from client openser port 5060) Delaying request 255 for 1 seconds Finished request 255 Going to the next request It would appear the the autorization portion of the process works just fine, and is being negotiated via the rlm_perl module. However, it would appear that the authentication portion isn't even transfered to the handling of the rlm_perl module for some reason. I've gone over various information I can find, in regards to the usage of Auth-Type settings for rlm_perl, however, all have produced the same result at the above. If any one has information at this point, this would be highly appreciated. z2l ----- Original Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: freeradius(a)zap2link.com, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: 14:52:19 (GMT+0200) Asia/Jerusalem יום שלישי 17 יולי 2007 Subject: Re: RLM_PERL Integration Issue FreeRadius-ML wrote: > Well, right now I would like to start of with something really simple. I'd like to have OpenSER authenticate > on FreeRadius, Digest is not a must - for all I care at this point, it can be clear-text. I'm currently using > the perl script example from the FreeRadius website, which if i understand correctly, should answer OK on any > request to it. That is what I where i want to get to at this point, once that is working, i can continue onwards. You are trying to do two independent things at the same time. 1) get Digest authentication working. 2) Get Perl working. Alan DeKok.

4 17

Re: how to drop idle users
by vik 18 Jul '07

18 Jul '07

I've added Idle-Timeout, but still tha table is empty. What should i do to make radius use it? Thanks. ----- Original Message ---- From: Stefan Winter <stefan.winter(a)restena.lu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, July 18, 2007 1:13:29 PM Subject: Re: how to drop idle users > Thank you for your fast answer, but my radreply table is empty and there is > no field Idle-Timeout. *add* it to radreply. -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/

3 2

Re: how to drop idle users
by vik 18 Jul '07

18 Jul '07

In fact i am using chillispot running on the same PC along with apache and freeradius. So chillispot acts as dhcp and comunicates with the radius server ont tha same machine. Does it change anything. ----- Original Message ---- From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, July 18, 2007 1:01:08 PM Subject: Re: how to drop idle users vik wrote: > Thank you for your fast answer, but my radreply table is empty and there is no field Idle-Timeout. > > Idle-Timeout is a reply attribute See http://www.freeradius.org/rfc/rfc2865.html#Idle-Timeout No guarantee your NAS will support it though. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Choose the right car based on your needs. Check out Yahoo! Autos new Car Finder tool. http://autos.yahoo.com/carfinder/

2 1

how to drop idle users
by vik 18 Jul '07

18 Jul '07

Thank you for your fast answer, but my radreply table is empty and there is no field Idle-Timeout. >This is usually done by the NAS IIRC. >Simply set an Idle-Timeout attribute in radreply for the user and the NAS >takes care of that. >Regards, >Liran. On 7/18/07, vik <vik_viktor at yahoo.com> wrote: >> >> Hi there, >> >> I have this problem, i would like to have idle users disconnected. With >> "idle" i mean users that have no activity with internet browsers. I'm not >> sure if there are other apllications using the 80 port the users are still >> idle. >> >> Thank you in advance. ____________________________________________________________________________________ Sick sense of humor? Visit Yahoo! TV's Comedy with an Edge to see what's on, when. http://tv.yahoo.com/collections/222

3 2

how to drop idle users
by vik 18 Jul '07

18 Jul '07

Hi there, I have this problem, i would like to have idle users disconnected. With "idle" i mean users that have no activity with internet browsers. I'm not sure if there are other apllications using the 80 port the users are still idle. Thank you in advance. ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/

3 2

certificates for TLS Tunnel (peap mschap v2 authentication)
by julien blanc 18 Jul '07

18 Jul '07

hi ! I'd like to set up an authentication system (for wireless clients) based on freeradius. I'm using a DC windows 2003 with Active Directory to manage my users and groups... i know ... its baaaad :-) but i don't have the choice ! I have built a linux server (fedora core 5), with freeradius, a kerberos client, samba and winbind to reach my domain. No problems so far. I'd like to authenticate my supplicants with PEAP-MSCHAP v2 and so i must set up a PKI for the TLS tunnel. My problem is here. I don't know how to use certificates in the freeradius directory: root.pem, root.p12, root.der cert-clt.pem, cert-clt.p12, cert-clt.der cert-srv.pem, cert-srv.p12, cert-srv.der any advice ... suggestions or anything else ??? Thanks ! Julien

3 4

Re: [Chillispot] Lack of Accounting ON/OFF in ChiliSpot RADIUS implementation
by Peter Nixon 17 Jul '07

17 Jul '07

After receiving your mail, I decided to do a little more ChilliSpot testing. a) Chillispot does not send an accounting ON packet on startup b) Chillispot does not send an accounting OFF packet on shutdown c) Chillispot does send an accounting Stop packet with "Acct-Terminate-Cause = NAS-reboot" for active sessions when shutdown cleanly. Now, c) is usefull in situations when you cleanly shutdown chillispot as it gives a proper stop record with the most information of the 3 options including final data counters. Instead of c) it would actually have been much easier to implement b) so I congratulate the chillispot author for his efforts. I still recommend that b) also be implemented however as it allows easy reporting of when the NAS was last shutdown. HOWEVER, If I only had the choice of ONE of the three options, I would pick option a) as it guarantees that the RADIUS server's idea of the active sessions will always be reset when the NAS boots. It is also the only one of the three options which (network conditions allowing) is always going to be delivered to the RADIUS server, as both b) and c) will not be sent in the case of a power outage or lockup of the NAS. To recap, ChilliSpot SHOULD send an accounting ON packet to the RADIUS server when it boots, and probably should send an OFF packet upon shutdown, although this is not critical given that it cleanly closes the sessions anyway. IF an accounting OFF packet is sent upon shutdown, it should be sent LAST, after all the session Stop packets are sent, otherwise the OFF packet will close all the active sessions on the RADIUS server, and the session Stop packets will generate duplicate SQL records as the radius server will err on the side of caution and prefer to duplicate records in the DB instead of possibly losing a session for which it did not receive a Start record. Regards Peter On Tue 17 Jul 2007, sophana wrote: > I'm receiving sometimes radius session stop requests with the terminate > cause "NAS-reboot". > Isn't it what you want? I don't know why it doesn't always work. > The problem is that it can't work reliably. > If there is a power off or whatever other reason, you don't get your > information. > Only the "on" information would be useful. > > Personally, I use trigger a periodic task that check open sessions which > haven't received alive requests since some time and close them. > If the user logs back before, you can detect that based on the > calling/called mac addresses and nasId and force the shutdown. > > Peter Nixon a écrit : > > Hi Guys > > > > I am one of the FreeRADIUS developers, as well as the openSUSE > > network:AAA project founder. As part of that project I also maintain > > ChilliSpot rpms. > > > > Over that last 6-9 months we have been getting increasing numbers of > > queries regarding ChilliSpot on the FreeRADIUS mailing list. One of the > > common queries we get is how to make FreeRADIUS "understand" when a > > chillispot NAS has been rebooted and all the users have been kicked off, > > but no accounting stop records have been received. > > > > I have taken a look at ChilliSpot and it generates an Auth packet > > similar to the following on initial start: > > > > rad_recv: Access-Request packet from host 192.168.2.67 port 2050, id=0, > > length=113 > > User-Name = "chillispot" > > User-Password = "chillispot" > > NAS-IP-Address = 192.168.1.7 > > Service-Type = Administrative-User > > NAS-Identifier = "demo" > > Called-Station-Id = "00:11:70:4f:01:aa" > > NAS-Port-Type = Wireless-802.11 > > Message-Authenticator = 0xdb58714687848c2c42bc8f5e91069891 > > > > However it does not generate an Accounting OFF record when it is shut > > down, nor an Accounting ON record when it is started. If these 2 > > features could be added to chillispot (10 or 20 lines of code at most > > given that you already generate an Auth packet on boot) then FreeRADIUS > > will know to automatically clear all active sessions from the accounting > > table (With its default configuration). Even if the power is lost from > > the device running chillispot if it sends an Accounting ON record on > > boot FreeRADIUS runs the following query on the accounting table: > > > > accounting_onoff_query = "UPDATE ${acct_table1} \ > > SET AcctStopTime = ('%S'::timestamp - > > '%{Acct-Delay-Time:-0}'::interval), \ AcctSessionTime = (EXTRACT(EPOCH > > FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with > > time zone \ > > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, \ > > AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = 0 \ > > WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND > > NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" > > > > And this query on the IP lease table: > > > > on-clear = "UPDATE ${ippool_table} \ > > SET nasipaddress = '', pool_key = 0, callingstationid = '', \ > > expiry_time = 'now'::timestamp(0) - '1 second'::interval \ > > WHERE nasipaddress = '%{Nas-IP-Address}'" > > > > If the chillispot developers could add this basic feature, it would: > > a) be usefull to chillispot users > > b) reduce some questions to the FR mailing list which we can currently > > do nothing about :-) > > > > I would be happy to help in any way necessary if you have any questions > > about this RADIUS feature. > > > > Regards > > _______________________________________________ > ChilliSpot mailing list > ChilliSpot(a)chillispot.org > http://chillispot.org/mailman/listinfo/chillispot_chillispot.org -- Peter Nixon http://peternixon.net/

1 0

OpenSER + FreeRadius implementations example
by FreeRadius-ML 17 Jul '07

17 Jul '07

Hi All, Ok, I'm a bit mixed up here, the documents are simply not cutting it. I'm wondering if any of you have a working OpenSER + FreeRadius configuration that I can look at and extrapulate my required settings? I've gone over all the material I could find, but all of it reverts back to the outdated how-to on the FreeRadius website. Assistance would be highly appreciated. Regards, Z2L

2 1

Interim-Updates
by Irina 17 Jul '07

17 Jul '07

Hello all, We enabled Cisco NAS to send Interim-Updates to the radius server, once an hour. Everything is great except for the following. There are users that use a lot of bandwidth. Seems, NAS wraps Acct-Input-Octets and Acct-Output-Octets at 4 GB. We have few users that may have their bandwidth reset to 0 within hour. When next Interim-Updates is sent, we don't have a proper number. Do I miss something in Radius configuration? Or is something that has to be handled by NAS? Any help is appreciated. Thank you. Irina

6 22