April 2008 - Freeradius-Users - lists.freeradius.org

$RAD_REPLY - Add multiple pairs issue (rlm_perl)
by Kinetix Tele.com Mailing Lists 21 Apr '08

21 Apr '08

I am using the following command to my authorize function (rlm_perl) : $RAD_REPLY{'Cisco-Command-Code'} = \@final_routing; because I want to add more than one pair in the reply packet. (final_routing is a perl array containing the desired values) These pairs are successfully added to the reply message during the authorization phase, but after the authentication function is being processed those pairs are added again one more time. Note : the only line that I have in my authenticate function is : return RLM_MODULE_OK; (positively authenticate anything) So I end up having twice the pairs I intended to in my reply packet. Has anyone seen this behavior before?

1 1

Re: NAS with dynamic IP
by Jack Murgia 21 Apr '08

21 Apr '08

Alex, Is there a command I can run periodically that would flush the dns cache? I use the NAS table in MySQL rather than clients.conf to register my NAS devices. The only problem with NAS devices on PPOE ADSL links is that a restart of Freeradius server is required in order to pick up the new IP address from DYNDNS.org. Would this problem be solved by a rlm_nsupdate module (scheduled for future release)? I would be willing to donate to the creation of this module. Jack Murgia on 2/26/08 2:31 AM, freeradius-users-request(a)lists.freeradius.org at freeradius-users-request(a)lists.freeradius.org wrote: > Date: Tue, 26 Feb 2008 10:30:59 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: NAS with dynamic IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <47C3DC53.9040703(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Rui Oliveira wrote: >> If anyone want to do the patch i can help with some donations because i >> will use it a lot :) > > Alternatively, you could define the client as a network (e.g. > 192.168/24). See clients.conf for details. > > Alan DeKok.

2 1

rlm_sql_mysql: Mysql check_error: 1064 received
by 여친급구 21 Apr '08

21 Apr '08

Hello all please help me freeradius-server-2.0.3.tar.gz rpmbuild -bb freeradius.spec --with-mysql-lib-dir=/usr/lib/mysql \ --with-mysql-include-dir=/usr/include/mysql \ accounting { sqlippool } post-auth { sqlippool } user file DEFAULT Pool-Name := dialup_pool1 Fall-Through = Yes mysql> select * from radippool; +----+--------------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | id | pool_name | framedipaddress | nasipaddress | calledstationid | callingstationid | expiry_time | username | pool_key | +----+--------------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | 64 | dialup_pool1 | 212.2x1.2x1.1x1 | 127.0.0.1 | | 2x1.1x1.88.x7 | 2008-04-21 11:24:37 | test | 0 | +----+--------------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ mysql> select * from radgroupcheck; +----+--------------+------------------+----+--------------+ | id | groupname | attribute | op | value | +----+--------------+------------------+----+--------------+ | 1 | dialup_pool1 | Simultaneous-Use | := | 1 | | 2 | dialup_pool1 | Pool-Name | := | dialup_pool1 | +----+--------------+------------------+----+--------------+ mysql> select * from radcheck +----+----------+--------------------+----+-------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------+ | 25 | test | Cleartext-Password | := | 1234 | +----+----------+--------------------+----+-------+ radiusd -X FreeRADIUS Version 2.0.3, for host i686-redhat-linux-gnu, built on Apr 15 2008 at 18:25:23 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/sqlippool.conf including configuration file /etc/raddb/sql/mysql/ippool.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "mypass" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "mypass" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sqlcounter Module: Instantiating noresetcounter sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute Max-All-Session is number 3000 rlm_sqlcounter: Current Time: 1208741067 [2008-04-21 10:24:27], Next reset 0 [2008-04-21 10:00:00] rlm_sqlcounter: Current Time: 1208741067 [2008-04-21 10:24:27], Prev reset 0 [2008-04-21 10:00:00] } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiusid" password = "mypass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiusid@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_sqlippool Module: Instantiating sqlippool sqlippool { sql-instance-name = "sql" lease-duration = 3600 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I'" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } rlm_sql (sql): Reserving sql socket id: 4 Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 32777, id=156, length=147 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x5bc8fc29eded59428c6286a5d89e78df MS-CHAP2-Response = 0x4a00a8f46528beaf42d4b9d53a028e03e2a300000000000000003a424ecfc094ccda458e972d8ae4cef69c619caf7304b83c Calling-Station-Id = "2x1.1x1.88.x7" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 172 ++[files] returns ok expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dialup_pool1' ORDER BY id rlm_sql (sql): User found in group dialup_pool1 expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dialup_pool1' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type mschap auth: type "MSCHAP" +- entering group MS-CHAP rlm_mschap: Told to do MS-CHAPv2 for test with NT-Password ++[mschap] returns ok +- entering group session expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> test ++[radutmp] returns ok Login OK: [test/<via Auth-Type = mschap>] (from client localhost port 0 cli 2x1.1x1.88.x7) +- entering group post-auth rlm_sql (sql): Reserving sql socket id: 2 expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: START TRANSACTION -> START TRANSACTION expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND rlm_sql_mysql: MYSQL check_error: 1064 received sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND' expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'dialup_pool1' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE sqlippool_query1: SQL query did not return any results expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: COMMIT -> COMMIT expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1 -> SELECT id FROM radippool WHERE pool_name='dialup_pool1' LIMIT 1 rlm_sql (sql): Released sql socket id: 2 rlm_sqlippool: IP address could not be allocated. expand: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> IP Allocation FAILED from dialup_pool1 (did cli 2x1.1x1.88.x7 port 0 user test) IP Allocation FAILED from dialup_pool1 (did cli 2x1.1x1.88.x7 port 0 user test) ++[sqlippool] returns notfound rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: %{User-Password} -> expand: %{Chap-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '', 'Access-Accept', '2008-04-21 10:24:34') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '', 'Access-Accept', '2008-04-21 10:24:34') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok Sending Access-Accept of id 156 to 127.0.0.1 port 32777 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x4a533d46444437464430314444333232333430413133443145343245333945453839303930353842444137 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 32777, id=157, length=111 Acct-Session-Id = "480BECD514B900" User-Name = "test" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "2x1.1x1.88.x7" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 212.2x1.2x1.1x1 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "480BECD514B900",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "d0e006f311977bc3". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/detail-20080421 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/detail-20080421 expand: %t -> Mon Apr 21 10:24:37 2008 ++[detail] returns ok ++[unix] returns ok expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> test ++[radutmp] returns ok rlm_sql (sql): Reserving sql socket id: 0 expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: START TRANSACTION -> START TRANSACTION expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' -> UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 0 ++[sqlippool] returns ok expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: %{Acct-Delay-Time} -> 0 expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('480BECD514B900', 'd0e006f311977bc3', 'test', '', '127.0.0.1', '0', 'Async', '2008-04-21 10:24:37', NULL, '0', 'RADIUS', '', '', '0', '0', '', '2x1.1x1.88.x7', '', 'Framed-User', 'PPP', '212.2x1.2x1.1x1', '0', '0', '') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 157 to 127.0.0.1 port 32777 Finished request 1. Cleaning up request 1 ID 157 with timestamp +10 Going to the next request Waking up in 1.9 seconds. Cleaning up request 0 ID 156 with timestamp +7 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 32777, id=158, length=147 Acct-Session-Id = "480BECD514B900" User-Name = "test" Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 6 Acct-Output-Octets = 24 Acct-Input-Octets = 2160 Acct-Output-Packets = 2 Acct-Input-Packets = 26 Calling-Station-Id = "2x1.1x1.88.x7" NAS-Port-Type = Async Acct-Terminate-Cause = User-Request Framed-IP-Address = 212.2x1.2x1.1x1 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "480BECD514B900",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "d0e006f311977bc3". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/detail-20080421 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/detail-20080421 expand: %t -> Mon Apr 21 10:24:43 2008 ++[detail] returns ok ++[unix] returns ok expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> test ++[radutmp] returns ok rlm_sql (sql): Reserving sql socket id: 2 expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: START TRANSACTION -> START TRANSACTION expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '2x1.1x1.88.x7' AND framedipaddress = '212.2x1.2x1.1x1' rlm_sql_mysql: MYSQL check_error: 1064 received sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '2x1.1x1.88.x7' AND framedipaddress = '212.2x1.2x1.1x1'' expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 2 expand: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) -> Released IP 212.2x1.2x1.1x1 (did cli 2x1.1x1.88.x7 user test) Released IP 212.2x1.2x1.1x1 (did cli 2x1.1x1.88.x7 user test) ++[sqlippool] returns ok expand: %{User-Name} -> test rlm_sql (sql): sql_set_user escaped user --> 'test' expand: %{Acct-Input-Gigawords} -> expand: %{Acct-Input-Octets} -> 2160 expand: %{Acct-Output-Gigawords} -> expand: %{Acct-Output-Octets} -> 24 expand: %{Acct-Delay-Time} -> 0 expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2008-04-21 10:24:43', acctsessiontime = '6', acctinputoctets = '0' << 32 | '2160', acctoutputoctets = '0' << 32 | '24', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = '480BECD514B900' AND username = 'test' AND nasipaddress = '127.0.0.1' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 158 to 127.0.0.1 port 32777 Finished request 2. Cleaning up request 2 ID 158 with timestamp +16 Going to the next request Ready to process requests. ________________________________________________________ 180도 달라진 야후! 메일 - 알아서 척척! 새로운 야후! 메일은 10분에 한번 스스로 새 메시지를 받아온답니다. http://kr.content.mail.yahoo.com/cgland

2 1

gdm and radius accounting
by sub 21 Apr '08

21 Apr '08

Hello everybody, I simply and correctly setup my ubuntu linux box to use freeradius authentication; actually the problem is that I'm not able to use radius accounting. I think that I correctly setup my radius server to use sql as accounting mode but the radius server neither receives accounting packets from the client (I see it starting the server with the -XXX option). The only "accounting" thing that it's saving in the sql db is the post auth section that inserts a line for a correct authentication response. on the client side I only modified the pam - gdm configuration file that is #%PAM-1.0 auth requisite pam_nologin.so auth sufficient pam_radius_auth.so auth required pam_env.so readenv=1 auth required pam_env.so readenv=1 envfile=/etc/default/locale @include common-auth auth optional pam_gnome_keyring.so account required pam_radius_auth.so @include common-account session required pam_limits.so @include common-session session optional pam_gnome_keyring.so auto_start @include common-password whitch step have I forgotten? what's wrong? thank you for your help, sub

7 11

Re: NAS with dynamic IP
by Jack Murgia 20 Apr '08

20 Apr '08

Alex, Is there a command I can run periodically that would flush the dns cache? I use the proxy.conf file rather than clients.conf to register my NAS devices. The only problem with NAS devices on PPOE ADSL links is that a restart of Freeradius server is required in order to pick up the new IP address from DYNDNS.org. Would this problem be solved by a rlm_nsupdate module (scheduled for future release)? I would be willing to donate to the creation of this module. Jack Murgia on 2/26/08 2:31 AM, freeradius-users-request(a)lists.freeradius.org at freeradius-users-request(a)lists.freeradius.org wrote: > Date: Tue, 26 Feb 2008 10:30:59 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: NAS with dynamic IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <47C3DC53.9040703(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Rui Oliveira wrote: >> If anyone want to do the patch i can help with some donations because i >> will use it a lot :) > > Alternatively, you could define the client as a network (e.g. > 192.168/24). See clients.conf for details. > > Alan DeKok.

1 0

Re: the newbie on radiustesting strikes again
by Si St 20 Apr '08

20 Apr '08

> ----- Original Message ----- > From: "David Wood" <david(a)wood2.org.uk> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: the newbie on radiustesting strikes again > Date: Sun, 20 Apr 2008 01:00:42 +0100 > > > Hi, > > Ivan has already given you much good advice. I wanted to add a few comments. > > In message <20080419222236.5BED97B8F8(a)ws5-10.us4.outblaze.com>, Si > St <sigbj-st(a)operamail.com> writes > > The Router supports EAP/WPA-Enterprise(has a box for this choice;) > > Automatic (WPA or WPA2), TKIP and AES > > I would be very surprised if the RADIUS functionality on the router > supports anything other than the wireless access point. It sounds > like you have a consumer level unit - not an enterprise level > router/firewall here. You are most probably 100% right In a prevoius mail I told this router to be a DLINK DIR-635 ftp://ftp.dlink.se/Products/dir-products/dir-635/Documentation/DIR-635_manual_ww.pdf > > If so, all you can do with RADIUS is to control access to your > wireless network - the Authentication and Authorisation of AAA. > Most consumer level units do not support Accounting - though some > do. If your router doesn't support accounting, there's no point > wasting any time setting up accounting in FreeRADIUS! Which will practically mean access to the router only And the router cannot handle Accounting that will mean giving user names and passwords > > You will not have the RADIUS functionality of more expensive > enterprise level wireless access points, such as the ability to > return the VLAN to connect the user to from the RADIUS server. > There again, if this is a consumer unit, it probably has no VLAN > support anyway. I find only a box for Virtual Server on the router and on Advanced Network only uPnP; not much to go for here. > > > > There will probably for all practical purposes be only wireless > > clients:3 laptops and one workstation,but I have configured 2 IP > > addresses for each laptop, one for their wireless card the other > > address for the wired/cabled card in case they will be needed. > > The access of the clients are controlled allowing only the > > specific MAC addresses of each machine to connect to the > > router.(Routers Netfilter) The machines have also fixed IPs > > reserved. > > I very much doubt that your router can make any use of RADIUS for > handing out IP addresses, especially if the only mention of RADIUS > is in connection with the wireless features. > > Handing out IP addresses via RADIUS is most commonly done with > NASes (dial in servers), VPN servers and CMTS (cable modem > termination systems). > > DHCP is more typical for bridged scenarios such as wireless > networks. Your credentials get you connected to the wireless > network, at which point the computer gets an IP address and related > information (gateway address, DNS server(s), possibly WINS servers) > via DHCP. > > > If you want better management of DHCP, one possibility is a DHCP > server that uses an LDAP backend. You could also use LDAP to store > user credentials for FreeRADIUS. However, with the size of your > network, the added complexity probably isn't worthwhile. Right. But my intentions here were to see what I could achieve choosing the WPA-Enterprise option alternatively to the WPA-Personal (as the checkboxes on the router call it), and thereby maybe apply the FreeRadius. My question was: Is it really possible for me to do this networking different, and with EAP, and learn something from it? How complicated is this task, and is it possible to do it fairly simple gaining profit from a resultant more secure network? And thus grow in knowledge and experience? So far I have learned a lot more through this mailinglist concerning my aims than I originally expected. They way my questions are answered forces me to think in the right rational way and professionally simpler. > > > Start with the simplest possible setup and only add functionality > when you've got the basic stuff working. Keeping the configuration > in a revision control system helps, too, not least when upgrading > the server to a newer version. I use Subversion, but it is probably > best to use what you're most familiar with. Excellent instruction for me, this. > > > FreeRADIUS 2.0.3 will make your task much easier as it will build > the necessary certificates for EAP automatically. PEAP is pretty > easy to get going as there's no need to generate client > certificates. Q: When one of the Win-laptops tries to connect the wireless network it happens it pops up a window asking for certificate. But not all the time. It seems as if there is a box with an entrance for a server certificate in the EAPconfig of that machine. One of the laptops -ASUS- has no entrance whatsoever for EAP extension. The others have. Strange. Any quick comment here? > > Whatever your eventual aims, start by getting your wireless users > on WPA2-Enterprise (or WPA2 / WPA mixed mode if you have any > clients that can't do WPA2) authenticating against FreeRADIUS with > PEAP. Use the users file for your users. Anything else should be > built on top of that. Thanks. This is clearifying instruction. > > > radiusd -X is your friend. > > > > Best wishes, > > > > > David > -- David Wood > david(a)wood2.org.uk > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

rlm_sql_mysql: Mysql check_error: 1064 received
by 여친급구 20 Apr '08

20 Apr '08

Hello all freeradius-server-2.0.3.tar.gz rpmbuild -bb freeradius.spec --with-mysql-lib-dir=/usr/lib/mysql \ --with-mysql-include-dir=/usr/include/mysql \ accounting { sqlippool } post-auth { sqlippool } user file DEFAULT Pool-Name := dialup_pool1 Fall-Through = Yes INSERT INTO radgroupcheck (GroupName, Attribute, op, Value) values("dialup_pool1", "Pool-Name", ":=", "dialup_pool1"); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('dialup_pool1', '192.168.0.1'); radiusd -X .. .. rlm_sql_mysql: MYSQL check_error: 1064 received sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND' .. .. rlm_sql_mysql: MYSQL check_error: 1064 received sqlippool_command: database query error in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '123.123.123.138' AND framedipaddress = '200.200.200.173'' .. .. -------------------------------------------------------------------------------------------------------------- Module: Instantiating sqlippool sqlippool { sql-instance-name = "sql" lease-duration = 3600 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time < = NOW() - INTERVAL 1 SECOND" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I'" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } ________________________________________________________ 180도 달라진 야후! 메일 - 알아서 척척! 새로운 야후! 메일은 10분에 한번 스스로 새 메시지를 받아온답니다. http://kr.content.mail.yahoo.com/cgland

2 1

New functionality in CVS head.
by Alan DeKok 20 Apr '08

20 Apr '08

After some oblique hints and private tests, I've committed some interesting new functionality to CVS head. The latest feature extends FreeRADIUS past RADIUS, and *way* past VMPS. In short, it turns FreeRADIUS into a DHCP server. This means that any network needing an *integrated* 802.1x and DHCP solution can use one piece of software: FreeRADIUS. There are some limitations, of course. The code is experimental, and is not included in the default build. (use ./configure --with-dhcp). It has few of the features that a normal DHCP server has. We are looking for migration scripts from legacy servers and database schemas, as there are none right now. The short-term goal is to gain wider testing, and contributions from the community. It has been tested to work with Windows XP, Vista, MAC, Linux, and *BSD. This means that the basic DHCP functionality is there for receiving packets, sending packets, and putting contents into packets. Any other features normally in a DHCP server don't exist. e.g. allocating unused IP's, lease expiry, etc. These features should not be too hard to add, as FreeRADIUS already has multiple "IP allocation" modules for RADIUS packets. That code can be re-targeted for DHCP without too much work. The current code *should* work when the MAC address of the client is known, and a fixed IP is assigned to that MAC. Anything else is at the "to be implemented" stage. Comments, (and patches) are welcome. Alan DeKok.

1 0

Re: the newbie on radiustesting strikes again
by Si St 19 Apr '08

19 Apr '08

> ----- Original Message ----- > From: "Ivan Kalik" <tnt(a)kalik.net> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: the newbie on radiustesting strikes again > Date: Sat, 19 Apr 2008 17:34:36 +0100 > > > >> You need to sort out some basic things: > >> > >> - your user sits at the laptop and connects to - what? What service is > >> router controlling? > > A: to internett via the router for example > > What service is router controlling? > > A:The traffic through the DSL-modem (You mean to say: "Which > > service is the router controlling" or "Which service is > > routercontrolling" i.e. controlling the router?) > > OK. But how are they going to connect to the router? You are mentioning > PEAP, so I assume that router does support EAP (WPA-Enterprise)? For > wireless clients. Will there be wired clients? Can their access be > controlled? The Router supports EAP/WPA-Enterprise(has a box for this choice;) Automatic (WPA or WPA2), TKIP and AES There will probably for all practical purposes be only wireless clients:3 laptops and one workstation,but I have configured 2 IP addresses for each laptop, one for their wireless card the other address for the wired/cabled card in case they will be needed. The access of the clients are controlled allowing only the specific MAC addresses of each machine to connect to the router.(Routers Netfilter) The machines have also fixed IPs reserved. > > >> - your router is most likely the only (radius) client on your network. > >> User machines should be removed from clients.conf. > > A:Remove all user machines > > Thus only one machine, the router, is to be defined as client > > client 192.168.0.1 { > > secret = testing123 > > shortname = asus-TL > > nastype = other > > # DLINK 635 Router > > } > > That should be fine now. > > >> > >> - don't use Auth-Type and User-Password. Read instructions in users > >> file. Documentation you got these entries from is years out of date. > > A: FreeRADIUS Version 1.0.4. - And this is a tricky part. If no > > Auth-Type and User-Password, should I apply Fall-Through instead > > to have a DEFAULT running? > > OK, disregard what I said. You are using version that is years out of > date, so those entries are likely to be correct. Just check that you can > disable DHCP on the router and hand IPs via radius. DHCP-server can be deactivated on the router but I had some problems making a deactivation work for the WinOSs. If the 4 machines have IPs 192.168.0.193-199 I could set DHCP reservations range on the router to the same and thus stop the server,is this safe, or does it disturb the radius DHCP ability? > > If you upgrade to current version certificates will be created for you. > Even if you don't want to upgrade you can download 2.0.3 and use it to > generate certificates that you can use in 1.0.4. I have right now downloaded the 2.0.3 and had a look at it. I could later try to generate certificates, as you say. Could also later try to upgrade. Hope SuSE 10.0 has the necessary environment for it. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

3 2

Re: the newbie on radiustesting strikes again
by Si St 19 Apr '08

19 Apr '08

> ----- Original Message ----- > From: "Ivan Kalik" <tnt(a)kalik.net> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: the newbie on radiustesting strikes again > Date: Sat, 19 Apr 2008 00:15:09 +0100 > > > You need to sort out some basic things: > > - your user sits at the laptop and connects to - what? What service is > router controlling? A: to internett via the router for example What service is router controlling? A:The traffic through the DSL-modem (You mean to say: "Which service is the router controlling" or "Which service is routercontrolling" i.e. controlling the router?) > > - your router is most likely the only (radius) client on your network. > User machines should be removed from clients.conf. A:Remove all user machines Thus only one machine, the router, is to be defined as client client 192.168.0.1 { secret = testing123 shortname = asus-TL nastype = other # DLINK 635 Router } > > - don't use Auth-Type and User-Password. Read instructions in users > file. Documentation you got these entries from is years out of date. A: FreeRADIUS Version 1.0.4. - And this is a tricky part. If no Auth-Type and User-Password, should I apply Fall-Through instead to have a DEFAULT running? > > Ican Kalik > Kalik Informatika ISP > > > Dana 18/4/2008, "Si St" <sigbj-st(a)operamail.com> piše: > > > WILL THE DEFAULT ROUTER FIREWALL CONFIGURATION BELOW WORK WITH THE RADIUS? > > Below you have the default setup of my router firewall section. I > > have not changed anything there yet. Could the router firewall > > stay as this? I have been looking through the SuSE-firewall > > settings in YaST too, and cannot find anything that should > > interfere there. I would also expect an installation of radius to > > harmonize with the SuSEfirewall2 through the /sbin/SuSEconfig > > anyhow. > > > > DOES THE ROUTER EAP CONFIGURATION BELOW LOOK RIGHT? > > Further, below you have also a proposal of how I would set up the > > radius-section of that router. The main thing here is to try to > > show if I really know what I am doing. The Shared Secret and user > > passwords are chosen in correspondance with my understanding of > > Alan DeKOKs answer of my first mails; I am here thinking of > > identity/password in YaST and secret in Router configs. > > > > ANY FIRST-THOUGHT COMMENT ON MY clients.conf AND users? > > I have tested out the changes I have made of /etc/raddb/users and > > clients.conf, starting debugmode with radiusd -X. This in > > correspondance with Buxeys recommendations to further proceed > > into the Inner Circle of Radius.No errors or warnings,"Ready to > > process requests". (The only one I had was forgetting a comma > > previous to the Reply_Message line. And I outcommented > > consciously certain values to test out the messages of the radius > > debug). As to the recent back-and-forth writing on the > > mailing-list about the file- and directory permissions in > > /etc/raddb/certs and demoCA, I chose to stay with the proposal of > > Hood, letting the files stay 640 as they used to and changing the > > seemingly bad and wrong permissions of certs/ and demoCA/ from > > 640 to 750. > > > > The next job is to work out the certificates, but here I have > > really good help by the stuff in > > /usr/share/doc/packages/freeradius/CA.certs, and I have already > > studied and tried out this part . > > > > > > ---------------------------------------- > > ROUTER FIREWALL SETTINGS > > ---------------------------------------- > > Enable SPI : YES > > > > NAT ENDPOINT FILTERING > > UDP Endpoint Filtering > > Endpoint Independent: NO > > Address Restricted: YES > > Port And Address Restricted:NO > > > > TCP Endpoint Filtering > > Endpoint Independent > > Address Restricted: NO > > Port And Address Restricted: YES > > > > ---------------------------------------- > > Radius configuration on the router > > EAP (802.1x) > > ---------------------------------------- > > Authentication Timeout : 60 (minutes) > > RADIUS server IP Address : 192.168.0.198 > > RADIUS server Port : 1812 > > RADIUS server Shared Secret : testing123 > > MAC Address Authentication : YES > > > > ------------------------------------------------- > > SuSE YaST setup for EAP-TLS > > ------------------------------------------------- > > machine/PC IP-address 192.168.0.198 > > Identity: sigbj > > Password: testing-0 > > Client-certificat: (file-address of this machine) > > Server-certificat: (file-address of this machine) > > ------------------------------------------------- > > machine/PC IP-address 192.168.0.196 > > Identity: elise > > Password: testing-2 > > Client-certificat: (file-address of this machine) > > Server-certificat: (file-address of this machine) > > ------------------------------------------------- > > (next machine,but now only WinOS: we have to do PEAP) > > ======================================== > > /etc/raddb/clients.conf > > -------------------------------------------- > > client 192.168.0.198 { > > secret = testing123 > > shortname = asus-TL > > nastype = other > > # SuSE 10.0_EAP-TLS; (WinXP_PEAP) -laptop > > } > > > > client 192.168.0.197 { > > secret = testing123 > > shortname = hp-TL > > nastype = other > > # WinVista_PEAP -laptop > > } > > > > client 192.168.0.196 { > > secret = testing123 > > shortname = loft-TL > > nastype = other > > # SLED SP1_EAP-TLS; WinXP_PEAP -workstation > > } > > > > client 192.168.0.195 { > > secret = testing123 > > shortname = acer-TL > > nastype = other > > # WinXP_PEAP -laptop > > } > > ================================================================= > > /etc/raddb/users > > ----------------------------------------------------------------- > > sigbj Auth-Type := Local, User-Password == "testing-0" > > Service-Type = Framed-User, > > Framed-Protocol = PPP, > > Framed-IP-Address = 192.168.0.198, > > Framed-IP-Netmask = 255.255.255.0, > > Framed-Routing = Broadcast-Listen, > > Framed-Filter-Id = "std.ppp", > > Framed-MTU = 1500, > > Framed-Compression = Van-Jacobsen-TCP-IP, > > Reply-Message = "Welcome to The Inner Circle, %u" > > > > andr Auth-Type := Local, User-Password == "testing-1" > > Service-Type = Framed-User, > > Framed-Protocol = PPP, > > Framed-IP-Address = 192.168.0.197, > > Framed-IP-Netmask = 255.255.255.0, > > Framed-Routing = Broadcast-Listen, > > Framed-Filter-Id = "std.ppp", > > Framed-MTU = 1500, > > Framed-Compression = Van-Jacobsen-TCP-IP, > > Reply-Message = "Welcome to The Inner Circle, %u" > > > > elise Auth-Type := Local, User-Password == "testing-2" > > Service-Type = Framed-User, > > Framed-Protocol = PPP, > > Framed-IP-Address = 192.168.0.196, > > Framed-IP-Netmask = 255.255.255.0, > > Framed-Routing = Broadcast-Listen, > > Framed-Filter-Id = "std.ppp", > > Framed-MTU = 1500, > > Framed-Compression = Van-Jacobsen-TCP-IP, > > Reply-Message = "Welcome to The Inner Circle, %u" > > > > ingv Auth-Type := Local, User-Password == "testing-3" > > Service-Type = Framed-User, > > Framed-Protocol = PPP, > > Framed-IP-Address = 192.168.0.195, > > Framed-IP-Netmask = 255.255.255.0, > > Framed-Routing = Broadcast-Listen, > > Framed-Filter-Id = "std.ppp", > > Framed-MTU = 1500, > > Framed-Compression = Van-Jacobsen-TCP-IP, > > Reply-Message = "Welcome to The Inner Circle, %u" > > > > --------------------------------------------------------------- > > > > > > -- > > _______________________________________________ > > Surf the Web in a faster, safer and easier way: > > Download Opera 9 at http://www.opera.com > > > > Powered by Outblaze > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1