April 2008 - Freeradius-Users - lists.freeradius.org

It is possible to limit the maximum number of same users allowed online?
by kutul＠simauria.net 19 Apr '08

19 Apr '08

hi, I have mounted a freeradius server whith mysql. It is possible to limit the maximum number of same users (or sessions) allowed online? and if this is possiblem, how can i do it? I need that only one user can login one time at same time.

3 2

the newbie on radiustesting strikes again
by Si St 18 Apr '08

18 Apr '08

WILL THE DEFAULT ROUTER FIREWALL CONFIGURATION BELOW WORK WITH THE RADIUS? Below you have the default setup of my router firewall section. I have not changed anything there yet. Could the router firewall stay as this? I have been looking through the SuSE-firewall settings in YaST too, and cannot find anything that should interfere there. I would also expect an installation of radius to harmonize with the SuSEfirewall2 through the /sbin/SuSEconfig anyhow. DOES THE ROUTER EAP CONFIGURATION BELOW LOOK RIGHT? Further, below you have also a proposal of how I would set up the radius-section of that router. The main thing here is to try to show if I really know what I am doing. The Shared Secret and user passwords are chosen in correspondance with my understanding of Alan DeKOKs answer of my first mails; I am here thinking of identity/password in YaST and secret in Router configs. ANY FIRST-THOUGHT COMMENT ON MY clients.conf AND users? I have tested out the changes I have made of /etc/raddb/users and clients.conf, starting debugmode with radiusd -X. This in correspondance with Buxeys recommendations to further proceed into the Inner Circle of Radius.No errors or warnings,"Ready to process requests". (The only one I had was forgetting a comma previous to the Reply_Message line. And I outcommented consciously certain values to test out the messages of the radius debug). As to the recent back-and-forth writing on the mailing-list about the file- and directory permissions in /etc/raddb/certs and demoCA, I chose to stay with the proposal of Hood, letting the files stay 640 as they used to and changing the seemingly bad and wrong permissions of certs/ and demoCA/ from 640 to 750. The next job is to work out the certificates, but here I have really good help by the stuff in /usr/share/doc/packages/freeradius/CA.certs, and I have already studied and tried out this part . /*But first - if you may - take a look at the matter below, and by the way it is Friday evening, at least in Norway now, and you may make yourselves a good sharp drink to have that burning sensation of exploring newbies crap with "failed","errors","really bad code,how is it possible to scribble so much sh..","God, do you really need to fill up our servers with so much unnecessary writing", and so on. But don't spill the boos on your keyboards, especially if you have those laptops;it is hell of a job to unscrew it, dry it up, and finally realizing that those plastic screw-holes do not fit so tight anymore. - Thanks people , so far! */ ---------------------------------------- ROUTER FIREWALL SETTINGS ---------------------------------------- Enable SPI : YES NAT ENDPOINT FILTERING UDP Endpoint Filtering Endpoint Independent: NO Address Restricted: YES Port And Address Restricted:NO TCP Endpoint Filtering Endpoint Independent Address Restricted: NO Port And Address Restricted: YES ---------------------------------------- Radius configuration on the router EAP (802.1x) ---------------------------------------- Authentication Timeout : 60 (minutes) RADIUS server IP Address : 192.168.0.198 RADIUS server Port : 1812 RADIUS server Shared Secret : testing123 MAC Address Authentication : YES ------------------------------------------------- SuSE YaST setup for EAP-TLS ------------------------------------------------- machine/PC IP-address 192.168.0.198 Identity: sigbj Password: testing-0 Client-certificat: (file-address of this machine) Server-certificat: (file-address of this machine) ------------------------------------------------- machine/PC IP-address 192.168.0.196 Identity: elise Password: testing-2 Client-certificat: (file-address of this machine) Server-certificat: (file-address of this machine) ------------------------------------------------- (next machine,but now only WinOS: we have to do PEAP) ======================================== /etc/raddb/clients.conf -------------------------------------------- client 192.168.0.198 { secret = testing123 shortname = asus-TL nastype = other # SuSE 10.0_EAP-TLS; (WinXP_PEAP) -laptop } client 192.168.0.197 { secret = testing123 shortname = hp-TL nastype = other # WinVista_PEAP -laptop } client 192.168.0.196 { secret = testing123 shortname = loft-TL nastype = other # SLED SP1_EAP-TLS; WinXP_PEAP -workstation } client 192.168.0.195 { secret = testing123 shortname = acer-TL nastype = other # WinXP_PEAP -laptop } ================================================================= /etc/raddb/users ----------------------------------------------------------------- sigbj Auth-Type := Local, User-Password == "testing-0" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.0.198, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Reply-Message = "Welcome to The Inner Circle, %u" andr Auth-Type := Local, User-Password == "testing-1" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.0.197, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Reply-Message = "Welcome to The Inner Circle, %u" elise Auth-Type := Local, User-Password == "testing-2" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.0.196, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Reply-Message = "Welcome to The Inner Circle, %u" ingv Auth-Type := Local, User-Password == "testing-3" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.0.195, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Reply-Message = "Welcome to The Inner Circle, %u" --------------------------------------------------------------- -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

Hello, sqlippool error
by 현옥 장 18 Apr '08

18 Apr '08

Hello Thank you very much Readme Fedora core 5 freeradius-client-1.1.5.tar.bz2 ./confiugre make make install freeradius-server-2.0.3.tar.gz %configure --prefix=%{_prefix} \ --localstatedir=%{_localstatedir} \ --sysconfdir=%{_sysconfdir} \ --mandir=%{_mandir} \ --with-docdir=%{_datadir}/doc/%{name}-%{version} \ --with-system-libtool \ --disable-ltdl-install \ --with-ltdl-lib=/usr/lib \ --with-ltdl-include=/usr/include \ --with-large-files --with-udpfromto --with-edir \ --with-mysql-lib-dir=/usr/lib/mysql \ --with-mysql-include-dir=/usr/include/mysql \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ --with-rlm-krb5-lib-dir=/usr/kerberos/lib rpmbuild -bb freeradius.spec rpm -Uvh freeradius-server-2.0.3-0.i386.rpm rpm -Uvh freeradius-server-debuginfo-2.0.3-0.i386.rpm pool-check = "SELECT id FROM ${ippool_table} WHERE pool_name='%{check:Pool-Name}' LIMIT 1" accounting { sqlippool } post-auth { sqlippool } user file DEFAULT Pool-Name := dialup_pool1 Fall-Through = Yes INSERT INTO radippool (pool_name, framedipaddress) VALUES ('dialup_pool1', '192.168.0.1'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('dialup_pool1', '192.168.0.2'); INSERT INTO radgroupcheck (GroupName, Attribute, op, Value) values("dialup_pool1", "Pool-Name", ":=", "dialup_pool1"); radiusd -X sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } FULL log .========================================================================== FreeRADIUS Version 2.0.3, for host i686-redhat-linux-gnu, built on Apr 15 2008 at 18:25:23 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/sqlippool.conf including configuration file /etc/raddb/sql/mysql/ippool.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "test1234" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "test1234" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sqlcounter Module: Instantiating noresetcounter sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute Max-All-Session is number 3000 rlm_sqlcounter: Current Time: 1208535834 [2008-04-19 01:23:54], Next reset 0 [2008-04-19 01:00:00] rlm_sqlcounter: Current Time: 1208535834 [2008-04-19 01:23:54], Prev reset 0 [2008-04-19 01:00:00] } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiusid" password = "test1234" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiusid@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_sqlippool Module: Instantiating sqlippool sqlippool { sql-instance-name = "sql" lease-duration = 3600 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I'" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{Calling-Station-Id}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time IS NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } rlm_sql (sql): Reserving sql socket id: 4 Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ________________________________________________________ 180도 달라진 야후! 메일 - 여러 개의 메시지를 동시에 확인? 새로운 야후! 메일의 탭으로 가능해집니다. http://kr.content.mail.yahoo.com/cgland

1 0

Timeouts
by Ben Wiechman 18 Apr '08

18 Apr '08

What are some techniques you all use to try and track down auth timeouts? Is it normal to see some small percentage of auth timeouts on a typical NAS, even if the radius server isn't all that heavily loaded? I am seeing around 2% timeout on my secondary server that is running radius only. This is strange to me however as my primary server has nearly no timeouts with the same config, same hardware, same OS, same network path. Any tips on tracking down where the issue might be? Ben Wiechman

2 2

test md5
by xiningtom_1986 18 Apr '08

18 Apr '08

Hello! Today I tried the md5 method,but at the last step when I sent the Access-Accept packet to the supplicant,the supplicant said that there is no session key and it can't continue to do the 4 way handshake.Why? The client use the wpa_supplicant. Xiningtom

3 3

OT: EAP-TTLS - Problem with securew2 and Vista
by Sergio Belkin 18 Apr '08

18 Apr '08

Hi, Sorry for the Off Topic, I know that I can ask in securew2 forums, but I bet that many of you as radius administrators with Windows clients are using EAP-TTLS with PAP. So, you are using securew2. *** Securew2 works fine with Windows XP. *** Sadly, newers laptops are shipped with a crappy system called Windows Vista. It happens that many laptops with Vista due a unknown reason (at least for me) prevents that securew2 appears, so users can't authenticate. Perhaps, many of you had faced this problem and solved it, if it's the case, please could you say me how? Perhaps you found another tool... I am using encrypted password in LDAP and it seems that have no chance to use someting different as EAP-TTLS with PAP. I'd thank your help. Thanks in advance. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 3

Re: clients can't authenticate in FR 2.0.3
by Gustavo Chavelas 18 Apr '08

18 Apr '08

I have tried to configure the 2.0.3 because they said to me in the forum that the VISTA works with a version superior to the 2. With version 2.0.3 or the 2.0.2 it does not allow me to connect nothing. Can't connect XP, VISTA or CE clients. I cannot connect anything. I will try with 1.1.4 or latest version. Thanks Gustavo. > Gustavo Chavelas wrote: > But when I to configure the freeradius-1.1.3-1.2.el5 (rpm) it works fine. > My windows XP and CE clients connect without problems, but I need > urgently to connect a Windows Vista clients too. You can try upgrading to 1.1.7, which should work with Vista, and will be compatible with the configuration you have for 1.1.3. I'm not sure why 2.0.3 wouldn't work. What happens when a Vista client tries to connect?

3 2

rlm_perl , unlang and Exec-Wait with Perl
by rsg 18 Apr '08

18 Apr '08

Hi, How could one compare between Rlm_perl and Unlang(or any other relevant module) for performance. I've read in http://wiki.freeradius.org/index.php/Rlm_perl that rlm_perl supports muliple instances and threads allowing faster processing. How is it with policies done using unlang? ......Faster, slower or no significant diff? As described in the same site 'Exec-Program-Wait' with perl scripts is slower than rlm_perl. Would like to have a clearer view about these points. Thanks, rg

3 6

rlm_perl - authorize - authenticate issue
by Apostolos Pantsiopoulos 18 Apr '08

18 Apr '08

Hi, I am using freeradius (rlm_perl) for a VoIP system for a long time now and today I tried to use it for routing purposes as well. In my authorize function of my perl script I am assigning the routing info to $RAD_REPLY : ... my @final_routing = ( "MLPAMPLA01/1/$calling_num/$called_num/$calling_num/$called_num/xxx.xxx.xxx.xxx:1720", "MLPAMPLA02/1/$calling_num/$called_num/$calling_num/$called_num/yyy.yyy.yyy.yyy:1720", ); ... $RAD_REPLY{'Cisco-Command-Code'} = \@final_routing; ... My authenticate section is very simple for now (accept everything): sub authenticate { return RLM_MODULE_OK; } My problem is that when freeradius accepts a message it processes the authorize section correctly : rlm_perl: Added pair Cisco-Command-Code = MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720 rlm_perl: Added pair Cisco-Command-Code = MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720 and when it processes the authenticate section it adds the above two pairs one more time leading to this reply : Sending Access-Accept of id 139 to zzz.zzz.zzz.zzz port 1814 Cisco-Command-Code += "MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720" Cisco-Command-Code += "MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720" Cisco-Command-Code += "MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720" Cisco-Command-Code += "MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720" ...which is not the desired result. In which part does the second addition of the attributes occur? The debug output follows : Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_realm: Looking up realm "LLL" for User-Name = "TEST@LLL" rlm_realm: No such realm "LLL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 perl_pool: item 0x950f330 asigned new request. Handled so far: 1 found interpetator at address 0x950f330 rlm_perl: Added pair Cisco-Command-Code = MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720 rlm_perl: Added pair Cisco-Command-Code = MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720 rlm_perl: Added pair Auth-Type = PERL perl_pool total/active/spare [10/0/10] Unreserve perl at address 0x950f330 modcall[authorize]: module "perl" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type PERL auth: type "PERL" Processing the authenticate section of radiusd.conf modcall: entering group PERL for request 0 perl_pool: item 0xa009ae0 asigned new request. Handled so far: 1 found interpetator at address 0xa009ae0 rlm_perl: Added pair Cisco-Command-Code = MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720 rlm_perl: Added pair Cisco-Command-Code = MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720 rlm_perl: Added pair Auth-Type = PERL perl_pool total/active/spare [10/0/10] Unreserve perl at address 0xa009ae0 modcall[authenticate]: module "perl" returns ok for request 0 modcall: leaving group PERL (returns ok) for request 0 Sending Access-Accept of id 17 to ooo.ooo.ooo.ooo port 1814 Cisco-Command-Code += "MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720" Cisco-Command-Code += "MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720" Cisco-Command-Code += "MLPAMPLA01/1//ddddddddddddd//ddddddddddddd/xxx.xxx.xxx.xxx:1720" Cisco-Command-Code += "MLPAMPLA02/1//ddddddddddddd//ddddddddddddd/yyy.yyy.yyy.yyy:1720" Finished request 0 -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

1 0

Re: Vendor-Specific attributes in Modules
by Vincent Arniego 18 Apr '08

18 Apr '08

Thanks Alan, I'll take a look at it and hopefully I can get the value. Thanks again! ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, April 18, 2008 5:58:23 PM Subject: Re: Vendor-Specific attributes in Modules Vincent Arniego wrote: > But somehow the messages we're getting have that attribute around 3 > times in the request. That's allowed in RADIUS. > This is from the file were feeding radclient: > > Nokia-Avpair="ita:ubi=0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0" > Nokia-Avpair+="ita:ubo=0/231/75672/97893/864/55/5676/247/235578/46759/110/12118/76812/1978453/1534/15359/11246" > Nokia-Avpair+="ita:sc=0/1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16" > > How do we distinguish each of the values for parsing in the module? The attributes are in a "linked list" in request->packet->vps. Look at the rest of the code to see how it manipulates the list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0