January 2009 - Freeradius-Users - lists.freeradius.org

Proxying: Multiple accounting hosts?
by Adam Bultman 12 Jan '09

12 Jan '09

I have Freeradius 2.1 built, and somehow, radrelay didn't get built. I was poking around on google, and it looks like proxy.conf might help me replace radrelay. Can you have multiple accthosts inside of proxy.conf realms? Like this: realm mydomain.com { type = radius authhost = LOCAL accthost = LOCAL accthost = 192.168.1.2:1813 accthost ... } On my FreeRADIUS 1.x server, I have a LOT of radrelay processes running, and it'd be nice to replace them all with proxy.conf. It'd make it much easier to manage for everybody else that might touch the server. I apologize if this is a dumb question, but I googled for a bit and didn't find anything. Adam

2 1

Error in test Freeradius
by Paulo César Naves Mota 12 Jan '09

12 Jan '09

Hello people, I`d like to know how to resolve this problem in configuration: [root@serverRH5 raddb]# radtest pc1 123456 localhost 0 mysecret Sending Access-Request of id 169 to 127.0.0.1 port 1812 User-Name = "pc1" User-Password = "123456" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=169, length=20 My clients.conf client localhost { ipaddr = 127.0.0.1 secret = mysecret require_message_authenticator = no shortname = localhost nastype = other } Thanks for all Best Regards Paulo Cesar

6 8

freeradius proxying to Juniper Steel-Belted - returning trailing \000 in attributes
by Jørn Kostøl 12 Jan '09

12 Jan '09

I'm running freeradius v2.1.1 that proxies to a Juniper Steel-Belted Radius. (NAS->freeradius->Juniper). The authentication works and the reply is sent to my NAS, but the Juniper sends back trailing \000 in the return attributes which my NAS obviously is not too fond of. The debug shows: rad_recv: Access-Accept packet from host <stripped> port 1812, id=94, length=289 Class = 0x53425232434c978dc5a3c1f6cbdbd4c011802c01800281988002801081aa91aab5a2d5a6c5a9908ab5a1b99ccc12800e81978dc5a3c1f6cbdbd4c289e48c84 Proxy-State = 0x3838 Cisco-AVPair = "+=lcp:interface-config= ip unnumbered lo10\000" Cisco-AVPair = "+=ip:addr-pool=testpool\000" Cisco-AVPair = "+=lcp:interface-config= ip vrf forwarding testvrf\000" Cisco-AVPair = "+=ip:dns-servers=x.x.x.x y.y.y.y\000" I'm having a problem figuring out where the trailing \000 is coming from. Has anyone experienced similar behavior or have experience proxying from freeradius to Juniper? Cheers, Jørn

2 1

3gpp2 parameter starts with '\0'
by lamersons 12 Jan '09

12 Jan '09

(debug listed below) Freeradius 2.x with Postgre database I need to store ESN value to my database, but it comes in format[3GPP2-ESN = "\000\000\000\000\000\000\00000BBF636"]. Freeradius counts '\0' as the end of the line and puts blank instead of actual parameter value. Not only ESN comes in that format but [Acct-Session-Id = "0000000\000"] does too. Does any1 have any ideas about this ? Thank You, Michael Zotov --------------------------------------------------------------------------------------------- main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 8192 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client PDSN { ipaddr = 192.168.145.1 netmask = 32 require_message_authenticator = no secret = "pdsn-key" shortname = "" nastype = "other" } client ltk1 { ipaddr = 80.232.227.87 require_message_authenticator = no secret = "cdma" shortname = "" nastype = "other" } client ltk2 { ipaddr = 80.232.227.88 require_message_authenticator = no secret = "cdma" shortname = "" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server ltk1 { ipaddr = 80.232.227.87 port = 1813 type = "acct" secret = "cdma" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server ltk2 { ipaddr = 80.232.227.88 port = 1813 type = "acct" secret = "cdma" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool ltk { type = fail-over home_server = ltk1 home_server = ltk2 } realm evdo.lattelecom { acct_pool = ltk nostrip } realm cdma.ltk.lv { acct_pool = ltk nostrip } realm lattelecom { acct_pool = ltk nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "Calling-Station-Id, Acct-Session-Id, 3GPP2-Correlation-Id" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "" password = "" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 48 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}', ' es es es est')" accounting_start_query_alt = "" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%{Event-Timestamp}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '%{Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', CDMABadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', CDMACorrelationId = '%{3GPP2-Correlation-Id}', CDMAActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /\" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radacc@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #31 rlm_sql (sql): Connected new DB handle, #31 rlm_sql (sql): starting 32 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #32 rlm_sql (sql): Connected new DB handle, #32 rlm_sql (sql): starting 33 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #33 rlm_sql (sql): Connected new DB handle, #33 rlm_sql (sql): starting 34 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #34 rlm_sql (sql): Connected new DB handle, #34 rlm_sql (sql): starting 35 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #35 rlm_sql (sql): Connected new DB handle, #35 rlm_sql (sql): starting 36 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #36 rlm_sql (sql): Connected new DB handle, #36 rlm_sql (sql): starting 37 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #37 rlm_sql (sql): Connected new DB handle, #37 rlm_sql (sql): starting 38 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #38 rlm_sql (sql): Connected new DB handle, #38 rlm_sql (sql): starting 39 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #39 rlm_sql (sql): Connected new DB handle, #39 rlm_sql (sql): starting 40 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #40 rlm_sql (sql): Connected new DB handle, #40 rlm_sql (sql): starting 41 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #41 rlm_sql (sql): Connected new DB handle, #41 rlm_sql (sql): starting 42 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #42 rlm_sql (sql): Connected new DB handle, #42 rlm_sql (sql): starting 43 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #43 rlm_sql (sql): Connected new DB handle, #43 rlm_sql (sql): starting 44 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #44 rlm_sql (sql): Connected new DB handle, #44 rlm_sql (sql): starting 45 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #45 rlm_sql (sql): Connected new DB handle, #45 rlm_sql (sql): starting 46 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #46 rlm_sql (sql): Connected new DB handle, #46 rlm_sql (sql): starting 47 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #47 rlm_sql (sql): Connected new DB handle, #47 } } radiusd: #### Opening IP addresses and Ports #### listen { type = "acct" ipaddr = 192.168.104.5 port = 1813 } Listening on accounting address 192.168.104.5 port 1813 Listening on proxy address * port 1489 Ready to process requests. Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823967" Framed-IP-Address = 192.168.173.4 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jan 9 2009 10:58:30 EET" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\00000BBF636" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "35067449" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "35067449",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823967"' rlm_acct_unique: Acct-Unique-Session-ID = "44d6e7436e38e449". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}','%{3GPP2-ESN}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress, esn) values('0000000', '44d6e7436e38e449', '247033715823967', 'Jan 9 2009 10:58:30 EET', NULL,'0', '0', '0', '192.168.173.4', trim('triatel(a)triatel.lv'), '0', '0', '35067449', '0', '192.168.145.1', '') rlm_sql (sql): Reserving sql socket id: 47 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 47 ++[sql] returns ok -------------------------------------------------------------------------------------------------- -- View this message in context: http://www.nabble.com/3gpp2-parameter-starts-with-%27%5C0%27-tp21409780p214… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 8

Re: Authentication Problem with PEAP and openldap
by Michael Poser 12 Jan '09

12 Jan '09

Hello Alan, thank you for your reply. The mapping of the NT-Password describe exactly our problem. We cannot find the right passage in the radius config to do this. Maybe you can give as a little hint, this would be very kindly. Best Regards, Michael > native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via > freeradius against openldap with an md4 encoded utf-16e password hash. The > authentication fails. If we use the hash instead of the clear-text password > with the xp client, the authentication works fine. There must be some > problems with the encryption of the password. How do we fix the problem? Any > help is appreciated. You may have the NT hash of the password in the LDAP database, but you're telling FreeRADIUS it's the clear-text password: ... > rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter > (uid=plisch01) > rlm_ldap: Added password 4183... in check items You want to map this to the NT-Password attribute. Alan DeKok. -- Michael Poser, HRZ - Abteilung Netze Tel.:069/798-28052

3 2

Disconnect packet
by Johan Meiring 12 Jan '09

12 Jan '09

Hi, This might be slightly off topic, but hoping I could get a pointer here. I am trying to use an openvpn talking to radius. I want the openvpn server to be able to receive a COA/DISCONNECT packet. The first idea I came up with was to try and get freeradius to receive the packet, then using rlm_perl do whatever I want after examining the packet. I realize that freeradius is not designed to do this, but I was hoping either the atuhentication of accounting module could give the packet to my own perl script to then "parse" and act upon. 1) Can anyone think of a way how freeradius might receive the packet for me and then pass it to perl for me to act on? or 2) Is anyone aware of other software that might listen on the coa port 1700/3799, receive a packet, parse it somehow and call my script to "disconnect" the client. i.e. a "disconnect server". as per http://wiki.freeradius.org/DM Thanks! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

3 8

Creation of User Accounts and Certificates
by mihir patankar 12 Jan '09

12 Jan '09

Hi, We want to know how to create EAP-TTLS User Accounts and Accounts specific Certificates in Free-Radius. As of now we have only created PAP Accounts. Mihir V Patankar

4 9

Re: Freeradius-Users Digest, Vol 45, Issue 31
by Hanno Schupp 12 Jan '09

12 Jan '09

> > > Dear All, > > > > > > > > I have a few questions regarding the rlm_sqlcounter module and its > > configuration. I have a freeradius 2.1.0 communicating with a router > running > > chillispot 1.1 I set up counters for time, data volume, and with > different > > reset periods. All works fine and as expected. > > > > > > > > Here my questions: > > > > > > > > 1) After the time or data volume for a period (say a month) is > reached > > the user is automatically disconnected – as expected. Rather them not > > allowing to log in , I would like freeradius to return some other > attributes > > (WISPr-Bandwidth-Max-Up and WISPr-Bandwidth-Max-Down work fine with > > ChilliSpot) to be sent to the router for the user, so that a connection > is > > still possible, but at a much lower maximum speed. Can that be done, and > if > > so, can someone give me a pointer. I was thinking maybe using unlang, but > I > > may be barking up the wrong tree. > > > > You might be better off making changes to your provisioning system > assuming you are using a database backend although > you might be able to get away with unlang. I know 'I might be able to get away with unlang'. I was hoping for a useful pointer as to how. I have followed this up further and have a new roadblock. I have put this code into my 'authorize' section: ... monthlytotal if (reject) { update control { Auth-Type := "Accept" } update reply { WISPr-Bandwidth-Max-Down := 256000 WISPr-Bandwidth-Max-Up := 32000 } } monthlyupload monthlydownload logintime ... Module monthlytotal is behaving as expected (definition below), throwing a reject, when the so far in the month used Octets exceed the set limit for the user. However, what appears to happen when looking through the debug (below), freeradius appears to stop processing any further modules in the authorise section. Is that what is expected? If so, can this behaviour be changed through configuration, or does this require a whole new module? ... sqlcounter monthlytotal { counter-name = Max-Monthly-Total-Octets check-name = Max-Monthly-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql02 key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } ... ... Mon Jan 12 11:49:28 2009 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Mon Jan 12 11:49:28 2009 : Debug: rlm_sqlcounter: Rejected user yubvef24, check_item=500000, counter=535178 Mon Jan 12 11:49:28 2009 : Info: ++[monthlytotal] returns reject Mon Jan 12 11:49:28 2009 : Info: Using Post-Auth-Type Reject Mon Jan 12 11:49:28 2009 : Info: +- entering group REJECT {...} Mon Jan 12 11:49:28 2009 : Debug: expand: %{User-Name} -> yubvef24 Mon Jan 12 11:49:28 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jan 12 11:49:28 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Jan 12 11:49:28 2009 : Info: Delaying reject of request 0 for 1 seconds ... > > > > > > > > 2) The reset = monthly method seem to the first of the current > > month. That is one way of doing it, but I would like the reset to occur > at > > the same date in the month every month. So if someone signs up, say on > the > > 12th of a month, the reset will occur every month on the 12th. Can that > be > > done with freeradius? > > > > > > rlm_sqlcounter only support calendar month or day or week. I am surprised to hear that, as this seems to be the standard way any ISP I came accross in this part of the world seems to define a 'month', including large internationals. If the final answer remains 'no, this cannot be done', who do I need to contact to discuss sponsoring the development of such a new feature within the module? > > > > > > 3) Currently I receive something like Reply-Message = "Your > maximum > > never usage time has been reached" when the counter reaches its limit – > > even when what was counted as not time but data volume. Can Reply-Message > > for sqlcounter be configured as in the expiration module? > > > > > > rlm_sqlcounter does not have provision for cusom reply messages. There > was a patch floating around to send custom reply messages from > rlm_sqlcounter. Probably you should look in mailing list archives. > I have done that, thanks. Neither search for 'rlm_sqlcounter' nor 'Reply-Message' yielded anything useful. > > > > > 4) One surprise I have had: I don't quite understand how the system > > calculates the day for the beginning of the reset = weekly. I appreciate > > that calculating the day of the week is not easy as for example first of > the > > current month or beginning of the day, so I was not surprised to not have > a > > Monday, but I was surprised to see the SQL query run with 'Fri Jan 09 > 2009 > > 00:00:00 GMT+1300 (New Zealand Daylight Time)' as beginning of the week, > > when running the query on a Saturday. BTW, SQL time is configured > correctly, > > and the UNIX_TIMESTAMP is giving a correct timestamp for local time. What > am > > I missing? > > (Note: When setting reset = 7d, I get something more explainable like > 'Sat > > Jan 10 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)', which is the > > beginning of the today's day. Should reset = weekly and reset =7d yield > the > > same result? If not, what is weekly vs 7d, and why does the week not > start > > on a Monday? > > > Interesting running it today, Monday, 12 January 2009 12:26:36 p.m. NZSTD, I get Tuesday, 6 January 2009 12:00:00 a.m. NZSTD as beginning of the time weekly period the system is checking. Can someone explain that logic? ---------- Forwarded message ---------- From: Eric <bbahar3(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Date: Sun, 11 Jan 2009 08:26:41 +0330 Subject: Re:freeradius doesn't sent information to mysql I had sent an instance of accounting request from my vpn server to radius server. you send me that I haven't got anything configured in the accounting section. do you mean that vpn server frame is correct but accounting section in radius server doesn't work? >rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, >length=260 > Acct-Status-Type = Start > Acct-Delay-Time = 0 > NAS-IP-Address = 10.10.10.3 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 4 > MS-RAS-Vendor = 311 > MS-RAS-Version = "MSRASV5.20" > NAS-Port-Type = Virtual > Tunnel-Type:0 = PPTP > Tunnel-Medium-Type:0 = IP > Calling-Station-Id = "192.168.201.59" > Tunnel-Client-Endpoint:0 = "192.168.201.59" > Microsoft-Attr-35 = 0x4d5352415356352e3130 > Microsoft-Attr-34 = 0x4d535241532d302d312d34304432 > 454332364243374334 > > Acct-Session-Id = "118382" > > User-Name = "school" > > Framed-IP-Address = 10.10.10.4 > > Framed-MTU = 1400 > > Session-Timeout = 389554 > > Idle-Timeout = 1200 > > Acct-Multi-Session-Id = "953" > > Acct-Link-Count = 1 > > Event-Timestamp = "Dec 31 2008 15:45:03 IRST" > > Acct-Authentic = RADIUS > > MS-MPPE-Encryption-Types = 0x00000000 > >Sending Accounting-Response of id 133 to 10.10.10.3 port 11858 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

2 2

SQLCounter configuration
by Hanno Schupp 11 Jan '09

11 Jan '09

Dear All, I have a few questions regarding the rlm_sqlcounter module and its configuration. I have a freeradius 2.1.0 communicating with a router running chillispot 1.1 I set up counters for time, data volume, and with different reset periods. All works fine and as expected. Here my questions: 1) After the time or data volume for a period (say a month) is reached the user is automatically disconnected - as expected. Rather them not allowing to log in , I would like freeradius to return some other attributes (WISPr-Bandwidth-Max-Up and WISPr-Bandwidth-Max-Down work fine with ChilliSpot) to be sent to the router for the user, so that a connection is still possible, but at a much lower maximum speed. Can that be done, and if so, can someone give me a pointer. I was thinking maybe using unlang, but I may be barking up the wrong tree. 2) The reset = monthly method seem to the first of the current month. That is one way of doing it, but I would like the reset to occur at the same date in the month every month. So if someone signs up, say on the 12th of a month, the reset will occur every month on the 12th. Can that be done with freeradius? 3) Currently I receive something like Reply-Message = "Your maximum never usage time has been reached" when the counter reaches its limit - even when what was counted as not time but data volume. Can Reply-Message for sqlcounter be configured as in the expiration module? 4) One surprise I have had: I don't quite understand how the system calculates the day for the beginning of the reset = weekly. I appreciate that calculating the day of the week is not easy as for example first of the current month or beginning of the day, so I was not surprised to not have a Monday, but I was surprised to see the SQL query run with 'Fri Jan 09 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)' as beginning of the week, when running the query on a Saturday. BTW, SQL time is configured correctly, and the UNIX_TIMESTAMP is giving a correct timestamp for local time. What am I missing? (Note: When setting reset = 7d, I get something more explainable like 'Sat Jan 10 2009 00:00:00 GMT+1300 (New Zealand Daylight Time)', which is the beginning of the today's day. Should reset = weekly and reset =7d yield the same result? If not, what is weekly vs 7d, and why does the week not start on a Monday? Any hints welcome

3 2

Using checkval for Call Routing with Sippy B2BUA
by Tobias Wolf 11 Jan '09

11 Jan '09

Hello, i am using FreeRadius 1.1.3 and want to use it for Call Routing. The Sippy B2BUA will send AAA Requests to RADIUS and i want the routing based on the Called-Station-Id Attribute. For the beginning i would like to configure the routes in the users-File and later switch to an sql backend. This is my users-File: b2b Called-Station-Id == 555,Called-Station-Id == 557,Auth-Type := Accept h323-ivr-in = 'Routing:12345@192.168.1.1;expires=30;Codecs:alaw,g.726' b2b Called-Station-Id == 556,Called-Station-Id == 558,Auth-Type := Accept h323-ivr-in = 'Routing:12345@192.168.1.2;expires=30;Codecs:alaw,g.726' The Calls will always come from the same user and the called number will have to decide what SIP Server to use. If i have only one Called-Station-Id in the check pairs line, i get the Access-Accept with the reply data. But since one route can have a lot of numbers i need to be able to have several Called-Station-Id Entrys. From the description of the checkval attribute it appeared to me the correct solution. Apart from this the different number ranges are conncected to different end users, which i have to find. This will be an accounting issue. How can this be solved with Freeradius ? The real user is not known when the INVITE reaches Sippy. Sippy sends the request to Freeradius with a lot of information, from which Called-Station-Id will indicate what SIP Server to use and what End User is associated with the call. Just want to clarify the whole procedure: I have several incoming SIP Servers, which sends SIP calls to Sippy. Each SIP Server will control a certain number range and will send its servername as Username. The SIP Server have no infomation about which number belongs to which end user, they forward all calls to Sippy. The Radius Server will have the information what numbers are associated with a certain end user and to which sip server a call have to be sent. The Authorize Request from Sippy should confirm wether the destination number is valid (is configured for an end user) and replys with the correct sip server to use and with a special codec list for the call. If the number is not configured, a Access-Reject is send and the call is aborted. I hope i made myself clear ;) Kind regards, -- Tobias Wolf

4 7