November 2009 - Freeradius-Users - lists.freeradius.org

regular expressions in proxy.conf
by Ana Gallardo 03 Nov '09

03 Nov '09

Hello, I'm using Debian and Freeradius 2.0.4-3. I want to use a regular expression in proxy.conf file to match any request that contain the word "domain" in the realm (suffix mode). ### /etc/freeradius/proxy.conf realm "~(domain)+" { # authhost = LOCAL # not strictly necessary # accthost = LOCAL # not strictly necessary } Then, in authorize section I have: ### /etc/freeradius/sites-available/default authorize { preprocess mschap suffix eap { ok = return } if ("%{Realm}" =~ /(temp\.)?domain\.es$/){ update control { Intentos-Reject = ... } } files switch "%{Realm}" { case "temp.domain.es" { sql } case "domain.es" { redundant { ldap2 ldap1 ldap3 } } case { update control { Auth-Type := Reject } } } expiration pap } And, in users file: ### /etc/freeradius/proxy.conf DEFAULT Intentos-Reject > 10, Auth-Type := Reject Reply-Message = "NUMERO DE INTENTOS FALLIDOS(%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}}" My problem is: the Realm that Freeradius add to the request is the regular expression... Here is my debug information: rad_recv: Access-Request packet from host 127.0.0.1 port 60112, id=208, length=68 User-Name = "XXX(a)domain.es" User-Password = "YYY" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "domain.es" for User-Name = "XXX(a)domain.es" rlm_realm: Found realm "~(domain)+" rlm_realm: Adding Stripped-User-Name = "XXX" rlm_realm: Adding Realm = "~(domain)+" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++? if ("%{Realm}" =~ /(temp\.)?domain\.es$/) expand: %{Realm} -> ~(domain)+ ? Evaluating ("%{Realm}" =~ /(temp\.)?domain\.es$/) -> FALSE ++? if ("%{Realm}" =~ /(temp\.)?domain\.es$/) -> FALSE ++[files] returns noop expand: %{Realm} -> ~(domain)+ ++- entering switch %{Realm} +++- entering case ++++[control] returns noop +++- case returns noop ++- switch %{Realm} returns noop I can resolve this adding this to proxy.conf: ### /etc/freeradius/proxy.conf realm "domain.es" { authhost = LOCAL # not strictly necessary accthost = LOCAL # not strictly necessary } realm "temp.domain.es" { authhost = LOCAL # not strictly necessary accthost = LOCAL # not strictly necessary } realm "~(domain)+" { authhost = LOCAL # not strictly necessary accthost = LOCAL # not strictly necessary } But I don't know if that is the best way to resolve my problem, so I would like to reinforce my decision. Thanks in advance and sorry for my english. -- ____________________ Ana Gallardo Gómez ____________________

2 2

The "right" way to limit a user to one EAP Type on FR2.1.7
by ziyen 03 Nov '09

03 Nov '09

Hi, What is the best way to limit a user to one EAP(EAP-TLS, TTLS, PEAP, ...) Type On FR2.1.7? backend on Mysql? Thanks.

1 0

Re: Freeradius-Users Digest, Vol 55, Issue 6
by Gilbert Lo 03 Nov '09

03 Nov '09

Thank you for your message. I am away until Nov 10th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Dynamic VLANing and anonymous identity on re-auth?
by Palmer J.D.F. 02 Nov '09

02 Nov '09

Hi all, Is it possible to use anonymous outer identities with dynamic VLANing? We have a problem with reauths when using anonymous outers, the initial login is fine and the VLAN is assigned using sql.authorize, but re-auths only seem to use the outer identity and hence no VLAN information is sent back in the access-accept packet. On a reauth, the only mention I see of the real username is... [peap] Adding cached attributes to the reply: User-Name = "test-user" [eap] Freeing handler ++[eap] returns ok Login OK: [anonymous(a)swansea.ac.uk] (from client wism port 29 cli 00-26-69-04-a7-f7) Is it possible to capture this brief appearance of the real username to run the sql.authorize to get the correct VLAN info? Fast re-auth is disabled in experimental.conf (FR 2.1.7) Many thanks, Jezz Palmer. ------------------------------------- Jezz Palmer Library & Information Services Swansea University Singleton Park Swansea SA2 8PP -------------------------------------

2 2

raddebug before 2.1.4
by marco perugini 02 Nov '09

02 Nov '09

hi list! my simple question is: is there a way to use the powerfull/wonderfull raddebug script with version 2.1.1? or the only way is to start the server with -x option? thanks and regards, marco -- 4it *4IT **S.r.l. **Marco Perugini* *| system administrator** * --------------------------------------------------------- Via Udine 30-36, 00161 Roma Phone +39 06 97601680 Mobile +39 339.39.81.246 Fax +39 06 97601683 m.perugini(a)4it.it <mailto:m.perugini@4it.it> www.4it.it <http://www.4it.it/> "Il presente messaggio e gli eventuali allegati sono di natura confidenziale. Qualora vi fosse pervenuto per errore, vi preghiamo di cancellarlo immediatamente dal vostro sistema e di avvisare il mittente. Grazie." "This electronic mail transmission and any accompanying attachments contain confidential information. If you have received this communication in error, please immediately delete the E-mail and either notify the sender. Thank you."

3 10

Logging Error Messages in SQL
by Jeff Fern 02 Nov '09

02 Nov '09

All, We are running Freeradius 2.1.7, some of our clients aren't properly configured, and we sometimes see errors like this in /var/log/radius.log: Mon Nov 2 16:23:04 2009 : Error: TLS Alert read:fatal:unknown CA Mon Nov 2 16:23:04 2009 : Error: TLS_accept:failed in SSLv3 read client certificate A Mon Nov 2 16:23:04 2009 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Mon Nov 2 16:23:04 2009 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. What I would like to be able to do is log part of this message in our database, so if the user seeks help about not being able to get access, our helpdesk just need to query the database rather than needing to ask us to look through the log file for any additional information. I haven't been able to find any info about this, does anyone have any ideas? Cheers, -Jeff -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Client Certificates
by Paul Ryszka 02 Nov '09

02 Nov '09

Hello, Do I need separate certificate for each client or can I use one cert for all clients ? Is there easy way to generate bunch of them using supplied scripts ? Regards Paul

1 0

802.1x Strange active directory with MSCHAP issue
by sea you 02 Nov '09

02 Nov '09

Hello List, I'm trying to set up freeradius for users to authenticate against Active Directory. The problem is that it seems to be that the client tries and somehow succeeds but then it sends Access-Challenge again. ntlm_auth from commandline works fine. If someone could pls take a look at it, and point me to the problem source. # freeradius -Xx [snip] rad_recv: Access-Request packet from host 10.X.X.X port 1645, id=170, length=272 User-Name = "DOMAIN\\USER_NAME" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-17-0E-18-6F-02" Calling-Station-Id = "00-22-68-10-E9-9D" EAP-Message = 0x0209006219001703010057dbed00fdb2ac2eebb7a9749b351455a9e261b8101109c397d32e7feda500fe9ab5be56aa8f0f553b050009e48c8201f1ead322025b3b996d9e78b3906eddcbef18660af56ffb77a3d66552c6bdf6b8a4acadb1e68ff4d0 Message-Authenticator = 0x060bb882f3abde473de477df5ec50d83 NAS-Port-Type = Ethernet NAS-Port = 50203 NAS-Port-Id = "FastEthernet2/3" Called-Station-Id = "00170E186F0" State = 0x651daded6314b44b23e510c28ece2035 NAS-IP-Address = 10.X.X.X Thu Oct 29 10:08:14 2009 : Info: +- entering group authorize {...} Thu Oct 29 10:08:14 2009 : Info: ++[preprocess] returns ok Thu Oct 29 10:08:14 2009 : Info: [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/10.X.X.X/auth-detail-20091029 Thu Oct 29 10:08:14 2009 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.X.X.X/auth-detail-20091029 Thu Oct 29 10:08:14 2009 : Info: [auth_log] expand: %t -> Thu Oct 29 10:08:14 2009 Thu Oct 29 10:08:14 2009 : Info: ++[auth_log] returns ok Thu Oct 29 10:08:14 2009 : Info: ++[mschap] returns noop Thu Oct 29 10:08:14 2009 : Info: [IPASS] No '/' in User-Name = "DOMAIN\USER_NAME", looking up realm NULL Thu Oct 29 10:08:14 2009 : Info: [IPASS] No such realm "NULL" Thu Oct 29 10:08:14 2009 : Info: ++[IPASS] returns noop Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Found realm "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Stripped-User-Name = "USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Realm = "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Authentication realm is LOCAL. Thu Oct 29 10:08:14 2009 : Info: ++[ntdomain] returns ok Thu Oct 29 10:08:14 2009 : Info: [eap] EAP packet type response id 9 length 98 Thu Oct 29 10:08:14 2009 : Info: [eap] Continuing tunnel setup. Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns ok Thu Oct 29 10:08:14 2009 : Info: Found Auth-Type = EAP Thu Oct 29 10:08:14 2009 : Info: +- entering group authenticate {...} Thu Oct 29 10:08:14 2009 : Info: [eap] Request found, released from the list Thu Oct 29 10:08:14 2009 : Info: [eap] EAP/peap Thu Oct 29 10:08:14 2009 : Info: [eap] processing type peap Thu Oct 29 10:08:14 2009 : Info: [peap] processing EAP-TLS Thu Oct 29 10:08:14 2009 : Info: [peap] eaptls_verify returned 7 Thu Oct 29 10:08:14 2009 : Info: [peap] Done initial handshake Thu Oct 29 10:08:14 2009 : Info: [peap] eaptls_process returned 7 Thu Oct 29 10:08:14 2009 : Info: [peap] EAPTLS_OK Thu Oct 29 10:08:14 2009 : Info: [peap] Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 02 09 00 46 31 ed 83 a9 6d bc 8a 55 45 16 3f PEAP tunnel data in 0010: 41 13 c8 eb 17 08 00 00 00 00 00 00 00 00 2a 0f PEAP tunnel data in 0020: 3a 33 97 72 a7 f0 09 9e 9d 13 00 64 df f8 d0 13 PEAP tunnel data in 0030: f5 0c 46 d8 94 0d 00 49 42 4d 45 4d 45 41 5c 68 PEAP tunnel data in 0040: 75 65 34 39 31 62 7a Thu Oct 29 10:08:14 2009 : Info: [peap] EAP type mschapv2 Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled request EAP-Message = 0x0209004b1a0209004631ed83a96dbc8a5545163f4113c8eb170800000000000000002a0f3a339772a7f0099e9d130064dff8d013f50c46d8940d0049424d454d45415c687565343931627a server { Thu Oct 29 10:08:14 2009 : Debug: PEAP: Setting User-Name to DOMAIN\USER_NAME Sending tunneled request EAP-Message = 0x0209004b1a0209004631ed83a96dbc8a5545163f4113c8eb170800000000000000002a0f3a339772a7f0099e9d130064dff8d013f50c46d8940d0049424d454d45415c687565343931627a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\USER_NAME" State = 0xd4de0819d4d7123b2e87e4d75e5d8f2c Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-17-0E-18-6F-02" Called-Station-Id = "00170E186F0" Calling-Station-Id = "00-22-68-10-E9-9D" NAS-Port-Type = Ethernet NAS-Port = 50203 NAS-Port-Id = "FastEthernet2/3" NAS-IP-Address = 10.X.X.X server inner-tunnel { Thu Oct 29 10:08:14 2009 : Info: +- entering group authorize {...} Thu Oct 29 10:08:14 2009 : Info: ++[mschap] returns noop Thu Oct 29 10:08:14 2009 : Info: [IPASS] No '/' in User-Name = "DOMAIN\USER_NAME", looking up realm NULL Thu Oct 29 10:08:14 2009 : Info: [IPASS] No such realm "NULL" Thu Oct 29 10:08:14 2009 : Info: ++[IPASS] returns noop Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Found realm "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Stripped-User-Name = "USER_NAME" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Adding Realm = "DOMAIN" Thu Oct 29 10:08:14 2009 : Info: [ntdomain] Authentication realm is LOCAL. Thu Oct 29 10:08:14 2009 : Info: ++[ntdomain] returns ok Thu Oct 29 10:08:14 2009 : Info: [eap] EAP packet type response id 9 length 75 Thu Oct 29 10:08:14 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns updated Thu Oct 29 10:08:14 2009 : Info: ++[files] returns noop Thu Oct 29 10:08:14 2009 : Info: ++[expiration] returns noop Thu Oct 29 10:08:14 2009 : Info: ++[logintime] returns noop Thu Oct 29 10:08:14 2009 : Info: Found Auth-Type = EAP Thu Oct 29 10:08:14 2009 : Info: +- entering group authenticate {...} Thu Oct 29 10:08:14 2009 : Info: [eap] Request found, released from the list Thu Oct 29 10:08:14 2009 : Info: [eap] EAP/mschapv2 Thu Oct 29 10:08:14 2009 : Info: [eap] processing type mschapv2 Thu Oct 29 10:08:14 2009 : Info: [mschapv2] +- entering group MS-CHAP {...} Thu Oct 29 10:08:14 2009 : Info: [mschap] Told to do MS-CHAPv2 for USER_NAME with NT-Password Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=USER_NAME Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --domain=%{mschap:NT-Domain:-SOMETHING.DOMAIN.NET} -> --domain=DOMAIN Thu Oct 29 10:08:14 2009 : Info: [mschap] mschap2: 7e Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=713fa3f8ce6f4b85 Thu Oct 29 10:08:14 2009 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2a0f3a339772a7f0099e9d130064dff8d013f50c46d8940d Thu Oct 29 10:08:14 2009 : Debug: Exec-Program output: NT_KEY: D3EF67E4795483D8C8ECCD398929BD83 Thu Oct 29 10:08:14 2009 : Debug: Exec-Program-Wait: plaintext: NT_KEY: D3EF67E4795483D8C8ECCD398929BD83 Thu Oct 29 10:08:14 2009 : Debug: Exec-Program: returned: 0 Thu Oct 29 10:08:14 2009 : Info: ++[mschap] returns ok Thu Oct 29 10:08:14 2009 : Debug: MSCHAP Success Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns handled } # server inner-tunnel Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d30354537393244373946463135444637443039333735354230303941433932373038353432363132 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4de0819d5d4123b2e87e4d75e5d8f2c Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d30354537393244373946463135444637443039333735354230303941433932373038353432363132 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd4de0819d5d4123b2e87e4d75e5d8f2c Thu Oct 29 10:08:14 2009 : Info: [peap] Got tunneled Access-Challenge PEAP tunnel data out 0000: 1a 03 09 00 2e 53 3d 30 35 45 37 39 32 44 37 39 PEAP tunnel data out 0010: 46 46 31 35 44 46 37 44 30 39 33 37 35 35 42 30 PEAP tunnel data out 0020: 30 39 41 43 39 32 37 30 38 35 34 32 36 31 32 Thu Oct 29 10:08:14 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 170 to 10.X.X.X port 1645 EAP-Message = 0x010a004a1900170301003f7a8338c8443aab925281cc99d62063e56bce7edc3a0fe618ef8cae86ffa7bdb310d88c30c000f2402e10963c02a43374f9b12818980ce2821a51182b132654 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x651daded6217b44b23e510c28ece2035 Thu Oct 29 10:08:14 2009 : Info: Finished request 8. [snip] Thanks in advance, cU

3 3

Send Reject When User Logged In Already
by boyali kus 02 Nov '09

02 Nov '09

Dear Users, In my test environment I use a Mikrotik RB333 as NAS and FreeRADIUS 2.1.7. How can I make this Simultaneous Use Checking Queries work? Although I uncommented simul_count_query in dialup.conf I cannot see any difference and users can still logon simultaneously (radwho displays same users twice as connected). I do not want to FreeRADIUS to query NAS (with SNMP etc) in order to know if user is connected, I want simply use this sql queries and send a reject packet if user seems connected in RADIUS. Should I write a stored procedure for authorize_check_query and send reject if there is a record of this user in radacct table which has a null acctstoptime? Meanwhile NAS sends accounting packets successfully and RADIUS receives them. I am really stuck! Debug Output: FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 18 2009 at 10:59:17 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "102.145.225.81" port = "" login = "raduser" password = "rad6m" radius_db = "raddb" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "CALL fr_authorize_check('%{SQL-User-Name}')" authorize_reply_query = "CALL fr_authorize_reply('%{SQL-User-Name}')" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to raduser@102.145.225.81:/raddb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=localsecret rlm_sql (sql): Adding client 127.0.0.1 (localhost, server=<none>) to clients list rlm_sql (sql): Read entry nasname=102.145.225.82,shortname=RB333,secret=rb333secret rlm_sql (sql): Adding client 102.145.225.82 (RB333, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

3 6

checking user connect time
by Yagnesh Dave 02 Nov '09

02 Nov '09

Hi, Can you let me know where can we check the time for which a particular user is connected, basically this is required so that we can advice the customer if his ISDN line is connected for too long. Regards, Yagnesh Dave.

2 1