December 2009 - Freeradius-Users - lists.freeradius.org

Multiple clients on same IP address
by Fahd Kasri 21 Dec '09

21 Dec '09

Hi, Is it possible to have multiple Radius clients behind a router connect to a distant Freeradius server (these clients would therefore have the same IP address and be the same client in clients.conf)? I've this and apparently it works, but could there be any problems in the long run? Thanks. -- Fahd

2 3

Pre-release of Version 2.1.8
by Alan DeKok 21 Dec '09

21 Dec '09

I've put a pre-release of version 2.1.8 on the web site: http://git.freeradius.org/pre/ Please do some sanity checks, and see if it works for you. This version is from the new "v2.1.x" branch, which is Version 2.1.7, plus *only* bug fixes. The "stable" branch is now planned to become version 2.2.0 in January. It will include TCP transport, among other new features. If there are no major issues, we can release 2.1.8 next week. Alan DeKok.

9 42

freeradius + ldap eap-ttls/pap
by Matias 21 Dec '09

21 Dec '09

Hi everybody, I ask for your help because I'm going craizy with this. I've an Acces Point configured to ask my radius server for authentication, this servers uses as a backend an openldap server with SSHA passwords on it. I've followed all the manuals and documentation I've found and I can't get this to work. The problem as far as I can see is related to the outer tunnel, it seems that the user "anonymous" cannot be authenticated and everthing ends there. Of course, I've not created that user anywere as I understand that this is not needed to be done as this is a "dummy" user until the inner tunnel is stablished. Here is the output of freeradius -X with a request from a windows XP secureW2 client, hope you can help me: FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 7 2008 at 17:42:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.0.12.2 { require_message_authenticator = no secret = "testing123" shortname = "ap6-1" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "ldap.example.local" port = 389 password = "xpe9su" identity = "cn=admin,dc=example,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=users,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x25707c0 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.12.2 port 3003, id=0, length=200 Message-Authenticator = 0x42731f5980bb7ec56b065eb88a6a771a Service-Type = Framed-User User-Name = "anonymous" Framed-MTU = 1488 Called-Station-Id = "00-24-01-AB-9F-18:testing" Calling-Station-Id = "00-22-FB-C3-BD-1E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000e01616e6f6e796d6f7573 NAS-IP-Address = 10.0.12.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=anonymous) expand: ou=users,dc=example,dc=com -> ou=users,dc=example,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.example.local:389, authentication 0 rlm_ldap: bind as cn=admin,dc=example,dc=com/xpe9su to ldap.example.local:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,dc=example,dc=com, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 10.0.12.2 port 3003 EAP-Message = 0x01010016041099d14e72c00dd63e55b37725daa71e69 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd50d6e1ad50c6a305031ee5aa47451b9 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.12.2 port 3003, id=1, length=210 Message-Authenticator = 0x058e9b3a1b995517e84ff4ed76f58359 Service-Type = Framed-User User-Name = "anonymous" Framed-MTU = 1488 State = 0xd50d6e1ad50c6a305031ee5aa47451b9 Called-Station-Id = "00-24-01-AB-9F-18:testing" Calling-Station-Id = "00-22-FB-C3-BD-1E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060315 NAS-IP-Address = 10.0.12.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=anonymous) expand: ou=users,dc=example,dc=com -> ou=users,dc=example,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,dc=example,dc=com, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for unsupported type 21 rlm_eap: No common EAP types found. rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [anonymous/<via Auth-Type = EAP>] (from client ap6-1 port 1 cli 00-22-FB-C3-BD-1E) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 10.0.12.2 port 3003 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds.

5 9

Certificate not valid in PEAP
by Fernando Calvelo Vazquez 21 Dec '09

21 Dec '09

Hi folks: I'm still trying to configure any authentication method that includes a client certificate validation (PEAP, EAP-TTLS... ) behind my window-vista supplicant software client, but unfortunately no successfully. Attached to this mail is the output of one PEAP try. The authentication starts once and again forever, in a loop, but never ends successfully. I have verify that the client certificate include the Microsoft extensions # openssl x509 -text -in client.pem X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication and also... I have signed certificates by using the Makefile from version 2.1.8 (latest one) I'm a bit frustrated with this "certificates" locking point. Thanks a lot in advance for your help. Regards, Fernando.

3 2

Calling-Station-Id
by osmany＠oc.quimefa.cu 21 Dec '09

21 Dec '09

Greetings, I have freeradius 2.x working with MySQL database with daloradius as a php web interface for management. I am having trouble specifying a calling station id for each user that I have in the radcheck table. I can create users through daloradius and specify the calling station id so that the users don't authenticate unless they are calling from the phone number I specify but I found out that users can still connect from any phone number and I really need this restriction to be working. I believe I am using the correct operator and everything. example Calling-Station-Id=="phonenumber" I find that daloradius has a buggy interface because once I insert the Calling-Station-Id attribute it shows twice as if it was repeated somehow. I also tried to create the users directly in mysql through a mysql client(EMMA is what I'm currently using) and it's the only way I know it works, so I concluded that it's some bug in daloradius (I am using version 0.9-8). I want to know if anyone had this experience before and how to fix this or if there are other freeradius php front ends out there, which one do you recommend. thanks in advance.

3 2

evaluated result is wrong
by Stephan Kirsten 20 Dec '09

20 Dec '09

Hello, first setup: FreeRADIUS Version 2.1.7, for host x86_64-pc-linux-gnu, built on Dec 10 2009 at 17:33:51 on Debian Lenny build via dpkg-buildpackage I have a question regarding this debug log output. I'm a bit confused about this logic operations and the boolean result: Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-4} -> 32933844 Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-5} -> 2785017856 Sun Dec 20 15:44:46 2009 : Info: ? Evaluating ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") -> TRUE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") -> TRUE Sun Dec 20 15:44:46 2009 : Info: ++- entering if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") {...} Sun Dec 20 15:44:46 2009 : Info: expand: USER %{User-Name}: hat Traffic-Limit erreicht! -> USER Stephan.Kirsten: hat Traffic-Limit erreicht! Sun Dec 20 15:44:46 2009 : Info: +++[reply] returns ok should obviously became false and won't expand Sun Dec 20 15:44:46 2009 : Info: ++- if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") returns ok Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" < "%{control:Tmp-Integer-5}") Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-4} -> 32933844 Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-5} -> 2785017856 Sun Dec 20 15:44:46 2009 : Info: ? Evaluating ("%{control:Tmp-Integer-4}" < "%{control:Tmp-Integer-5}") -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" < "%{control:Tmp-Integer-5}") -> FALSE should be true and expanded So how does this come together? The debug log is attached to this mail. I hope someone ca clarify this problem -Stephan Sun Dec 20 15:44:03 2009 : Info: FreeRADIUS Version 2.1.7, for host x86_64-pc-linux-gnu, built on Dec 10 2009 at 17:33:51 Sun Dec 20 15:44:03 2009 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Sun Dec 20 15:44:03 2009 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Sun Dec 20 15:44:03 2009 : Info: PARTICULAR PURPOSE. Sun Dec 20 15:44:03 2009 : Info: You may redistribute copies of FreeRADIUS under the terms of the Sun Dec 20 15:44:03 2009 : Info: GNU General Public License v2. Sun Dec 20 15:44:03 2009 : Info: Starting - reading configuration files ... Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/radiusd.conf Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/proxy.conf Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/clients.conf Sun Dec 20 15:44:03 2009 : Debug: including files in directory /etc/freeradius/modules/ Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/sradutmp Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/detail Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/expiration Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/smsotp Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/otp Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/expr Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/mschap Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/digest Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/pap Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/cui Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/ldap Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/wimax Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/preprocess Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/mac2ip Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/counter Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/always Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/exec Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/echo Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/etc_group Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/realm Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/detail.log Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/unix Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/perl Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/linelog Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/sql_log Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/chap Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/inner-eap Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/krb5 Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/radutmp Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/policy Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/acct_unique Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/passwd Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/logintime Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/files Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/checkval Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/ippool Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/pam Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/modules/attr_filter Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/eap.conf Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/sql.conf Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/sql/mysql/dialup.conf Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/policy.conf Sun Dec 20 15:44:03 2009 : Debug: including files in directory /etc/freeradius/sites-enabled/ Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/eap Sun Dec 20 15:44:03 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/pptp Sun Dec 20 15:44:03 2009 : Debug: group = freerad Sun Dec 20 15:44:03 2009 : Debug: user = freerad Sun Dec 20 15:44:03 2009 : Debug: including dictionary file /etc/freeradius/dictionary Sun Dec 20 15:44:03 2009 : Debug: main { Sun Dec 20 15:44:03 2009 : Debug: prefix = "/usr" Sun Dec 20 15:44:03 2009 : Debug: localstatedir = "/var" Sun Dec 20 15:44:03 2009 : Debug: logdir = "/var/log/freeradius" Sun Dec 20 15:44:03 2009 : Debug: libdir = "/usr/lib/freeradius" Sun Dec 20 15:44:03 2009 : Debug: radacctdir = "/var/log/freeradius/radacct" Sun Dec 20 15:44:03 2009 : Debug: hostname_lookups = no Sun Dec 20 15:44:03 2009 : Debug: max_request_time = 30 Sun Dec 20 15:44:03 2009 : Debug: cleanup_delay = 5 Sun Dec 20 15:44:03 2009 : Debug: max_requests = 1024 Sun Dec 20 15:44:03 2009 : Debug: allow_core_dumps = no Sun Dec 20 15:44:03 2009 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Sun Dec 20 15:44:03 2009 : Debug: checkrad = "/usr/sbin/checkrad" Sun Dec 20 15:44:03 2009 : Debug: debug_level = 0 Sun Dec 20 15:44:03 2009 : Debug: proxy_requests = yes Sun Dec 20 15:44:03 2009 : Debug: log { Sun Dec 20 15:44:03 2009 : Debug: stripped_names = no Sun Dec 20 15:44:03 2009 : Debug: auth = no Sun Dec 20 15:44:03 2009 : Debug: auth_badpass = no Sun Dec 20 15:44:03 2009 : Debug: auth_goodpass = no Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: security { Sun Dec 20 15:44:03 2009 : Debug: max_attributes = 200 Sun Dec 20 15:44:03 2009 : Debug: reject_delay = 1 Sun Dec 20 15:44:03 2009 : Debug: status_server = yes Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: radiusd: #### Loading Realms and Home Servers #### Sun Dec 20 15:44:03 2009 : Debug: proxy server { Sun Dec 20 15:44:03 2009 : Debug: retry_delay = 5 Sun Dec 20 15:44:03 2009 : Debug: retry_count = 3 Sun Dec 20 15:44:03 2009 : Debug: default_fallback = no Sun Dec 20 15:44:03 2009 : Debug: dead_time = 120 Sun Dec 20 15:44:03 2009 : Debug: wake_all_if_all_dead = no Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: home_server localhost { Sun Dec 20 15:44:03 2009 : Debug: ipaddr = 127.0.0.1 Sun Dec 20 15:44:03 2009 : Debug: port = 1812 Sun Dec 20 15:44:03 2009 : Debug: type = "auth" Sun Dec 20 15:44:03 2009 : Debug: secret = "testing123" Sun Dec 20 15:44:03 2009 : Debug: response_window = 20 Sun Dec 20 15:44:03 2009 : Debug: max_outstanding = 65536 Sun Dec 20 15:44:03 2009 : Debug: require_message_authenticator = no Sun Dec 20 15:44:03 2009 : Debug: zombie_period = 40 Sun Dec 20 15:44:03 2009 : Debug: status_check = "status-server" Sun Dec 20 15:44:03 2009 : Debug: ping_interval = 30 Sun Dec 20 15:44:03 2009 : Debug: check_interval = 30 Sun Dec 20 15:44:03 2009 : Debug: num_answers_to_alive = 3 Sun Dec 20 15:44:03 2009 : Debug: num_pings_to_alive = 3 Sun Dec 20 15:44:03 2009 : Debug: revive_interval = 120 Sun Dec 20 15:44:03 2009 : Debug: status_check_timeout = 4 Sun Dec 20 15:44:03 2009 : Debug: irt = 2 Sun Dec 20 15:44:03 2009 : Debug: mrt = 16 Sun Dec 20 15:44:03 2009 : Debug: mrc = 5 Sun Dec 20 15:44:03 2009 : Debug: mrd = 30 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: home_server_pool my_auth_failover { Sun Dec 20 15:44:03 2009 : Debug: type = fail-over Sun Dec 20 15:44:03 2009 : Debug: home_server = localhost Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: realm example.com { Sun Dec 20 15:44:03 2009 : Debug: auth_pool = my_auth_failover Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: realm LOCAL { Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: radiusd: #### Loading Clients #### Sun Dec 20 15:44:03 2009 : Debug: client localhost { Sun Dec 20 15:44:03 2009 : Debug: ipaddr = 127.0.0.1 Sun Dec 20 15:44:03 2009 : Debug: require_message_authenticator = no Sun Dec 20 15:44:03 2009 : Debug: secret = "testing123" Sun Dec 20 15:44:03 2009 : Debug: nastype = "other" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: client 10.17.2.0/24 { Sun Dec 20 15:44:03 2009 : Debug: require_message_authenticator = no Sun Dec 20 15:44:03 2009 : Debug: secret = "testing123" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: client 192.168.0.0/16 { Sun Dec 20 15:44:03 2009 : Debug: require_message_authenticator = no Sun Dec 20 15:44:03 2009 : Debug: secret = "test" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: radiusd: #### Instantiating modules #### Sun Dec 20 15:44:03 2009 : Debug: instantiate { Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_exec, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_exec Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating exec Sun Dec 20 15:44:03 2009 : Debug: exec { Sun Dec 20 15:44:03 2009 : Debug: wait = no Sun Dec 20 15:44:03 2009 : Debug: input_pairs = "request" Sun Dec 20 15:44:03 2009 : Debug: shell_escape = yes Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_expr, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_expr Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating expr Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_expiration, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_expiration Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating expiration Sun Dec 20 15:44:03 2009 : Debug: expiration { Sun Dec 20 15:44:03 2009 : Debug: reply-message = "Password Has Expired " Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_logintime, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_logintime Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating logintime Sun Dec 20 15:44:03 2009 : Debug: logintime { Sun Dec 20 15:44:03 2009 : Debug: reply-message = "You are calling outside your allowed timespan " Sun Dec 20 15:44:03 2009 : Debug: minimum-timeout = 60 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: radiusd: #### Loading Virtual Servers #### Sun Dec 20 15:44:03 2009 : Debug: server eap { Sun Dec 20 15:44:03 2009 : Debug: modules { Sun Dec 20 15:44:03 2009 : Debug: Module: Checking authenticate {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_mschap, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_mschap Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating mschap Sun Dec 20 15:44:03 2009 : Debug: mschap { Sun Dec 20 15:44:03 2009 : Debug: use_mppe = yes Sun Dec 20 15:44:03 2009 : Debug: require_encryption = no Sun Dec 20 15:44:03 2009 : Debug: require_strong = no Sun Dec 20 15:44:03 2009 : Debug: with_ntdomain_hack = no Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_eap, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_eap Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap Sun Dec 20 15:44:03 2009 : Debug: eap { Sun Dec 20 15:44:03 2009 : Debug: default_eap_type = "peap" Sun Dec 20 15:44:03 2009 : Debug: timer_expire = 60 Sun Dec 20 15:44:03 2009 : Debug: ignore_unknown_eap_types = no Sun Dec 20 15:44:03 2009 : Debug: cisco_accounting_username_bug = no Sun Dec 20 15:44:03 2009 : Debug: max_sessions = 2048 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to sub-module rlm_eap_md5 Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap-md5 Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to sub-module rlm_eap_leap Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap-leap Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to sub-module rlm_eap_gtc Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap-gtc Sun Dec 20 15:44:03 2009 : Debug: gtc { Sun Dec 20 15:44:03 2009 : Debug: challenge = "Password: " Sun Dec 20 15:44:03 2009 : Debug: auth_type = "PAP" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to sub-module rlm_eap_tls Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap-tls Sun Dec 20 15:44:03 2009 : Debug: tls { Sun Dec 20 15:44:03 2009 : Debug: rsa_key_exchange = no Sun Dec 20 15:44:03 2009 : Debug: dh_key_exchange = yes Sun Dec 20 15:44:03 2009 : Debug: rsa_key_length = 512 Sun Dec 20 15:44:03 2009 : Debug: dh_key_length = 512 Sun Dec 20 15:44:03 2009 : Debug: verify_depth = 0 Sun Dec 20 15:44:03 2009 : Debug: pem_file_type = yes Sun Dec 20 15:44:03 2009 : Debug: private_key_file = "/etc/freeradius/certs/server.pem" Sun Dec 20 15:44:03 2009 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Sun Dec 20 15:44:03 2009 : Debug: CA_file = "/etc/freeradius/certs/ca.pem" Sun Dec 20 15:44:03 2009 : Debug: private_key_password = "whatever" Sun Dec 20 15:44:03 2009 : Debug: dh_file = "/etc/freeradius/certs/dh" Sun Dec 20 15:44:03 2009 : Debug: random_file = "/etc/freeradius/certs/random" Sun Dec 20 15:44:03 2009 : Debug: fragment_size = 1024 Sun Dec 20 15:44:03 2009 : Debug: include_length = yes Sun Dec 20 15:44:03 2009 : Debug: check_crl = no Sun Dec 20 15:44:03 2009 : Debug: cipher_list = "DEFAULT" Sun Dec 20 15:44:03 2009 : Debug: make_cert_command = "/etc/freeradius/certs/bootstrap" Sun Dec 20 15:44:03 2009 : Debug: cache { Sun Dec 20 15:44:03 2009 : Debug: enable = no Sun Dec 20 15:44:03 2009 : Debug: lifetime = 24 Sun Dec 20 15:44:03 2009 : Debug: max_entries = 255 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to sub-module rlm_eap_peap Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap-peap Sun Dec 20 15:44:03 2009 : Debug: peap { Sun Dec 20 15:44:03 2009 : Debug: default_eap_type = "md5" Sun Dec 20 15:44:03 2009 : Debug: copy_request_to_tunnel = no Sun Dec 20 15:44:03 2009 : Debug: use_tunneled_reply = no Sun Dec 20 15:44:03 2009 : Debug: proxy_tunneled_request_as_eap = yes Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating eap-mschapv2 Sun Dec 20 15:44:03 2009 : Debug: mschapv2 { Sun Dec 20 15:44:03 2009 : Debug: with_ntdomain_hack = no Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Checking authorize {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_sql, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_sql Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating sql Sun Dec 20 15:44:03 2009 : Debug: sql { Sun Dec 20 15:44:03 2009 : Debug: driver = "rlm_sql_mysql" Sun Dec 20 15:44:03 2009 : Debug: server = "athene.fbn-dd.de" Sun Dec 20 15:44:03 2009 : Debug: port = "" Sun Dec 20 15:44:03 2009 : Debug: login = "radius" Sun Dec 20 15:44:03 2009 : Debug: password = "radius" Sun Dec 20 15:44:03 2009 : Debug: radius_db = "radius" Sun Dec 20 15:44:03 2009 : Debug: read_groups = yes Sun Dec 20 15:44:03 2009 : Debug: sqltrace = no Sun Dec 20 15:44:03 2009 : Debug: sqltracefile = "/var/log/freeradius/sqltrace.sql" Sun Dec 20 15:44:03 2009 : Debug: readclients = no Sun Dec 20 15:44:03 2009 : Debug: deletestalesessions = yes Sun Dec 20 15:44:03 2009 : Debug: num_sql_socks = 5 Sun Dec 20 15:44:03 2009 : Debug: lifetime = 0 Sun Dec 20 15:44:03 2009 : Debug: max_queries = 0 Sun Dec 20 15:44:03 2009 : Debug: sql_user_name = "%{User-Name}" Sun Dec 20 15:44:03 2009 : Debug: default_user_profile = "" Sun Dec 20 15:44:03 2009 : Debug: nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" Sun Dec 20 15:44:03 2009 : Debug: authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" Sun Dec 20 15:44:03 2009 : Debug: authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" Sun Dec 20 15:44:03 2009 : Debug: authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" Sun Dec 20 15:44:03 2009 : Debug: authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" Sun Dec 20 15:44:03 2009 : Debug: accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" Sun Dec 20 15:44:03 2009 : Debug: accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" Sun Dec 20 15:44:03 2009 : Debug: accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" Sun Dec 20 15:44:03 2009 : Debug: accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" Sun Dec 20 15:44:03 2009 : Debug: accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" Sun Dec 20 15:44:03 2009 : Debug: accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" Sun Dec 20 15:44:03 2009 : Debug: accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" Sun Dec 20 15:44:03 2009 : Debug: group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" Sun Dec 20 15:44:03 2009 : Debug: connect_failure_retry_delay = 60 Sun Dec 20 15:44:03 2009 : Debug: simul_count_query = "" Sun Dec 20 15:44:03 2009 : Debug: simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" Sun Dec 20 15:44:03 2009 : Debug: postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" Sun Dec 20 15:44:03 2009 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Dec 20 15:44:03 2009 : Info: rlm_sql (sql): Attempting to connect to radius@athene.fbn-dd.de:/radius Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): starting 0 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Connected new DB handle, #0 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): starting 1 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Connected new DB handle, #1 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): starting 2 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Connected new DB handle, #2 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): starting 3 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Connected new DB handle, #3 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): starting 4 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql): Connected new DB handle, #4 Sun Dec 20 15:44:03 2009 : Debug: Module: Checking accounting {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_acct_unique Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating acct_unique Sun Dec 20 15:44:03 2009 : Debug: acct_unique { Sun Dec 20 15:44:03 2009 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_detail, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_detail Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating detail Sun Dec 20 15:44:03 2009 : Debug: detail { Sun Dec 20 15:44:03 2009 : Debug: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Sun Dec 20 15:44:03 2009 : Debug: header = "%t" Sun Dec 20 15:44:03 2009 : Debug: detailperm = 384 Sun Dec 20 15:44:03 2009 : Debug: dirperm = 493 Sun Dec 20 15:44:03 2009 : Debug: locking = no Sun Dec 20 15:44:03 2009 : Debug: log_packet_header = no Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Checking session {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: Module: Checking post-auth {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: } # modules Sun Dec 20 15:44:03 2009 : Debug: } # server Sun Dec 20 15:44:03 2009 : Debug: server pptp { Sun Dec 20 15:44:03 2009 : Debug: modules { Sun Dec 20 15:44:03 2009 : Debug: Module: Checking authenticate {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: Module: Checking authorize {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating sql_mitglieder Sun Dec 20 15:44:03 2009 : Debug: sql sql_mitglieder { Sun Dec 20 15:44:03 2009 : Debug: driver = "rlm_sql_mysql" Sun Dec 20 15:44:03 2009 : Debug: server = "dbserver.fbn-dd.de" Sun Dec 20 15:44:03 2009 : Debug: port = "" Sun Dec 20 15:44:03 2009 : Debug: login = "radius_server" Sun Dec 20 15:44:03 2009 : Debug: password = "r4d1u5" Sun Dec 20 15:44:03 2009 : Debug: radius_db = "users" Sun Dec 20 15:44:03 2009 : Debug: read_groups = yes Sun Dec 20 15:44:03 2009 : Debug: sqltrace = no Sun Dec 20 15:44:03 2009 : Debug: sqltracefile = "/var/log/freeradius/sqltrace.sql" Sun Dec 20 15:44:03 2009 : Debug: readclients = no Sun Dec 20 15:44:03 2009 : Debug: deletestalesessions = yes Sun Dec 20 15:44:03 2009 : Debug: num_sql_socks = 5 Sun Dec 20 15:44:03 2009 : Debug: lifetime = 0 Sun Dec 20 15:44:03 2009 : Debug: max_queries = 0 Sun Dec 20 15:44:03 2009 : Debug: sql_user_name = "%{User-Name}" Sun Dec 20 15:44:03 2009 : Debug: default_user_profile = "" Sun Dec 20 15:44:03 2009 : Debug: nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" Sun Dec 20 15:44:03 2009 : Debug: authorize_check_query = " SELECT BNID as id, Username as username, 'Cleartext-Password' as attribute, Password as value , ':=' as op FROM Mitglieder WHERE Username = '%{SQL-User-Name}' AND VPN_IO = 1 AND Status BETWEEN 1600 AND 8900" Sun Dec 20 15:44:03 2009 : Debug: authorize_group_check_query = "" Sun Dec 20 15:44:03 2009 : Debug: authorize_group_reply_query = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_onoff_query = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_update_query = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_update_query_alt = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_start_query = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_start_query_alt = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_stop_query = "" Sun Dec 20 15:44:03 2009 : Debug: accounting_stop_query_alt = "" Sun Dec 20 15:44:03 2009 : Debug: connect_failure_retry_delay = 60 Sun Dec 20 15:44:03 2009 : Debug: simul_count_query = "" Sun Dec 20 15:44:03 2009 : Debug: simul_verify_query = "" Sun Dec 20 15:44:03 2009 : Debug: postauth_query = "" Sun Dec 20 15:44:03 2009 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Info: rlm_sql (sql_mitglieder): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Dec 20 15:44:03 2009 : Info: rlm_sql (sql_mitglieder): Attempting to connect to radius_server@dbserver.fbn-dd.de:/users Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): starting 0 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Attempting to connect rlm_sql_mysql #0 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Connected new DB handle, #0 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): starting 1 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Attempting to connect rlm_sql_mysql #1 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Connected new DB handle, #1 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): starting 2 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Attempting to connect rlm_sql_mysql #2 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Connected new DB handle, #2 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): starting 3 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Attempting to connect rlm_sql_mysql #3 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Connected new DB handle, #3 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): starting 4 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Attempting to connect rlm_sql_mysql #4 Sun Dec 20 15:44:03 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Dec 20 15:44:03 2009 : Debug: rlm_sql (sql_mitglieder): Connected new DB handle, #4 Sun Dec 20 15:44:03 2009 : Debug: (Loaded rlm_always, checking if it's valid) Sun Dec 20 15:44:03 2009 : Debug: Module: Linked to module rlm_always Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating reject Sun Dec 20 15:44:03 2009 : Debug: always reject { Sun Dec 20 15:44:03 2009 : Debug: rcode = "reject" Sun Dec 20 15:44:03 2009 : Debug: simulcount = 0 Sun Dec 20 15:44:03 2009 : Debug: mpp = no Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Checking accounting {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: Module: Instantiating echo Sun Dec 20 15:44:03 2009 : Debug: exec echo { Sun Dec 20 15:44:03 2009 : Debug: wait = yes Sun Dec 20 15:44:03 2009 : Debug: program = "/bin/echo %{User-Name}" Sun Dec 20 15:44:03 2009 : Debug: input_pairs = "request" Sun Dec 20 15:44:03 2009 : Debug: output_pairs = "reply" Sun Dec 20 15:44:03 2009 : Debug: shell_escape = yes Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Module: Checking session {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: Module: Checking post-auth {...} for more modules to load Sun Dec 20 15:44:03 2009 : Debug: } # modules Sun Dec 20 15:44:03 2009 : Debug: } # server Sun Dec 20 15:44:03 2009 : Debug: server { Sun Dec 20 15:44:03 2009 : Debug: modules { Sun Dec 20 15:44:03 2009 : Debug: } # modules Sun Dec 20 15:44:03 2009 : Debug: } # server Sun Dec 20 15:44:03 2009 : Debug: radiusd: #### Opening IP addresses and Ports #### Sun Dec 20 15:44:03 2009 : Debug: listen { Sun Dec 20 15:44:03 2009 : Debug: type = "auth" Sun Dec 20 15:44:03 2009 : Debug: ipaddr = * Sun Dec 20 15:44:03 2009 : Debug: port = 1812 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: listen { Sun Dec 20 15:44:03 2009 : Debug: type = "auth" Sun Dec 20 15:44:03 2009 : Debug: ipaddr = * Sun Dec 20 15:44:03 2009 : Debug: port = 1860 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: listen { Sun Dec 20 15:44:03 2009 : Debug: type = "acct" Sun Dec 20 15:44:03 2009 : Debug: ipaddr = * Sun Dec 20 15:44:03 2009 : Debug: port = 1861 Sun Dec 20 15:44:03 2009 : Debug: } Sun Dec 20 15:44:03 2009 : Debug: Listening on authentication address * port 1812 as server eap Sun Dec 20 15:44:03 2009 : Debug: Listening on authentication address * port 1860 as server pptp Sun Dec 20 15:44:03 2009 : Debug: Listening on accounting address * port 1861 as server pptp Sun Dec 20 15:44:03 2009 : Debug: Listening on proxy address * port 1814 Sun Dec 20 15:44:03 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.20 port 43443, id=34, length=185 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 27 NAS-Port-Type = Virtual User-Name = "Stephan.Kirsten" Calling-Station-Id = "10.17.2.2" Called-Station-Id = "192.168.254.20" MS-CHAP-Challenge = 0x6af23287e589a4d403e5e4ff5b327de1 MS-CHAP2-Response = 0x0100f2a949c8f48c5887c6ec6eaaba0e2afc0000000000000000ef8a3b845bd4b84e1322a794860bcbf5b5785fd6b0d9a37f NAS-Identifier = "Test-ES" NAS-IP-Address = 192.168.254.20 Sun Dec 20 15:44:46 2009 : Info: server pptp { Sun Dec 20 15:44:46 2009 : Info: +- entering group authorize {...} Sun Dec 20 15:44:46 2009 : Info: sql_xlat Sun Dec 20 15:44:46 2009 : Info: expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Info: expand: SELECT Sperre FROM Mitglieder WHERE Username = '%{User-Name}' AND Status BETWEEN 1600 AND 8900 -> SELECT Sperre FROM Mitglieder WHERE Username = 'Stephan.Kirsten' AND Status BETWEEN 1600 AND 8900 Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Reserving sql socket id: 4 Sun Dec 20 15:44:46 2009 : Info: sql_xlat finished Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Released sql socket id: 4 Sun Dec 20 15:44:46 2009 : Info: expand: %{sql_mitglieder:SELECT Sperre FROM Mitglieder WHERE Username = '%{User-Name}' AND Status BETWEEN 1600 AND 8900} -> 0 Sun Dec 20 15:44:46 2009 : Info: sql_xlat Sun Dec 20 15:44:46 2009 : Info: expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Info: expand: SELECT count(UserName) From radacct Where UNIX_TIMESTAMP(AcctStopTime)='0' AND Username='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime)+AcctSessionTime > UNIX_TIMESTAMP(DATE_SUB( now(),INTERVAL 600 SECOND)) Group By Username -> SELECT count(UserName) From radacct Where UNIX_TIMESTAMP(AcctStopTime)='0' AND Username='Stephan.Kirsten' AND UNIX_TIMESTAMP(AcctStartTime)+AcctSessionTime > UNIX_TIMESTAMP(DATE_SUB( now(),INTERVAL 600 SECOND)) Group By Username Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Sun Dec 20 15:44:46 2009 : Info: SQL query did not return any results Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Sun Dec 20 15:44:46 2009 : Info: expand: %{sql:SELECT count(UserName) From radacct Where UNIX_TIMESTAMP(AcctStopTime)='0' AND Username='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime)+AcctSessionTime > UNIX_TIMESTAMP(DATE_SUB( now(),INTERVAL 600 SECOND)) Group By Username} -> Sun Dec 20 15:44:46 2009 : Info: sql_xlat Sun Dec 20 15:44:46 2009 : Info: expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Info: expand: SELECT VPN_IO FROM Mitglieder Where Username = '%{User-Name}' AND Status BETWEEN 1600 AND 8900 -> SELECT VPN_IO FROM Mitglieder Where Username = 'Stephan.Kirsten' AND Status BETWEEN 1600 AND 8900 Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Reserving sql socket id: 3 Sun Dec 20 15:44:46 2009 : Info: sql_xlat finished Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Released sql socket id: 3 Sun Dec 20 15:44:46 2009 : Info: expand: %{sql_mitglieder:SELECT VPN_IO FROM Mitglieder Where Username = '%{User-Name}' AND Status BETWEEN 1600 AND 8900} -> 1 Sun Dec 20 15:44:46 2009 : Info: sql_xlat Sun Dec 20 15:44:46 2009 : Info: expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Info: expand: SELECT ROUND(SUM(AcctOutputOctets+AcctInputOctets)) FROM radacct WHERE Username='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > UNIX_TIMESTAMP(DATE_SUB(now(), INTERVAL 7 DAY)) -> SELECT ROUND(SUM(AcctOutputOctets+AcctInputOctets)) FROM radacct WHERE Username='Stephan.Kirsten' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > UNIX_TIMESTAMP(DATE_SUB(now(), INTERVAL 7 DAY)) Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Sun Dec 20 15:44:46 2009 : Info: sql_xlat finished Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql): Released sql socket id: 3 Sun Dec 20 15:44:46 2009 : Info: expand: %{sql:SELECT ROUND(SUM(AcctOutputOctets+AcctInputOctets)) FROM radacct WHERE Username='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > UNIX_TIMESTAMP(DATE_SUB(now(), INTERVAL 7 DAY))} -> 32933844 Sun Dec 20 15:44:46 2009 : Info: sql_xlat Sun Dec 20 15:44:46 2009 : Info: expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Info: expand: SELECT TrafficPunkteMax*1024*1024 FROM Mitglieder WHERE Username = '%{User-Name}' AND Status BETWEEN 1600 AND 8900 -> SELECT TrafficPunkteMax*1024*1024 FROM Mitglieder WHERE Username = 'Stephan.Kirsten' AND Status BETWEEN 1600 AND 8900 Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Reserving sql socket id: 2 Sun Dec 20 15:44:46 2009 : Info: sql_xlat finished Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Released sql socket id: 2 Sun Dec 20 15:44:46 2009 : Info: expand: %{sql_mitglieder:SELECT TrafficPunkteMax*1024*1024 FROM Mitglieder WHERE Username = '%{User-Name}' AND Status BETWEEN 1600 AND 8900} -> 62914560000 Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-5} - %{control:Tmp-Integer-4} -> - Sun Dec 20 15:44:46 2009 : Info: expand: %{expr: %{control:Tmp-Integer-5} - %{control:Tmp-Integer-4} } -> 0 Sun Dec 20 15:44:46 2009 : Info: ++[control] returns notfound Sun Dec 20 15:44:46 2009 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Sun Dec 20 15:44:46 2009 : Info: ++[mschap] returns ok Sun Dec 20 15:44:46 2009 : Info: [sql_mitglieder] expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: [sql_mitglieder] sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Reserving sql socket id: 1 Sun Dec 20 15:44:46 2009 : Info: [sql_mitglieder] expand: SELECT BNID as id, Username as username, 'Cleartext-Password' as attribute, Password as value , ':=' as op FROM Mitglieder WHERE Username = '%{SQL-User-Name}' AND VPN_IO = 1 AND Status BETWEEN 1600 AND 8900 -> SELECT BNID as id, Username as username, 'Cleartext-Password' as attribute, Password as value , ':=' as op FROM Mitglieder WHERE Username = 'Stephan.Kirsten' AND VPN_IO = 1 AND Status BETWEEN 1600 AND 8900 Sun Dec 20 15:44:46 2009 : Info: [sql_mitglieder] User found in radcheck table Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql_mitglieder): Released sql socket id: 1 Sun Dec 20 15:44:46 2009 : Info: ++[sql_mitglieder] returns ok Sun Dec 20 15:44:46 2009 : Info: ++? if (control:Tmp-Integer-1 > 0) Sun Dec 20 15:44:46 2009 : Info: ? Evaluating (control:Tmp-Integer-1 > 0) -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if (control:Tmp-Integer-1 > 0) -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-2}" > "%{control:Tmp-Integer-3}") Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-2} -> 0 Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-3} -> 1 Sun Dec 20 15:44:46 2009 : Info: ? Evaluating ("%{control:Tmp-Integer-2}" > "%{control:Tmp-Integer-3}") -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-2}" > "%{control:Tmp-Integer-3}") -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-5}" == 0) Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-5} -> 2785017856 Sun Dec 20 15:44:46 2009 : Info: ? Evaluating ("%{control:Tmp-Integer-5}" == 0) -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-5}" == 0) -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-4} -> 32933844 Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-5} -> 2785017856 Sun Dec 20 15:44:46 2009 : Info: ? Evaluating ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") -> TRUE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") -> TRUE Sun Dec 20 15:44:46 2009 : Info: ++- entering if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") {...} Sun Dec 20 15:44:46 2009 : Info: expand: USER %{User-Name}: hat Traffic-Limit erreicht! -> USER Stephan.Kirsten: hat Traffic-Limit erreicht! Sun Dec 20 15:44:46 2009 : Info: +++[reply] returns ok Sun Dec 20 15:44:46 2009 : Info: ++- if ("%{control:Tmp-Integer-4}" >= "%{control:Tmp-Integer-5}") returns ok Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" < "%{control:Tmp-Integer-5}") Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-4} -> 32933844 Sun Dec 20 15:44:46 2009 : Info: expand: %{control:Tmp-Integer-5} -> 2785017856 Sun Dec 20 15:44:46 2009 : Info: ? Evaluating ("%{control:Tmp-Integer-4}" < "%{control:Tmp-Integer-5}") -> FALSE Sun Dec 20 15:44:46 2009 : Info: ++? if ("%{control:Tmp-Integer-4}" < "%{control:Tmp-Integer-5}") -> FALSE Sun Dec 20 15:44:46 2009 : Info: Found Auth-Type = MSCHAP Sun Dec 20 15:44:46 2009 : Info: +- entering group MS-CHAP {...} Sun Dec 20 15:44:46 2009 : Info: [mschap] Told to do MS-CHAPv2 for Stephan.Kirsten with NT-Password Sun Dec 20 15:44:46 2009 : Info: [mschap] adding MS-CHAPv2 MPPE keys Sun Dec 20 15:44:46 2009 : Info: ++[mschap] returns ok Sun Dec 20 15:44:46 2009 : Info: +- entering group post-auth {...} Sun Dec 20 15:44:46 2009 : Info: [sql] expand: %{User-Name} -> Stephan.Kirsten Sun Dec 20 15:44:46 2009 : Info: [sql] sql_set_user escaped user --> 'Stephan.Kirsten' Sun Dec 20 15:44:46 2009 : Info: [sql] expand: %{User-Password} -> Sun Dec 20 15:44:46 2009 : Info: [sql] expand: %{Chap-Password} -> Sun Dec 20 15:44:46 2009 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Stephan.Kirsten', '', 'Access-Accept', '2009-12-20 15:44:46') Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Stephan.Kirsten', '', 'Access-Accept', '2009-12-20 15:44:46') Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Sun Dec 20 15:44:46 2009 : Debug: rlm_sql (sql): Released sql socket id: 2 Sun Dec 20 15:44:46 2009 : Info: ++[sql] returns ok Sun Dec 20 15:44:46 2009 : Info: } # server pptp Sending Access-Accept of id 34 to 192.168.254.20 port 43443 Reply-Message = "USER Stephan.Kirsten: hat Traffic-Limit erreicht!" Mikrotik-Rate-Limit = "128k/128k" Mikrotik-Advertise-URL = "http://www.fbn-dd.de" WISPr-Redirection-URL = "10.64.1.240" Mikrotik-Advertise-Interval = 10 WISPr-Logoff-URL = "10.64.1.240" MS-CHAP2-Success = 0x01533d44454546344137334242323735443732373841354545333337383841324543464439434537323836 MS-MPPE-Recv-Key = 0xfbcf5a773c0fda641859474e0e3cb0b8 MS-MPPE-Send-Key = 0xa96a099e1d07b693843bd4f1f447068c MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Sun Dec 20 15:44:46 2009 : Info: Finished request 0.

4 8

libtool/libltdl bug
by Peter O'Gorman 20 Dec '09

20 Dec '09

Hi, We received a bug report about libltdl, but there is not really enough information to diagnose the problem, perhaps someone here would be able to provide us with the reasoning of why this is a bug in ltdl. http://lists.gnu.org/archive/html/bug-libtool/2009-12/msg00028.html Note that I am subscribed in order to post, but have set it so that I don't receive email from the list, so please keep me in CC. Thanks, Peter -- Peter O'Gorman http://pogma.com

2 1

Different realms for different databases
by liran tal 20 Dec '09

20 Dec '09

Hey, To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows: authenticate { ... Autz-Type SQL_EXAMPLE2 { sql_example2 } ... } Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section. What would be the way to configure accounting for the different realms in their correct databases? FreeRADIUS 1.1.7 and MySQL 5. Regards, Liran.

3 9

Error building with ldtl own
by Коньков Евгений 20 Dec '09

20 Dec '09

Здравствуйте, FreeRadius. rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT cc .libs/radiusdS.o -pthread -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic -L/usr/local/lib /usr/ports/net/freeradius2/work/freeradius-server-2.1.7/src/lib/.libs/libfreeradius-radius.so -lcrypt /usr/local/lib/libltdl.so -lssl -lcrypto -Wl,--rpath -Wl,/usr/local/lib/freeradius-2.1.7 -Wl,--rpath -Wl,/usr/local/lib .libs/modules.o(.text+0x16e7): In function `setup_modules': : undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.7/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.7/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.7/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.7' gmake: *** [all] Error 2 *** Error code 1 Stop in /usr/ports/net/freeradius2. *** Error code 1 Stop in /usr/ports/net/freeradius2. -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 1

rlm_perl: Can't load module DBI.so
by Коньков Евгений 19 Dec '09

19 Dec '09

Здравствуйте, FreeRadius. Module: Instantiating kes perl kes { module = "/usr/local/etc/raddb/kes.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } Can't load '/usr/local/lib/perl5/5.10.1/mach/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/local/lib/perl5/5.10.1/mach/auto/Data/Dumper/Dumper.so: Undefined symbol "PL_sv_undef" at /usr/local/lib/perl5/5.10.1/mach/XSLoader.pm line 70. at /usr/local/lib/perl5/5.10.1/mach/Data/Dumper.pm line 36 Compilation failed in require at /usr/local/etc/raddb/kes.pl line 6. BEGIN failed--compilation aborted at /usr/local/etc/raddb/kes.pl line 6. rlm_perl: perl_parse failed: /usr/local/etc/raddb/kes.pl not found or has syntax errors. /usr/local/etc/raddb/modules/perl[58]: Instantiation failed for module "kes" /usr/local/etc/raddb/sites-enabled/default[263]: Failed to find module "kes". /usr/local/etc/raddb/sites-enabled/default[263]: Failed to parse "kes" entry. Errors initializing modules When I commented out use of Data::Dumper in my perl kes module I get: Can't load '/usr/local/lib/perl5/site_perl/5.10.1/mach/auto/DBI/DBI.so' for module DBI: /usr/local/lib/perl5/site_perl/5.10.1/mach/auto/DBI/DBI.so: Undefined symbol "PL_dowarn" at /usr/local/lib/perl5/5.10.1/mach/DynaLoader.pm line 200. at /usr/local/lib/perl5/site_perl/5.10.1/mach/DBI.pm line 263 BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/5.10.1/mach/DBI.pm line 263. Compilation failed in require at /usr/local/etc/raddb/kes.pl line 9. BEGIN failed--compilation aborted at /usr/local/etc/raddb/kes.pl line 9. rlm_perl: perl_parse failed: /usr/local/etc/raddb/kes.pl not found or has syntax errors. /usr/local/etc/raddb/modules/perl[58]: Instantiation failed for module "kes" /usr/local/etc/raddb/sites-enabled/default[263]: Failed to find module "kes". /usr/local/etc/raddb/sites-enabled/default[263]: Failed to parse "kes" entry. Errors initializing modules In common scripts those modules works fine without errors: #!/usr/bin/perl use Data::Dumper; my $a= { b => 3 }; print Dumper $a; That is freeradius do wrong thing loading modules or .. ? in 2.1.3 there were not errors -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 2