May 2009 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 49, Issue 4
by wlanmac 14 May '09

14 May '09

For what it's worth, CoovaChilli supports an option called 'acctupdate' which will allow for "updated" provisioning attributes to be returned to the NAS in accounting response. Yes, it's not very RFC compliant, but certainly helpful when you don't have the ability to send CoA requests to the NAS. David On Mon, 2009-05-04 at 07:32 +0200, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re :checking authorization in the duration of connection (Eric) > 2. Re: Re :checking authorization in the duration of connection > (??????? ????????) > 3. Re: Re :checking authorization in the duration of connection > (Marinko Tarlac) > 4. Re: Re :checking authorization in the duration of connection > (Ivan Kalik) > 5. Re :checking authorization in the duration of connection (Eric) > 6. Re: Re :checking authorization in the duration of connection > (Fajar A. Nugraha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 3 May 2009 14:39:11 +0430 > From: Eric <bbahar3(a)gmail.com> > Subject: Re :checking authorization in the duration of connection > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <38a27c8c0905030309u44457388u2e55f5f2c9a5b1b8(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > NAS sends accounting update packets in periodic times. I want > freeradius use this updates and > check my online users periodically and send Disconnect packet if > user's traffic is above my > limit. > How can it do this? > any document about config ? > Eric wrote: > > Hi, > > My radius server use ldap server for authorize and authentication.I set an > attribute in ldap server that is the check-name in sqlcounter to limit users > Input traffic. I want when user traffic reaches to this amount the user > become stop but radius checks ldap attributes only at the first of > connection not in the middle. How can I set radius server check users > traffic with the amount of this attribute in ldap server in the duration of > connection? > > The radius server steps out of the way once authentication and authorization > is complete, nor does it have the ability to disconnect a user from a NAS. > You need to have the NAS disconnect the user itself when a threshold is > reached. This is accomplished by returning a vendor specific attribute > specifying the limit for the session which the NAS then maintains. Once the > limit on the NAS is reached the NAS terminates the session. You'll have to > check your NAS documentation for a traffic limiting parameter. In the other > common case of disconnect after a time duration it's handled by computing > the session length during authorization and returning attribute 194 with the > maximum number of seconds for the connection. This attribute is understood > by comon NAS devices and is known variously as Ascend-Maximum-Time, > Cisco-Maximum-Time > or Lucent-Maximum-Time. You'll need to apply the same logic for data volume. >

3 2

Re: Upgrading freeradius from source
by Ming-Ching Tiew 14 May '09

14 May '09

--- On Thu, 5/14/09, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: > From: A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Upgrading freeradius from source > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Date: Thursday, May 14, 2009, 7:45 AM > Hi, > > > Software will always have flaws, defects, bugs or > whatever > > we call it. The way I understand the rpmbuild > process, > > it is not difficult to add a little patch which fixes > > the problem. > > ..or just wait for 2.1.6 which fixes the problem + many > other small > issues > No issues. I have made myself a own rpm for 2.1.4/2.1.5 for adapting the older SPECS. It's not perfect but good enough for my own consumption for the time being. Cheerse.

1 0

Problems with IP address allocation, help needed debugging...
by Ramm-Ericson, Johannes 14 May '09

14 May '09

Hi Freeradius-users! I've run into a problem with my Freeradius 2.1.3 installation (on Suse Linux 10 - I'll be upgrading freeradius & migrating to Ubuntu Linux server during the weekend) that I'm hoping maybe someone on this list can help me with. There are several NASes from various vendors / service providers connecting to my Freeradius server. I have instances of IP address allocation managed by the vendors equipment and in some cases IP address allocation is managed by my server. IP address management by Freeradius works fine except for in one instance and I have been hitting my head against the wall trying to figure out where the problem is. Here is the radiusd.conf post-auth / ippool configuration for a working instance (GLANA) and for the instance that does not work (CBJN) ippool GLANA { range-start = 192.168.10.2 range-stop = 192.168.10.254 netmask = 255.255.255.0 cache-size = 252 session-db = ${db_dir}/db.GLANA.pool ip-index = ${db_dir}/db.GLANA.ipindex #override = yes maximum-timeout = 600 } ippool CBJN { range-start = 192.168.6.2 range-stop = 192.168.6.254 netmask = 255.255.255.0 cache-size = 252 session-db = ${db_dir}/db.CBJN.pool ip-index = ${db_dir}/db.CBJN.ipindex #override = yes maximum-timeout = 600 } Following are extracts from the debug log that exemplify a working instance with GLANA and a failing instance with CBJN: ************** Working instance with GLANA *************** Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.249 port 3886, id=80, length=126 NAS-IP-Address = 192.168.11.249 NAS-Identifier = "sh_ggsn_3" Called-Station-Id = "GLANA" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 64749880 User-Name = "048103" User-Password = "*****" Calling-Station-Id = "3333" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 250 [files] users: Matched entry DEFAULT at line 278 ++[files] returns ok Found Auth-Type = System +- entering group System {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <sel048103> ++[pam] returns ok Login OK: [048103] (from client GLANA port 64749880 cli 3333) +- entering group post-auth {...} [GLANA] expand: %{NAS-IP-Address} %{NAS-Port} -> 192.168.11.249 64749880 [GLANA] MD5 on 'key' directive maps to: 525f9fa7f7e5045b96ec4ad53f324087 [GLANA] Searching for an entry for key: '525f9fa7f7e5045b96ec4ad53f324087' rlm_ippool: Allocating ip to key: '525f9fa7f7e5045b96ec4ad53f324087' [GLANA] num: 1 [GLANA] Allocated ip 192.168.10.55 to client key: 525f9fa7f7e5045b96ec4ad53f324087 ++[GLANA] returns ok [reply_log] expand: /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply -detail-%Y%m%d -> /opt/freeradius/current/var/log/radius/radacct/192.168.11.249/reply-detail-2009 0513 [reply_log] /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m %d expands to /opt/freeradius/current/var/log/radius/radacct/192.168.11.249/reply-detail-20090513 [reply_log] expand: %t -> Wed May 13 11:10:21 2009 ++[reply_log] returns ok [sql] expand: %{User-Name} -> 048103 [sql] sql_set_user escaped user --> '048103' [sql] expand: %{User-Password} -> ***** [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdat e) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type} ', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '048103', '****', 'Access-Accept', '2009-05-13 11:10:21') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (userna me, pass, reply, authdate) VALUES ( '048103', '*****', 'Access-Accept', '2009-05-13 11:10:21') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok Sending Access-Accept of id 80 to 192.168.11.249 port 3886 MS-Primary-DNS-Server = 192.168.212.10 Framed-IP-Address = 192.168.10.55 Framed-IP-Netmask = 255.255.255.0 Finished request 90. ***************************************************** **************** Failing instance with CBJN **************** Ready to process requests. rad_recv: Access-Request packet from host 10.100.100.1 port 4415, id=170, length=136 NAS-IP-Address = 10.100.100.1 NAS-Identifier = "****" Called-Station-Id = "CBJN" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 9682712 User-Name = "100583" User-Password = "****" 3GPP-IMSI = "111111111111" Calling-Station-Id = "2222" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 236 [files] users: Matched entry DEFAULT at line 278 ++[files] returns ok Found Auth-Type = System +- entering group System {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <100583> ++[pam] returns ok Login OK: [100583] (from client CBJN port 9682712 cli 2222) +- entering group post-auth {...} ++[GLANA] returns noop [reply_log] expand: /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply -detail-%Y%m%d -> /opt/freeradius/current/var/log/radius/radacct/10.100.100.1/reply-detail-200905 14 [reply_log] /opt/freeradius/current/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m %d expands to /opt/freeradius/current/var/log/radius/radacct/10.100.100.1/reply-detail-20090514 [reply_log] expand: %t -> Thu May 14 07:52:51 2009 ++[reply_log] returns ok [sql] expand: %{User-Name} -> 100583 [sql] sql_set_user escaped user --> '100583' [sql] expand: %{User-Password} -> ****** [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdat e) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type} ', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '100583', '*****', 'Access-Accept', '2009-05-14 07:52:51') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (userna me, pass, reply, authdate) VALUES ( '100583', '****', 'Access-Accept', '2009-05- 14 07:52:51') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok Sending Access-Accept of id 170 to 10.100.100.1 port 4415 MS-Primary-DNS-Server = 192.168.212.10 Finished request 54. ************************************************** I'm hoping someone can provide some guidance as to why IP address allocation via Freeradius fails in the second (CBJN) instance.... Also; naturally I'll provide any further logs necessary to clarify anything I may have missed mentioning now (for obvious reasons I also had to clean the logs before posting them here, so I may have missed a relevant entry). Thanks and Regards, Johannes

2 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 14 May '09

14 May '09

--- On Wed, 5/13/09, John Dennis <jdennis(a)redhat.com> wrote: > BTW, the 2.1.4/2.1.5 snafu is why > the most recent > RPM is 2.1.3. > -- Software will always have flaws, defects, bugs or whatever we call it. The way I understand the rpmbuild process, it is not difficult to add a little patch which fixes the problem. Regards.

3 2

how to limiting user bandwidth by quota..
by Nizar Zulmi 14 May '09

14 May '09

dear all..i'am using freeradius 1.1.7 on ubuntu 8.04, i do implementing sqlcounter like noresetcounter,dailycounter and montly counter and it works properly. but i now i have 1 case how to limiting user bandwidth usage with sqlcounter, i've read and learn how do sqlcounter work, but i still dont have idea how to make a query to limiting user bandwidth. i have 1 user and i want to limit the bandwidth for this user 300mb in a week..how to perform this..clue please..really apreciate for your help

3 2

Re: radiusd -X solaris eap error
by Urugn 13 May '09

13 May '09

Hello again I finally got the freeradius build 2.1.5 to initialize under SunOS 5.10 Generic_138889-02 i86pc i386 i86pc. Here is the data 1. Got mysql from blastwave via pkg-get 2. Got openssl from blastwave via pk-get install openssl 3. downloaded freeradius-server-2.1.4.tar.gz from freeradius.org 4. tar -xvfz freeradius-server-2.1.4.tar.gz 5. mv freeradius-server-2.1.4 /usr/src/freeradius 6. cd /usr/src/freeradius 7. ./configure --with-openssl-includes=/opt/csw/include/openssl --with-openssl-libraries=/opt/csw/lib 8. gmake 9. gmake install 10. cd /usr/local/etc/raddb/certs created the following openssl script from the Makefile 11. vi radss.sh #!/bin/bash # # Diffie-Hellman parameters # openssl dhparam -out dh 1024 # # Create a new self-signed CA certificate # openssl req -new -x509 -keyout ca.key -out ca.pem -days 3660 -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key whatever -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:whatever -passout pass:whatever openssl pkcs12 -in server.p12 -out server.pem -passin pass:whatever -passout pass:whatever # #Verify Server Certificate # openssl verify -CAfile ca.pem server.pem # # # Create a new client certificate, signed by the the above server # certificate. # # openssl req -new -out client.csr -keyout client.key -config ./client.cnf openssl ca -batch -keyfile server.key -cert server.crt -in client.csr -key whatever -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:whatever -passout pass:whatever openssl pkcs12 -in client.p12 -out client.pem -passin pass:whatever -passout pass:whatever cp client.pem urugn(a)support.com.pem 12. chmod +x radssl 13 ./radssl manually executed the following command thats included in the Makefile 14. date > ./random; Finally ran radiusd -X 15. radiusd -X Lots of debug with the following output Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Well i think under solaris the auto build process is not finished hopefully this will be fixed in the 2.1.6 release. Next i will be interested in solaris router to act as the radius client. One thing very confusing is solaris router a NAS/RAS and how can i get it to authenticate LAN subnets to the radius? Any info or links will be appreciated. Thanks in advance. On Wed, May 13, 2009 at 10:27 AM, Urugn <urugn.tony(a)gmail.com> wrote: > Thanks Alan > > debud mode would be radiusd -x or radiusd -xx or the extendd debug mode > radiusd -X > > i have tried radiusd -xx and still got the following error and the server > does not start > > /usr/local/etc/raddb/certs/bootstrap: make: not found > /usr/local/etc/raddb/certs/bootstrap: test: unknown operator == > > > > On Tue, May 12, 2009 at 3:09 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> tony(a)urugn.com wrote: >> > Errors initializing modules >> > I thot may be ad trace the problem and directly executed >> > /usr/local/etc/raddb/certs/bootstrap Here is the output >> > sh: test: argument expected >> > *** Error code 1 >> > The following command caused the error: >> > if [ -e /dev/urandom ] ; then \ >> > dd if=/dev/urandom of=./random count=10 >/dev/null 2>&1; \ else >> \ >> > date > ./random; \ >> > fi >> > make: Fatal error: Command failed for target `random' >> > ./bootstrap: test: unknown operator == >> >> Just re-run the server in debug mode. There's a typo in the script >> that will be fixed in 2.1.6. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >

1 0

User in multiple groups with different login time
by Pramada Batchu 13 May '09

13 May '09

Hi, I am trying to assign one user to multiple groups and each group has a different login time. Is it possible to check the user against each group's login time and allow access if anyone of them matches. I tried using DEFAULT and matching GROUP-NAME in users file with fall-through option. But the last matching entry overwrites the Login-time to its value. Is there a way that we can concatenate Login time values from all matching entries or is there any other way we can achieve this? Thanks, Pramada

2 1

Re: authentication failed because sqlcounter...
by Nizar Zulmi 13 May '09

13 May '09

the problem solved it just because 30 second less than one minute, i've tried using Max-All-Sesion:=3600 and it works.. --- On Sat, 5/9/09, Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> wrote: From: Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> Subject: Re: authentication failed because sqlcounter... To: tnt(a)kalik.net, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Saturday, May 9, 2009, 2:03 PM i am using freeradius 1.1.7, not that old rite??? i've tried using := operator and cleartext-password but still doesn't work..this bellow is my radcheck table.. +----+----------+--------------------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+--------+ | 1 | nizar | Password | == | nizar | | 2 | nizar1 | Password | == | nizar1 | | 6 | tes | Max-All-Session | == | 90 | | 4 | tes | Password | == | tes | | 7 | denizaro | Cleartext-Password | := | 123456 | | 8 | denizaro | Max-All-Session | := | 30 | +----+----------+--------------------+----+--------+ 6 rows in set (0.00 sec) i try to log in with user denizaro first time before i add attribute max-all-session its succesfully logged in, but after i adding max-all-session attribut its failed.. whats happen?? --- On Sat, 5/9/09, Ivan Kalik <tnt(a)kalik.net> wrote: From: Ivan Kalik <tnt(a)kalik.net> Subject: Re: authentication failed because sqlcounter... To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Saturday, May 9, 2009, 2:51 AM > mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it > as default no change i made in noresetcounter module. then i adding > noresetcounter in authorize and instantiate section. > i have defined 1user named tes and password tes has loged in normally > before i add attribut max-all-session in the table radcheck just like > this. > +----+----------+-----------------+----+--------+ > | id | UserName | Attribute | op | Value | > +----+----------+-----------------+----+--------+ > | 1 | nizar | Password | == | nizar | > | 2 | nizar1 | Password | == | nizar1 | > | 6 | tes | Max-All-Session | == | 90 | > | 4 | tes | Password | == | tes | > +----+----------+-----------------+----+--------+ > after i adding the attribut max-all-session the user tes cannot login > anymore. i do running freeradius in debug mode and the following si the > result.. := not ==. And that password attribute Password is deprecated for many years. How old is your freeradius version? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAP password
by Doug Hardie 13 May '09

13 May '09

V 2.1.5. I am having a problem with PAP not using the proper user id. IF the user id is just a plain <user_id> then it works properly. However, I have some realms setup that have prefixes and suffixes e.g., DUB+<user_id>@lafn. PAP is trying to find the user_id DUB+<user_id>@lafn rather than the stripped user id <user_id> and hence it doesn't find a password for the user. Everything works just fine if I add Auth-Type := Accept to the users file, but thats not a great way to run a railroad. Obviously I missed something. hints has: DEFAULT Prefix == "DUB+", Suffix == "@lafn", Strip-User-Name = Yes Hint = "SlipStream" What have I missed?

3 6

MySQL radacct backup
by sub 13 May '09

13 May '09

Hello everybody, I've a full working freeradius server on an Ubuntu server. My accounting table grows and grows so I'd like to backup my data in any way; before I write my own procedure, does the server (freeradius) provide any utility? I've looked in the config but I've not found anything useful. Basically, this would be something different from a simple MySQL Database backup as I'll have to keep info about the total AcctSessionTime of every user. Thanks! -- sub

5 5