May 2009 - Freeradius-Users - lists.freeradius.org

Accounting responce question.
by lamersons 28 May '09

28 May '09

Hello there, i have posted here few times and got very helpfull answers, so i desided to try my luck once more. Im using FreeRADIUS Version 2.0.4(slackware+postgre) on powerfull x86 server with alot of RAM, connected with gigabit to NAS. Load is about 5-15record/sec Once in a while we get double accounting records. I started to take traces at NAS side and saw that sometimes AAA doesnt responce to accounting record, NAS thinks that AAA didnt get it and sends it one more time. But AAA gets the first one even if it doesnt responce to request, therefore we get double record.(debug info is below) I have made debug trace at AAA side. Is it somehow possible to see from that trace that AAA did respond and that is NASes(or network) problem that it did not recieve responce ?(debug info is below) p.s. ------------------------------------------------------------------- I sent information to NAS vendor: Dear, Yesterday at 02:27:38 PDSN sent the "Accounting request start" message and then PDSN sent the same Accounting request start massage at 02:27:43 (see in traces of PI interface). Thanks Best regards, They answered me: • The AAA can’t start the new accounting session, until it stops the first one, so the AAA doesn’t reply to the Accounting Request Start. • The PDSN wait for TIMEOUT which is 5 seconds, and resend the Accounting message again. • When the PDSN resend the Accounting message, the AAA replies to it. ----------------------------------------------------------------------- ########################### First start record : request 11309 Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:27:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('0000000', '33187f91caa26b34', '247033715823092', 'Jul 18 2008 02:27:39 EEST', NULL,'0', '0', '0', '192.168.172.128', trim('triatel(a)triatel.lv'), '0', '0', '17934924', '0', '192.168.145.1') rlm_sql (sql): Reserving sql socket id: 18 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 18 ++[sql] returns ok Finished request 11309. Cleaning up request 11309 ID 18 with timestamp +769 Going to the next request ##################### second Start record : request 11380 Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:27:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 5 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('0000000', '33187f91caa26b34', '247033715823092', 'Jul 18 2008 02:27:39 EEST', NULL,'0', '0', '0', '192.168.172.128', trim('triatel(a)triatel.lv'), '0', '0', '17934924', '0', '192.168.145.1') rlm_sql (sql): Reserving sql socket id: 43 rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error duplicate key value violates unique constraint "radacct_acctuniqueid" rlm_sql_postgresql: Postgresql Fatal Error: [23505: UNIQUE VIOLATION] Occurred!! rlm_sql (sql): Couldn't insert SQL accounting START record - ERROR: duplicate key value violates unique constraint "radacct_acctuniqueid" expand: -> rlm_sql (sql): Released sql socket id: 43 ++[sql] returns ok Finished request 11380. ############################## Interim record ################### Ready to process requests. Acct-Status-Type = Interim-Update User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:42:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Acct-Session-Time = 900 Acct-Output-Octets = 0 Acct-Input-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Multi-Session-Id = "17934924" Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Session-Continue = 1 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Active-Time = 33 3GPP2-Number-Active-Transitions = 0 3GPP2-Received-HDLC-Octets = 0 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Last-User-Activity-Time = 1216337292 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: -> rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok Finished request 21837. ##########################################STOP record ########## Acct-Status-Type = Stop User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:43:01 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Acct-Session-Time = 922 Acct-Output-Octets = 0 Acct-Input-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = Idle-Timeout Acct-Multi-Session-Id = "17934924" Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Session-Continue = 0 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-Release-Indicator = 7 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Active-Time = 33 3GPP2-Number-Active-Transitions = 0 3GPP2-Received-HDLC-Octets = 0 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Last-User-Activity-Time = 1216337292 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: UPDATE radacct SET AcctStopTime = '%{Event-Timestamp}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '%{Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', CDMABadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', CDMACorrelationId = '%{3GPP2-Correlation-Id}', CDMAActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' -> UPDATE radacct SET AcctStopTime = 'Jul 18 2008 02:43:01 EEST', AcctSessionTime = '922', AcctInputOctets = '0', OutputPacket = '0', InputPacket = '0', AcctOutputOctets = '0', ReleaseIndicator = 'Idle-Timeout', CDMABadPPPFrameCount = '0', CDMACorrelationId = '17934924', CDMAActiveTime = '33' WHERE AcctUniqueId = '33187f91caa26b34' rlm_sql (sql): Reserving sql socket id: 25 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 25 ++[sql] returns ok Finished request 22102. -- View this message in context: http://www.nabble.com/Accounting-responce-question.-tp23756895p23756895.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

How to enter users in sql?
by Just E. Mail 27 May '09

27 May '09

I have successfully setup a freeRADIUS server with PostgreSQL backend (separate) server. When I start freeRADIUS in test mode 'radiusd -X', it connects to the sql server and there is no error. I have two general questions: 1. I need to add one or two test UID & PW in the SQL database. Is there a GUI application available to accomplish that or I have to do it manually entering the data? 2. When the freeRADIUS server is live (on-line) how does user authentication data gets added into the database? In MD5, LINUX has an application to add USER Name & Group (created automatically) which both email program (such as Postfix) and freeRADIUS authenticate against. How is it done in PostgreSQL? I have tried to post this question as clearly as I can. Please ask and clarification! Jennifer K.

2 1

Assigning IP address from RADIUS to Cisco PPTP users
by up＠3.am 27 May '09

27 May '09

Hi: I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems. Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common vpdn-group 1 accept-dialin protocol pptp virtual-template 1 interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

3 5

wired 802.1x for desktops (offtopic)
by Mikael Kermorgant 27 May '09

27 May '09

Hello, Sorry for this off-topic message, I have a question about 802.1x deployment and don't know where to ask. As freeradius is one of the element I think of, maybe someone here can help me find the solution ? My Goals : 1) authenticate access to the network from Open Public Access Catalog (OPAC) desktop machines available to every user of a biblioteque. 2) have a guest account with limited LAN access (no access to internet, or just a very short whitelist) 3) Keep the machines reachable from some servers (ghost server, monitoring, etc). (this criteria eliminates the solution of a captive portal) I thought 802.1x with dynamic vlans would be a nice solution as it should permit to put the guest account in a specific vlan. But how would it be possible to reach the machine from the management servers before someone authenticates ? Is it possible to have a default vlan activated on startup of the machine ? Or do you know where I should ask this question ? Regards, -- Mikael Kermorgant

4 4

Authenticating usernames with spaces using MySQL
by Justin Menga 27 May '09

27 May '09

Hi I have an issue where I authenticate incoming DHCP requests on a broadband aggregation router using the Option 82 Port ID information as the username attribute within the RADIUS authentication request. Unfortunately the Port ID information includes spaces - and this is causing an issue where authentication fails using MySQL database, even though a username with spaces is configured in the MySQL database. If I use the /etc/raddb/users file it works OK, but I want to use MySQL accounting etc... Any ideas on how to work around this issue? Thanks Justin

2 1

Re: Assigning IP address from RADIUS to Cisco PPTP users
by Neville 26 May '09

26 May '09

> Message: 1 > Date: Tue, 26 May 2009 18:56:42 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: Assigning IP address from RADIUS to Cisco PPTP users > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <52973.87.194.16.13.1243360602.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > >> I've used Livingston and Cistron radiusd's in the past with dialup ppp >> users and Cisco/Lucent NASes and have been able to do this with no >> problems. >> >> Users are currently authenticating fine and getting assigned IPs from the >> IP pool as defined in the Cisco NAS. However, I'd like to have a few, >> select users assigned static IPs from outside that pool, but the Cisco >> (2811) is simply ignoring the raddb/users file entry for that user and >> assigning an IP from the pool on the NAS. >> >> Here is my Cisco config:: >> -------------------- >> aaa new-model >> aaa authentication login default local group radius >> aaa authentication ppp default group radius local >> aaa authorization exec default local >> aaa authorization network default if-authenticated >> aaa session-id common >> >> vpdn-group 1 >> accept-dialin >> protocol pptp >> virtual-template 1 >> >> interface Loopback0 >> ip address 99.99.99.99 255.255.255.255 >> ip nat inside >> ip virtual-reassembly >> >> interface Virtual-Template1 >> ip unnumbered FastEthernet0/0 >> ip policy route-map VPN-Client >> peer match aaa-pools >> peer default ip address pool vpnpool >> no keepalive >> ppp encrypt mppe auto >> ppp authentication pap chap ms-chap ms-chap-v2 >> ! >> ip local pool vpnpool 172.16.30.2 172.16.30.254 >> --------- >> Here is the raddb/users file entry: >> --------- >> testuser Service-Type == Framed-User >> Framed-Protocol == PPP, >> Framed-IP-Address = 172.16.1.2, >> Framed-IP-Netmask = 255.255.255.255, >> Framed-Compression = Van-Jacobson-TCP-IP >> >> DEFAULT Framed-Protocol == PPP >> Framed-Protocol = PPP, >> Framed-Compression = Van-Jacobson-TCP-IP >> -------------- >> The DEFAULT entry allows users in /etc/passwd to authenticate fine, but >> "testuser" still gets an IP from the NAS pool instead of the one above.. >> Any pointers appreciated! > > http://wiki.freeradius.org/index.php/FAQ#It_still_doesn.27t_work.21 > > Post the debug of the authentication attempt. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 2 > Date: Tue, 26 May 2009 14:15:44 -0500 > From: jon jon <free9360(a)gmail.com> > Subject: Re: next > To: tim.sylvester(a)networkradius.com, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <c1efadb10905261215n4c0a4cdbw143227509a69c594(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > ok so after reading the admin.sql it looks like it is telling me what to > type into my mysql, to create a default admin for radius,and so freeradius > can read any table in sql, does it matter what I change localhost to or > can > it be anyname I want. guess I am seeing what I have to do but not fully > understanding it. I am using a mysql book also but think that might be > getting me more confused. > jon > > On Tue, May 26, 2009 at 12:02 PM, Tim Sylvester < > tim.sylvester(a)networkradius.com> wrote: > >> Read the SQL HOWTO at: http://wiki.freeradius.org/SQL_HOWTO. Also, look >> at the sql.conf file in the raddb directory and the mysql files in >> raddb/sql/mysql. You will want to read the information in admin.sql and >> schema.sql. >> >> >> >> Tim >> >> >> >> *From:* freeradius-users-bounces+tim.sylvester=networkradius.com@ >> lists.freeradius.org >> [mailto:freeradius-users-bounces+tim.sylvester<freeradius-users-bounces%2Btim.sylvester> >> =networkradius.com(a)lists.freeradius.org] *On Behalf Of *jon jon >> *Sent:* Tuesday, May 26, 2009 9:51 AM >> *To:* FreeRadius users mailing list >> *Subject:* next >> >> >> >> I have my freeradius working, I running slackware 12.1 with freeradius >> version 2.1.5. I used NTRAping utility to send packets to my freeradius >> server. I also used radtest and that was successful. So now I want to set >> freeradius with backend mysql database. I am looking for the script >> db_mysql.sql and cannot find this file. I installed mysql as a package, >> when >> I installed slackware. So, does that file even exist anymore? I have the >> radius book and the directory it shows doesn't contain any file with that >> name. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

3 2

Preventing outer EAP id from going through auth
by John Doppke 26 May '09

26 May '09

I have a fairly standard config, using EAP/TTLS and an LDAP back end. Both EAP and non-EAP requests need to do LDAP lookups. It's working well (I did very little customizing), except I see a lot of the anonymous outer id's getting sent to the LDAP servers. I moved EAP above LDAP in the config, and it seems to have eliminated those when EAP returns 'ok', but I'm still seeing some. It looks like when EAP returns 'updated' it still runs anonymous through LDAP. I noticed the eap def has ok = return, should I add updated = return to avoid the anonymous LDAP lookups? -John

2 1

Re: Fail-over. Send the request directly to Server2
by Ivan Kalik 26 May '09

26 May '09

> My scenario is: > > > > --> Radius Server > 1 > > Radius Client --> Radius Proxy --- > > --> Radius Server > 2 > > > > Radius Proxy sends the request to the first live home server in the list > (fail-over method). > > Can RadiusProxy send the request directly towards Server2, if Server1 is > down? > Yes. Read instructions in proxy.conf. Ivan Kalik Kalik Informatika ISP

1 0

Fail-over. Send the request directly to Server2
by Marco De Magistris 26 May '09

26 May '09

Hi guys, My scenario is: --> Radius Server 1 Radius Client --> Radius Proxy --- --> Radius Server 2 Radius Proxy sends the request to the first live home server in the list (fail-over method). Radius Proxy sends the request towards Server1. Server 1 is down. Now the Radius Proxy rejects the Request. Radius Client Radius Proxy Radius Server1 | Request --> | Request--> | | <-- Reject | | Can RadiusProxy send the request directly towards Server2, if Server1 is down? Radius Client Radius Proxy Radius Server1 | Request --> | Request --> | (Server1 is down, Radius Proxy sends packet towards Server2) Radius Server2 | | Request --> | | | <-- Accept | Thanks in advance Marco

1 0

RE: Freeradius-Users Digest, Vol 49, Issue 117
by Marco De Magistris 26 May '09

26 May '09

Hi Alan Thanks for your help. Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: martedì 26 maggio 2009 17.58 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 117 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Statistic Counter (Alan DeKok) 2. problem with rlm_counter module when reset option is set to never (Ahmed Nifaz Faizabadi) 3. Re: problem with rlm_counter module when reset option is set to never (Ivan Kalik) 4. Re: problem with rlm_counter module when reset option is set to never (Ahmed Nifaz Faizabadi) 5. Re: problem with rlm_counter module when reset option is set to never (Alan DeKok) 6. Assigning IP address from RADIUS to Cisco PPTP users (up(a)3.am) 7. wired 802.1x for desktops (offtopic) (Mikael Kermorgant) 8. FW: freeradius2.1.4--Simultaneous (??) ---------------------------------------------------------------------- Message: 1 Date: Tue, 26 May 2009 13:29:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Statistic Counter To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1BD2AF.5050101(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Marco De Magistris wrote: > Can I enable other counters for AuthRadiusClientAccessRetransmissions, > AuthRadiusClientTimeouts, AuthRadiusClientCounterDiscontinuity)? The server does not currently track those statistics. As always, patches are welcome. > Or I should use ?counter? module of FreeRadius? No. It won't do what you want. Alan DeKok. ------------------------------ Message: 2 Date: Tue, 26 May 2009 18:13:59 +0530 From: Ahmed Nifaz Faizabadi <ahmednifaz(a)gmail.com> Subject: problem with rlm_counter module when reset option is set to never To: freeradius-users(a)lists.freeradius.org Message-ID: <d49df1900905260543k4228999ai4aeb7ff46b595237(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Hi all, Here is the issue I am facing with rlm_counter module. I am using freeradius-server-2.1.4 and configuring Max session time for each user. for example: user1 Max-Session-Time := 1800, Auth-Type := Reject Reply-Message = "Your time limit is used" user2 Max-Session-Time := 3600, Auth-Type := Reject Reply-Message = "Your time limit is used" and rlm_counter options are : counter daily { counter-name = Max-All-Session-Time check-name = Max-All-Session key = User-Name reset = never } I am observing that the user accounting record is not deleted from rlm_counter module once the user has used his allocated time. For example when user1 has used 1800 seconds allocated to him then I will be deleting the user from users config and then add the same user back. I am getting the "Your time limit is used" message :(. Does somebody has information about how to delete the records from rlm_counter module once they are expired with reset-option set to never. Regards Ahmed Nifaz ------------------------------ Message: 3 Date: Tue, 26 May 2009 14:15:35 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: problem with rlm_counter module when reset option is set to never To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <30874.194.176.105.44.1243343735.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Here is the issue I am facing with rlm_counter module. > I am using freeradius-server-2.1.4 and configuring Max session time > for each user. > > for example: > user1 Max-Session-Time := 1800, Auth-Type := Reject > Reply-Message = "Your time limit is used" > > user2 Max-Session-Time := 3600, Auth-Type := Reject > Reply-Message = "Your time limit is used" > > and rlm_counter options are : > > counter daily { > counter-name = Max-All-Session-Time > check-name = Max-All-Session > key = User-Name > reset = never > } > > > I am observing that the user accounting record is not deleted from > rlm_counter module once the user has used his allocated time. And what makes you think it would be. > For > example when user1 has used 1800 seconds allocated to him then I will > be deleting the user from users config and then add the same user > back. I am getting the "Your time limit is used" message :(. > > Does somebody has information about how to delete the records from > rlm_counter module once they are expired with reset-option set to > never. Yes. Delete accounting records as well when you delete user details. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Tue, 26 May 2009 19:03:34 +0530 From: Ahmed Nifaz Faizabadi <ahmednifaz(a)gmail.com> Subject: Re: problem with rlm_counter module when reset option is set to never To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <d49df1900905260633k59bc4b28peeeeb6f6f36d9223(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 >> Here is the issue I am facing with rlm_counter module. >> I am using freeradius-server-2.1.4 and configuring Max session time >> for each user. >> >> for example: >> user1 ? ? ? ? ?Max-Session-Time := 1800, Auth-Type := Reject >> ? ? ? ? ? ? ? ? Reply-Message = "Your time limit is used" >> >> user2 ? ? ? ? ?Max-Session-Time := 3600, Auth-Type := Reject >> ? ? ? ? ? ? ? ? Reply-Message = "Your time limit is used" >> >> and rlm_counter options are : >> >> counter daily { >> ? ? ? ?counter-name = Max-All-Session-Time >> ? ? ? ?check-name = Max-All-Session >> ? ? ? ?key = User-Name >> ? ? ? ?reset = never >> ? ?} >> >> >> I am observing that the user accounting record is not deleted from >> rlm_counter module once the user has used his allocated time. > > And what makes you think it would be. > This would increase the accounting file size indefenitely and cause some other problems as the user records are not at all being deleted. >> For >> example when user1 has used 1800 seconds allocated to him then I will >> be deleting the user from users config and then add the same user >> back. I am getting the "Your time limit is used" message :(. >> >> Does somebody has information about how to delete the records from >> rlm_counter module once they are expired with reset-option set to >> never. > > Yes. Delete accounting records as well when you delete user details. > I tried that but that accounting file is in binary or some other encrypted format. Will you please let me know about how to delete that accounting record or how to convert that to simple text file ( which would make easy deleting expired records) . Ahmed Nifaz ------------------------------ Message: 5 Date: Tue, 26 May 2009 15:49:26 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: problem with rlm_counter module when reset option is set to never To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1BF366.5020409(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ahmed Nifaz Faizabadi wrote: .... >>> counter daily { >>> counter-name = Max-All-Session-Time >>> check-name = Max-All-Session >>> key = User-Name >>> reset = never ... >>> I am observing that the user accounting record is not deleted from >>> rlm_counter module once the user has used his allocated time. ... > This would increase the accounting file size indefenitely and cause > some other problems as the user records are not at all being deleted. See the configuration: "reset = never" means "never reset". Which means "don't reset". > I tried that but that accounting file is in binary or some other > encrypted format. Will you please let me know about how to delete that > accounting record or how to convert that to simple text file ( which > would make easy deleting expired records) . It's just a DBM file. See the "rad_counter.pl" file in the source tree. It shows how to edit the file. Alan DeKok. ------------------------------ Message: 6 Date: Tue, 26 May 2009 11:34:41 -0400 (EDT) From: up(a)3.am Subject: Assigning IP address from RADIUS to Cisco PPTP users To: freeradius-users(a)lists.freeradius.org Message-ID: <Pine.BSF.4.64.0905261122570.14312(a)richard2.pil.net> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Hi: I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems. Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common vpdn-group 1 accept-dialin protocol pptp virtual-template 1 interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am ========================================================================= ------------------------------ Message: 7 Date: Tue, 26 May 2009 17:49:03 +0200 From: Mikael Kermorgant <mikael.kermorgant(a)gmail.com> Subject: wired 802.1x for desktops (offtopic) To: freeradius-users(a)lists.freeradius.org Message-ID: <9711147e0905260849o189c2601w5c1e378769668760(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, Sorry for this off-topic message, I have a question about 802.1x deployment and don't know where to ask. As freeradius is one of the element I think of, maybe someone here can help me find the solution ? My Goals : 1) authenticate access to the network from Open Public Access Catalog (OPAC) desktop machines available to every user of a biblioteque. 2) have a guest account with limited LAN access (no access to internet, or just a very short whitelist) 3) Keep the machines reachable from some servers (ghost server, monitoring, etc). (this criteria eliminates the solution of a captive portal) I thought 802.1x with dynamic vlans would be a nice solution as it should permit to put the guest account in a specific vlan. But how would it be possible to reach the machine from the management servers before someone authenticates ? Is it possible to have a default vlan activated on startup of the machine ? Or do you know where I should ask this question ? Regards, -- Mikael Kermorgant

1 0