May 2009 - Freeradius-Users - lists.freeradius.org

FW: freeradius2.1.4--Simultaneous
by 蒋曙 26 May '09

26 May '09

HI: I use freebsd7.0+mysql+freeradius2.1.4 Can use the raidus data base to be hit by a consumer at the same time, by verifying with a consumer. But, I am put into use coming to control a consumer "Simultaneous" in raidus. When condition now is that second consumers log on,before acctstoptime in billing form renew with classics. But, nas does not initiate consumer time line information kit. (The consumer continues using a network). Feel that the radius does not send out acc-reject or acc-stop Bao Lai stops using a family. Thank you! System localhost# whereis perl perl: /usr/bin/perl /usr/local/man/man1/perl.1 localhost# whereis snmpget snmpget: /usr/local/bin/snmpget /usr/local/man/man1/snmpget.1 Cisco config aaa authentication enable default none aaa authentication dot1x default group radius aaa authorization network default group radius aaa accounting send stop-record authentication failure aaa accounting suppress null-username aaa accounting session-duration ntp-adjusted aaa accounting update newinfo periodic 5 aaa accounting dot1x default start-stop group radius aaa accounting network default start-stop group radius aaa accounting connection default start-stop group radius aaa accounting resource default start-stop-failure group radius interface FastEthernet0/1 switchport mode access dot1x pae authenticator dot1x port-control auto dot1x violation-mode protect dot1x timeout quiet-period 2 dot1x guest-vlan 3 dot1x auth-fail vlan 4 dot1x auth-fail max-attempts 2 spanning-tree portfast redius.conf # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" INSERT INTO `radius`.`radgroupcheck` (`groupname` ,`attribute` ,`op` ,`value` )VALUES ( 'user', 'Simultaneous-Use', ':=', '1'); 使用同一账号登录的时候，在mysql的radacct表中发现如下情况！不知道是否正常？（我觉得这个不正常）。 mysql> select username,acctstarttime,acctstoptime from radacct where username="jsh"; +----------+---------------------+---------------------+ | username | acctstarttime | acctstoptime | +----------+---------------------+---------------------+ | jsh | 2009-05-19 07:34:57 | 2009-05-19 07:35:49 | | jsh | 2009-05-19 07:35:49 | NULL | +----------+---------------------+---------------------+ 2 rows in set (0.00 sec) mysql> sites-available/default accounting { radutmp ... sql .... } session { #radutmp sql } … ….. Mysql query is radacct,radpostauth radacct username acctstarttime acctstoptime count(*) jsh 2009-05-26 07:45:09 NULL 1 radpostauth <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radpostauth&toke n=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radpostauth%60.%60id%60+% 3D+14&sql_query=SELECT+%2A+FROM+%60radpostauth%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radpostauth&token=9954b 30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radpostauth%60+WHERE+%6 0radpostauth%60.%60id%60+%3D+14+LIMIT+1&zero_rows=The+row+has+been+deleted&g oto=sql.php%3Fdb%3Dradius%26table%3Dradpostauth%26token%3D9954b30f278d52fb0a 59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radpostauth%2560%2 6zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structure.php> Delete 14 jsh Access-Accept 2009-05-26 07:30:04 <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radpostauth&toke n=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radpostauth%60.%60id%60+% 3D+15&sql_query=SELECT+%2A+FROM+%60radpostauth%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radpostauth&token=9954b 30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radpostauth%60+WHERE+%6 0radpostauth%60.%60id%60+%3D+15+LIMIT+1&zero_rows=The+row+has+been+deleted&g oto=sql.php%3Fdb%3Dradius%26table%3Dradpostauth%26token%3D9954b30f278d52fb0a 59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radpostauth%2560%2 6zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structure.php> Delete 15 jsh Access-Accept 2009-05-26 07:45:08 <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radpostauth&toke n=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radpostauth%60.%60id%60+% 3D+16&sql_query=SELECT+%2A+FROM+%60radpostauth%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radpostauth&token=9954b 30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radpostauth%60+WHERE+%6 0radpostauth%60.%60id%60+%3D+16+LIMIT+1&zero_rows=The+row+has+been+deleted&g oto=sql.php%3Fdb%3Dradius%26table%3Dradpostauth%26token%3D9954b30f278d52fb0a 59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radpostauth%2560%2 6zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structure.php> Delete 16 jsh Access-Accept 2009-05-26 07:45:08 　Radgroupcheck <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radgroupcheck&sql_query =SELECT+%2A+FROM+%60radgroupcheck%60&goto=tbl_structure.php&dontlimitchars=1 &token=9954b30f278d52fb0a59651606dd9117> Full Texts id groupname attribute op value <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radgroupcheck&to ken=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radgroupcheck%60.%60id% 60+%3D+1&sql_query=SELECT+%2A+FROM+%60radgroupcheck%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radgroupcheck&token=995 4b30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radgroupcheck%60+WHER E+%60radgroupcheck%60.%60id%60+%3D+1+LIMIT+1&zero_rows=The+row+has+been+dele ted&goto=sql.php%3Fdb%3Dradius%26table%3Dradgroupcheck%26token%3D9954b30f278 d52fb0a59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radgroupche ck%2560%26zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structur e.php> Delete 1 user Simultaneous-Use := 1 Nas nasname shortname type ports secret community description 192.168.0.100 cisco3560 cisco 1812 cisco cisco3560 RADIUS Client 蒋　　曙财讯传媒集团__信息技术部地址：北京市朝阳门外大街22号泛利大厦10层 100020 Tel：010-85650282 Mobi:13810174932 Fax：010-65880126 MSN：mousejsh(a)hotmail.com

1 0

Statistic Counter
by Marco De Magistris 26 May '09

26 May '09

Hi all, Thanks in advance for your help. My scenario is shown below: ________________________________________________________________________ ____ Radius Client --> Radius Proxy Radius Server 192.168.1.2 192.168.1.3 --> IPS1(192.168.1.4) ________________________________________________________________________ ____ I need the following Authentication Statistic of the RADIUS Server (192.168.1.4) AuthRadiusClientAccessRequests Counter32, AuthRadiusClientAccessRetransmissions Counter32, AuthRadiusClientAccessAccepts Counter32, AuthRadiusClientAccessRejects Counter32, AuthRadiusClientAccessChallenges Counter32, AuthRadiusClientMalformedAccessResponses Counter32, AuthRadiusClientBadAuthenticators Counter32, AuthRadiusClientPendingRequests Gauge32, AuthRadiusClientTimeouts Counter32, AuthRadiusClientUnknownTypes Counter32, AuthRadiusClientPacketsDropped Counter32, AuthRadiusClientCounterDiscontinuity TimeTicks Launch the command: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1 , FreeRADIUS-Stats-Server-IP-Address = 192.168.1.4 , FreeRADIUS-Stats-Server-Port = 1812" | ./radclient -s 192.168.1.3:1812 status <SHAREDSECRET> Received response ID 59, code 2, length = 140 FreeRADIUS-Total-Access-Requests = 56 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 1 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 3 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 5 FreeRADIUS-Total-Auth-Unknown-Types = 0 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Can I enable other counters for AuthRadiusClientAccessRetransmissions, AuthRadiusClientTimeouts, AuthRadiusClientCounterDiscontinuity)? Or I should use "counter" module of FreeRadius? RadiusClientAccessRetransmissions "The number of RADIUS Access-Request packets retransmitted to this RADIUS authentication server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of edaRadiusServerCounterDiscontinuity." RadiusClientTimeouts "The number of authentication timeouts to this server. After a timeout, the client may retry to the same server, send to a different server, or give up. A retry to the same server is counted as a retransmit as well as a timeout. A send to a different server is counted as a Request as well as a timeout. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of edaRadiusServerCounterDiscontinuity." RadiusClientCounterDiscontinuity "The number of centiseconds since the last discontinuity in the RADIUS Client counters. A discontinuity may be the result of a reinitialization of the RADIUS Client module within the managed entity." Thanks Regards Marco

2 1

filter anonymous identity
by Riccardo Veraldi 26 May '09

26 May '09

Hello, on radius 1.1.x I have some users autenticating using an outer identity. This is annoying to me because in the radius.log file I cannot identify easily who is the real user autenticating, since outer identity can be anything. How can I forbid in freeradius configuration to use an outer identity or anonymous ? I wish to forbid autentications which uses an outer identity. howto have control over it ? thank you Rick

4 6

MySQL 5.1 Partitions & FreeRADIUS
by Tim O'Donovan 26 May '09

26 May '09

Hi, Has anyone had any success in implementing MySQL 5.1's partitions to increase backend performance for FreeRADIUS? Thanks, Tim

2 1

modules in authorize{} and authenticate{} sections
by bastardinho69 26 May '09

26 May '09

Hi, guys, I have successfully set up FreeRADIUS server to use Active Directory to authenticate LAN users. My authorize{} and authenticate{} section configuration in radiusd.conf file looks like this: authorize { preprocess eap mschap } authenticate { Auth-Type MS-CHAP { mschap } eap } As u see, in both sections there is modules eap and mschap mentioned. Can anybody tell me why it is so? Or where to look for the answer? I have been checking the logs from running radius in debug mode but i cannot find the definite answer, for example, in conversation between radius server and supplicant, mschap in authorize section always returns noop, so my question is- why it is needed there if it always returns noop? Thank you.

2 1

cisco: time-based reply attributes set
by Ruslan A Dautkhanov 25 May '09

25 May '09

Hello, How to link reply attributes set with time of day (and possibly time of week) ? We need to leverage shaping at Cisco twice at night. Up to Cisco documentation, Cisco-Avpair += PPW00:00:00:127 Cisco-Service-Info += QU;128000;16000;32000;D;128000;16000;32000 Cisco-Avpair += PPW08:00:00:127 Cisco-Service-Info += QU;256000;32000;64000;D;256000;32000;64000 for example, is used to deal with this demand. As far as I understand, Cisco re-authorize at specified time without droppping user's session, so you can reapply some attributes, e.g. Cisco-Service-Info with different shaping. How to link reply attributes set with time of day (and possibly time of week) ? Is any module to deal with it, or it's core's due? Thank you, Ruslan

2 1

external script doesn't add the attributes it prints out
by Stun Box 25 May '09

25 May '09

Hi all, I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply } and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2) But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug : ... [GETVLAN] expand: %{User-Name} -> nobody Exec-Program output: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program-Wait: value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program: returned: 3 ++[GETVLAN] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nobody" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nobody" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.3.125 port 48956 EAP-Message = 0x0109002b190017030100206a5e995dedc28425eadd6f6b92faa22efdc1a93ab3a26a000df6f49744b8b392 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1f8b9f59174286e5556aa2fa4357052a Finished request 8. Going to the next request .... Regards, G.

3 5

Huntgroup problem
by Parashar Singh 25 May '09

25 May '09

Hi I am new to freeradius. I want to implement huntgroup for associating a user name with particular NAS device. I am performing username authentication with Auth-Type = LDAP If my NAS devices are cisco routes, with IP A.B.C.D, and I want to authenticate this device with user1/***** in LDAP, can some one pls provide what are configuration needed to modified in which files. If I am doing following in /etc/raddb/users file: kmcuser Auth-Type = LDAP, Huntgroup-Name == "kmc1" Fall-Through = Yes and following lines in /etc/raddb/huntgroup file: kmc1 NAS-IP-Address == 172.16.0.150 After restarting radius server with radiusd -X, Now if I am trying to logon to NAS device, it is unsuccessfull with following messages: rad_recv: Access-Request packet from host 172.16.0.150:47715, id=31, length=65 NAS-IP-Address = 172.16.0.155 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "kmcuser" User-Password = "kmcnet" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "kmcuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. Login incorrect: [kmcuser] (from client private-network-1 port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 172.16.0.150 port 47715 Waking up in 4 seconds... so pls tell me how shall I solve this problem?/

3 2

freeRadius 1.1.6 ldap inner and outer identity
by Daniel Daza Muñoz 25 May '09

25 May '09

Hello, We use freeRadius v 1.1.6 and EAP-TTLS for our WiFi network. FreeRadius uses LDAP for users autentication. It is querying LDAP about inner identities and outer identities (anonymous usually). Is there any way to stop freeRadius from querying LDAP about outer identities? Thanks. -- "En el principio Dios creo * desde la línea de comandos" Daniel Daza Muñoz Responsable de programación. Área de Comunicaciones. Servicio de Informática y Comunicaciones. UNIVERSIDAD DE SEVILLA. Campus de Reina Mercedes. Edificio Rojo. Despacho 3.26 Avenida de Reina Mercedes, s/n 41012 Sevilla ESPAÑA KML de localización geográfica: https://jade.us.es/publico/ArCo.kml Web : http://www.us.es/servicios/sic/ Tlf : 95 455 11 97 Fax : 95 455 65 45 Mail: daniel(a)us.es Clave PGP: http://pgp.rediris.es:11371/pks/lookup?op=vindex&search=0xF7D11DDD97D2AEF5

3 2

Re: usr-hiper and freeradius 2.1.5 accounting problem
by haries fajar nugroho 25 May '09

25 May '09

Thanks for replying.. haries fajar nugroho wrote: >> I wanna migrate my radius server from icradius to freeradius 2.1.5.' > 2.1.6. [root@rina2 haries]# /usr/local/freeradius/sbin/radiusd -v radiusd: FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr 15 2009 at 13:33:02 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. >> In my freeradius debugging mode, the error message was : >> rad_recv: Accounting-Request packet from host x.x.x.x (* encrypted ip) >> port 1646, id=63, length=405 >> Received Accounting-Request packet from x.x.x.x (* encrypted ip) with >> invalid signature! (Shared secret is incorrect.) Dropping packet >> without response. > Well... the shared secret is wrong. There really isn't much else to say. But what i am wondering is, why the authentication sections run normally. My user can be authenticated, but the accounting cannot be logged. When i use the same settings with another ras modem, the AAA runs correctly. >> 2. I've tried to use default freeradius secret at the freeradius side >> with testing123 without changing the secret at the ras modem. But >> still failed. > That won't work. >> Do you have another solution ? > Re-enter the shared secret on both the NAS && FreeRADIUS. > Alan DeKok. Thanks :)

3 2