June 2009 - Freeradius-Users - lists.freeradius.org

multiple radiusVSA in ldap.attrmap
by François Mehault 12 Jun '09

12 Jun '09

Hi, I would like to have a profil administrator on my openldap wich allows administrator to authenticate on cisco and foundry equipment and enters directly in Privileged EXEC level. So I read VSA attribute in dictionary.foundry and dictionary.cisco. I created my profile in OpenLDAP and I am logging on my cisco and see the reply log to see what is reply. With this profil : dn: cn=administrateur,ou=Profiles,dc=netplus,dc=fr objectClass: radiusObjectProfile objectClass: top objectClass: radiusprofile radiusServiceType: NAS-Prompt-User cn: administrateur radiusVSA: shell:priv-lvl=15 radiusReplyItem: "Foundry-Privilege-Level = 0" radiusReplyItem: "Foundry-Command-String = *" radiusReplyItem: "Foundry-Command-Exception-Flag = 0" radiusReplyItem: "Foundry-INM-Privilege = 15" + in ldap.attrmap I add replyItem $GENERIC$ radiusReplyItem [...] replyItem Cisco-AVPair radiusVSA I see in my log : Fri Jun 12 12:01:07 2009 Packet-Type = Access-Accept Reply-Message = "Utilisateur: fmehault, group: Administrateur" Cisco-AVPair = "shell:priv-lvl=15" Service-Type = NAS-Prompt-User With this profil : dn: cn=administrateur,ou=Profiles,dc=netplus,dc=fr objectClass: radiusObjectProfile objectClass: top objectClass: radiusprofile radiusServiceType: NAS-Prompt-User cn: administrateur radiusVSA: shell:priv-lvl=15 radiusVSA: 0 radiusVSA: 15 + in ldap.attrmap I add replyItem Cisco-AVPair radiusVSA replyItem Foundry-Privilege-Level radiusVSA replyItem Foundry-INM-Privilege radiusVSA I see in my log : Fri Jun 12 12:14:49 2009 Packet-Type = Access-Accept Reply-Message = "Utilisateur: fmehault, group: Administrateur" Foundry-INM-Privilege = AAA_pri_15 Foundry-Privilege-Level = 15 Cisco-AVPair = "shell:priv-lvl=15" Service-Type = NAS-Prompt-User I don't succeed to give good value for each attribute with OpenLDAP, ldapattrmap, radiusVSA ... In addition, I can't to have two radiusVSA attributes with the same value in OpenLDAP. So I woul like to know if it is possible to have just one profil with several attributes for different constructor (foundry, cisco, fortinet ...). Or I have to do a profil administratorCisco, administratorFoundry, ... Thanks for your help in advance Regards, François Mehault

3 3

Robust proxy accounting
by Chris Howley 12 Jun '09

12 Jun '09

Ivan, I doubled the value of cleanup delay in radiusd.conf. This change didn't fix the problem (see below). Thanks for your help, Chris ++[exec] returns noop Sending Access-Accept of id 88 to 10.12.80.109 port 32769 User-Name = "isschug" MS-MPPE-Recv-Key = 0x529e91a0004dce6a6ba2d81c79eeeb98aa3bc7c08880c37d95236064ef786280 MS-MPPE-Send-Key = 0x59005da107574a481d3a7d580821be64872d65153f9767789e79a51f84880994 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschug - student" Finished request 9. Going to the next request Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49",User-Name = "isschug"' [acct_unique] Acct-Unique-Session-ID = "829905a4bf02a129". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschug", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-11:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-11:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Fri Jun 12 11:51:48 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschug ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschug attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 167 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313337 Proxying request 10 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 167 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313337 Going to the next request Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 137 due to unfinished request 10 Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.3 seconds. Cleaning up request 0 ID 79 with timestamp +1750 Cleaning up request 1 ID 80 with timestamp +1750 Cleaning up request 2 ID 81 with timestamp +1750 Cleaning up request 3 ID 82 with timestamp +1750 Cleaning up request 4 ID 83 with timestamp +1750 Cleaning up request 5 ID 84 with timestamp +1750 Cleaning up request 6 ID 85 with timestamp +1750 Waking up in 0.2 seconds. Cleaning up request 7 ID 86 with timestamp +1750 Cleaning up request 8 ID 87 with timestamp +1751 Cleaning up request 9 ID 88 with timestamp +1751 Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 137 due to unfinished request 10 Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.4 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 137 due to unfinished request 10 Rejecting request 10 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:11 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:11 [detail.example.com] expand: %t -> Fri Jun 12 11:51:48 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 137 to 10.12.80.109 port 32769 Finished request 10. Cleaning up request 10 ID 137 with timestamp +1758 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 86 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:11 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "829905a4bf02a129" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 11:51:48 BST" Acct-Delay-Time = 7 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 179 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3339353133 Proxying request 12 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 179 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3339353133 Going to the next request Waking up in 0.8 seconds. Waking up in 0.1 seconds. Waking up in 0.6 seconds. Waking up in 1.0 seconds. Waking up in 0.5 seconds. Waking up in 0.6 seconds. Waking up in 0.8 seconds. Waking up in 0.9 seconds. Waking up in 0.3 seconds. Rejecting request 12 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 12. Cleaning up request 12 ID 39513 with timestamp +1765 Going to the next request Waking up in 0.7 seconds. Waking up in 26.6 seconds. Sending Status-Server of id 141 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.3 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "829905a4bf02a129" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 11:51:48 BST" Acct-Delay-Time = 43 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 210 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3232383630 Proxying request 14 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 210 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3232383630 Going to the next request Waking up in 0.6 seconds. Waking up in 0.3 seconds. Waking up in 1.1 seconds. Waking up in 1.0 seconds. Waking up in 0.8 seconds. Waking up in 0.7 seconds. Waking up in 1.1 seconds. Rejecting request 14 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 14. Cleaning up request 14 ID 22860 with timestamp +1801 Going to the next request Waking up in 25.5 seconds. Sending Status-Server of id 186 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 0.4 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "829905a4bf02a129" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 11:51:48 BST" Acct-Delay-Time = 79 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 16. Cleaning up request 16 ID 56874 with timestamp +1837 Going to the next request Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*

2 1

my freeradius-2.1.6 is not auth with PIN only.
by Goke M Aruna 12 Jun '09

12 Jun '09

I will be glad, if anyone can direct me to whare The log below is the part of the debug for the new test freeradius server 2.1.6 am testing with. However, the hotspotlogin,cgi is able to pass the param username to the radius but when the query is run against the database the "Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031" the value of the username sent is changed. I have disabled the chap in the /usr/local/etc/raddb/sites-enabled/default. kindly advise on what to do. ################### my radcheck has the info below. mysql> select * from radcheck; +-----+------------+--------------------+----+------------+ | id | username | attribute | op | value | +-----+------------+--------------------+----+------------+ | 5 | 2345678901 | Auth-Type | := | Accept | | 201 | 1234567890 | Cleartext-Password | := | 1234567890 | +-----+------------+--------------------+----+------------+ 4 rows in set (0.00 sec) ######################radiusd -XX (part of the debug) rad_recv: Access-Request packet from host 127.0.0.1 port 44600, id=0, length=189 ChilliSpot-Max-Input-Octets = 0x32333435363738393031 ChilliSpot-Max-Output-Octets = 0 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-1F-29-80-62-F3" Called-Station-Id = "00-50-DA-0C-C9-B0" NAS-Identifier = "nas01" Acct-Session-Id = "4a2e6a7700000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xf2ee6add34820fb96dcceef08c07bbc5 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Tue Jun 9 14:59:48 2009 : Info: +- entering group authorize {...} Tue Jun 9 14:59:48 2009 : Info: ++[preprocess] returns ok Tue Jun 9 14:59:48 2009 : Info: ++[mschap] returns noop Tue Jun 9 14:59:48 2009 : Info: [suffix] No '@' in User-Name = "2345678901", looking up realm NULL Tue Jun 9 14:59:48 2009 : Info: [suffix] No such realm "NULL" Tue Jun 9 14:59:48 2009 : Info: ++[suffix] returns noop Tue Jun 9 14:59:48 2009 : Info: [eap] No EAP-Message, not doing EAP Tue Jun 9 14:59:48 2009 : Info: ++[eap] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[unix] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[files] returns noop Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Info: [sql] sql_set_user escaped user --> '0x32333435363738393031' Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0x32333435363738393031' ORDER BY id Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0x32333435363738393031' ORDER BY priority Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] User 0x32333435363738393031 not found Tue Jun 9 14:59:48 2009 : Info: ++[sql] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[expiration] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[logintime] returns noop Tue Jun 9 14:59:48 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Jun 9 14:59:48 2009 : Info: ++[pap] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[validity] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[noresetcounter] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[hotspotcontrol] returns noop Tue Jun 9 14:59:48 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jun 9 14:59:48 2009 : Info: Failed to authenticate the user. Tue Jun 9 14:59:48 2009 : Info: Using Post-Auth-Type Reject Tue Jun 9 14:59:48 2009 : Info: +- entering group REJECT {...} Tue Jun 9 14:59:48 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 9 14:59:48 2009 : Info: ++[attr_filter.access_reject] returns updated Tue Jun 9 14:59:48 2009 : Info: Delaying reject of request 0 for 1 seconds Tue Jun 9 14:59:48 2009 : Debug: Going to the next request Tue Jun 9 14:59:48 2009 : Debug: Waking up in 0.9 seconds. Tue Jun 9 14:59:49 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 44600 Tue Jun 9 14:59:49 2009 : Debug: Waking up in 4.9 seconds. Tue Jun 9 14:59:54 2009 : Info: Cleaning up request 0 ID 0 with timestamp +187 Tue Jun 9 14:59:54 2009 : Debug: Ready to process requests.

2 2

refresh variable after exec module
by bLn 12 Jun '09

12 Jun '09

Good morning, I back with the same problem. I've seeing past post for last week but I have any wrong because those solutions don't work for me. I have a script in exec module which set 2 values: Session-Timeout if everything is correct for each user and it calculate his remaining time to connect, and Reply-Message if there is any problem, to show this message to the user I've seen these values are cached before when mysql runs the queries to radcheck, radgroupchek, radreply, etc...in authtorize section and when I execute my script in post-auth module the new values aren't replaced and sent together with Access-Accept or Access-Reject I've done an update in post-auth section, like you said in last posts, in two different modes: first example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "%{reply:Reply-Message}" } sql reply_log } Second example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } I've set Reply-Message := "pepe" to try without a variable but unsuccessfully because I'm not sure if I've set the variable correctly but if I put the value of variable and this is not send neither it is because my value is not replaced by the before one, ok? why? Post-Auth section post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap exec update outer.reply { Session-Timeout:="%{reply:Session-Timeout}" } # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } } I try with "update reply" too. I don't understand the different between both modes. Can you say me where I can read the neccesary doc to find this difference? thanks in advance and I'm sorry to repeat this issue again

3 9

MAC Authentication
by Steve Wu 11 Jun '09

11 Jun '09

Everyone - I'm being a bit brain dead most likely. I have been tinkering with Freeradius and MAC authentication successfully. Now I have a real server to build FR on so I proceeded to build the new server. After going through the *same* steps to build FR, duplicating the clients.conf and users file, I can't get the auth to work again. In my notes these were the two files I touched to get it going, but I'm hoping I missed something simple. My -Xy output looks like this: --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.10.18.208:1030, id=16, length=53 User-Name = "000e35-84610a" User-Password = "000e35-84610a" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "000e35-84610a", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 1 seconds... My users file: 000E35-84610A Cleartext-Password := "000E35-84610A" Any help to recover from my brain lapse would be greatly appreciated. Did I miss some other config tweak so it's looking at the user file? Thx in advance!

3 3

Change of Authorization (RFC 3576 / 5176)
by Alan DeKok 11 Jun '09

11 Jun '09

I have just committed *full* support for CoA to the "stable" and "master" branches on git.freeradius.org. I'd like to thank the sponsor of this work, who wishes to remain anonymous. In 2.1.6, the server could *originate* CoA packets. e.g. If the users bandwidth consumption is over a quota, send a packet to disconnect them. In the current "git" code, it can now *receive* CoA packets. This also means full proxying of CoA packets. It is now possible to implement functionality such as: "disconnect user bob" This can be done by sending a CoA packet to the server, with User-Name of "bob". The policies on the server can then look up in the accounting database to see where that user has logged in, and fill in the rest of the CoA packet with NAS IP, port, etc. The resulting packet can then be sent to the NAS. The only caveat is that none of these policies have been written. The functionality works, and has been tested with switches from at least one major networking vendor. We now need help to create the policies, schemas, etc. to implement the required functionality. Alan DeKok.

5 8

segmentation fault with group in huntgroups
by François Mehault 11 Jun '09

11 Jun '09

Hi All, I want to use huntgroup to restrict access to certain huntgroups to certaingroups of users. So I edit my huntgroups file : swLabo NAS-IP-Address == 192.168.0.50 Group = administrateur I guess that administrateur is a Ldap-Group, isn't it ? And I use OpenLDAP to store my users and my radiusGroupName. dn: ou=Profiles,dc=netplus,dc=fr objectClass: organizationalUnit objectClass: top ou: Profiles dn: cn=administrateur,ou=Profiles,dc=netplus,dc=fr objectClass: radiusObjectProfile objectClass: top objectClass: radiusprofile radiusServiceType: NAS-Prompt-User radiusVSA: shell:priv-lvl=15 cn: administrateur dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: administrateur homeDirectory: /home/fmehault loginShell: /usr/local/bin/zsh cn: Francois MEHAULT gidNumber: 1203 userPassword: {SHA}C5wmJdwh7wX2rU3fR8XyA4N6oyw= So I understand that fmehault is able to authenticate on the NAS 192.168.0.50. But I have a segmentation fault of radiusd. I created also the posix group administrateur which includes fmehault. rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=67, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" User-Password = "mdp" +- entering group authorize {...} zsh: segmentation fault radiusd -X # id fmehault uid=1203(fmehault) gid=1203 groups=1203,1400(administrateur) What is the problem ? If someone has a documentation/howto about huntgroups and group, I am interested. Regards, François Mehault Netplus Communication

3 3

Robust proxy accounting
by Chris Howley 11 Jun '09

11 Jun '09

Ivan, When both RADIUS servers are operational robust proxying works. When one of the servers is unreachable the other server (that's attempting to proxy an accounting request) will delete the detail.work file from the listener's sub-directory after failing to get a response from the other server. Thanks for you help. Chris ++[exec] returns noop Sending Access-Accept of id 67 to 10.12.80.109 port 32769 User-Name = "isschrpg" MS-MPPE-Recv-Key = 0x240dd3ada2d5904bf049fc2bd7afdfc8b1a2b589b4eb3974235cf04143f138d1 MS-MPPE-Send-Key = 0x638979dd5d59705051793c16de1509508e39fd9722d56198d52da2286bb69879 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschrpg - student" Finished request 9. Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44",User-Name = "isschrpg"' [acct_unique] Acct-Unique-Session-ID = "aeb3d50af9d33fb8". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschrpg", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Thu Jun 11 08:39:20 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok [unix] ++returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschrpg ++[radutmp] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] expand: %{User-Name} -> isschrpg [sql] expand: %{%{User-Name}:-DEFAULT} -> isschrpg [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> isschrpg [sql] sql_set_user escaped user --> 'isschrpg' [sql] expand: %{Acct-Delay-Time} -> [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', ! '%{Calling-Station-Id} [sql] expand: /usr/local/var/log/radius/sqltrace.sql -> /usr/local/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('4a30b4a8/00:13:02:8d:f3:1f/44', 'aeb3d50af9d33fb8', 'isschrpg', '', 'WM07-1', '10.12.80.109', '29', '', '2009-06-11 08:39:20', '0000-00-00 00:00:00', '0', 'RADIUS', '', '', '0', '0', '10.12.80.109', '129.11.1.138', 'VLAN', 'IEEE-802', '3022', '', '', '', '1! 29.11.1.138', '0', '0') rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschrpg attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 66 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Proxying request 10 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 66 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Going to the next request Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.4 seconds. Cleaning up request 0 ID 58 with timestamp +4 Cleaning up request 1 ID 59 with timestamp +4 Cleaning up request 2 ID 60 with timestamp +4 Cleaning up request 3 ID 61 with timestamp +4 Cleaning up request 4 ID 62 with timestamp +4 Cleaning up request 5 ID 63 with timestamp +4 Cleaning up request 6 ID 64 with timestamp +4 Waking up in 0.2 seconds. Cleaning up request 7 ID 65 with timestamp +4 Cleaning up request 8 ID 66 with timestamp +5 Cleaning up request 9 ID 67 with timestamp +5 Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 Discarding duplicate request from client wism07-1 port 32769 - ID: 123 due to unfinished request 10 Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 Discarding duplicate request from client wism07-1 port 32769 - ID: 123 due to unfinished request 10 Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.6 seconds. Rejecting request 10 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] expand: %t -> Thu Jun 11 08:39:20 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 123 to 10.12.80.109 port 32769 Finished request 10. Cleaning up request 10 ID 123 with timestamp +9 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 19 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.3 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44",User-Name = "isschrpg"' [acct_unique] Acct-Unique-Session-ID = "aeb3d50af9d33fb8". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschrpg", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Thu Jun 11 08:39:26 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok [unix] ++returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschrpg ++[radutmp] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] expand: %{User-Name} -> isschrpg [sql] expand: %{%{User-Name}:-DEFAULT} -> isschrpg [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> isschrpg [sql] sql_set_user escaped user --> 'isschrpg' [sql] expand: %{Acct-Delay-Time} -> [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', ! '%{Calling-Station-Id} [sql] expand: /usr/local/var/log/radius/sqltrace.sql -> /usr/local/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('4a30b4a8/00:13:02:8d:f3:1f/44', 'aeb3d50af9d33fb8', 'isschrpg', '', 'WM07-1', '10.12.80.109', '29', '', '2009-06-11 08:39:26', '0000-00-00 00:00:00', '0', 'RADIUS', '', '', '0', '0', '10.12.80.109', '129.11.1.138', 'VLAN', 'IEEE-802', '3022', '', '', '', '1! 29.11.1.138', '0', '0') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschrpg attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 23 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Proxying request 12 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 23 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:20 BST" Acct-Delay-Time = 6 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 243 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 6 Proxy-State = 0x3231313537 Proxying request 13 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 243 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 6 Proxy-State = 0x3231313537 Going to the next request Waking up in 0.5 seconds. Waking up in 0.4 seconds. Waking up in 0.1 seconds. Waking up in 1.0 seconds. Waking up in 1.1 seconds. Waking up in 0.2 seconds. Waking up in 1.0 seconds. Waking up in 0.9 seconds. Rejecting request 12 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] expand: %t -> Thu Jun 11 08:39:26 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 123 to 10.12.80.109 port 32769 Finished request 12. Cleaning up request 12 ID 123 with timestamp +15 Going to the next request Waking up in 0.2 seconds. Waking up in 0.1 seconds. Rejecting request 13 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 13. Cleaning up request 13 ID 21157 with timestamp +15 Going to the next request Waking up in 0.9 seconds. Waking up in 23.9 seconds. Sending Status-Server of id 131 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 2.0 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:20 BST" Acct-Delay-Time = 42 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 247 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 42 Proxy-State = 0x3431353031 Proxying request 15 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 247 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 42 Proxy-State = 0x3431353031 Going to the next request Waking up in 0.8 seconds. Waking up in 0.1 seconds. Waking up in 0.8 seconds. Waking up in 0.7 seconds. Waking up in 0.7 seconds. Waking up in 1.1 seconds. Waking up in 1.0 seconds. Waking up in 0.4 seconds. Rejecting request 15 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 15. Cleaning up request 15 ID 41501 with timestamp +51 Going to the next request Waking up in 0.6 seconds. Waking up in 15.9 seconds. Sending Status-Server of id 34 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 10.0 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:20 BST" Acct-Delay-Time = 78 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 17. Cleaning up request 17 ID 9120 with timestamp +87 Going to the next request Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:26 BST" Acct-Delay-Time = 73 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 18. Cleaning up request 18 ID 39494 with timestamp +88 Going to the next request Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*

2 1

Re: PPTPD Bandwidth Shaping
by Neville 11 Jun '09

11 Jun '09

Dear Ivan, Appreciate your comment.... Can anyone else point me in the correct direction.. Thx Nev > Message: 1 > Date: Wed, 10 Jun 2009 00:07:22 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: PPTPD Bandwidth Shaping > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <50989.87.194.16.13.1244588842.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > >> Ok, I've got WISPr-Bandwidth-Max-Down in /var/run/radattr.ppp0 but the >> value is all wrong. >> >> I set WISPr-Bandwidth-Max-Down = 512000 (as a reply) >> >> and in /var/run/radattr.ppp0 its show as - WISPr-Bandwidth-Max-Down >> -1062731706 >> >> I just basically copied the dictionary.wispr to >> /usr/share/radiusclient-ng >> as in order to get it loaded in radattr.ppp0 :- >> >> [root@xxx radiusclient-ng]# more dictionary.wispr >> ATTRIBUTE WISPr-Location-ID 1 string >> ATTRIBUTE WISPr-Location-Name 2 string >> ATTRIBUTE WISPr-Logoff-URL 3 string >> ATTRIBUTE WISPr-Redirection-URL 4 string >> ATTRIBUTE WISPr-Bandwidth-Min-Up 5 integer >> ATTRIBUTE WISPr-Bandwidth-Min-Down 6 integer >> ATTRIBUTE WISPr-Bandwidth-Max-Up 7 integer >> ATTRIBUTE WISPr-Bandwidth-Max-Down 8 integer >> #ATTRIBUTE WISPr-Session-Terminate-Time 9 string >> #ATTRIBUTE WISPr-Session-Terminate-End-Of-Day 10 string >> ATTRIBUTE WISPr-Billing-Class-Of-Service 11 string >> >> Any ideas please. > > Try writing to the correct list. Your problem is not with freeradius. > > Ivan Kalik > Kalik Informatika ISP

2 1

DHCP code in 2.0.4+
by Martin Lorentz 11 Jun '09

11 Jun '09

Hello everyone from a long-time user of freeradius, but this is my first post on the list. While playing around with the experimental DHCP code in the latest freeradius releases, I came across a problem where the DHCP packet is not recognized, when the Message-Type is not the first among the list of options. Currently, the code uses a static offset to look for the message type in the packet. A patch is enclosed to fix the problem by iterating through the available options, but will most likely need fixing by someone who knows how to code :-) It applies to 2.0.6 and works in the lab, though. Also, I'm interested to hear about the plans for DHCP in freeradius. Personally, I'm evaluating a solution to assign static IPs based on the Agent-Circuit-Id without being tied to a specific MAC - something ISC dhcpd will not do by design. This is supposed to eventually replace PPPoE connections from CPEs. I guess freeradius could someday be able to handle this since the backend data store is really flexible. While most users will probably use the DHCP code with a leases database, in our scenario the configuration would just hand out a static IP calculated from the values in the Agent-Circuit-ID, probably by making use of scripting. Another suggestion with regards to the server design. Currently, the whole server needs to run as root to bind to port 67. That's not necessary for a RADIUS server binding only to ports above 1024. For the long run, would it be feasible to separate the DHCP server code into its own daemon, as a pure DHCP-to-RADIUS translator? Best regards, Martin Lorentz

10 59