June 2009 - Freeradius-Users - lists.freeradius.org

Robust proxy accounting
by Chris Howley 10 Jun '09

10 Jun '09

Alan, Thank you for your help. I've removed the configuration from the proxy.conf and I'm now using the original robust-proxy-accounting file. However, the problem persists - the detail.work file is being erased. Chris -----Original Message----- From: freeradius-users-bounces+c.p.howley=leeds.ac.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+c.p.howley=leeds.ac.uk@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 10 June 2009 11:00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 50, Issue 56 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Robust proxy accounting (A.L.M.Buxey(a)lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Jun 2009 10:18:04 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Robust proxy accounting To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090610091804.GC7855(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > I used the example configuration and got the same result. ..... > 2. I moved the following from the robust-proxy-accounting file to the proxy.conf file. why? the robust-accounting stuff is a self-contained virtual server. by putting this into proxy.conf you have introduced (or reintroduced) a loop mechanism. I can think of no reason to have moved this configuration from the virtual server...this isnt plain config. the virtual server is a virtual instance. by putting this code into the main proxy.conf it may/will get triggered by other instances. alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 50, Issue 56 ************************************************

2 1

accounting and radutmp problem
by kalesameer 10 Jun '09

10 Jun '09

I want to use mysql only for accounting purposes.I have uncommented the "sql" and "sql_log" entries iin the various modules. While users try to login,entries are being entered into the "radpostauth" table of mysql.However, no entries are being made into the "radacct" table.Can anyone please tell me the reason for this?? Secondly,in order to check the users logged on currently,we must use the "radutmp" file.However,no file of this name exists at "/usr/local/var/log/radius".What may be the reason for this?? And what corrective action must i take for solving these problems?? -- View this message in context: http://www.nabble.com/accounting-and-radutmp-problem-tp23949734p23949734.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

libradius-1.1.7.so
by parlato 10 Jun '09

10 Jun '09

Hi, I'm new here. I installed freeradius 1.1.7 on a debian lenny. ./configure make make install when I tri to start radiusd -x I get the following error : radiusd: error while loading shared libraries: libradius-1.1.7.so: cannot open shared object file: No such file or directory (I dont have to use deb package and I have to use 1.1.7) can someone tell me how to install that library? thanks

3 3

Cannot get TTLS to work with inner protocol of mschap or PAP
by carferna 10 Jun '09

10 Jun '09

Hi, I am having trouble configuring free radius to use TTLS with inner protocol of either mschap or PAP. Currently, I have TTLS working with the default inner protocol of MD-5. But when I change the eap.conf file to use mschap or PAP then I can't even get radiusd -X to start. I see the following error: rlm_eap:ttls:unknown EAP type mschap rlm_eap:Failed to initialize type ttls I would most appreciate if anyone can give me some pointers on this -- View this message in context: http://www.nabble.com/Cannot-get-TTLS-to-work-with-inner-protocol-of-mschap… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Cisco-avpair
by Pallares, Jorge 09 Jun '09

09 Jun '09

Hi all, Anybody knows how to configure freeradius to send access list configuration back to a cisco router applied to Dialer 0. Thanks, Jorge Pallares ________________________________ Email disclaimer: The information contained in or attached to this communication may contain confidential or privileged information and is intended for the addressee only. If you are not the intended recipient of this email communication, you are notified that any use, dissemination, distribution or copying of this message or data is prohibited. If you have received this email in error, please notify the sender by return email and permanently delete the document. Any drawing provided with this communication is provided for general information purposes only. No person receiving or using that drawing should rely on it as a complete or accurate representation of the rail assets referred to in it. All written dimensions take precedence over scaled dimension. The drawing has been prepared by, or compiled from information provided by, persons other than VicTrack. To the maximum extent permissible by law, VicTrack takes no responsibility for, and makes no representations in relation to, the completeness, accuracy or quality of any information contained in the drawing. Each user of the drawing releases VicTrack from all and any loss, damage, cost, expense or liability in relation to the use of, or any reliance on, the drawing or the information contained in it. The drawing is provided only for the information of the person or organisation to whom VicTrack provides it. It may not be provided to, or used by, any other person without VicTrack's prior written consent. The views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of VicTrack. VicTrack does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference.

1 0

my freeradius-2.1.6 is not auth with PIN only
by Goke Aruna 09 Jun '09

09 Jun '09

I will be glad, if anyone can direct me to whare The log below is the part of the debug for the new test freeradius server 2.1.6 am testing with. However, the hotspotlogin,cgi is able to pass the param username to the radius but when the query is run against the database the "Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031" the value of the username sent is changed. I have disabled the chap in the /usr/local/etc/raddb/sites-enabled/default. kindly advise on what to do. ################### my radcheck has the info below. mysql> select * from radcheck; +-----+------------+--------------------+----+------------+ | id | username | attribute | op | value | +-----+------------+--------------------+----+------------+ | 5 | 2345678901 | Auth-Type | := | Accept | | 201 | 1234567890 | Cleartext-Password | := | 1234567890 | +-----+------------+--------------------+----+------------+ 4 rows in set (0.00 sec) ######################radiusd -XX (part of the debug) rad_recv: Access-Request packet from host 127.0.0.1 port 44600, id=0, length=189 ChilliSpot-Max-Input-Octets = 0x32333435363738393031 ChilliSpot-Max-Output-Octets = 0 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-1F-29-80-62-F3" Called-Station-Id = "00-50-DA-0C-C9-B0" NAS-Identifier = "nas01" Acct-Session-Id = "4a2e6a7700000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xf2ee6add34820fb96dcceef08c07bbc5 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Tue Jun 9 14:59:48 2009 : Info: +- entering group authorize {...} Tue Jun 9 14:59:48 2009 : Info: ++[preprocess] returns ok Tue Jun 9 14:59:48 2009 : Info: ++[mschap] returns noop Tue Jun 9 14:59:48 2009 : Info: [suffix] No '@' in User-Name = "2345678901", looking up realm NULL Tue Jun 9 14:59:48 2009 : Info: [suffix] No such realm "NULL" Tue Jun 9 14:59:48 2009 : Info: ++[suffix] returns noop Tue Jun 9 14:59:48 2009 : Info: [eap] No EAP-Message, not doing EAP Tue Jun 9 14:59:48 2009 : Info: ++[eap] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[unix] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[files] returns noop Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Info: [sql] sql_set_user escaped user --> '0x32333435363738393031' Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0x32333435363738393031' ORDER BY id Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0x32333435363738393031' ORDER BY priority Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] User 0x32333435363738393031 not found Tue Jun 9 14:59:48 2009 : Info: ++[sql] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[expiration] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[logintime] returns noop Tue Jun 9 14:59:48 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Jun 9 14:59:48 2009 : Info: ++[pap] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[validity] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[noresetcounter] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[hotspotcontrol] returns noop Tue Jun 9 14:59:48 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jun 9 14:59:48 2009 : Info: Failed to authenticate the user. Tue Jun 9 14:59:48 2009 : Info: Using Post-Auth-Type Reject Tue Jun 9 14:59:48 2009 : Info: +- entering group REJECT {...} Tue Jun 9 14:59:48 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 9 14:59:48 2009 : Info: ++[attr_filter.access_reject] returns updated Tue Jun 9 14:59:48 2009 : Info: Delaying reject of request 0 for 1 seconds Tue Jun 9 14:59:48 2009 : Debug: Going to the next request Tue Jun 9 14:59:48 2009 : Debug: Waking up in 0.9 seconds. Tue Jun 9 14:59:49 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 44600 Tue Jun 9 14:59:49 2009 : Debug: Waking up in 4.9 seconds. Tue Jun 9 14:59:54 2009 : Info: Cleaning up request 0 ID 0 with timestamp +187 Tue Jun 9 14:59:54 2009 : Debug: Ready to process requests.

3 4

Re: PPTPD Bandwidth Shaping
by Neville 09 Jun '09

09 Jun '09

Hi all again, Ok, I've got WISPr-Bandwidth-Max-Down in /var/run/radattr.ppp0 but the value is all wrong. I set WISPr-Bandwidth-Max-Down = 512000 (as a reply) and in /var/run/radattr.ppp0 its show as - WISPr-Bandwidth-Max-Down -1062731706 I just basically copied the dictionary.wispr to /usr/share/radiusclient-ng as in order to get it loaded in radattr.ppp0 :- [root@xxx radiusclient-ng]# more dictionary.wispr ATTRIBUTE WISPr-Location-ID 1 string ATTRIBUTE WISPr-Location-Name 2 string ATTRIBUTE WISPr-Logoff-URL 3 string ATTRIBUTE WISPr-Redirection-URL 4 string ATTRIBUTE WISPr-Bandwidth-Min-Up 5 integer ATTRIBUTE WISPr-Bandwidth-Min-Down 6 integer ATTRIBUTE WISPr-Bandwidth-Max-Up 7 integer ATTRIBUTE WISPr-Bandwidth-Max-Down 8 integer #ATTRIBUTE WISPr-Session-Terminate-Time 9 string #ATTRIBUTE WISPr-Session-Terminate-End-Of-Day 10 string ATTRIBUTE WISPr-Billing-Class-Of-Service 11 string Any ideas please. Thx Nev ----- Original Message ----- From: Neville To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, June 09, 2009 10:45 PM Subject: Re: PPTPD Bandwidth Shaping Hi Chuan, Thx for reply amongst this heated discussion on DHCP.... I've currently got install freeRadius 2.1.6 and Poptop 2.4.4 and I see no dictionary file in /etc/ppp/radius/dictionary. In fact I have no radius directory in /etc/ppp All freeradius dictionary's are located in /usr/share/freeradius.... The question is, how can I pass WISPr-Bandwidth-Max-Down to ip-up.local as I was hoping it would be in in /var/run/radattr.pppX, but all thats in there is:- Framed-IP-Address 192.168.0.70 Session-Timeout 1646690 MS-CHAP2-Success 7S=A8CF4948283C1C4BE11682787ADBD0EA9852E691 MS-MPPE-Recv-Key \220\265J\372\250\336\342nD\226o\272\007\030I\372'\313\267@J\36 1\370\266\212?_\377\262\324\215X\274\357 MS-MPPE-Send-Key \235\342\367\325\243\210\020\217|H\314WkU0\201\352\374\364\023\ 220\220\315z\364\277\254\361\356["Ce\002 MS-MPPE-Encryption-Policy MS-MPPE-Encryption-Types However we can see WISPr-Bandwidth-Max-Down being sucessfully passed to FreeRadius? ++[exec] returns noop Sending Access-Accept of id 198 to 127.0.0.1 port 53025 Framed-IP-Address := 192.168.0.70 WISPr-Bandwidth-Max-Down := 512000 Session-Timeout = 1646690 MS-CHAP2-Success = 0x37533d41384346343934383238334331433442453131363832373837414442443045413938353245363931 MS-MPPE-Recv-Key = 0x0b660d35b65015368d107e57d97e2b55 MS-MPPE-Send-Key = 0xc78164fb4478212fbd0d198389ee2d52 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 198 with timestamp +244 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 38836, id=199, length=98 Acct-Session-Id = "4A2EE3A302FB00" User-Name = "test99" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.0.70 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok I would love to use WISPr as suggested, but cannot find out how to get this to work. Currently I've just defaulted EVERYONE to the same bandwidth restrictions by using the follow script in /etc/ppp/ip-up.local ip-up.local DOWNSPEED=256 UPSPEED=768 /sbin/tc qdisc del dev $1 root > /dev/null /sbin/tc qdisc del dev $1 ingress > /dev/null ##### speed server->client if [ "$UPSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 root handle 1: htb default 20 r2q 1 /sbin/tc class add dev $1 parent 1: classid 1:1 htb rate ${UPSPEED}kbit burst 4k /sbin/tc class add dev $1 parent 1:1 classid 1:10 htb rate ${UPSPEED}kbit burst 4k prio 1 /sbin/tc class add dev $1 parent 1:1 classid 1:20 htb rate ${UPSPEED}kbit burst 4k prio 2 /sbin/tc qdisc add dev $1 parent 1:10 handle 10: sfq perturb 10 quantum 1500 /sbin/tc qdisc add dev $1 parent 1:20 handle 20: sfq perturb 10 quantum 1500 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip tos 0x10 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip protocol 1 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1: protocol ip prio 10 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u160x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:10 fi ##### speed client->server if [ "$DOWNSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 handle ffff: ingress /sbin/tc filter add dev $1 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate ${DOWNSPEED}kbit burst 12k drop flowid :1 fi /sbin/ifconfig $1 mtu 1400

2 1

Lower case
by Michel Bulgado 09 Jun '09

09 Jun '09

Hello everyone I migrated my freeradius version 1.1.3-1.4.el5 that came with CentOS 5.3 to version 2.1.6-2. I am looking for an option that I had in my previous configuration and does not find it on this new, maybe it is removed. the fact is that many of my users sometimes tend to write the username with the first letter in upper or miniscule. If someone could guide me, how i cant fix this. lower_user = after lower_pass = no Thanks Michel

2 1

Re: PPTPD Bandwidth Shaping
by Neville 09 Jun '09

09 Jun '09

Hi Chuan, Thx for reply amongst this heated discussion on DHCP.... I've currently got install freeRadius 2.1.6 and Poptop 2.4.4 and I see no dictionary file in /etc/ppp/radius/dictionary. In fact I have no radius directory in /etc/ppp All freeradius dictionary's are located in /usr/share/freeradius.... The question is, how can I pass WISPr-Bandwidth-Max-Down to ip-up.local as I was hoping it would be in in /var/run/radattr.pppX, but all thats in there is:- Framed-IP-Address 192.168.0.70 Session-Timeout 1646690 MS-CHAP2-Success 7S=A8CF4948283C1C4BE11682787ADBD0EA9852E691 MS-MPPE-Recv-Key \220\265J\372\250\336\342nD\226o\272\007\030I\372'\313\267@J\36 1\370\266\212?_\377\262\324\215X\274\357 MS-MPPE-Send-Key \235\342\367\325\243\210\020\217|H\314WkU0\201\352\374\364\023\ 220\220\315z\364\277\254\361\356["Ce\002 MS-MPPE-Encryption-Policy MS-MPPE-Encryption-Types However we can see WISPr-Bandwidth-Max-Down being sucessfully passed to FreeRadius? ++[exec] returns noop Sending Access-Accept of id 198 to 127.0.0.1 port 53025 Framed-IP-Address := 192.168.0.70 WISPr-Bandwidth-Max-Down := 512000 Session-Timeout = 1646690 MS-CHAP2-Success = 0x37533d41384346343934383238334331433442453131363832373837414442443045413938353245363931 MS-MPPE-Recv-Key = 0x0b660d35b65015368d107e57d97e2b55 MS-MPPE-Send-Key = 0xc78164fb4478212fbd0d198389ee2d52 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 198 with timestamp +244 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 38836, id=199, length=98 Acct-Session-Id = "4A2EE3A302FB00" User-Name = "test99" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.0.70 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok I would love to use WISPr as suggested, but cannot find out how to get this to work. Currently I've just defaulted EVERYONE to the same bandwidth restrictions by using the follow script in /etc/ppp/ip-up.local ip-up.local DOWNSPEED=256 UPSPEED=768 /sbin/tc qdisc del dev $1 root > /dev/null /sbin/tc qdisc del dev $1 ingress > /dev/null ##### speed server->client if [ "$UPSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 root handle 1: htb default 20 r2q 1 /sbin/tc class add dev $1 parent 1: classid 1:1 htb rate ${UPSPEED}kbit burst 4k /sbin/tc class add dev $1 parent 1:1 classid 1:10 htb rate ${UPSPEED}kbit burst 4k prio 1 /sbin/tc class add dev $1 parent 1:1 classid 1:20 htb rate ${UPSPEED}kbit burst 4k prio 2 /sbin/tc qdisc add dev $1 parent 1:10 handle 10: sfq perturb 10 quantum 1500 /sbin/tc qdisc add dev $1 parent 1:20 handle 20: sfq perturb 10 quantum 1500 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip tos 0x10 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1:0 protocol ip prio 10 u32 match ip protocol 1 0xff flowid 1:10 /sbin/tc filter add dev $1 parent 1: protocol ip prio 10 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u160x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:10 fi ##### speed client->server if [ "$DOWNSPEED" != "0" ] ; then /sbin/tc qdisc add dev $1 handle ffff: ingress /sbin/tc filter add dev $1 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate ${DOWNSPEED}kbit burst 12k drop flowid :1 fi /sbin/ifconfig $1 mtu 1400

1 0

Robust proxy accounting
by Chris Howley 09 Jun '09

09 Jun '09

Alan, I hoping you can help me. We're currently testing FR2.1.6 and robust proxy accounting. We have two servers running FR2.1.6. When both servers are operational the relaying of accounting packets works. However, when one of the servers is down the other operational server fails to retain the accounting data. The software deletes the detail.work file and any other detail files stored in the listener's sub-directory. Looking at the debug output the only thing that's different after the last time that the detail.work file is accessed is shown below. A copy of the debug output is available at: http://netgrp-pc052.leeds.ac.uk/radiusd.debug.txt Thanks, Chris Howley >>> Sending proxied request internally to virtual server. server acct_detail.leeds.ac.uk { +- entering group accounting {...} [detail.leeds.ac.uk] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.leeds.ac.uk] returns noop } # server acct_detail.leeds.ac.uk Going to the next request <<< Received proxied response from internal virtual server.

2 1