July 2009 - Freeradius-Users - lists.freeradius.org

pam_radius_auth for big endian
by maxim maxim 07 Jul '09

07 Jul '09

How i can to fix pam_radius_auth for big endian platform? Thanks, Max

2 1

receives 1 request --> proxy 2 requests?
by Torsten Förster 07 Jul '09

07 Jul '09

Hi there, i installed a new server with ubuntu 8.04 lts and freeradius 2.1.0 behind this radius are 2 other radius-server (failover) after configuration i always get an error-message after succesfull login of an user. Error: Received Accounting-Response packet from client x.x.xx port 1813 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response. ...after 30 sec. again this is the debug: rad_recv: Accounting-Request packet from host x.x.x.x port 3989, id=185, length=135 User-Name = \"111111@test\" NAS-Port = 1967 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.x.x.x Class = 0x346d613475 Calling-Station-Id = \"x.x.x.x\" Acct-Status-Type = Start Acct-Session-Id = \"DB900337\" Tunnel-Client-Endpoint:0 = \"x.x.x.x\" Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-IP-Address = 172x.x.x NAS-Port-Type = Virtual +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing \'NAS-Port = 1967,Client-IP-Address = 172.x.x.x,NAS-IP-Address = 172.x.x.x,Acct-Session-Id = \"DB900337\",User-Name = \"111111@test\"\' [acct_unique] Acct-Unique-Session-ID = \"a6246460a4bd5acf\". ++[acct_unique] returns ok [suffix] Looking up realm \"test\" for User-Name = \"111111@test\" [suffix] Found realm \"test\" [suffix] Adding Realm = \"test\" [suffix] Proxying request from user 111111 to realm test [suffix] Preparing to proxy accounting request to realm \"test\" ++[suffix] returns updated [prefix] Request already proxied. Ignoring. ++[prefix] returns ok ++[files] returns noop +- entering group accounting {...} expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.x.x.x/detail-20090707 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.x.x.x/detail-20090707 expand: %t -> Tue Jul 7 13:42:39 2009 ++[detail] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 111111@test ++[radutmp] returns ok expand: %{User-Name} -> 111111@test attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Request of id 252 to 172.y.y.y port 1813 User-Name = \"111111@test\" NAS-Port = 1967 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.x.x.x Class = 0x346d613475 Calling-Station-Id = \"x.x.x.x\" Acct-Status-Type = Start Acct-Session-Id = \"DB900337\" Tunnel-Client-Endpoint:0 = \"x.x.x.x\" Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-IP-Address = 172x.x.x NAS-Port-Type = Virtual Proxy-State = 0x313835 Proxying request 0 to home server 172.y.y.y port 1813 Sending Accounting-Request of id 252 to 172.y.y.y port 1813 User-Name = \"111111@test\" NAS-Port = 1967 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.x.x.x Class = 0x346d613475 Calling-Station-Id = \"x.xx.x\" Acct-Status-Type = Start Acct-Session-Id = \"DB900337\" Tunnel-Client-Endpoint:0 = \"x.x.x.x\" Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-IP-Address = 172.x.x.x NAS-Port-Type = Virtual Proxy-State = 0x313835 Going to the next request Waking up in 0.9 seconds. rad_recv: Accounting-Response packet from host 172.y.y.y port 1813, id=252, length=140 Received Accounting-Response packet from client 172.y.y.y port 1813 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. rad_recv: Accounting-Request packet from host 172.x.x.x port 3989, id=185, length=135 Sending duplicate reply to client XXX port 3989 - ID: 185 Cleaning up request 0 ID 185 with timestamp +6 Ready to process requests. Is the second Accounting-Request the normal way? for me it looks like a repeat of the request. thanks! #adBox3 {display:none;}

2 1

Building FreeRADIUS2 on Solaris10
by Steven Carr 07 Jul '09

07 Jul '09

Are there any instructions for building FreeRADIUS2 on Solaris10? (or any prebuilt packages anywhere?) I must comment the state of FreeRADIUS documentation is atrocious, it has taken me days to get our RADIUS implementation up and running due to the amount of outdated or lack of documentation (instead of what could have been hours). The wiki mayaswell not exist as 90% of it is relating to v1 of FreeRADIUS which is no longer maintained, and the configuration of v2 is completely different. Regards Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953

2 3

PEAP and Huntgroup-Name
by Nicolas Boullis 07 Jul '09

07 Jul '09

Hello, I'm using Freeradius 2.0.4 from the package in Debian Lenny for WPA (for wifi) and 802.1x (for wired ethernet) authentication and authorization. They use PEAP/MSchapv2 for authentication. Most users are in LDAP and are allowed to connect either to wired ethernet or to wifi. But I also have to deal with some "guest" users, whose usernames all begin with the "guest/" prefix, who are in a SQL database, and who only should be allowed to connect to wifi. Currently, the relevant part of my users file is: | DEFAULT Huntgroup-Name == ap, Prefix == "guest/", Autz-Type := GUEST | Fall-Through = No | | DEFAULT Autz-Type := DEFAULT The trouble is the inner request has no NAS-IP-Address, so the Huntgroup-Name is not set and does not match. Running freeradius -X shows that the Huntgroup-Name condition is correctly verified for the outer request, but not for the inner one. And if I remove the Huntgroup-Name condition, everything works fine, but the guest users are allowed to connect to wired ethernet. Is there a way I can test the outer Huntgroup-Name in my users file? Regards, -- Nicolas Boullis Ecole Centrale Paris

2 2

Cisco ignores Framed-IP-Address from freeradius
by Gilloteau Frederic 07 Jul '09

07 Jul '09

Hello, I use freeradius 2.1.1-7 and a CISCO router (IOS 12.4(6)T9) to provide VPN connections. I would like my CISCO router to assign static IP address to remote VPN users thanks to the Freeradius server. My freeradius server is configured to give static ip address to users. I can check it with radtest : [root@host ~]# radtest toto(a)domain.com mypassword 127.0.0.1 0 testing123 Sending Access-Request of id 152 to 127.0.0.1 port 1812 User-Name = "toto(a)domain.com" User-Password = "mypassword" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=152, length=69 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 15.1.1.99 Framed-IP-Netmask = 255.255.255.0 and the CISCO router gets it ... Log Buffer (32768 bytes): Jul 3 17:50:35.368: RADIUS/ENCODE(00000058):Orig. component type = VPN_IPSEC Jul 3 17:50:35.368: RADIUS: AAA Unsupported Attr: interface [158] 13 Jul 3 17:50:35.368: RADIUS: 32 31 33 2E 34 31 2E 31 33 33 2E Jul 3 17:50:35.368: RADIUS/ENCODE(00000058): dropping service type, "radius-ser ver attribute 6 on-for-login-auth" is off Jul 3 17:50:35.368: RADIUS(00000058): Config NAS IP: 0.0.0.0 Jul 3 17:50:35.368: RADIUS/ENCODE(00000058): acct_session_id: 72 Jul 3 17:50:35.368: RADIUS(00000058): sending Jul 3 17:50:35.368: RADIUS/ENCODE: Best Local IP-Address X.X.X.X for Radius -Server Y.Y.Y.Y Jul 3 17:50:35.368: RADIUS(00000058): Send Access-Request to Y.Y.Y.Y:1812 i d 1645/50, len 112 Jul 3 17:50:35.368: RADIUS: authenticator 73 C3 A8 1F E5 ED BA C6 - B0 39 12 7 4 33 3C 80 A7 Jul 3 17:50:35.372: RADIUS: User-Name [1] 25 "toto(a)domain.com" Jul 3 17:50:35.372: RADIUS: User-Password [2] 18 * Jul 3 17:50:35.372: RADIUS: Calling-Station-Id [31] 16 "A.B.C.D" Jul 3 17:50:35.372: RADIUS: NAS-Port-Type [61] 6 Virtual [5] Jul 3 17:50:35.372: RADIUS: NAS-Port [5] 6 3 Jul 3 17:50:35.372: RADIUS: NAS-Port-Id [87] 15 "E.F.G.H" Jul 3 17:50:35.372: RADIUS: NAS-IP-Address [4] 6 X.X.X.X Jul 3 17:50:35.440: RADIUS: Received from id 1645/50 Y.Y.Y.Y:1812, Access-A ccept, len 44 Jul 3 17:50:35.444: RADIUS: authenticator 86 A5 0A EA BE DF 30 E0 - 11 E3 24 5 4 9B 2C C6 77 Jul 3 17:50:35.444: RADIUS: Service-Type [6] 6 Framed [2] Jul 3 17:50:35.444: RADIUS: Framed-Protocol [7] 6 PPP [1] Jul 3 17:50:35.444: RADIUS: Framed-IP-Address [8] 6 15.1.1.99 Jul 3 17:50:35.444: RADIUS: Framed-IP-Netmask [9] 6 255.255.255.0 Jul 3 17:50:35.444: RADIUS(00000058): Received from id 1645/50 Jul 3 17:50:35.444: RADIUS: Constructed " ppp negotiate" Jul 3 17:50:37.852: RADIUS/ENCODE(00000058):Orig.. component type = VPN_IPSEC Jul 3 17:50:37.852: RADIUS(00000058): Config NAS IP: 0.0.0.0 Jul 3 17:50:37.852: RADIUS(00000058): sending Jul 3 17:50:37.852: RADIUS/ENCODE: Best Local IP-Address X.X.X.X for Radius -Server Y.Y.Y.Y Jul 3 17:50:37.852: RADIUS(00000058): Send Accounting-Request to Y.Y.Y.Y:18 13 id 1646/33, len 112 Jul 3 17:50:37.852: RADIUS: authenticator AE 34 03 31 02 D0 C3 19 - 16 B0 6F D D 1E 26 FE 66 Jul 3 17:50:37.852: RADIUS: Acct-Session-Id [44] 10 "00000048" Jul 3 17:50:37.852: RADIUS: Framed-IP-Address [8] 6 15.1.1.18 Jul 3 17:50:37.852: RADIUS: User-Name [1] 25 "toto(a)domain.com" Jul 3 17:50:37.852: RADIUS: Acct-Authentic [45] 6 RADIUS [1] Jul 3 17:50:37.852: RADIUS: Acct-Status-Type [40] 6 Start [1] Jul 3 17:50:37.852: RADIUS: NAS-Port-Type [61] 6 Virtual [5] Jul 3 17:50:37.852: RADIUS: NAS-Port [5] 6 3 Jul 3 17:50:37.852: RADIUS: NAS-Port-Id [87] 15 "E.F.G.H" Jul 3 17:50:37.852: RADIUS: NAS-IP-Address [4] 6 X.X.X.X Jul 3 17:50:37.852: RADIUS: Acct-Delay-Time [41] 6 0 Jul 3 17:50:37.856: RADIUS: Received from id 1646/33 Y.Y.Y.Y:1813, Accounti ng-response, len 20 Jul 3 17:50:37.856: RADIUS: authenticator B8 26 8E 14 AE AB AF AA - 67 C3 3C 1 F 62 4D 70 5B .. but never assign it to remote users, the cisco router assigns an IP address from its local pool. The interesting lines of my cisco configuration are : aaa new-model ! ! aaa authentication login ClientAuth group radius aaa authorization network ClienAuth group radius local aaa accounting delay-start aaa accounting network ClientAuth start-stop group radius crypto isakmp client configuration address-pool local vpnpool crypto map rasvpn client authentication list ClientAuth crypto map rasvpn client accounting list ClientAuth crypto map rasvpn isakmp authorization list ClientAuth crypto map rasvpn client configuration address respond crypto map rasvpn 10 ipsec-isakmp dynamic dynmap I also tried with the cisco av-pair attribute with no luck ... Does anybody know what the problem could be ? Thanks! Fred

4 3

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 06 Jul '09

06 Jul '09

Estaré ausente de la oficina desde el 06/07/2009 y no volveré hasta el 22/07/2009. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) o Juan Orea Hernandez (juan.oreahernandez(a)telefonica.es) ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

Syslog and FreeRADIUS
by Jonathan Gazeley 06 Jul '09

06 Jul '09

Hi all, I've decided to move logging on my radius boxes to a pair of syslog servers, rather than stored locally. I'm using rsyslog to send the logs over the network. I follow this guide http://wiki.freeradius.org/Syslog_HOWTO but it seems to be for an old version of FreeRADIUS. I have managed to get FreeRADIUS to send syslog packets to my syslog hosts; however I can't tell how to specifically split out the FreeRADIUS syslog packets. The wiki page suggests local1.* but this isn't matching the right packets. I'm running FreeRADIUS 2.1.6 so if anyone has a snippet of their rsyslog.conf or can simply say how to match the radius syslog packets, I'd be very grateful. Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless& VPN Team Information Services University of Bristol ----------------------------

4 10

Re: set absolute lifetimes
by Sebastian Wieseler 06 Jul '09

06 Jul '09

> Use Expiration attribute. And where? radcheck? What should I check? If Expiration is... what is CurrentTime as Value in SQL? So.. radreply? Expiration to reply is senseless nevertheless because.. does the client handle this attribute? Dunno? And how? Reply, that Expiration should be (Jun 29 2009)? And then the client should disconnects automatically? So what should I do with your three words...... Regards, Sebastian Wieseler

2 1

unable to run radtest
by ramesh p 06 Jul '09

06 Jul '09

root@parsa-laptop:/etc/freeradius# freeradius -X FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Apr 30 2009 at 07:22:56 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel group = radius freeradius: Cannot get ID for group radius: Success root@parsa-laptop:/etc/freeradius# vi radiusd.conf root@parsa-laptop:/etc/freeradius# freeradius -X FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Apr 30 2009 at 07:22:56 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "password" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ---------------------------------------------------- I tried to run the following: root@parsa-laptop:/etc/freeradius# radtest sqltest testpwd localhost 1812 testing123 radclient: socket: cannot initialize udpfromto: Function not implemented. PLz. help. Thanks, Rams.

2 2

Re: Acct Input and Output gigaword
by Eric 06 Jul '09

06 Jul '09

There is a freeradius server for aaa of VPN (poptop) users. I want to limit users traffic volume.When users are online I want to use acct update packets to know when they reach to their volume limitation.It seems PPP radius plugin cann't support gigaword. If the time duration of acct interim packets is little, the traffic volume doesn't reach to 4G in updates. Can I use this way? Is there another way to do this aim? What is the usual way? >I think youre misunderstang.... >Input/Output octets is a 32 bit number. >Therefore it's maximum is 4294967295 bytes. >That is 4.2GB. > >The moment The client uses 4.29G the number will wrap to 0 again. >If the client used 0.1G the NAS will tell freeradius 0.1G. >If the client used 4.39G the NAS will tell freeradius 0.1G. >How must free freeradius know it's 4.39G if it gets told 0.1G? >It cannot know this. >The NAS must tell it! (using gigawords).

3 3