August 2009 - Freeradius-Users - lists.freeradius.org

redback nas
by Alexandre Chapellon 20 Aug '09

20 Aug '09

Hello, This is not really an freeradius related question... sorry about that. Does anyone know about attributes supported by redback devices that would allow disconnection of sessions based on the amount of traffic transfered during the session and which could be set to higher than 4Gb? thanks to any redback guru! :)

1 0

Re: How to control users traffic ?
by Neville 20 Aug '09

20 Aug '09

> Message: 2 > Date: Tue, 14 Jul 2009 08:32:18 +0430 > From: Eric <bbahar3(a)gmail.com> > Subject: Re: How to control users traffic ? > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <38a27c8c0907132102w4d55ebfcmea079116add7b370(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > freeradius-1.1.3-1.4 !! > Is it the reason of problem ? > > >> I set reply-name = Session-Octets-Limit in sqlcounter >> but freeradius sends Seesion-Timeout in reply with value equal to the >> deduct of octets used until now from check-name = Max-Input-Octets. >> How should change the session-timeout to Session-Octets-Limit in >> auth-reply? > > That shouldn't happen. What freeradius version? Post the debug from server > startup and request processiong. > > Ivan Kalik > Kalik Informatika ISP Hi Ivan, I have this working, other that I cannot set a Session-Octets-Limit higher that 4Gb. Is there anyway to get around this as I'm allocating 5GB of Usage Per Month? Max-Traffic-Monthly := 4294970000 (4Gb) [monthlytraffic] expand: %{sql:SELECT (sum(acctinputoctets)+sum(acctoutputoctets)) FROM radacct WHERE username='test1000' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW())} -> 0 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user test1000, check_item=4294967295, counter=0 rlm_sqlcounter: Sent Reply-Item for user test1000, Type=Session-Octets-Limit, value=1029889 ++[monthlytraffic] returns ok Sending Access-Accept of id 144 to 193.33.186.190 port 46294 Idle-Timeout := 1800 Framed-MTU = 1488 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 Session-Timeout = 3600 Session-Octets-Limit = 1029889 Session-Octets-Limited is set to 1Mb instead of 4Gb Framed-IP-Address = 192.168.0.22 Max-Traffic-Monthly := 4200000000 (3.9Gb) [monthlytraffic] expand: %{sql:SELECT (sum(acctinputoctets)+sum(acctoutputoctets)) FROM radacct WHERE username='test1000' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW())} -> 0 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user test1000, check_item=4200000000, counter=0 rlm_sqlcounter: Sent Reply-Item for user test1000, Type=Session-Octets-Limit, value=4201030340 ++[monthlytraffic] returns ok Sending Access-Accept of id 98 to 193.33.186.190 port 34040 Idle-Timeout := 1800 Framed-MTU = 1488 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 Session-Timeout = 3600 Session-Octets-Limit = 4201030340 Framed-IP-Address = 192.168.0.23 Thx Nev > Message: 2 > Date: Tue, 14 Jul 2009 08:32:18 +0430 > From: Eric <bbahar3(a)gmail.com> > Subject: Re: How to control users traffic ? > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <38a27c8c0907132102w4d55ebfcmea079116add7b370(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > freeradius-1.1.3-1.4 !! > Is it the reason of problem ? > > >> I set reply-name = Session-Octets-Limit in sqlcounter >> but freeradius sends Seesion-Timeout in reply with value equal to the >> deduct of octets used until now from check-name = Max-Input-Octets. >> How should change the session-timeout to Session-Octets-Limit in >> auth-reply? > > That shouldn't happen. What freeradius version? Post the debug from server > startup and request processiong. > > Ivan Kalik > Kalik Informatika ISP >

1 0

Re: MAX-Monthly-Traffic V2 Post
by Neville 20 Aug '09

20 Aug '09

Hi Alex, > You are expecting an interim update to send session-timeout to your nas > so it disconnect your user? > If so, two things seems incorrect to me. > > 1- You're measuring traffic volume and want disconnection to set > based on time (session-timout)... a bit tricky isn't it? So VERY True, Too many late nights and I really do appreciate your input as this gave me food for thought and I now have EVERYTHING Working. Both for Traffic & Session USAGE. For Usage, I still had to use Max-Monthly-Traffic as a Check := and based on sqlcounter calc, do a Reply = Sessions-Octets-Limit = XXXXXX on the Access-Accept as this is supported by the ppp 2.4.4 NAS. What I would like to know now, is how I can use sqlcounter to do a Month Calculation based on the date of the account being registered and NOT the Calander Month? Anyone? > 2- I think the attribute "Session-Timeout" cannot be found in > interim-updates packets (maybe I'm wrong), rfc 2869 specify that: "It > is envisioned that an Interim Accounting record (with Acct-Status-Type = > Interim-Update (3)) would contain all of the attributes normally found > in an Accounting Stop message with the exception of the > Acct-Term-Cause attribute." > > What you would need is an attribute known by your nas and representing > remaining traffic. That attrbute should be sent at acct-start time and > would trigger a disconnection from the NAS when traffic limit is > reached. If such a attribute does not exists for your NAS, you should > take a look at CoA server. > Maybe someone have better idea...? > > Le mercredi 19 ao?t 2009 ? 15:56 +0100, Neville a ?crit : > Cheers Nev ================ CentOS 5.3 pptpd 1.3.4 / ppp 2.4.4 freeradius2 2.1.6 radiusclient-ng 0.5.6 daloRadius 0.9-8-SVN ================

1 0

Freeradius authentication
by Rundzio, Remi 19 Aug '09

19 Aug '09

I am presented with a scenario where I need to run freeradius with no authentication (the system connecting to me is not sending credentials, just blindly sends data). Is it possible? When running the debug version of freeradius it does not require authentication for incoming streams but it seems to timeout at random times and shut down and a release version does not accept data without the sender authenticating. Thanks

2 1

segfault with regex and hint
by Alexander Clouter 19 Aug '09

19 Aug '09

Hi, It's that time of year to overhaul the cesspool that makes up my FreeRADIUS config files. I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :) Any more information needed, then let me know. Cheers [1] at commit 08baab6769fea367bda5dd006b659621bb9aac18 from yesterday-ish [2] strlcpy sourced from address 0x0 [3] User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i" ---- DEFAULT NAS-Port-Type == "Ethernet", User-Name == "%{User-Password}", Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i", User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i" Hint = mac-auth ---- ---- server dot1x { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes with_alvarion_vsa_hack = no } Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f943272eae0 (LWP 3894)] strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50 50 if ((*d++ = *s++) == 0) (gdb) where #0 strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50 #1 0x00007f9432315164 in pairmake (attribute=<value optimized out>, value=0x0, operator=17) at valuepair.c:1549 #2 0x00007f9432315a39 in pairread (ptr=0x7fff3a7352a8, eol=0x7fff3a7352b4) at valuepair.c:1703 #3 0x00007f9432315b7f in userparse (buffer=<value optimized out>, first_pair=0x7fff3a739470) at valuepair.c:1804 #4 0x000000000040ec5c in pairlist_read (file=0x1352140 "/etc/freeradius/hints", list=0x13522b8, complain=<value optimized out>) at files.c:192 #5 0x00007f942dd21aeb in preprocess_instantiate (conf=0x1217110, instance=0x1352108) at rlm_preprocess.c:497 #6 0x0000000000413bc1 in find_module_instance (modules=<value optimized out>, instname=0x121e0c0 "preprocess", do_link=20259360) at modules.c:506 #7 0x0000000000414fee in do_compile_modsingle (parent=0x0, component=1, ci=0x121e080, grouptype=0, modname=0x7fff3a739b38) at modcall.c:1872 #8 0x0000000000412db3 in load_component_section (cs=0x121df00, components=0x1351ea0, comp=1) at modules.c:794 #9 0x0000000000413368 in load_byserver (cs=0x121d6d0) at modules.c:993 #10 0x0000000000413697 in virtual_servers_load (config=0x1203030) at modules.c:1121 #11 0x0000000000414058 in setup_modules (reload=<value optimized out>, config=0x1203030) at modules.c:1368 #12 0x000000000041245a in read_mainconfig (reload=<value optimized out>) at mainconfig.c:904 #13 0x0000000000416d1a in main (argc=2, argv=0x7fff3a73a418) at radiusd.c:257 (gdb) ---- -- Alexander Clouter .sigmonster says: Keep it short for pithy sake.

5 9

Re: Re: accounting through detail module help
by ramesh p 19 Aug '09

19 Aug '09

> Thanks Alan. > > But we have two accounting sections in default and buffered-sql. > Do i need to enable sql module only in buffered-sql? And place buffered-sql > in defualt 'accounting' section. am Confused... > > Thanks, > Rams. > > > > >> >> ------------------------------ >> >> Message: 2 >> Date: Tue, 18 Aug 2009 23:29:47 +0100 >> From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> >> Subject: Re: accounting through detail module help >> To: FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >> Message-ID: <20090818222947.GD32575(a)lboro.ac.uk> >> Content-Type: text/plain; charset=us-ascii >> >> Hi, >> > Thanks Alan. >> > I enabled detail module in accounting. details files were created under >> > radacct clients directories. >> > Just wanted to check if any module already available in freeradius to >> scan >> > these detail files, parse and put attributes in mysql db every 2-3 mins? >> >> >> sites-available/buffered-sql ? >> >> just ensure that the sql stuff is configured correctly...link/copy it into >> sites-enabled and restart the daemon >> >> alan >> >> >> ------------------------------ >> >

2 3

How could I assing an IP a client.
by Rokkhan 19 Aug '09

19 Aug '09

Hello, I want to know if it is possible assign IP to clients with the freeradius. I have tried to do this with a Sql user and setting Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 values in radreply but i doesnt work. The client always take the IP from a DHCP server. I using freeradius 2.1.6 and validating wifi users with PEAP. The user validation works correctly. Thanks in advance.

2 1

Unlang Question/Problem
by Garber, Neal 19 Aug '09

19 Aug '09

I haven't had much sleep the past few days and just wanted another set of eyes on an issue I'm having. Also, I won't be able to do more testing until tomorrow (user/equip. unavailable) and wanted to try to fix it before then. I'm running FR 2.1.6 with patches to rlm_mschap & rlm_eap_mschapv2 to correct a problem with case-sensitive userids. Anyway, the patch was working great for user auth. and failing for machine auth. I used some unlang to get around the issue. I haven't done a lot with unlang (and yes I read the man page), so I may be missing something simple. I'm doing 802.1x authentication from Windows supplicant with PEAP/MS-CHAPv2. Here's the authenticate section of my inner-tunnel server: authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { if (User-Name =~ /host\/(.*)\.energyeast\.net/i) { update request { Ntlm-Auth-Username = "%{1}$" } updated } else { update request { Ntlm-Auth-Username = "%{User-Name}" } updated } mschap-inner } Auth-Type LDAP { ldap } eap-internal eap-comodo } First, if I didn't include "updated" after the "update request" actions, then it would return reject. Is that normal (I didn't call a module in there)? Should the unlang be outside of the "Auth-Type MS-CHAP" block? Also, Ntlm-Auth-Username is expanded, there's a "[request] returns reject". I think this is the source of the problem, but I don't understand where the reject is coming from. The mschap module that follows returns OK, but the subsequent eap-comodo module returns reject with no explanation in the debug. Do I need something like: eap-comodo { ok = return } Here's the relevant debug output: Tue Aug 18 15:41:15 2009 : Info: Found Auth-Type = eap-comodo Tue Aug 18 15:41:15 2009 : Info: +- entering group authenticate {...} Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] Request found, released from the list Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] EAP/mschapv2 Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] processing type mschapv2 Tue Aug 18 15:41:15 2009 : Info: [mschapv2] +- entering group MS-CHAP {...} Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ++? if (User-Name =~ /host\/(.*)\.energyeast\.net/i) Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ? Evaluating (User-Name =~ /host\/(.*)\.energyeast\.net/i) -> TRUE Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ++? if (User-Name =~ /host\/(.*)\.energyeast\.net/i) -> TRUE Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ++- entering if (User-Name =~ /host\/(.*)\.energyeast\.net/i) {...} Tue Aug 18 15:41:15 2009 : Info: [mschapv2] expand: %{1}$ -> US62695C$ Tue Aug 18 15:41:15 2009 : Info: [mschapv2] +++[request] returns reject Tue Aug 18 15:41:15 2009 : Info: +++[updated] returns updated Tue Aug 18 15:41:15 2009 : Info: ++- if (User-Name =~ /host\/(.*)\.energyeast\.net/i) returns updated Tue Aug 18 15:41:15 2009 : Info: ++ ... skipping else for request 124: Preceding "if" was taken Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] No Cleartext-Password configured. Cannot create LM-Password. Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] No Cleartext-Password configured. Cannot create NT-Password. Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] Using MS-CHAP Response Name (host/US62695C.energyeast.net) to construct MS-CHAPv1 challenge Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] rlm_mschap: mschap_authenticate: Creating challenge hash with username: host/US62695C.energyeast.net Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] Told to do MS-CHAPv2 for host/US62695C.energyeast.net with NT-Password Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] No trailing :- after variable at %{Ntlm-Auth-UserName:-None}} Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] expand: --username=%{%{Ntlm-Auth-UserName:-None}} -> --username=US62695C$ Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] mschap2: d1 Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] Using MS-CHAP Response Name (host/US62695C.energyeast.net) to construct MS-CHAPv1 challenge Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] rlm_mschap: mschap_xlat: Creating challenge hash with username: host/US62695C.energyeast.net Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=943b358133b5bcac Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=121180cc778e59746acb8c12aa6bb9ab7ab2099604c750eb Tue Aug 18 15:41:15 2009 : Debug: Exec-Program output: NT_KEY: 8E774D7FDDFC8300DF50499B30DA1CAF Tue Aug 18 15:41:15 2009 : Debug: Exec-Program-Wait: plaintext: NT_KEY: 8E774D7FDDFC8300DF50499B30DA1CAF Tue Aug 18 15:41:15 2009 : Debug: Exec-Program: returned: 0 Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] adding MS-CHAPv2 MPPE keys Tue Aug 18 15:41:15 2009 : Info: ++[mschap-inner] returns ok Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] Freeing handler Tue Aug 18 15:41:15 2009 : Info: ++[eap-comodo] returns reject Tue Aug 18 15:41:15 2009 : Info: Failed to authenticate the user. Tue Aug 18 15:41:15 2009 : Auth: Login incorrect: [host/US62695C.energyeast.net] (from client eedmz02app08 port 2648774147 cli 00009de11603 via TLS tunnel) } # server inner-tunnel Thank you for your time and assistance..

2 1

Re: Freeradius-Users Digest, Vol 52, Issue 87
by ramesh p 19 Aug '09

19 Aug '09

Thanks Alan. But we have two accounting sections in default and buffered-sql. Do i need to enable sql module only in buffered-sql? And place buffered-sql in defualt 'accounting' section. am Confused... Thanks, Rams. > > ------------------------------ > > Message: 2 > Date: Tue, 18 Aug 2009 23:29:47 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: accounting through detail module help > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090818222947.GD32575(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > Thanks Alan. > > I enabled detail module in accounting. details files were created under > > radacct clients directories. > > Just wanted to check if any module already available in freeradius to > scan > > these detail files, parse and put attributes in mysql db every 2-3 mins? > > > sites-available/buffered-sql ? > > just ensure that the sql stuff is configured correctly...link/copy it into > sites-enabled and restart the daemon > > alan > > > ------------------------------ >

1 0

RADIUS-LDAPv3.schema not found
by RANDRIAMAMPIONONA José Johnny 19 Aug '09

19 Aug '09

Hi All, I downloaded and installed freeradius-server-2.1.6 but I can-t find the radius schema to copy it in ldap directory. Help! Best regards! -- JJohnny R. Beginner vasiana09(a)gmail.com

2 2