September 2009 - Freeradius-Users - lists.freeradius.org

rlm_acct_unique Issue
by Tim O'Donovan 07 Sep '09

07 Sep '09

Hi, We're using FreeRADIUS 2.1.6, and have rlm_acct_unique configured as per the below: acct_unique { key = "User-Name, Framed-IP-Address, Acct-Session-Id" } Over the past couple of days we've noticed that the unique session ID calculated by the module during interim updates is changing mid session for some users, although none of the attributes defined in the configuration are changing between requests. Here's an example for a session that had started on 2009-09-06 at 00:31:28: Mon Sep 7 05:00:23 2009 Acct-Session-Id = "01BCBC45" Framed-Protocol = PPP Framed-IP-Address = xxx.xxx.xxx.xxx User-Name = "user@realm" Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=7349000" Cisco-AVPair = "nas-rx-speed=1000" Acct-Session-Time = 102534 Acct-Input-Octets = 5792373 Acct-Output-Octets = 8666851 Acct-Input-Packets = 79786 Acct-Output-Packets = 54731 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual Cisco-NAS-Port = "Uniq-Sess-ID40" NAS-Port = 40 Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx Acct-Delay-Time = 45 Acct-Unique-Session-Id = "3c17c916d8e9ff20" Timestamp = 1252296023 Request-Authenticator = Verified Mon Sep 7 05:28:24 2009 Acct-Session-Id = "01BCBC45" Framed-Protocol = PPP Framed-IP-Address = xxx.xxx.xxx.xxx User-Name = "user@realm" Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=7349000" Cisco-AVPair = "nas-rx-speed=1000" Acct-Session-Time = 104260 Acct-Input-Octets = 5895021 Acct-Output-Octets = 8838223 Acct-Input-Packets = 81164 Acct-Output-Packets = 55643 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual Cisco-NAS-Port = "Uniq-Sess-ID40" NAS-Port = 40 Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx Acct-Delay-Time = 0 Acct-Unique-Session-Id = "fb0d91180bc7523e" Timestamp = 1252297704 Request-Authenticator = Verified I've hidden the Framed-IP-Address and User-Name attributes, but they were identical in both requests. Prior to 05:28:2 today, the unique session ID was always returned as 3c17c916d8e9ff20, and since 05:28:24, it has been returned as fb0d91180bc7523e. The only common factor with the sessions where this has happened is the Acct-Delay-Time attribute being set to 45 in the last logged request before the ID had changed, but I can't see any evidence on the server of a delay, or any issues that may have caused a delay, around this time. Does anyone know what might be causing this? Thanks, Tim

2 2

Using multiple certificates
by Dean, Barry 07 Sep '09

07 Sep '09

I have been asked it it possible to run two SSIDs on our wireless, lets call them A and B that authorise against a FreeRADIUS server running as two virtual servers radiusA and radiusB. What we want is to have radiusA use a different server certificate from radiusB. However, as I see it, this looks impossible as the EAP configuration is global in eap.conf and not per server instance. Is this true or am I not being creative enough! Can you place the eap definition inside the site files in sites- availble and make it different per server instance is the question I guess. Any help would be appreciated. A quick google reveals a similar question in 2007 which got no answers :-( ---------------------- Barry Dean Networks Group University of Liverpool --- Nice boy, but about as sharp as a sack of wet mice. -- Foghorn Leghorn

2 1

What problem does the FreeRADIUS wiki have?
by Arran Cudbard-Bell 07 Sep '09

07 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As per title. - -Arran - -- Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk>, Systems Administrator (AAA), Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkqlOikACgkQcaklux5oVKIRFQCdGqivLhNy//pWHpvssxSdrHUz X+IAniTNY3WhpKjAF8m+50IEWTqeZvJ5 =JNcr -----END PGP SIGNATURE-----

1 1

intel Proset/wireless -> OK // windows zero config wireless -> KO
by Jaulin Bernard 07 Sep '09

07 Sep '09

Hi all, After many weeks with no results, It's time to find help ! Debian : 5.0 Freeradius : 3.0.4 (with openssl) Samba : 3.2.5 AD : Windows 2008 PEAP & MSCHAPV2 CISCO AP Here is the problem. We use MSCHAP V2 with PEAP for Windows and Linux Client, the problem is so strange. On HP laptops with Intel Proset wireless or IBM Thinpad with Thinkvantage tools the connection was successful. The same laptop with Windows zero config wireless client or Linux (Fedora, Debian) impossible ! No error on log debug, just an authentication silently failed. Yes certificates have Windows OID client/server (xpestensions) Any ideas ? Thanks in advance for your answers... Bernard. PS : No, I don't want to use MS Radius !! ____________________ Bernard Jaulin - ilem S.A. Administration systèmes * +41 (0)79 593 22 46 Route de la Galaise, 32 1228 Plan-Les-Ouates http://www.ilem.ch/

3 2

Freeradius Mysql problem
by Asin Silva 07 Sep '09

07 Sep '09

Hi All, I'm using mysql server 5.1.30 for storing radius accounting details. The system works fine and accounting is done to log file and to mysql server installed in a separate machine. But the problem arises when the mysql server is not working. When the radius accounting server lost the connectivity to the mysql server it does not report any kind of error. The radius daemon is working fine in the radius accounting server. But it does not respond to any requests. Is there any way for me to recognize whether the mysql server is offline from the radius server? Thanks Asin New Email addresses available on Yahoo! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/aa/

2 1

Re: Wimax AAA Session ID
by Victor Tangendjaja 07 Sep '09

07 Sep '09

How do you generate this unique session id? It appears the NAS is expecting the AAA to provide this session id. Then the NAS will keep track of this session id. Thanks, Victor > > > ------------------------------ > > Message: 4 > Date: Fri, 4 Sep 2009 10:01:45 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: Wimax AAA Session ID > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <42574.194.176.105.43.1252054905.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > > >> Is there a way to generate WiMAX-AAA-Session-Id inside freeRADIUS? >> > > Generate - yes. But that's a bit of a pointless exercise. How would you > track the session if id is not provided by NAS? > > Ivan Kalik > Kalik Informatika ISP > > >

2 1

radius configuration suggestions
by ramesh p 06 Sep '09

06 Sep '09

Hi all, I have configured LNS routers to send packets to Radius servers primary and secondary. Both sharing packets and sending to single mysql cluster. when one radius server packets are writing/updating other server packets are locked and waiting for mysql. This i observed using show full processlist. We are using default storage engine MyISAM. And the writes are through network i mean sql in different server instead of radius server. Radius process also crashing due mysql db handles not available, no socket to handle requests. We are logging only accounting packets in to db. And only stop queries sent to radius server. stop queries in dialup.conf are given below: accounting_stop_query = "UPDATE ${acct_table2} SET acctstoptime = DATE_SUB('%S', INTERVAL ( %{%{Acct-Delay-Time}:-0}) SECOND), acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', AcctStatusType = '%{Acct-Status-Type}', TunnelAssignmentId = '%{Tunnel-Assignment-Id}', TunnelClientEndpoint = '%{Tunnel-Client-Endpoint}',AcctTunnelConnection = '%{Acct-Tunnel-Connection}', TunnelType = '%{Tunnel-Type}', AcctInputPackets = '%{Acct-Input-Packets}',AcctOutputPackets = '%{Acct-Output-Packets}', TunnelServerEndpoint = '%{Tunnel-Server-Endpoint}', DiscCauseExt = '%{disc-cause-ext}',PPPDisconnectCause = '%{ppp-disconnect-cause}', NASPortType = '%{NAS-Port-Type}',acctstopdelay = '%{%{Acct-Delay-Time}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT INTO ${acct_table2} (acctsessionid, acctuniqueid, username, nasipaddress, nasporttype, acctstoptime, acctsessiontime, acctauthentic, acctinputoctets, acctoutputoctets, acctterminatecause, framedprotocol,TunnelAssignmentId,TunnelClientEndpoint, AcctTunnelConnection, TunnelType, AcctInputPackets, AcctOutputPackets, TunnelServerEndpoint, AcctStatusType, DiscCauseExt, PPPDisconnectCause,acctstopdelay ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{NAS-IP-Address}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL ( %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}','%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Acct-Terminate-Cause}', '%{Framed-Protocol}','%{Tunnel-Assignment-Id}', '%{Tunnel-Client-Endpoint}','%{Acct-Tunnel-Connection}','%{Tunnel-Type}','%{Acct-Input-Packets}', '%{Acct-Output-Packets}', '%{Tunnel-Server-Endpoint}', '%{Acct-Status-Type}', '%{disc-cause-ext}', '%{ppp-disconnect-cause}', '%{%{Acct-Delay-Time}:-0}')" Any problem in sql queries which leads to sql db slowness? radiusacct schema: desc radiusacct; mysql> desc LWT.radiusacct; +----------------------+------------------+------+-----+---------------------+----------------+ | Field | Type | Null | Key | Default | Extra | +----------------------+------------------+------+-----+---------------------+----------------+ | RadAcctId | bigint(21) | NO | PRI | NULL | auto_increment | | AcctSessionId | varchar(32) | NO | PRI | | | | AcctUniqueId | varchar(32) | NO | MUL | | | | UserName | varchar(64) | NO | MUL | | | | NASIPAddress | varchar(15) | NO | MUL | | | | AcctStopTime | datetime | NO | MUL | 0000-00-00 00:00:00 | | | AcctSessionTime | int(12) | YES | MUL | NULL | | | AcctAuthentic | varchar(32) | YES | | NULL | | | acctinputoctets | bigint(20) | YES | | NULL | | | acctoutputoctets | bigint(20) | YES | | NULL | | | AcctTerminateCause | varchar(32) | NO | | | | | FramedProtocol | varchar(32) | YES | | NULL | | | TunnelServerEndpoint | varchar(15) | NO | | | | | TunnelClientEndpoint | varchar(15) | NO | | | | | TunnelType | varchar(10) | NO | | | | | AcctTunnelConnection | int(10) | YES | | NULL | | | AcctInputPackets | int(10) unsigned | YES | | NULL | | | AcctOutputPackets | int(10) unsigned | YES | | NULL | | | TunnelAssignmentId | varchar(25) | NO | | | | | AcctStatusType | varchar(20) | NO | | | | | DiscCauseExt | varchar(100) | YES | | NULL | | | PPPDisconnectCause | varchar(100) | YES | | NULL | | | NASPortType | varchar(32) | YES | | NULL | | | acctstopdelay | int(12) | YES | | NULL | | +----------------------+------------------+------+-----+---------------------+----------------+ Please suggest to speed up sql db. Mysql server RAM is 8GB and four processor Xeon. Thanks, Rams.

4 3

Re: How to desactivate freeradius to open the network ?
by Ivan Kalik 06 Sep '09

06 Sep '09

> I use Freeradius on Debian with mac-based authentification along > with a MySQL > database containing the mac addresses (as Login & Password). I would like > to open > the network to everyone, so I wonder how to make freeradius to authorize > any > mac address to open the network ? Why bother with radius at all. Just open the authentication on the NAS. Ivan Kalik Kalik Informatika ISP

6 6

Re: [RE]FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response?
by Cristina Miyata 06 Sep '09

06 Sep '09

Thanks a lot again, Alan !!! ---------[ Received Mail Content ]---------- Subject : Re: [RE]FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response? Date : Sat, 05 Sep 2009 01:17:37 +0200 >From : Alan DeKok <aland(a)deployingradius.com> To : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cristina Miyata wrote: > 1) If FreeRADIUS doesn't use Proxy-State for nothing, how it matches the requests with responses? Using only the Packet Identifier (AVP 92)? Very well, thank you. :) But really... packet src/dst ip/port, plus RADIUS code && Id. Proxy-State isn't needed. > 2) Since it is Packet Identifier has only 1 byte (0-254), it can only handle 255 requests (received by NAS and sent to remote hosts via Proxy) at a time? Or only handle 255 requests per NAS or remote host? No. It opens multiple source ports. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

[RE]FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response?
by Cristina Miyata 04 Sep '09

04 Sep '09

Thanks Alan for your answers! I still have more questions: 1) If FreeRADIUS doesn't use Proxy-State for nothing, how it matches the requests with responses? Using only the Packet Identifier (AVP 92)? 2) Since it is Packet Identifier has only 1 byte (0-254), it can only handle 255 requests (received by NAS and sent to remote hosts via Proxy) at a time? Or only handle 255 requests per NAS or remote host? Thanks for your attention! Cristina Miyata Cristina Miyata wrote: > I realized that this host doesn't responds the accounting request with the Proxy-State (AVP 33). I checked the RFC2865 and it seems that it is mandatory the remote server responds the accounting response with the Proxy-State (AVP 33). While the attribute is mandatory, FreeRADIUS doesn't use it for anything. > My questions are: > > 1) Is FreeRADIUS really correlating the accounting requests/response correctly for this remote host that doesn't add the AVP 33 in the response for a proxied request? Yes. > 2) What is the expected behavior of the FreeRADIUS and effects in the described situation (proxied requests being responded with no Proxy-State attribute). It will work. FreeRADIUS will work if it (a) proxies a request containing Proxy-State (b) receives a valid response (src/dst ip/port, etc.) with no Proxy-State. In your case, the home server is being marked dead because it isn't responding. Nothing else will cause it to me marked dead! . Alan DeKok. ---------[ Received Mail Content ]---------- Subject : FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response? Date : Fri, 04 Sep 2009 13:38:38 -0400 (EDT) >From : "Cristina Miyata" <cmiyata(a)lycos.com> To : <freeradius-users(a)lists.freeradius.org> p {margin-top:0px;margin-bottom:0px;} Dear FreeRADIUS Users, I have one FreeRADIUS server proxying accounting RADIUS to two different hosts. One of the remote hosts is receiving the requests and answering the responses, but processing the details file very slowly (keeps being marked as dead all the time). I realized that this host doesn't responds the accounting request with the Proxy-State (AVP 33). I checked the RFC2865 and it seems that it is mandatory the remote server responds the accounting response with the Proxy-State (AVP 33). My questions are: 1) Is FreeRADIUS really correlating the accounting requests/response correctly for this remote host that doesn't add the AVP 33 in the response for a proxied request? 2) What is the expected behavior of the FreeRADIUS and effects in the described situation (proxied requests being responded with no Proxy-State attribute). Appreciate any help and Thanks in advance! Cristina Miyata

2 1