January 2010 - Freeradius-Users - lists.freeradius.org

Free radius installation
by José Campos 25 Jan '10

25 Jan '10

Im new on freeradius. Ive just installed it on fedora11 with yum install freeradius* and then done: radiusd X Here are the final lines of the debugging mode: } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. After install done the test in another shell on the same machine: radtest test test localhost 0 testing123, as suggested in <http://freeradius.org/radiusd/INSTALL> http://freeradius.org/radiusd/INSTALL and nothing appended. What is wrong with it? Can someone help me.

4 17

Dan Schaffer is not in the office
by Dan Schaffer 25 Jan '10

25 Jan '10

I will be out of the office starting 01/25/2010 and will not return until 01/28/2010. I will have limited email and voicemail access during the week at the Phoenix Contact Kickoff meetings. If this is an urgent issue, please contact our Tech Support group at 800-586-5525. Thanks, Dan

1 0

ldap group filter by different incoming IPs
by Stephon Chen 25 Jan '10

25 Jan '10

Hello all, We want to do a sceranio like below: (Pre-requisties: a radius server RD, a ldap backend LD, and 2 unix clients CA and CB with different IPs) CA sends user auth requests to RD, RD would only send if the user is in ldap group A CB sends user auth requests to RD, RD would only send if the user is in ldap group B Is it possible for only one radius server to do this according to different incoming IPs? Thanks a lot stephon

2 1

How to charge based on accounting correctly
by George Chelidze 25 Jan '10

25 Jan '10

Hello, We have a system which sends radius accounting messages to our radius. Based on this accounting we charge subscribers. Interim accounting is enabled so for a normal session we get one Start, zero or more Interim-Update and one Stop packets. Every accounting packet except Start contains Acct-Session-Time which is "how many seconds the user has received service for" according to rfc2866. That means that it's always incrementing during a session. To charge a session in chunks we calculate a difference between the recent value and the previous one. In our case we get Interim-Update records every 15 minutes, so this difference between 2 sequential Interim-Update records is 900 secs +/- 2-3 secs. What happens when for some reason one Interim-Update records is lost? In such case we get diff - 1800 secs and everything is fine. However recently we discovered that a system which is sending accounting records will resend unconfirmed packets after some time (I do not mean Retransmit-Interval/Retransmit-Count feature which exists on most if not all NAS-es). The later means that in some cases we can get an Interim-Update packet with Acct-Session-Timeout = 1800 calculate a difference against a Start record (that is 1800 secs) and charge it, later get Interim-Update with Acct-Session-Timeout = 900. So my questions can be stated like this: 1. Is it better to charge the whole difference between current and previous Session-Timeout values and later ignore any previous packets which arrive out of order, or it's better to charge last 15 minutes (I get Interim-Update records every 15 minutes as already stated above) and do not care about missing parts (if any) of a session? 2. Is it a correct behavior of a NAS to store accounting information on it's internal disk if it can't get acknowledgment for accounting request/s and resend it later? Best Regards, George Chelidze

2 3

Can't Assign IP address my users
by Tevfik Ceydeliler 25 Jan '10

25 Jan '10

Hi Alain, > Also, the proxy isn't returning an IP address: >> Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. >> Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop That log is taken from test for static IP Here is the log for user who get IP address from pool : rad_recv: Access-Request packet from host 10.65.8.100 port 65401, id=2, length=56 User-Name = "tevfikceydeliler" User-Password = "172932808506" +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry tevfikceydeliler at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Proxying request 1 to home server 10.1.1.51 port 1812 Sending Access-Request of id 236 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172932808506" NAS-IP-Address = 10.65.8.100 Proxy-State = 0x32 Going to the next request Waking up in 0.9 seconds. OK ############################> rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=236, length=23 Proxy-State = 0x32 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} OK ############################>++[main_pool] returns noop expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.8.100 OK ############################>[birmas] MD5 on 'key' directive maps to: b6201c0efddb958ed955eb3c8b0d920a [birmas] Searching for an entry for key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] Found a stale entry for ip: 172.30.64.95 [birmas] num: 0 rlm_ippool: Allocating ip to key: 'b6201c0efddb958ed955eb3c8b0d920a' [birmas] num: 1 [birmas] Allocated ip 172.30.64.86 to client key: b6201c0efddb958ed955eb3c8b0d920a ++[birmas] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.65.8.100/detail-20100121 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.65.8.100/detail-20100121 expand: %t -> Thu Jan 21 13:39:39 2010 ++[detail] returns ok ++[exec] returns noop OK ############################>Sending Access-Accept of id 2 to 10.65.8.100 port 65401 OK ############################> Framed-IP-Address = 172.30.64.86 OK ############################> Framed-IP-Netmask = 255.255.240.0 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 2 with timestamp +44 Ready to process requests. There is no manual about how to set user for static ip address. Mostly configurations use password. But i use OTP (realm) as password. What is changed when user moved from pool so static ip? Tevfik Ceydeliler Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Conditional expression ":-" deprecated?
by John Morrissey 24 Jan '10

24 Jan '10

We have a vendor product that only supports usernames shorter than 64 characters. I used the unlang expression: if ("%{#User-Name:-0}" <= 63) to avoid sending accounting with longer usernames to it, which yielded: server buffered-dpi-esc4 { +- entering group preacct {...} ++? if ("%{#User-Name:-0}" <= 63) WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{#User-Name:-0} -> 70 ? Evaluating ("%{#User-Name:-0}" <= 63) -> FALSE ++? if ("%{#User-Name:-0}" <= 63) -> FALSE I got the ":-" expression from unlang(5), which doesn't mention that it's deprecated. I used this expression to specify a default length of 0 since unlang(5) states that %{#attr} returns an empty value if attr isn't present, and I wasn't sure how FreeRADIUS would react to a numeric comparison against an unset value. I'm using: if (User-Name && "%{#User-Name}" <= 63) { instead for now, but is the ":-" expression really deprecated, and is there an alternative equivalent? How will FreeRADIUS react to an unset value in a numeric comparison? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 7

Duplicate Radius data when OSPF Kicks in
by Eugene van der Merwe 24 Jan '10

24 Jan '10

Hi, We have a problem with duplicate sessions on our MikroTik wireless network with FreeRADIUS when OSPF kicks in: Subscription Analysis for user@isp 2010-01-17 up to 2010-01-25 # logged in session time upload download server terminate cause callerid 1 2010-01-23 22:07:31 15 hours 6.9 MB 83.6 MB * 192.168.199.254*:513 - 00:0B:6B:DB:A9:96 2 2010-01-22 22:07:30 18 hours 16.2 MB 451.1 MB * 192.168.208.1*:434 - 00:0B:6B:DB:A9:96 3 2010-01-22 22:07:29 1 days 27.0 MB 0.6 GB 192.168.199.254:434 Session-Timeout 00:0B:6B:DB:A9:96 4 2010-01-21 22:07:27 1 days 4.7 MB 65.0 MB 192.168.199.254:386 Session-Timeout 00:0B:6B:DB:A9:96 5 2010-01-20 22:07:25 1 days 2.9 MB 45.7 MB 192.168.199.254:331 Session-Timeout 00:0B:6B:DB:A9:96 6 2010-01-19 22:07:23 2 hours 171.3 KB 1.4 MB 192.168.208.1:290 - 00:0B:6B:DB:A9:96 7 2010-01-19 22:07:23 1 days 2.9 MB 24.5 MB 192.168.199.254:290 Session-Timeout 00:0B:6B:DB:A9:96 8 2010-01-18 22:07:20 1 days, 1 seconds 3.8 MB 66.2 MB 192.168.199.254:207 Session-Timeout 00:0B:6B:DB:A9:96 9 2010-01-17 22:07:15 1 days 1.5 MB 10.0 MB 192.168.199.254:166 Session-Timeout 00:0B:6B:DB:A9:96 10 2010-01-17 22:07:15 0 seconds 0.0 KB 0.0 KB 192.168.208.1:166 - 00:0B:6B:DB:A9:96 High site 1 is 192.168.199.254 and high site 2 is 192.168.208.1. As you can see it looks like FreeRADIUS counts the extra data on the dropped connection as well. The only suggestion I have received so far is to use a product called SMRadius (http://www.smradius.org/tiki-index.php?page=Features) that apparently merges duplicate sessions. But my FreeRadius installation is 7 years old and I don't want to change to another product. We are using FreeRADIUS Version 1.1.7, for host x86_64-pc-linux-gnu (Ubuntu 8.04 64-bit). mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (x86_64) using readline 5.2 Apart from that we have a pretty stock standard default installation. I have heard about some other people with large MikroTik networks and OSPF and FreeRADIUS that they are having the same problem. I have also described this problem on the MikroTik forum: http://forum.mikrotik.com/viewtopic.php?f=2&t=38620 please assist urgently, this problem is leading to some difficult client service inquiries. -------- Eugene van der Merwe

3 2

Removing an attribute from reply message!
by Hamid Reza Hasani 24 Jan '10

24 Jan '10

Hi, I want to remove an attribute from reply message(account accept), how can I should do that? more detail: I'm using some sqlcounter to count daily, weekly and monthly octets. After their processing they add Session-Octets-Limit to my reply message. I want to have a condition that if this value reach some special value (for example 20000Byte), then it removes Session-Octets-Limit from reply message. I add this lines at the end of authorize section: if("%{reply.Session-Octets-Limit}" >= 20000) { update reply { Session-Octets-Limit [I don't know what!] } } Is it correct? I don't know! am I should add a module or filter or else? BTW how can I remove Session-Octets-Limit from reply message! Is it possible? Thanks. Hamid Reza Hasani ------------------ Ya Ali

2 3

radiusd only starting with radiusd -X, but not as daemon via rc.freeradius
by Michael Arndt 23 Jan '10

23 Jan '10

hello *, 1. i can start radiusd with a valid and working radiusd.config using radiusd -X in this case auth using e.g radtest or other clients is working and stable .. 2. without the -X option and as a "service" via rc.freeradius radiusd will start, but authentication against radius is not sucessful, e.g. using radtest .... ( cannot connect to ... ) as far as i understand, difference between both modes is, that without -X radiusd switches over from root to "user" radius after parsing all config files. So i assume a problem with a socket or else, but with strace i see no hint that gives me a clue any hints in which direction my debugging should go ... ??? System is an openSUSE 10.3 (i586) VERSION = 10.3 SW Package Versions: freeradius-devel-1.1.6-47.4 freeradius-client-1.1.5-36 freeradius-1.1.6-47.4 freeradius-client-libs-1.1.5-36 freeradius-client-devel-1.1.5-36 pam_radius-1.3.16-144 TIA Michael

3 2

Blank Password Problem
by Satyam Mathura 23 Jan '10

23 Jan '10

Guys, I'm experiencing a strange problem. I use FreeRadius to control cmd line access to my routers and switches and I've configured FreeRadius to use a MySQL back-end and thus far it works fine except for one condition. If i supply a blank password when authenticating, FreeRadius allows the request and authenticates me once my username is correct. Why is this happening? Is there any way to have FreeRadius keep on prompting if a blank password is supplied or reject the request altogether? Thanks for your help. Radius debug is below: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1645, id=215, length=104 User-Name = "john.doe" Reply-Message = "Password: " User-Password = "" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "192.168.1.1" NAS-IP-Address = 192.168.1.1 +- entering group authorize ++[preprocess] returns ok rlm_sql (sql): - sql_xlat expand: %{User-Name} -> john.doe rlm_sql (sql): sql_set_user escaped user --> 'john.doe' expand: SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-IP-Address}" AND nasportid LIKE IF (SUBSTRING("%{NAS-Port-Id}", 1, 3) = 'tty', 'tty', "%{NAS-Port-Id}") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "%{User-Name}") -> SELECT groupname FROM radhuntgroup WHERE nasipaddress="192.168.1.1" AND nasportid LIKE IF (SUBSTRING("tty1", 1, 3) = 'tty', 'tty', "tty1") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "john.doe") rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-IP-Address}" AND nasportid LIKE IF (SUBSTRING("%{NAS-Port-Id}", 1, 3) = 'tty', 'tty', "%{NAS-Port-Id}") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "%{User-Name}") } -> admin ++[request] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "john.doe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 204 ++[files] returns ok expand: %{User-Name} -> john.doe rlm_sql (sql): sql_set_user escaped user --> 'john.doe' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john.doe' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'john.doe' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'john.doe' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'engineeringadmin' ORDER BY id rlm_sql (sql): User found in group engineeringadmin expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'engineeringadmin' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Normalizing SHA-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [john.doe] (from client routerA port 1 cli 192.168.1.1) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 215 to 192.168.1.1 port 1645 Service-Type := Administrative-User Cisco-AVPair := "shell:priv-lvl=15" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 215 with timestamp +9 Ready to process requests.

3 7