February 2010 - Freeradius-Users - lists.freeradius.org

Accounting queries logging just after Acct-Stop packet
by Luiz Gustavo de Villa Scandelari 18 Feb '10

18 Feb '10

Hi, I have Just upgraded my freeradius to version 2.1.7 and changed the config files in order to get it working with mysql. It´s working ok now, but compared to the previous version (1.x.x) the accounting queries are not logging the accounting session at radacct, as it should. After we receive an Acct-Stop Packet the sql module logs the accounting session data to the database, so what can I do in order to have the sql module logging just after the Acct-Start Packet? If you need more information please tell me that I´ll promptly send so I can solve this problem soon. Ps.: It´s very important to us to have accounting log data at acct-start packets, because we use this information for some Stored Procedure that affects another system. Best regards, Luiz Gustavo Scandelari Skype: luiz.gustavo.wni

2 1

Max-Monthly-Traffic
by Neville 18 Feb '10

18 Feb '10

Sorry for troubling everyone on this, but I cannot work out why Session-Octets-Limit is not calculating the differences between the counter and the check_item and setting an higher limited than the check_item? Log below Sun Feb 7 12:59:50 2010 : Debug: rlm_sqlcounter: Check item is greater than query result Sun Feb 7 12:59:50 2010 : Debug: rlm_sqlcounter: Authorized user FT-memjxa, check_item=262100000, counter=151223038 Sun Feb 7 12:59:50 2010 : Debug: rlm_sqlcounter: Sent Reply-Item for user FT-memjxa, Type=Session-Octets-Limit, value=263954010 Sun Feb 7 12:59:50 2010 : Info: ++[monthlytraffic] returns ok sqlcounter monthlytraffic { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Session-Octets-Limit sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE username='%{%k}' AND Month(acctstoptime) =(Month(NOW())) AND Year(acctstoptime) = Year(NOW())" } Any pointers would help. Thx Nev

3 2

Problems freeradius + mysql
by Toro 18 Feb '10

18 Feb '10

Hi list, I'm trying to integrate freeradius with mysql and daloradius for the management, but i can't resolve some problems. When I do a radiusd -X print a big output, and in the end of the output: *Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[159]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. * I search on google, but i can't find anything to solve the problem. ¿Anyone know where I can find a solution?

2 1

Is Centralized SSH Public Key Authentication Possible?
by John L. Singleton 18 Feb '10

18 Feb '10

Hi All, I am trying to set up a centralized SSH authentication server that allows authentication via public keys. I can't find anything on the web about if this is possible with FR. Is it? Basically all I need is for FR to allow authentication off of a respective users's .ssh/.authorized_keys file. So far all I can seem to get going is password authentication. Can anyone let me know if this is even doable? Best, JLS John L. Singleton jsinglet(a)gmail.com

6 5

How long it take to auth in 802.1X/WPA-enterprise?
by JaeJong Baek 18 Feb '10

18 Feb '10

How long it take to auth in 802.1X/WPA-enterprise? I set up 802.1X/WPA-Enterprise network simply as follows. Free radius 2.1.8 server ubunt on VMware 10.10.20.14 | |EAP-TLS(wired. 802.3) | AP Belkin 54g WPA-Enterprise Tkip : :EAP-TLS(wireless 802.11) : Client : Laptop Windows 7 (Self certification) kkk(a)xxxx.yyy.zz.vv In this simple network model, I have tried to auth using EAP-TLS(self-certification) and it works good. By the way, about 18 seconds are taken to auth as follow debug logs. (confer the timestamp (1) and (2)) ....... ....... Wed Feb 17 21:36:29 2010 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.10.20.14 port 3072, id=0, length=157 User-Name = "kkk(a)xxxx.yyy.zz.vv" NAS-IP-Address = 10.10.20.14 Called-Station-Id = "001150624dc1" Calling-Station-Id = "00242bc8fe6a" NAS-Identifier = "001150624dc1" NAS-Port = 28 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001b016a6a624063636c61622e796f6e7365692e61632e6b72 Message-Authenticator = 0x3d4a5b810f49d3bc390d39406a300eda Wed Feb 17 21:36:42 2010 : Info: +- entering group authorize {...} Wed Feb 17 21:36:42 2010 : Info: ++[preprocess] returns ok Wed Feb 17 21:36:42 2010 : Info: ++[chap] returns noop Wed Feb 17 21:36:42 2010 : Info: ++[mschap] returns noop Wed Feb 17 21:36:42 2010 : Info: [suffix] Looking up realm "xxxx.yyy.zz.vv" for User-Name = "kkk(a)xxxx.yyy.zz.vv" Wed Feb 17 21:36:42 2010 : Info: [suffix] No such realm "xxxx.yyy.zz.vv" Wed Feb 17 21:36:42 2010 : Info: ++[suffix] returns noop Wed Feb 17 21:36:42 2010 : Info: [eap] EAP packet type response id 0 length 27 Wed Feb 17 21:36:42 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Feb 17 21:36:42 2010 : Info: ++[eap] returns updated Wed Feb 17 21:36:42 2010 : Info: ++[unix] returns notfound Wed Feb 17 21:36:42 2010 : Info: ++[files] returns noop Wed Feb 17 21:36:42 2010 : Info: ++[expiration] returns noop Wed Feb 17 21:36:42 2010 : Info: ++[logintime] returns noop Wed Feb 17 21:36:42 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Feb 17 21:36:42 2010 : Info: ++[pap] returns noop Wed Feb 17 21:36:42 2010 : Info: Found Auth-Type = EAP Wed Feb 17 21:36:42 2010 : Info: +- entering group authenticate {...} Wed Feb 17 21:36:42 2010 : Info: [eap] EAP Identity Wed Feb 17 21:36:42 2010 : Info: [eap] processing type tls Wed Feb 17 21:36:42 2010 : Info: [tls] Requiring client certificate Wed Feb 17 21:36:42 2010 : Info: [tls] Initiate Wed Feb 17 21:36:42 2010 : Info: [tls] Start returned 1 Wed Feb 17 21:36:42 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.10.20.14 port 3072 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x897eb023897fbdcff6383e26a1b0eb16 Wed Feb 17 21:36:42 2010 : Info: Finished request 0. Wed Feb 17 21:36:42 2010 : Debug: Going to the next request Wed Feb 17 21:36:42 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.20.14 port 3072, id=0, length=157 Wed Feb 17 21:36:42 2010 : Info: Cleaning up request 0 ID 0 with timestamp +13 User-Name = "kkk(a)xxxx.yyy.zz.vv" NAS-IP-Address = 10.10.20.14 Called-Station-Id = "001150624dc1" Calling-Station-Id = "00242bc8fe6a" NAS-Identifier = "001150624dc1" NAS-Port = 28 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001b016a6a624063636c61622e796f6e7365692e61632e6b72 Message-Authenticator = 0x6bba537330b0a4ceeb559fdbf62726fa Wed Feb 17 21:36:42 2010 : Info: +- entering group authorize {...} Wed Feb 17 21:36:42 2010 : Info: ++[preprocess] returns ok Wed Feb 17 21:36:42 2010 : Info: ++[chap] returns noop Wed Feb 17 21:36:42 2010 : Info: ++[mschap] returns noop Wed Feb 17 21:36:42 2010 : Info: [suffix] Looking up realm "xxxx.yyy.zz.vv" for User-Name = "kkk(a)xxxx.yyy.zz.vv" Wed Feb 17 21:36:42 2010 : Info: [suffix] No such realm "xxxx.yyy.zz.vv" Wed Feb 17 21:36:42 2010 : Info: ++[suffix] returns noop Wed Feb 17 21:36:42 2010 : Info: [eap] EAP packet type response id 0 length 27 Wed Feb 17 21:36:42 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Feb 17 21:36:42 2010 : Info: ++[eap] returns updated Wed Feb 17 21:36:42 2010 : Info: ++[unix] returns notfound Wed Feb 17 21:36:42 2010 : Info: ++[files] returns noop Wed Feb 17 21:36:42 2010 : Info: ++[expiration] returns noop Wed Feb 17 21:36:42 2010 : Info: ++[logintime] returns noop Wed Feb 17 21:36:42 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Feb 17 21:36:42 2010 : Info: ++[pap] returns noop Wed Feb 17 21:36:42 2010 : Info: Found Auth-Type = EAP Wed Feb 17 21:36:42 2010 : Info: +- entering group authenticate {...} Wed Feb 17 21:36:42 2010 : Info: [eap] EAP Identity Wed Feb 17 21:36:42 2010 : Info: [eap] processing type tls Wed Feb 17 21:36:42 2010 : Info: [tls] Requiring client certificate Wed Feb 17 21:36:42 2010 : Info: [tls] Initiate Wed Feb 17 21:36:42 2010 : Info: [tls] Start returned 1 Wed Feb 17 21:36:42 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.10.20.14 port 3072 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4ec97f554ec8722ce642d653e0f84a11 Wed Feb 17 21:36:42 2010 : Info: Finished request 1. Wed Feb 17 21:36:42 2010 : Debug: Going to the next request Wed Feb 17 21:36:42 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.20.14 port 3072, id=0, length=157 Wed Feb 17 21:36:47 2010 : Info: Cleaning up request 1 ID 0 with timestamp +13 ^^^^^^^^^^^^^^(1) Wed Feb 17 21:36:47 2010 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.10.20.14 port 3072, id=0, length=157 User-Name = "kkk(a)xxxx.yyy.zz.vv" NAS-IP-Address = 10.10.20.14 Called-Station-Id = "001150624dc1" Calling-Station-Id = "00242bc8fe6a" NAS-Identifier = "001150624dc1" NAS-Port = 28 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001b016a6a624063636c61622e796f6e7365692e61632e6b72 Message-Authenticator = 0x03977f17a87e73640019845a87fca910 Wed Feb 17 21:37:00 2010 : Info: +- entering group authorize {...} Wed Feb 17 21:37:00 2010 : Info: ++[preprocess] returns ok Wed Feb 17 21:37:00 2010 : Info: ++[chap] returns noop Wed Feb 17 21:37:00 2010 : Info: ++[mschap] returns noop Wed Feb 17 21:37:00 2010 : Info: [suffix] Looking up realm "xxxx.yyy.zz.vv" for User-Name = "kkk(a)xxxx.yyy.zz.vv" Wed Feb 17 21:37:00 2010 : Info: [suffix] No such realm "xxxx.yyy.zz.vv" Wed Feb 17 21:37:00 2010 : Info: ++[suffix] returns noop Wed Feb 17 21:37:00 2010 : Info: [eap] EAP packet type response id 1 length 27 Wed Feb 17 21:37:00 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Feb 17 21:37:00 2010 : Info: ++[eap] returns updated Wed Feb 17 21:37:00 2010 : Info: ++[unix] returns notfound Wed Feb 17 21:37:00 2010 : Info: ++[files] returns noop Wed Feb 17 21:37:00 2010 : Info: ++[expiration] returns noop Wed Feb 17 21:37:00 2010 : Info: ++[logintime] returns noop Wed Feb 17 21:37:00 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Feb 17 21:37:00 2010 : Info: ++[pap] returns noop Wed Feb 17 21:37:00 2010 : Info: Found Auth-Type = EAP Wed Feb 17 21:37:00 2010 : Info: +- entering group authenticate {...} Wed Feb 17 21:37:00 2010 : Info: [eap] EAP Identity Wed Feb 17 21:37:00 2010 : Info: [eap] processing type tls Wed Feb 17 21:37:00 2010 : Info: [tls] Requiring client certificate Wed Feb 17 21:37:00 2010 : Info: [tls] Initiate Wed Feb 17 21:37:00 2010 : Info: [tls] Start returned 1 Wed Feb 17 21:37:00 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.10.20.14 port 3072 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5e8be3495e89ee006f9068a0260d02b1 Wed Feb 17 21:37:00 2010 : Info: Finished request 2. Wed Feb 17 21:37:00 2010 : Debug: Going to the next request Wed Feb 17 21:37:00 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.20.14 port 3072, id=0, length=279 Wed Feb 17 21:37:00 2010 : Info: Cleaning up request 2 ID 0 with timestamp +31 ^^^^^^^^^^^^^^^(2) User-Name = "kkk(a)xxxx.yyy.zz.vv" NAS-IP-Address = 10.10.20.14 Called-Station-Id = "001150624dc1" Calling-Station-Id = "00242bc8fe6a" NAS-Identifier = "001150624dc1" NAS-Port = 28 Framed-MTU = 1400 State = 0x5e8be3495e89ee006f9068a0260d02b1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200830d800000007916030100740100007003014b7be2f6f44552f530788e05c2c2f200 51ba0547a8df2ede6aabb38fae71fd8f000018002f00350005000ac013c014c009c00a003200 38001300040100002f0000001b00190000166a6a624063636c61622e796f6e7365692e61632e 6b72000a0006000400170018000b00020100 Message-Authenticator = 0x1da810154c90aa4a028de1eaebee971c ....... ....... Is it right? I can't understand the taken time 18 seconds. it's too long. Can you explain what is wrong? I don't think it due to system performance or network throughput. Maybe configuration file problems... Thanks in advance.^^ Best, Jaejong Baek

2 1

Re: How to configure EAP PEAPv0/EAP-MSCHAPv2 in freeradius 2.10,
by Dilip Patel 17 Feb '10

17 Feb '10

Thanks Alan for your suggestion. I tried to install freeradius2.1.8, but ran into following error: pateldil@pateldil-desktop:~/freeradius-server-2.1.8[17:00:07]$ sudo dpkg -i ../freeradius_2.1.8+git_amd64.deb Selecting previously deselected package freeradius. (Reading database ... 179982 files and directories currently installed.) Unpacking freeradius (from .../freeradius_2.1.8+git_amd64.deb) ... dpkg: dependency problems prevent configuration of freeradius: freeradius depends on libfreeradius2 (= 2.1.8+git); however: Version of libfreeradius2 on system is 2.1.0+dfsg-0ubuntu4.1. dpkg: error processing freeradius (--install): dependency problems - leaving unconfigured Errors were encountered while processing: freeradius Can't figure out an easy way to install libfreeradius2 (= 2.1.8+git.). Anyways, thanks for your suggestion.

2 1

Matching Airespace-Wlan-Id in users files or radgroupcheck database
by Adam Wien 17 Feb '10

17 Feb '10

I'm trying to get FreeRadius working with a Cisco WLC. I would like to match on Airespace-Wlan-Id to permit access to certain SSIDs. I can't seem to deny access using this attribute. Is there a trick to this? Thanks, -adam

3 7

How to configure EAP PEAPv0/EAP-MSCHAPv2 in freeradius 2.10 Ubuntu linux 9.04
by Dilip Patel 17 Feb '10

17 Feb '10

I am using FreeRADIUS Version 2.1.0 in Ubuntu linux 9.04. How do I configure Free Radius to use EAP PEAPv0/EAP-MSCHAPv2? I have updated the default configuration in eap.conf to the following: eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = peap However, I get the following error output in initializing modules: root@pateldil-desktop:/etc/freeradius# freeradius -X FreeRADIUS Version 2.1.0, for host x86_64-pc-linux-gnu, built on Apr 30 2009 at 07:39:22 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.1 { require_message_authenticator = no secret = "testing" shortname = "m210" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } rlm_eap: No such sub-type for default EAP type peap /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Errors initializing modules

2 1

unlang help please
by Leighton Man 17 Feb '10

17 Feb '10

Using /usr/local/bin/radclient -f radpkt .............. where radpkt contains: Packet-Type = Access-Request User-Name = "test(a)test.test.test" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "13" I have unlang in authorise section of sites-enabled/default, after pap: if (request:Tunnel-Private-Group-Id:0 == "13"){ #if (request:Airespace-Wlan-Id == 3){ update control { Proxy-To-Realm := LOCAL } } In debug mode I see: rad_recv: Access-Request packet from host 172.17.193.111 port 51171, id=33, length=87 User-Name = "test(a)test.test.test" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "13" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/auth-detail-20100217 [auth_log] /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20100217 [auth_log] expand: %t -> Wed Feb 17 12:23:28 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "test.test.test" for User-Name = "test(a)test.test.test" [suffix] Found realm "DEFAULT" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user test to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ++? if (request:Tunnel-Private-Group-Id:0 == "13") ? Evaluating (request:Tunnel-Private-Group-Id:0 == "13") -> FALSE ++? if (request:Tunnel-Private-Group-Id:0 == "13") -> FALSE expand: %{client:shortname} -> testing ++[request] returns noop Etc. etc. Can someone please explain why the comparison (request:Tunnel-Private-Group-Id:0 == "13") fails? I've tried single quotes, double quotes and no quotes around the 13. If I change == to != in the unlang, the comparison returns TRUE . If I use (request:Airespace-Wlan-Id == 4 ) in the comparison, it all works as I would expect. Thanks in advance, Leighton ________________________________ --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 2

How to access config parameters for rlm_perl
by David Donn 17 Feb '10

17 Feb '10

Hi, I want to set up some config parameters for use in my perl module. I think these are supposed to be in the RAD_CONFIG hash. But this hash always seems to be empty. Any ideas? Maybe I have I have my config parameters defined in the wrong place? Cheers, David Donn My site file: accounting { example } My rlm_perl config file (from /etc/raddb/modules): perl example { module = ${confdir}/example.pl foo = bar } My perl code (example.pl): use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK %RAD_CONFIG); use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant LOG_ERROR => 4; sub accounting { # doesn't print anything, expected it to print "module = /etc/raddb/example.pl" and "foo = bar" foreach my $k (keys %RAD_CONFIG) { &radiusd::radlog(LOG_ERROR, "Config $k = $RAD_CONFIG{$k}"); } return RLM_MODULE_OK; }

2 1