March 2010 - Freeradius-Users - lists.freeradius.org

OT: send email when traffic-limit exceeded
by Alexander 17 Mar '10

17 Mar '10

Hello all, I use FR 2.x with MySQL. I would like to get informed via email when a user hits the traffic-limit. Has anyone done this before and can provide some sample script? Cheers, Alexander

1 0

Accounting Start From Client
by Teguh Kurniawan 17 Mar '10

17 Mar '10

Hello, I was succed sending "Accounting Start" from NTRadping to FR 2.1.3. My question is Mikrotik RouterOS and UBNT Nanostation could send "Accounting Start" automatically to FR ? Thank's Teguh Kurniawan

2 1

accounting Framed-IP-Address
by omega bk 16 Mar '10

16 Mar '10

HI, i can do accounting with mysql, it's working so fine. but i noticed that i don't have the real ip address of a workstation connected. i got this +-----------------+---------------------+---------------------+-------------------+-----------------+ | FramedIPAddress | AcctStartTime | AcctStopTime | CallingStationId | FramedIPAddress | +-----------------+---------------------+---------------------+-------------------+-----------------+ | bernard | 2010-03-16 13:07:29 | 2010-03-16 13:10:35 | 00-18-8B-B5-26-B7 | 3.118.236.192 | what is FramedIPAddress stand for? => cause i don't know this ip address how can retrie the real ip address ? (wired) thanks

3 6

Configuring freeradius for a new authentication module
by Abu Marcose 16 Mar '10

16 Mar '10

OK.. so first time I am working with free radius (or any kind of radius server) .. so please bear with me. I have a ubuntu based system on which I have installed freeradius 2.1.8 I have created my own new module called grid which is intended to only provide an authentication function I have the code compiled and the .so installed to the lib directory I have modified the radiusd.conf file to include the new module I have updated the sites-available/default file to include the new authentication type. In fact since all i am interested in is authentication, i have removed entries from all the other sections. So my default file looks like ========================= authorize {} authenticate { Auth-Type GRID { grid } } preacct {} accounting {} session {} post-auth {} pre-proxy {} post-proxy {} =========================== I start up radius in debug mode and send in the following test request 'radtest abc 123 127.0.0.1 10 testing123' and I get the No Auth -Type specified error.. Attached below is the output from radius. Could somebody please tell me what I am doing wrong ? FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on Mar 16 2010 at 20:29:16 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/grid including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/ detail.example.com including configuration file /usr/local/etc/raddb/modules/ sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner- tunnel including configuration file /usr/local/etc/raddb/sites-enabled/ default including configuration file /usr/local/etc/raddb/sites-enabled/ control-socket main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_grid Module: Instantiating grid grid { grid_auth_url = "http://localhost/pam_grid/process.php<http://www.google.com/url?sa=D&q=http://localhost/pam_grid/process.php&usg=…> " grid_app_id = "some app id" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 58303, id=88, length=55 User-Name = "abc" User-Password = "123" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 88 to 127.0.0.1 port 58303 Waking up in 4.9 seconds. Radius server boots up ok with no problems.

2 3

FreeRADIUS 2.1.7 and 2.1.8 fail to build
by Joey Officer 16 Mar '10

16 Mar '10

Trying to build FreeRADIUS from Gentoo's package system, or manually building it from the downloaded sources and I receive the following errors: building manually: gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /root/build/freeradius-server-2.1.8/src/lib/.libs/libfreeradius-radius.s o -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -lssl -lcrypto -ldl .libs/modules.o: In function `setup_modules': /root/build/freeradius-server-2.1.8/src/main/modules.c:1358: undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/root/build/freeradius-server-2.1.8/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/build/freeradius-server-2.1.8/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/build/freeradius-server-2.1.8/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/build/freeradius-server-2.1.8' make: *** [all] Error 2 I found the following thread: http://lists.cistron.nl/pipermail/freeradius-users/2009-September/msg001 49.html I see that when I try to build manually I am getting basically the same thing. I'm the first to admit I may be missing something in Alan's notes about updating the freeradius source code. What I believe he meant was to update ltmain.sh in the root of the extracted FreeRADIUS directory. I made the following change: from: #define lt_preloaded_symbols some_other_symbol to: #define lt__PROGRAM__LTX_preloaded_symbols t__PROGRAM__LTX_preloaded_symbols I run make clean, configure, and make again, and still receive the same error. So I'm probably missing something in this step. When I try to compile from within Gentoo's package management tools, I get the following: gentoo emerge: libtool: compile: i686-pc-linux-gnu-gcc -O2 -mtune=i686 -pipe -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2. 1.7/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.7\" -DOPENSSL_NO_KRB5 -c event.c -fPIC -DPIC -o .libs/event.o event.c: In function 'wait_a_bit': event.c:1163: warning: implicit declaration of function 'pthread_equal' event.c:1163: error: 'REQUEST' has no member named 'child_pid' event.c:1163: error: 'NO_SUCH_CHILD_PID' undeclared (first use in this function) event.c:1163: error: (Each undeclared identifier is reported only once event.c:1163: error: for each function it appears in.) event.c:1174: error: 'wait_for_child_to_die' undeclared (first use in this function) event.c: In function 'radius_event_init': event.c:3440: warning: unused variable 'attr' gmake[4]: *** [event.lo] Error 1 gmake[4]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7' make: *** [all] Error 2 Unfortunately, I wasn't able to find reference of this within the existing archives for FreeRADIUS. One thing to point out is that the Gentoo package is based off of 2.1.7 and when I attempt to build from source it is 2.1.8. Any help would be fantastic. If possible I'd prefer to get it working within the existing package system, using the build from source as a last resort. Thanks, joey

2 1

About FreeRADIUS-Stats-Client-IP-Address
by Sergio Belkin 16 Mar '10

16 Mar '10

Hi, When I issue the following command on the shell: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-IP-Address = 10.128.255.80" | radclient localhost:18120 status MySecret It gets global statistic and *not only* those of Client. Is there a way to get *only* stats from Client? Thanks in advance! -- -- SB http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Accounting and Segmentation Fault
by matthew.stringer＠bt.com 16 Mar '10

16 Mar '10

Hi all, I am a bit of a FreeRadius newbie and am having some issues with the accounting, getting segmentation fault reported back. I have FreeRadius 2.1.8 running on CentOS 5.4, set up in a pretty basic configuration. It is authenticating to a MySQL database that contains records for 300,000 users, again very basic info in the database. I am using RadPerf version 1.1a to have a number of users authenticated and then asking for accounting requests, the number needs to be up to 200,000 but at the moment I am having issues with 1,000 users. Basically RadPerf goes off and starts the authentication and then comes back and reports 'Segmentation Fault (Core Dump)' and then stops everything. Anybody got any ideas that may help with this? Thanks in advance Matt Stringer

2 1

vrf-aware vpdn / l2tp termination / cisco-avpair
by Alexander 16 Mar '10

16 Mar '10

Hello all, I am using FreeRadius 2.1.8 with MySQL to authenticate BBA users. I get L2TP sessions from my ISP (=LAC) arriving in VRF l2tp_vrf which I want to terminate in a different VRF (e.g. inet_vrf). Basic authentication works as long as I do not intruduce cisco-avpair attributes. Which ones do I need? I tried "lcp:interface-config#1=ip vrf forwarding (inet_vrf)" and "ip:vrf-id:=inet_vrf" in my radgroupreply table - without success. From the "debug radius authentication" I see "AAA Unsupported Attr: interface" and "parse unknown cisco vsa "vrf-id:". Here are some parts of my Cisco config: aaa authentication login default local aaa authentication ppp default group radius aaa authorization exec default local aaa authorization network default group radius aaa accounting delay-start aaa accounting update newinfo aaa accounting exec default action-type start-stop group radius aaa accounting network default action-type start-stop broadcast group radius aaa accounting connection default action-type start-stop group radius aaa session-id common vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname LAC vpn vrf l2tp_vrf source-ip xxx.xxx.xxx.xxx local name LNS l2tp tunnel password 0 xyz ip mtu adjust interface Virtual-Template1 mtu 1460 ip unnumbered Loopback0 no snmp trap link-status peer default ip address pool INET_ADDR_POOL no keepalive ppp mru match ppp authentication pap callin ppp ipcp mask 255.255.255.255 end What am I missing? Thanks in advance! Cheers, Alexander

1 1

convert mysql from ICRadius to Free
by Len Conrad 16 Mar '10

16 Mar '10

We can't find any info how to do this, but we can't be the first, either. Anybody got howtos or recipes for converting MySQL db? Len

2 1

eapol_test retransmits 10 times
by R C 15 Mar '10

15 Mar '10

Hi, My eapol_test retransmits 10 times even though i set the RADIUS_CLIENT_MAX_RETRIES to 0. How can i avoid it retransmitting 10 times? It retransmits 10 times every 150 seconds. ________________________________ /* Defaults for RADIUS retransmit values (exponential backoff) */ #define RADIUS_CLIENT_FIRST_WAIT 150 /* seconds */ #define RADIUS_CLIENT_MAX_WAIT 120 /* seconds */ #define RADIUS_CLIENT_MAX_RETRIES 0 /* maximum number of retransmit attempts * before entry is removed from retransmit * list */ #define RADIUS_CLIENT_MAX_ENTRIES 0 /* maximum number of entries in retransmit * list (oldest will be removed, if this * limit is exceeded) */ #define RADIUS_CLIENT_NUM_FAILOVER 4 /* try to change RADIUS server after this * many failed retry attempts */ ________________________________ thanks, rc

2 2