March 2010 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

FR 2.1.0 (ubuntu) proxying to NPS/IAS.
by Ville Leinonen 02 Feb '11

02 Feb '11

Hi, I try to use FR to forwarding access-request to NPS servers, but some reason FR/NPS gives "User password is incorrect" message. I have tripple check that password is correct. When i test IAS to NPS proxy it works. I have enable in NPS side MS-CHAP-v2, MS-CHAP, CHAP and PAP/SPAP methods. Any clue what is wrong? Here is some logs: rad_recv: Access-Request packet from host 192.168.21.150 port 1025, id=57, length=154 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "vle", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "vle" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user vle to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} ++[files] returns noop Sending Access-Request of id 118 to 192.168.21.200 port 1812 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" Proxy-State = 0x3537 Proxying request 0 to home server 192.168.21.200 port 1812 Sending Access-Request of id 118 to 192.168.21.200 port 1812 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" Proxy-State = 0x3537 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 192.168.21.200 port 1812, id=118, length=52 Proxy-State = 0x3537 Reply-Message = "User password is incorrect" Br, Ville

6 11

Certificate-based client side authentication towards a website with freeradius
by Martin Schneider 01 Dec '10

01 Dec '10

Hello all, we're trying to setup a freeradius / apache installation that allows us to authenticate and authorize users with *certificates* towards a website. Is there a good tutorial out there somewhere? We did only finde partial information that seems to be quite old unfortunately. Or could somebody who is deep into this matter please give some advice or ideas how we can solve our task? Best regards M

5 10

Adding Multiple Cisco-AVPairs using rlm_perl
by James Nedila 29 Aug '10

29 Aug '10

I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response. Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this? Thanks, James

5 8

FR 2.1.8 Issue - Unjustified(?) Access-Rejects.
by Palmer J.D.F. 29 Jun '10

29 Jun '10

Hi, We migrated to 2.1.8 (from 2.1.7) last week while things were quiet, as the users have re-appeared after the holiday we've started to receive a few reports from users stating that they have been getting lots of prompts for credentials. Two users in particular, both Ubuntu users, have been having big problems. I had a look at the radpostauth table and sure enough at least 50% of their auth attempts have resulted in access-rejects. I rolled back to 2.1.7 this afternoon and the problem has gone away. Should anyone be interested I have attached an radmin output for one of the users, it shows some accepts and lots of rejects. Is this likely to be a configuration error (no changes were made to the 2.1.7 config), or a bug? Thanks, Jezz Palmer.

7 16

How to handle challenge response using PAM auth in FreeRadius
by Rajendra Hegde 13 Apr '10

13 Apr '10

Hello, I am developing a PAM module for radius server. The radius server is configured to use PAM auth. It reads /etc/pam.d/radiusd and loads it on receiving auth request. The PAM module talks to external Authentication server and sometimes gets back "Challenge Respose". How can this be returned back to radius server from pam_sm_authenticate from my PAM module ? Please note that this is different than what pam_radius_auth.c does. pam_radius_auth.c talks to radius directly via network where as my module directly gets loaded by Radius. Why should not there be a way to return "Challenge Respose" from linux PAM back to it's loader ? Can this possible linux limitation be overcome by radius calling another exported function for PAM module covering all scenarios including "Challenge Response" ? Where should I look into in the freeradius codebase, if I were to add that functionality ? with best regards, The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. Please see our legal details at http://www.cryptocard.com CRYPTOCard Inc. is registered in the province of Ontario, Canada with Business number 80531 6478. CRYPTOCard Europe is limited liability company registered in England and Wales (with registered number 05728808 and VAT number 869 3979 41); its registered office is Aztec Centre, Aztec West, Almondsbury, Bristol, UK, BS32 4TD

4 10

Multiple EAP-TLS modules with different certificates
by Thibault Le Meur 06 Apr '10

06 Apr '10

Hi, I'm about to change the CA of my radius server certificate. At the same time I've installed a new wifi network and plan to change the SSID as well (authentication is EAP-TTLS or EAP-PEAP). In order to avoid a complete breakout when I change the certificate of my radius server (because a manual operation is required on the supplicant side to select the new CA), I'd like to configure FR so that: * when the WiFi client connects to the SSID1, the server uses the old certificate and key, * and when the client uses the SSID2, the radius server uses the new certificate and key Is this possible ? I've already tried such a configuration by: * defining 2 eap modules let's say "eapOld" and "eapNew" (each with its own key and cert) * making sure that depending on the SSID, the access-point sets a different NAS-Identifier (let's say ID1 and ID2) in the Access-request * in the virtual FR server, I've used unlang to run either eap module: in authorize: if ("%{request:NAS-Identifier}" == ID1) { eapOld { ok = return } if ("%{request:NAS-Identifier}" == ID2) { eapNew { ok = return } in authenticate: Auth-Type eapNew { eapNew } Auth-Type eapOld { eapOld } in eap.conf: the two eap modules only differ from their certificate/key, they redirect to the same inner-tunnel virtual server. The result so far is that with such setup my wireless clients can't connect at all when they check the certificate, but can connect when they don't (no matter what setup is done on the client side). Of course I've installed the 2 certificates on the client to check this. A quick look at FR debug logs confirms, as far as I can read them, that the client is refusing the radius server certificate. Is there a client tool to check which certificate is used by FR ? Have I missed something in the setup ? I've tried to turn on Windows EAP log, but they aren't very easy to read as far as TLS/TTLS/PEAP authentication is concerned ! Environement: FR is 2.1.1, client used Windows XP SP3 and Windows 7. Thanks a lot for your ideas, proposals, ... Best regards, Thibault

2 3

Freeradius + PEAP.. stuck on validating identity..
by Bruno Kremel 01 Apr '10

01 Apr '10

Hi, I have freeradius for WPA2 Enterprise authentification in small network in library, it is stable version (2.0.4) on Debian Lenny compiled from sources with OpenSSL support.. Everything seems to be OK, but when I try to connect to AP from laptop with Windows XP after I enter name and password I am stuck on Validating identity, same on Ubuntu machine... My configuration is pretty much default except of enabling MySQL and setting paths and passwords to certificates (generated with make script in /etc/freeradius/certs, so they should be OK) and addresses of clients. This is what freeradius -X gives me when I try to connect to AP: Ready to process requests. rad_recv: Access-Request packet from host 192.168.3.1 port 1291, id=0, length=123 User-Name = "pokus" NAS-IP-Address = 192.168.3.1 Called-Station-Id = "00259c523046" Calling-Station-Id = "001e650eb532" NAS-Identifier = "00259c523046" NAS-Port = 9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a01706f6b7573 Message-Authenticator = 0x634f3b088572fda3a12eca56ed6035b9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pokus", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> pokus rlm_sql (sql): sql_set_user escaped user --> 'pokus' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'pokus' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'pokus' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'pokus' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [pokus/<via Auth-Type = Accept>] (from client router port 9 cli 001e650eb532) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.3.1 port 1291 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +59 Ready to process requests. To me it seems that name/password was accepted so I have no clue where is the problem.. Thank you in advance for any help..

3 11

Freeradius Isn't Listening
by Randall Degges 31 Mar '10

31 Mar '10

Hi everyone, Firstly, I'm new to this list, but I've searched for an answer to my problems for quite a while, and haven't been able to find a solution. Please excuse me if this has already been asked. *USAGE* I'm using Freeradius to log call statistics from my Cisco AS5400 call gateway to a MySQL database. We use this for accounting ( to keep track of how many minutes callers use ). *VERSION* I'm using FreeRADIUS Version 2.1.0, for host x86_64-pc-linux-gnu, built on Sep 17 2009 at 17:46:37 on ubuntu-server. *PROBLEM* The problem I'm having is that when I run Freeradius (in production or debug mode), my Cisco AS5400 is unable to connect to the freeradius server. When I do a netstat -a on my freeradius server, I see no connections listening on ports 1812 and 1813 (which freeradius should be listening on). I believe that once this problem has been resolved, my setup will work correctly: 1. Call comes into my Cisco AS5400. 2. Cisco AS5400 sends accounting requests to my freeradius server. 3. Freeradius server performs a MySQL query to my MySQL database. 4. Caller hangs up. 5. Cisco AS5400 sends an accounting request to my freeradius server. 6. Freeradius server performs a MySQL update to my MySQL database, thus ending the transaction. *FREERADIUS DEBUG* Here is the output of: freeradius -X root@RAD01:~# freeradius -X FreeRADIUS Version 2.1.0, for host x86_64-pc-linux-gnu, built on Sep 17 2009 at 17:46:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 9600 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client xx.xx.xx.xx { ipaddr = xx.xx.xx.xx require_message_authenticator = no secret = "password" shortname = "AA" nastype = "cisco" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking session {...} for more modules to load Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "xx.xx.xx.xx" port = "" login = "radius" password = "password" radius_db = "accounting" read_groups = yes sqltrace = yes sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 25 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT INTO dids (sessionid, did, caller, start) VALUES ('%{NAS-Identifier}%{Acct-Session-Id}', '%{Called-Station-Id}', '%{Calling-Station-Id}', NOW())" accounting_start_query_alt = "" accounting_stop_query = "UPDATE dids SET stop=NOW(), duration=%{Acct-Session-Time}, termination_cause='%{Acct-Terminate-Cause}' WHERE sessionid='%{NAS-Identifier}%{Acct-Session-Id}' LIMIT 1" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@xx.xx.xx.xx:/accounting rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 } } modules { Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking session {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. *DEBUG LISTENING PORTS* As you can see in the previous section, my freeradius debug seems to execute perfectly. Note how it says it is listening on 1812 and 1813. When I do a netstat -a command, I get: root@RAD01:~# netstat -a Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 *:ssh *:* LISTEN tcp 0 0 RAD01:37518 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37534 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37528 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37513 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37523 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37533 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37517 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37531 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37512 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37529 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:ssh cpe-xx.xx.xx.xx.:42502 ESTABLISHED tcp 0 0 RAD01:37519 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37530 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:ssh xx.xx.xx.xx.s:45758 ESTABLISHED tcp 0 0 RAD01:37516 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37515 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37514 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37511 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37510 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37522 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37526 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37521 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37525 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37524 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37520 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37527 xx.xx.xx.xx.s:mysql ESTABLISHED tcp 0 0 RAD01:37532 xx.xx.xx.xx.s:mysql ESTABLISHED tcp6 0 0 [::]:ssh [::]:* LISTEN udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 4 [ ] DGRAM 3587 /dev/log unix 2 [ ACC ] STREAM LISTENING 2363 @/com/ubuntu/upstart unix 2 [ ] DGRAM 2429 @/org/kernel/udev/udevd unix 2 [ ] DGRAM 3868 unix 2 [ ] DGRAM 3813 unix 3 [ ] DGRAM 2432 unix 3 [ ] DGRAM 2431 unix 3 [ ] STREAM CONNECTED 2415 @/com/ubuntu/upstart unix 3 [ ] STREAM CONNECTED 2414 Note how it appears that ports 1812 and 1813 do not have anything listening... *DEBUG NETWORK* Now, after seeing this, I thought maybe I have a firewall active or something. But upon further investigation, I found that iptables has no rules: root@RAD01:~# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination And that my server is on a public IP (our radius server is hosted in the rackspace cloud, no firewall or anything as far as I know). *CONFIG FILES* Here are my freeradius configuration files. I've put them on a pastebin because I didn't want to make this email immensely long. Please have a look at them if you have any questions. http://pastie.org/893100 *CISCO SETUP* As I mentioned earlier, my freeradius *client* in this setup is my Cisco AS5400. When I have radius debugging turned on, on my cisco, here is some debugging output from a call. As you can see, it says that the server is not online. When I make calls, I see no activity in my freeradius debug window. So it seems that the packets aren't getting to freeradius from my cisco. *Jan 2 08:47:02.895: AAA/BIND(00000190): Bind i/f Serial7/0:15:23 *Jan 2 08:47:02.899: AAA/BIND(00000191): Bind i/f *Jan 2 08:47:02.903: RADIUS/ENCODE(00000191):Orig. component type = VOICE *Jan 2 08:47:02.903: RADIUS(00000191): Config NAS IP: 0.0.0.0 *Jan 2 08:47:02.903: RADIUS(00000191): sending *Jan 2 08:47:02.903: RADIUS/ENCODE: Best Local IP-Address 10.0.2.1 for Radius-Server xx.xx.xx.xx *Jan 2 08:47:02.907: RADIUS(00000191): Send Accounting-Request to xx.xx.xx.xx:1813 id 1646/154, len 128 *Jan 2 08:47:02.907: RADIUS: authenticator 5A 66 34 6D 47 00 B7 9E - BD 76 22 42 14 B6 A1 59 *Jan 2 08:47:02.907: RADIUS: Acct-Session-Id [44] 18 "0200000000000253" *Jan 2 08:47:02.907: RADIUS: Calling-Station-Id [31] 12 "8182179228" *Jan 2 08:47:02.907: RADIUS: Called-Station-Id [30] 12 "2172386245" *Jan 2 08:47:02.907: RADIUS: User-Name [1] 12 "8182179228" *Jan 2 08:47:02.907: RADIUS: Acct-Status-Type [40] 6 Start [1] *Jan 2 08:47:02.907: RADIUS: NAS-Port-Type [61] 6 Async [0] *Jan 2 08:47:02.907: RADIUS: NAS-Port [5] 6 0 *Jan 2 08:47:02.907: RADIUS: NAS-Port-Id [87] 18 "ISDN 7/7:15:D:24" *Jan 2 08:47:02.907: RADIUS: Service-Type [6] 6 Login [1] *Jan 2 08:47:02.907: RADIUS: NAS-IP-Address [4] 6 10.0.2.1 *Jan 2 08:47:02.907: RADIUS: Acct-Delay-Time [41] 6 0 *Jan 2 08:47:07.655: RADIUS: acct-timeout for 4012ECE4 now 5, acct-jitter 4294967295, acct-delay-time (at 4012ED5E) now 4 *Jan 2 08:47:07.655: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:07.655: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/155 *Jan 2 08:47:12.687: RADIUS: acct-timeout for 4012ECE4 now 9, acct-jitter 0, acct-delay-time (at 4012ED5E) now 9 *Jan 2 08:47:12.687: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:12.687: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/156 *Jan 2 08:47:14.947: RADIUS/ENCODE(00000191):Orig. component type = VOICE *Jan 2 08:47:14.947: RADIUS(00000191): Config NAS IP: 0.0.0.0 *Jan 2 08:47:14.947: RADIUS(00000191): sending *Jan 2 08:47:14.951: RADIUS/ENCODE: Best Local IP-Address xx.xx.xx.xx for Radius-Server xx.xx.xx.xx *Jan 2 08:47:14.951: RADIUS(00000191): Send Accounting-Request to xx.xx.xx.xx:1813 id 1646/157, len 158 *Jan 2 08:47:14.951: RADIUS: authenticator 6F 5D 1E 4E CC 63 E0 A1 - 64 3B 75 46 FF 42 65 55 *Jan 2 08:47:14.951: RADIUS: Acct-Session-Id [44] 18 "0200000000000253" *Jan 2 08:47:14.951: RADIUS: Calling-Station-Id [31] 12 "8182179228" *Jan 2 08:47:14.951: RADIUS: Called-Station-Id [30] 12 "2172386245" *Jan 2 08:47:14.951: RADIUS: Acct-Input-Octets [42] 6 94880 *Jan 2 08:47:14.951: RADIUS: Acct-Output-Octets [43] 6 95520 *Jan 2 08:47:14.951: RADIUS: Acct-Input-Packets [47] 6 593 *Jan 2 08:47:14.951: RADIUS: Acct-Output-Packets [48] 6 597 *Jan 2 08:47:14.951: RADIUS: Acct-Session-Time [46] 6 12 *Jan 2 08:47:14.951: RADIUS: User-Name [1] 12 "8182179228" *Jan 2 08:47:14.951: RADIUS: Acct-Status-Type [40] 6 Stop [2] *Jan 2 08:47:14.951: RADIUS: NAS-Port-Type [61] 6 Async [0] *Jan 2 08:47:14.951: RADIUS: NAS-Port [5] 6 0 *Jan 2 08:47:14.951: RADIUS: NAS-Port-Id [87] 18 "ISDN 7/7:15:D:24" *Jan 2 08:47:14.951: RADIUS: Service-Type [6] 6 Login [1] *Jan 2 08:47:14.951: RADIUS: NAS-IP-Address [4] 6 10.0.2.1 *Jan 2 08:47:14.951: RADIUS: Acct-Delay-Time [41] 6 0 *Jan 2 08:47:17.559: RADIUS: acct-timeout for 4012ECE4 now 14, acct-jitter 0, acct-delay-time (at 4012ED5E) now 14 *Jan 2 08:47:17.559: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:17.559: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/158 *Jan 2 08:47:19.871: RADIUS: acct-timeout for 4013486C now 5, acct-jitter 4294967295, acct-delay-time (at 40134904) now 4 *Jan 2 08:47:19.871: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:19.871: %RADIUS-4-RADIUS_DEAD: RADIUS server xx.xx.xx.xx:1812,1813 is not responding. *Jan 2 08:47:19.871: %RADIUS-4-RADIUS_ALIVE: RADIUS server xx.xx.xx.xx:1812,1813 has returned. *Jan 2 08:47:19.871: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/159 *Jan 2 08:47:22.527: RADIUS: acct-timeout for 4012ECE4 now 19, acct-jitter 0, acct-delay-time (at 4012ED5E) now 19 *Jan 2 08:47:22.527: RADIUS: no sg in radius-timers: ctx 0x66F7FB78 sg 0x0000 *Jan 2 08:47:22.527: RADIUS: No response from (xx.xx.xx.xx:1812,1813) for id 1646/158 *Jan 2 08:47:22.527: RADIUS/DECODE: No response from radius-server; parse response; FAIL *Jan 2 08:47:22.527: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL *Jan 2 08:47:24.903: RADIUS: acct-timeout for 4013486C now 9, acct-jitter 0, acct-delay-time (at 40134904) now 9 *Jan 2 08:47:24.903: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:24.903: RADIUS: Retransmit to (173.203.117.112:1812,1813) for id 1646/161 *Jan 2 08:47:29.415: RADIUS: acct-timeout for 4013486C now 14, acct-jitter 0, acct-delay-time (at 40134904) now 14 *Jan 2 08:47:29.415: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:29.415: RADIUS: Retransmit to (xx.xx.xx.xx:1812,1813) for id 1646/162 *Jan 2 08:47:34.415: RADIUS: acct-timeout for 4013486C now 19, acct-jitter 0, acct-delay-time (at 40134904) now 19 *Jan 2 08:47:34.415: RADIUS: no sg in radius-timers: ctx 0x67045494 sg 0x0000 *Jan 2 08:47:34.415: RADIUS: No response from (xx.xx.xx.xx:1812,1813) for id 1646/162 *Jan 2 08:47:34.415: RADIUS/DECODE: No response from radius-server; parse response; FAIL *Jan 2 08:47:34.415: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL *HELP!* OK, so sorry for this terribly long email, but I hope that this has provided enough information for you guys to help me debug what the heck is going wrong here. I've spent tons of hours trying to resolve this to no avail. I'm out of ideas. Thanks so much for all of your help, this has been a really irritating and frustrating experience. I'm hoping that if anyone else has the same problem, this thread may help them later on. Thanks! -Randall

5 7

Handling dynamic IPs for clients
by Fahd Kasri 31 Mar '10

31 Mar '10

Hi all, I have several clients connected to my freeradius server, but these clients have dynamic IPs. I have setup scripts on the clients for sending their IPs to the server and scripts on the server to restart freeradius when an IP address has changed. The problem is that there is always someone that won't be able to be authenticated because the client's IP hasn't been refreshed on the server. Is anybody in a similar situation? If so, do you have a better solution? Thanks. -- Fahd

2 1