October 2011 - Freeradius-Users - lists.freeradius.org

Re: FreeRadius with Eduroam - Accounting
by Mike Diggins 15 Oct '11

15 Oct '11

On Tue, 4 Oct 2011, Mike Diggins wrote: > > I'm running FreeRadius 2.1.3 on RedHat Enterprise Linux configured as an > Eduroam Radius proxy server. My Cisco Wireless Lan Controllers are constantly > failing over the Accounting Servers, due to lack of response from the Home > Servers, or so says the log. However, I believe the issue is that some remote > institutions Radius Servers are ignoring the Accounting packets, and timing > out my end, making it believe the Home Servers have failed to respond. > FreeRadius responds by marking the Home server dead. It then sends a > status-server query, to which is gets a reply, and enables the Dead Home > server. I believe that's the sequence of events anyway. I captured some of > that in debug mode: > > Rejecting request 288 due to lack of any response from home server x.x.x.x > port 1813 > > Finished request 288. > > Cleaning up request 288 ID 205 with timestamp +1161 > > PROXY: Marking home server x.x.x.x port 1813 as zombie (it looks like it is > dead). > > Sending Status-Server of id 55 to x.x.x.x port 1813 > Message-Authenticator := 0x00000000000000000000000000000000 > NAS-Identifier := "Status Check. Are you alive?" > Waking up in 3.9 seconds. > > rad_recv: Access-Accept packet from host x.x.x.x port 1813, id=55, length=806 > > I don't have any control over Accounting Packets being accepted, or not, by > other Eduroam members. Some do, some don't I imagine. Is there a > configuration for FreeRadius that handles this situation cleanly? Seems to me > that FR should check the Home server first, before marking it dead (at > least). Accounting feature on the WLAN controllers (for now), I noticed that a similar failure is a happening on the Authentication side. Some authentication requests proxied to other radius servers (via Eduroam) are either failing or taking a long time to respond, which also causes my FreeRadius to mark the Home Server as DOWN. That also seems to cause a chain reaction of backed up requests, causing my WLAN controllers to failover the radius server. So, similar to my Accounting problem, is there anyway to prevent a single Authentication failure from backing up the works!? Does FR answer queries in sequence only? I don't really understand why this sort of failure has such a nasty consequence. -Mike

3 5

Policy construct for string "concatenation"
by Ray Scholl 15 Oct '11

15 Oct '11

Good afternoon: I was hoping to see if anyone could provide the best syntax to concatenate two strings being used in a comparison (policy.conf). Synopsis: We intend to compare an LDAP group name to a Freeradius shortname, but we want the shortname to be "shortname" ++ "otp". The existing syntax (which we believe will work) is : if ( clients_ldap-Ldap-Group == FreeRadius-Client-Shortname) New syntax : if ( clients_ldap-Ldap-Group == ) The Manpage for unlang references double quotes around variable, but one is a constant. Should I declare a variable and then quote them - "FreeRadius-Client-Shortname vOTP" Thanks in advance, Ray

4 7

(no subject)
by OzSpots - Carl Sawers 14 Oct '11

14 Oct '11

Hi All, I have searched high and low for a Radacct Terminate cause description for Freeradius, the terminate cause states "Lost-Session" , anyone know what it refers too? Regards Carl

3 2

Re: Newbie starting up - with problem, of course; and questions
by Dale Grice 14 Oct '11

14 Oct '11

>> I am running freeradius 2.1.10 on Debian 6.0.3. >> >> What startup script in Debian starts freeradius? I would like to add the >> -X option to it. >> >> My first problem is I can't get radtest to work. The only thing I have >> modified is the User file. I searched the FAQs and maillist archives to no >> avail. >> >> Top lines in User file: >> bob Cleartext-Password := "hello" >> Reply-Message = "Hello, BOB" >> testing Cleartext-Password := "password" >> Reply-Message = "Testing in Progress" >> # >> >> My radtest: >> root@Mikado:/etc/freeradius# radtest bob hello localhost 0 testing123 >> Sending Access-Request of id 171 to 127.0.0.1 port 1812 >> User-Name = "bob" >> User-Password = "hello" >> NAS-IP-Address = 10.56.1.11 >> NAS-Port = 0 >> radclient: Failed to send packet for ID 171: (unknown error) >> Sending Access-Request of id 171 to 127.0.0.1 port 1812 >> User-Name = "bob" >> User-Password = "hello" >> NAS-IP-Address = 10.56.1.11 >> NAS-Port = 0 >> radclient: Failed to send packet for ID 171: (unknown error) >> Sending Access-Request of id 171 to 127.0.0.1 port 1812 >> User-Name = "bob" >> User-Password = "hello" >> NAS-IP-Address = 10.56.1.11 >> NAS-Port = 0 >> radclient: Failed to send packet for ID 171: (unknown error) >> radclient: no response from server for ID 171 socket 3 >> >> >> Debug output: >> >> FreeRADIUS Version 2.1.10, for host i486-pc-kfreebsd-gnu, built on Nov 15 >> 2010 at 09:02:02 >> Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. >> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >> PARTICULAR PURPOSE. >> You may redistribute copies of FreeRADIUS under the terms of the >> GNU General Public License v2. >> Starting - reading configuration files ... >> including configuration file /etc/freeradius/radiusd.conf >> including configuration file /etc/freeradius/proxy.conf >> including configuration file /etc/freeradius/clients.conf >> including files in directory /etc/freeradius/modules/ >> including configuration file /etc/freeradius/modules/always >> including configuration file /etc/freeradius/modules/attr_filter >> including configuration file /etc/freeradius/modules/attr_rewrite >> including configuration file /etc/freeradius/modules/chap >> including configuration file /etc/freeradius/modules/checkval >> including configuration file /etc/freeradius/modules/counter >> including configuration file /etc/freeradius/modules/cui >> including configuration file /etc/freeradius/modules/detail >> including configuration file /etc/freeradius/modules/detail.example.com >> including configuration file /etc/freeradius/modules/detail.log >> including configuration file /etc/freeradius/modules/digest >> including configuration file /etc/freeradius/modules/dynamic_clients >> including configuration file /etc/freeradius/modules/echo >> including configuration file /etc/freeradius/modules/etc_group >> including configuration file /etc/freeradius/modules/exec >> including configuration file /etc/freeradius/modules/expiration >> including configuration file /etc/freeradius/modules/expr >> including configuration file /etc/freeradius/modules/files >> including configuration file /etc/freeradius/modules/inner-eap >> including configuration file /etc/freeradius/modules/ippool >> including configuration file /etc/freeradius/modules/krb5 >> including configuration file /etc/freeradius/modules/ldap >> including configuration file /etc/freeradius/modules/linelog >> including configuration file /etc/freeradius/modules/logintime >> including configuration file /etc/freeradius/modules/mac2ip >> including configuration file /etc/freeradius/modules/mschap >> including configuration file /etc/freeradius/modules/mac2vlan >> including configuration file /etc/freeradius/modules/ntlm_auth >> including configuration file /etc/freeradius/modules/opendirectory >> including configuration file /etc/freeradius/modules/otp >> including configuration file /etc/freeradius/modules/pam >> including configuration file /etc/freeradius/modules/pap >> including configuration file /etc/freeradius/modules/passwd >> including configuration file /etc/freeradius/modules/perl >> including configuration file /etc/freeradius/modules/policy >> including configuration file /etc/freeradius/modules/preprocess >> including configuration file /etc/freeradius/modules/radutmp >> including configuration file /etc/freeradius/modules/realm >> including configuration file /etc/freeradius/modules/smbpasswd >> including configuration file /etc/freeradius/modules/smsotp >> including configuration file /etc/freeradius/modules/sql_log >> including configuration file >> /etc/freeradius/modules/sqlcounter_expire_on_login >> including configuration file /etc/freeradius/modules/sradutmp >> including configuration file /etc/freeradius/modules/unix >> including configuration file /etc/freeradius/modules/wimax >> including configuration file /etc/freeradius/modules/acct_unique >> including configuration file /etc/freeradius/eap.conf >> including configuration file /etc/freeradius/policy.conf >> including files in directory /etc/freeradius/sites-enabled/ >> including configuration file /etc/freeradius/sites-enabled/default >> including configuration file /etc/freeradius/sites-enabled/inner-tunnel >> main { >> user = "freerad" >> group = "freerad" >> allow_core_dumps = no >> } >> including dictionary file /etc/freeradius/dictionary >> main { >> prefix = "/usr" >> localstatedir = "/var" >> logdir = "/var/log/freeradius" >> libdir = "/usr/lib/freeradius" >> radacctdir = "/var/log/freeradius/radacct" >> hostname_lookups = no >> max_request_time = 30 >> cleanup_delay = 5 >> max_requests = 1024 >> pidfile = "/var/run/freeradius/freeradius.pid" >> checkrad = "/usr/sbin/checkrad" >> debug_level = 0 >> proxy_requests = yes >> log { >> stripped_names = no >> auth = no >> auth_badpass = no >> auth_goodpass = no >> } >> security { >> max_attributes = 200 >> reject_delay = 1 >> status_server = yes >> } >> } >> radiusd: #### Loading Realms and Home Servers #### >> proxy server { >> retry_delay = 5 >> retry_count = 3 >> default_fallback = no >> dead_time = 120 >> wake_all_if_all_dead = no >> } >> home_server localhost { >> ipaddr = 127.0.0.1 >> port = 1812 >> type = "auth" >> secret = "testing123" >> response_window = 20 >> max_outstanding = 65536 >> require_message_authenticator = yes >> zombie_period = 40 >> status_check = "status-server" >> ping_interval = 30 >> check_interval = 30 >> num_answers_to_alive = 3 >> num_pings_to_alive = 3 >> revive_interval = 120 >> status_check_timeout = 4 >> irt = 2 >> mrt = 16 >> mrc = 5 >> mrd = 30 >> } >> home_server_pool my_auth_failover { >> type = fail-over >> home_server = localhost >> } >> realm example.com { >> auth_pool = my_auth_failover >> } >> realm LOCAL { >> } >> radiusd: #### Loading Clients #### >> client localhost { >> ipaddr = 127.0.0.1 >> require_message_authenticator = no >> secret = "testing123" >> nastype = "other" >> } >> radiusd: #### Instantiating modules #### >> instantiate { >> Module: Linked to module rlm_exec >> Module: Instantiating module "exec" from file >> /etc/freeradius/modules/exec >> exec { >> wait = no >> input_pairs = "request" >> shell_escape = yes >> } >> Module: Linked to module rlm_expr >> Module: Instantiating module "expr" from file >> /etc/freeradius/modules/expr >> Module: Linked to module rlm_expiration >> Module: Instantiating module "expiration" from file >> /etc/freeradius/modules/expiration >> expiration { >> reply-message = "Password Has Expired " >> } >> Module: Linked to module rlm_logintime >> Module: Instantiating module "logintime" from file >> /etc/freeradius/modules/logintime >> logintime { >> reply-message = "You are calling outside your allowed timespan " >> minimum-timeout = 60 >> } >> } >> radiusd: #### Loading Virtual Servers #### >> server inner-tunnel { # from file >> /etc/freeradius/sites-enabled/inner-tunnel >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Linked to module rlm_pap >> Module: Instantiating module "pap" from file /etc/freeradius/modules/pap >> pap { >> encryption_scheme = "auto" >> auto_header = no >> } >> Module: Linked to module rlm_chap >> Module: Instantiating module "chap" from file >> /etc/freeradius/modules/chap >> Module: Linked to module rlm_mschap >> Module: Instantiating module "mschap" from file >> /etc/freeradius/modules/mschap >> mschap { >> use_mppe = yes >> require_encryption = no >> require_strong = no >> with_ntdomain_hack = no >> } >> Module: Linked to module rlm_unix >> Module: Instantiating module "unix" from file >> /etc/freeradius/modules/unix >> unix { >> radwtmp = "/var/log/freeradius/radwtmp" >> } >> Module: Linked to module rlm_eap >> Module: Instantiating module "eap" from file /etc/freeradius/eap.conf >> eap { >> default_eap_type = "md5" >> timer_expire = 60 >> ignore_unknown_eap_types = no >> cisco_accounting_username_bug = no >> max_sessions = 4096 >> } >> Module: Linked to sub-module rlm_eap_md5 >> Module: Instantiating eap-md5 >> Module: Linked to sub-module rlm_eap_leap >> Module: Instantiating eap-leap >> Module: Linked to sub-module rlm_eap_gtc >> Module: Instantiating eap-gtc >> gtc { >> challenge = "Password: " >> auth_type = "PAP" >> } >> Module: Linked to sub-module rlm_eap_tls >> Module: Instantiating eap-tls >> tls { >> rsa_key_exchange = no >> dh_key_exchange = yes >> rsa_key_length = 512 >> dh_key_length = 512 >> verify_depth = 0 >> CA_path = "/etc/freeradius/certs" >> pem_file_type = yes >> private_key_file = "/etc/freeradius/certs/server.key" >> certificate_file = "/etc/freeradius/certs/server.pem" >> CA_file = "/etc/freeradius/certs/ca.pem" >> private_key_password = "whatever" >> dh_file = "/etc/freeradius/certs/dh" >> random_file = "/dev/urandom" >> fragment_size = 1024 >> include_length = yes >> check_crl = no >> cipher_list = "DEFAULT" >> make_cert_command = "/etc/freeradius/certs/bootstrap" >> cache { >> enable = no >> lifetime = 24 >> max_entries = 255 >> } >> verify { >> } >> } >> Module: Linked to sub-module rlm_eap_ttls >> Module: Instantiating eap-ttls >> ttls { >> default_eap_type = "md5" >> copy_request_to_tunnel = no >> use_tunneled_reply = no >> virtual_server = "inner-tunnel" >> include_length = yes >> } >> Module: Linked to sub-module rlm_eap_peap >> Module: Instantiating eap-peap >> peap { >> default_eap_type = "mschapv2" >> copy_request_to_tunnel = no >> use_tunneled_reply = no >> proxy_tunneled_request_as_eap = yes >> virtual_server = "inner-tunnel" >> } >> Module: Linked to sub-module rlm_eap_mschapv2 >> Module: Instantiating eap-mschapv2 >> mschapv2 { >> with_ntdomain_hack = no >> } >> Module: Checking authorize {...} for more modules to load >> Module: Linked to module rlm_realm >> Module: Instantiating module "suffix" from file >> /etc/freeradius/modules/realm >> realm suffix { >> format = "suffix" >> delimiter = "@" >> ignore_default = no >> ignore_null = no >> } >> Module: Linked to module rlm_files >> Module: Instantiating module "files" from file >> /etc/freeradius/modules/files >> files { >> usersfile = "/etc/freeradius/users" >> acctusersfile = "/etc/freeradius/acct_users" >> preproxy_usersfile = "/etc/freeradius/preproxy_users" >> compat = "no" >> } >> Module: Checking session {...} for more modules to load >> Module: Linked to module rlm_radutmp >> Module: Instantiating module "radutmp" from file >> /etc/freeradius/modules/radutmp >> radutmp { >> filename = "/var/log/freeradius/radutmp" >> username = "%{User-Name}" >> case_sensitive = yes >> check_with_nas = yes >> perm = 384 >> callerid = yes >> } >> Module: Checking post-proxy {...} for more modules to load >> Module: Checking post-auth {...} for more modules to load >> Module: Linked to module rlm_attr_filter >> Module: Instantiating module "attr_filter.access_reject" from file >> /etc/freeradius/modules/attr_filter >> attr_filter attr_filter.access_reject { >> attrsfile = "/etc/freeradius/attrs.access_reject" >> key = "%{User-Name}" >> } >> } # modules >> } # server >> server { # from file /etc/freeradius/radiusd.conf >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Linked to module rlm_digest >> Module: Instantiating module "digest" from file >> /etc/freeradius/modules/digest >> Module: Checking authorize {...} for more modules to load >> Module: Linked to module rlm_preprocess >> Module: Instantiating module "preprocess" from file >> /etc/freeradius/modules/preprocess >> preprocess { >> huntgroups = "/etc/freeradius/huntgroups" >> hints = "/etc/freeradius/hints" >> with_ascend_hack = no >> ascend_channels_per_line = 23 >> with_ntdomain_hack = no >> with_specialix_jetstream_hack = no >> with_cisco_vsa_hack = no >> with_alvarion_vsa_hack = no >> } >> Module: Checking preacct {...} for more modules to load >> Module: Linked to module rlm_acct_unique >> Module: Instantiating module "acct_unique" from file >> /etc/freeradius/modules/acct_unique >> acct_unique { >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, >> Client-IP-Address, NAS-Port" >> } >> Module: Checking accounting {...} for more modules to load >> Module: Linked to module rlm_detail >> Module: Instantiating module "detail" from file >> /etc/freeradius/modules/detail >> detail { >> detailfile = >> "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" >> header = "%t" >> detailperm = 384 >> dirperm = 493 >> locking = no >> log_packet_header = no >> } >> Module: Instantiating module "attr_filter.accounting_response" from file >> /etc/freeradius/modules/attr_filter >> attr_filter attr_filter.accounting_response { >> attrsfile = "/etc/freeradius/attrs.accounting_response" >> key = "%{User-Name}" >> } >> Module: Checking session {...} for more modules to load >> Module: Checking post-proxy {...} for more modules to load >> Module: Checking post-auth {...} for more modules to load >> } # modules >> } # server >> radiusd: #### Opening IP addresses and Ports #### >> listen { >> type = "auth" >> ipaddr = * >> port = 0 >> } >> listen { >> type = "acct" >> ipaddr = * >> port = 0 >> } >> listen { >> type = "auth" >> ipaddr = 127.0.0.1 >> port = 18120 >> } >> Listening on authentication address * port 1812 >> Listening on accounting address * port 1813 >> Listening on authentication address 127.0.0.1 port 18120 as server >> inner-tunnel >> Listening on proxy address * port 1814 >> Ready to process requests. >> >> >> Thanks for your patience and replies, >> >> Dale >> >> -- >> >> Dale Grice >> >> Staff Engineer, Lab Architect; Motorola >> >> >> >> > > >

3 3

EAP-TLS + Symbian = weird behaviour
by Zeus V Panchenko 14 Oct '11

14 Oct '11

Hi, may somebody advice, please i have: > uname FreeBSD 8.1-RELEASE amd64 > radiusd -v radiusd: FreeRADIUS Version 2.1.10, for host amd64-portbld-freebsd8.1, built on Apr 4 2011 at 22:44:15 radiusd configured with EAP-TLS only and works fine with xNIX-es, WinXP, Android and Maemo with Symbian (Nokia E51, E52) i face much weird picture ... the same device works fine (getting authorized well) via one AP in my LAN and remote VPN, but receiving !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session for state ... did not finish! !! Please read http://wiki.freeradius.org/Certificate_Compatibility !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! via another AP (in remote VPN, while other OS still authorized well) AP are the same models and configured the same way what can cause this behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 6

terminate session
by OzSpots - Carl Sawers 13 Oct '11

13 Oct '11

Hi All, I am using the latest freeradius and coovachilli and am having a terminate session problem. Some user sessions are not stopping, the session time shown in the DB stops but the user does not logout and there is also no reason given in the DB for termination... The user can also go over the ChilliSpot-Max-Total-Octets quota and the Idle-Timeout does not appear to work. How does radius send a stop session command to the coovachilli router, perhaps that's where the issues is? Regards Carl

3 3

Fast session resumption memory leak?
by Phil Mayers 13 Oct '11

13 Oct '11

All, We recently upgraded to 2.1.12 and I have at the same time enabled SSL fast session resumption; in the last 6 days, FreeRADIUS on the server that is currently handling most of our auth has consumed 27% of the RAM. Is anyone else running fast session resumption and seeing these symptoms, or not?

4 7

PEAP/MSCHAPv2 / Freeradius / AD
by Kevin Chan 13 Oct '11

13 Oct '11

Hi all, hopefully i got to the right group of people. We are trying to use Freeradius to do PEAP/MSCHAPv2 authentication against Active Directory (2003). Our realm is abc.acme.edu, but since Eduroam doesn't allow subdomain, end user has to use bob(a)acme.edu instead bob(a)abc.acme.edu as username. My question is can you modify the realm behind the user's back? (during EAP process). Kevin

3 3

Broken Pipe with ssh
by Sergio Belkin 13 Oct '11

13 Oct '11

Hi, Ssh users are suffering of broken pipe when NASes use the WPA Enterprise schema. I wonder is I have something misconfigured that is causing nosense reconnection or thinks alike. Please could could you help me and take a look to my config and tell me if I should fix something? Thanks in advance! FreeRADIUS Version 2.1.1, for host x86_64-unknown-linux-gnu, built on Oct 21 2008 at 15:14:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/files.backup including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/status including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default.backup including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap group = radiusd user = radiusd including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client spectrum { require_message_authenticator = no secret = "testing123" shortname = "spectrum.sarlanga.edu" } client 10.128.255.100 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-PB" } client 10.128.255.10 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-SS" } client 10.128.255.11 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-1" } client 10.128.255.254 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "Transitional" } client 10.128.255.12 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-2" } client 10.128.255.111 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-2-bis" } client 10.128.255.13 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-3" } client 10.128.255.14 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-4" } client 10.128.255.15 { require_message_authenticator = no secret = "sarlangalad0-Red-3-winnie" shortname = "AP-PI-5" } client 10.128.255.60 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-Sociales-0" } client 10.128.255.61 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-Sociales-I" } client 10.128.255.158 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-SS" } client 10.128.255.80 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-PB" } client 10.128.255.81 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-I" } client 10.128.255.82 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-II" } client 10.128.255.182 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-I_bis_test" } client 10.128.255.83 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-III" } client 10.128.255.84 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-IV" } client 10.128.255.181 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-I_bis" } client 10.128.255.162 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-I_bis_2" } client 10.128.255.86 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-VI" } client 10.128.255.87 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-VII" } client 10.128.255.52 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PV-PB" } client 10.128.255.85 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-V" } client 10.128.255.189 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-IX-HD" } client 10.128.255.88 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-PVIII-VIII" } client 10.128.255.89 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "oficina-test" } client 10.128.255.160 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-Sociales-Auditorio" } client 10.128.255.90 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "sarlanga-X" } client 192.168.2.53 { require_message_authenticator = no secret = "akantilad0-Green-22" shortname = "sarlanga3" } client 192.168.45 { require_message_authenticator = no secret = "sarlangalad0-black-54" shortname = "sarlanga4" } client 192.168.3.201 { require_message_authenticator = no secret = "sarlangalad0-blue-246692" shortname = "sarlanga7" } client 192.168.4 { require_message_authenticator = no secret = "sarlangalad0-Red-3ieriooiweorioeioreiroeioiraida3948390849hsajhdajd" shortname = "AP-sarlanga7" } client 192.168.142.240 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-Cabre-1" } client 192.168.142.241 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-Cabre-2" } client 192.168.142.242 { require_message_authenticator = no secret = "sarlangalad0-Red-398952" shortname = "AP-Cabre-3" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server status { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } } } server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "ldap.sarlanga.edu" port = 636 password = "sarlanga" identity = "cn=freeradius,ou=applications,dc=sarlanga,dc=edu" net_timeout = 10 timeout = 120 timelimit = 30 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/raddb/cacert.pem" randfile = "/dev/urandom" require_cert = "demand" } basedn = "ou=people,dc=sarlanga,dc=edu" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr = "radiusAllowed" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 15 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusPassword mapped to RADIUS Cleartext-Password conns: 0x4543bc0 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 600 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/pki/tls/certs/ips-spectrum-key.pem" certificate_file = "/etc/pki/tls/certs/spectrum.sarlanga.edu.cer" CA_file = "/etc/pki/tls/certs/IPS-IPSCABUNDLE.crt" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = yes lifetime = 6 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel-peap" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating post_proxy_log detail post_proxy_log { detailfile = "/usr/local/var/log/radius/radacct/postproxy/%{Client-IP-Address}/post-proxy-detail-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/replies/%{Client-IP-Address}/reply-detail-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server inner-tunnel-peap { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Instantiating auth_log detail auth_log { detailfile = "/usr/local/var/log/radius/radacct/requests/%{Client-IP-Address}/auth-detail-%{NAS-Identifier}-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.1.5 port = 0 } listen { type = "acct" ipaddr = 192.168.1.5 port = 0 } listen { type = "status" ipaddr = 127.0.0.1 port = 18120 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "YellowSubmarine" } } Listening on authentication address 192.168.1.5 port 1812 Listening on accounting address 192.168.1.5 port 1813 Listening on status address 127.0.0.1 port 18120 as server status Ready to process requests. -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

4 4

FreeRadius with Eduroam - Accounting
by Mike Diggins 13 Oct '11

13 Oct '11

I'm running FreeRadius 2.1.3 on RedHat Enterprise Linux configured as an Eduroam Radius proxy server. My Cisco Wireless Lan Controllers are constantly failing over the Accounting Servers, due to lack of response from the Home Servers, or so says the log. However, I believe the issue is that some remote institutions Radius Servers are ignoring the Accounting packets, and timing out my end, making it believe the Home Servers have failed to respond. FreeRadius responds by marking the Home server dead. It then sends a status-server query, to which is gets a reply, and enables the Dead Home server. I believe that's the sequence of events anyway. I captured some of that in debug mode: Rejecting request 288 due to lack of any response from home server x.x.x.x port 1813 Finished request 288. Cleaning up request 288 ID 205 with timestamp +1161 PROXY: Marking home server x.x.x.x port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 55 to x.x.x.x port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. rad_recv: Access-Accept packet from host x.x.x.x port 1813, id=55, length=806 I don't have any control over Accounting Packets being accepted, or not, by other Eduroam members. Some do, some don't I imagine. Is there a configuration for FreeRadius that handles this situation cleanly? Seems to me that FR should check the Home server first, before marking it dead (at least). -Mike

5 13