December 2011 - Freeradius-Users - lists.freeradius.org

traffic limiting & QoS attributes (noob RADIUS question)
by Rogelio 05 Dec '11

05 Dec '11

I'm looking up how RADIUS can limit / throttle various traffic, and I'm wondering what attributes there are that do this. The application would be for an ISP that wants to throttle users who attach to a certain access point. People who attach would then authenticate to RADIUS and then get assigned a certain profile (say, "best effort" and "premium"). I'm new to RADIUS, and I'm hoping to see what types of QoS is available at the RADIUS level so that I can see what other QoS stuff we might need to put in place. thx in advance! Rogelio

2 1

Freeradius 2 and sqlippools
by baddah 05 Dec '11

05 Dec '11

Hi, I've set up freeradius 2, and want to get it working with sqlippools. Everything works fine, but i cannot get the sql ippool to overwrite a Framed-IP-Address (if a Framed-IP-Address attribute exists for a username). Previously i used freeradius 1.1.3 and i had my ippools in the radiusd.conf file. When declaring the pools, it had a option overwrite=yes which override a Framed-IP-Address if already set. The effect was that it would take preference of the pool over the Framed-IP-Address, which is exactly what i want to achieve now using freeradius 2 and sql ip pools. I cannot see to find how/where i can set this option. Anyone have a suggestion for me? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-2-and-sqlippools-tp50488… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

access reject
by Harish Mandowara 05 Dec '11

05 Dec '11

Hi all, i am connecting network-manager to freeradius server. It showing access reject. I am using server.crt which is provided by freeradius it self. Please check and reply. error paste below rad_recv: Access-Request packet from host 192.168.21.2 port 32768, id=0, length=153 Cleaning up request 95 ID 0 with timestamp +543 User-Name = "testing123" NAS-IP-Address = 192.168.21.2 Called-Station-Id = "30469a872e66" Calling-Station-Id = "1caff76ce38c" NAS-Identifier = "30469a872e66" NAS-Port = 3 Framed-MTU = 1400 State = 0x05139c0406178548b5e80cb0708716d1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204001119800000000715030100020230 Message-Authenticator = 0xfd142706451c8cf676b90ad74a062ecb # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing123", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 17 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 96 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 96 Sending Access-Reject of id 0 to 192.168.21.2 port 32768 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. -- Warm Regards Harish Mandowara -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Re: EAP/TLS authentication in 2050
by Victor Guk 05 Dec '11

05 Dec '11

> This error comes from within OpenSSL. FreeRADIUS just does what OpenSSL > tells it. > > Can you verify the cert with the "openssl verify ..." test command? e.g. > try this: > > openssl verify -CAfile ca.pem -purpose sslserver server.pem freeradius:/usr/local/CA # openssl verify -CAfile cacert.pem -purpose sslserver cert-srv.pem cert-srv.pem: OK > > If this fails as well, then it's either a problem in OpenSSL or your > system libraries with dates>2050. If it succeeds (which I doubt) then > FreeRADIUS should work too. > > I sort of admire your effort to future-proof your certs though! ;o) > why? > > really, why? wat purpose does testing these dates have - you really think > your current infrastructure, and techologies such as 802.1X are going > to be around in the same format in even 20 years time? No, of course not :) This is my curiosity led me to test such date. > > anyway....I'm guessing these are 32 bit server and client OS ? > > you may find, in that case, that your tests will work until you set the > date beyond 2037 - 32bit OS have problems with dates after 2038 > > so, try this with KNOWN parameters - eg 2020 , within the 2038 > timeframe and things should work. The server is running SLES 11 SP1 (x86_64), a workstation running Windows XP SP3 (32bit). Authentication is successful until February 1, 2050, ie for example if you logged in December 31, 2049, then the authentication is successful. A little later, try the client computer under the control of 64bit. the results announced later.

1 0

EAP/TLS authentication in 2050
by Victor Guk 05 Dec '11

05 Dec '11

Hello I have SLES 11 SP1(64bit), freeradius 2.1.12 and openssl 0.9.8r. I set up authentication with EAP/TLS. Server and client certificates are valid until 3011 year. Here they are: Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Dec 5 07:05:02 2011 GMT Not After : Apr 7 07:05:02 3011 GMT Subject: countryName = AU stateOrProvinceName = Some-State organizationName = Internet Widgits Pty Ltd commonName = Root X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Apr 7 07:05:02 3011 GMT (365000 days) Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Dec 5 07:06:57 2011 GMT Not After : Apr 7 07:06:57 3011 GMT Subject: countryName = AU stateOrProvinceName = Some-State organizationName = Internet Widgits Pty Ltd commonName = testuser X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication Certificate is to be certified until Apr 7 07:06:57 3011 GMT (365000 days) Now client like authentication is successful. About this show freeradius: Login OK: [host/testuser] (from client private-network port 33566721 cli 0022-15ef-ab87) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 67 to 10.2.2.240 port 5002 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" MS-MPPE-Recv-Key = 0xca7449798f0f957fe8e03542d1b9a5ef6291756644f4e392a60f078a3c858cba MS-MPPE-Send-Key = 0xcfffb577e162ba2111b253f1f969e46e39521626f4669704e367502640f368a7 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/testuser" Finished request 3. After that, I wanted to check as to be the case in 2050, as we recall certificates are valid until 3011. Set the time on the server freeradius August 1, 2050 (01/08/2050) and the same thing on a client running on Windows XP SP3. Authentication fails (slightly below records cite the radius). I have a question for all who can help, this is the mistake of freeradius, which can not correctly identify the validity of the certificate. Or somewhere I made a mistake when setting up. Maybe this one is already experienced. I'll be glad for your help. test#radiusd -X .................. rad_recv: Access-Request packet from host 10.2.2.240 port 5002, id=68, length=221 User-Name = "host/testuser" EAP-Message = 0x0202001201686f73742f7465737475736572 Message-Authenticator = 0xe394bda2df7b6ff808bd0079cb5620cd NAS-IP-Address = 10.2.2.240 NAS-Identifier = "001ac1d4d442" NAS-Port = 33566721 NAS-Port-Id = "unit=2;subslot=0;port=3;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022-15ef-ab87" H3C-Connect_Id = 18 H3C-Product-ID = "5500-EI" H3C-Ip-Host-Addr = "0.0.0.0 00:22:15:ef:ab:87" H3C-NAS-Startup-Timestamp = 954640520 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 152 [files] users: Matched entry host/testuser at line 234 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 68 to 10.2.2.240 port 5002 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x905a520890595f1e7244e69c58c3b630 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.2.2.240 port 5002, id=69, length=301 User-Name = "host/testuser" EAP-Message = 0x020300500d800000004616030100410100003d030198387b2b15bc66925793a2b08aec38827730edb90a98238b1f8967ad5b0e5a3000001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x57f352efbff4566bed7422e481a95c1e NAS-IP-Address = 10.2.2.240 NAS-Identifier = "001ac1d4d442" NAS-Port = 33566721 NAS-Port-Id = "unit=2;subslot=0;port=3;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022-15ef-ab87" State = 0x905a520890595f1e7244e69c58c3b630 H3C-Connect_Id = 18 H3C-Product-ID = "5500-EI" H3C-Ip-Host-Addr = "0.0.0.0 00:22:15:ef:ab:87" H3C-NAS-Startup-Timestamp = 954640520 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 152 [files] users: Matched entry host/testuser at line 234 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0245], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0066], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 69 to 10.2.2.240 port 5002 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" EAP-Message = 0x010402ee0d80000002e4160301002a02000026030198387b5ccef9ea8b00a2b87027963d9f59eccbf3df96bfb208b4fb2072f06cd10000040016030102450b00024100023e00023b30820237308201a0a003020102020101300d06092a864886f70d01010505003054310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464310d300b06035504031304526f6f743020170d3131313230353037303530325a180f33303131303430373037303530325a3054310b3009060355040613024155311330110603550408130a536f6d65 EAP-Message = 0x2d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464310d300b06035504031304526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100e3bd7f6d0226d923d61f85542cd081e2a78a647855b252a3796b624daf45cc8e7d2ce664942d507fdd60bb8bfcf4b439122a7cf5607957e25439b3df92a56bbab3f6ead61042869e1beee05acfc3a5b338e5cc847ce2e4c09d3b8122569bbdbb93939502bbd9c7fc8efe1af165aaca423562729433f8c94466df2742c6dcc56d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d EAP-Message = 0x010105050003818100ae145995a7db51de5488b35bb51c8cd9cb38be974572fb10989e2bfd5e8d2bcb1fac78a393e2b1afcb23a7436194078d4c246ae4c2f2823a2cfb586dbb1ba181887761f3eb2e4ee93fda19ed3b461af1f1dd49040462f574913234446b52d926f9680dca83626fc6deb048ce1d8cd1ef09b6cf42464bfc2dda2534ded1aec5ae16030100660d00005e03010240005800563054310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464310d300b06035504031304526f6f740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x905a5208915e5f1e7244e69c58c3b630 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.2.2.240 port 5002, id=70, length=1138 User-Name = "host/testuser" EAP-Message = 0x0204038f0d800000038516030103550b00024500024200023f3082023b308201a4a003020102020102300d06092a864886f70d01010505003054310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464310d300b06035504031304526f6f743020170d3131313230353037303635375a180f33303131303430373037303635375a3058310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c74643111300f0603 EAP-Message = 0x5504031308746573747573657230819f300d06092a864886f70d010101050003818d0030818902818100e4991040e15c9024ae083463fd6e2d09f46ca74e3cbeadd978f2e41ddb724e19ad31a9992e8da760d4892efaf9aeeff0c3331935020138485f7d48e625c4e57e55de639f131144c4e57fa7392f963ac719cf79d8dec0aa13254a8593022cb0004e58377ac8e2deaeb543b412a4ec96f955a30efab73e08cb7a825c9a6ec871af0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d01010505000381810057827d8957a1782f450852803827b2e739cf5d7f85aac9a851467b4f8f2e2925c80d EAP-Message = 0xe075839d54a9b794e8a57a46750d932ae08a9c5b459d612dbd3153917da9f59dd493035382d696b1ecdcf1d867b55bdead570bd2417bd73c9c25b97d059c0579010da85edea51153830e4f4ce739ad361840198a7fefb1a68f328760ae561000008200807e2f5d813d13b4d0b4a37a400aa4047bd80f48b2239421304e8e87ddd9f1e8346ce680c7d965d83b6b11dcd1d6630ef0558f98c7323fe944aa024b8a51bd3ee5d376abb52df677e950eac9264435d027cc10e852107936a47fa622da0dfd575fcc48d095a931b544e6a9807dbfea859060cf28aa77eee6b66f20f94b9f183b620f00008200801f56d252999ca4dace4dd3653ab3ba1d2b232a EAP-Message = 0x126b781576b298652220ea7135e389b908c5e792fc316c3932836c317527278ba5682d5f22b86671f4bec52015f513402f6dfe9c371dbc245b8a563c87b1a3ea5589ecd20814e4e8aeee29c6832ebad011afc6040b85e4e2ec2b2ece9acdefa78e9f3c533f9ad13f104a7d5fa81403010001011603010020484dad944f3d7e14256da2f4be5641b0e3e094b3bbd20f973f13f4c081a6fddb Message-Authenticator = 0xc43e468dd06dc0a9bc0a93893dbd14a5 NAS-IP-Address = 10.2.2.240 NAS-Identifier = "001ac1d4d442" NAS-Port = 33566721 NAS-Port-Id = "unit=2;subslot=0;port=3;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0022-15ef-ab87" State = 0x905a5208915e5f1e7244e69c58c3b630 H3C-Connect_Id = 18 H3C-Product-ID = "5500-EI" H3C-Ip-Host-Addr = "0.0.0.0 00:22:15:ef:ab:87" H3C-NAS-Startup-Timestamp = 954640520 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 152 [files] users: Matched entry host/testuser at line 234 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 901 [tls] Length Included [tls] eaptls_verify returned 11 [tls] <<< TLS 1.0 Handshake [length 0249], Certificate --> verify error:num=9:certificate is not yet valid [tls] >>> TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert write:fatal:bad certificate TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect (certificate is not yet valid): [host/testuser] (from client private-network port 33566721 cli 0022-15ef-ab87) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 70 to 10.2.2.240 port 5002 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 68 with timestamp +11 Cleaning up request 1 ID 69 with timestamp +11 Waking up in 1.0 seconds. Cleaning up request 2 ID 70 with timestamp +11 Ready to process requests.

4 3

MUTT + freeradius -X
by Aceror 05 Dec '11

05 Dec '11

I will like to recive a email when someone login into my server,I thought using mutt + freeradius but no result about mutt -s "Un usuario ha entrado en la red" myemail(a)domin.com | freeradius -X Any idea how to do it???

3 4

BUG: radwtmp and system 'last' command
by Коньков Евгений 04 Dec '11

04 Dec '11

Hi, Freeradius-users. man radlast ... radlast is a frontend for the systems last command but in last versions of FreeBSD the 'last' command have change format and now radwtmp log file can not be readed by radlast command because of NEW system LAST do not understand old format ( Is there any workaround about this? -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 1

TEST
by Коньков Евгений 04 Dec '11

04 Dec '11

some problem with this mail list, trying to test sorry

1 0

freeradius, problem with chap ?
by Piotr 04 Dec '11

04 Dec '11

Hello I have two kind of remote access on cisco asa, first ovia ssl vpn and second via l2tp/ipsec (for mobile phones with androids). Both access are made on the same cisco and both autorizen on the same freeradius server with motp ( mobile one time password). Access via ssl vpn works correct but access via l2tp/ipsec not. I see that there is some problem with auth. For l2tp/ipsec i set authorization chap ( i disabled mschap v1 and v2, they didn't work also) Thank You for any help This is debug from l2tp/ipsec connection: rad_recv: Access-Request packet from host 10.162.1.1 port 1025, id=240, length=134 User-Name = "tom3" CHAP-Password = 0x01972f0886c4e5e2f30e32053dbcf67504 NAS-Port = 5357568 Service-Type = Framed-User Framed-Protocol = PPP CHAP-Challenge = 0x119f01e96a9a794879f770373a39827c7463bb1cfd4c9bf6ebeac4fb1ac47b3b8b1861bee84b0273d5 Tunnel-Client-Endpoint:0 = "83.6.6.66" NAS-IP-Address = 10.162.1.1 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [suffix] No '@' in User-Name = "tom3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 2 [files] expand: /usr/local/bin/otp4freeradius.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}' -> /usr/local/bin/otp4freeradius.sh 'tom3' '' '' '' '' [files] users: Matched entry tom3 at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "tom3" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [tom3/<CHAP-Password>] (from client ciscoasa port 5357568) /raddb/users: DEFAULT Auth-Type = External Exec-Program-Wait = "/usr/local/bin/otp4freeradius.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}'", Fall-Through = Yes tom3 Secret = f11111xxxx1111a, PIN = yyyy, Offset = 0, CVPN3000-IETF-Radius-Class := "press" cat radiusd.conf ... modules { exec MOTP { wait = yes program = "/usr/local/bin/otp4freeradius.sh %{User-Name} %{User-Password} %{reply:Secret} %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply } $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ cat raddb/sites-enabled/default authorize { preprocess chap mschap suffix files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type External { MOTP } unix } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } and here is debug from working connection for sslvpn: rad_recv: Access-Request packet from host 10.162.1.1 port 1025, id=239, length=136 User-Name = "tom3" User-Password = "bd8d9a" NAS-Port = 5353472 Called-Station-Id = "7.24.64.182" Calling-Station-Id = "9.72.8.13" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "9.72.8.13" NAS-IP-Address = 10.162.1.1 Cisco-AVPair = "ip:source-ip=9.72.8.13" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "tom3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 2 [files] expand: /usr/local/bin/otp4freeradius.sh '%{User-Name}' '%{User-Password}' '%{reply:Secret}' '%{reply:Pin}' '%{reply:Offset}' -> /usr/local/bin/otp4freeradius.sh 'tom3' 'bd8d9a' '' '' '' [files] users: Matched entry tom3 at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = External +- entering group External {...} [MOTP] expand: %{User-Name} -> tom3 [MOTP] expand: %{User-Password} -> bd8d9a [MOTP] expand: %{reply:Secret} -> f11111111xx111a [MOTP] expand: %{reply:Pin} -> xyzw [MOTP] expand: %{reply:Offset} -> 0 Exec-Program output: ACCEPT czas:2011-12-01 21:27:32 Exec-Program-Wait: plaintext: ACCEPT czas:2011-12-01 21:27:32 Exec-Program: returned: 0 ++[MOTP] returns ok Login OK: [tom3/bd8d9a] (from client ciscoasa port 5353472 cli 9.72.8.13) WARNING: Empty section. Using default return values. Sending Access-Accept of id 239 to 10.162.1.1 port 1025 CVPN3000-IETF-Radius-Class := "press" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 239 with timestamp +308 Ready to process requests.

4 4

Radacct update at 3 hours
by Hitesh Vinzoda 04 Dec '11

04 Dec '11

Hi, We want to have accounting records created every 3 hours in case the users are not disconnected to create daily/weekly/monthly report. I have gone through all the steps involved till modifying the accounting queries in sql.conf, i realized that my sql.conf is different from one listed at http://freeradius.org/radiusd/raddb/sql.conf Now i stalled that whether to modify. I am using FR 2.1.10. LNS is setup to send periodic updates every 3 hours and FR is updating the records but the acctstarttime is unchanged and acctstoptime is set to "null" but i can see that the acctinoctets and output octets are updated. We need to have separate record created in MYSQL radacct table once received update from the LNS. Any help on this would be appreciated. Thanks in advance Hitesh Vinzoda Network Administrator +91-9924117399 www.vinzoda.in "There are 10 types of people in this world. One who can understand binary and other's can't."

4 7