March 2011 - Freeradius-Users - lists.freeradius.org

Packet tracing web interface
by Brian Candler 14 Mar '11

14 Mar '11

I'd like to build a "packet tracer" web interface for freeradius: that is, somewhere where you can paste in a set of AV pairs (perhaps caught from radsniff), and you get back the AV responses plus all the decision-making logic that took place. Basically what freeradius -X shows. Has anyone done this before? I have a few considerations. (1) If I had a single persistent freeradius daemon running, and multiple users were submitting requests to this web interface, I'd need to separate out the debug data for each of the requests. I guess I could have a locking system so that only one person could be using it at once. (Alternatively I'd have to fire off a new foreground radiusd for each request as it came in, and kill it afterwards) (2) What's the best way to submit the request so that it looks like it's coming from a particular IP address? The "Client-IP-Address" attribute is internal only, not on-the-wire. At the moment the best I've been able to do is to create loopback interfaces on my box with examples of the source IPs I'm interested in, then use radclient to send the packet with a Packet-Src-IP-Address of one of those loopbacks. Is there a better way I've overlooked? (Before you say it, I know a well-behaved radius server should be looking at NAS-IP-Address not Client-IP-Address. Unfortunately there are some cases where we have to make logic decisions based on the Client-IP-Address) Thanks, Brian.

5 10

Proxy Request to Virtual Server using EAP
by joaocdc＠gmail.com 14 Mar '11

14 Mar '11

Hello Guys I need a help to use proxy request to virtual_server using EAP-TTLS and EAP-PEAP I have the following scenario: I have a Radius Sever (version 2.1.10), this server on a Linux Debian 6 This server must authenticate users of my wireless network. But my network is interconnected with several educational institutions, and users of these institutions are in my network. For users who are in my company, I want to authenticate them in my radius server, for users who are from other institutions to do routing or proxy server. I already have configured the authentication of my users using LDAP as a backend. My users will be divided into groups, each group has its own realm, each realm and forwards the authentication to a virtual server. If my users try to authenticate without entering the realm, it works OK. If users try to authenticate other institutions stating the realm of the institution, my radius is usually the proxy, and it works OK. if my users try to authenticate informing realm, I see in debug mode the virtual server is invoked, but the authentication does not happen, he accuses the following error: # Executing group from file /etc/freeradius/sites-enabled/ inner-tunnel +- entering group authenticate {...} [eap] Multiple levels of TLS nesting is invalid. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel Apparently he often wraps the request with TLS, and can no longer decapsulation. If you do a test without using EAP authentication (via radtest) authentication with realm works. Apparently he often wraps the request with TLS, and can no longer decapsulation. Enough already researched on the internet but have not found a solution. I need to make a proxy for virtual_server using EAP. If any can help me thank you. Sincerely John -- João Paulo de Lima Barbosa

1 0

freeradius2 update
by Student University 14 Mar '11

14 Mar '11

Dear all , is there anything like freeradius2.repo , so we can safely use yum update to latest stable version of freeradius 2.1.10 any community have like experience ,,, BR,

5 5

Redirecting accounting packets
by Rajkumar R 14 Mar '11

14 Mar '11

Hi All, This query is regarding using freeRadius as proxy server as part of loadbalancing activity. In turn this proxy server would redirect the accounting requests to two other freeRadius servers. We have tried this setup, for 20 accounting messages simultaneously and it worked pretty well. However, we would it like to scale up to 1million users and would like to know if it have performance impact on the proxy server(with the foresaid setup would it be enough to handle a high traffic with 1 proxy & 2 freeRadius servers?) as all the radius-acct messages(for ~1million users) from the NAS are pumped to the only proxy server. Thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Trying to get my sql configuration right.
by John.Hayward＠wheaton.edu 13 Mar '11

13 Mar '11

Hi Radius People, I am getting the message from sql authentication: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >From other posts the solution is to update the configuration to replace the attribute "User-Password" to be "Cleartext-Password" in the radcheck table. In the radcheck table I actually have "Password" which probably get mapped to User-Password and then the warning occurs. If I change an entry in radcheck table to actually have Cleartext-Password in the radcheck table I get: ==== [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ==== and it fails to authenticate (but does not produce the warning message ;-) What might be causing the attribute "Password" from the table to get mapped to "User-Password" and what is suggested that I change to have radius be happy? johnh...

3 3

reply-detail log And Exec-Program-Wait
by KHiDR 13 Mar '11

13 Mar '11

Dear All , I am upgrading from 1.1.7 To 2.1.10 I am using Exec-Program-Wait to run a script In the old ver, I can find the out put of my script in reply-detail log , But in the new ver. I Only find the attribute Exec-Program-Wait = "/usr/bin/php /var/www/html/check.php testuser 1" but i need all the ourput to be printed in the reply-detail log, so is there any way to do that ?? regards

1 0

Dictionary question`
by David Peterson 13 Mar '11

13 Mar '11

I have to define a TLV which has a description of: TLV ID 1 for Classifier ID Description An identifier of the classifier that uniquely identifies the classifier in the scope of the Packet Flow Descriptor irrespective of whether or not the classifier is an uplink or downlink classifier. Length 2+1 Value 1 to 256. Would this be integer, short, byes? David

2 1

Query regarding rlm_sqlcounter !
by Suman Dash 12 Mar '11

12 Mar '11

I am facing some issues in making the rlm_sqlcounter worj with freeradius 2.1.9 . I am unable to understand that why the Wiki and the actual config files are different . The wiki link http://wiki.freeradius.org/Rlm_sqlcounter shows an example in which there is no Reply-Name whereas the sql/mysql/counter.conf shows a Reply-Name attribute.. The config part : radiusd.conf $INCLUDE ${confdir}/modules/ # Extensible Authentication Protocol # # For all EAP related authentications. # Now in another file, because it is very large. # $INCLUDE eap.conf # Include another file that has the SQL-related configuration. # This is another file only because it tends to be big. # $INCLUDE sql.conf # # This module is an SQL enabled version of the counter module. # # Rather than maintaining seperate (GDBM) databases of # accounting info for each counter, this module uses the data # stored in the raddacct table by the sql modules. This # module NEVER does any database INSERTs or UPDATEs. It is # totally dependent on the SQL module to process Accounting # packets. # $INCLUDE sql/mysql/counter.conf # # IP addresses managed in an SQL table. # $INCLUDE sqlippool.conf } instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` exec # # The expression module doesn't do authorization, # authentication, or accounting. It only does dynamic # translation, of the form: # # Session-Timeout = `%{expr:2 + 3}` # # So the module needs to be instantiated, but CANNOT be # listed in any other section. See 'doc/rlm_expr' for # more information. # expr daily expiration logintime # # We add the counter module here so that it registers # the check-name attribute before any module which sets # it sql/mysql/counter.conf sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ FROM radacct WHERE username='%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" } sites-enabled/default authorize { .......... noresetcounter dailycounter monthlycounter daily } What bothers me is the Reply-Name defined is already instantiated by freeradius for daily counter. DB Scheme suman Max-Daily-Session := 10suman Expiration := 05 Mar 2012 23:59:59 NTRadPing Output Session-Timeour = 10 ( Which is Infact Correct ) But When i change the Max-Daily-Session to Max-Monthly-Session sumanMax-Monthly-Session:=10suman Expiration := 05 Mar 2012 23:59:59 NTRadPing Output Session-Timeour = 10 ( Which is Infact Correct ) But When i change the Max-Daily-Session to Max-Monthly-Session NTRadPing gives the total session timeout based on the user expiration date . Debug Log for Max-Daily-Session: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 122.175.85.117 port 26130, id=39, length=59 User-Name = "suman" User-Password = "duman12" Calling-Station-Id = "001122334455" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "suman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> suman [sql] sql_set_user escaped user --> 'suman' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM tbl_check WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM tbl_check WHERE username = 'suman' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM tbl_reply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM tbl_reply WHERE username = 'suman' ORDER BY id [sql] expand: SELECT groupname FROM tbl_usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM tbl_usergroup WHERE username = 'suman' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM tbl_groupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM tbl_groupcheck WHERE groupname = 'Biz1Mbps-UL' ORDER BY id [sql] User found in group Biz1Mbps-UL [sql] expand: SELECT id, groupname, attribute, value, op FROM tbl_groupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM tbl_groupreply WHERE groupname = 'Biz1Mbps-UL' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200'' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200' -> SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200'}' [dailycounter] sql_xlat [dailycounter] expand: %{User-Name} -> suman [dailycounter] sql_set_user escaped user --> 'suman' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200' -> SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql (sql): database query error, SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200': Table 'rdscrm.radacct' doesn't exist rlm_sql (sql): Released sql socket id: 2 [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1299868200 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1299868200'} -> rlm_sqlcounter: No integer found in string "" ++[dailycounter] returns noop rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'suman' rlm_counter: Could not find the requested key in the database. rlm_counter: Check item = 10, Count = 0 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user suman, check_item=10, counter=0 rlm_counter: Sent Reply-Item for user suman, Type=Session-Timeout, value=10 ++[daily] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 001122334455 rlm_checkval: Value Name: Calling-Station-Id, Value: 001122334455 ++[checkval] returns ok [expiration] Checking Expiration time: '05 Mar 2012 23:59:59' ++[expiration] returns ok ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "duman12" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group session {...} [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> suman ++[radutmp] returns ok +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 1 [sqlippool] expand: %{User-Name} -> suman [sqlippool] sql_set_user escaped user --> 'suman' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE tbl_ippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE tbl_ippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '122.175.85.117' [sqlippool] expand: SELECT framedipaddress FROM tbl_ippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM tbl_ippool WHERE pool_name = 'main_pool' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE tbl_ippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 180 SECOND WHERE framedipaddress = '192.168.1.20' AND expiry_time IS NULL -> UPDATE tbl_ippool SET nasipaddress = '122.175.85.117', pool_key = '', callingstationid = '001122334455', username = 'suman', expiry_time = NOW() + INTERVAL 180 SECOND WHERE framedipaddress = '192.168.1.20' AND expiry_time IS NULL [sqlippool] Allocated IP 192.168.1.20 [1401a8c0] [sqlippool] expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 1 [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 192.168.1.20 from main_pool (did cli 001122334455 port user suman) Allocated IP: 192.168.1.20 from main_pool (did cli 001122334455 port user suman) ++[sqlippool] returns ok [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/122.175.85.117/reply-detail-20110312 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/122.175.85.117/reply-detail-20110312 [reply_log] expand: %t -> Sat Mar 12 16:18:51 2011 ++[reply_log] returns ok [sql] expand: %{User-Name} -> suman [sql] sql_set_user escaped user --> 'suman' [sql] expand: %{User-Password} -> duman12 [sql] expand: INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( 'suman', 'duman12', 'Access-Accept', '2011-03-12 16:18:51') rlm_sql (sql) in sql_postauth: query is INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( 'suman', 'duman12', 'Access-Accept', '2011-03-12 16:18:51') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 39 to 122.175.85.117 port 26130 Framed-MTU := 1472 Reply-Message := "Welcome to Internet Services" Acct-Interim-Interval := 60 Framed-Compression := Van-Jacobson-TCP-IP Service-Type := Framed-User Framed-Protocol := PPP Idle-Timeout := 300 Mikrotik-Rate-Limit := "512k/1024k 1024k/2048k 512k/512k 30/30 1" Framed-IP-Netmask := 255.255.255.255 Session-Timeout = 10 Framed-IP-Address = 192.168.1.20 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 39 with timestamp +2 Ready to process requests. Debug Log for Max-Monthly-Session Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 122.175.85.117 port 26199, id=40, length=59 User-Name = "suman" User-Password = "duman12" Calling-Station-Id = "001122334455" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "suman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> suman [sql] sql_set_user escaped user --> 'suman' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM tbl_check WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM tbl_check WHERE username = 'suman' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM tbl_reply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM tbl_reply WHERE username = 'suman' ORDER BY id [sql] expand: SELECT groupname FROM tbl_usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM tbl_usergroup WHERE username = 'suman' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM tbl_groupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM tbl_groupcheck WHERE groupname = 'Biz1Mbps-UL' ORDER BY id [sql] User found in group Biz1Mbps-UL [sql] expand: SELECT id, groupname, attribute, value, op FROM tbl_groupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM tbl_groupreply WHERE groupname = 'Biz1Mbps-UL' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800'' [monthlycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800' -> SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800'}' [monthlycounter] sql_xlat [monthlycounter] expand: %{User-Name} -> suman [monthlycounter] sql_set_user escaped user --> 'suman' [monthlycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800' -> SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql (sql): database query error, SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800': Table 'rdscrm.radacct' doesn't exist rlm_sql (sql): Released sql socket id: 2 [monthlycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1298917800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='suman' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1298917800'} -> rlm_sqlcounter: No integer found in string "" ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 001122334455 rlm_checkval: Value Name: Calling-Station-Id, Value: 001122334455 ++[checkval] returns ok [expiration] Checking Expiration time: '05 Mar 2012 23:59:59' ++[expiration] returns ok ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "duman12" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group session {...} [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> suman ++[radutmp] returns ok +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 1 [sqlippool] expand: %{User-Name} -> suman [sqlippool] sql_set_user escaped user --> 'suman' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE tbl_ippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE tbl_ippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '122.175.85.117' [sqlippool] expand: SELECT framedipaddress FROM tbl_ippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM tbl_ippool WHERE pool_name = 'main_pool' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE tbl_ippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 180 SECOND WHERE framedipaddress = '192.168.1.28' AND expiry_time IS NULL -> UPDATE tbl_ippool SET nasipaddress = '122.175.85.117', pool_key = '', callingstationid = '001122334455', username = 'suman', expiry_time = NOW() + INTERVAL 180 SECOND WHERE framedipaddress = '192.168.1.28' AND expiry_time IS NULL [sqlippool] Allocated IP 192.168.1.28 [1c01a8c0] [sqlippool] expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 1 [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 192.168.1.28 from main_pool (did cli 001122334455 port user suman) Allocated IP: 192.168.1.28 from main_pool (did cli 001122334455 port user suman) ++[sqlippool] returns ok [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/122.175.85.117/reply-detail-20110312 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/122.175.85.117/reply-detail-20110312 [reply_log] expand: %t -> Sat Mar 12 16:19:47 2011 ++[reply_log] returns ok [sql] expand: %{User-Name} -> suman [sql] sql_set_user escaped user --> 'suman' [sql] expand: %{User-Password} -> duman12 [sql] expand: INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( 'suman', 'duman12', 'Access-Accept', '2011-03-12 16:19:47') rlm_sql (sql) in sql_postauth: query is INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( 'suman', 'duman12', 'Access-Accept', '2011-03-12 16:19:47') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 40 to 122.175.85.117 port 26199 Framed-MTU := 1472 Reply-Message := "Welcome to Internet Services" Acct-Interim-Interval := 60 Framed-Compression := Van-Jacobson-TCP-IP Service-Type := Framed-User Framed-Protocol := PPP Idle-Timeout := 300 Mikrotik-Rate-Limit := "512k/1024k 1024k/2048k 512k/512k 30/30 1" Framed-IP-Netmask := 255.255.255.255 Session-Timeout = 31045212 Framed-IP-Address = 192.168.1.28 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 40 with timestamp +2 Ready to process requests.

1 1

EAP-TLS with Ldap
by Usuário do Sistema 12 Mar '11

12 Mar '11

Hello, I'm new at the Freeradius and I'm deploying it with EAP-TLS to authenticate my Wireless users which will be authenticated against a OpenLDAP base. I'm using freeradius2 and when I make a test from other linux machine with command "radtest joao.vero jango123 128.2.100.131 2 meleca" it's working as follow out Sending Access-Request of id 45 to 128.2.100.131 port 1645 User-Name = "joao.vero" User-Password = "jango123" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 128.2.100.131:1645, id=45, length=20 But, when I'm going to authenticate wireless users from Win7 ( with EAP-TLS, I'm using the test certificate from /etc/raddb/certs/..) It isn't working. it's appear in log: TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation What I did until at the moment in ralation EAP-TLS: I've configured the eap.conf file to read the certificates from /etc/raddb/certs/... I've create the user certificate ( as shows README in /etc/raddb/certs ) I've copied and installed two certificates to user machine: cliente.p12 and ca.der. the first as personal and the last as Trusted Root Certification Authorities I wish to use LDAP for authenticate my users but seems that User-Password must be Clear text. there is possible reach EAP-TLS with LDAP?? What I have do ?? any help is welcome Thank!

2 2

Failover for SQL lookup expansions?
by Brian Candler 12 Mar '11

12 Mar '11

With freeradius 2.1.10 I can configure failover for SQL lookups like this: # in policy.conf sql_foo { redundant { sql_foo_local sql_foo_remote } } # in sites-available/foo authorize { sql_foo } However, it looks like I can't use this redundant module inside a string expansion: authorize { update request { Huntgroup-Name = "%{sql_foo:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } --- Error logged: WARNING: Unknown module "sql_foo" in string expansion "%" How could I get the same level of redundancy for string expansions? Could I do the expansion multiple times inside a redundant section? I am thinking of perhaps: huntgroup_local { update request { Huntgroup-Name = "%{sql_foo_local:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } huntgroup_remote { update request { Huntgroup-Name = "%{sql_foo_remote:SELECT groupname FROM radhuntgroup where nasipaddress='%{NAS-IP-Address}' limit 1}" } } ... authorize { redundant { huntgroup_local huntgroup_remote } } However, I'm just not sure whether the ok/notfound/fail status would propagate through a string expansion in this case. The examples in configurable_failover.rst talk only about normal modules. Thanks, Brian.

2 2