June 2011 - Freeradius-Users - lists.freeradius.org

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61

Sending accounting packets to more than one server?
by Tim McNabb 27 Oct '11

27 Oct '11

Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I'm working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done? Thanks in advance, -Tim

6 12

Freeradius mysql acct copy
by Alexander Kosykh 27 Oct '11

27 Oct '11

Hi. I need to copy acct packets to my billing server and save acct in standart freeradius radacct table in mysql. I'm saving acct in radacct table now, but can't duplicate them to other (billing) radius server. I've tried to use copy-acct-to-home-server but no success. As I understand, virtual server from copy-acct-to-home-server use a detail files to read acct information from default server. Is the way to don't use detail file and use mysql? Regards, Alexander.

4 6

How to configure proxy server to send a copy of acct to remote/home server
by Difan Zhao 27 Oct '11

27 Oct '11

Dear experts, I configured my Freeradius2.1.7 server to be a proxy server which will forward the PEAP authentication packages to a remote server. The authentication part works great. I configured my switch to send accounting information to the proxy server. The proxy server is using MySQL to store the acct info. This part works fine too. However I'm requested to also send a copy of the acct info to the remote server... I'm still checking my switch (Cisco) and see if it can send two copies of acct info to two different servers at the same time. However, is it possible to make FreeRadius to automatically forward a copy to the remote server?? Thanks! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com INTERNET | MEDIA | VOICE The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

3 2

EAP-TLS + Symbian = weird behaviour
by Zeus V Panchenko 14 Oct '11

14 Oct '11

Hi, may somebody advice, please i have: > uname FreeBSD 8.1-RELEASE amd64 > radiusd -v radiusd: FreeRADIUS Version 2.1.10, for host amd64-portbld-freebsd8.1, built on Apr 4 2011 at 22:44:15 radiusd configured with EAP-TLS only and works fine with xNIX-es, WinXP, Android and Maemo with Symbian (Nokia E51, E52) i face much weird picture ... the same device works fine (getting authorized well) via one AP in my LAN and remote VPN, but receiving !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session for state ... did not finish! !! Please read http://wiki.freeradius.org/Certificate_Compatibility !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! via another AP (in remote VPN, while other OS still authorized well) AP are the same models and configured the same way what can cause this behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 6

Problem with rml_sqlcounter with GigaByte datavolume
by Hanno Schupp 14 Sep '11

14 Sep '11

Dear All, can I ask for some pointers please. in my FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu (Ubuntu LTS 10.04) installation I have followed the Gigabyte instructions on the FreeRADIUS wiki's FAQ http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Oct…. The Usage is calculated correctly, but the check_item value is not what I expect to see (1.7 GB as opposed th 6GB set in radcheck). I understand who the system determines the counter value and it is correctly calculated, but where does the check_item vlaue of 1.7GB come from? I have no idea to be truthful. Any pointers welcome. Thanks in advance. Here the data/logs: Here the relevant debug log: Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Entering module authorize code Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: 'SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}'' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: '%{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'}' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{User-Name} -> lapzel14 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_set_user escaped user --> 'lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Reserving sql socket id: 3 Sat Jun 4 23:10:21 2011 : Debug: rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat finished Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Released sql socket id: 3 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'} -> 2147513300 Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Rejected user lapzel14, check_item=1705032704, counter=2147513300 Sat Jun 4 23:10:21 2011 : Info: ++[noresettotal] returns reject Definition of the noresettotal module in counter.conf: sqlcounter noresettotal { counter-name = Max-All-Total-Octets check-name = Max-All-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql03 key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}'" } and here the radcheck values for user 'lapzel14': [image: Full Texts]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> id<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> UserName<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Attribute<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> op<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Value<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…>[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572098lapzel14User-Password:=loxdas[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572102lapzel14Expiration:=1311932528[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572106lapzel14Simultaneous-Use:=1[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572110lapzel14Max-All-Total:=6000000000

7 17

different acctuniqueids with common keys?
by andrew＠sybaweb.com 06 Sep '11

06 Sep '11

I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config. It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries. Relevant radconf2xml snippet is: <acct_unique> <key>User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port</key> </acct_unique> Related entries I'm looking at in the radacct table are: username, acctsessionid, nasipaddress, framedipaddress, nasportid. I have checked these with a script and confirmed that I have a number of entries which share all these attributes yet have different acctuniqueids. This is a problem for me since it causes my billing software to overconsume usage. I could change this to not use acctuniqueid, but a fixed acctuniqueid would make my life easier. Any ideas? Best, -AL.

6 7

Freeradius capable of url-redirect
by Nathan McDavit-Van Fleet 15 Aug '11

15 Aug '11

Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2. I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access. http://www.cisco.com/en/US/products/ps6366/products_configuration_example091 86a0080956185.shtml Is this handled somehow is Freeradius?

6 12

Cleanup Stale Sessions - needed?
by Paolo Di Francesco 08 Aug '11

08 Aug '11

Hi Radius Gurus I have a problem with one not-so-typical situation. First of all, I am running daloradius on top of Freeradius: [root@radman ~]# radiusd -v radiusd: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. I have just update my network topology and therefore I moved some NASes from one server to another. When I did this change, obviously I did it without worrying what could happen to the radiusd. So I simply moved the NASes on new IPs/servers and restarted the radiusd. Now I have the users trying to get into the network but they look "online" to radiusd on the old NASes. In few words the connection is refused because radiusd thinks that the user is ALREADY online on the "old NAS" (not true) and it does not permit the user to get into the network. So I have this teasing menu option in daloradius which is called "Cleanup Stale Sessions". I think it does exactly what I need but: 1) I do not want to break the radiusd 2) I do not want to loose my radius logs ("who had that IP that day..") 3) I do not know if this is the right "button" to click So I am asking you if you have any idea of how to solve this issue and if I should click that button Thank you in advance (radiusd log follows) ----------------------------------------------------------------------- Auth: Multiple logins (max 1) [MPP attempt]: [myuser(a)mynet.org] (from client xyz port 45118 cli 00:15:6D:5E:0A:82) ----------------------------------------------------------------------- -- Ing. Paolo Di Francesco Level7 s.r.l. unipersonale Sede operativa: Largo Montalto, 5 - 90144 Palermo C.F. e P.IVA 05940050825 Fax : +39-091-8772072 assistenza: (+39) 091-8776432 web: http://www.level7.it

6 11

can policy.conf be used to create an access control list
by michael lamborn 28 Jul '11

28 Jul '11

Hi, I am using version freeRadius 1.1.7. I am trying to create an access control list via radius, to prevent specific PC's/locations from accessing my network. Please see my policy.conf example below. My freeRadius server keeps sending an access-accept, when I try to login in from my office as a test, which has the IP address 10.2.222.35. I don't understand why the server is allowing the login. It seems logical to me the way that I have approached an implementation, but I can't find any specific info from the wiki or in internet searches. So I am not sure if I am still misconfigured or if it just doesn't work for some other reason. Thanks, Mike In policy.conf, I have the following, but it doesn't have any affect ( I do have '$INCLUDE ${confdir}/policy.conf' in my radiusd.conf file): policy { forbid_login_ip_hosts { %{request:Login-IP-Host} =~ /^10.2./ { reject } } }

3 2