July 2011 - Freeradius-Users - lists.freeradius.org

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61

Sending accounting packets to more than one server?
by Tim McNabb 27 Oct '11

27 Oct '11

Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I'm working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done? Thanks in advance, -Tim

6 12

Freeradius mysql acct copy
by Alexander Kosykh 27 Oct '11

27 Oct '11

Hi. I need to copy acct packets to my billing server and save acct in standart freeradius radacct table in mysql. I'm saving acct in radacct table now, but can't duplicate them to other (billing) radius server. I've tried to use copy-acct-to-home-server but no success. As I understand, virtual server from copy-acct-to-home-server use a detail files to read acct information from default server. Is the way to don't use detail file and use mysql? Regards, Alexander.

4 6

How to configure proxy server to send a copy of acct to remote/home server
by Difan Zhao 27 Oct '11

27 Oct '11

Dear experts, I configured my Freeradius2.1.7 server to be a proxy server which will forward the PEAP authentication packages to a remote server. The authentication part works great. I configured my switch to send accounting information to the proxy server. The proxy server is using MySQL to store the acct info. This part works fine too. However I'm requested to also send a copy of the acct info to the remote server... I'm still checking my switch (Cisco) and see if it can send two copies of acct info to two different servers at the same time. However, is it possible to make FreeRadius to automatically forward a copy to the remote server?? Thanks! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com INTERNET | MEDIA | VOICE The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

3 2

EAP-TLS + Symbian = weird behaviour
by Zeus V Panchenko 14 Oct '11

14 Oct '11

Hi, may somebody advice, please i have: > uname FreeBSD 8.1-RELEASE amd64 > radiusd -v radiusd: FreeRADIUS Version 2.1.10, for host amd64-portbld-freebsd8.1, built on Apr 4 2011 at 22:44:15 radiusd configured with EAP-TLS only and works fine with xNIX-es, WinXP, Android and Maemo with Symbian (Nokia E51, E52) i face much weird picture ... the same device works fine (getting authorized well) via one AP in my LAN and remote VPN, but receiving !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session for state ... did not finish! !! Please read http://wiki.freeradius.org/Certificate_Compatibility !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! via another AP (in remote VPN, while other OS still authorized well) AP are the same models and configured the same way what can cause this behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 6

SoH and DHCP
by Francois Gaudreault 20 Sep '11

20 Sep '11

Hi, I am trying to make the SoH statements to work using the FreeRADIUS DHCP. However, I have issues to get the SoH values from the NAP client. Maybe someone will be able to help. On the client side, the DHCP NAP policy is set to enabled. Thanks! sites-enabled/dhcp : listen { ipaddr = * port = 67 type = dhcp # interface = eth0 broadcast = yes } dhcp DHCP-Discover { soh update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp DHCP-Request { soh update reply { DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } passwd mac2ip { filename = ${confdir}/mac2ip format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," } The Debug : Received DHCP-Discover of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Hostname = "TestingLaptop" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor DHCP-Vendor = 0xdc00 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} [soh] SoH adding NAP marker to DHCP reply ++[soh] returns ok ++[reply] returns ok ++[reply] returns ok [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Vendor = 0xdc0350414e DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1767. Cleaning up request 1767 ID 1763899400 with timestamp +76404 Going to the next request Ready to process requests. Received DHCP-Request of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Request DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Requested-IP-Address = 10.0.0.245 DHCP-DHCP-Server-Identifier = 10.0.0.243 DHCP-Hostname = "TestingLaptop" DHCP-Client-FQDN = "\000\000\000TestingLaptop.inverse.local" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} ++[soh] returns noop ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Ack of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1768. -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 5

Problem with rml_sqlcounter with GigaByte datavolume
by Hanno Schupp 14 Sep '11

14 Sep '11

Dear All, can I ask for some pointers please. in my FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu (Ubuntu LTS 10.04) installation I have followed the Gigabyte instructions on the FreeRADIUS wiki's FAQ http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Oct…. The Usage is calculated correctly, but the check_item value is not what I expect to see (1.7 GB as opposed th 6GB set in radcheck). I understand who the system determines the counter value and it is correctly calculated, but where does the check_item vlaue of 1.7GB come from? I have no idea to be truthful. Any pointers welcome. Thanks in advance. Here the data/logs: Here the relevant debug log: Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Entering module authorize code Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: 'SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}'' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: '%{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'}' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{User-Name} -> lapzel14 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_set_user escaped user --> 'lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Reserving sql socket id: 3 Sat Jun 4 23:10:21 2011 : Debug: rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat finished Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Released sql socket id: 3 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'} -> 2147513300 Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Rejected user lapzel14, check_item=1705032704, counter=2147513300 Sat Jun 4 23:10:21 2011 : Info: ++[noresettotal] returns reject Definition of the noresettotal module in counter.conf: sqlcounter noresettotal { counter-name = Max-All-Total-Octets check-name = Max-All-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql03 key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}'" } and here the radcheck values for user 'lapzel14': [image: Full Texts]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> id<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> UserName<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Attribute<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> op<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Value<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…>[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572098lapzel14User-Password:=loxdas[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572102lapzel14Expiration:=1311932528[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572106lapzel14Simultaneous-Use:=1[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572110lapzel14Max-All-Total:=6000000000

7 17

different acctuniqueids with common keys?
by andrew＠sybaweb.com 06 Sep '11

06 Sep '11

I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config. It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries. Relevant radconf2xml snippet is: <acct_unique> <key>User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port</key> </acct_unique> Related entries I'm looking at in the radacct table are: username, acctsessionid, nasipaddress, framedipaddress, nasportid. I have checked these with a script and confirmed that I have a number of entries which share all these attributes yet have different acctuniqueids. This is a problem for me since it causes my billing software to overconsume usage. I could change this to not use acctuniqueid, but a fixed acctuniqueid would make my life easier. Any ideas? Best, -AL.

6 7

Proxying based on a regex
by Charles Plater 15 Aug '11

15 Aug '11

I'm trying to configure our FreeRadius (2.1.9) server to proxy based on the format of the ID. I have a working regex that determines the domain to which the request should be sent, but I'm having a hard time figuring out the syntax of the proxy statement. Here's what I've tried: if (User-Name !~ <REGEX>) { proxy: domain.name else { proxy: LOCAL } } FWIW, I can successfully authenticate do the "domain.name" realm by using userid(a)domain.name. Can anyone offer any suggestions? Thanks in advance. -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189(a)wayne.edu

5 9

Freeradius capable of url-redirect
by Nathan McDavit-Van Fleet 15 Aug '11

15 Aug '11

Cisco has a feature to redirect users to a splash page after 802.1x/WPA2-personal authentication. We are interested in this feature so we can notify users of our EAP-TTLS service that we are migrating to PEAP-MSCHAPv2. I have included the url for the configuration description (of Cisco ACS). But essentially there is a av-pair and url-redirect attribute which need to be configured on Cisco ACS (and some other wireless configs) in order to enable that option. I am not talking about a captive portal. We want to display a info page for the users of a specific protocol. The document below describes that it happens after authentication and network access. http://www.cisco.com/en/US/products/ps6366/products_configuration_example091 86a0080956185.shtml Is this handled somehow is Freeradius?

6 12