August 2011 - Freeradius-Users - lists.freeradius.org

Daily accounting
by David Roze 02 Dec '11

02 Dec '11

Hi everyone, I have seen a lot of people who are trying to get traffic accounting collected at regular intervals to generate graphs and view per day/month etc... I have made a few modifications in order to achieve this. You can see it at http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html It works on Mysql setup but can be adapted to any db. I'd be grateful to get some feedback on this. A lot of ISPs are running into this problem. Hope this helps Regards, David

2 1

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61

Sending accounting packets to more than one server?
by Tim McNabb 27 Oct '11

27 Oct '11

Hi there! I'm running FreeRADIUS 2.1.7, I was wondering if it is possible to forward accounting packets to another server while also keeping the packets on the local machine. I'm working on integrating a Netsweeper appliance and the company is saying that I need to forward accounting packets to the appliance in order for it to set policies correctly. Has anyone ever done this or would be willing to forward some good documentation on how this can be done? Thanks in advance, -Tim

6 12

Freeradius mysql acct copy
by Alexander Kosykh 27 Oct '11

27 Oct '11

Hi. I need to copy acct packets to my billing server and save acct in standart freeradius radacct table in mysql. I'm saving acct in radacct table now, but can't duplicate them to other (billing) radius server. I've tried to use copy-acct-to-home-server but no success. As I understand, virtual server from copy-acct-to-home-server use a detail files to read acct information from default server. Is the way to don't use detail file and use mysql? Regards, Alexander.

4 6

How to configure proxy server to send a copy of acct to remote/home server
by Difan Zhao 27 Oct '11

27 Oct '11

Dear experts, I configured my Freeradius2.1.7 server to be a proxy server which will forward the PEAP authentication packages to a remote server. The authentication part works great. I configured my switch to send accounting information to the proxy server. The proxy server is using MySQL to store the acct info. This part works fine too. However I'm requested to also send a copy of the acct info to the remote server... I'm still checking my switch (Cisco) and see if it can send two copies of acct info to two different servers at the same time. However, is it possible to make FreeRadius to automatically forward a copy to the remote server?? Thanks! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com INTERNET | MEDIA | VOICE The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

3 2

EAP-TLS + Symbian = weird behaviour
by Zeus V Panchenko 14 Oct '11

14 Oct '11

Hi, may somebody advice, please i have: > uname FreeBSD 8.1-RELEASE amd64 > radiusd -v radiusd: FreeRADIUS Version 2.1.10, for host amd64-portbld-freebsd8.1, built on Apr 4 2011 at 22:44:15 radiusd configured with EAP-TLS only and works fine with xNIX-es, WinXP, Android and Maemo with Symbian (Nokia E51, E52) i face much weird picture ... the same device works fine (getting authorized well) via one AP in my LAN and remote VPN, but receiving !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session for state ... did not finish! !! Please read http://wiki.freeradius.org/Certificate_Compatibility !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! via another AP (in remote VPN, while other OS still authorized well) AP are the same models and configured the same way what can cause this behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 6

SoH and DHCP
by Francois Gaudreault 20 Sep '11

20 Sep '11

Hi, I am trying to make the SoH statements to work using the FreeRADIUS DHCP. However, I have issues to get the SoH values from the NAP client. Maybe someone will be able to help. On the client side, the DHCP NAP policy is set to enabled. Thanks! sites-enabled/dhcp : listen { ipaddr = * port = 67 type = dhcp # interface = eth0 broadcast = yes } dhcp DHCP-Discover { soh update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp DHCP-Request { soh update reply { DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } passwd mac2ip { filename = ${confdir}/mac2ip format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," } The Debug : Received DHCP-Discover of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Hostname = "TestingLaptop" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor DHCP-Vendor = 0xdc00 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} [soh] SoH adding NAP marker to DHCP reply ++[soh] returns ok ++[reply] returns ok ++[reply] returns ok [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Vendor = 0xdc0350414e DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1767. Cleaning up request 1767 ID 1763899400 with timestamp +76404 Going to the next request Ready to process requests. Received DHCP-Request of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Request DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Requested-IP-Address = 10.0.0.245 DHCP-DHCP-Server-Identifier = 10.0.0.243 DHCP-Hostname = "TestingLaptop" DHCP-Client-FQDN = "\000\000\000TestingLaptop.inverse.local" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} ++[soh] returns noop ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Ack of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1768. -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 5

Problem with rml_sqlcounter with GigaByte datavolume
by Hanno Schupp 14 Sep '11

14 Sep '11

Dear All, can I ask for some pointers please. in my FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu (Ubuntu LTS 10.04) installation I have followed the Gigabyte instructions on the FreeRADIUS wiki's FAQ http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Oct…. The Usage is calculated correctly, but the check_item value is not what I expect to see (1.7 GB as opposed th 6GB set in radcheck). I understand who the system determines the counter value and it is correctly calculated, but where does the check_item vlaue of 1.7GB come from? I have no idea to be truthful. Any pointers welcome. Thanks in advance. Here the data/logs: Here the relevant debug log: Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Entering module authorize code Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: 'SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}'' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Debug: sqlcounter_expand: '%{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'}' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{User-Name} -> lapzel14 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_set_user escaped user --> 'lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' -> SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Reserving sql socket id: 3 Sat Jun 4 23:10:21 2011 : Debug: rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14' Sat Jun 4 23:10:21 2011 : Info: [noresettotal] sql_xlat finished Sat Jun 4 23:10:21 2011 : Debug: rlm_sql (sql03): Released sql socket id: 3 Sat Jun 4 23:10:21 2011 : Info: [noresettotal] expand: %{sql03:SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='lapzel14'} -> 2147513300 Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Sat Jun 4 23:10:21 2011 : Debug: rlm_sqlcounter: Rejected user lapzel14, check_item=1705032704, counter=2147513300 Sat Jun 4 23:10:21 2011 : Info: ++[noresettotal] returns reject Definition of the noresettotal module in counter.conf: sqlcounter noresettotal { counter-name = Max-All-Total-Octets check-name = Max-All-Total reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql03 key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctInputOctets) + SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}'" } and here the radcheck values for user 'lapzel14': [image: Full Texts]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> id<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> UserName<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Attribute<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> op<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> Value<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…>[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572098lapzel14User-Password:=loxdas[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572102lapzel14Expiration:=1311932528[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572106lapzel14Simultaneous-Use:=1[image: Edit]<http://login02.chillifire.net/phpmyadmin/tbl_change.php?db=radius&table=rad…>[image: Delete]<http://login02.chillifire.net/phpmyadmin/sql.php?db=radius&table=radcheck&s…> 572110lapzel14Max-All-Total:=6000000000

7 17

Radius Access-Challenge and Apache
by Daniel Abels 07 Sep '11

07 Sep '11

Hi all, I have developed a rlm_perl script for FreeRadius to provide an Access-Challenge response upon an initial successful login (i.e. enter username & password, receive access-challenge, then enter a code.) I'm having some trouble getting the an access-challenge "reply message" to display on a web browser. I'm not sure if I have something configured incorrectly, or If my expectations of what the apache module (mod-auth-radius) should be doing is wrong. According to the documentation from the mod_auth_radius README, when the module receives an "Access-Challenge" response: "...you'll see your username displayed, along with the RADIUS Reply-Message at the top of the authentication window." But I see no such reply-message in the browser. It just displays the same Authentication Realm message ("Radius Authentication Test") for each prompt (tested in Firefox.) I was expecting the reply-message (which is "Please Enter Code") to be displayed instead, is that possible? Upon examining the source code for the module, there appears to be code to handle this. Using Wireshark, it also appears that this message is not returned to the browser. Anyway, if the user enters the correct code at this point, they can reach the web page successfully, so the authentication side of things is not a problem. The server is Debian (squeeze) with freeradius (2.1.10+dfsg-2), apache (2.2.16-6+squeeze1) and libapache2-mod-auth-radius (1.5.8-1) The important portion of my apache configuration is below: # Radius Server Authentication AddRadiusAuth localhost:1812 testing123 5 AddRadiusCookieValid 5 # Test Radius Authentication <Directory /var/www/test/> Options Indexes FollowSymLinks MultiViews AuthType Basic AuthName "Radius Authentication Test" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative On AuthRadiusActive On Require valid-user </Directory> I have performed other tests using a Cisco VPN concentrator and Cisco's VPN client on Windows 7, this works great - the "Access-Challenge" response works (It returns the message "Please Enter Code".) On the command line, this also works using radtest, see below: # radtest user testing localhost 10 testing123 Sending Access-Request of id 150 to 127.0.0.1 port 1812 User-Name = "user" User-Password = "testing" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 rad_recv: Access-Challenge packet from host 127.0.0.1 port 1812, id=150, length=50 Reply-Message = "Please Enter Code" State = 0x6368616c6c656e6765 Any assistance on this matter would be greatly appreciated! Regards, Daniel Abels

2 3

problem with chillispot
by Frank Bonnet 07 Sep '11

07 Sep '11

Hello I'm in trouble using chillispot with freeradius on ubuntu 11.04 server freeradius works well with a LDAP backend but when I start chillispot I get that kind of error messages, the shared secret is OK on both sides as it is a testing install I haven't touch the famous "testing123" Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 56851, id=0, length=162 Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 56851, id=1, length=162 Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Thank you for any idea ...

6 8