January 2012 - Freeradius-Users - lists.freeradius.org

test suite simulating NAS for development?
by Mark McWiggins 14 Feb '12

14 Feb '12

Hi All, We're developing an application to capture log data from Radius, but we don't have a NAS to test with to generate the logs. Is there some test suite available to do this? Thanks much; if none is available we will probably develop one and I think our management will consent to share it. -- Mark McWiggins Client Integration Engineer mark.mcwiggins(a)messagesystems.com 443-656-3311 ext 344

6 9

Problems sending session-timeout
by tonimanel 03 Feb '12

03 Feb '12

Hi guys, I have a problem with my freeradius service. I would like to get that freeradius sends to my NAS the session-timeout attribute. Can you tell my how could I get it? This is the output result: FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 50 reject_delay = 3 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "19m_K28hespggeR" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 8 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 7 rlm_sql (sql): Read entry nasname=80.26.102.157,shortname=NataliWifi,secret=sj6bo5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 80.26.102.157 (NataliWifi, server=<none>) to clients list rlm_sql (sql): Read entry nasname=0.0.0.0/0,shortname=FaberWifi,secret=62p@%5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 0.0.0.0 (FaberWifi, server=<none>) to clients list rlm_sql (sql): Read entry nasname=213.0.2.116,shortname=WifiPoint,secret=Mb6xUH14yXK27F1d rlm_sql (sql): Adding client 213.0.2.116 (WifiPoint, server=<none>) to clients list rlm_sql (sql): Read entry nasname=80.36.217.106,shortname=PamadiWifi,secret=mk5mk5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 80.36.217.106 (PamadiWifi, server=<none>) to clients list rlm_sql (sql): Read entry nasname=213.97.154.93,shortname=PamadiWifiArenas,secret=mk6ml5RdYsmME@uyf8yuTq9x4SVb39 rlm_sql (sql): Adding client 213.97.154.93 (PamadiWifiArenas, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 7 Module: Linked to module rlm_sqlcounter Module: Instantiating module "unuso" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter unuso { counter-name = "One-All-Session-Time" check-name = "One-All-Session" key = "User-Name" sqlmod-inst = "sql" query = "SELECT UNIX_TIMESTAMP()-UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName='%{%k}' ORDER BY AcctStartTime LIMIT 1" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute One-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute One-All-Session is number 11274 rlm_sqlcounter: Current Time: 1327590641 [2012-01-26 16:10:41], Next reset 0 [2012-01-26 16:00:00] rlm_sqlcounter: Current Time: 1327590641 [2012-01-26 16:10:41], Prev reset 0 [2012-01-26 16:00:00] Module: Instantiating module "noresetcounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11275 rlm_sqlcounter: Check attribute Max-All-Session is number 11276 rlm_sqlcounter: Current Time: 1327590641 [2012-01-26 16:10:41], Next reset 0 [2012-01-26 16:00:00] rlm_sqlcounter: Current Time: 1327590641 [2012-01-26 16:10:41], Prev reset 0 [2012-01-26 16:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 217.127.52.231 port 50992, id=16, length=121 User-Name = "nu533GIDU" Acct-Session-Id = "1327590646R21kln" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "Localhost" NAS-Port = 0 Calling-Station-Id = "demohotspot" User-Password = "XIWOVA42" Message-Authenticator = 0x9a2efd35607129a6faab0f5a1fd93c47 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [sql] expand: %{User-Name} -> nu533GIDU [sql] sql_set_user escaped user --> 'nu533GIDU' rlm_sql (sql): Reserving sql socket id: 6 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'nu533GIDU' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'nu533GIDU' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'nu533GIDU' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pruebasibi20min' ORDER BY id [sql] User found in group pruebasibi20min [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'pruebasibi20min' ORDER BY id rlm_sql (sql): Released sql socket id: 6 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[unuso] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='nu533GIDU' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='nu533GIDU'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> nu533GIDU [noresetcounter] sql_set_user escaped user --> 'nu533GIDU' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='nu533GIDU' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='nu533GIDU' rlm_sql (sql): Reserving sql socket id: 5 [noresetcounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 5 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='nu533GIDU'} -> rlm_sqlcounter: No integer found in string "" ++[noresetcounter] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "XIWOVA42" [pap] Using clear text password "XIWOVA42" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 16 to 217.127.52.231 port 50992 Acct-Interim-Interval := 600 Idle-Timeout := 300 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 16 with timestamp +4 Ready to process requests. /*****************************************************************************/ I hope your suggestions. Thanks. Regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-sending-session-timeout-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 17

Newbie and Sqlippool
by Antonio Modesto 03 Feb '12

03 Feb '12

Hi, I am trying to test sqlippool on freeradius, but i've found that the documentation explains very well how to implement it, but it doesn't explain very well how I can set a user or a group to use this pool. Can someone explain me how can I do this? i've set up a pool called 'main_pool' in my database: select * from radippool; +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationID | expiry_time | username | pool_key | +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | 1 | main_pool | 172.16.254.1 | | | | 0000-00-00 00:00:00 | | | +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ 1 row in set (0.01 sec) and I have this user: select * from radcheck; +----+----------+---------------+----+-------+-------+ | id | UserName | Attribute | op | Value | ativo | +----+----------+---------------+----+-------+-------+ | 1 | modesto | User-Password | == | 12345 | S | +----+----------+---------------+----+-------+-------+ 1 row in set (0.00 sec) I've already tried to associate the Pool-Name attribute with this user, but it didn't work. Can someone explain me how this stuff works or send me a more detailed documentation? Thanks in advance. Regards.

3 14

Verifying you are Joining the Active Directory Domain
by Gilmour, Scott 01 Feb '12

01 Feb '12

Hi, Still can't figure out why the clock is skewed since both my Ubuntu and Active Directory server are showing the same time and Date. My Ubuntu server is an NTP Server but when I issue the command net time system I get this error Can't contact server (null). Error NT_STATUS_BAD_NETWORK_NAME It looks like it joined the domain but when I do a wbinfo -u it gives me an error message: Error looking up domain users. Plus when I go to my 2008 Server and I open up Active Directory, Select my Domain and choose Domain Controllers that my FreeRadius Server isn't listed in that directory but it is listed under computers. Is this correct? Thanks Scott root@FreeRadius:/home/sqauser# net ads join -U Administrator Enter Administrator's password: Using short domain name -- SQA Joined 'FREERADIUS' to realm 'SQA.net' [2012/01/31 15:44:15, 0] libads/kerberos.c:333(ads_kinit_password) kerberos_kinit_password FREERADIUS$(a)SQA.NET failed: Clock skew too great root@FreeRadius:/home/sqauser# root@FreeRadius:/home/sqauser# wbinfo -u Error looking up domain users root@FreeRadius:/home/sqauser#

4 3

Re: Joining Active Directory Domain
by Alan Buxey 31 Jan '12

31 Jan '12

You do have a SRV record in your DNS pointing to required _kerberos._tcp.$domain (usually don't need to have krb5.conf configured because if this). If not, you should be able to choose the DC IP address on the net add join command line. ..giving IT infrastructure advice from corner of pub. The internet has a lot to answer for! ;) alan -- This smartphone has free worldwide WiFi access using eduroam. Now. that IS smart.

1 0

Joining Active Directory Domain
by Gilmour, Scott 31 Jan '12

31 Jan '12

> Hi, > > I am following the FreeRadius Beginners Guide book on how to > > join a domain. I keep on getting this error when running the command. > > root@FreeRadius:/etc# net ads join -U Administrator > > Enter Administrator's password: > > Using short domain name -- SQA > > Joined 'FREERADIUS' to realm 'SQA.net' > > [2012/01/31 10:21:29, 0] libads/kerberos.c:333(ads_kinit_password) > > kerberos_kinit_password FREERADIUS$(a)SQA.NET failed: Clock skew too great > > No DNS domain configured for freeradius. Unable to perform DNS Update. > > DNS update failed! This is Samba being annoying. The "net ads" stuff "cares" about your hostname, i.e. $ hostname freeradius ...won't work. You can fool it by temporarily changing your domain to: $ hostname freeradius.soa.net Hi, I am assuming I should edit the $ hostname freeradius.sqa.net in the /etc/hostname file? The only config file I don't have is the krbd5 config file but it ays it is not necessary in the www.deployingradius.com website. You may also have to edit the /etc/krb5.conf file, to add an entry that points to the Active Directory Server. This is often not necessary, as Samba can just "figure it out" when Active Directory is also the main DNS server. I am unable to installthe krdb5-kdc file using the synaptic package manager. Still getting this error: root@FreeRadius:/home/sqauser# net join -U Administrator Enter Administrator's password: Failed to join domain: failed to find DC for domain SQA.NET ADS join did not work, falling back to RPC... Unable to find a suitable server for domain SQA Unable to find a suitable server for domain SQA root@FreeRadius:/home/sqauser# Thanks for everyones feedback. I will continue to debug my issue. Scott

1 0

Re: Joining Active Directory Domain
by Alan Buxey 31 Jan '12

31 Jan '12

And your system time is too far from that of the AD. Ensure you are sync'd eg with ntpdate or ntpd alan

1 0

Joining Active Directory Domain
by Gilmour, Scott 31 Jan '12

31 Jan '12

Hi, I am following the FreeRadius Beginners Guide book on how to join a domain. I keep on getting this error when running the command. root@FreeRadius:/etc# net ads join -U Administrator Enter Administrator's password: Using short domain name -- SQA Joined 'FREERADIUS' to realm 'SQA.net' [2012/01/31 10:21:29, 0] libads/kerberos.c:333(ads_kinit_password) kerberos_kinit_password FREERADIUS$(a)SQA.NET failed: Clock skew too great No DNS domain configured for freeradius. Unable to perform DNS Update. DNS update failed! root@FreeRadius:/etc# I have checked the clock, added the dns forward lookup zone to the AD Doman. Add the AD Server to the resolv.conf and etc/hosts files. I am able to ping both servers. I am attempting to join my FreeRadius domain to my 2008 Server Active Directory Domain. Thanks Scott

3 2

Segmentation Fault in 2.1.12 - rlm_eap-2.1.12.so
by DaveA 31 Jan '12

31 Jan '12

FreeRadius has been stable for about a month, up until yesterday, and I have not changed the configuration of the server. I began seeing segmentation faults as seen below: #grep radiusd /var/log/messages Jan 30 15:53:03 radius1 kernel: radiusd[14764]: segfault at 70 ip 00007fb9d4ba81ed sp 00007fb9917fa490 error 4 in rlm_eap-2.1.12.so[7fb9d4ba6000+7000] Jan 31 09:09:43 radius1 kernel: radiusd[26073]: segfault at 70 ip 00007fe5e2c9a1ed sp 00007fe5a2bfc490 error 4 in rlm_eap-2.1.12.so[7fe5e2c98000+7000] Jan 31 09:12:33 radius1 kernel: radiusd[8743]: segfault at 70 ip 00007fa6d3acc1ed sp 00007fa6cd241490 error 4 in rlm_eap-2.1.12.so[7fa6d3aca000+7000] Jan 31 09:20:38 radius1 kernel: radiusd[9849]: segfault at 70 ip 00007ff092a6c1ed sp 00007ff08fde7490 error 4 in rlm_eap-2.1.12.so[7ff092a6a000+7000] I have not included my radiusd -X because it will need to be heavily censored and I have my fingers crossed that someone can help with only the information I've provided. Can anyone tell me how to prevent this, or if a fix is available? Thank you, Dave A. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Segmentation-Fault-in-2-1-12-rlm-ea… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Using different realm in the same server
by Gabriele Brosulo 31 Jan '12

31 Jan '12

Hi all, I'm trying to use different realm into the same server, but I probably miss something. I just want to check my users in radcheck table as user@realm, but I can't get it working. here you are my radcheck table mysql> select * from radcheck where username like 'tesths%'; +----+------------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+------------------+--------------------+----+--------------+ | 5 | tesths2 | Cleartext-Password | := | tesths2 | | 4 | tesths@drupalAP1 | Cleartext-Password | := | tesths | | 11 | tesths@drupalAP1 | Login-Time | := | Any1000-2000 | | 8 | tesths@drupalAP1 | Max-Daily-Session | := | 36000 | | 12 | tesths@drupalAP1 | Expiration | := | 31 Mar 2012 | +----+------------------+--------------------+----+--------------+ 5 rows in set (0.03 sec) Following the output of freeradius -X replying to my Access-Request. As you can see it search for the cleartext password for tesths@drupalAP1, but it doesn't find it: rad_recv: Access-Request packet from host 213.144.94.217 port 2060, id=64, length=322 ChilliSpot-Version = "1.2.7-svn" User-Name = "tesths@drupalAP1" CHAP-Challenge = 0x1d5cbf018e5c3e1f0f27db84019d6334 CHAP-Password = 0x00e56e25844efe021fe0ada407d300798d Service-Type = Login-User Acct-Session-Id = "4f28155900000001" Framed-IP-Address = 10.1.0.3 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" Calling-Station-Id = "48-5D-60-71-DC-CC" Called-Station-Id = "58-6D-8F-B4-69-F7" NAS-IP-Address = 192.168.2.152 NAS-Identifier = "coovaAP01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Coova_HotSpot01" WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3660/logoff" Message-Authenticator = 0xcbdb61af05f57eb2c5ef22c62a339623 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "drupalAP1" for User-Name = "tesths@drupalAP1" [suffix] No such realm "drupalAP1" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> tesths@drupalAP1 [sql] sql_set_user escaped user --> 'tesths@drupalAP1' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tesths@drupalAP1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tesths@drupalAP1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tesths@drupalAP1' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400'' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' -> SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400'}' [dailycounter] sql_xlat [dailycounter] expand: %{User-Name} -> tesths@drupalAP1 [dailycounter] sql_set_user escaped user --> 'tesths@drupalAP1' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' -> SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400' rlm_sql (sql): Reserving sql socket id: 0 [dailycounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 0 [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1327964400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'tesths@drupalAP1' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1327964400'} -> rlm_sqlcounter: No integer found in string "" ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [expiration] Checking Expiration time: '31 Mar 2012' ++[expiration] returns ok rlm_logintime: Checking Login-Time: 'Any1000-2000' rlm_logintime: timestr returned accept rlm_logintime: Session-Timeout set to: 9240 ++[logintime] returns ok [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "tesths@drupalAP1" with CHAP password [chap] Using clear text password "tesths" for user tesths@drupalAP1 authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tesths@drupalAP1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 64 to 213.144.94.217 port 2060 Waking up in 4.9 seconds. Cleaning up request 3 ID 64 with timestamp +378 Ready to process requests. How can I have the realm be part of the authentication? Thanks a lot -- Gabriele Dr. Brosulo Responsabile Web EdiSoft Srl

1 0