October 2012 - Freeradius-Users - lists.freeradius.org

getting rejected, please give me some light.
by Eliezer Croitoru 05 Oct '12

05 Oct '12

I am new with freeradius and I probably didnt understood something yet about how to configure everything: I can authenticate using command line but and on radius wifi but not on NAS\LNS that I' m getting rejected. the logs with couple comments on it: rad_recv: Access-Request packet from host 192.168.10.159 port 54933, id=211, length=43 User-Name = "bob" User-Password = "Hello" # Executing section authorize from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry bob at line 204 ++[files] returns ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' ############### what is that means? what it refers to? i dont have the word loca at all in my files else then the defaults WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. # Executing section post-auth from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 211 to 192.168.10.159 port 54933 Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 10 ID 211 with timestamp +2391 ##this is the rejected request Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.131 port 19606, id=134, length=152 NAS-Identifier = "NAS" NAS-IP-Address = 192.168.10.131 Acct-Session-Id = "9358763-re0-3" NAS-Port = 3 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "00270e08e1c0" NAS-Port-Id = "re0" Vendor-12341-Attr-12 = 0x7265302d33 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:27:0e:08:e1:c0" User-Name = "bob" User-Password = "Hello" # Executing section authorize from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user #it's the basic as before so why the software saying that?what is the difference between the logins (a lot) that makes it's not work with users file? Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /opt/fradius-2.2.0/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Thanks, Eliezer

3 5

bugs.freeradius.org unavailable?
by endo mitsuharu 04 Oct '12

04 Oct '12

Hello, First of all, I would like to express my utmost appreciation for being able to use FreeRADIUS, most especially to everyone involved in the development. In this regard, I tried accessing the "Report a Bug" link (http://bugs.freeradius.org/) posted in FreeRADIUS official web site. However, there seems to be a problem reaching the "Report a Bug" link. I've tried from two different local ISPs without any luck. I would like to refer to the existing bug report, so I would like to ask if bugs.freeradius.org is dead or if the URL has been changed. (or is it just me.) Any information regarding the access problem would greatly help. Please also inform me if this inquiry has been directed to the incorrect recipients and as to where this inquiry be posted. Thank you and hoping for your feedback. --- Thanks, Endo

4 15

rebuilding a FR server
by Andrew Precht 04 Oct '12

04 Oct '12

Hi users, I'm attempting to setup a new virtual FR server on centos6, to replace an aging FR 1.13-1.6.el5 server. I have got the new server setup per the docs at freeradius.org. I've run the simple test using radtest locally and I get an Access-Accept. Also, using NTradPing remotely I get an Access-Accept. So, I think I've got the basic freeradius and firewall setup correctly. Now the hard part... I have no documentation or knowledge base for the old FR setup. It is used to authenticate WiFi users against a proprietary system using a Sybase DB. From what I can tell, it's using a perl script to talk to the db. I say this because of two lines in the radiusd.conf. One is: Auth-Type Perl { perl } and the other is: perl { module = /etc/raddb/sjsu.pl } My question is: Is it as easy as adding the same two lines to my new FR 2.1.12 radiusd.conf and copying over the sjsu.pl to get it to use the perl script? Please advise, thanks for any help...

2 1

Multi-valued attributes
by Lorenzo Milesi 04 Oct '12

04 Oct '12

Hi. Is it possible to use Multi-valued attributes? I have group1 NAS-Identifier =~ nas01|nas02 group2 NAS-Identifier =~ nas03|nas04 I'd like some users which are in group1 to access ALSO group2 nases. Is it possible to do that, without creating a dedicated group? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 1

Dialup Admin and PPPoE
by Serge Paquin 04 Oct '12

04 Oct '12

Hello, I've setup FreeRadius and Dialup Admin to manage it. One item I haven't been able to figure out is how to have the Upload and Download statistics updated on a regular basis. With PPPoE my users stay always on. Looking at the code it seems that transfer statistics are only updated if there is a complete session with a log off. Ideally I'd like something we could run every day or 12 hours or something that would update the transfer statistics even if the user is still online. I've done a lot of searching and read all the documents so if I've missed something I apologize. If somebody has some insight and can point me in the right direction it would be much appreciated. Thanks, Serge.

4 5

sqlcounter instance not found in modules section
by Russell Stockhammer 04 Oct '12

04 Oct '12

Hey Everyone, I'm trying to create a new sqlcounter instance that counts octets. I think what I've done is correct but I get the following error when I start FreeRadius... -------- Mon Oct 1 21:09:41 2012 : Error: /usr/local/etc/raddb/sites-enabled/default[203]: Failed to find "dailyoctetcounter" in the "modules" section. Mon Oct 1 21:09:41 2012 : Error: /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. Mon Oct 1 21:09:41 2012 : Error: Failed to load virtual server <default> -------- This error also occurs when I change the name of "dailycounter" to be "dailytimecounter". My relivant config is as follows... ---- radius.conf ---- instantiate { dailycounter dailyoctetcounter } --------- ---- sql/mysql/counter.conf ---- sqlcounter dailyoctetcounter { counter-name = Daily-Session-Octet check-name = Max-Daily-Session-Octet reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctinputoctets + acctoutputoctets) \ FROM radacct WHERE username = '%{%k}' \ AND UNIX_TIMESTAMP(acctstarttime) > '%b'" } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } -------- ---- sites-enabled/default ---- authorize { dailycounter { reject = 1 } if (reject) { update reply { Reply-Message := "Your daily time limit is up!" } ok = reject } dailyoctetcounter { reject = 1 } if (reject) { update reply { Reply-Message := "Your daily transfer limit is up!" } ok = reject } } -------- Is there a set of keywords that are only valid for sqlcounters? Or like I think anything that isn't already another instance should be vaild. Please tell me where I'm going wrong with my config. Thanks Russ

3 7

*** glibc detected *** /usr/local/sbin/radiusd: malloc(): memory corruption: 0x000000000e253360 ***
by Armando Oliveira 03 Oct '12

03 Oct '12

Hello Got this on 2.1.5. The server was ok until now (it's running without problems within the last 2 years), and now it crashes several time per day. Any help ?

2 2

simple accounting proxy setup.
by Bill Schoolfield 02 Oct '12

02 Oct '12

Looking for help in setting up simple (single) accounting relay (forward). Its been awhile since I last used freeradius and I'm use to the old radrelay program. I see that has been replaced with internal based methods. I've read what documents and comments I could find, but haven't been able to see the entire picture. I've set things up but so far no luck at getting the accounting packets forwarded. In keeping with recommended practice, I have modified very little. I edited the proxy.conf file and enabled the copy-acct-to-home-server server. What else do I need to do? Could someone provide a working example configuration? I'm a little shaky on the realm processing. Perhaps that's the issue. The sever log appears to show just a normal (local) receipt of the accounting record: Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 44057, id=153, length=102 Acct-Session-Id = "6000006B" User-Name = "Fnord" NAS-IP-Address = 192.168.3.5 NAS-Port-Id = "32" NAS-Port-Type = Async Acct-Status-Type = Start Connect-Info = "46000 LAPM/V42BIS" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.5.66 Acct-Delay-Time = 0 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',Client-IP-Address = 127.0.0.1,NAS-IP-Address = 192.168.3.5,Acct-Session-Id = "6000006B",User-Name = "Fnord"' [acct_unique] Acct-Unique-Session-ID = "cce9407c7efa55eb". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "Fnord", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/detail-20121001 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/detail-20121001 [detail] expand: %t -> Mon Oct 1 20:00:15 2012 ++[detail] returns ok ++[unix] returns noop [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> Fnord rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[radutmp] returns noop [sql] expand: %{User-Name} -> Fnord [sql] sql_set_user escaped user --> 'Fnord' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, na sportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, conn ectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedp rotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acc t-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', N ULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> Fnord attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 153 to 127.0.0.1 port 44057 Finished request 0. Cleaning up request 0 ID 153 with timestamp +178 Going to the next request Ready to process requests. TIA, Bill

3 7

Re: Re: Customization of authorize_reply_query
by Václav Pernica 02 Oct '12

02 Oct '12

Phil Mayers: > > Just set a null query e.g. > > select null where 1=0 > Thanks a lot! This was the hint I need.. I used: select null from table where 1=0 because it required FROM. One more question. I set the number of sql connections to make to server to 5 (default value). I noticed that if all connections are currently in use, the authentication fails: Tue Oct 2 16:07:10 2012 : Error: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Is there some parameter that would cause to wait until next next connection will be available instead of failing authentication? Thanks Vaclav

3 2

RE: exec module not seeming to run something
by Franks Andy (RLZ) IT Systems Engineer 02 Oct '12

02 Oct '12

Thanks Alan, Good call about the path thing. I also forgot about the ssh prompt to accept a new ssh key, which obviously can't be seen, so copied the known_hosts file from another user to the freerad/.ssh folder and altered the permissions. Works fine now Thanks very much Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 02 October 2012 10:30 To: FreeRadius users mailing list Subject: Re: exec module not seeming to run something Franks Andy (RLZ) IT Systems Engineer wrote: > The problem is it doesn’t work. I can run the script from a shell prompt > and the backup functions fine, the variables outputting to the > testssh.out file and the ssh command running ok. Freeradius fires the > script off ok after an accounting session and the bits get written to > the testssh.out file, including the PID of the ssh process but the > command itself doesn’t work. > > Am I missing something obvious (again)? PATH Use the complete filename for all executables in the shell script. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0