December 2012 - Freeradius-Users - lists.freeradius.org

WARNING: Please replace '%S' with '${sqlmod-inst}'
by Prabhpal S. Mavi 22 Dec '12

22 Dec '12

Hi List what does this means? i do not see any %S in query. WARNING: Please replace '%S' with '${sqlmod-inst}' rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime) FROM radacct WHERE username='User-Name' AND acctstarttime > FROM_UNIXTIME('0')' [noresetcounter] expand: SELECT SUM(acctsessiontime) FROM radacct WHERE username='User-Name' AND acctstarttime > FROM_UNIXTIME('0') -> SELECT SUM(acctsessiontime) FROM radacct WHERE username='User-Name' AND acctstarttime > FROM_UNIXTIME('0') WARNING: Please replace '%S' with '${sqlmod-inst}' Thanks

2 1

Re: Issue with Kerberos
by Alan Buxey 21 Dec '12

21 Dec '12

You can sort out the host key file if you want. PAP gives a warning because it hasnt been given a plain text password to test/verify....that's okay as you don't need it...and it does tell you things MAY fail. Alan

1 0

session attribute Freeradius freeradius-utils-2.1.12
by Prabhpal S. Mavi 21 Dec '12

21 Dec '12

Greetings, can someone assist me to know how to identify that if my freeradiud is including session time-out attribute in reply from "radius -X". if i execute "radius -X" i get the following related to session time-out, 1.) INTERVAL (%{%{Acct-Session-Time}:-0} 2.) %{Acct-Session-Time}', does this mean it includes the attribute. if i am sure i can focus in NAS side because session time-out is not working with me. i am bit confuse where is the problem. thanks for attending it. freeradius-2.1.12-4.el6_3.x86_64 freeradius-utils-2.1.12-4.el6_3.x86_64 Regards

2 1

Re: freeradius query on password encryption and decryption
by Alan Buxey 21 Dec '12

21 Dec '12

Yes. All clients will have a place where the shared secret is configured EVEN if the target is the locahost (that doesn't change the spec!) Check the seagull docs and XML profile Alan

1 0

Need Help - Problem Working With Session Time Out
by Prabhpal S. Mavi 21 Dec '12

21 Dec '12

Hi Dear List Members, Radius do not send session timeout attribute in result user do not log off after time expired. Can anyone help please? what i have done. enabled cunters.sql in "radius.conf & sql.sonf" my counters. sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" } radiusd -X INTERVAL (%{%{Acct-Session-Time}:-0} Thanks

1 0

Sub-TLVs how to have the same kind of descriptor twice
by Sven Tantau 21 Dec '12

21 Dec '12

Hello, I am running version 3.0.0 and have a question about sub-tlvs: I am looking at: WiMAX-QoS-Descriptor as it is defined in dictionary.wimax.alvarion (the standard dictionary.wimax does not get included/is commented out) This is the situation: My reply has to contain two QoS profiles. testingstuff(a)internet.ao Cleartext-Password := "sven" Alvarion-R3-IF-Name+=cpe_mgnt_sg, Alvarion-PDFID+=1, WiMAX-Packet-Data-Flow-Id+=1, WiMAX-Direction+=3, WiMAX-Transport-Type+=1, WiMAX-Uplink-QOS-Id+=2, WiMAX-Downlink-QOS-Id+=3, WiMAX-ClassifierID+=1, WiMAX-Classifier-Priority+=2, WiMAX-Classifier-Direction+=3, WiMAX-IP-TOS-DSCP-Range-and-Mask+=0x1818FF, WiMAX-QoS-Id+=2, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000, WiMAX-QoS-Id+=3, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000 I checked the debug output and could see this: Alvarion-R3-IF-Name += "cpe_mgnt_sg" 01 0d 63 70 65 5f 6d 67 6e 74 5f 73 67 ..(skipped some attributes).. WiMAX-Uplink-QOS-Id += 2 07 03 02 WiMAX-Downlink-QOS-Id += 3 08 03 03 WiMAX-ClassifierID += 1 01 03 01 WiMAX-Classifier-Priority += 2 02 03 02 WiMAX-Classifier-Direction += Bi-Directional 04 03 03 WiMAX-IP-TOS-DSCP-Range-and-Mask += 0x1818ff 07 05 18 18 ff WiMAX-Classifier = ... 0b 10 01 03 01 02 03 02 04 03 03 07 05 18 18 ff WiMAX-Packet-Flow-Descriptor = ... 1a 29 000060b5 (24757) 1c 23 00 01 04 00 01 04 03 03 06 03 01 07 03 02 08 03 03 0b 10 01 03 01 02 03 02 04 03 03 07 05 18 18 ff WiMAX-QoS-Id += 2 01 03 02 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Id += 3 01 03 03 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Descriptor = ... 1a 27 000060b5 (24757) 1d 21 00 01 03 02 04 03 02 05 03 01 06 06 00 01 f4 00 01 03 03 04 03 02 05 03 01 06 06 00 01 f4 00 You can see that the 2 QoS profiles are both contained in the created WiMAX-QoS-Descriptor. What I need is to have two WiMAX-QoS-Descriptors. One for each QoS definition. I can archive that by putting another attribute between the QoS attributes: xnewstuff(a)internet.ao Cleartext-Password := "sven" Alvarion-R3-IF-Name+=cpe_mgnt_sg, ...(skipped some attributes)... WiMAX-QoS-Id+=2, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000, added-> Acct-Interim-Interval+=60, WiMAX-QoS-Id+=3, WiMAX-Schedule-Type+=2, WiMAX-Traffic-Priority+=1, WiMAX-Maximum-Sustained-Traffic-Rate+=128000 The debug output now looks like this: (and is pretty close to what I expect) Alvarion-R3-IF-Name += "cpe_mgnt_sg" 01 0d 63 70 65 5f 6d 67 6e 74 5f 73 67 ...(some attributes skipped).... WiMAX-QoS-Id += 2 01 03 02 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Descriptor = ... 1a 18 000060b5 (24757) 1d 12 00 01 03 02 04 03 02 05 03 01 06 06 00 01 f4 00 Acct-Interim-Interval += 60 55 06 00 00 00 3c WiMAX-QoS-Id += 3 01 03 03 WiMAX-Schedule-Type += Best-Effort 04 03 02 WiMAX-Traffic-Priority += 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate += 128000 06 06 00 01 f4 00 WiMAX-QoS-Descriptor = ... 1a 18 000060b5 (24757) 1d 12 00 01 03 03 04 03 02 05 03 01 06 06 00 01 f4 00 Somehow the freeradius now sees that the first QoS flow is finished and creates the WiMAX-QoS-Descriptor out of the values. Then it puts in the newly introduced value (Acct-Interim-Interval+=60). And at the end it created the second WiMAX-QoS-Descriptor out of the definition for the second QoS flow. In case it is not clear: I would like to have the two QoS flows to create two WiMAX-QoS-Descriptors, instead of one that combines the two. How does freeradius know when a 'sub-TLV' definition is finished? What am I missing? I hope that this request is somehow understandable. Please let me know in case you need further clarification or if you want me to include more information or debug output. Thanks for your good work. Best regards, Sven -- Internet Technologies Angola / Systems Department Tel: +244 (227) 286 000 / (924) 770 290 / (924) 770 291 Skype: internet-technologies-angola Mobile: +244 931 696413 Mail: sven(a)internet.ao

3 6

freeradius query on password encryption and decryption
by Yashaswini Sathyanarayana 21 Dec '12

21 Dec '12

HI, I am using seagull testing tool to send messages to free radius. I am running seagull with "radius protocol ". When i send messages from seagull to freeradius , the password is not getting decrypted properly on radius side. Can you please tell me how to send password from seagull without encryption ?? OR What changes to make on freeradius side to make it decrypt the password?? Thanks & Regards, Yashaswini | Prod Engg | Tech Mahindra Ltd. 9 / 7 Hosur Road, Bangalore - 560029, India. (Office: +91 80 40243000, Extn: 3478 Mobile: +91 9611591177 www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

4 8

freeRadius 2.x
by rosect190＠yahoo.com 20 Dec '12

20 Dec '12

It is noticed that some VSAs are sent with Access-Challenge but not with Access-Accept when PEAP is used. Is there a way to configure the server such that those attributes are sent with Access-Accept? Thank you.

4 3

user-agent as authentication
by Budiono Untung 20 Dec '12

20 Dec '12

Hi All, I would like to make wifi hotspot , with user-agent as authentication to freeradius . The scenario is like this: If the user-agent is 'a' then it will rejected and if user-agent is 'b' then it will be allowed to login page that connected to freeradius as authenticator. Is above scenario will be possible ? TIA, Dion

2 3

Problem with proxying request
by BALSIANOK, Peter 20 Dec '12

20 Dec '12

Hi, I try to send proxy request via freeradius-2.2.0, but as i can see in the debug output, freeradius didn`t process Accounting Response ( tcpdump shows, that server got response ) rad_recv: Accounting-Request packet from host 127.0.0.1 port 49935, id=13, length=202 X-Ascend-Dial-Number != "<U+0557>\331\025" Acct-Session-Id != "d597d91572f51ab3" Service-Type != Framed-User Called-Station-Id != "orangewap" Acct-Link-Count != 1 X-Ascend-Metric != 1928665779 Acct-Authentic != Local Acct-Status-Type != Start NAS-IP-Address != 10.64.192.1 X-Ascend-PRI-Number-Type != 8 3GPP-SGSN-Address != 213.151.252.35 Calling-Station-Id != "421905012405" X-Ascend-IPX-Alias != 4294967295 Framed-Protocol != GPRS-PDP-Context User-Name != "421905012405" NAS-Identifier != "ggsn-01-bb1.orange.sk" Acct-Multi-Session-Id != "d597d9153962de6b" Framed-IP-Address != 10.10.1.1 (2) # Executing section preacct from file /app/radius/raddb/ggsn//sites-enabled/default (2) group preacct { (2) - entering group preacct {...} (2) [preprocess] = ok (2) linelog : escape: 'Start' -> 'Start' (2) linelog : expand: '%{Acct-Status-Type}' -> 'Start' (2) linelog : expand: 'Accounting-Request.%{%{Acct-Status-Type}:-unknown}' -> 'Accounting-Request.Start' (2) linelog : expand: '/app_log/radius/ggsn/ggsn-acct.dat' -> '/app_log/radius/ggsn/ggsn-acct.dat' (2) linelog : escape: 'Start' -> 'Start' (2) linelog : escape: '421905012405' -> '421905012405' (2) linelog : escape: '10.10.1.1' -> '10.10.1.1' (2) linelog : escape: 'orangewap' -> 'orangewap' (2) linelog : escape: '10.64.192.1' -> '10.64.192.1' (2) linelog : escape: '213.151.252.35' -> '213.151.252.35' (2) linelog : escape: 'd597d9153962de6b' -> 'd597d9153962de6b' (2) linelog : expand: '%{Acct-Status-Type}:%{Calling-Station-Id}:%{Framed-IP-Address}:%{Called-Station-Id}:%{NAS-IP-Address}:%{3GPP-SGSN-Address}:%{Acct-Multi-Session-Id}:%l' -> 'Start:421905012405:10.10.1.1:orangewap:10.64.192.1:213.151.252.35:d597d9153962de6b:1355835824' (2) [linelog] = ok (2) suffix : No '@' in User-Name = "421905012405", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) files : acct_users: Matched entry DEFAULT at line 25 (2) [files] = ok (2) # Executing section accounting from file /app/radius/raddb/ggsn//sites-enabled/default (2) group accounting { (2) - entering group accounting {...} (2) attr_filter.accounting_response : expand: '%{User-Name}' -> '421905012405' (2) attr_filter.accounting_response : Matched entry DEFAULT at line 103 (2) [attr_filter.accounting_response] = updated (2) # Executing section pre-proxy from file /app/radius/raddb/ggsn//sites-enabled/default (2) group pre-proxy { (2) - entering group pre-proxy {...} (2) files : preproxy_users: Matched entry DEFAULT at line 33 (2) files : expand: '%{Called-Station-Id}.%{3GPP-SGSN-Address}' -> 'orangewap.213.151.252.35' (2) [files] = ok (2) Proxying request to home server 213.151.250.149 port 1813 Sending Accounting-Request of id 93 from 255.255.255.255 port 56347 to 213.151.250.149 port 1813 X-Ascend-Dial-Number != "<U+0557>\331\025" Acct-Session-Id != "d597d91572f51ab3" Service-Type != Framed-User Called-Station-Id = "orangewap.213.151.252.35" Acct-Link-Count != 1 X-Ascend-Metric != 1928665779 Acct-Authentic != Local Acct-Status-Type != Start NAS-IP-Address != 10.64.192.1 X-Ascend-PRI-Number-Type != 8 3GPP-SGSN-Address != 213.151.252.35 Calling-Station-Id != "421905012405" X-Ascend-IPX-Alias != 4294967295 Framed-Protocol != GPRS-PDP-Context User-Name != "421905012405" NAS-Identifier != "ggsn-01-bb1.orange.sk" Acct-Multi-Session-Id != "d597d9153962de6b" Framed-IP-Address != 10.10.1.1 Event-Timestamp != "Dec 18 2012 14:03:44 CET" Proxy-State != 0x3133 Waking up in 0.3 seconds. Waking up in 0.4 seconds. (2) Expecting proxy response no later than 14 seconds from now Waking up in 13.1 seconds. (2) No proxy response, giving up on request and marking it done (2) Failing request due to lack of any response from home server 213.151.250.149 port 1813 No Post-Proxy-Type Fail: ignoring (2) Cleaning up request packet ID 13 with timestamp +323 Ready to process requests. Here is tcp dump of the communication between freeradius and 3rdparty radius server: 14:03:44.828028 IP (tos 0x0, ttl 64, id 16529, offset 0, flags [none], proto: UDP (17), length: 255) tdrad1.vas.orange.sk.56347 > dial-250-149.orange.sk.radius-acct: [bad udp cksum 9e40!] RADIUS, length: 227 Accounting Request (4), id: 0x5d, Authenticator: 872eb1da3e3ae0c483a4ee7eec20d78c Unknown Attribute (227), length: 12, Value: 0x0000: 3c55 2b30 3535 373e d915 Accounting Session ID Attribute (44), length: 18, Value: d597d91572f51ab3 0x0000: 6435 3937 6439 3135 3732 6635 3161 6233 Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Called Station Attribute (30), length: 26, Value: orangewap.213.151.252.35 0x0000: 6f72 616e 6765 7761 702e 3231 332e 3135 0x0010: 312e 3235 322e 3335 Accounting Link Count Attribute (51), length: 6, Value: 1 0x0000: 0000 0001 Unknown Attribute (225), length: 6, Value: 0x0000: 72f5 1ab3 Accounting Authentication Attribute (45), length: 6, Value: Local 0x0000: 0000 0002 Accounting Status Attribute (40), length: 6, Value: Start 0x0000: 0000 0001 NAS IP Address Attribute (4), length: 6, Value: 10.64.192.1 0x0000: 0a40 c001 Unknown Attribute (226), length: 6, Value: 0x0000: 0000 0008 Vendor Specific Attribute (26), length: 12, Value: Vendor: 3GPP (10415) Vendor Attribute: 6, Length: 4, Value: ...# 0x0000: 0000 28af 0606 d597 fc23 Calling Station Attribute (31), length: 14, Value: 421905012405 0x0000: 3432 3139 3035 3031 3234 3035 Unknown Attribute (224), length: 6, Value: 0x0000: ffff ffff Framed Protocol Attribute (7), length: 6, Value: #7 0x0000: 0000 0007 Username Attribute (1), length: 14, Value: 421905012405 0x0000: 3432 3139 3035 3031 3234 3035 NAS ID Attribute (32), length: 23, Value: ggsn-01-bb1.orange.sk 0x0000: 6767 736e 2d30 312d 6262 312e 6f72 616e 0x0010: 6765 2e73 6b Accounting Multilink Session ID Attribute (50), length: 18, Value: d597d9153962de6b 0x0000: 6435 3937 6439 3135 3339 3632 6465 3662 Framed IP Address Attribute (8), length: 6, Value: 10.10.1.1 0x0000: 0a0a 0101 Event Timestamp Attribute (55), length: 6, Value: Tue Dec 18 14:03:44 2012 0x0000: 50d0 69b0 Proxy State Attribute (33), length: 4, Value: 13 0x0000: 3133 14:03:44.832901 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto: UDP (17), length: 52) dial-250-149.orange.sk.radius-acct > tdrad1.vas.orange.sk.56347: [udp sum ok] RADIUS, length: 24 Accounting Response (5), id: 0x5d, Authenticator: d2521d74f782356ebf2d752e94dbfc82 Proxy State Attribute (33), length: 4, Value: 13 0x0000: 3133 Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

4 7