March 2012 - Freeradius-Users - lists.freeradius.org

FW: Radacct table not working properly
by Javier Ruiz Escalante 27 Mar '12

27 Mar '12

From: Javier Ruiz Escalante [mailto:fruiz002@hotmail.com] Sent: viernes, 23 de marzo de 2012 18:49 To: 'freeradius-users(a)lists.freeradius.org' Subject: RE: Radacct table not working properly Good evening, I have realized that my radius system does not record the logging information in my radius Data base, in radacct table, but nevertheless creates a folder in /var/log/freeradius for every NAS which is called "radacct" inside this folder there is another folder with the ip of the NAS and inside it there is a txt file with the info that I should have in the radacct table, furthermore I get the following error in radius debug: Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" Any clue? Thanks

3 9

update reply problem
by Ana Gallardo Gómez 27 Mar '12

27 Mar '12

I'm using Freeradius 2.1.10 and I have one problem updating reply. When I use EAP-TTLS-PAP, I have this configuration in inner-tunnel: post-auth { sql{ fail=1 } if (fail) { update reply { Codigo-Reject = Imposible-Contactar-Backend } reply_log reject } else{ reply_log } } and this configuraion in outer-tunnel: post-auth { ... Post-Auth-Type REJECT { update reply { Codigo-Reject = Credenciales-Erroneas } sql{ fail=1 } ... } If MySQL is down, post-auth inner-tunnel set Codigo-Reject = Imposible-Contactar-Backend Post-Auth-Type REJECT don't have to update the reply because I'm using "=" operator But, Post-Auth-Type REJECT set Codigo-Reject to Credenciales-Erroneas. Debug log: # Executing section post-auth from file /etc/freeradius/sites-enabled/ inner-tunnel +- entering group post-auth {...} [sql] expand: %{Stripped-User-Name} -> 02747632 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 02747632 [sql] sql_set_user escaped user --> '02747632' [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radius') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Accept', NOW(), '','radius') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Accept', NOW(), '','radius') rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): Ignoring unconnected handle 4.. ++[sql] returns fail ++? if (fail) ? Evaluating (fail) -> TRUE ++? if (fail) -> TRUE ++- entering if (fail) {...} +++[reply] returns fail [reply_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-reply-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/03/23/10.253.40.43-reply-detail-20120323 [reply_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/03/23/10.253.40.43-reply-detail-20120323 [reply_log] expand: %t -> Fri Mar 23 11:59:41 2012 +++[reply_log] returns ok +++[reject] returns reject ++- if (fail) returns reject } # server inner-tunnel [ttls] Got tunneled reply code 3 Relaciones = "03" Nombre-Completo = "MARCOS" Codigo-Reject = Imposible-Contactar-Backend [ttls] Got tunneled Access-Reject [eapeduroam] Handler failed in EAP/ttls [eapeduroam] Failed in EAP select ++[eapeduroam] returns invalid Failed to authenticate the user. } # server eduroam Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/eduroam +- entering group REJECT {...} ++[reply] returns noop [sql] expand: %{Stripped-User-Name} -> 02747632 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 02747632 [sql] sql_set_user escaped user --> '02747632' [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radius') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radius') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radius') rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): Ignoring unconnected handle 4.. ++[sql] returns fail I don't know what I'm doing wrong :( I whould like to know wahta this mean: [eapeduroam] Handler failed in EAP/ttls [eapeduroam] Failed in EAP select ++[eapeduroam] returns invalid And, the last thing, can I do: # inner-tunnel post-auth { sql{ fail=1 } if (fail) { update reply { Codigo-Reject = Imposible-Contactar-Backend * Packet-Type := Access-Reject* } reply_log reject } Thank you very much and sorry for my english. :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

2 3

TCP/TLS - radsec / application
by Jason Rohm 26 Mar '12

26 Mar '12

I've been doing some research and it seems like there has been a lot of talk about radsec and some movement on the IETF standardization front, but I'm unclear about the state of radsec within the freeradius codebase. I've downloaded the current master source as of a few days ago and successfully compiled it on CentOS 6.2 64bit. Everything seems to work save some EAP stuff that I'm not using and was able to disable around, but I can't figure out if the radsec is there and not documented or if it isn't in there at all. I'm asking because I have a specific use-case that is somewhat similar to how edu-roam is doing that I want to implement and was hoping someone can steer me in the right direction. I'm looking to implement a multi-tier radius hierarchy to deploy centralized user logins to managed network devices in a number of my managed IT customers (I'm the service provider). What I want to accomplish is something similar to: (pardon the ASCII Visio) [NAS (Typically Cisco Router/Switch)] --Standard Radius Auth--> [Onsite FreeRadius as proxy/realm selector] --Standard Radius Auth--> @customer.domain [Customer's Server (typically MS IAS/NPS) Or --TCP/TLS Radius Auth--> @service_provider.domain [Internet facing FreeRadius] --Standard Radius Auth or LDAP--> [Our backend user database (currently AD)] Right now our solution is to implement the same hierarchy but to use standard UDP radius over SSH/socat tunnels for the onsite to off-site communication. A radsec solution would be cleaner and probably more reliable. So my questions are: -Is the radsec code included in the mainline git repo? -If not, where do I get it? -If so, does anyone have any quick and dirty doc somewhere or a working example? -Am I nuts for even trying this? Jason Rohm Communications Architect SRC Technologies Inc.

3 3

can you internally proxy a request more than once?
by mark.leese＠stfc.ac.uk 25 Mar '12

25 Mar '12

Hi, I have been using FreeRADIUS to authenticate visitors onto a wireless network using LDAP against Active Directory. I now need to also deploy eduroam. I thought it would be sensible to do this as two separate virtual servers, so I created a new minimal 'default' server that proxies to a 'visitors' or 'eduroam' virtual server based on the wireless SSID, which the wireless NAS adds to an attribute in the Access-Request. The default server sets the Proxy-To-Realm attribute in the list of control items. The Realm then maps to a home_server in proxy.conf which has an associated virtual server e.g. home_server virtual_server_for_eduroam { type =auth+acct virtual_server = eduroam } home_server_pool virtual_server_for_eduroam_pool { home_server = virtual_server_for_eduroam } realm EDUROAM_VIRTUAL_SERVER { pool = virtual_server_for_eduroam_pool } The 'visitors' virtual server works fine. The 'eduroam' virtual server proxies the Access-Request to LOCAL or our National RADIUS Proxy Servers depending on whether the realm in the User-Name attribute is our realm or not. Local authentications are performed against Active Directory, and so we are using PEAP-MS-CHAPv2. For local authentications the inner MS-CHAPv2 authentications are proxied to the 'inner-tunnel' virtual server. If (for testing) I configure clients.conf so that Access-Requests from the wireless NAS are always sent to the 'eduroam' virtual server, then it works fine. The 'eduroam' virtual server doesn't work if it is called from the new 'default' server using internal proxying. In that case I get an error saying "Multiple levels of TLS nesting is invalid". I'm running FreeRADIUS 2.1.11. I may not have provided enough detail, but am I doing something that obviously won't work? I don't know if it's possible to internally proxy a request more than once, e.g. to two different virtual servers. If it isn't possible, do I have any other options? Would a solution be to make the virtual servers listen on two different IP addresses, and configure the NAS to use a different RADIUS server IP address for each SSID? Alternatively, could the NAS continue to send all RADIUS packets to one IP address, and the default server proxy to virtual servers listening on different IP addresses? Thanks in advance of any help you can give, Have a good weekend, Mark. -- Scanned by iCritical.

4 7

group search filter openLDAP
by dhanushka ranasinghe 25 Mar '12

25 Mar '12

Hi guys, im using freeradius with LDAP , and its authentication works fine when i use following configuration. server = "ldap.home.com" identity = "cn=admin,dc=home,dc=com" password = home basedn = "ou=users,dc=home,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" access_attr = "uid" authtype = ldap but , then i created the LDAP group, and add the members to that, eg : dn: cn=people,ou=users,dc=home,dc=com objectClass: groupOfNames objectClass: top cn: wso2 member: uid=userone,ou=user,dc=home,dc=com member: uid=usertwo,ou=user,dc=home,dc=com , then i change my ldap config as follows , server = "ldap.home.com" identity = "cn=admin,dc=home,dc=com" password = home basedn = "cn=people,ou=users,dc=home,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" access_attr = "uid" authtype = ldap but this method is not working , radius debug output says, user cannot be searched within that group. , is there any particular search method that i need use... ? , what can i do to sort out this problem ? Thank You Dhanushka

3 7

Re: FW: Radacct table not working properly
by Alan Buxey 24 Mar '12

24 Mar '12

It might be configured...ie you edited sql.conf ....but did you add 'sql' to the relevant sections in the relevant virtual server? alan

1 0

Zombie Clarification
by Norman Elton 24 Mar '12

24 Mar '12

Just to make sure I know what's going on... According to the docs, a server that does not respond to a request within the response_window (default: 20 sec) is considered a "zombie", and becomes eligible for the status checker. If no responses are received within the zombie_period (default: 40 sec), it is marked "dead". Once it's dead, it needs to respond to num_answers_to_alive requests before being marked as "alive". Assumign the zombie_period and check_interval are the defaults (40 sec, 30 sec), then the status checker would presumably run at least once during the zombie_period and bring a server back to life before it is marked dead. So here's the question... If the FR server receives no requests, then nothing gets forwarded to the home server. Does this scenario fall under "does not respond to a request within the response_window"? That is, should a quiet server constantly toggle in and out of zombie state? If so, then "zombie" is not really indicative of a problem and I can safely ignore the scenario. Hopefully this makes sense, and is useful to anyone else burrowing through the guts of the proxy status mechanism. Thanks! Norman Elton

4 6

RE: Radacct table not working properly
by Javier Ruiz Escalante 24 Mar '12

24 Mar '12

Hello, Despite taht my user is authenticated, I don't get the data in RADACCT table, my output is this one. Can anybody help me? Thanks input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "1107" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Packet 0 rad_recv: Access-Request packet from host 192.168.1.11 port 42704, id=6, length=195 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "68:A3:C4:37:A2:59" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "terezia" NAS-Port = 2163212290 Acct-Session-Id = "80f00002" Framed-IP-Address = 10.5.50.253 Mikrotik-Host-IP = 10.5.50.253 CHAP-Challenge = 0x3cbbf994793f97861a7be55834b6aa8c CHAP-Password = 0xc22f6ecadc317de6e657d2e0b04217c40b Service-Type = Login-User WISPr-Logoff-URL = "http://10.5.50.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.11 # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "terezia", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> terezia [sql] sql_set_user escaped user --> 'terezia' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'terezia' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'terezia' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'terezia' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/radiusd.conf +- entering group CHAP {...} [chap] login attempt by "terezia" with CHAP password [chap] Using clear text password "" for user terezia authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> terezia attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Packet 1 rad_recv: Access-Request packet from host 192.168.1.11 port 42704, id=6, length=195 Waiting to send Access-Reject to client private-network-1 port 42704 - ID: 6 Waking up in 0.7 seconds. Packet 2 rad_recv: Access-Request packet from host 192.168.1.11 port 42704, id=6, length=195 Waiting to send Access-Reject to client private-network-1 port 42704 - ID: 6 Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 6 to 192.168.1.11 port 42704 Waking up in 4.9 seconds. Cleaning up request 0 ID 6 with timestamp +43 Ready to process requests. Packet 3 rad_recv: Access-Request packet from host 192.168.1.11 port 45935, id=7, length=192 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "68:A3:C4:37:A2:59" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "test" NAS-Port = 2163212291 Acct-Session-Id = "80f00003" Framed-IP-Address = 10.5.50.253 Mikrotik-Host-IP = 10.5.50.253 CHAP-Challenge = 0x46d763209ae10ed864d0f7ddd0c804c4 CHAP-Password = 0x98679418c360d0807088b3c0fff060452b Service-Type = Login-User WISPr-Logoff-URL = "http://10.5.50.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.11 # Executing section authorize from file /etc/freeradius/radiusd.conf +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/radiusd.conf +- entering group CHAP {...} [chap] login attempt by "test" with CHAP password [chap] Using clear text password "test" for user test authentication. [chap] chap user test authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 192.168.1.11 port 45935 Mikrotik-Recv-Limit = 104857600 Finished request 1. > From: fruiz002(a)hotmail.com > To: freeradius-users(a)lists.freeradius.org > Subject: Radacct table not working properly > Date: Fri, 23 Mar 2012 16:30:11 +0100 > > Hello, > > My Radacct table in mysql Freeradius saves only sometimes the values of my > users when they log in, does anybody know why? > > Thanks > > regards > > -----Original Message----- > From: freeradius-users-bounces+fruiz002=hotmail.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+fruiz002=hotmail.com@lists.freeradius.org] > On Behalf Of Alan DeKok > Sent: viernes, 23 de marzo de 2012 13:07 > To: FreeRadius users mailing list; FreeRadius users mailing list > Subject: Re: Disconnect a Mikrotik NAS client from Daloradius > > Javier Ruiz Escalante wrote: > > I would like to disconnect a client which is connected through a > > Mikrotik Hotspot and the command used normally via Chillispot does not > > work, I know that I have to use several attributes like session id and > > so on, but no clue how to use them. Can somebody give me a clue? > > Read the mikrotik documentation to see what it needs in order to > disconnect a user. Then, configure FreeRADIUS to send those attributes. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 3

radpostauth - from client ip
by Steven Staples 23 Mar '12

23 Mar '12

Hello All... I have been trying to figure out why our radius.log file shows the 'from client:' IP correctly on accepted logins, but when I'm storing them into my database, I get a different IP? In my query, I'm using %{NAS-IP-Address}, which is giving me an IP, but not the one I'm expecting to see. Which attribute should I be using to store the same 'from client' that the radius.log is storing? Thanks!

3 3

Radacct table not working properly
by Javier Ruiz Escalante 23 Mar '12

23 Mar '12

Hello, My Radacct table in mysql Freeradius saves only sometimes the values of my users when they log in, does anybody know why? Thanks regards -----Original Message----- From: freeradius-users-bounces+fruiz002=hotmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+fruiz002=hotmail.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: viernes, 23 de marzo de 2012 13:07 To: FreeRadius users mailing list; FreeRadius users mailing list Subject: Re: Disconnect a Mikrotik NAS client from Daloradius Javier Ruiz Escalante wrote: > I would like to disconnect a client which is connected through a > Mikrotik Hotspot and the command used normally via Chillispot does not > work, I know that I have to use several attributes like session id and > so on, but no clue how to use them. Can somebody give me a clue? Read the mikrotik documentation to see what it needs in order to disconnect a user. Then, configure FreeRADIUS to send those attributes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0