May 2012 - Freeradius-Users - lists.freeradius.org

Unix TimeStamp Based Login
by jomajo 16 May '12

16 May '12

Hello! Maybe somebody know or maybe already implemented , Unix TimeStamp based login? For example if I have "radcheck" table like this: http://freeradius.1045715.n5.nabble.com/file/n5708187/freeradius_unix.png How should Freeradius know, that he need's to look at start_time and end_time field in this table, and let the user to log in just at this specific time slot? I know that I need to change this SQL statement: authorize_check_query = "SELECT id, username, attribute1, value, op1 \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" Thanks if you have a minute to help me figure this out. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Unix-TimeStamp-Based-Login-tp570818… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 27

Post-crash investigations
by Julien Cornuwel 16 May '12

16 May '12

Hi, I setup a cluster (Pacemaker) of two freeradius servers on CentOS 5.8 (freeradius 1.1.3). We use it for 802.1X: our switchs (HP Procurve) send it EAP challenges and it authenticates our users/hosts against an ActiveDirectory domain. It's been running smoothly for a month and stopped working this morning. We switched back to our old server but I want to know what happened before putting the cluster back in production. I'm currently trying to find out what happened but information is sparse: - From the cluster perspective, everything is fine. The daemon is running and no failover event occurred. - From samba, same thing. - In radius.log: nothing. There are client SSL certs errors but they have been there the whole time. - In auth-detail logfile: I can see all received requests. Before _and_ after the problem. However, it doesn't contain the reply :-/ - In detail logfile: Nothing after 7:56, time of the outage. So, I need pointers on two different issues: - I don't have enough information in logs. I realize that the recommended solution is to run the server in debug mode but I'm not sure I can store a month - or more - of such verbose logging. Any way to have more information, except the debug mode ? - I failed to check the whole authentication process both at the cluster level and at the monitoring level (nagios). Tools like NTradPing and check_radius_adv are of little help here because they can only check static accounts declared in radius configuration. They do not exercise the whole chain (Windows client > switch > radius server > ntlm_auth > AD). I tried replaying a successful authentication but it failed (Access-Denied). Any way to perform a 'real' check ? Sorry for the long post and thanks for any idea/pointer you can give me. Regards,

5 8

Re: Specific User Trace and multiple radiusd instant
by 全球无线联盟 16 May '12

16 May '12

Hello everyone, We use below freeradius. It works well. The OS is Linux Enterprise 5.4. Thanks. freeradius2.x86_64 2.1.12-3.el5 installed freeradius2-krb5.x86_64 2.1.12-3.el5 installed freeradius2-ldap.x86_64 2.1.12-3.el5 installed freeradius2-mysql.x86_64 2.1.12-3.el5 installed freeradius2-perl.x86_64 2.1.12-3.el5 installed freeradius2-postgresql.x86_64 2.1.12-3.el5 installed freeradius2-python.x86_64 2.1.12-3.el5 installed freeradius2-unixODBC.x86_64 2.1.12-3.el5 installed freeradius2-utils.x86_64 2.1.12-3.el5 installed We got below two questions recently. 1. We know 'radiusd -X' will run the radius in debuge mode. With large amount user request, the debug information will be massive. It will be difficult to read one specific user authentication process. Can anyone advise how to debug a specific user's access process? 2. We tried to run multiple radiusd at same server while the second failed. Can anyone advise how to configure the server to run multiple radiusd simultaneously？ Thanks! Tom

5 7

Re: MSCHAP Errors
by Alan Buxey 15 May '12

15 May '12

What does the server try to run when actually dealing with your client? radius -X will show you, you can then try running that command yourself. alan

4 3

Conditionally passing custom attributes
by Chad Lensert 15 May '12

15 May '12

freeradius-server-utils-2.1.1-7.7.19.77 freeradius-server-libs-2.1.1-7.7.19.77 freeradius-server-2.1.1-7.10.1 Greetings all. I am trying to pass a list of custom attributes based on the information in the radius request. Originally, I tried matching on NAS-IP-Address as noted below, but it looks like I can also match on Client-IP-Address, which I would prefer. The issue I am having is that I don't see radius matching the right entry in the users file and returning specific custom attributes. I can't determine why it is choosing the last user entry in the users file. Here is an example of the users file. I expect the information from the request to match the first entry for user "chad". #################################################### DEFAULT Auth-Type=Pam Service-Type = NAS-Prompt-User, cisco-avpair +="shell:priv-lvl=2", cisco-avpair :="shell:roles*network-operator", Fall-Through = 1 ... #put customer user attributes here! chad NAS-IP-Address == "1.2.3.4" cisco-avpair += "NCS:virtual-domain0=ROOT-DOMAIN", cisco-avpair += "NCS:role0=Root" chad NAS-IP-Address == "2.3.4.5" cisco-avpair += "NCS:virtual-domain0=ROOT-DOMAIN", cisco-avpair += "NCS:role0=Root" chad Service-Type := Administrative-User, cisco-avpair := "shell:priv-lvl=15", cisco-avpair := "shell:roles*network-admin" #################################################### The debug from radius shows that the NAS-IP-Address in the first user entry matches the initial request. I also tried to match on Client-IP-Address, but the debugs always show radius matching on the last user entry and sending different attributes. Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x port 19721, id=31, length=62 NAS-IP-Address = 1.2.3.4 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "chad" User-Password = "0123456789" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <chad> ++[pam] returns ok Login OK: [chad/0123456789] (from client lensert port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 31 to x.x.x.x port 19721 Service-Type := Administrative-User Cisco-AVPair := "shell:roles*network-admin" Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 9296, id=104, length=68 User-Name = "chad" User-Password = "0123456789" NAS-IP-Address = 2.3.4.5 Message-Authenticator = 0xb346bbcf6f763e4e9e32c2f4ddc657b9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <chad>. Reason: Permission denied ++[pam] returns reject Failed to authenticate the user. Login incorrect: [chad/0123456789] (from client lensert port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 104 to x.x.x.x port 9296 Finished request 1. Going to the next request Waking up in 2.7 seconds. rad_recv: Access-Request packet from host x.x.x.x port 55546, id=31, length=62 NAS-IP-Address = 1.2.3.4 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "chad" User-Password = "0123456789" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <chad>. Reason: Permission denied ++[pam] returns reject Failed to authenticate the user. Login incorrect: [chad/0123456789] (from client lensert port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 31 to x.x.x.x port 55546 Finished request 2. Going to the next request Waking up in 0.4 seconds. Cleaning up request 0 ID 31 with timestamp +30 Waking up in 2.2 seconds. Cleaning up request 1 ID 104 with timestamp +32 Waking up in 2.3 seconds. Cleaning up request 2 ID 31 with timestamp +35 Ready to process requests.

2 1

Freeradius 100% cpu
by Arianna Manlio 15 May '12

15 May '12

Hi, I'm running this version of FR: # freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 OS is: # cat /etc/debian_version 6.0.5 # uname -ar Linux 2.6.32-5-686 #1 SMP Sun May 6 04:01:19 UTC 2012 i686 GNU/Linux it's a VMware VM with 4 vCpu and 1 GB RAM. Auth module is MySQL. FR is working but it takes 100% CPU. Other strange thing is that load does not rise more than 1 (it should be 4 or more). Any suggestion? This is my relevant config: max_request_time = 60 cleanup_delay = 5 max_requests = 102400 (I've 18 clients) thread pool { start_servers = 32 max_servers = 256 min_spare_servers = 5 max_spare_servers = 20 max_requests_per_server = 0 } sql.conf sql { num_sql_socks = 8 connect_failure_retry_delay = 60 } Thank you very much

3 3

webauth and macauth
by djura 15 May '12

15 May '12

Hi, i am trying to setup radius auth for my AP. i've followed wiki instructions and it must be i overseen something my session printout and config files are below. I need your expert help with this one. Have anyone seen this kind of behaviour? br, jura root@zgpc-radius:~# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on May 19 2011 at 15:42:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_badpass = "Holly shit your password is bad!" } security { max_attributes = 200 reject_delay = 3 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "0123456789ABCDEF" nastype = "other" } client 192.168.113.0/24 { require_message_authenticator = no secret = "0123456789ABCDEF" shortname = "BLMOVI" } client 10.222.72.0/24 { require_message_authenticator = no secret = "0123456789ABCDEF" shortname = "ONTOVI" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/freeradius/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking authorize {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "authorized_macs" from file /etc/freeradius/modules/files files authorized_macs { usersfile = "/etc/freeradius/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } Module: Instantiating module "reject" from file /etc/freeradius/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 10.222.72.112 port 65534, id=26, length=143 NAS-IP-Address = 100.1.1.1 NAS-Port-Id = "1.1" Framed-MTU = 1024 User-Name = "64-31-50-81-CB-2F" Calling-Station-Id = "64-31-50-81-CB-2F" Message-Authenticator = 0x55e71eef2d8919739367e5026db3bc16 EAP-Message = 0x020200110167706f6e2d48505c67706f6e NAS-Identifier = "BLM12" Ericsson-Attr-101 = 0x4552494353534f4e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} [eap] EAP packet type response id 2 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) (Attribute Service-Type was not found) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^64-31-50-81-CB-2F$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> TRUE ++- entering if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) {...} +++[control] returns updated ++- if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) returns updated Found Auth-Type = EAP WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. # Executing group from file /etc/freeradius/sites-enabled/default Failed to authenticate the user. expand: Crap your password is bad! -> Crap your password is bad! Login incorrect: [64-31-50-81-CB-2F/<via Auth-Type = EAP>] (from client ONTOVI port 0 cli 64-31-50-81-CB-2F) Holly shit your password is bad! Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. # Executing group from file /etc/freeradius/sites-enabled/default Delaying reject of request 0 for 3 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 1.9 seconds. rad_recv: Access-Request packet from host 10.222.72.112 port 65534, id=26, length=143 Waiting to send Access-Reject to client ONTOVI port 65534 - ID: 26 Waking up in 1.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 26 to 10.222.72.112 port 65534 rad_recv: Access-Request packet from host 10.222.72.112 port 65534, id=26, length=143 Sending duplicate reply to client ONTOVI port 65534 - ID: 26 Sending Access-Reject of id 26 to 10.222.72.112 port 65534 Waking up in 4.9 seconds. Cleaning up request 0 ID 26 with timestamp +43 Ready to process requests. ---------------------------------------------------------------------------- root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' ../clients.conf client localhost { ipaddr = 127.0.0.1 secret = 0123456789ABCDEF require_message_authenticator = no } client 10.222.72.0/24 { secret = 0123456789ABCDEF shortname = ONTOVI require_message_authenticator = no } ----------------------------------------------------------------------------- root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' ../radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_badpass = "Crap your password is bad!" } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 3 status_server = yes } proxy_requests = no $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ root@zgpc-radius:/etc/freeradius/sites-enabled# --------------------------------------------------------------------------- root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' ../policy.conf policy { forbid_eap { if (EAP-Message) { reject } } permit_only_eap { if (!EAP-Message) { if (!"%{outer.request:EAP-Message}") { reject } } } deny_realms { if (User-Name =~ /@|\\/) { reject } } do_not_respond { update control { Response-Packet-Type := Do-Not-Respond } handled } cui_authorize { update request { Chargeable-User-Identity:='\\000' } } cui_postauth { if (FreeRadius-Proxied-To == 127.0.0.1) { if (outer.request:Chargeable-User-Identity) { update outer.reply { Chargeable-User-Identity:="%{md5:%{config:cui_hash_key}%{User-Name}}" } } } else { if (Chargeable-User-Identity) { update reply { Chargeable-User-Identity="%{md5:%{config:cui_hash_key}%{User-Name}}" } } } } cui_updatedb { if (reply:Chargeable-User-Identity) { cui } } cui_accounting { if (!Chargeable-User-Identity) { update control { Chargable-User-Identity := "%{cui: SELECT cui FROM cui WHERE clientipaddress = '%{Client-IP-Address}' AND callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'}" } } if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) { cui } } rewrite_calling_station_id { if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ update request { Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } } else { noop } } } ------------------------------------------------------------------------------------------------------ root@zgpc-radius:/etc/freeradius/sites-enabled# grep -v '#' /etc/freeradius/eap.conf eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/webauth-and-macauth-tp5703328.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

FreeRADIUS Installation on Windows Server 2008
by dsumalabe 15 May '12

15 May '12

Hi, I tried installing the FreeRADIUS ver 1.1.7-r0.0.2 and MYSQL 5.5.23 in Windows 7 and it works OK and also the Accounting and Authentication work OK. Now I started installing it in Windows Server 2008. When installing FreeRADIUS in Windows Server 2008, the installation does not finish. When installation is on approximately 90%, the chown.exe appears and stop from there. It will only continue when chown.exe cmd window is manually closed. Then Chmod.exe will appear and manually close it also to continue installation. Then the rm.exe, we did the same thing and installation was completed. The FreeRADIUS will start but it will not work properly because of this 3 items (chown.exe, chmod.exe and rm.exe). Please help me how to resolve the problem. Thanks and Kind Regards, dsumalabe -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-Installation-on-Windows-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

[PATCH]es decrement client limit on socket timeout, saner tls sample conf, and a pasto
by Brian Julin 15 May '12

15 May '12

Three patches versus master attached: The first puts a saner default config for radsec connections from clients, because in the dominant use-case for radsec clients (outside federation servers pointing to your IDP service) these connections are often nailed up by the client so if they timeout every thirty seconds (which is the new default as of the limit structure changes), the client just proceeds to rebuild them every 30 seconds. The second patch is a pasto that was preventing dhcp.c from compiling. Note I don't use this module, so I haven't tested that at all. The third patch decrements the client's connection limit counter when a socket times out so that a TCP connection falling down and restoring does not eventually run afoul of max_connections. Note this problem was pre-existing before for the new limit structure changes but also occured with them applied. This is only slightly tested, and might benefit from an experienced eyeball or two, especially WRT possibly backporting it.

1 0

How to set attribute value as null means that " "
by mimir 15 May '12

15 May '12

Hello, I want to add a custom attribute before replicate the accounting package with null value. I see that it is added successfully before replication, but when I check it on remote server, I can not see userid1 and userid2 attributes. Do you have any comment on this? [replicate] Replicating packet to Realm SECONDARY2 Sending Accounting-Request of id 235 to 127.0.0.6 port 2814 User-Name = "test" Calling-Station-Id = "1678912345" Framed-Protocol = PPP Acct-Status-Type = Start NAS-Port = 22 Acct-Session-Id = "6" Service-Type = Framed-User NAS-IP-Address = 135.243.90.19 * userid1 = "" userid2 = ""* -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-set-attribute-value-as-null-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1