June 2012 - Freeradius-Users - lists.freeradius.org

Re: Cisco WLC - Freeradius Vlan assigment problem
by Martin Silvero 28 Jun '12

28 Jun '12

> ++- if (!Huntgroup-Name) returns ok ++? if (Huntgroup-Name == "list") > (Attribute Huntgroup-Name was not found) > >the problem seems to be your huntgroup.. Can you post your huntgroup >definitions? >-- >Jens Weibler >IT-Services Hi, In huntgroup I just have: ........... # Usuario = xxx xxx list Calling-Station-Id == 0221.6ae0.cef8 ............ Them in sites-available/inner-tunnel I have a script: if(!Huntgroup-Name) { # reject update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 249 } } if(Huntgroup-Name == "list") { if( Ldap-Group == "WIFI-Direccion") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 200 } seems ok. What do you think? Thanks a lot.

1 0

Help needed to configure FreeRADIUS for eduroam
by Olivier Nicole 28 Jun '12

28 Jun '12

Hi, I am struggling to configure my FreeRADIUS server for eduroam (www.eduroam.org) as I understood that some subscribers have done the configuration successfully, I come here to get help. I have been running my FreeRADIUS server with out problem for several years, identifying to an openLdap backend. I managed to configure a test WiFi access point to identify with 802.1x against that same radius/ldap server. But I have a problem to configure eduroam, so I would be glad if I could see a working example. TIA, Olivier

4 5

Max Daily Session key
by jim bolger 28 Jun '12

28 Jun '12

Hi all, I am running Freeradius 1.1.7, mysql and coovachilli. I need a access plan of a maximum 2 hours per day per mac address. We want users to click an enter button rather than using vouchers/usernames, etc, How do I tie the mac address and not a username to max daily session? Do I change the sqlcounter dailycounter key from user-name to callingstatinID Can the dailycounter query be rewritten with callingstationID rather than UserName? query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" Am I on the right track here?

1 0

Questions on the finer points of CUI
by Scott Armitage 28 Jun '12

28 Jun '12

All, I was after some clarification about the implementation of CUI in freeRADIUS. My first point is the use of Client IP Address. I notice that client IP Address makes a regular appearance but I'm wondering whether it should. Looking at the cui.conf the post-auth insert adds the Client IP Address. postauth_query = "INSERT IGNORE INTO ${cui_table} \ (clientipaddress, callingstationid, username, cui, lastaccounting) \ VALUES \ ('%{Client-IP-Address}', '%{Calling-Station-Id}', '%{User-Name}', '%{reply:Chargeable-User-Identity}', NULL) ON DUPLICATE KEY UPDATE lastaccounting='0000-00-00 00:00:00', cui='%{reply:Chargeable-User-Identity}'"; likewise the schema (in cui.sql) even has the Client IP Address as a primary key which to me seems wrong. In the world of eduroam my RADIUS server can proxy off to one of 3 National Proxies each will have a different Client IP Address, therefore a single client could have 3 entries in the cui table depending upon which National proxy dealt with the request. I don't see the point of the Client IP Address being in there. If each home server is using a salt (together with the operator name) then even the same username and calling station id will return a different CUI for different home servers. Maybe some could explain what I'm missing and why the Client IP Address is there? Staying with the Client IP Address, my next point surrounds the Accounting. The cui.conf shows that accounting updates the table using Client IP Address in the search: accounting_start_query = "UPDATE ${cui_table} \ SET \ lastaccounting = CURRENT_TIMESTAMP \ WHERE clientipaddress = '%{Client-IP-Address}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND username = '%{User-Name}' \ AND cui = '%{Chargeable-User-Identity}'"; How would this work? The NAS doesn't know what the Client IP Address is and doesn't send it in Accounting packets. Finally, why does the Accounting stop for cui remove the cui from the database: accounting_stop_query = "DELETE FROM ${cui_table} WHERE \ clientipaddress = '%{Client-IP-Address}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND username = '%{User-Name}' \ AND cui = '%{Chargeable-User-Identity}'"; Surely I'd want to keep this? If 2 weeks later I get a copyright infringement notice for a client, I'd want the CUI when contacting the home site of the user. Thanks Scott Armitage

2 1

CUI accounting in policy.conf
by Scott Armitage 27 Jun '12

27 Jun '12

All, I'm using FR3.0 trying to use CUI and am having a few problems with the accounting. In policy.conf I have: # # If we had stored a CUI for the User, add it to the request. # cui.accounting { # # If the CUI isn't in the packet, see if we can find it # in the DB. # if (!Chargeable-User-Identity) { update control { Chargeable-User-Identity := "%{cui: SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'}" } } # # If it exists now, then write out when we last saw # this CUI. # if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) { cui } } Which is slightly different to the standard policy.conf in that I don't care about the Client-IP-Address in my select. However, that change should not have an effect on the issue I am seeing. Basically the update control should set the Chargeable-User-Identity but it appears not to, as the following if evaluates to false: Wed Jun 27 19:40:59 2012 : Info: (13) policy cui.accounting { Wed Jun 27 19:40:59 2012 : Info: (13) - entering policy cui.accounting {...} Wed Jun 27 19:40:59 2012 : Info: (13) ? if (!Chargeable-User-Identity) Wed Jun 27 19:40:59 2012 : Info: (13) ? Evaluating !(Chargeable-User-Identity) -> TRUE Wed Jun 27 19:40:59 2012 : Info: (13) ? if (!Chargeable-User-Identity) -> TRUE Wed Jun 27 19:40:59 2012 : Info: (13) if (!Chargeable-User-Identity) { Wed Jun 27 19:40:59 2012 : Info: (13) - entering if (!Chargeable-User-Identity) {...} Wed Jun 27 19:40:59 2012 : Info: (13) update control { Wed Jun 27 19:40:59 2012 : Info: (13) sql_xlat Wed Jun 27 19:40:59 2012 : Info: (13) expand: %{User-Name} -> anonymous(a)eduroam.ac.uk Wed Jun 27 19:40:59 2012 : Info: (13) sql_set_user escaped user --> 'anonymous(a)eduroam.ac.uk' Wed Jun 27 19:40:59 2012 : Info: (13) expand: SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}' -> SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '02-00-00-00-00-01' AND username = 'anonymous(a)eduroam.ac.uk' Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Opening additional connection (1) Wed Jun 27 19:40:59 2012 : Debug: No trigger subsection: ignoring trigger modules.sql.open Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Reserved connection (1) Wed Jun 27 19:40:59 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Wed Jun 27 19:40:59 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 1 Wed Jun 27 19:40:59 2012 : Info: (13) sql_xlat finished Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Released connection (1) Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Closing idle connection (1): Too many free connections (1 > 0) Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Closing connection (1) Wed Jun 27 19:40:59 2012 : Debug: No trigger subsection: ignoring trigger modules.sql.close Wed Jun 27 19:40:59 2012 : Info: (13) expand: %{cui: SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'} -> 51311af182a072427aec46c8d4f14844 Wed Jun 27 19:40:59 2012 : Info: (13) } # update control = ok Wed Jun 27 19:40:59 2012 : Info: (13) - if (!Chargeable-User-Identity) returns ok Wed Jun 27 19:40:59 2012 : Info: (13) ? if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) Wed Jun 27 19:40:59 2012 : Info: (13) ? Evaluating (Chargeable-User-Identity ) -> FALSE Wed Jun 27 19:40:59 2012 : Info: (13) ?? Skipping (Chargeable-User-Identity != "") Wed Jun 27 19:40:59 2012 : Info: (13) ? if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) -> FALSE Wed Jun 27 19:40:59 2012 : Info: (13) - policy cui.accounting returns ok I'm I being stupid or is this policy broken. thanks Scott Armitage

2 2

Can't figure out Group Authentication
by Julson, Jim 27 Jun '12

27 Jun '12

First, I'd like to thank Alan for his beyond countless hours of dedication to all the blogs, forum posting, and general support within the community. Your write-ups are thorough and well thought out. I wish more people were like you. I'm pretty new to RADIUS and as consequently, Linux in general. So I might ask questions that seem noobish or lame, but it doesn't mean I'm not willing to learn, research etc. Just bare with me. Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. I've added the following entry into "/etc/raddb/clients.conf" to allow AAA on one of my cisco routers. ************************************* client 10.10.0.5 { secret = REALSECRETOMMITTED shortname = Cisco-2911-VPCRTR nastype = cisco } ************************************* Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. However, so did every other "Domain User" account in the environment. This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together. I'm getting there, but just not fast enough. So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well. NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up. Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication. BEGIN RADIUSD -X DEBUG OUTPUT ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.16.1.1 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-1" nastype = "cisco" } client 172.16.1.3 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-2" nastype = "cisco" } client 172.16.1.2 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5520-01" nastype = "cisco" } client 10.10.0.5 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-2911-VPCRTR" nastype = "cisco" } client 172.16.1.10 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5510-GDM" nastype = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYREALDOMAIN-OMMITTED --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** END RADIUSD -X DEBUG OUTPUT Jim C. Julson Sr. Network & Systems Administrator C 208.908.1476 jjulson(a)marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com> [Learn more about Network Connect]<http://www.marketron.com/network-connect.php?email> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.

5 13

FW: SQLm_counter and 64 bit values
by Jonathan Bastin 26 Jun '12

26 Jun '12

I am using Freeradius 2 on Ubuntu 64 bit machine. I am trying to add up the months' worth of data the user has used and make sure they don't go over capacity. So far I have counter.conf: sqlcounter monthlydata { counter-name = Total-Octets-Monthly check-name = CS-Total-Octets-Monthly reply-name = menu sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM( AcctInputOctets + AcctOutputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > (DATE_SUB(CURDATE(),INTERVAL DAYOFMONTH(CURDATE())DAY))" } And in the users I have a check value of CS-Total-Octets-Monthly := 107375000000 The issue I am having is that I get Debug: rlm_sqlcounter: (Check item - counter) is less than zero which I believe is because the sql query returns a value bigger than 32bit and the sql counter module isn't 64 bit counter. Is anybody able to offer me advise on where to go with this one. I did read this thread but no real fix came out of it http://freeradius.1045715.n5.nabble.com/Problem-with-rml-sqlcounter-with-Gi… -------------------------------------------------------------------------------------------------------------------------- This email (including any attachments) is intended only for the recipient(s) named above. It may contain confidential or privileged information and should not be read, copied or otherwise used by any other person. If you are not the named recipient please contact the sender and delete the email from your system. The author's incumbent expressions, views and thoughts are their own and not necessarily representative of those of the Peer Point Internet Ltd or associated companies.

1 1

radwho with nas-ip-address behind NAT
by Sergio Belkin 26 Jun '12

26 Jun '12

Hi, I wonder radwho can show the "actual" Nas-IP-Address os and not the Nat device IP nat. Another interesting option would be NAS-Identifier. Is that feasible? Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

2 2

Reg: IMSI based authentication.
by Malla reddy Sama 26 Jun '12

26 Jun '12

Dear All, I am using freeradius 2.1.10 + Mysql. I successfully tested user name and password based authentication with radius. Now I want to do IMSI based authentication with radius. Please can anyone help me on how to do IMSI based authentication. Thanks & Best Regards, Malla Reddy,

2 1

EAP-TLS used to be working, replaced Wifi AP, reimported backed-up config, EAP-TLS not working anymore
by Benjamin Malynovytch 26 Jun '12

26 Jun '12

Dear list members, Before writing this email, I spent hours in debug and reading ML and howto. The configuration I'm trying to debug was working a couple of weeks ago. The wifi access point became faulty (antenna broken) and was replaced in RMA (Cisco WAP200-EU). Before sending the AP back, I saved the configuration file through the dedicated wizard provided by the web GUI. When the new one arrived, I updated the firmware with the same as the one that used to be in production (I still had the binary file) and reuploaded the configuration file. (Fw rev: 2.0.4.0-ETSI) All the configuration seemed to be restored as expected, as well as the 802.1X parameters (IP / port of FR, shared key, mode ...) IP and port are fine, as well as the shared key that I already tried to change (removing special chars). Mode is set to "WPA2 Enterprise" (encryption to AES) Before I give more details on the configuration, here are some details : - certs are generated using the Makefile provided with Freeradius, with special OIDs (openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf) - I followed the FAQ and the official howtos a couple of times, starting all over without success - FreeRadius v2.1.10 on CentOS 6.2 x86_64 What works : - eapol_test with my personal client cert receives "Access-Accept" - using the AP configuration on a network switch, enabling 802.1X with the same parameters works (even though time between each Access-Challenge is quite long, around 5 secs) What doesn't work : wifi auth keeps exchanging Access-Challenge, ending by "EAP session for state ... did not finish! ... bla bla bla" Tests are made with a MacBook, using Mac OS X Lion. CA and client certs are setup properly and used to be working like a charm before RMA. I also tested a pair of iPhone and a Windows 7 notebook that also used to be working properly. On the Mac Book, I don't need to change any setting in the configuration (certs or params) to use either wifi or ethernet with 802.1X. Ethernet works while Wifi doesn't. I tried to reduce packet fragmentation to 768. Conf used to be working well with default. You will find the full configuration file (the working configuration was reduced to minimal, test ones are based on the default file set provided with FR, giving exactly same behavior) linked at the end of this mail. What I would like at first, is an advice on where to search, as the configuration of FR used to be working well, as well as the client certificates and the client configurations. Thanks in advance for your help. /etc/raddb/radiusd.conf : http://paste.org/50823 /etc/raddb/users : http://paste.org/50822 radiusd -d /etc/raddb -X : http://paste.org/50824 Best regards, -- Benjamin MALYNOVYTCH

2 1