August 2012 - Freeradius-Users - lists.freeradius.org

Problem with accounting insert into Oracle
by Aurélien Lafranchise 13 Aug '12

13 Aug '12

Hi, I have the same error for every request in dialup.conf (STOP, START, UPDATE). The database connection is working well but I have: [sql] Couldn't insert SQL accounting STOP record - ORA-01756: quoted string not properly terminated with sqltrace on you can see the mistake at the end. The request seems to be truncated: INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, IMSI_3GPP, ChargingID_3GPP, PDPType_3GPP, ChargingGwAddress_3GPP, GPRSNegotiatedQoSprofile_3GPP, SGSNAddress_3GPP, GGSNAddress_3GPP, IMSIMCCMNC_3GPP, GGSNMCCMNC_3GPP, NSAPI_3GPP, SessionStopIndicator_3GPP, SelectionMode_3GPP, ChargingCharacteristics_3GPP, ChargingGwIPv6Address_3GPP, SGSNIPv6Address_3GPP, GGSNIPv6Address_3GPP, IPv6DNSServers_3GPP, SGSNMCCMNC_3GPP, TeardownIndicator_3GPP, IMEISV_3GPP, RATType_3GPP, MSTimeZone_3GPP, CamelChargingInfo_3GPP, PacketFilter_3GPP, NegotiatedDSCP_3GPP, AllocateIPType_3GPP) VALUES('', 'D4090646343006F3', '64e5c1c4162df0d5', '447937700458', '', '10.100.100.3', '', 'Ethernet', NULL, TO_DATE('2012-08-13 11:35:27','yyyy-mm-dd hh24:mi:ss'), '74', 'RADIUS', '', '', '679' + ('0' * 4294967296), '83' + ('0' * 4294967296), 'internet.mbqt.net', '447937700458', 'User-Request', 'Framed-User', 'GPRS-PDP-Context', '10.73.248.60', '0', '0', '234507089001283', '875562739', '0', '', '98-1B631F', '80.10.0.97', '212.9.6.70', '23450', '', '5', '255', '0', '0800', '', '', '', '', '20801', '', '', '2', '; but in the dialup.conf file it is ok: accounting_stop_query_alt = "INSERT into ${acct_table2} (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, IMSI_3GPP, ChargingID_3GPP, PDPType_3GPP, ChargingGwAddress_3GPP, GPRSNegotiatedQoSprofile_3GPP, SGSNAddress_3GPP, GGSNAddress_3GPP, IMSIMCCMNC_3GPP, GGSNMCCMNC_3GPP, NSAPI_3GPP, SessionStopIndicator_3GPP, SelectionMode_3GPP, ChargingCharacteristics_3GPP, ChargingGwIPv6Address_3GPP, SGSNIPv6Address_3GPP, GGSNIPv6Address_3GPP, IPv6DNSServers_3GPP, SGSNMCCMNC_3GPP, TeardownIndicator_3GPP, IMEISV_3GPP, RATType_3GPP, MSTimeZone_3GPP, CamelChargingInfo_3GPP, PacketFilter_3GPP, NegotiatedDSCP_3GPP, AllocateIPType_3GPP) \ VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', NULL, TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), \ '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', \ '%{Acct-Input-Octets}' + ('%{%{Acct-Input-Gigawords}:-0}' * 4294967296), \ '%{Acct-Output-Octets}' + ('%{%{Acct-Output-Gigawords}:-0}' * 4294967296), \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', \ '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}', '%{3GPP-IMSI}', '%{3GPP-Charging-ID}', '%{3GPP-PDP-Type}', '%{3GPP-Charging-Gateway-Address}', '%{3GPP-GPRS-Negotiated-QoS-profile}', '%{3GPP-SGSN-Address}', '%{3GPP-GGSN-Address}', '%{3GPP-IMSI-MCC-MNC}', '%{3GPP-GGSN-MCC-MNC}', '%{3GPP-NSAPI}', '%{3GPP-Session-Stop-Indicator}', '%{3GPP-Selection-Mode}', '%{3GPP-Charging-Characteristics}', '%{3GPP-Charging-Gateway-IPv6-Address}', '%{3GPP-SGSN-IPv6-Address}', '%{3GPP-GGSN-IPv6-Address}', '%{3GPP-IPv6-DNS-Servers}', '%{3GPP-SGSN-MCC-MNC}', '%{3GPP-Teardown-Indicator}', '%{3GPP-IMEISV}', '%{3GPP-RAT-Type}', '%{3GPP-MS-TimeZone}', '%{3GPP-Camel-Charging-Info}', '%{3GPP-Packet-Filter}', '%{3GPP-Negotiated-DSCP}', '%{3GPP-Allocate-IP-Type}')" Any idea ? Is there a global option for the maximum number of characters for a request ? Cheers Aurélien Lafranchise

2 2

FTP site is now on a new machine
by Alan DeKok 13 Aug '12

13 Aug '12

It's a quad core system with a bit better connectivity. Let me know if there are any issues. Alan DeKok.

1 0

Testing pre-2.2.0
by Alan DeKok 13 Aug '12

13 Aug '12

We're (again) close to releasing 2.2.0. This time for real. In order to make the server more future-proof, I've made some changes to the TTLS parser. This will solve issues in the long term. But it needs more testing now. Please try the git "v2.1.x" branch with various supplicants, and TTLS. Please post here if it works / fails. Thanks. Alan DeKok.

4 9

sql_log and Accounting On/Off
by Stefan Winter 11 Aug '12

11 Aug '12

Hello, I'm currently migrating a number of direct accounting sql module calls to delayed writes using sql_log. I noticed that sql_log has statements for Start, Stop, Alive (and Post-Auth, about which I don't care at that point). The real SQL modules have accounting_on_off_query, too. I wonder how to send stuff to sql_log when an On/Off arrives... guessing that I'm simply overlooking something. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 7

support-fr@support.gandi.net
by Alan DeKok 10 Aug '12

10 Aug '12

Whoever this person is, you need to unsubscribe NOW. If we find out who you are, you will be banned forever. The list admins have recently started getting spammed from that account. After some investigation, it turns out that some idiot subscribed to the list using an email account associated with "Request Tracker". Every post to the list results in a new ticket being opened. The "new ticket" notification is getting sent to the list admins. For every single message to the list. However, the "support-fr(a)support.gandi.net" account is NOT subscribed. There seems to be an additional layer of email forwarding. That makes it difficult to track down the offending party. Whoever did this needs to fix it NOW. Alan DeKok.

1 0

RE: Wimax with Free radius
by Mulindwa 10 Aug '12

10 Aug '12

Hallo there, i have an issue with my wimax setup, am trying to have my users authenticate using the wonderful freeradius but still failing. Am suing WASN9970 and using freeradius 2.1.12, When i turn on radius using radius-X, this is what i get, and client never authenticates someone please come to my rescue istening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 196.0.4.18 port 1812, id=250, length=187 User-Name = "gulucdp@utmax" NAS-IP-Address = 192.168.224.70 Calling-Station-Id = "6416f00100e1" NAS-Identifier = "WASN9770" Event-Timestamp = "Mar 5 2012 09:14:53 EAT" EAP-Message = 0x020100120167756c756364704075746d6178 WiMAX-Release = "1.1" WiMAX-Accounting-Capabilities = Flow-Based WiMAX-BS-Id = 0x303030303038316235393030 WiMAX-GMT-Timezone-offset = 10800 NAS-Port-Type = Wireless-802.16 WiMAX-Available-In-Client = 3 Service-Type = Framed-User Message-Authenticator = 0x143b601c01eca1d4595511b0a81c0d78 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/196.0.4.18/auth-detail-20120305 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/196.0.4.18/auth-detail-20120305 [auth_log] expand: %t -> Mon Mar 5 08:59:56 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop ++[wimax] returns ok [suffix] Looking up realm "utmax" for User-Name = "gulucdp@utmax" [suffix] Found realm "utmax" [suffix] Adding Realm = "utmax" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 125 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 250 to 196.0.4.18 port 1812 Service-Type = Framed-User Framed-Protocol = PPP Framed-Address = 255.255.255.254 Framed-Netmask = 255.255.255.255 EAP-Message = 0x0102001604101bd377e252fa3b4f59a9210cb6a3fdfb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0dc4c5bf0dc6c1ff885e3d68e8e55b4e Finished request 0. Eric M

7 34

Cisco integration with priv-lvl=15 vs. priv-lvl=0
by Casho, Craig L 10 Aug '12

10 Aug '12

Basically, how does one go about configuring the radius server to forward requests to the Redhad LDAP server with these attributes. Thanks,

2 1

Segmentation fault in "rlm_pap"
by Urban Loesch 09 Aug '12

09 Aug '12

Hi, I'm new to the list. I'm currently migrating from "Radiator" to Freeradius with MySQL Database Backend for Authentication and Accounting. User-passwords are stored in mysql db with SMD5. I have installed latest freeradius from debian "squeeze" repositories: ii freeradius 2.1.10+dfsg-2 a high-performance and highly configurable RADIUS server ii freeradius-common 2.1.10+dfsg-2 FreeRADIUS common files ii freeradius-dbg 2.1.10+dfsg-2 debug symbols for the FreeRADIUS packages ii freeradius-mysql 2.1.10+dfsg-2 MySQL module for FreeRADIUS server ii freeradius-utils 2.1.10+dfsg-2 FreeRADIUS client utilities ii libfreeradius2 2.1.10+dfsg-2 FreeRADIUS shared library If I start freeradius in daemon mode it runs without any problems. After some hours freeradius segfaults without any visible reason. Until this time users can authenticate without problems. No error messages in the logfile. So I tried to run freeradius in debug mode with -X and when it craches i get the following after some hours: ... rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing SMD5-Password from base64 encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "232nr4Cs" [pap] Using SMD5 encryption. [pap] Normalizing SMD5-Password from base64 encoding Segmentation fault The Kernel logs the message: kernel: [10466122.427567] freeradius[20622]: segfault at 7f2ed32e1000 ip 00007f2ed8cbaa4b sp 00007f2ed32debd8 error 4 in libc-2.11.3.so[7f2ed8c3b000+159000] After the crash above I tried to run freeradius with gdb. When it crashes I got the following in gdb shell: ... rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing SMD5-Password from base64 encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "232nr4Cs" [pap] Using SMD5 encryption. [pap] Normalizing SMD5-Password from base64 encoding Program received signal SIGSEGV, Segmentation fault. 0x00007ffff6859a4b in memcpy () from /lib/libc.so.6 (gdb) bt #0 0x00007ffff6859a4b in memcpy () from /lib/libc.so.6 #1 0x00007ffff5392572 in normify (request=0x8d2920, vp=0x8d3100, min_length=16) at rlm_pap.c:272 #2 0x00007ffff5392f7e in pap_authenticate (instance=<value optimized out>, request=0x8d2920) at rlm_pap.c:655 #3 0x000000000041b6e3 in call_modsingle (component=<value optimized out>, c=<value optimized out>, request=0x8d2920) at modcall.c:297 #4 modcall (component=<value optimized out>, c=<value optimized out>, request=0x8d2920) at modcall.c:670 #5 0x000000000078ac50 in ?? () #6 0x00000000000002cc in ?? () #7 0x00000000f7bd7a3a in ?? () #8 0x00007fffffffd720 in ?? () #9 0x0000000000000000 in ?? () Other installed packages: ii libc6 2.11.3-3 Embedded GNU C Library: Shared libraries ii libmysqlclient16 5.1.58-1 MySQL database client library I also tried to compile freeradius version 2.1.12 from latest git, but it's always the same. After some hours it crashes too. Have you any idea what could cause this strange crashes? If you need any further info please let me know. Many thanks and regards Urban Base-Config: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = no $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sqlippool.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ... Only Default Enabled: authorize { preprocess auth_log chap mschap digest suffix eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail sql if (noop) { ok } exec attr_filter.accounting_response } session { sql } post-auth { exec Post-Auth-Type REJECT { sql attr_filter.access_reject } } pre-proxy { } post-proxy { eap }

3 4

Online Users
by Shawky Skaff 09 Aug '12

09 Aug '12

Hi, On the online users gui page of dialup admin, there are serveral columns, one of the columns states "name", which is after the caller ID column. I would like to know where this comes from, I have set the name on the user info page, but it doesn't seem like that works. Thanks.

2 1

SSH to Cisco Devices
by Michael Schwartzkopff 09 Aug '12

09 Aug '12

Hi, I know it is possible to use FreeRADIUS to authenticate SSH access to Cisco devices with username/password scheme. Cisco's IOS in version 15 also offers the private/public key authentication scheme. Is is possible to authenticate the key scheme in FreeRADIUS? Or does anybody know if that is possible in Cisco's ACS? Thanks for any hint. -- Dr. Michael Schwartzkopff Guardinistr. 63 81375 München Tel: (0163) 172 50 98 Fax: (089) 620 304 13

3 2