August 2012 - Freeradius-Users - lists.freeradius.org

Failed to authenticate the user
by George Innocent 07 Aug '12

07 Aug '12

Hi; I am getting the attached logs on debug. What could be the problem? -- Regards: George Innocent.

6 28

Behavior of redundant/load-balance
by Sébastien Barbereau 07 Aug '12

07 Aug '12

Hi I hope someone will be able to clarify for me the behavior of the redundant/loadbalance grouping. In particular, when using the module redundant features (aka failover) what is the exact way freeradius will proceed? Let me clarify my question. If I have the following configuration (from the documentation): modules { sql sql1 { # configuration to connect to SQL database one } sql sql2 { # configuration to connect to SQL database two } always handled { rcode = handled } } # Handle accounting packets accounting { # always log to detail, stopping if it fails detail redundant { # try module sql1 sql1 # if that's down, try module sql2 sql2 # otherwise drop the request as # it's been "handled" by the "always" # module (see doc/rlm_always) handled } } If sql1 is down, freeradius will move to process the request with sql2, but what does the documentation mean with 'is down' : no connectivity to DB, slow request, ... ? Also once it detects that sql1is down, does it "mark" it as down and afterwards does not query anymore for X minutes? is there a charitable soul to clarify this ? Thanks, Seb.

2 1

user(name) and EAP-TLS
by Klaus Klein 07 Aug '12

07 Aug '12

Hi Folks, I'm working on securing the access to a WLAN network with WPA2-Enterprise, EAP-TLS and a FreeRADIUS server. Everything seemed to work as expected until realized that a client will be authenticated (by eap) even if the user(name), provided with the mandatory "identifier" entry in wpa_supplicant.conf, doesn't exist in the users file. To verify this I used the unedited 'default' users file provided with the FreeRADIUS package and the user/name 'FooBar'. Is that meant to be like this or do I miss something? Cheers, Klaus

4 17

FR 3 Event-Timestamp wrong format and Mysql FROM_UNIXTIME error
by lscrlstld 07 Aug '12

07 Aug '12

Hi, I´m making initial tests with FR 3 (from git) using default configs with mysql db, but have mysql error. Debug info: rlm_sql_mysql: MySQL error 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '5 2012 23:25:16 BRT), acctupdatetime = FROM_UNIXTIME(Aug 5 2012 23:25:16 BRT)' at line 1' rlm_sql (sql): Released connection (4) The %{Event-Timestamp} used in query have a wrong date/time format, it is not the timestamp. Is it a dependency of OS setup? How this variable (Event-Timestamp) is generated? Tks

3 6

Freeradius Accounting
by Robert Souter 07 Aug '12

07 Aug '12

Afternoon All I apologies if I am sending detail the wrong way or the wrong format. But a newbie to this and also new to working with freeradius so I do apologies in advance if I have done something wrong. My issue with freeradius is Accounting The issue been I took over looking after the freeradius server when someone left, and he dealt with it himself up to then. What I am trying to figure out is that up to the day he left the server was doing accounting in the following directory Var/log/radius/radacct then below that was a folder for each server that was allowed to authenticate in the /clients.conf/ file I have checked the radius server and it is still using ports 1646 and 1645 have also check our cisco NAS router and it is pointing to our radius server with the secret password, which I have checked and are the same along with the same ports 1646 and 1645. If you can help it would be much appreciated. I am sorry if I have not put in the correct data but if you let me know I will try and put it right and adhere to your rules. Thanks very much for your assistance. Kind Regards Robert Robert Souter Network Engineer Office: 0345 450 4502 Fax: 0345 450 4503 [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\signature logo.jpg] www.highnet.com<http://www.highnet.com> | connecting your business [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\Twitter Icon.jpg]<http://twitter.com/HighNetTelecoms> [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\LinkedIn Icon.jpg] <http://www.linkedin.com/company/highnet> [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\Facebook Icon.jpg] <http://www.facebook.com/pages/HighNet-Telecoms/151941874838133> Please consider the environment before printing this e-mail. Why not further your environmental commitments with HighNet's Green Telecoms? Disclaimer: Any opinions expressed in this e-mail are those of the individual and not necessarily the Company. This e-mail and any files transmitted with it, including replies and forwarded copies (which may contain alterations) subsequently transmitted from the Company, are confidential and solely for the use of the intended recipient. If you are not the intended recipient of this transmission, please be advised that you have received it in error and that any use is strictly prohibited. If you have received this e-mail in error please notify the sender.

3 2

multiple radius auth server
by Asif Iqbal 07 Aug '12

07 Aug '12

Hi All Does mod_auth_radius module allow multiple entries of AddRadiusAuth entries with Apache 2.x httpd.conf ? The example httpd.conf file http://freeradius.org/mod_auth_radius/httpd.conf does not tell. Thanks -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 1

Duplicate Radius Accounting
by Christopher Manigan 06 Aug '12

06 Aug '12

In my logs I see many entries like the following: Info: WARNING: Child is hung for request 51651 in component <core> module <queue>.3 Error: Dropping request (2049 is too many): from client myhost.mysite port 32869 - ID: 239 In the last ~10 hours, the status server reports the following for accounting: Responses 0 Duplicate 954442 Malformed 115045 Invalid 564029 Dropped 0 Unknown 0 Radius will hang and start to time out and eventually die. It looks like the duplicate count gets extremely high very quickly. Could it be the NAS that are pointing to it? Or could it be my radius configs somehow causing this? I am not really sure how to prove it out or troubleshoot. I can increase the max requests but I don't think that is the right solution. Chris

4 5

Radius copy accounting
by BELLIERE Eric 06 Aug '12

06 Aug '12

Thanks but with sql I can send the attribute to Oracle DB without any problem? So can you please help me with this unlang command to add? And where? In preacct section of my virtual sites? Eric B. *****DISCLAIMER***** This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Mobistar does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. *****END OF DISCLAIMER*****

1 0

Radius copy accounting
by BELLIERE Eric 06 Aug '12

06 Aug '12

Dears, I have a question concerning attribute in forwarding accounting packet. I have configure FR to read the detail file and proxy this accounting packet to another server. As you can see this schema is working well except that the attribute REALM is not include in the packet? We can see it in the detail file but when FR proxy the packet this attribute is missing? Can you please help me? Fri Aug 3 16:23:50 2012 : Debug: Detail - Renaming /usr/app/radius/instances-available/internal1/log/radacct/spool/accttodpi -> /usr/app/radius/instances-available/internal1/log/radacct/spool/acctt detail_recv: Read packet from /usr/app/radius/instances-available/internal1/log/radacct/spool/accttodpi.work User-Name = "02130395" Acct-Status-Type = Start Acct-Session-Id = "1736" NAS-IP-Address = 212.65.34.96 FreeRADIUS-Acct-Session-Start-Time = "Aug 3 2012 16:23:50 CEST" Acct-Unique-Session-Id = "fe767cbc41e2f2e6" Stripped-User-Name = "02130395" Realm = "MOBISTAR" Proxy-State = 0x3231 Packet-Original-Timestamp = "Aug 3 2012 16:23:50 CEST" Acct-Delay-Time = 0 Packet-Transmit-Counter = 1 Fri Aug 3 16:23:50 2012 : Info: server dpi-acct-read { Fri Aug 3 16:23:50 2012 : Info: # Executing section preacct from file /usr/app/radius/instances-enabled/internal1//sites-enabled/dpi Fri Aug 3 16:23:50 2012 : Info: +- entering group preacct {...} Fri Aug 3 16:23:50 2012 : Info: expand: %{Realm} -> MOBISTAR Fri Aug 3 16:23:50 2012 : Info: ++[request] returns noop Fri Aug 3 16:23:50 2012 : Info: ++[control] returns noop Fri Aug 3 16:23:50 2012 : Info: # Executing section accounting from file /usr/app/radius/instances-enabled/internal1//sites-enabled/dpi Fri Aug 3 16:23:50 2012 : Info: +- entering group accounting {...} Fri Aug 3 16:23:50 2012 : Info: ++[ok] returns ok Fri Aug 3 16:23:50 2012 : Info: } # server dpi-acct-read Fri Aug 3 16:23:50 2012 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Accounting-Request of id 80 to 172.31.128.122 port 1813 User-Name = "02130395" Acct-Status-Type = Start Acct-Session-Id = "1736" NAS-IP-Address = 212.65.34.96 FreeRADIUS-Acct-Session-Start-Time = "Aug 3 2012 16:23:50 CEST" Proxy-State = 0x3231 Acct-Delay-Time = 0 Proxy-State = 0x3537393531 Fri Aug 3 16:23:50 2012 : Info: Proxying request 7 to home server 172.31.128.122 port 1813 Sending Accounting-Request of id 80 to 172.31.128.122 port 1813 User-Name = "02130395" Acct-Status-Type = Start Acct-Session-Id = "1736" NAS-IP-Address = 212.65.34.96 FreeRADIUS-Acct-Session-Start-Time = "Aug 3 2012 16:23:50 CEST" Proxy-State = 0x3231 Acct-Delay-Time = 0 Proxy-State = 0x3537393531 Fri Aug 3 16:23:50 2012 : Debug: Going to the next request Fri Aug 3 16:23:50 2012 : Debug: Detail listener /usr/app/radius/instances-available/internal1/log/radacct/spool/accttodpi state running signalled 0 waiting 1.039211 sec Fri Aug 3 16:23:50 2012 : Debug: Waking up in 0.4 seconds. rad_recv: Accounting-Response packet from host 172.31.128.122 port 1813, id=80, length=31 Proxy-State = 0x3231 Proxy-State = 0x3537393531 Here is the config : Site-enable : server dpi-acct-read { listen { type = detail filename = ${radacctdir}/spool/accttodpi load_factor = 50 } preacct { update request { Realm = "%{Realm}" } update control { Proxy-To-Realm := "dpiacctfwd" } } accounting { ok } } Modules Detail detail detail-dpi { detailfile = ${radacctdir}/spool/accttodpi detailperm = 0600 header = "%t" lock = no #suppress { # User-Password #} } Proxy Config : home_server dpi_acct { ipaddr = 172.31.128.122 port = 1813 type = "acct" secret = "ccxxxxxxxx" status_check = none # zombie_period = 40 # revive_interval = 120 # check_interval = 30 } home_server_pool dpi_acct { type = fail-over home_server = dpi_acct } realm dpiacctfwd { type = acct acct_pool = dpi_acct } Thanks Eric Bellière <https://mysite.mobilebelgium.be/Person.aspx?guid=C9F0A81A-FE99-40F9-A83C-5B…> Operation & Integration Expert ITNO/ISO/ISIO/LSS Avenue Jean Mermoz 32 6041 Gosselies Tel: +32 (0)2 745 79 97 GSM: +32(0)495 55 13 43 please consider the environment - do you really need to print this email? *****DISCLAIMER***** This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Mobistar does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. *****END OF DISCLAIMER*****

3 2

Reject user if does not match group's checks
by Andrei Petru Mura 06 Aug '12

06 Aug '12

Although I saw some similar questions on forum, I didn't see a clear response to it. *The question is: *Is there a way to force user be rejected if it does not match check conditions for the group that belongs to? Thanks.

2 6