January 2013 - Freeradius-Users - lists.freeradius.org

Slow Ldap Authorization
by Tyler Brady 15 Jan '13

15 Jan '13

Version 2.1.10 Since adding LDAP authorization, my login time has slowed down quite a bit. It takes 4 or 5 seconds longer for freeRadius to get through all of the [ldap] fields and send an Access-Accept. Is this a normal amount of time, or is there something in my configuration that is causing this slow down? LDAP Module: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "172.28.64.10" identity = "CN=User Name,OU=Phoenix_Users,DC=company,DC=com" password = password basedn = "DC=company,DC=com" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{contr$ groupmembership_attribute = memberOf # base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 Debug: Ready to process requests. rad_recv: Access-Request packet from host 172.28.64.3 port 1645, id=98, length=85 User-Name = "RadiusUser" User-Password = "password" NAS-Port = 3 NAS-Port-Id = "tty3" NAS-Port-Type = Virtual Calling-Station-Id = "172.28.64.119" NAS-IP-Address = 172.28.64.3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "RadiusUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [files] expand: DC=company,DC=com -> DC=company,DC=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> RadiusUser [files] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=RadiusUser)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.28.64.10:389, authentication 0 [ldap] bind as CN=User Name,OU=Alaska_Users,DC=company,DC=com/password to 172.28.64.10:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=company,DC=com, with filter (&(sAMAccountName=RadiusUser)) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=com, with filter (&(cn=Radius-Users)(|(&(objectClass=GroupOfNames)(member=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom)))) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=User Name,OU=Alaska_Users,DC=company,DC=com, with filter (objectclass=*) [ldap] performing search in CN=Radius-Users,OU=Alaska_Users,DC=company,DC=com, with filter (cn=Radius-Users) rlm_ldap::ldap_groupcmp: User found in group Radius-Users [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok [ldap] performing user authorization for RadiusUser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> RadiusUser [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=RadiusUser)) [ldap] expand: DC=company,DC=com -> DC=company,DC=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=com, with filter (&(sAMAccountName=RadiusUser)) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user RadiusUser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> TRUE ++? if (!control:Auth-Type) -> TRUE ++- entering if (!control:Auth-Type) {...} +++[control] returns noop ++- if (!control:Auth-Type) returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=RadiusUser [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 98 to 172.28.64.3 port 1645 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Motorola-WIBB-Auth-Role = security-officer-role Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 98 with timestamp +17 Ready to process requests. T. Brady

3 7

how to test a user in db from free-radius server
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi All, I have configured freeradius server + oracle database 11g. I send user1 in the Access-Request from radclient to the free-radius server. I need to check whether user1 is exists in user_test table, which is in oracle database 11g. The table contains username - 'user1' and status--'valid' If user found in user_test table Access-Accept else Access-Reject should return to the radclient. Note : should not use 'users' file Please help me how can do that?........................ Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

how to call stored procedure with output varaibles in free-radius
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi All, How to call my own stored procedure ,which takes input and output variable in free-radius server. How do i do that ??? please help.................... Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 (Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

6 7

how to call stored procedure in free-radius server
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi Arran, Thanks for your reply.... have created stored procedure(myS1Request) in oracle database 11g as shown below, procedure takes input and output parameters. The below procedure should be called in the SQL module in Free-radius for Authentication and Authorization purpose. PROCEDURE myS1Request( UserName IN VARCHAR2, MessageType IN LONG, RemoteAddress IN LONG, FemtoAp IN VARCHAR2, RadCoverageInd IN LONG, RadCellId IN LONG, Rad3GCellId IN LONG, RadGeoCord IN LONG, RadAltDirection IN LONG, HNBIPAddress IN LONG, RadPLMNId IN LONG, HNBCellIdentity IN LONG, RadLocAreaLAC IN LONG, RadRoutAreaCode IN LONG, RadServiceArCode IN LONG, RadCSGId IN LONG, RadUECap IN LONG, Result OUT VARCHAR2, RadRegRejCau OUT LONG, RadLocBlacklInd OUT LONG, HNBCellId OUT LONG, RadServiceAreaC OUT LONG, RadLocationAreaI OUT LONG, RadRoutAreaC OUT LONG ) please help me how can proceed........... . Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com Message: 2 Date: Tue, 15 Jan 2013 10:46:08 +0000 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: how to call stored procedure with output varaibles in free-radius Message-ID: <C47F1EE1-3524-4709-85FA-79D0B268C5D6(a)freeradius.org> Content-Type: text/plain; charset=us-ascii On 15 Jan 2013, at 06:22, "Lakshmi Narayana Baliah" <LB0074453(a)techmahindra.com> wrote: > Hi All, > > How to call my own stored procedure ,which takes input and output variable in free-radius server. > > How do i do that ??? please help.................... Guessing you're referring to stored procedures in SQL? Or are you misusing SQL terminology to refer to something like a subroutine or function writen in the policy language? -Arran ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 93, Issue 42 ************************************************ ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

3 2

PROBLEM: RLM SQL_DAILY COUNTER DO NOT REST
by Russell Mike 15 Jan '13

15 Jan '13

Dear List & Alan D. Greetings. I read the wiki documentation & also checked the mail archive before posting on the list. Please accept my apologies if topic has been replied before. My "noresetcounter" works fine as expected but *"sql daily counter"*also do not reset everyday. i tried to dig lot but could not understand the cause. then i upgrade the Freeradius installation from v2.1.12.x to v2.2 but still, daily counter do not reset. i need your help. Due to size restriction i will reduce the output information but i am willing to send more info on request. if a user logs in for 3600 seconds, he can never login again even next day when counting through daily counter, daily counter behaves like noresetcounter. *sqlcounter dailycounter* { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" sqlmod-inst = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime - GREATEST((%b-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } ================================================================================== *Attributes applied to the radius profile for the user:* Check Items: Session-Timeout = 3600 Max-Daily-Session = 3600 Reply Items: ideal-Timeout = 60 Acct-Interim-Interval = 120 Session-Timeout = 3600 ================================================================================== [root@radius mike]# radiusd -X FreeRADIUS *Version 2.2.0*, for host x86_64-unknown-linux-gnu, built on Oct 18 2012 at 13:58:38 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/sites-enabled/default more includes .............. main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Instantiating module "dailycounter" from file /etc/raddb/sql/mysql/counter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-Daily-Session is number 11277 rlm_sqlcounter: Current Time: 1358236678 [2013-01-15 07:57:58], Next reset 1358294400 [2013-01-16 00:00:00] rlm_sqlcounter: Current Time: 1358236678 [2013-01-15 07:57:58], Prev reset 1358208000 [2013-01-15 00:00:00] } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "XXXXXX" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret= jhr75hitflcv98rk rlm_sql (sql): Adding client 127.0.0.1 (localhost, server=<none>) to clients list rlm_sql (sql): Read entry nasname=172.21.45.33,shortname=pfSense Box,secret=jhr75hitflcv98rk rlm_sql (sql): Adding client 172.21.45.33 (Box, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 55408 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 *Ready to process requests.* ==================================================================================== *USER LOGIN REQUEST: THIS USER WAS LAST LOGIN 4 DAYS BACK, ONLY FIRST & LAST TIME. * rad_recv: Access-Request packet from host 127.0.0.1 port 51696, id=136, length=78 User-Name = "russell" User-Password = "rootadmin" NAS-IP-Address = 172.21.45.33 NAS-Port = 1812 Message-Authenticator = 0x7c4bb5c2fa912975d790cb33058d50c5 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "russell", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> russell [sql] sql_set_user escaped user --> 'russell' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'russell' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'russell' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'russell' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'One_Hour_Access' ORDER BY id [sql] User found in group One_Hour_Access [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'One_Hour_Access' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [expiration] Checking Expiration time: '20 Jan 2013' ++[expiration] returns ok ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code WARNING: Please replace '%k' with '${key}' sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' -> SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'}' [dailycounter] sql_xlat [dailycounter] expand: %{User-Name} -> russell [dailycounter] sql_set_user escaped user --> 'russell' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' -> SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' rlm_sql (sql): Reserving sql socket id: 1 [dailycounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 1 [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'} -> 2146567019 rlm_sqlcounter: (Check item - counter) is less than zero *rlm_sqlcounter: Rejected user russell, check_item=3600, counter=2576267* ++[dailycounter] returns reject Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> russell [sql] sql_set_user escaped user --> 'russell' [sql] expand: %{User-Password} -> rootadmin [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'russell', 'rootadmin', 'Access-Reject', '2013-01-15 07:59:31') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'russell', 'rootadmin', 'Access-Reject', '2013-01-15 07:59:31') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> russell attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 136 to 127.0.0.1 port 51696 *Reply-Message = "Your maximum daily usage time has been reached"* Waking up in 4.9 seconds. Cleaning up request 1 ID 136 with timestamp +93 Ready to process request I would grateful for your assistance & advice.. Thanks / Russell

1 0

wiki.freeradius.org will be down for upgrades
by Alan DeKok 14 Jan '13

14 Jan '13

We'll take it down for a few hours to do some upgrades. It should be back up later today. Alan DeKok.

1 0

(no subject)
by Yashaswini Sathyanarayana 14 Jan '13

14 Jan '13

Hi all, I want to configure the free radius to return access- reject based on the value of a particular column in database . How do i do that ??? please help.... Thanks & Regards, Yashaswini | Prod Engg | Tech Mahindra Ltd. 9 / 7 Hosur Road, Bangalore - 560029, India. (Office: +91 80 40243000, Extn: 3478 Mobile: +91 9611591177 www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

EAP-SIM Authentication Failure-FreeRadius-V2.2.0
by Ratnesh Sinha 13 Jan '13

13 Jan '13

Hi, I am trying to test EAP-SIM Authentication using 802.1x Access Node and a Wifi enabled phone with EAP-SIM support. I have configured Radius Server 2.2.0 based on instructions. I am getting the following error: [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT ############################################################################ ############################### The full trace below: ############################################################################ ############################### Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=7, length=244 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013134303434353030313234373839333540776c616e2e6d6e633034352e6d6363 3430342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x558781ab0d6f653bc2fcf8af9ee61260 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 245 ++[eap] returns handled Sending Access-Challenge of id 7 to 10.0.0.1 port 1047 EAP-Message = 0x01f50014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf445757cf4b067d13eec4c46dac51c4a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=8, length=294 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f50058120a00000705000021846d8ebd5ce97d1b79c5501a95ac64100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0xf445757cf4b067d13eec4c46dac51c4a Message-Authenticator = 0xe1d4bbed7648690e15b0720f9277206c # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 245 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f50058120a00000705000021846d8ebd5ce97d1b79c5501a95ac64100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0xf445757cf4b067d13eec4c46dac51c4a Message-Authenticator = 0xe1d4bbed7648690e15b0720f9277206c EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x000021846d8ebd5ce97d1b79c5501a95ac64 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333134303434353030313234373839333540776c616e2e6d6e633034352e6d6363343034 2e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 246 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.0.0.1 port 1047 EAP-Message = 0x01f60050120b0000010d000030000000000000000000000000000000310000000000000000 00000000000000320000000000000000000000000000000b050000bb28c3433b5a561015daaf 0ea141811e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf445757cf5b367d13eec4c46dac51c4a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=9, length=218 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f6000c120e000016010000 State = 0xf445757cf5b367d13eec4c46dac51c4a Message-Authenticator = 0xca05315c11be75a0938baf8f708367e2 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 246 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 9 to 10.0.0.1 port 1047 EAP-Message = 0x04f60004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.9 seconds. Cleaning up request 0 ID 7 with timestamp +19 Cleaning up request 1 ID 8 with timestamp +19 Waking up in 4.0 seconds. Cleaning up request 2 ID 9 with timestamp +22 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=10, length=244 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013134303434353030313234373839333540776c616e2e6d6e633034352e6d6363 3430342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x74523b39f4caeb2704555e3a35630534 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 255 ++[eap] returns handled Sending Access-Challenge of id 10 to 10.0.0.1 port 1047 EAP-Message = 0x01ff0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x067ab3ff0685a127aaec9be0764c9b76 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=11, length=294 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02ff0058120a000007050000f3c0d40d24735995cd2aa194ccc3e9ae100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0x067ab3ff0685a127aaec9be0764c9b76 Message-Authenticator = 0x4e16bb97083e9c782af073721b309c20 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 255 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02ff0058120a000007050000f3c0d40d24735995cd2aa194ccc3e9ae100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0x067ab3ff0685a127aaec9be0764c9b76 Message-Authenticator = 0x4e16bb97083e9c782af073721b309c20 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000f3c0d40d24735995cd2aa194ccc3e9ae EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333134303434353030313234373839333540776c616e2e6d6e633034352e6d6363343034 2e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 0 ++[eap] returns handled Sending Access-Challenge of id 11 to 10.0.0.1 port 1047 EAP-Message = 0x01000050120b0000010d000030000000000000000000000000000000310000000000000000 00000000000000320000000000000000000000000000000b0500008ed118746ac218cc6ea072 1d59d42518 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x067ab3ff077aa127aaec9be0764c9b76 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=12, length=218 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c120e000016010000 State = 0x067ab3ff077aa127aaec9be0764c9b76 Message-Authenticator = 0x9a08d17e00177ea24b2a90933b12d4c0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 12 to 10.0.0.1 port 1047 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.9 seconds. Cleaning up request 3 ID 10 with timestamp +29 Cleaning up request 4 ID 11 with timestamp +29 Waking up in 4.0 seconds. Cleaning up request 5 ID 12 with timestamp +32 Ready to process requests. ############################################################################ ############################### simtriplets.dat content below ############################################################################ ############################### 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,300000000000000000000000 00000000,30112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,310000000000000000000000 00000000,31112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,320000000000000000000000 00000000,32112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,330000000000000000000000 00000000,33112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,340000000000000000000000 00000000,34112233,445566778899AABB ############################################################################ ############################### Regards, Ratnesh

1 0

dhcp sqlippool reauthenticate users every minute
by Ethan Hayon 12 Jan '13

12 Jan '13

Hi, I'm trying to set up FreeRADIUS 2.2 to act as an authentication and accounting system as well as a DHCP server. (I'm relaying DHCP requests from a pfSense box). I am trying to use sqlippools on FreeRADIUS, but I have noticed that my ippools are filling up quickly (I am only testing with two devices). I have pfSense configured to reauthenticate user every minute, so I believe that FreeRADIUS is running post-auth dhcp leasing each time the user is reauthenticated. FreeRADIUS is serving the same client a new IP address each minute. I have adjusted my policy conf to the below. I may be approaching this the wrong way, but this is essentially what I am trying to do: I want to have multiple pools on different subnets. When a new client connects to the network (they don't yet have a radius account) they are sent to a default (pending) pool. This may be on the 192.168.1/24 subnet. After they have set up their account and have been added to the RADIUS database, they will be given a pool-name, maybe `pool2`. `pool2` will be on a different subnet, for example, 192168.2/24. The pfsense box knows how to route these subnets, so that is not a problem. I only want clients to receive a different IP address if their pool-name changes for whatever reason, if there are no changes to their account, they shouldn't be leased a new IP every time they reauthenticate (every minute). Eventually I will disable the reauthenticate every minute feature as the production system would not be able to handle this many requests. Am I approaching this problem correctly? I have written some un-lang in the policy.conf file for handling some of this. I am getting hung up on this problem. The pool is getting exhausted in minutes since each client is leased a new ip every minute. Any help is appreciated! Thanks, Ethan …. dhcp_sqlippool.post-auth { # Do some minor hacks to the request so that it looks # like a RADIUS request to the SQL IP Pool module. # check whether the requester is a user or not, if they do not have a pool-name, send them to pfpriv by default if("%{sql: SELECT COUNT(*) FROM radcheck where username='%{DHCP-Client-Hardware-Address}' AND attribute='Pool-Name'}" != "0") { update control { Pool-Name := "%{sql: SELECT `value` FROM radcheck WHERE username = '%{DHCP-Client-Hardware-Address}' AND attribute='Pool-Name'}" } } else { update control { Pool-Name := "pfpriv" # default pool if the user doesn't have an account } } update reply { DHCP-Domain-Name-Server = "192.168.1.1" # we will ultimately create a mysql table `radpoolinfo` to store per-pool attributes DHCP-Router-Address = "192.168.0.1" # this will also be in `radpoolinfo` eventually } update request { User-Name = "DHCP-%{DHCP-Client-Hardware-Address}" Calling-Station-Id = "%{DHCP-Client-Hardware-Address}" NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}" Acct-Status-Type = Start } # Call the actual module # # Uncomment this in order to really call it! dhcp_sqlippool #fail # Convert Framed-IP-Address to DHCP, but only if we # actually allocated an address. if (ok) { update reply { DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" } } } …

2 5

C External Program
by Ali Majdzadeh 11 Jan '13

11 Jan '13

Hi I wrote the following code to accept any user/pass in a C external program: Main() { fprintf (stdout, "Auth-Type := Accept\n"); return 0; } It works well with PAP but does not work in CHAP/MSCHAP. I know I should return Cleartext-Password but I want to permit any user/pass to loggin in. So how can I do that?

1 0