August 2013 - Freeradius-Users - lists.freeradius.org

FR3.0/Policy.D
by ultaman khoo 22 Aug '13

22 Aug '13

Hi All, I have faced an issue with NAS IP Changes causes radius accouting insert instead of update, this has causes an issue with the reporting wenever the NAS IP changes, for example the usage of the users will be duplicate if you sum up the usage for 1 day for example. i have tested the FR3.0RC0 with the policy.d in place, below is the issue i encounter during the testing in lab. >From Debug Log: Radius accouting start - OK rad_recv: Accounting-Request packet from host 10.69.1.35 port 62260, id=11, length=39 User-Name = 'cskhoo' Acct-Status-Type = Start Acct-Session-Id = '900' (0) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (0) group preacct { (0) - entering group preacct {...} (0) [preprocess] = ok (0) policy acct_unique { (0) - entering policy acct_unique {...} (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (0) expand: "%{string:Class}" -> '' (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (0) else else { (0) - entering else else {...} (0) update request { (0) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> 'c2141489ad2dd37607b19fd75af8623f' (0) Acct-Unique-Session-Id := "c2141489ad2dd37607b19fd75af8623f" (0) } # update request = ok (0) - else else returns ok (0) - policy acct_unique returns ok (0) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) [files] = noop (0) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (0) group accounting { (0) - entering group accounting {...} (0) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815' (0) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815 (0) detail : expand: "%t" -> 'Thu Aug 15 02:53:59 2013' (0) [detail] = ok (0) [unix] = noop (0) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.start.query' (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : expand: "%{User-Name}" -> 'cskhoo' (0) sql : SQL-User-Name updated (0) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', 'c2141489ad2dd37607b19fd75af8623f', 'cskhoo', '', '10.69.1.35', '', '', FROM_UNIXTIME(1376506439), FROM_UNIXTIME(1376506439), NULL, '0', '', '', '', '0', '0', '', '', '', '', '', '')' rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', 'c2141489ad2dd37607b19fd75af8623f', 'cskhoo', '', '10.69.1.35', '', '', FROM_UNIXTIME(1376506439), FROM_UNIXTIME(1376506439), NULL, '0', '', '', '', '0', '0', '', '', '', '', '', '')' rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3) rlm_sql_mysql: Socket destructor called, closing socket (0) [-sql] = ok (0) [exec] = noop (0) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (0) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (0) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 11 from 0.0.0.0 port 1813 to 10.69.1.35 port 62260 (0) Finished request 0. Waking up in 0.2 seconds. (0) Cleaning up request packet ID 11 with timestamp +10 Ready to process requests. Radius Acct Update - OK rad_recv: Accounting-Request packet from host 10.69.1.35 port 62261, id=12, length=39 User-Name = 'cskhoo' Acct-Status-Type = Interim-Update Acct-Session-Id = '900' (1) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (1) group preacct { (1) - entering group preacct {...} (1) [preprocess] = ok (1) policy acct_unique { (1) - entering policy acct_unique {...} (1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (1) expand: "%{string:Class}" -> '' (1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (1) else else { (1) - entering else else {...} (1) update request { (1) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> 'c2141489ad2dd37607b19fd75af8623f' (1) Acct-Unique-Session-Id := "c2141489ad2dd37607b19fd75af8623f" (1) } # update request = ok (1) - else else returns ok (1) - policy acct_unique returns ok (1) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (1) group accounting { (1) - entering group accounting {...} (1) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815' (1) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815 (1) detail : expand: "%t" -> 'Thu Aug 15 02:54:31 2013' (1) [detail] = ok (1) [unix] = noop (1) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.interim-update.query' (1) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (1) sql : expand: "%{User-Name}" -> 'cskhoo' (1) sql : SQL-User-Name updated (1) sql : expand: "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506471), acctinterval = 1376506471 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.35'' rlm_sql (sql): Executing query: 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506471), acctinterval = 1376506471 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.35'' rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (1): Too many free connections (4 > 3) rlm_sql_mysql: Socket destructor called, closing socket (1) [-sql] = ok (1) [exec] = noop (1) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (1) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 12 from 0.0.0.0 port 1813 to 10.69.1.35 port 62261 (1) Finished request 1. Waking up in 0.2 seconds. (1) Cleaning up request packet ID 12 with timestamp +42 Ready to process requests. Radius Update when NAS IP Changes - Error as below rad_recv: Accounting-Request packet from host 10.69.1.31 port 65146, id=13, length=39 User-Name = 'cskhoo' Acct-Status-Type = Interim-Update Acct-Session-Id = '900' (2) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (2) group preacct { (2) - entering group preacct {...} (2) [preprocess] = ok (2) policy acct_unique { (2) - entering policy acct_unique {...} (2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (2) expand: "%{string:Class}" -> '' (2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (2) else else { (2) - entering else else {...} (2) update request { (2) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '47fe864f0f34504bea1670f9b8e542e4' (2) Acct-Unique-Session-Id := "47fe864f0f34504bea1670f9b8e542e4" (2) } # update request = ok (2) - else else returns ok (2) - policy acct_unique returns ok (2) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) [files] = noop (2) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (2) group accounting { (2) - entering group accounting {...} (2) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815' (2) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815 (2) detail : expand: "%t" -> 'Thu Aug 15 02:55:53 2013' (2) [detail] = ok (2) [unix] = noop (2) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.interim-update.query' (2) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (2) sql : expand: "%{User-Name}" -> 'cskhoo' (2) sql : SQL-User-Name updated (2) sql : expand: "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506553), acctinterval = 1376506553 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' rlm_sql (sql): Executing query: 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506553), acctinterval = 1376506553 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' (2) sql : No records updated (2) sql : Trying next query... (2) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506553 - 0), FROM_UNIXTIME(1376506553), NULL, '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '')' rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506553 - 0), FROM_UNIXTIME(1376506553), NULL, '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '')' rlm_sql_mysql: MYSQL check_error: 1136 received rlm_sql (sql): Database query error: Column count doesn't match value count at row 1 rlm_sql_mysql: MYSQL check_error: 1136 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Column count doesn't match value count at row 1' (2) sql : No additional queries configured rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 124 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 124 seconds rlm_sql_mysql: Socket destructor called, closing socket (2) [-sql] = noop (2) [exec] = noop (2) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (2) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (2) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 13 from 0.0.0.0 port 1813 to 10.69.1.31 port 65146 (2) Finished request 2. Waking up in 0.3 seconds. (2) Cleaning up request packet ID 13 with timestamp +124 Ready to process requests. Radius Acct Stop after NAS IP Changes - another record with stop time was added into mysql DB, the previous record will not have stop time. rad_recv: Accounting-Request packet from host 10.69.1.31 port 53956, id=14, length=39 User-Name = 'cskhoo' Acct-Status-Type = Stop Acct-Session-Id = '900' (3) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (3) group preacct { (3) - entering group preacct {...} (3) [preprocess] = ok (3) policy acct_unique { (3) - entering policy acct_unique {...} (3) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (3) expand: "%{string:Class}" -> '' (3) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (3) else else { (3) - entering else else {...} (3) update request { (3) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '47fe864f0f34504bea1670f9b8e542e4' (3) Acct-Unique-Session-Id := "47fe864f0f34504bea1670f9b8e542e4" (3) } # update request = ok (3) - else else returns ok (3) - policy acct_unique returns ok (3) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) [files] = noop (3) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (3) group accounting { (3) - entering group accounting {...} (3) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815' (3) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815 (3) detail : expand: "%t" -> 'Thu Aug 15 02:56:37 2013' (3) [detail] = ok (3) [unix] = noop (3) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.stop.query' (3) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (3) sql : expand: "%{User-Name}" -> 'cskhoo' (3) sql : SQL-User-Name updated (3) sql : expand: "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1376506597), acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = '', connectinfo_stop = '' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' rlm_sql (sql): Executing query: 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1376506597), acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = '', connectinfo_stop = '' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' (3) sql : No records updated (3) sql : Trying next query... (3) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506597 - 0), FROM_UNIXTIME(1376506597), FROM_UNIXTIME(1376506597), '', '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '', '')' rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506597 - 0), FROM_UNIXTIME(1376506597), FROM_UNIXTIME(1376506597), '', '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '', '')' rlm_sql (sql): Released connection (4) rlm_sql (sql): Opening additional connection (5) rlm_sql_mysql: Starting connect to MySQL server (3) [-sql] = ok (3) [exec] = noop (3) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (3) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (3) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 14 from 0.0.0.0 port 1813 to 10.69.1.31 port 53956 (3) Finished request 3. Waking up in 0.2 seconds. (3) Cleaning up request packet ID 14 with timestamp +168 Ready to process requests. Regards, Ultaman

2 7

rlm_python
by stefan.paetow＠diamond.ac.uk 21 Aug '13

21 Aug '13

Hello all, I'm currently attempting to use rlm_python to query LDAP (with python-ldap) and then return an XML string in a VSA (SAML-AAA-Assertion). However, when I try to load it, I get the dreaded "undefined symbol: PyExc_SystemError" error. This is on Ubuntu 12 with, I know, I know, FreeRADIUS 2.1.10. Python-LDAP was built on the local machine for the newest version (although the existing version in the Ubuntu repository has the same problem). Freeradius_samlldap exists in the correct path for Python eggs, and this is the PYTHONPATH (when I print it with Python): /usr/local/lib/python2.7/dist-packages/pysaml2-0.4.2-py2.7.egg,/usr/local/lib/python2.7/dist-packages/repoze.who-1.0.18-py2.7.egg,/usr/local/lib/python2.7/dist-packages/zope.interface-4.0.5-py2.7-linux-x86_64.egg,/usr/local/lib/python2.7/dist-packages/Paste-1.7.5.1-py2.7.egg,/usr/local/lib/python2.7/dist-packages/httplib2-0.8-py2.7.egg,/usr/local/lib/python2.7/dist-packages/decorator-3.4.0-py2.7.egg,/usr/local/lib/python2.7/dist-packages/freeradius_samlldap-0.0.1-py2.7.egg,/usr/local/lib/python2.7/dist-packages/python_ldap-2.4.13-py2.7-linux-x86_64.egg,/etc/freeradius/modules,/usr/local/lib/python2.7/dist-packages,/usr/lib/python2.7,/usr/lib/python2.7/plat-linux2,/usr/lib/python2.7/lib-tk,/usr/lib/python2.7/lib-old,/usr/lib/python2.7/lib-dynload,/usr/lib/python2.7/dist-packages,/usr/lib/pymodules/python2.7 >From what I understand, using ldd -r will list several unresolved imports, but that is supposedly correct? Or is that horribly wrong? The usual debug log is below: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 24 2012 at 17:58:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/saml including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/umbrella_ldap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/umbrella-inner including configuration file /etc/freeradius/sites-enabled/umbrella main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm umbrellaid.org { } realm LOCAL { } realm NULL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "diamond-umbrella" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server umbrella-inner { # from file /etc/freeradius/sites-enabled/umbrella-inner modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/umbrella_ldap ldap { server = "127.0.0.1" port = 389 password = "root" identity = "cn=admin" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" basedn = "ou=people,dc=eurofel,dc=eu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP EAAHash mapped to RADIUS Chargeable-User-Identity conns: 0x1ff48d0 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "gtc" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "umbrella-inner" include_length = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "reply_log" from file /etc/freeradius/modules/detail.log detail reply_log { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } Module: Linked to module rlm_python Module: Instantiating module "python" from file /etc/freeradius/modules/saml python_init done python { mod_instantiate = "freeradius_samlldap" func_instantiate = "instantiate" mod_post_auth = "freeradius_samlldap" func_post_auth = "post_auth" } rlm_python:python_load_function: module 'freeradius_samlldap' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /usr/local/lib/python2.7/dist-packages/python_ldap-2.4.13-py2.7-linux-x86_64.egg/_ldap.so: undefined symbol: PyExc_SystemError rlm_python:python_load_function: failed to import python function 'freeradius_samlldap.instantiate' /etc/freeradius/modules/saml[1]: Instantiation failed for module "python" /etc/freeradius/sites-enabled/umbrella-inner[149]: Failed to load module "python". /etc/freeradius/sites-enabled/umbrella-inner[133]: Errors parsing post-auth section. Some help with this is very much appreciated! :-) Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 5

NEW NAS Password Doesn't Authenticate
by mr. s 21 Aug '13

21 Aug '13

>From the logs I interpret, the error is incorrect password for the user. Is this correct interpretation? I believe we have added in the NAS correctly to the clients file. Also the username and password, we are testing, authenticates both locally and from another NAS, without issue. Here is an excerpt of our radius -X FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... client 192.168.1.239 { require_message_authenticator = no secret = "FreeRADIUS" shortname = "New_NAS" } rad_recv: Access-Request packet from host 192.168.1.239 port 1645, id=30, length=140 Framed-Protocol = PPP User-Name = "username(a)domain.com" User-Password = "password" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/1/2890" Cisco-AVPair = "client-mac-address=a820.6654.6a6f" Service-Type = Framed-User NAS-IP-Address = 192.168.1.239 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "domain.com" for User-Name = "username(a)domain.com" [suffix] Found realm "domain.com" [suffix] Adding Stripped-User-Name = "username" [suffix] Adding Realm = "domain.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++? if (control:Auth-Type == Reject) (Attribute control:Auth-Type was not found) ++- entering else else {...} [sql] expand: %{Stripped-User-Name} -> username [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> username [sql] sql_set_user escaped user --> 'username' rlm_sql (sql): Reserving sql socket id: 23 [sql] expand: SELECT '1' as id, userId as username, 'Cleartext-Password' as attribute, checkNASIPPassword( '%{NAS-IP-Address}','%{SQL-User-Name}') as value, ':=' as op FROM radiusUsers WHERE userId = '%{SQL-User-Name}' ORDER BY id -> SELECT '1' as id, userId as username, 'Cleartext-Password' as attribute, checkNASIPPassword( '192.168.1.239','username') as value, ':=' as op FROM radiusUsers WHERE userId = 'username' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT '1' as id, userId as username, 'Framed-IP-Address' as attribute, assignIPAddress('%{NAS-IP-Address}','%{SQL-User-Name}') as value, '==' as op FROM radiusUsers WHERE userId = '%{SQL-User-Name}' ORDER BY id -> SELECT '1' as id, userId as username, 'Framed-IP-Address' as attribute, assignIPAddress('192.168.1.239','username') as value, '==' as op FROM radiusUsers WHERE userId = 'username' ORDER BY id [sql] expand: SELECT userID as groupname FROM radiusUsers WHERE userId = '**-Not-Using-Groups-**' -> SELECT userID as groupname FROM radiusUsers WHERE userId = '**-Not-Using-Groups-**' rlm_sql (sql): Released sql socket id: 23 +++[sql] returns ok ++- else else returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "**-User-Not-Allowed-To-Use-This-NAS-**" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [ username(a)domain.com/password] (from client SHL-BRAS-01_239 port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> username(a)domain.com attr_filter: Matched entry DEFAULT attrt line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 30 to 192.168.1.239 port 1645 Finished request 70.

2 4

Re: User Account Configuration
by Alan Buxey 20 Aug '13

20 Aug '13

Think about the login time ... If you create an account for the future then if it has a start validity date. .. alan

1 0

User Account Configuration
by Patrick Meyer 20 Aug '13

20 Aug '13

Greetings! I am using Freeradius2 2.2.0 on a pfsense 2.1 RC1 firewall to support authentication for a captive portal. I see that it is possible to expire a user account in Freeradius. I am wondering if I can specify a date and time to make the account effective. For instance, I know I have a user starting in 30 days. Can I configure the account today to enable the user in 30 days? Regards, Patrick

1 0

FreeRADIUS + OpenLDAP + Daloradius
by Mantas Šiurkus 19 Aug '13

19 Aug '13

Hello, I am creating WIFI hotspot on Debian 7. I had configured FreeRADIUS to work with OpenLDAP for users authentication. How I can configure Daloradius for user control? All tutorials that I found, shows how to configure it with mysql, but my users are stored into LDAP (not mysql). Is it possible to configure Daloradius to work when users authenticate wia LDAP?

1 0

Policy to split domain and host
by nicolas.clo＠ricoh-industrie.fr 16 Aug '13

16 Aug '13

Hi list, I'm searching the best way to configure a policy to split the domain and the prefix ' /host' when it is a computer connection. The initial UserName is like this: host/computername.DOMAIN.LOCAL I can already easily split the /host by policy and realm configuration but I don't know how I can do when there is double delimiter in the same UserName ? Thanks for your reply. __________________________________________________________________________ Nicolas CLO Industrial and Network Technician ITS Section RICOH INDUSTRIE FRANCE SAS 144, route de Rouffach, 68920 WETTOLSHEIM Tel: +33 (0) 3 89 20 48 84 nicolas.clo(a)ricoh-industrie.fr | www.ricoh-thermal.com

2 2

FreeRADIUS basic setup for PEAP using example certificates
by Darlington, Andrew 15 Aug '13

15 Aug '13

Hi all I'm trying to setup a very basic test server using FreeRADIUS (running on Ubuntu 12.04) that uses PEAP with the example certificates generated by FreeRADIUS. I keep running into a variety of fairly basic problems. After running freeradius -X I get this error message. Couldn't open /etc/freeradius/acct_users for reading: Permission denied Errors reading /etc/freeradius/acct_users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. I was hoping someone could advise. Thanks PS I'm new to FreeRADIUS and Ubuntu. ________________________________ This e-mail message is confidential and for use by the addressee only. If you are not the intended recipient, you must not use, disclose, copy or forward this transmission. Please return the message to the sender by replying to it and then delete the message from your computer. Sagentia provides e-mail services for both itself and a number of its independent spin-out companies. Sagentia shall not be held liable to any person resulting from the use of any information contained in this e-mail and shall not be liable to any person who acts or omits to do anything in reliance upon it. Sagentia does not accept responsibility for changes made to this message after it was sent. Company Information: Name: Sagentia Limited. Registered Address: Harston Mill, Harston Cambridge CB22 7GG. Registered as a Company in England: 2081960 VAT Number: 432214202. Website hosted by: Sagentia Limited Harston Mill, Harston, Cambridge, UK. CB22 7GG info(a)sagentia.com -- Scanned by iCritical.

4 6

Rejecting realms based on calling client
by David Aldwinckle 15 Aug '13

15 Aug '13

Hello, I have two clients that proxy access requests to me. The realm varies, but the format is always userid(a)realm.whatever<mailto:userid@realm.whatever> Is there a way that I can deny a specific realm when an access request is received from a specific client? I tried adding something to policy.conf but I couldn't get the syntax right: #Prevent secretrealm from logging in off-campus remote_secret_reject if ("%{Realm}" == "secretrealm.ca") && ((Client-Shortname == "proxy-client1") || (Client-Shortname == "proxy-client2"))) { reject } Is there a different way that I should be doing this? Thanks, Dave Dave Aldwinckle Network Support Specialist Information Systems and Technology Phone: (519)-888-4567 ext. 31145 E-Mail: daldwinc(a)uwaterloo.ca<mailto:daldwinc@uwaterloo.ca>

3 5

How to accept RADIUS traffic on multiple interfaces?
by Kurt Hillig 15 Aug '13

15 Aug '13

We're running FreeRadius 2.2.0 on RHEL 6. The servers are working fine with a single active interface (eth0) on each one; but we need to activate a second interface (eth1) on each server - on a different IP subnet - to handle local traffic on that subnet. The interfaces look like this: eth0 Link encap:Ethernet HWaddr 18:03:73:EE:76:96 inet addr:10.10.0.189 Bcast:10.10.0.191 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 eth1 Link encap:Ethernet HWaddr 18:03:73:EE:76:98 inet addr:10.10.95.62 Bcast:10.10.95.127 Mask:255.255.255.128 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 and the routing is correct: Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.10.0.184 0.0.0.0 255.255.255.248 U 0 0 0 eth0 10.10.95.0 0.0.0.0 255.255.255.128 U 0 0 0 eth1 0.0.0.0 10.10.0.185 0.0.0.0 UG 0 0 0 eth0 Iptables is set up to accept incoming traffic from anywhere on UDP ports 1812 and 1813. radiusd.conf includes these "listen" sections (omitting comments): listen { type = auth ipaddr = * port = 1812 interface = eth0 } listen { type = auth ipaddr = * port = 1812 interface = eth1 } listen { type = acct ipaddr = * port = 1813 interface = eth0 } listen { type = acct ipaddr = * port = 1813 interface = eth1 } But radiusd isn't seeing any of the inbound RADIUS traffic on eth1 - tcpdump shows it coming in, but "radiusd -X" shows no indication of this traffic (but is reporting all of the traffic on eth0). Anyone know what I'm missing here? -- Dr. Kurt Hillig UMNet Administration I always tell the (734)647-8778 desk University of Michigan absolute truth, (734)323-2736 cell Ann Arbor, MI 48105-3640 as I see it. khillig(at)umich.edu > Computers were invented to help people waste more time faster <

3 3