January 2014 - Freeradius-Users - lists.freeradius.org

cui-inner.post-auth and cui.post-auth
by stefan.paetow＠diamond.ac.uk 29 Jan '14

29 Jan '14

Sorry, doing more poking around and have discovered that while the %{User-Name} attribute is turned into lower-case with %{tolower:...}, %{Operator-Name} is not. Surely to ensure consistency, shouldn't Operator-Name ALSO be turned into a lower-case? After all, 1DIAMOND.AC.UK and 1diamond.ac.uk are the same on t'Internet? Just a question... Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 7

How to set User access for certain clients
by dilanka nayanajith 29 Jan '14

29 Jan '14

Hi every one i am facing some problems, i configured radius server i configured a client and finally i have configured a user as well how do i block or deny access for users to log certain clients as and example -- User1 can log to the SWA but he should not be able to log to SWB please help me on this , i read so many articuls but cant fiend a way to do it -- dilanka nayanajith Thank you

3 2

How configure freeradius that check user group in Microsoft Active Direcory
by matrix30003 28 Jan '14

28 Jan '14

Hi I integrated freeradius with Microsoft Active Directory All users in Active Directory have access. How I will set freeradius that check users groups nad access accept if user belongs to groups WIFI in Active Directory.

8 15

%S short variable obsolescence
by stefan.paetow＠diamond.ac.uk 28 Jan '14

28 Jan '14

Hi, Another question... The Wiki at http://wiki.freeradius.org/config/Run%20time%20variables says that %S and others *will* be removed in the future... since I am now using %S, what future variable would be preferred for using it? The Wiki does not list one at the moment. With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 3

rlm_perl truncating some attributes in 3.0.1
by Leggett, Torrance I. 28 Jan '14

28 Jan '14

I'm trying to upgrade our 2.2.1 based servers to 3.0.1, but it appears that rlm_perl is truncating some attributes. Specifically Calling-Station-Id, User-Name and User-Password. Here is the debug output from the server: http://pastebin.com/GYpBS59L And here is the rlm_perl script that currently works under 2.2.1 but appears to be receiving truncated %RAD_REQUEST attributes: http://pastebin.com/auKspQcU Is this normal behavior that can be overridden at script definition time? Thanks!

2 4

SSH Logins to Cisco Switch. RADIUS/Active Directory
by Luke Ramsden 28 Jan '14

28 Jan '14

Hi, I am trying to authenticate SSH logins to my Cisco 3750 switches using RADIUS/Active Directory. I think this means I will need the Cisco switches to send an MSCHAPv2 challenge to the RADIUS server? I am struggling to achieve this and wondered if anyone else had come across this and could offer some advice? Essentially, all I want is to remotely access the switches on my network using Active Directory credentials. Are there any other/better methods if the above is not possible? Any help is greatly appreciated :-)

2 9

Changed behaviour in v3.x
by stefan.paetow＠diamond.ac.uk 28 Jan '14

28 Jan '14

Hi, In my post-auth section, I get the exact date and time in a specific format using /bin/date, and feed that back into an attribute. I've noticed though that now the back-tick exec appends a '\n' (a carriage return) to the end, which it did not do in FR2. Is that now correct (and expected) behaviour? The code in my post-auth: update control { Tmp-String-1 := `/bin/date -u +%%FT%%TZ` } FR 3 output: (20) update control { (20) Executing: "/bin/date -u +%%FT%%TZ" (20) expand: "+%%FT%%TZ" -> '+%FT%TZ' (20) Program returned code (0): 2014-01-27T17:20:42Z (20) Tmp-String-1 := '2014-01-27T17:20:42Z\n' (20) } # update control = noop FR 2 output: expand: +%%FT%%TZ -> +%FT%TZ Exec-Program output: 2014-01-27T17:35:00Z Exec-Program-Wait: plaintext: 2014-01-27T17:35:00Z Exec-Program: returned: 0 +++[control] returns noop When I then re-use the Tmp-String-1 attribute for a reply attribute I'm building, I end up with a CR in the reply attribute, which is then considered invalid (because it contains a CR). If the appended CR is now accepted behaviour, how do I remove it? With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 6

fr3+ldap = rad_send() failed: Invalid argument
by Zeus Panchenko 28 Jan '14

28 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, please, help me to understand what am I missing ... I am trying to get fr3 working with ldap as storage for users, profiles and clients while I was able to auth successfully on v.2, now after upgrade to 3.0.0 I am unable to get Access-Accept with radtest ... > radtest -4 -x student2 ***** radius.es 100 testing123 0 radius.es Sending Access-Request of id 23 from 0.0.0.0 port 24919 to 10.0.0.1 port 1812 User-Name = 'student2' User-Password = '*****' NAS-IP-Address = 10.0.0.1 NAS-Port = 100 Message-Authenticator = 0x00 ... radclient: no response from server for ID 23 socket 3 here is fr debug fragment: - ---[ quotation start ]------------------------------------------- rlm_ldap (ldap): Reserved connection (14) (1) files : Using user DN from request "cn=student2,ou=users,ou=radius,dc=es" (1) files : Checking user object membership (radiusGroupName) attributes (1) files : Performing search in 'cn=student2,ou=users,ou=radius,dc=es' with filter '(null)' (1) files : Waiting for search result... (1) files : Processing group membership value "students" (1) files : Processing group membership value "teachers" (1) files : User found. Comparison between membership: name, check: name] rlm_ldap (ldap): Released connection (14) (1) files : users: Matched entry DEFAULT at line 7 (1) [files] = ok rlm_ldap (ldap): Reserved connection (14) (1) ldap : expand: "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(cn=student2)' (1) ldap : expand: "ou=users,ou=radius,dc=es" -> 'ou=users,ou=radius,dc=es' (1) ldap : Performing search in 'ou=users,ou=radius,dc=es' with filter '(cn=student2)' (1) ldap : Waiting for search result... (1) ldap : User object found at DN "cn=student2,ou=users,ou=radius,dc=es" (1) ldap : control:Cleartext-Password := '*****' (1) ldap : control:User-Profile := 'cn=students,ou=profiles,ou=radius,dc=es' rlm_ldap (ldap): Released connection (14) (1) [ldap] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap : login attempt with password "*****" (1) pap : Using clear text password "*****" (1) pap : User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok ... Sending Access-Accept of id 23 from 10.0.0.1 port 1812 to 10.0.0.1 port 24919 rad_send() failed: Invalid argument (1) ERROR: Failed sending reply: (1) Finished request 1. Waking up in 0.3 seconds. - ---[ quotation end ]------------------------------------------- and in addition, while the very auth is successfull as I can see, profile attributes application to the user is not occuring (as it was with v.2) ... here is ldap module configuration: - ---[ quotation start ]------------------------------------------- ldap { server = "localhost" port = 389 password = "*****" identity = "cn=ldapmaster,dc=es" edir_autz = yes user { filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "ou=users,ou=radius,dc=es" access_positive = yes } group { filter = "(objectClass=groupOfNames)" scope = "sub" base_dn = "ou=profiles,ou=radius,dc=es" name_attribute = "cn" membership_attribute = "radiusGroupName" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=clients,ou=radius,dc=es" attribute { identifier = "radiusClientIdentifier" shortname = "radiusClientShortname" secret = "radiusClientSecret" } } profile { filter = "(&(objectClass=radiusprofile)(ou=profile))" } options { ldap_debug = 296 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } - ---[ quotation end ]------------------------------------------- can somebody advise, pls? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlLmpxsACgkQr3jpPg/3oyq5CQCfbhlkzaPhzwuxcj78BnAeBIsh 1PIAoOjcaDCyKH6znEfTW+eR6zDNGTiu =6U/9 -----END PGP SIGNATURE-----

2 5

Using old certificates
by Khalid Tawfik Kasem 28 Jan '14

28 Jan '14

Hi, we are replacing Diameter which use eap/tls and has its server and client certificates. Is there any way to use the old certificates inside freeRADIUS without forcing the clients to replace it with freeRADIUS certificates? We don't need to change the customer behavior. Your cooperation and support are highly appreciated. Best Regards, Khaled Qasem.

3 4

FreeRADIUS & sqlite?
by Mark DeCheser 28 Jan '14

28 Jan '14

Hey everyone, I'm interested to get FreeRADIUS working with a sqlite backend. My searches around the internet show there is support for sqlite in both 2.x and 3.x versions of FreeRADIUS. I am using 2.1.12 as packaged in CentOS 6. To start, can someone direct me to some documentation online which provides direction to getting this working? I must be looking in the wrong places, because I don't see much documentation for FreeRADIUS when using a sqlite datastore. The first issue I encountered was that there is no schema packaged for FreeRADIUS on CentOS. I worked around this issue by using the schema provided for PostgreSQL. Aside from the commands required to get the DB created, I was only required to remove one or two lines from the PostgreSQL schema: CREATE INDEX radacct_active_user_idx ON radacct (UserName, NASIPAddress, AcctSessionId) WHERE AcctStopTime IS NULL; CREATE INDEX radacct_start_user_idx ON radacct (AcctStartTime, UserName); At some point, I will revisit why these lines threw an error in sqlite, but accounting is a secondary concern right now. The primary concern is authentication, which is failing for pptpd/VPN users. I did manage to get authentication working for Squid users. I only have one record inserted into the radcheck table: [root@host ~]# sqlite3 /tmp/radius SQLite version 3.6.20 Enter ".help" for instructions Enter SQL statements terminated with a ";" sqlite> select * from radcheck; |radtestguy|Cleartext-Password|:=|radtestpw Auth, for Squid, is working beautifully here. Auth for VPN is not working, and I'm not sure why. Here's the full output of radiusd -X: [root@host ~]# radiusd -X FreeRADIUS Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct 3 2012 at 01:20:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/sqlite/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no msg_badpass = "Door is locked." msg_goodpass = "Door is unlocked. C'mon in." } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "datsecret" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "datsecret" nastype = "other" } client PUB.IP.OF.SERVER { require_message_authenticator = no secret = "datsecret" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_unixodbc" server = "" port = "" login = "" password = "" radius_db = "radius-datasource" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{Stripped-User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT, AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_update_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), '%{Acct-Session-Time}', '%{Acct-Authentic}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctStartDelay = 0, ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN (EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE NULLIF('%{Acct-Session-Time}','')::BIGINT END, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}', '%{Connect-Info}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0)" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to @:/radius-datasource rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 36456 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ===== Note the section "Module: Instantiating module "sql" from file /etc/raddb/sql.conf" where server, port, username and password are all blanked out as they are in the config. The answer involve specifying details to connect radius to the file by path, but I'm a bit lost here. I've tried turning on debug logging in rsyslog, but it doesn't provide much more in /var/log/messages than the following: Jan 27 22:37:17 host pppd[17041]: No CHAP secret found for authenticating radtestguy Jan 27 22:37:17 host pppd[17041]: Peer radtestguy failed CHAP authentication Jan 27 22:37:17 host pppd[17041]: sent [CHAP Failure id=0xae ""] Jan 27 22:37:17 host pppd[17041]: sent [LCP TermReq id=0x2 "Authentication failed"] Jan 27 22:37:17 host pppd[17041]: rcvd [LCP TermReq id=0x2 "Failed to authenticate ourselves to peer"] What other configs or sections of configs can I provide that would be helpful? Thanks in advance, Mark DeCheser

3 2