March 2015 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 119, Issue 17
by kanmongkhon buasa 04 Mar '15

04 Mar '15

http://paidvertsmoneynew.blogspot.com/ 2015-03-04 21:36 GMT+07:00 <freeradius-users-request(a)lists.freeradius.org>: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Weird issue - threads bottleneck in post-proxy section > (Alan DeKok) > 2. Re: Question about multiple sql databases! (Alan DeKok) > 3. Insert accounting data in different tables based on realm > (Francisco Amaral) > 4. Re: Question about multiple sql databases! (Haviaras Kostas) > 5. redis Module "rlm_redis" not available in Freeradius 2.2.5 ? > (tom greisch) > 6. Re: redis Module "rlm_redis" not available in Freeradius > 2.2.5 ? (Herwin Weststrate) > 7. Re: Question about multiple sql databases! (Haviaras Kostas) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 4 Mar 2015 07:54:17 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Weird issue - threads bottleneck in post-proxy section > Message-ID: <51284ED0-4211-4D88-8047-4B9CC62864E9(a)deployingradius.com> > Content-Type: text/plain; charset=windows-1252 > > On Mar 4, 2015, at 3:53 AM, RESTOUX, Loïc <loic.restoux(a)capgemini.com> > wrote: > > Do you mean that you reach 20K pps with time-consuming processing in > post-proxy ? > > I mean there’s 20K PPS with a carefully crafted configuration. So > FreeRADIUS *can* do 20Kpps proxying. > > > It's a critical point, because it means that there is something bad in > our overall environment, not in FreeRADIUS. > > Yes. There is nothing in the server which is designed to destroy > performance. The server core is designed to run as fast as possible. > > But… if you use EAP (TLS), performance drops about 90%. That’s due to > the CPU overhead of calculating the RSA keys. If you use a database, > performance drops a similar amount. Because databases have to write to > disk, and disks are slow. > > I have *never* seen the server proxy 100 pps, even with complex rules in > pre and post-proxy. So there’s something weird about your local system. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Wed, 4 Mar 2015 07:57:41 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Question about multiple sql databases! > Message-ID: <7C10500A-FCCF-4079-8B86-B54B06A8DF6A(a)deployingradius.com> > Content-Type: text/plain; charset=windows-1252 > > On Mar 4, 2015, at 2:50 AM, Haviaras Kostas <koshalirod(a)gmail.com> wrote > > I just tested, you are right, I am getting the same result! You know how > to > > solve this ??? > > Configure multiple SQL modules. One for each virtual server. > > Or, update the queries to include a “database table” field. Take that > field from a RADIUS attribute. Probably one you create yourself (see > raddb/dictionary). Then, in each virtual server, set the value of that > attribute to the correct database table. And then use the same SQL module > in all 3 virtual servers. > > Alan DeKok. > > > > > ------------------------------ > > Message: 3 > Date: Wed, 4 Mar 2015 13:07:10 +0000 > From: Francisco Amaral <famaral(a)towerstream.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Insert accounting data in different tables based on realm > Message-ID: <1425474427863.49191(a)towerstream.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > > I am trying to insert accounting data from different realms into different > tables in MySQL. I would rather not have this run on the database server as > a stored procedure, or spin up another pair of radius servers for every > realm if possible. > > > For instance I would like to: > > > insert accounting data for user(a)example.org into radiusdb.radacct > > insert accounting data for user(a)example.com into radiusdb.radaccttemp > > > Could someone point me in the right direction if this is even possible in > FreeRADIUS before I call support? It seems to me like this has probably > been done somewhere and I would not have to re-invent the wheel. > > > I have been searching quite a bit the last few days and can't find an > example. > > > Regards, > > > //F > > > Francisco Amaral > Senior Wi-Fi Networks Engineer > Phone: (866) 848-5848 x 318 > Fax: (866) 762-2250 > Mobile: (401) 862-0526 > Website: http://www.towerstream.com > towerstream > > > > ------------------------------ > > Message: 4 > Date: Wed, 4 Mar 2015 15:41:00 +0200 > From: Haviaras Kostas <koshalirod(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Question about multiple sql databases! > Message-ID: > < > CAMALVUM9-t3_AH2D1OrX8UGXHS-mfhfBFWGRKYfqZqwjaLvB7Q(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > >> I just tested, you are right, I am getting the same result! You know how > to > >> solve this ??? > > > > Configure multiple SQL modules. One for each virtual server. > > > > Or, update the queries to include a “database table” field. Take that > field from a RADIUS >attribute. Probably one you create yourself (see > raddb/dictionary). Then, in each virtual server, set > the value of that > attribute to the correct database table. And then use the same SQL module > in >all 3 virtual servers. > > > > Alan DeKok. > > Thanks for your response Alan, I have configure 3 SQL modules in the sql > file, one for each virtual server and when I am connecting to one virtual > server it is connect also to the other 2. My sql module is like this: > /etc/freeradius/mods-enabled/sql: > sql{ > } > sql fordb1{ > > } > sql fordb2{ > > } > sql fordb3{ > > } > And my virtual servers are in the /etc/freeradius/sites-enabled/server1 > server server1{ > > listen { > type = auth > ipaddr = * > port = 50002 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > > listen { > type = acct > ipaddr = * > port = 50003 > limit { > } > } > > listen { > type = auth > ipv6addr = :: > port = 50002 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > > listen { > ipv6addr = :: > port = 50003 > type = acct > limit { > } > } > > authorize { > filter_username > preprocess > chap > mschap > digest > suffix > eap { > ok = return > } > files > fordb1 > checkthetime1 > -ldap > expiration > logintime > pap > } > > authenticate{ > Auth-Type PAP { > pap > } > Auth-Type CHAP { > chap > } > Auth-Type MS-CHAP { > mschap > } > digest > eap > } > > preacct { > preprocess > acct_unique > suffix > files > } > > accounting { > detail > unix > fordb1 > exec > attr_filter.accounting_response > } > > session { > fordb1 > } > > post-auth { > fordb1 > exec > remove_reply_message_if_eap > Post-Auth-Type REJECT { > fordb1 > attr_filter.access_reject > eap > remove_reply_message_if_eap > } > } > > pre-proxy { > } > > post-proxy { > eap > } > } > And similary I have create the other 2 virtual servers. I have to configure > anything to radiusd.conf? I don't know if I am missing something here. > Thanks > > > ------------------------------ > > Message: 5 > Date: Wed, 4 Mar 2015 14:27:06 +0000 (UTC) > From: tom greisch <tom.greisch(a)yahoo.de> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: redis Module "rlm_redis" not available in Freeradius 2.2.5 ? > Message-ID: > <124032476.4603484.1425479226428.JavaMail.yahoo(a)mail.yahoo.com> > Content-Type: text/plain; charset=UTF-8 > > Hello everybody, > I try to install Freeradius on a Debian 8.0 Testmaschine.I used the > Standard Packetmanager for Installation. So i got Freeradius > 2.2.5.Authentication works against Active Directory -> everything OK > After that i wanted to use the redis Module to cache AD User Groups. So i > configured a Redis Server and the "../freeradius/modules/redis" File. > > But when i start Freeradius in debugging Mode i get the following Messages: > etc/freeradius/modules/redis[10]: Failed to link to module 'rlm_redis': > file not found > /etc/freeradius/sites-enabled/inner-tunnel[307]: Failed to find "redis" in > the "modules" section. > /etc/freeradius/sites-enabled/inner-tunnel[263]: Errors parsing post-auth > section. > > My Question is: > -Is the Redis Module (rlm_redis) not part of the standard Freeradius 2.2.5 > Installation? > > > > ------------------------------ > > Message: 6 > Date: Wed, 04 Mar 2015 15:35:42 +0100 > From: Herwin Weststrate <herwin(a)quarantainenet.nl> > To: tom greisch <tom.greisch(a)yahoo.de>, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: redis Module "rlm_redis" not available in Freeradius > 2.2.5 ? > Message-ID: <54F7183E.2030300(a)quarantainenet.nl> > Content-Type: text/plain; charset=utf-8 > > On 04-03-15 15:27, tom greisch wrote: > > Hello everybody, > > I try to install Freeradius on a Debian 8.0 Testmaschine.I used the > Standard Packetmanager for Installation. So i got Freeradius > 2.2.5.Authentication works against Active Directory -> everything OK > > After that i wanted to use the redis Module to cache AD User Groups. So > i configured a Redis Server and the "../freeradius/modules/redis" File. > > > > But when i start Freeradius in debugging Mode i get the following > Messages: > > etc/freeradius/modules/redis[10]: Failed to link to module 'rlm_redis': > file not found > > /etc/freeradius/sites-enabled/inner-tunnel[307]: Failed to find "redis" > in the "modules" section. > > /etc/freeradius/sites-enabled/inner-tunnel[263]: Errors parsing > post-auth section. > > > > My Question is: > > -Is the Redis Module (rlm_redis) not part of the standard Freeradius > 2.2.5 Installation? > > It is not listed as a stable module (src/modules/stable), which means > the Debian package doesn't include it. > > -- > Herwin Weststrate > > > ------------------------------ > > Message: 7 > Date: Wed, 4 Mar 2015 16:36:13 +0200 > From: Haviaras Kostas <koshalirod(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Question about multiple sql databases! > Message-ID: > < > CAMALVUNjCs7coV6dE_w4gZk9zMz+UorYdUSsYf12PE_D1C6OUw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > It matters if the user have the same username in the three databases?? > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 119, Issue 17 > ************************************************* >

1 0

redis Module "rlm_redis" not available in Freeradius 2.2.5 ?
by tom greisch 04 Mar '15

04 Mar '15

Hello everybody, I try to install Freeradius on a Debian 8.0 Testmaschine.I used the Standard Packetmanager for Installation. So i got Freeradius 2.2.5.Authentication works against Active Directory -> everything OK After that i wanted to use the redis Module to cache AD User Groups. So i configured a Redis Server and the "../freeradius/modules/redis" File. But when i start Freeradius in debugging Mode i get the following Messages: etc/freeradius/modules/redis[10]: Failed to link to module 'rlm_redis': file not found /etc/freeradius/sites-enabled/inner-tunnel[307]: Failed to find "redis" in the "modules" section. /etc/freeradius/sites-enabled/inner-tunnel[263]: Errors parsing post-auth section. My Question is: -Is the Redis Module (rlm_redis) not part of the standard Freeradius 2.2.5 Installation?

2 1

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

On Mar 2, 2015, at 4:39 AM, Haviaras Kostas <[hidden email] <http://freeradius.1045715.n5.nabble.com/user/SendEmail.jtp?type=node&node=5…>> wrote: > Each database is for different company! I will change to have different > username and passwords. > Then you will need different SQL queries. If you use the same SQL queries for each company, > > you will get the same response. > This isn’t really a RADIUS problem. > Alan DeKok. I just tested, you are right, I am getting the same result! You know how to solve this ??? Thanks

2 1

online users not showing in fr/mysql cli
by JAHANZAIB SYED 04 Mar '15

04 Mar '15

I have freeradius 2.2.0 with mysql DB in CENTOS 6.6. The radius is working fine, I want to pull some information via CLI to see online users by using following query. select username from radacct where acctstoptime=null; OR select username from radacct where acctstoptime=0; but it always return following TextEmpty set (0.00 sec) I have also tried this TextSELECT COUNT(*) FROM radacct WHERE username = 'username' AND acctstoptime IS NULL; +----------+ | COUNT(*) | +----------+ | 0 | +----------+ 1 row in set (0.00 sec) When I check with phpmyadmin in radius / radacct rable, I can see the radacct table with appropriate values but its not showing user with my cli. How can I troubleshoot it ? This is my radiusd -X output. =========================== FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Mar 4 2015 at 04:09:49 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sqlippool.conf including configuration file /usr/local/etc/raddb/sql/mysql/ippool.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 101.11.11.255 { require_message_authenticator = no secret = "testing123" shortname = "Mikrotik" } client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "Localhost" } client 192.168.0.3 { require_message_authenticator = no secret = "testing123" shortname = "Linux" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /usr/local/etc/raddb/users reading pairlist file /usr/local/etc/raddb/acct_users reading pairlist file /usr/local/etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radius123" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate, nasipaddress) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S', '%{NAS-IP-Address}')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_sqlippool Module: Instantiating module "sqlippool" from file /usr/local/etc/raddb/sqlippool.conf sqlippool { sql-instance-name = "sql" lease-duration = 3600 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 56177 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ======================================= Regard's Jz!

2 5

Unprintable Characters
by Adam Bishop 03 Mar '15

03 Mar '15

We have a set of NAS's that are at the end of an unreliable (GSM) connection managed by a third party. Sometimes the AuthN requests are sent to us malformed - like you'd see if the shared secret is correct, except it can't be because well formed requests are interspersed with malformed ones, seconds apart with the same source and destination servers. Unfortunately the user name is almost always intact, so the request is valid enough to be processed and, eventually lockout the afflicted user's account. While the vendor tries to fix their problem so this doesn't happen, I need to filter out the malformed requests. I can do this by writing a regex to bin any requests that contain any unprintable characters (as FreeRADIUS does using fr_utf8_char()), but before I sit down and try and figure that out is there a better way to do this? Is the check done by FreeRADIUS for unprintable characters available to unlang (or if not, would this be easy to expose)? Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 1

How to set multiple reply values via a single SQL query?
by James Wood 03 Mar '15

03 Mar '15

Hi Is there any way to set multiple reply items via a single SQL query? At the moment, I have a table called settings and within that I have a number of columns like Session-Timeout. I am having to do multiple SQL queries to pull these out, even though they are in the same table, which is both introducing time and load on the server. I am using: update reply { Session-Timeout = "%{sql:SELECT `Session-Timeout` FROM settings WHERE router_mac = \"%{Called-Station-Id}\"}" Idle-Timeout = "%{sql:SELECT `Idle-Timeout` FROM settings WHERE router_mac = \"%{Called-Station-Id}\"}" Filter-Id = "%{sql:SELECT `Filter-Id` FROM settings WHERE router_mac = \"%{Called-Station-Id}\"}" } Is there any way to do this in a single query? The SQL query above is simplified as we join some other tables in (which is why we are not just using entries in radreply) but that's a different topic. Thanks, James

4 5

Aliases in radcheck
by J Kephart 03 Mar '15

03 Mar '15

This may seem an odd question, but is there a way to create an alias in radcheck that refers to another record, similar to how DNS works? For example: user1 Cleartext-Password := testing user2 alias user1 In this way, one would be able to use /either/ username to log on, but attributes would only need to be set once, for 'user1'. Still being rather new at FR, I'm just looking to see if there are possibilities such as those. Thanks, Jim

2 2

dynamic vlan for failure authentication
by Sautron Nick 03 Mar '15

03 Mar '15

Hello everyone, I will want to know how to put a dynamic VLAN for authentication failure in the users file please? Best Regards

2 1

Problem to copy attribute Tunnel-Private-Group-ID to inner-tunnel (eap) - freeradius 3.0.7
by joaocdc＠gmail.com 02 Mar '15

02 Mar '15

Hello guys, In the last version freeradius (3.0.7), some attributes are not visible inside the inner-tunnel, like as Tunnel-Private-Group-ID, this attribute have de VLAN ID from client. Before I was using freeradius version 3.0.1 and always work fine, in 3.0.7 version this attribute is visible in default server, but it not is copied to inner-tunnel. In EAP configuration session, when I upgrade from 3.0.1 to 3.0.7, I changed the configs to: in eap module: use_tunneled_reply = no And uncomment in inner-tunnel post-auth from: update { &outer.session-state: += &reply: } and update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } In accord with documentation, this replace use_tunneled_reply = yes in 3.0.5 version In debug below we can see the missing attribute Tunnel-Private-Group-ID in EAP check, this produce de error: “ERROR: Failed retrieving values required to evaluate condition” (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) if (User-Name !~ /@/){ (8) if (User-Name !~ /@/) -> TRUE (8) if (User-Name !~ /@/) { (8) update request { (8) Realm := 'pti' (8) } # update request = noop (8) } # if (User-Name !~ /@/) = noop (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) suffix: Request already has destination realm set. Ignoring (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := 'LOCAL' (8) } # update control = noop (8) eap: Peer sent code Response (2) ID 10 length 66 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop *(8) if (Tunnel-Private-Group-ID == "5"){(8) ERROR: Failed retrieving values required to evaluate condition(8) if (Tunnel-Private-Group-ID == "81"){(8) ERROR: Failed retrieving values required to evaluate condition(8) if (Tunnel-Private-Group-ID == "62"){(8) ERROR: Failed retrieving values required to evaluate condition* (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xdf2cb347df26a950 (8) eap: Finished EAP session with state 0xdf2cb347df26a950 (8) eap: Previous EAP request found for state 0xdf2cb347df26a950, released from the list (8) eap: Peer sent method MSCHAPv2 (26) (8) eap: EAP MSCHAPv2 (26) (8) eap: Calling eap_mschapv2 to process EAP data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) eap_mschapv2: Auth-Type MS-CHAP { (8) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (8) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (8) mschap: Creating challenge hash with username: 0013006 (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (8) mschap: ERROR: MS-CHAP2-Response is incorrect (8) [mschap] = reject (8) } # Auth-Type MS-CHAP = reject (8) eap: Freeing handler (8) [eap] = reject (8) } # authenticate = reject (8) Failed to authenticate the user (8) Login incorrect (Failed retrieving values required to evaluate condition): [0013006] (from client controladora-wlan-1 port 4 cli e0-f8-47-30-8d-82 via TLS tunnel) (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) Post-Auth-Type REJECT { (8) if ( Realm == "vst" ) { (8) if ( Realm == "vst" ) -> FALSE (8) if ( Realm == "srv" ) { (8) if ( Realm == "srv" ) -> FALSE Thanks for help -- João Paulo de Lima Barbosa "Para chegar aonde a maioria não chega, você precisa fazer o que a maioria não faz."

2 5

rlm_cache NT-Password with EAP-PEAP
by Sherker, Donald 02 Mar '15

02 Mar '15

We are trying to setup a freeradius 3.0.7 server that uses EAP-PEAP and EAP-TTLS, both with MSCHAPv2. This server reads a users Cleartext-Password from an ldap server. In order to minimize the calls to the ldap server we are trying to use rlm_cache to cache the NT-Password and LM-Password so that when a user logs in after the initial log in freeradius does not need to query the ldap server. This works with EAP-TTLS, but it does not work with EAP-PEAP. The NT-Password and LM-Password do not seem to be available to the caching module with EAP-PEAP. I am pasting the parts of the config files related to this below. Please let me know if there is any other information needed. mods-enabled/cache: update { control:NT-Password := "%{control:NT-Password}" control:LM-Password := "%{control:LM-Password}" } mods-enabled/eap: eap { default_eap_type = peap ignore_unknown_eap_types = no ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } } sites-enabled/inner-tunnel: authorize { eap { ok = return } update control { Cache-Status-Only = 'yes' } cache if (notfound) { ldap } else { cache } mschap } post-auth { cache } I am also posting excerpts from the debug, again if more is needed let me know. This is for en EAP-TTLS session: Tue Feb 24 16:32:57 2015 : Debug: (7) modsingle[post-auth]: calling cache (rlm_cache) for request 7 Tue Feb 24 16:32:57 2015 : Debug: %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:32:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:32:57 2015 : Debug: attribute --> User-Name Tue Feb 24 16:32:57 2015 : Debug: attribute --> Calling-Station-Id Tue Feb 24 16:32:57 2015 : Debug: (7) cache: EXPAND %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:32:57 2015 : Debug: (7) cache: --> andyresd022be6e8229 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Mutex acquired Tue Feb 24 16:32:57 2015 : Debug: (7) cache: No cache entry found for "andyresd022be6e8229" Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Creating new cache entry Tue Feb 24 16:32:57 2015 : Debug: %{control:NT-Password} Tue Feb 24 16:32:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:32:57 2015 : Debug: attribute --> NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: EXPAND %{control:NT-Password} Tue Feb 24 16:32:57 2015 : Debug: (7) cache: --> 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: control:NT-Password := 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Merging cache entry into request Tue Feb 24 16:32:57 2015 : Debug: (7) cache: &control:NT-Password := 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: FROM 1 TO 6 MAX 7 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: Examining NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: OVERWRITING NT-Password FROM 0 TO 4 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: TO in 6 out 6 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[0] = Proxy-To-Realm Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[1] = Ldap-UserDn Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[2] = Cleartext-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[3] = Auth-Type Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[4] = NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[5] = LM-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Commited entry, TTL 86400 seconds Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Mutex released Tue Feb 24 16:32:57 2015 : Debug: (7) modsingle[post-auth]: returned from cache (rlm_cache) for request 7 Tue Feb 24 16:32:57 2015 : Debug: (7) [cache] = updated Tue Feb 24 16:32:57 2015 : Debug: (7) } # post-auth = updated Tue Feb 24 16:32:57 2015 : Debug: (7) } # server inner-tunnel This is for an EAP-PEAP Session: Tue Feb 24 16:34:57 2015 : Debug: (8) modsingle[post-auth]: calling cache (rlm_cache) for request 8 Tue Feb 24 16:34:57 2015 : Debug: %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> User-Name Tue Feb 24 16:34:57 2015 : Debug: attribute --> Calling-Station-Id Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> qaresdonE8-99-C4-72-33-D8 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Mutex acquired Tue Feb 24 16:34:57 2015 : Debug: (8) cache: No cache entry found for "qaresdonE8-99-C4-72-33-D8" Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Creating new cache entry Tue Feb 24 16:34:57 2015 : Debug: %{control:NT-Password} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{control:NT-Password} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> Tue Feb 24 16:34:57 2015 : Debug: (8) cache: control:NT-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: %{control:LM-Password} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{control:LM-Password} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> Tue Feb 24 16:34:57 2015 : Debug: (8) cache: control:LM-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Merging cache entry into request Tue Feb 24 16:34:57 2015 : Debug: (8) cache: &control:NT-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: &control:LM-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: FROM 2 TO 4 MAX 6 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: Examining NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: APPENDING NT-Password FROM 0 TO 4 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: Examining LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: APPENDING LM-Password FROM 1 TO 5 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: TO in 4 out 6 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[0] = Proxy-To-Realm Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[1] = Auth-Type Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[2] = Ldap-UserDn Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[3] = Cleartext-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[4] = NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[5] = LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Commited entry, TTL 86400 seconds Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Mutex released ________________________________ CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. **If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

4 16