- Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 80, Issue 65
by Peter Moreton 14 Dec '11

14 Dec '11

Hi Rudolf, So it can be done, that's what I wanted to know really. I appreciate that all I am going to get is dual-passwords (1 LDAP, 1 Pin) but this will lift the level of security somewhat, and make it far harder to guess simple Username/Password combinations. Thanks, Peter > Perhaps you may want delivering PIN to user's cellular over SMS. Anyway Freeradius seems not to be enough, at least you would need some external database > and web server - both for creating and storing PINs. I did the task using FR, Apache and MySql. As I see, my concept is quite similar to Nick's one. > Regards, Rudolf. *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

1 0

Request for Radius Test Client to test the following call flow
by Ratnesh Sinha 14 Dec '11

14 Dec '11

Hi, I require to simulate and test the RADIUS ACCESS_REQUEST message with PPAC, Update Reason & Service Type Parameters in the packet and ACCESS_ACCEPT with PPAQ(VQ/DQ, VT/DT). Any radius client which supports setting these two parameters and send ACCESS_REQUEST message & how to set the response ACCESS_ACCEPT with PPAQ(VQ/DQ, VT/DT). Regards, Ratnesh

2 1

semulteneius-use with cisco nas
by tolik_shavlovsky＠mail.ru 14 Dec '11

14 Dec '11

hi, i continue configuring simulteneous-use with cisco NAS. My configs: mysql> select * from radcheck; +----+------------------------------+--------------------+----+------------------------------+ | id | username | attribute | op | value | +----+------------------------------+--------------------+----+------------------------------+ | 11 | user | Cleartext-Password | := | user | | 3 | test(a)wimax.com | Cleartext-Password | := | test | | 15 | KeepAliveUserNameAndPassword | Cleartext-Password | := | KeepAliveUserNameAndPassword | | 5 | test1(a)wimax.com | Cleartext-Password | := | test | | 10 | user | Simultaneous-Use | := | 1 | | 14 | test1(a)wimax.com | Framed-Filter-Id | := | SP=data:MSF=data; | | 13 | test(a)wimax.com | Framed-Filter-Id | := | SP=data:MSF=data; | +----+------------------------------+--------------------+----+------------------------------+ clients: client 10.169.33.11/24 { # require_message_authenticator = no secret = "12345" nastype = "cisco" login = snmp password = public } snmpget works: freebsd# snmpget -v2c -c public 10.169.33.11 sysUpTime.0 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (147940948) 17 days, 2:56:49.48 debug: rad_recv: Access-Request packet from host 10.169.33.11 port 1645, id=104, length=159 User-Name = "user" Framed-MTU = 1400 Called-Station-Id = "0013.1a08.9340" Calling-Station-Id = "001b.7770.9159" Service-Type = Login-User Message-Authenticator = 0x2e82883f159c894bdd80b8ec62351994 EAP-Message = 0x020b001d19001703010012b37fc2616cb987f684d4f8af1145e855c165 NAS-Port-Type = Wireless-802.11 NAS-Port = 13431 State = 0x526a475d5a615e1a09ba39034fe381ca NAS-IP-Address = 10.169.33.11 NAS-Identifier = "ap" Thu Dec 8 17:26:25 2011 : Info: (36) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (36) group authorize { Thu Dec 8 17:26:25 2011 : Info: (36) - entering group authorize {...} Thu Dec 8 17:26:25 2011 : Info: (36) [preprocess] = ok Thu Dec 8 17:26:25 2011 : Info: (36) [chap] = noop Thu Dec 8 17:26:25 2011 : Info: (36) [mschap] = noop Thu Dec 8 17:26:25 2011 : Info: (36) [digest] = noop Thu Dec 8 17:26:25 2011 : Info: (36) suffix : No '@' in User-Name = "user", looking up realm NULL Thu Dec 8 17:26:25 2011 : Info: (36) suffix : No such realm "NULL" Thu Dec 8 17:26:25 2011 : Info: (36) [suffix] = noop Thu Dec 8 17:26:25 2011 : Info: (36) eap : EAP packet type response id 11 length 29 Thu Dec 8 17:26:25 2011 : Info: (36) eap : Continuing tunnel setup. Thu Dec 8 17:26:25 2011 : Info: (36) [eap] = ok Thu Dec 8 17:26:25 2011 : Info: (36) Found Auth-Type = ? Thu Dec 8 17:26:25 2011 : Info: (36) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (36) group authenticate { Thu Dec 8 17:26:25 2011 : Info: (36) - entering group authenticate {...} Thu Dec 8 17:26:25 2011 : Info: (36) eap : Request found, released from the list Thu Dec 8 17:26:25 2011 : Info: (36) eap : EAP/peap Thu Dec 8 17:26:25 2011 : Info: (36) eap : processing type peap Thu Dec 8 17:26:25 2011 : Info: (36) peap : processing EAP-TLS Thu Dec 8 17:26:25 2011 : Info: (36) peap : eaptls_verify returned 7 Thu Dec 8 17:26:25 2011 : Info: (36) peap : Done initial handshake Thu Dec 8 17:26:25 2011 : Info: (36) peap : eaptls_process returned 7 Thu Dec 8 17:26:25 2011 : Info: (36) peap : FR_TLS_OK Thu Dec 8 17:26:25 2011 : Info: (36) peap : Session established. Decoding tunneled attributes. Thu Dec 8 17:26:25 2011 : Info: (36) peap : Peap state phase2 Thu Dec 8 17:26:25 2011 : Info: (36) peap : EAP type mschapv2 Thu Dec 8 17:26:25 2011 : Info: (36) peap : Got tunneled request EAP-Message = 0x020b00061a03 server { Thu Dec 8 17:26:25 2011 : Info: (36) peap : Setting User-Name to user Sending tunneled request EAP-Message = 0x020b00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0xcb00ddfeca0bc7c30919b7db84ca14bd Framed-MTU = 1400 Called-Station-Id = "0013.1a08.9340" Calling-Station-Id = "001b.7770.9159" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 13431 NAS-IP-Address = 10.169.33.11 NAS-Identifier = "ap" server inner-tunnel { Thu Dec 8 17:26:25 2011 : Info: (36) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Dec 8 17:26:25 2011 : Info: (36) group authorize { Thu Dec 8 17:26:25 2011 : Info: (36) - entering group authorize {...} Thu Dec 8 17:26:25 2011 : Info: (36) [chap] = noop Thu Dec 8 17:26:25 2011 : Info: (36) [mschap] = noop Thu Dec 8 17:26:25 2011 : Info: (36) suffix : No '@' in User-Name = "user", looking up realm NULL Thu Dec 8 17:26:25 2011 : Info: (36) suffix : No such realm "NULL" Thu Dec 8 17:26:25 2011 : Info: (36) [suffix] = noop Thu Dec 8 17:26:25 2011 : Info: (36) update control { Thu Dec 8 17:26:25 2011 : Info: (36) } # update control = noop Thu Dec 8 17:26:25 2011 : Info: (36) eap : EAP packet type response id 11 length 6 Thu Dec 8 17:26:25 2011 : Info: (36) eap : EAP-MSCHAPV2 success, returning short-circuit ok Thu Dec 8 17:26:25 2011 : Info: (36) [eap] = ok Thu Dec 8 17:26:25 2011 : Info: (36) Found Auth-Type = ? Thu Dec 8 17:26:25 2011 : Info: (36) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Dec 8 17:26:25 2011 : Info: (36) group authenticate { Thu Dec 8 17:26:25 2011 : Info: (36) - entering group authenticate {...} Thu Dec 8 17:26:25 2011 : Info: (36) eap : Request found, released from the list Thu Dec 8 17:26:25 2011 : Info: (36) eap : EAP/mschapv2 Thu Dec 8 17:26:25 2011 : Info: (36) eap : processing type mschapv2 Thu Dec 8 17:26:25 2011 : Info: (36) eap : Freeing handler Thu Dec 8 17:26:25 2011 : Info: (36) [eap] = ok Thu Dec 8 17:26:25 2011 : Auth: (36) Login OK: [user/<via Auth-Type = ?>] (from client 10.169.33.11/24 port 13431 cli 001b.7770.9159 via TLS tunnel) Thu Dec 8 17:26:25 2011 : Info: (36) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Dec 8 17:26:25 2011 : Info: (36) group post-auth { Thu Dec 8 17:26:25 2011 : Info: (36) - entering group post-auth {...} Thu Dec 8 17:26:25 2011 : Info: (36) sql : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (36) sql : sql_set_user escaped user --> 'user' Thu Dec 8 17:26:25 2011 : Info: (36) sql : expand: %{User-Password} -> Thu Dec 8 17:26:25 2011 : Info: (36) sql : ... expanding second conditional Thu Dec 8 17:26:25 2011 : Info: (36) sql : expand: %{Chap-Password} -> Thu Dec 8 17:26:25 2011 : Info: (36) sql : expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user', '', 'Access-Accept', '2011-12-08 17:26:25') Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user', '', 'Access-Accept', '2011-12-08 17:26:25') Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql): Reserved connection (12) Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql): Released connection (12) Thu Dec 8 17:26:25 2011 : Info: (36) [sql] = ok Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : Processing sql_log_postauth Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : expand: %{%{User-Name}:-DEFAULT} -> user Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : sql_set_user escaped user --> 'user' Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : ... expanding second conditional Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : expand: Chap-Password -> Chap-Password Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('user', 'Chap-Password', 'Access-Accept', '2011-12-08 17:26:25'); Thu Dec 8 17:26:25 2011 : Info: (36) sql_log : expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay Thu Dec 8 17:26:25 2011 : Info: (36) [sql_log] = ok } # server inner-tunnel Thu Dec 8 17:26:25 2011 : Info: (36) peap : Got tunneled reply code 2 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed MS-MPPE-Send-Key = 0x4b950af2af95357660e7b7cd0d70c4ee MS-MPPE-Recv-Key = 0xe041e091013829024563e0c64a2a8b3e EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Thu Dec 8 17:26:25 2011 : Info: (36) peap : Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed MS-MPPE-Send-Key = 0x4b950af2af95357660e7b7cd0d70c4ee MS-MPPE-Recv-Key = 0xe041e091013829024563e0c64a2a8b3e EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Thu Dec 8 17:26:25 2011 : Info: (36) peap : Tunneled authentication was successful. Thu Dec 8 17:26:25 2011 : Info: (36) peap : SUCCESS Thu Dec 8 17:26:25 2011 : Info: (36) peap : Saving tunneled attributes for later Thu Dec 8 17:26:25 2011 : Info: (36) [eap] = handled Sending Access-Challenge of id 104 to 10.169.33.11 port 1645 EAP-Message = 0x010c00261900170301001b6149c2683fad2144473d4eb64a84d8bb311c1da55a06ac23ef2f1c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x526a475d5b665e1a09ba39034fe381ca Thu Dec 8 17:26:25 2011 : Info: (36) Finished request 36. rad_recv: Access-Request packet from host 10.169.33.11 port 1645, id=105, length=168 User-Name = "user" Framed-MTU = 1400 Called-Station-Id = "0013.1a08.9340" Calling-Station-Id = "001b.7770.9159" Service-Type = Login-User Message-Authenticator = 0xf57cb17ca4c07354856cdc1443089a6a EAP-Message = 0x020c00261900170301001befdfaf794c7809b50b1718d07d1b237ae93b9c5c6c9a330aa0202c NAS-Port-Type = Wireless-802.11 NAS-Port = 13431 State = 0x526a475d5b665e1a09ba39034fe381ca NAS-IP-Address = 10.169.33.11 NAS-Identifier = "ap" Thu Dec 8 17:26:25 2011 : Info: (37) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (37) group authorize { Thu Dec 8 17:26:25 2011 : Info: (37) - entering group authorize {...} Thu Dec 8 17:26:25 2011 : Info: (37) [preprocess] = ok Thu Dec 8 17:26:25 2011 : Info: (37) [chap] = noop Thu Dec 8 17:26:25 2011 : Info: (37) [mschap] = noop Thu Dec 8 17:26:25 2011 : Info: (37) [digest] = noop Thu Dec 8 17:26:25 2011 : Info: (37) suffix : No '@' in User-Name = "user", looking up realm NULL Thu Dec 8 17:26:25 2011 : Info: (37) suffix : No such realm "NULL" Thu Dec 8 17:26:25 2011 : Info: (37) [suffix] = noop Thu Dec 8 17:26:25 2011 : Info: (37) eap : EAP packet type response id 12 length 38 Thu Dec 8 17:26:25 2011 : Info: (37) eap : Continuing tunnel setup. Thu Dec 8 17:26:25 2011 : Info: (37) [eap] = ok Thu Dec 8 17:26:25 2011 : Info: (37) Found Auth-Type = ? Thu Dec 8 17:26:25 2011 : Info: (37) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (37) group authenticate { Thu Dec 8 17:26:25 2011 : Info: (37) - entering group authenticate {...} Thu Dec 8 17:26:25 2011 : Info: (37) eap : Request found, released from the list Thu Dec 8 17:26:25 2011 : Info: (37) eap : EAP/peap Thu Dec 8 17:26:25 2011 : Info: (37) eap : processing type peap Thu Dec 8 17:26:25 2011 : Info: (37) peap : processing EAP-TLS Thu Dec 8 17:26:25 2011 : Info: (37) peap : eaptls_verify returned 7 Thu Dec 8 17:26:25 2011 : Info: (37) peap : Done initial handshake Thu Dec 8 17:26:25 2011 : Info: (37) peap : eaptls_process returned 7 Thu Dec 8 17:26:25 2011 : Info: (37) peap : FR_TLS_OK Thu Dec 8 17:26:25 2011 : Info: (37) peap : Session established. Decoding tunneled attributes. Thu Dec 8 17:26:25 2011 : Info: (37) peap : Peap state send tlv success Thu Dec 8 17:26:25 2011 : Info: (37) peap : Received EAP-TLV response. Thu Dec 8 17:26:25 2011 : Info: (37) peap : Success Thu Dec 8 17:26:25 2011 : Info: (37) peap : Using saved attributes from the original Access-Accept User-Name = "user" Thu Dec 8 17:26:25 2011 : Info: (37) eap : Freeing handler Thu Dec 8 17:26:25 2011 : Info: (37) [eap] = ok Thu Dec 8 17:26:25 2011 : Auth: (37) Login OK: [user/<via Auth-Type = ?>] (from client 10.169.33.11/24 port 13431 cli 001b.7770.9159) Thu Dec 8 17:26:25 2011 : Info: (37) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (37) group post-auth { Thu Dec 8 17:26:25 2011 : Info: (37) - entering group post-auth {...} Thu Dec 8 17:26:25 2011 : Info: (37) sql : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (37) sql : sql_set_user escaped user --> 'user' Thu Dec 8 17:26:25 2011 : Info: (37) sql : expand: %{User-Password} -> Thu Dec 8 17:26:25 2011 : Info: (37) sql : ... expanding second conditional Thu Dec 8 17:26:25 2011 : Info: (37) sql : expand: %{Chap-Password} -> Thu Dec 8 17:26:25 2011 : Info: (37) sql : expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user', '', 'Access-Accept', '2011-12-08 17:26:25') Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user', '', 'Access-Accept', '2011-12-08 17:26:25') Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql): Reserved connection (12) Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql): Released connection (12) Thu Dec 8 17:26:25 2011 : Info: (37) [sql] = ok Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : Processing sql_log_postauth Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : expand: %{%{User-Name}:-DEFAULT} -> user Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : sql_set_user escaped user --> 'user' Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : ... expanding second conditional Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : expand: Chap-Password -> Chap-Password Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('user', 'Chap-Password', 'Access-Accept', '2011-12-08 17:26:25'); Thu Dec 8 17:26:25 2011 : Info: (37) sql_log : expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay Thu Dec 8 17:26:25 2011 : Info: (37) [sql_log] = ok Thu Dec 8 17:26:25 2011 : Info: (37) [exec] = noop Thu Dec 8 17:26:25 2011 : Info: (37) policy remove_reply_message_if_eap { Thu Dec 8 17:26:25 2011 : Info: (37) - entering policy remove_reply_message_if_eap {...} Thu Dec 8 17:26:25 2011 : Info: (37) ? if (reply:EAP-Message && reply:Reply-Message) Thu Dec 8 17:26:25 2011 : Info: (37) ? Evaluating (reply:EAP-Message ) -> TRUE Thu Dec 8 17:26:25 2011 : Info: (37) ? Evaluating (reply:Reply-Message) -> FALSE Thu Dec 8 17:26:25 2011 : Info: (37) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Thu Dec 8 17:26:25 2011 : Info: (37) else else { Thu Dec 8 17:26:25 2011 : Info: (37) - entering else else {...} Thu Dec 8 17:26:25 2011 : Info: (37) [noop] = noop Thu Dec 8 17:26:25 2011 : Info: (37) - else else returns noop Thu Dec 8 17:26:25 2011 : Info: (37) - policy remove_reply_message_if_eap returns noop Sending Access-Accept of id 105 to 10.169.33.11 port 1645 User-Name = "user" MS-MPPE-Recv-Key = 0xb6ad8feb9e726faf3476818bb97ba4617babe493ae3317f8f51d5fe7560d676b MS-MPPE-Send-Key = 0x1b7714f349209231ebf5846bdb4b41398434d9e013c6ea05b162b9a8220eef32 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 8 17:26:25 2011 : Info: (37) Finished request 37. rad_recv: Accounting-Request packet from host 10.169.33.11 port 1646, id=172, length=224 Acct-Session-Id = "000033C8" Called-Station-Id = "0013.1a08.9340" Calling-Station-Id = "001b.7770.9159" Cisco-AVPair = "ssid=HAYATT" Cisco-AVPair = "vlan-id=55" Cisco-AVPair = "nas-location=unspecified" User-Name = "user" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "13431" NAS-Port = 13431 Service-Type = Framed-User NAS-IP-Address = 10.169.33.11 Acct-Delay-Time = 0 Thu Dec 8 17:26:25 2011 : Info: (38) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (38) group preacct { Thu Dec 8 17:26:25 2011 : Info: (38) - entering group preacct {...} Thu Dec 8 17:26:25 2011 : Info: (38) [preprocess] = ok Thu Dec 8 17:26:25 2011 : Info: (38) policy acct_unique { Thu Dec 8 17:26:25 2011 : Info: (38) - entering policy acct_unique {...} Thu Dec 8 17:26:25 2011 : Info: (38) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) Thu Dec 8 17:26:25 2011 : Info: (38) expand: %{string:Class} -> Thu Dec 8 17:26:25 2011 : Info: (38) ? Evaluating ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE Thu Dec 8 17:26:25 2011 : Info: (38) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE Thu Dec 8 17:26:25 2011 : Info: (38) else else { Thu Dec 8 17:26:25 2011 : Info: (38) - entering else else {...} Thu Dec 8 17:26:25 2011 : Info: (38) update request { Thu Dec 8 17:26:25 2011 : Info: (38) expand: %{User-Name}%{Acct-Session-ID}%{NAS-IP-Address}%{NAS-Port-ID:}%{NAS-Port} -> user000033C810.169.33.1113431 Thu Dec 8 17:26:25 2011 : Info: (38) expand: %{md5:%{User-Name}%{Acct-Session-ID}%{NAS-IP-Address}%{NAS-Port-ID:}%{NAS-Port}} -> df4dee5fb72121b17bd275a4d64782c6 Thu Dec 8 17:26:25 2011 : Info: (38) } # update request = ok Thu Dec 8 17:26:25 2011 : Info: (38) - else else returns ok Thu Dec 8 17:26:25 2011 : Info: (38) - policy acct_unique returns ok Thu Dec 8 17:26:25 2011 : Info: (38) suffix : No '@' in User-Name = "user", looking up realm NULL Thu Dec 8 17:26:25 2011 : Info: (38) suffix : No such realm "NULL" Thu Dec 8 17:26:25 2011 : Info: (38) [suffix] = noop Thu Dec 8 17:26:25 2011 : Info: (38) [files] = noop Thu Dec 8 17:26:25 2011 : Info: (38) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default Thu Dec 8 17:26:25 2011 : Info: (38) group accounting { Thu Dec 8 17:26:25 2011 : Info: (38) - entering group accounting {...} Thu Dec 8 17:26:25 2011 : Info: (38) detail : expand: %{Packet-Src-IP-Address} -> 10.169.33.11 Thu Dec 8 17:26:25 2011 : Info: (38) detail : expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.169.33.11/detail-20111208 Thu Dec 8 17:26:25 2011 : Info: (38) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.169.33.11/detail-20111208 Thu Dec 8 17:26:25 2011 : Info: (38) detail : expand: %t -> Thu Dec 8 17:26:25 2011 Thu Dec 8 17:26:25 2011 : Info: (38) [detail] = ok Thu Dec 8 17:26:25 2011 : Info: (38) [unix] = ok Thu Dec 8 17:26:25 2011 : Info: (38) radutmp : expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp Thu Dec 8 17:26:25 2011 : Info: (38) radutmp : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (38) [radutmp] = ok Thu Dec 8 17:26:25 2011 : Info: (38) sql : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (38) sql : sql_set_user escaped user --> 'user' Thu Dec 8 17:26:25 2011 : Info: (38) sql : expand: %{Acct-Delay-Time} -> 0 Thu Dec 8 17:26:25 2011 : Info: (38) sql : expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('000033C8', 'df4dee5fb72121b17bd275a4d64782c6', 'user', '', '10.169.33.11', '13431', 'Wireless-802.11', '2011-12-08 17:26:25', NULL, '0', 'RADIUS', '', '', '0', '0', '0013.1a08.9340', '001b.7770.9159', '', 'Framed-User', '', '', '0', '0', '') Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql): Reserved connection (12) Thu Dec 8 17:26:25 2011 : Debug: rlm_sql (sql): Released connection (12) Thu Dec 8 17:26:25 2011 : Info: (38) [sql] = ok Thu Dec 8 17:26:25 2011 : Info: (38) sql_log : Processing sql_log_accounting Thu Dec 8 17:26:25 2011 : Info: (38) sql_log : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (38) sql_log : expand: %{%{User-Name}:-DEFAULT} -> user Thu Dec 8 17:26:25 2011 : Info: (38) sql_log : sql_set_user escaped user --> 'user' Thu Dec 8 17:26:25 2011 : Info: (38) sql_log : expand: INSERT INTO radacct (AcctSessionId, UserName, NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctTerminateCause) VALUES ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', '%{Framed-IP-Address}', '%S', '0', '0', ''); -> INSERT INTO radacct (AcctSessionId, UserName, NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctTerminateCause) VALUES ('000033C8', 'user', '10.169.33.11', '', '2011-12-08 17:26:25', '0', '0', ''); Thu Dec 8 17:26:25 2011 : Info: (38) sql_log : expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay Thu Dec 8 17:26:25 2011 : Info: (38) [sql_log] = ok Thu Dec 8 17:26:25 2011 : Info: (38) [exec] = noop Thu Dec 8 17:26:25 2011 : Info: (38) attr_filter.accounting_response : expand: %{User-Name} -> user Thu Dec 8 17:26:25 2011 : Info: (38) attr_filter.accounting_response : Matched entry DEFAULT at line 12 Thu Dec 8 17:26:25 2011 : Info: (38) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 172 to 10.169.33.11 port 1646 Thu Dec 8 17:26:25 2011 : Info: (38) Finished request 38. Thu Dec 8 17:26:26 2011 : Debug: Waking up in 0.2 seconds. Thu Dec 8 17:26:26 2011 : Info: (38) Cleaning up request packet ID 172 with timestamp +765 Thu Dec 8 17:26:26 2011 : Debug: Waking up in 3.9 seconds. Thu Dec 8 17:26:30 2011 : Info: (27) Cleaning up request packet ID 95 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (28) Cleaning up request packet ID 96 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (29) Cleaning up request packet ID 97 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (30) Cleaning up request packet ID 98 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (31) Cleaning up request packet ID 99 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (32) Cleaning up request packet ID 100 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (33) Cleaning up request packet ID 101 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (34) Cleaning up request packet ID 102 with timestamp +765 Thu Dec 8 17:26:30 2011 : Debug: Waking up in 0.3 seconds. Thu Dec 8 17:26:30 2011 : Info: (35) Cleaning up request packet ID 103 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: (36) Cleaning up request packet ID 104 with timestamp +765 Thu Dec 8 17:26:30 2011 : Debug: Waking up in 0.2 seconds. Thu Dec 8 17:26:30 2011 : Info: (37) Cleaning up request packet ID 105 with timestamp +765 Thu Dec 8 17:26:30 2011 : Info: Ready to process requests. freebsd# radwho Login Name What TTY When From Location user user shell >999 Thu 14:38 10.169.33.11 user user shell >999 Thu 15:03 10.169.33.11 user user shell >999 Thu 17:25 10.169.33.11 user user shell >999 Thu 17:26 10.169.33.11 what can be an issue? thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/semulteneius-use-with-cisco-nas-tp5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 16

Re: Accounting-Response dependence
by Alan Buxey 14 Dec '11

14 Dec '11

So what us your decoupled accounting using? alan -- Message may be brief as it has been sent from my mobile

1 0

Re: Re[6]: semulteneius-use with cisco nas
by Alan Buxey 14 Dec '11

14 Dec '11

'..but it doesn't work' This is a meaningless statement without providing this list the important thing to help you with, ie the output of 'radius -X' - to show what happens when 1 client connects and then tries to connect simultaneously. There is really no point in just saying you've done xyz and it doesn't work.... alan -- Message may be brief as it has been sent from my mobile

1 0

Accounting-Response dependence
by RudolfSusnik 14 Dec '11

14 Dec '11

Hello, I have freeradius 2.1.12 installed on 64bit CentOS. Radius-Accounting messages are logged on MySql (I call mysql procedure to write into the table). When execution of mysql procedure takes a while, accounting-response is delayed to accounting-request according to the procedure execution delay. When MySQL goes down, accounting-response is sent immediately. Is it possible to configure accounting in such way that there actually would be no accounting-response in case MySQL fails? Regards, Rudolf. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Accounting-Response-dependence-tp50… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 8

Query regarding redundant module and configurable failover codes
by Shweta Khadse 13 Dec '11

13 Dec '11

Dears I have a question regarding the configurable failover codes. Our accounting module is defined as follows Detail… Detail_hour_ae1 … … Redundant{ Sql2 { Fail=1 … … } Sql2_redundant { Fail= return … … } *Sql_update_xxxx* * * *Sql_update_yyyy* } The last two sql updates ie *"Sql_update_xxxx" and **"Sql_update_yyyy" *do not have a redundant module defined. The actions of these statement is not very critical. However we observe that if the radius is unable to execute these the radius drops the session and returns a FAIL. One way to avoid this session disconnection is to implement a redundant module for the last two statements as well. We are looking at a possibility of this second solution. And require help in this regard. If we modify our configuration to something like this Redundant{ Sql{ Ok=2 } Sql2 { Ok=3 } } Group{ * Sql_update_xxxx* * * * Sql_update_yyyy* … Fail =1 } } *Ok will override Fail because the priority is higher.* * * *So the accounting module will not return failure because of the third module (atleast in theory).* Does anyone have a solution/suggestions for this kind of a problem. Thanks & Regards Shweta

3 10

Wired 802.1X + FreeRADIUS + LDAP issue
by Ryan Garland 13 Dec '11

13 Dec '11

Hi all, I have been tasked with implementing 802.1X for our office wireless & wired connectivity - wireless through an Aruba AP, wired through a Dell PowerConnect 6200 switch - by using FreeRADIUS (2.1.12) and our backend LDAP server (Open DS). FreeRADIUS is running on Ubuntu 10.04. * Wireless 802.1X auth is working properly (verified on both OS X and Win 7) using TTLS+PAP - debug output attached for reference. * Wired 802.1X auth is not working, and I am not sure why. This is where I am hoping to be pointed in the right direction - debug output attached for this as well. For wireless, my supplicant (laptop running OS X Lion) has an 802.1X profile configured (tried with and without the FreeRADIUS server's ca certificate (ca.der)), connects to the Aruba, gets prompted for login/password, the credentials pass auth with LDAP, a certificate gets installed in my Keychain, and network access is granted. Yay! For wired, I have the same 802.1X profile configured, the laptop connects to the switch, EAP begins, the Access-Challenge gets returned, but there is seemingly no further communication done. (It has been confirmed using tcpdump that the supplicant is receiving the response from FreeRADIUS.) I get a Warning message from FreeRADIUS indicating that EAP did not complete. The message directs me to a Certificate Compatibility page on the FR wiki, but unfortunately that points a lot of fingers at Windows, which my laptop is not running. We have also tried creating the certs with the bootstrap program and modifying eap.conf accordingly, to no avail. For reference, eapol_test also fails in the same manner when running locally on the FreeRADIUS box. I am sure I am missing something - probably something simple - but I just have not been able to figure it out, and I am clearly not very good at reading the debug output. :-( I have been researching this for quite some time and have found a lot of helpful information from people on this list, so I hope somebody can help me pinpoint the issue. My apologies if I was too wordy. Any help is greatly appreciated. -- RG

3 6

SQL - inserting yearmonth variable
by Steven Staples 12 Dec '11

12 Dec '11

Good morning list.. I am trying to insert a YEAR and MONTH into my sql table. I have in the past, used a stored procedure for the accounting start/stop, which worked well. >From what I see, %S will give me a current timestamp, but how can I get/extract the year and month from this? Or is there an easier way to do this... I tried adding: Yearmonth = $(date +%Y%m) As a variable, and then putting it into the sql query like: accounting_start_query = "INSERT INTO ...<snip>'${Yearmonth}' But that didn't work. Could someone please help me with getting a year & month variable set? THANKS!!! Steve

2 1

Testing LDAP server return code?
by John Doppke 12 Dec '11

12 Dec '11

Is there a way to test the return code or message from the LDAP server so a different reply-message can be sent on "server is unwilling to perform"? thanks, -John

2 1