- Freeradius-Users - lists.freeradius.org

too long Calling Station Ids
by Josip Rodin 03 Dec '10

03 Dec '10

Hi, Just ran across this IRL: Calling-Station-Id: GigabitEthernet 1/0/3.2045:2045#587202578###pppoe c0:d0:44:e4:cf:3b# But: Mon Nov 29 16:54:16 2010 : Error: [our_sql] Couldn't insert SQL accounting START record - ERROR: value too long for type character varying(50) The situation is actually a bit inconsistent: raddb/sql/mssql/schema.sql: [CallingStationId] [varchar] (30) DEFAULT ('') FOR [CallingStationId], raddb/sql/mysql/schema.sql: callingstationid varchar(50) NOT NULL default '', raddb/sql/postgresql/schema.sql: CallingStationId VARCHAR(50), raddb/sql/postgresql/schema.sql: CallingStationId VARCHAR(50), Is there really much point in limiting this? The specification seems to say it's a string of an arbitrary length... -- 2. That which causes joy or happiness.

5 9

freeradius + ldap
by Ana Gallardo 03 Dec '10

03 Dec '10

Hello, I'm using freeradius 2.1.10 and I want to use ldap like a backend in authorize section to take userPassword attribute (unix crypt) to authenticate the user. My problem is: the ldap server don't have public key that an admin user (who bind) can take. So I have to bind in the authorize section with the user and password (clear text) in the request. Is this posible? What are my posibilities? Here is my actual configuration in my test: LDAP MODULE ldap ldapPerson{ server = "ldap.xxxx" basedn = "ou=people,dc=unex,dc=es" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldapPerson.attrmap edir_account_policy_check = no set_auth_type = yes } SERVER server test{ authorize { suffix files ldapPerson expiration pap } authenticate { Auth-Type PAP { pap } } } DEBUG rad_recv: Access-Request packet from host X.X.X.X port 38152, id=201, length=58 User-Name = "aigallardo(a)unex.es" User-Password = "pass" server test { # Executing section authorize from file /etc/freeradius/sites-enabled/test +- entering group authorize {...} [suffix] Looking up realm "unex.es" for User-Name = "aigallardo(a)unex.es" [suffix] Found realm "unex.es" [suffix] Adding Stripped-User-Name = "aigallardo" [suffix] Adding Realm = "unex.es" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 33 ++[files] returns ok [ldapPerson] performing user authorization for aigallardo [ldapPerson] expand: %{Stripped-User-Name} -> aigallardo [ldapPerson] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=aigallardo) [ldapPerson] expand: ou=people,dc=unex,dc=es -> ou=people,dc=unex,dc=es [ldapPerson] ldap_get_conn: Checking Id: 0 [ldapPerson] ldap_get_conn: Got Id: 0 [ldapPerson] attempting LDAP reconnection [ldapPerson] (re)connect to XXXXX :389, authentication 0 [ldapPerson] bind as / to XXXX :389 [ldapPerson] waiting for bind result ... [ldapPerson] Bind was successful [ldapPerson] performing search in ou=people,dc=unex,dc=es, with filter (uid=aigallardo) [ldapPerson] No default NMAS login sequence [ldapPerson] looking for check items in directory... [ldapPerson] looking for reply items in directory... [ldapPerson] gecos -> Nombre-Completo = "Ana-Isabel Gallardo Gomez" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldapPerson] user aigallardo authorized to use remote access [ldapPerson] ldap_release_conn: Release Id: 0 ++[ldapPerson] returns ok ++[expiration] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server test Thank you very much and sorry for my eglish. ++ Ana Gallardo Gómez ++

2 7

to enlist Mac addresses
by jesus cervantes ochoa 03 Dec '10

03 Dec '10

hello: my name is jesus I am making a management settings mac address, I register a user in freeradius-server-02.01.1910 I have a ubuntu 9.10 operating system, and users to modify the plain, unformatted to register a user as follows: jesus cleartest-password: = "jesus" service-type = framed-user framed-protocol = ppp Framed-Compression = Van-Jacobsen-TCP-IP Now as you ago to enlist Mac addresses and what is the syntax or commands? Thanks ...... Jesus R. Cervantes

2 1

(no subject)
by paulina santillan mendez 03 Dec '10

03 Dec '10

what is the syntax to register a mac address on file freeradius users in the Ubuntu operating system? the error I get is: parse errror (reply) for entry 00-1E-65-9C-2C-BC Errors reading /usr/local/etc/raddb/users /usr/local/ect/raddb/modules/files[7]:Instantiation failed for module "files". /usr/local/etc/raddb/sites-enabled/inner-tunnel[124]:failed to load module "files". /usr/local/etc/raddb/sites-enabled/inner-tunnel[47]:Errors parsing authorize section.

1 0

(no subject)
by pedro eduardo aguilar garcia 03 Dec '10

03 Dec '10

How to manage customers Freeradiusd 2.10.1 Server, MAC filtering through, having an operating system Ubuntun 10?

1 0

Clear text password (radius)
by Miha Zoubek 03 Dec '10

03 Dec '10

Hello, I am trying to get radius working for voip. I am getting this error. including configuration file /etc/raddb/modules/ntlm_authincluding configuration file /etc/raddb/modules/mac2vlanincluding configuration file /etc/raddb/modules/dynamic_clientsincluding configuration file /etc/raddb/modules/inner-eapincluding configuration file /etc/raddb/modules/detail.example.comincluding configuration file /etc/raddb/modules/expirationincluding configuration file /etc/raddb/modules/unixincluding configuration file /etc/raddb/modules/exprincluding configuration file /etc/raddb/modules/policyincluding configuration file /etc/raddb/modules/sql_logincluding configuration file /etc/raddb/modules/cuiincluding configuration file /etc/raddb/modules/realmincluding configuration file /etc/raddb/modules/radutmpincluding configuration file /etc/raddb/modules/linelogincluding configuration file /etc/raddb/modules/detail.logincluding configuration file /etc/raddb/modules/attr_filterincluding configuration file /etc/raddb/modules/mschapincluding configuration file /etc/raddb/modules/attr_rewriteincluding configuration file /etc/raddb/modules/smbpasswdincluding configuration file /etc/raddb/modules/opendirectoryincluding configuration file /etc/raddb/modules/sradutmpincluding configuration file /etc/raddb/modules/logintimeincluding configuration file /etc/raddb/modules/digestincluding configuration file /etc/raddb/modules/passwdincluding configuration file /etc/raddb/modules/execincluding configuration file /etc/raddb/modules/perlincluding configuration file /etc/raddb/modules/acct_uniqueincluding configuration file /etc/raddb/modules/checkvalincluding configuration file /etc/raddb/modules/otpincluding configuration file /etc/raddb/modules/preprocessincluding configuration file /etc/raddb/modules/detailincluding configuration file /etc/raddb/modules/mac2ipincluding configuration file /etc/raddb/modules/papincluding configuration file /etc/raddb/modules/etc_groupincluding configuration file /etc/raddb/modules/smsotpincluding configuration file /etc/raddb/modules/chapincluding configuration file /etc/raddb/modules/echoincluding configuration file /etc/raddb/modules/wimaxincluding configuration file /etc/raddb/eap.confincluding configuration file /etc/raddb/sql.confincluding configuration file /etc/raddb/sql/mysql/dialup.confincluding configuration file /etc/raddb/policy.confincluding files in directory /etc/raddb/sites-enabled/including configuration file /etc/raddb/sites-enabled/inner-tunnelincluding configuration file /etc/raddb/sites-enabled/control-socketincluding configuration file /etc/raddb/sites-enabled/defaultmain { user = "radiusd" group = "radiusd" allow_core_dumps = no}including dictionary file /etc/raddb/dictionarymain { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client xxx.xxx.xxx.xxx { require_message_authenticator = no secret = "soft1234" shortname = "intraswitch" }radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } }radiusd: #### Loading Virtual Servers ####server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules} # serverserver { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "soft1234" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" }rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to root@localhost:/radiusrlm_sql (sql): starting 0rlm_sql (sql): Attempting to connect rlm_sql_mysql #0rlm_sql_mysql: Starting connect to MySQL server for #0rlm_sql (sql): Connected new DB handle, #0rlm_sql (sql): starting 1rlm_sql (sql): Attempting to connect rlm_sql_mysql #1rlm_sql_mysql: Starting connect to MySQL server for #1rlm_sql (sql): Connected new DB handle, #1rlm_sql (sql): starting 2rlm_sql (sql): Attempting to connect rlm_sql_mysql #2rlm_sql_mysql: Starting connect to MySQL server for #2rlm_sql (sql): Connected new DB handle, #2rlm_sql (sql): starting 3rlm_sql (sql): Attempting to connect rlm_sql_mysql #3rlm_sql_mysql: Starting connect to MySQL server for #3rlm_sql (sql): Connected new DB handle, #3rlm_sql (sql): starting 4rlm_sql (sql): Attempting to connect rlm_sql_mysql #4rlm_sql_mysql: Starting connect to MySQL server for #4rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules} # serverradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0}listen { type = "acct" ipaddr = * port = 0}listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" }}listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on command file /var/run/radiusd/radiusd.sockListening on authentication address 127.0.0.1 port 18120 as server inner-tunnelListening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 51738, id=152, length=206 Acct-Multi-Session-Id = "1291302052682" Cisco-Attr-130 = 0x683332332d63616c6c696e672d656e74657270726973652d69643d656e74504258 Calling-Station-Id = "81609000" NAS-Identifier = "intraswitch" NAS-IP-Address = 212.13.228.58 3GPP2-Prepaid-acct-Capability = 0x010600000002 3GPP2-Session-Termination-Capability = 1 h323-conf-id = "h323-conf-id=1291302052682" Vendor-Specific = 0x00000009 Event-Timestamp = "Dec 2 2010 16:00:52 CET" User-Name = "081609000" User-Password = "\205;m\353\177\275i\027\231\216\34158n\037\233"# Executing section authorize from file /etc/raddb/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop++[digest] returns noop[sql] expand: %{User-Name} -> 081609000[sql] sql_set_user escaped user --> '081609000'rlm_sql (sql): Reserving sql socket id: 4[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '081609000' ORDER BY id[sql] User found in radcheck table[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '081609000' ORDER BY id[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '081609000' ORDER BY priority[sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'static' ORDER BY id[sql] User found in group static[sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'static' ORDER BY idrlm_sql (sql): Released sql socket id: 4++[sql] returns ok[suffix] No '@' in User-Name = "081609000", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop++[unix] returns notfound[sql] expand: %{User-Name} -> 081609000[sql] sql_set_user escaped user --> '081609000'rlm_sql (sql): Reserving sql socket id: 3[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '081609000' ORDER BY id[sql] User found in radcheck table[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '081609000' ORDER BY id[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '081609000' ORDER BY priority[sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'static' ORDER BY id[sql] User found in group static[sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'static' ORDER BY idrlm_sql (sql): Released sql socket id: 3++[sql] returns ok++[expiration] returns noop++[logintime] returns noop++[pap] returns updatedFound Auth-Type = PAP# Executing group from file /etc/raddb/sites-enabled/default+- entering group PAP {...}[pap] login attempt with password "?;më½i???á58n??"[pap] Using CRYPT password "1234"[pap] Passwords don't match++[pap] returns rejectFailed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!Using Post-Auth-Type Reject# Executing group from file /etc/raddb/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> 081609000 attr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 0 for 1 secondsGoing to the next requestWaking up in 0.9 seconds.Sending delayed reject for request 0Sending Access-Reject of id 152 to xxx.xxx.xxx.xxx 8 port 51738Waking up in 4.9 seconds.rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 51738, id=152, length=206Sending duplicate reply to client intraswitch port 51738 - ID: 152Sending Access-Reject of id 152 to xxx.xxx.xxx.xxx port 51738Waking up in 4.9 seconds.Cleaning up request 0 ID 152 with timestamp +15Ready to process requests. Please help me! Thanks!

4 10

agent-remote-id, agent-circuit-id strange format change.
by Denis Iskandarov 03 Dec '10

03 Dec '10

Hello i'm using DHCP Option 82 with Freeradius auth. it uses several fields as username for auth: User-Name, agent-remote-id and agent-circuit-id. User-Name is mac address of cdhcp-client, and comes to radius in normal format "aa:bb:cc:dd:ee:ff" agent-remote-id and agent-circuit-id - are combination of dhcp-client mac address, vlan id, port id, slot id of dhcp relay. they should come in same normal hex format aa:bb:cc:dd:ee:ff but lil bit bit longer e.g.: Agent-Remote-Id = 0006000ded21a480 Agent-Circuit-Id = 000400020000 But they are coming in this unknow unreadable format: Agent-Remote-Id = "\000\006\000\r\355!\244\200" Agent-Circuit-Id = "\000\004\000\002\000" dictionary used is Redback with attributes 96 and 97....i've tried both octets and string format in dictionary for this attributes. How can i tell freeradius to work with this attributes in normal format ? Other way i've to enter this stupid strings in users db to authenticate user (it works like this right now). There is other commercial multi OS radius server built on perl "RADIATOR" and it works like charm with only few string in its rad.conf. (in my case it's working on WinXP, and FreeRadius main server on CentOS) here is debug output of both radius servers: FreeRadius: rad_recv: Access-Request packet from host 192.168.1.101 port 50213, id=4, length=143 NAS-Port-Type = Ethernet NAS-Port = 2210402311 Calling-Station-Id = "1:0:c:42:40:40:38" Called-Station-Id = "CLIENTS_pool1" User-Name = "00:0C:42:40:40:38" User-Password = "" *Agent-Remote-Id = "\000\006\000\r\355!\244\200" Agent-Circuit-Id = "\000\004\000\002\000"* NAS-Identifier = "R1" NAS-IP-Address = 192.168.1.101 Radiator Attributes: NAS-Port-Type = Ethernet NAS-Port = 2213543991 Calling-Station-Id = "1:0:c:42:40:40:38" Framed-IP-Address = 192.168.3.156 Called-Station-Id = "CLIENTS_pool1" User-Name = "00:0C:42:40:40:38" User-Password = <230><182><134>I<22><196><196><178>\#<8>Uq<251><162><201> * RB-Agent-Remote-Id = 0006000ded21a480 RB-Agent-Circuit-Id = 000400020000* NAS-Identifier = "R1" NAS-IP-Address = 192.168.0.22 Link on my mikrotik forum with detail wireshark sniffing: http://forum.mikrotik.com/viewtopic.php?f=2&t=47083

2 3

radsniff behaviour change?
by Brian Candler 03 Dec '10

03 Dec '10

As of 2.1.10, radsniff doesn't decode packets automatically without -x: $ sudo bin/radsniff -i lo -c 1 Access-Request Id 17 127.0.0.1:43171 -> 127.0.0.1:1812 +0.000 Attr-1 = 0x7374657665 Attr-2 = 0x98f7337df71223dc220a3a682c5f0a7f Attr-4 = 0x7f000001 Attr-5 = 0x00000001 Looking at the code, it doesn't even read the dictionary unless you add -x (debug) or -F (filter). This change was made in commit 7a85628d I wonder if this logic is unintentionally broken, and in fact you meant to load the dictionary *unless* -F is present? Regards, Brian.

2 2

configure radius to write detailed log to multiple files
by kabilius smith 02 Dec '10

02 Dec '10

Hi all, In my radiusd.conf I have the following detail { detailfile = c:/testfolder/testfile.log detailperm = 0777 } This will write the detail records to testfile.log in c:\testfolder. Is there a way to configure the radius server to write to a second log file? I tried to add another line like the following, but it didn't work. detailfile = c:/testfolder1/testfil.log Thank you, kab

4 5

Limiting user accounts for specific devices
by JARED HOOVER 02 Dec '10

02 Dec '10

We have a bunch of HP switches that we're using radius authentication on to configure. Our freeradius server is configured to grab users from an active directory server. We want to be able to only allow a single user account to be able to have rights to login to these switches so if any other account is used it should be denied access. I have to be able to pull this information from AD so that the user password can be changed quickly by someone not familiar with configuring radius. Later on we're going to use this same radius server to authenticate wireless access so it would need to be set per IP address or range only for the limits so that the other users in AD can be used for that. I'm thinking there is a way to do this in clients.conf but haven't found anything so far in my research. Here's an example client we have in our clients.conf: client 10.0.0.251 { secret = xxxxx shortname = NOC_5308 } Any help would be greatly appreciated. Thanks, Jared

3 2