- Freeradius-Users - lists.freeradius.org

Update warning
by Maurice James 05 Nov '10

05 Nov '10

If you update from FreeRadius 2.1.9x to 2.1.10x your server might fail to start if the sample virtual server in the proxy.conf file is uncommented. I learned that the hard way Description: MCITP(rgb)_1084_1085 Description: https://exams.giac.org/images/logos/giac_silver_small.gif GIAC Security Leadership Certification (GSLC)

1 0

Idle-Timeout problem
by michel＠casa.co.cu 05 Nov '10

05 Nov '10

Hi I currently work with freeradius version 2.1.7, my users are in mysql. mysql> SELECT * FROM `radusergroup`; +----------------+----------------+----------+ | username | groupname | priority | +----------------+----------------+----------+ | joseph | Desarrollo | 1 | | carlos | Desarrollo | 1 | | miguel | Admins | 1 | +--------------------------------------------+ My problem is that users are being disconnected before the time indicated by parameter "Idle-Timeout." mysql> SELECT * FROM `radgroupreply` ; +----+----------------+--------------------+----+---------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+---------------------+ | 1 | Desarrollo | Service-Type | = | Framed-User | | 2 | Desarrollo | Framed-Protocol | = | PPP | | 3 | Desarrollo | Framed-MTU | = | 1500 | | 4 | Desarrollo | Framed-Compression | = | Van-Jacobsen-TCP-IP | | 5 | Desarrollo | Framed-IP-Netmask | = | 255.255.255.0 | | 6 | Desarrollo | Idle-Timeout | := | 900 | | 7 | Admins | Service-Type | = | Framed-User | | 8 | Admins | Framed-Protocol | = | PPP | | 9 | Admins | Framed-MTU | = | 1500 | | 10 | Admins | Framed-Compression | = | Van-Jacobsen-TCP-IP | | 11 | Admins | Framed-IP-Netmask | = | 255.255.255.0 | | 12 | Admins | Idle-Timeout | := | 0 | +----+----------------+--------------------+----+---------------------+ As you can see here he is sending the access server parameters defined above in the database. Sending Access-Accept of id 246 to 172.19.19.50 port 17979 Service-Type = Framed-User Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Netmask = 255.255.255.0 Idle-Timeout := 900 And here you can see the user disconnected prematurely rad_recv: Accounting-Request packet from host 172.19.19.10 port 17979, id=197, length=170 NAS-IP-Address = 172.19.19.10 NAS-Identifier = "Access Server" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 10.71.53.214 User-Name = "carlos" NAS-Port = 447 NAS-Port-Type = Async Called-Station-Id = "60110" Calling-Station-Id = "78382547" Acct-Status-Type = Stop Acct-Session-Id = "0130000425" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Acct-Input-Octets = 47429 Acct-Output-Octets = 4377 Acct-Input-Packets = 66 Acct-Output-Packets = 57 Acct-Session-Time = 95 Acct-Terminate-Cause = Idle-Timeout Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

1 0

Re: Counter SQL Calculation
by Neville 04 Nov '10

04 Nov '10

Can anyone please help on this as I've googled as cannot find a solution to the issue I've outlined below. Thx Nev > Hi Everyone, > > Here is some Debug if anyone can help explain or correct the > [monthlytraffic] Counter calculation. > > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: SELECT > IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE > username='%{User-Name}' AND Month(acctstoptime) =(Month(NOW())) AND > Year(acctstoptime) = Year(NOW()) -> SELECT > IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE > username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND > Year(acctstoptime) = Year(NOW()) > Sat Oct 30 22:39:39 2010 : Debug: sqlcounter_expand: '%{sql:SELECT > IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE > username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND > Year(acctstoptime) = Year(NOW())}' > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] sql_xlat > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: > %{User-Name} -> FTU-GzwgcD > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] sql_set_user escaped > user --> 'FTU-GzwgcD' > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: SELECT > IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE > username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND > Year(acctstoptime) = Year(NOW()) -> SELECT > IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE > username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND > Year(acctstoptime) = Year(NOW()) > Sat Oct 30 22:39:39 2010 : Debug: rlm_sql (sql): Reserving sql socket id: > 4 > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] sql_xlat finished > Sat Oct 30 22:39:39 2010 : Debug: rlm_sql (sql): Released sql socket id: 4 > Sat Oct 30 22:39:39 2010 : Info: [monthlytraffic] expand: > %{sql:SELECT > IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct WHERE > username='FTU-GzwgcD' AND Month(acctstoptime) =(Month(NOW())) AND > Year(acctstoptime) = Year(NOW())} -> 991187 > Sat Oct 30 22:39:39 2010 : Debug: rlm_sqlcounter: Check item is greater > than > query result > Sat Oct 30 22:39:39 2010 : Debug: rlm_sqlcounter: Authorized user > FTU-GzwgcD, check_item=262100000, counter=991187 > Sat Oct 30 22:39:39 2010 : Debug: rlm_sqlcounter: Sent Reply-Item for user > FTU-GzwgcD, Type=Session-Octets-Limit, value=262191221 > Sat Oct 30 22:39:39 2010 : Info: ++[monthlytraffic] returns ok > > > The Important bit is that the counter returns 991187, but then the > Reply-Item "Session-Octets-Limit" is set to 262191221, which is actually > an > INCREASE of 91221, how is this calculation CORRECT? > > Thx > Nev > > >> >>> Hi everyone, >>> >>> I have a small problem where the counter is not working how I would like >>> it two work. >>> >>> sqlcounter monthlytraffic { >>> counter-name = Monthly-Traffic >>> check-name = Max-Monthly-Traffic >>> reply-name = Session-Octets-Limit >>> sqlmod-inst = sql >>> key = User-Name >>> reset = monthly >>> query = "SELECT >>> IFNULL((sum(acctinputoctets)+sum(acctoutputoctets)),0) FROM radacct >>> WHERE >>> username='%{%k}' AND Month(acctstoptime) =(Month(NOW())) AND >>> Year(acctstoptime) = Year(NOW())" >>> } >>> >>> The problem with this, is that it the SELECT statement returns a value >>> Less than the value of Max-Monthly-Traffic, then sets >>> Session-Octets-Limit is set to equal Max-Monthly-Traffic. >>> >>> What I need it to do is to populate Session-Octets-Limit with the VALUE >>> of Max-Monthly-Traffic, then subtract the VALUE of the Select Statement. >>> >>> E.G. if Max-Monthy-Traffic is set to 250Mb or 262100000, and the SELECT >>> returns a result of 52430000 being 50Mb of usage, then >>> Session-Octets-Limit should be set to 262100000 - 5230000 being >>> 256870000 >>> >>> Can anyone point in the right direction on this please. >>> >>> Thx >>> Nev >>

1 0

proxy.conf src_ipaddr ignored
by Edgar Fuß 04 Nov '10

04 Nov '10

I've a strange problem with proxying working perfectly in debugging mode, but not in production mode. I tracked this down to the src_ipaddr setting in proxy.conf apperantly being ignored depending on command-line options. Option settings that do work include: -sfxx -l stdout -sfx -l stdout Option settings that don't work include: -sf -l stdout -sfxx Is this a known issue in 2.1.7? Am I going mad? I found that the other issue I ran into (server not starting up properly if multiple home server sections included a src_ipaddr setting) was fixed in 2.1.10, but I couldn't find anything about the issue I'm facing now.

2 8

Restrict certain users to certain clients
by inetjunkmail 04 Nov '10

04 Nov '10

I have clients multiple clients on the following networks: 192.168.89.0/24 192.168.90.0/24 192.168.91.0/24 I have two users: test1 test2 I would like to grant test1 access to clients on 192.168.89.0/24 and 192.168.90.0/24 but not 192.168.91.0/24. I would like to grant test2 access to clients on 192.168.91.0/24 but not 192.168.89.0/24 nor 192.168.90.0/24. I've solved it with huntgroups with individual client IP's but I need to do it by subnet. I thought the following would work but it didn't. /etc/raddb/huntgroups hunt1 NAS-IP-Address =~ /^192\.168\.(89|90|91)\..*$/ Can anyone provide some direction? Thanks

1 1

Re: PEAP/TTLS and Client certificates
by rdeboer 04 Nov '10

04 Nov '10

I'm using the Juniper Odyssey Access Client, you can download a trial from the Juniper website. So far it's the only supplicant I've come across that allows for PEAP or TTLS with client certificates. Drawback being you have to buy licenses for each instance of it running inside the company, which undoubtedly is going to cost a fortune. So if anyone out there has any idea of a free open source solution I'm game... About the perl module, I'll start looking into that, thanks for the tip. -- View this message in context: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

which user is using this IP? (Ethernet, no dial-up)
by Guido De Rosa 04 Nov '10

04 Nov '10

[Apparently the usenet gateway is not bidirectional, so I re-post here, sorry] Hello, AFAIK, there's nothing in the RADIUS protocol allowing you to ask a RADIUS server which user is currently using a given IP address... or am I missing something? The only thing you can do is FreeRADIUS-specific like issuing the "radwho" command which shows you a list of currently logged users, their IP addresses and other informations. Another option is querying the FreeRADIUS database (MySQL/whatever...), which is actually what some front-ends do (like DaloRADIUS...). Do you know a more robust/standard/portable solution to get these info? To clarify my question I will explain why I need this. I'm configuring DansGuardian web content filtering (http://dansguardian.org) which has the possibility to configure several "filter groups" each with different filtering rules. I would like to match filter groups by RADIUS login but since this is not implemented I'm willing to contribute some code to the project, and here I need to clarify some technical details. The programmatic counterpart of running radwho should be reading /var/log/freeradius/radutmp, which is simply the serialization of a C struct, as I read here: http://goo.gl/Rq1c7 http://goo.gl/BSvAn http://goo.gl/erLtw Would be this one the correct approach? Any suggestion? Thanks! Guido De Rosa P.S. the matching thread in the DG mailing list is: http://tech.groups.yahoo.com/group/dansguardian/message/24488

3 4

EAP-PEAP/MSCHAPv2 Proxy
by Влад Власов 04 Nov '10

04 Nov '10

Hello everyone, Please help me I try to setup FreeRadius as proxy. I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another radius server ,that does not work with a EAP-PEAP. changed only the following items: clients.conf client 172.100.100.24/30 { secret = secretpass shortname = AP_50 } proxy.conf realm nc { authhost = 172.10.10.1:1812 accthost = 172.10.10.1:1813 secret = secretpass } realm DEFAULT { authhost = 172.10.10.1:1812 accthost = 172.10.10.1:1813 secret = secretpass } eap.conf default_eap_type = peap default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no Result: Ready to process requests. rad_recv: Access-Request packet from host 172.100.50.24 port 1041, id=0, length=165 NAS-IP-Address = 172.100.50.24 NAS-Port = 1 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = Authenticate-Only Called-Station-Id = "00-18-25-10-2b-20:SOME" Calling-Station-Id = "0c-60-76-7c-af-d0" NAS-Port-Id = "0c-60-76-7c-af-d0" User-Name = "testuser@nc" EAP-Message = 0x020000120174612d32323331313236406e63 Message-Authenticator = 0x0d82a782af2e0cc67d993968ef2b793c # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "nc" for User-Name = "testuser@nc" [suffix] Found realm "nc" [suffix] Adding Stripped-User-Name = "testuser" [suffix] Adding Realm = "nc" [suffix] Proxying request from user testuser to realm nc [suffix] Preparing to proxy authentication request to realm "nc" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm nc. Not doing EAP. ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 79 to 172.10.10.1 port 1812 NAS-IP-Address = 172.100.50.24 NAS-Port = 1 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = Authenticate-Only Called-Station-Id = "00-18-25-10-2b-20:SOME" Calling-Station-Id = "0c-60-76-7c-af-d0" NAS-Port-Id = "0c-60-76-7c-af-d0" User-Name = "testuser" EAP-Message = 0x020000120174612d32323331313236406e63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Proxying request 0 to home server 172.10.10.1 port 1812 Sending Access-Request of id 79 to 172.10.10.1 port 1812 NAS-IP-Address = 172.100.50.24 NAS-Port = 1 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = Authenticate-Only Called-Station-Id = "00-18-25-10-2b-20:SOME" Calling-Station-Id = "0c-60-76-7c-af-d0" NAS-Port-Id = "0c-60-76-7c-af-d0" User-Name = "testuser" EAP-Message = 0x020000120174612d32323331313236406e63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 172.10.10.1 port 1812, id=79, length=44 Invalid packet code 1 sent to a proxy port from home server 172.10.10.1 port 1812 - ID 79 : IGNORED Waking up in 0.9 seconds. Waking up in 13.0 seconds.

3 3

Re: Problem suppressing timestamp/Request-Athenticator in detailed logging
by Janet Plato 04 Nov '10

04 Nov '10

Alan, > You're stuck on a solution that isn't working. > You should instead describe the problem. > There is likely a better way to get the same results. > > Alan DeKok. Thanks for replying and your work on this project. I am installing a new radius server and want to accomplish three kinds of logging, only one of which I mentioned. In one paragraph: - I want to to send messages related to radiusd to a local file such as /var/log/messages or radius.log - I was accounting related messages written out one line each in a local file since it is easy to automatically filter them to notice anomalies. I want to limit the size of log files and putting it all on one line works better for me. - I want the accounting related messages to also be reflected to a remote syslog server that is part of our monitoring systems, where it can cause visual alerts when certain things happen. - I want to configure networks in clients.conf, but have logging done by NAS-IP-Addr. At this moment the server seems to be answering fine and the default config is mostly working. I am now trying to work step by step towards the following: - I want to have log messages related to the radius daemon appear in /var/log/radius/radius.log (or /var/log/messages), things like starting and stopping the server, errors in the config and so on. Local detail files could also go there, but I'd rather they went in their own detail file. - I want radiusd to send syslog messages concerning logins to a remote syslog server at the same time it logs local details. I could enable logging to the local syslog socket and having syslogd reflect local1.* to @syslog.remote.my.net, but: radiusd cannot log to both files and syslog in the same log {} stanza in radiusd.conf and also syslogd would have to reflect all events of facility.* to the remote server. Right now nothing else uses local1.* but that might not always be true. Also, if radiusd sends everything to a remote syslog server that is fine, as long as it also does local file logging. If radiusd does its own remote syslog sending, then local processes are free to send to the local socker on local1.* without conflict. I could probably get syslogd to log to both a file and a remote server but that causes problems with other processes potentially using the same facility.severity. - I want to be able to configure networks in my clients.conf file but have logging by NAS IP address. I have this in clients.conf client 10.0.0.0/16 { secret = Hint:ThisIsNotTheRealSecret } I get this as a log entry: Tue Nov 2 13:06:04 2010 : Auth: Login OK: [uname] (from client 10.0.0.0/16 port 1812) I'd like to log the header line I specified and suppress everything else: 2010-11-03 14:50:38 1b17d86ead 10.1.1.1: User uname from 192.168.1.1 Start 2010-11-03 14:50:38 1b17d86ead 10.1.1.1: User uname from 192.168.1.1 Stop This lets me easily notice trends in the system, does not fill up my logs, allows me to filter out logins from known users on their desktops, and see what is left. I can easily write something that views the log file as a series of stanzas, and only shows those stanzas that do not contain both (a username line with a known user and a client-IP from a known host). The detail log rolls daily which is nice, but I would prefer the server messages to go into radius.log which rolls less often. So how can I just have it create a header with what I want, and suppress everything else as well as log to a remote syslog server? Cheers, Janet

2 1

PROXY settings can't be reload with sig HUP
by ichiro tanaka 04 Nov '10

04 Nov '10

Hi. I was using freeradus-2.1.10 as radius proxy server. proxy.conf says this. # Also, the mapping of host name to address is done ONCE # when the server starts. If DNS is later updated to # change the address, FreeRADIUS will NOT discover that # until after a re-start, or a HUP. So, I send to freeradius "kill -HUP". But authhost and accthost was not reloaded to new ip-address. ----- my proxy.conf ----- realm example.jp { authhost = example.jp accthost = example.jp secret = secret nostrip } Thanks for your help. ichiro tanaka

2 1