- Freeradius-Users - lists.freeradius.org

peap/eap/mschapv2 + MySQL
by Matt Madrid 01 Jun '10

01 Jun '10

Hello list, First of all: freeradius-2.1.8, Mysql 5.1.41 on Ubuntu 10.04 / Airport Extreme v7.5 I'm having trouble authenticating users with EAP/mschapv2 against a mysql database. Users authenticate fine if they are in the users file. Here's the main problem it seems from the debug output: Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for oogabooga with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Now I've read a million posts on the web, including this list where people have reported the same problem. In most cases the problem was that the inner-tunnel server wasn't configured for sql. I definitely have sql on in the inner-tunnel file (which I will post in a sec). The mysql server IS being queried on the initial request, but not in inner-tunnel. Can someone please shed some light on this for me please. Here is my inner-tunnel file and debug output (long). Thanks, Matt /etc/freeradius/sites-enabled/inner-tunnel : ------------------------------------------------------------------------------------------------------------------------ server inner-tunnel { authorize { chap mschap unix suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } # inner-tunnel server block ------------------------------------------------------------------------------------------------------------------------ debug output: ------------------------------------------------------------------------------------------------------------------------ rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=181, length=153 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x028d000e016f6f6761626f6f6761 Message-Authenticator = 0x9388a95b4d72cd941931671109245b66 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 141 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> oogabooga [sql] expand: %{%{User-Name}:-DEFAULT} -> oogabooga [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> oogabooga [sql] sql_set_user escaped user --> 'oogabooga' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'oogabooga' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'oogabooga' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'oogabooga' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'oogabooga' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'oogabooga' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'oogabooga' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 181 to 10.20.20.254 port 65023 EAP-Message = 0x018e00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38d5cb6a385bd2236abc452f8306cad0 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=182, length=321 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x028e00a419800000009a16030100950100009103014c003b641f6f7f2118662c35e08463255495bbfed1d9fe136d852ec7dbdb4082000056c00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a00170019000101000012000a00080006001700180019000b00020100 State = 0x38d5cb6a385bd2236abc452f8306cad0 Message-Authenticator = 0x968e8650d27c8223dbd04cf324fc8257 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 142 length 164 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 154 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0095], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02f5], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 182 to 10.20.20.254 port 65023 EAP-Message = 0x018f03381900160301002a0200002603014c003b6472ff82bbee3871d32531c8f2c3a3b44e52f700638686f9ea11d4b83400002f0016030102f50b0002f10002ee0002eb308202e730820250a003020102020900b56636c836797a81300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a43616c69666f726e6961310b3009060355040a13025244310b3009060355040b13024d46310d300b060355040313046d617474312a302806092a864886f70d010901161b6d6174744072657075746174696f6e646566656e6465722e636f6d301e170d3130303532383036313931375a170d313130353238 EAP-Message = 0x3036313931375a3077310b3009060355040613025553311330110603550408130a43616c69666f726e6961310b3009060355040a13025244310b3009060355040b13024d46310d300b060355040313046d617474312a302806092a864886f70d010901161b6d6174744072657075746174696f6e646566656e6465722e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ab763a40e980384ddbb4260532c78892ab952341d55a426a570b53ae9fe65ba451290621509f02d10d8d6eae83288501845f58060021dcc5a9a706f08a68f2e9c2f93e9cdb37ca03c7946393a001e0d93bb17566ad50cc973c484a3592ce7625 EAP-Message = 0x72010d2da6edb23548162efc4ed24f9d46cdcf0e6bcf51fc628bd6337260c54f0203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604148b65f5271d9f8c34ecae0e645f6e08fc8734daf6301f0603551d230418301680142c94ae4302408ac4fef21fbb54805d7e1284debc300d06092a864886f70d0101050500038181009d0d147da8613b618dd31d47b906be2c3630fc880285388aff423c78a2e65858588bbd66207187bb311e983bb42155fc0e76a0145567ff423ba865384498dd89b2d036218bfd96ab EAP-Message = 0x954333569960576d12ab362bac80123e5a5acfad12b608a04971fdd28153ed5bb1aca14636e75d75f27233fc16b05196c075763bfc2156b116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38d5cb6a395ad2236abc452f8306cad0 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=183, length=365 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x028f00d01980000000c6160301008610000082008004bdd3b7b0a852356a1ac6e3b689f0052c720bfd0b953cc999a0864190470e58611196f4fb24605d35f758a8503ed50bf3e17a6156d0b2a7fe39bac81b8899cf6d0098413e8224d3d65ec4933169f090d5472f5ebb73627562a91c7c42f4df18de851c8ec8e72f32555ac19efd6cc20993dfb1c011e5e8cb4199b784fd0394a314030100010116030100300bb9f30d41b604fc645341a03d7cada5cc0bfbfd6e801632d95038ce42d4cc59c63245182f4a727eae303a4b90efbfce State = 0x38d5cb6a395ad2236abc452f8306cad0 Message-Authenticator = 0x830e541d08e25241fb1dfc4a51315de3 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 143 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 183 to 10.20.20.254 port 65023 EAP-Message = 0x01900041190014030100010116030100302d5b73a41a5fbd772604817295b40babc67ae810bf9cbcee437e7132285ab51930479abb317f2d94e42d5ea6b0cc5dc4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38d5cb6a3a45d2236abc452f8306cad0 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=184, length=163 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x029000061900 State = 0x38d5cb6a3a45d2236abc452f8306cad0 Message-Authenticator = 0xce08080eb592323fb851c85a19f465c5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 144 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 184 to 10.20.20.254 port 65023 EAP-Message = 0x0191002b19001703010020460a34a8baf463cc09a1320e3652ff078e4690eb993b711727b2f74b0a7a1775 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38d5cb6a3b44d2236abc452f8306cad0 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=185, length=200 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0291002b19001703010020acd51704f89f5cc2f583d85fb67d12c86680b9db361dec43517e988ca4d637ec State = 0x38d5cb6a3b44d2236abc452f8306cad0 Message-Authenticator = 0xaf1b3159314beff66b426a1a00402670 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 145 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - oogabooga [peap] Got tunneled request EAP-Message = 0x0291000e016f6f6761626f6f6761 server { PEAP: Got tunneled identity of oogabooga PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to oogabooga Sending tunneled request EAP-Message = 0x0291000e016f6f6761626f6f6761 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "oogabooga" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 145 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x019200231a0192001e101b0835effa80083b985e84044997630e6f6f6761626f6f6761 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x126780d012f59a3245837272e42ef114 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x019200231a0192001e101b0835effa80083b985e84044997630e6f6f6761626f6f6761 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x126780d012f59a3245837272e42ef114 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 185 to 10.20.20.254 port 65023 EAP-Message = 0x0192004b19001703010040aaa6c0a208f282582fce08e5608816ae7754e20c97e6892b43c82945613a824c54d463b35633e720283256337388bea291f65677344493c4455fb9680af96f3f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38d5cb6a3c47d2236abc452f8306cad0 Finished request 9. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=186, length=264 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0292006b190017030100601935f319960578d36124d2b8fb1a7a0b7eb1d9c17f8f9690e3c43f242cac0e50c37fc6ac63c88626b045c4408000e0804dcdd57b9f3aafb03ab69ba6418b8992bd8ee41dc0fd40fc08c73e3898606c89b6fae6d27fe1ba685486b9db8f0e9608 State = 0x38d5cb6a3c47d2236abc452f8306cad0 Message-Authenticator = 0x378af067a4b9b94ce8fee36e2d97802a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 146 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x029200441a0292003f3167b2b7ad4188023c4886e6989b9a4004000000000000000057a7eb9b0536b2a56075aa2351abbf780081fd44b66a16f1006f6f6761626f6f6761 server { PEAP: Setting User-Name to oogabooga Sending tunneled request EAP-Message = 0x029200441a0292003f3167b2b7ad4188023c4886e6989b9a4004000000000000000057a7eb9b0536b2a56075aa2351abbf780081fd44b66a16f1006f6f6761626f6f6761 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "oogabooga" State = 0x126780d012f59a3245837272e42ef114 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 146 length 68 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for oogabooga with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\222E=691 R=1" EAP-Message = 0x04920004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\222E=691 R=1" EAP-Message = 0x04920004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 186 to 10.20.20.254 port 65023 EAP-Message = 0x0193002b190017030100201afe77cd1d02697e61c2bbcd462649cb5245412353ad060d1c786f76308c8295 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38d5cb6a3d46d2236abc452f8306cad0 Finished request 10. Going to the next request Waking up in 0.7 seconds. rad_recv: Access-Request packet from host 10.20.20.254 port 65023, id=187, length=200 User-Name = "oogabooga" NAS-IP-Address = 10.20.20.254 NAS-Port = 0 Called-Station-Id = "F8-1E-DF-FC-8C-82:xyz" Calling-Station-Id = "00-17-F2-45-F7-CF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0293002b19001703010020fd0090fac6f01439ffc066319ab8e8f0d3e832307599fd747a3b8fe696104009 State = 0x38d5cb6a3d46d2236abc452f8306cad0 Message-Authenticator = 0xe4f5e5b68c5e815de63c20ed81863e09 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oogabooga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 147 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> oogabooga attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.6 seconds. Cleaning up request 5 ID 181 with timestamp +328 Cleaning up request 6 ID 182 with timestamp +328 Cleaning up request 7 ID 183 with timestamp +328 Waking up in 0.1 seconds. Cleaning up request 8 ID 184 with timestamp +328 Cleaning up request 9 ID 185 with timestamp +328 Waking up in 0.1 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 187 to 10.20.20.254 port 65023 EAP-Message = 0x04930004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 10 ID 186 with timestamp +332 Waking up in 1.0 seconds. Cleaning up request 11 ID 187 with timestamp +332 Ready to process requests. ------------------------------------------------------------------------------------------------------------------------

3 7

EAP_TLS
by dorra aa 01 Jun '10

01 Jun '10

hello freeradius. I used my radius by using authentication type EAP-MD5, which is based on the use of login and password. Then I tried to use EAP-TLS. So I created the certificates and I modified the file eap.con as follows:eap{ default_eap_type = tls}tls { private_key_password = 20092010 private_key_file = ${raddbdir}/certs/serveur(a)yahoo.fr-cert.pem certificate_file = ${raddbdir}/certs/serveur(a)yahoo.fr-cert.pem CA_file = ${raddbdir}/certs/root_CA-cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes CA_path = ${raddbdir}/certs/ check_crl = no } When i run freeradius-X, the shell out the following message:root@pfe-laptop:/home/pfe# freeradius -XStarting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: /etc/freeradius/proxy.confConfig: including file: /etc/freeradius/clients.confConfig: including file: /etc/freeradius/snmp.confConfig: including file: /etc/freeradius/eap.conf/etc/freeradius/eap.conf[344]: Unexpected end of fileErrors reading radiusd.conf But,I don't modify the file radiusd.conf.Please, is there something wrong in my file eap.con?thank you _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969

2 1

Using rml_perl to modify calling_station_id and set as sql_user_name
by blaqb0x＠netscape.net 31 May '10

31 May '10

Hi, I'm trying to get mac authentication to a mysql database where the mac addresses are stripped of all special characters. If I add this line to the /sql/mysql/dialup.conf file sql_user_name = "%{Calling-Station-Id}" the calling-station-id (username passed to mysql) is the correct mac address however, it has still needs to have all the special characters (hyphens) removed. Can someone show me an example of how to modify the calling-station-id? I suppose using rlm_perl would be the best way as I could modify it using perl. Thanks,

2 1

freeradius-dialupadmin
by Robert Wilkinson 31 May '10

31 May '10

Freeradius-dialupadmin Check Server page only shows: (test user dummy) Does this indicate that it isn't working correctly?

1 0

badusers issues
by Robert Wilkinson 31 May '10

31 May '10

i get this message from the bad users page: Database query failed: Unknown column 'incidentdate' in 'where clause' Is this something that is critical or concerning?

1 0

At FR2.1.9 this is possible?
by ziyen 31 May '10

31 May '10

Hi at one auth request happen then FR Act as like { first check remote1 radius Server if fail second chek remote 2 radius Server if fail third check local DB of file fi fi } is't a another multi auth check method? Thaks!

2 1

Your maximum never usage time has been reached
by David Moorhouse (FR) 30 May '10

30 May '10

Hi I've installed easyhotspot which incorporates an installation of freeradius. My user can authenticate fine, but if they logout, the next time they try to authenticate the message "Your maximum never usage time has been reached". This is despite setting a maximum download of 100MB within a one month time. A copy of the radius -X output follows... I can see where the "never" part of the message comes from in the max_all_mb counter (if I change it to "monthly" it still refuses to authorise a user with the message showing " "Your maximum monthly usage time has been reached", despite there still being time and data quote left on the account. Any help is appreciated. Thanks David You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "topsecret" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Your account has expired, %{User-Name}." } Module: Linked to module rlm_sqlcounter Module: Instantiating chillispot_max_bytes sqlcounter chillispot_max_bytes { counter-name = "ChilliSpot-Max-Total-Octets" check-name = "ChilliSpot-Max-Total-Octets" reply-name = "ChilliSpot-Max-Total-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct WHERE" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute ChilliSpot-Max-Total-Octets is number 954138627 rlm_sqlcounter: Counter attribute ChilliSpot-Max-Total-Octets is number 954138627 rlm_sqlcounter: Check attribute ChilliSpot-Max-Total-Octets is number 954138627 rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Next reset 0 [2010-05-30 23:00:00] rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Prev reset 0 [2010-05-30 23:00:00] Module: Instantiating noresetcounter sqlcounter noresetcounter { counter-name = "Session-Timeout" check-name = "Session-Timeout" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(Acctsessiontime) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Session-Timeout is number 27 rlm_sqlcounter: Check attribute Session-Timeout is number 27 rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Next reset 0 [2010-05-30 23:00:00] rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Prev reset 0 [2010-05-30 23:00:00] Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "easyhotspot" password = "secretpassword" radius_db = "easyhotspot_opensource" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to easyhotspot@localhost:/easyhotspot_opensource rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiating max_all_mb sqlcounter max_all_mb { counter-name = "Max-All-MB" check-name = "Max-All-MB" reply-name = "ChilliSpot-Max-Total-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute ChilliSpot-Max-Total-Octets is number 954138627 rlm_sqlcounter: Counter attribute Max-All-MB is number 954138635 rlm_sqlcounter: Check attribute Max-All-MB is number 954138635 rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Next reset 1275307200 [2010-06-01 00:00:00] rlm_sqlcounter: Current Time: 1275217359 [2010-05-30 23:02:39], Prev reset 1272628800 [2010-05-01 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 420 callerid = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

2 3

Re: Accounting to MySQL not working
by John McDonnell 28 May '10

28 May '10

Making a backup of the file in sites-available would make more sense since the files in sites-enabled are only links to the files in sites-enabled. It is documented. ;) Marinko Tarlac <mangia81(a)gmail.com> wrote: :) Sure, its good idea to create backups but do not store them in the sites-enabled dir :) John Dennis wrote: > On 05/28/2010 04:33 PM, Christoph Schwabl wrote: >>>> however, it seems the sql line is ignored by the radius server >>> >>> This happens in one of two cases: >>> >>> 1) the server is reading a *different* file than the one you're editing >>> >> >> this exactly was the problem >> >> I had 2 files in /etc/raddb/sites-enabled >> >> default.original >> default >> >> It seems the server was reading default.original >> >> Since I deleted default.original its working fine. > > Hmm... we just had a discussion about how loading every configuration > file in a directory trips folks up. Yet another example :-) > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Fresh Install
by David Peterson 28 May '10

28 May '10

I just installed Ubuntu 10.04 server with the basic LAMP install added. I used the git method for downloading and compiling freeradius and everything installed properly but for one caveat. radiusd: error while loading shared libraries: libfreeradius-radius-2.1.9.so: cannot open shared object file: No such file or directory I can find this file but I am not sure how to resolve this issue David

3 3

Conditional radreply with Freeradius. Possible somehow ?
by Pere Hospital 28 May '10

28 May '10

Hi all, Here is the situation. We have a freeradius server that receives autnetication/authorization requests from multiple vpn servers. For just CERTAIN servers we want to return a Framed-IP-Address via radreply. We would control the Framed-IP-Address return value (if any) via Nas-Identifier parameter that we receive from the VPN servers. So the logic of the process would be : Receive auth request from VPN server ---> Authenticate/Authorize user (via radcheck, checking expiration date, number of simultaneous logins ...). ---> If NAS-Identifier = X then return (via radreply) Framed-IP-Address=Y ---> If NAS-Identifier = Z then return (via radreply) Framed-IP-Address=W ---> otherwise don't return a Framed-IP-Address Is this possible somehow ? We are using SQL module in freeradius. Details : Debian 5.0.4 freeradius 2.0.4+dfsg-6 Regards, Pere -- Pere Hospital, CISSP®, OSCP® secWays Security First p: +34 933905455 m: +34 649827299 e: pere(a)secways.com w: www.secways.com PGP keyid: 0x100D35BDA0F669A8 http://keyserver.pgp.com

2 3