- Freeradius-Users - lists.freeradius.org

Information not getting into MySQL - UPDATE to radacct
by Steve. Parfitt (Siphon) 19 Mar '10

19 Mar '10

Hi All, I'm using FreeRadius with an ACME NetNet SD. I can see the accounting requests arrive at free radius and it seems to be writing to the MySQL with an UPDATE method yet I never see any information get into the DB. An Example from radius -X rad_recv: Accounting-Request packet from host 10.57.19.30:1103, id=0, length=105 Acct-Status-Type = Accounting-On NAS-IP-Address = 192.168.1.10 NAS-Port = 0 Acct-Session-Id = "SiphonLab#788" Acme-Firmware-Version = "SC6.1.0 MR-1 Patch 4 (Build 348)" Acme-CDR-Sequence-Number = 3938 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 3 modcall[preacct]: module "preprocess" returns noop for request 3 rlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 10.57.19.30,NAS-IP-Address = 192.168.1.10,Acct-Session-Id = "SiphonLab#788",' rlm_acct_unique: Acct-Unique-Session-ID = "4ba5092db9c79961". modcall[preacct]: module "acct_unique" returns ok for request 3 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 3 modcall[preacct]: module "files" returns noop for request 3 modcall: leaving group preacct (returns ok) for request 3 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 3 radius_xlat: '/var/log/radius/radacct/10.57.19.30/detail' rlm_detail: %A/%{Client-IP-Address}/detail expands to /var/log/radius/radacct/10.57.19.30/detail modcall[accounting]: module "detail" returns ok for request 3 modcall[accounting]: module "unix" returns noop for request 3 radius_xlat: '/var/log/radius/radutmp' rlm_radutmp: NAS 192.168.1.10 restarted (Accounting-On packet seen) modcall[accounting]: module "radutmp" returns ok for request 3 rlm_sql (sql): received Acct On/Off packet radius_xlat: 'UPDATE radacct SET AcctStopTime='2010-03-19 14:10:15', AcctSessionTime=unix_timestamp('2010-03-19 14:10:15') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '192.168.1.10' AND AcctStartTime <= '2010-03-19 14:10:15'' radius_xlat: '/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: UPDATE radacct SET AcctStopTime='2010-03-19 14:10:15', AcctSessionTime=unix_timestamp('2010-03-19 14:10:15') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '192.168.1.10' AND AcctStartTime <= '2010-03-19 14:10:15' rlm_sql (sql): Released sql socket id: 0 modcall[accounting]: module "sql" returns ok for request 3 modcall: leaving group accounting (returns ok) for request 3 Sending Accounting-Response of id 0 to 10.57.19.30 port 1103 However no data is getting to the DB mysql> select * from radacct; Empty set (0.00 sec) If I try the update in MySQL it does not populate mysql> UPDATE radacct SET AcctStopTime='2010-03-19 11:55:14', AcctSessionTime=unix_timestamp('2010-03-19 11:55:14') - unix_timestamp(AcctStartTime), AcctTerminateCause='', AcctStopDelay = '' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '192.168.1.10' AND AcctStartTime <= '2010-03-19 11:55:14'; Query OK, 0 rows affected (0.00 sec) Rows matched: 0 Changed: 0 Warnings: 0 Anyone seen this problem? Any help much appreciated Regards Steve P

2 1

MAC based Vlan problem
by Dr.Peer-Joachim Koch 19 Mar '10

19 Mar '10

Hi, we're using freeradius to switch different computer into various vlans on our switches. We have had a working configuration for freeradius 1.x, but for 2.1.6 (running on SLES) this configuration is working different. We're including a file looking like this: ------------------- # VLAN 14 # # DEFAULT Tunnel-Private-Group-ID = 14, Foundry-802_1x-enable = 0, Fall-Through = 1 # aaabbbcccddd User-Password == "aaabbbcccddd" # VLAN 15 # # DEFAULT Tunnel-Private-Group-ID = 15, Foundry-802_1x-enable = 0, Fall-Through = 1 # bbbcccdddaaa User-Password == "bbbcccdddaaa" --------------------------- On the new freeradius *all* valid mac addresses are getting the vlan Tunnel-Private-Group-ID from the first statement. All other vlan id's are ignored. The advantage was, to group all mac according to the vlan-id. Now you have to add all settings to each mac .... Is there a way to group the mac addresses with one header ? -- Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

2 1

Freeradius and COA
by Johan Meiring 19 Mar '10

19 Mar '10

Hi, I am trying to figure out to use the Coa functionality in Freeradius. I have two seperate questions. 1) For originating a COA packet, is it possible to trigger it from rlm_perl. i.e. cause an "update coa". 2) For receiving a COA packet. How can I "process" it. I see that when perl instantiates, it claims it will use two funtions, send_coa and recv_coa. In what section must I put perl for it to call the functions? I've created a listen section for Coa. Freradius receives it, but "does nothing" and simply sends back an ack. Hope this makes sense... -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

2 3

TLS/SSL Error?
by Mike Diggins 19 Mar '10

19 Mar '10

I just recently enabled a WPA SSID on our wireless network. PEAP with MSCHAP V2 is the EAP method. As far as I know it's working correctly (from all my test clients anyway), but I have seen a number of these messages logged (FreeRadius 2.1.3) and I don't know where they're coming from. My Free radius server has a Thawte Certificate installed. I'm not sure what the message means? Mar 18 15:01:01 rad01 radiusd[8452]: TLS Alert read:fatal:unknown CA Mar 18 15:01:01 rad01 radiusd[8452]: TLS_accept:failed in SSLv3 read client certificate A Mar 18 15:01:01 rad01 radiusd[8452]: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca -Mike

3 2

Enable Volume Based Accounting
by Teguh Kurniawan 19 Mar '10

19 Mar '10

Hi, how to enable traffic volume based accounting on freeradius ? Thank's Teguh

1 0

Clients Configuration on MySQL
by Teguh Kurniawan 19 Mar '10

19 Mar '10

Hi, Could we move clients.conf to mysql table ? How to do that ? Thank's Teguh

2 2

debug only for rlm_xxx (rlm_perl)
by bitte＠antworte.me 18 Mar '10

18 Mar '10

Hello list, is there an option in radiusd.conf how to enable debug logging only for several rlm_modules, e.g. I have rlm_perl and I only want debug messages for this. Thanks for your reply in advance. T.

3 6

Re: /usr/local/sbin/radiusd -X problem
by gmani 18 Mar '10

18 Mar '10

gmani wrote: > > The same Problem I am getting My Solaris Servers while starting the radius > server. How can I fix this . > > can U give me detailed explanation. > > > > > shivashankar wrote: >> >> hi All, >> >> i am using freeradius2.1.6 >> >> on solaris 10 >> >> when i run server i am getting following error >> >> >> bash-3.00# /usr/local/sbin/radiusd -X >> FreeRADIUS Version 2.1.6, for host sparc-sun-solaris2.10, built on Jul 30 >> 2009 at 20:25:20 >> Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. >> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >> PARTICULAR PURPOSE. >> You may redistribute copies of FreeRADIUS under the terms of the >> GNU General Public License v2. >> Starting - reading configuration files ... >> including configuration file /usr/local/etc/raddb/radiusd.conf >> including configuration file /usr/local/etc/raddb/proxy.conf >> including configuration file /usr/local/etc/raddb/clients.conf >> including files in directory /usr/local/etc/raddb/modules/ >> including configuration file /usr/local/etc/raddb/modules/acct_unique >> including configuration file /usr/local/etc/raddb/modules/always >> including configuration file /usr/local/etc/raddb/modules/attr_filter >> including configuration file /usr/local/etc/raddb/modules/attr_rewrite >> including configuration file /usr/local/etc/raddb/modules/chap >> including configuration file /usr/local/etc/raddb/modules/checkval >> including configuration file /usr/local/etc/raddb/modules/counter >> including configuration file /usr/local/etc/raddb/modules/detail >> including configuration file >> /usr/local/etc/raddb/modules/detail.example.com >> including configuration file /usr/local/etc/raddb/modules/detail.log >> including configuration file /usr/local/etc/raddb/modules/digest >> including configuration file /usr/local/etc/raddb/modules/echo >> including configuration file /usr/local/etc/raddb/modules/etc_group >> including configuration file /usr/local/etc/raddb/modules/exec >> including configuration file /usr/local/etc/raddb/modules/expiration >> including configuration file /usr/local/etc/raddb/modules/expr >> including configuration file /usr/local/etc/raddb/modules/files >> including configuration file /usr/local/etc/raddb/modules/inner-eap >> including configuration file /usr/local/etc/raddb/modules/ippool >> including configuration file /usr/local/etc/raddb/modules/krb5 >> including configuration file /usr/local/etc/raddb/modules/ldap >> including configuration file /usr/local/etc/raddb/modules/linelog >> including configuration file /usr/local/etc/raddb/modules/logintime >> including configuration file /usr/local/etc/raddb/modules/mac2ip >> including configuration file /usr/local/etc/raddb/modules/mac2vlan >> including configuration file /usr/local/etc/raddb/modules/otp >> including configuration file /usr/local/etc/raddb/modules/mschap >> including configuration file /usr/local/etc/raddb/modules/pam >> including configuration file /usr/local/etc/raddb/modules/pap >> including configuration file /usr/local/etc/raddb/modules/passwd >> including configuration file /usr/local/etc/raddb/modules/perl >> including configuration file /usr/local/etc/raddb/modules/policy >> including configuration file /usr/local/etc/raddb/modules/preprocess >> including configuration file /usr/local/etc/raddb/modules/radutmp >> including configuration file /usr/local/etc/raddb/modules/realm >> including configuration file /usr/local/etc/raddb/modules/smbpasswd >> including configuration file /usr/local/etc/raddb/modules/smsotp >> including configuration file /usr/local/etc/raddb/modules/sql_log >> including configuration file >> /usr/local/etc/raddb/modules/sqlcounter_expire_on_login >> including configuration file /usr/local/etc/raddb/modules/sradutmp >> including configuration file /usr/local/etc/raddb/modules/unix >> including configuration file /usr/local/etc/raddb/modules/wimax >> including configuration file /usr/local/etc/raddb/eap.conf >> including configuration file /usr/local/etc/raddb/policy.conf >> including files in directory /usr/local/etc/raddb/sites-enabled/ >> including configuration file /usr/local/etc/raddb/sites-enabled/default >> including configuration file >> /usr/local/etc/raddb/sites-enabled/inner-tunnel >> including configuration file >> /usr/local/etc/raddb/sites-enabled/control-socket >> including dictionary file /usr/local/etc/raddb/dictionary >> main { >> prefix = "/usr/local" >> localstatedir = "/usr/local/var" >> logdir = "/usr/local/var/log/radius" >> libdir = "/usr/local/lib" >> radacctdir = "/usr/local/var/log/radius/radacct" >> hostname_lookups = no >> max_request_time = 30 >> cleanup_delay = 5 >> max_requests = 1024 >> allow_core_dumps = no >> pidfile = "/usr/local/var/run/radiusd/radiusd.pid" >> checkrad = "/usr/local/sbin/checkrad" >> debug_level = 0 >> proxy_requests = yes >> log { >> stripped_names = no >> auth = no >> auth_badpass = no >> auth_goodpass = no >> } >> security { >> max_attributes = 200 >> reject_delay = 1 >> status_server = yes >> } >> } >> radiusd: #### Loading Realms and Home Servers #### >> proxy server { >> retry_delay = 5 >> retry_count = 3 >> default_fallback = no >> dead_time = 120 >> wake_all_if_all_dead = no >> } >> home_server localhost { >> ipaddr = 127.0.0.1 >> port = 1812 >> type = "auth" >> secret = "testing123" >> response_window = 20 >> max_outstanding = 65536 >> require_message_authenticator = no >> zombie_period = 40 >> status_check = "status-server" >> ping_interval = 30 >> check_interval = 30 >> num_answers_to_alive = 3 >> num_pings_to_alive = 3 >> revive_interval = 120 >> status_check_timeout = 4 >> irt = 2 >> mrt = 16 >> mrc = 5 >> mrd = 30 >> } >> home_server_pool my_auth_failover { >> type = fail-over >> home_server = localhost >> } >> realm example.com { >> auth_pool = my_auth_failover >> } >> realm LOCAL { >> } >> radiusd: #### Loading Clients #### >> client localhost { >> ipaddr = 127.0.0.1 >> require_message_authenticator = no >> secret = "testing123" >> nastype = "other" >> } >> client 192.168.0.0/24 { >> require_message_authenticator = no >> secret = "testing123-1" >> shortname = "private-network-1" >> } >> client 192.168.0.0/16 { >> require_message_authenticator = no >> secret = "testing123-2" >> shortname = "private-network-2" >> } >> client 10.232.170.228/16 { >> require_message_authenticator = no >> secret = "testing123" >> shortname = "private-network-2" >> } >> client 10.232.170.228 { >> require_message_authenticator = no >> secret = "testing123" >> shortname = "liv1" >> nastype = "livingston" >> } >> radiusd: #### Instantiating modules #### >> instantiate { >> Module: Linked to module rlm_exec >> Module: Instantiating exec >> exec { >> wait = no >> input_pairs = "request" >> shell_escape = yes >> } >> Module: Linked to module rlm_expr >> Module: Instantiating expr >> Module: Linked to module rlm_expiration >> Module: Instantiating expiration >> expiration { >> reply-message = "Password Has Expired " >> } >> Module: Linked to module rlm_logintime >> Module: Instantiating logintime >> logintime { >> reply-message = "You are calling outside your allowed timespan " >> minimum-timeout = 60 >> } >> } >> radiusd: #### Loading Virtual Servers #### >> server inner-tunnel { >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Linked to module rlm_pap >> Module: Instantiating pap >> pap { >> encryption_scheme = "auto" >> auto_header = no >> } >> Module: Linked to module rlm_chap >> Module: Instantiating chap >> Module: Linked to module rlm_mschap >> Module: Instantiating mschap >> mschap { >> use_mppe = yes >> require_encryption = no >> require_strong = no >> with_ntdomain_hack = no >> } >> Module: Linked to module rlm_unix >> Module: Instantiating unix >> unix { >> radwtmp = "/usr/local/var/log/radius/radwtmp" >> } >> Module: Linked to module rlm_eap >> Module: Instantiating eap >> eap { >> default_eap_type = "md5" >> timer_expire = 60 >> ignore_unknown_eap_types = no >> cisco_accounting_username_bug = no >> max_sessions = 2048 >> } >> Module: Linked to sub-module rlm_eap_md5 >> Module: Instantiating eap-md5 >> Module: Linked to sub-module rlm_eap_leap >> Module: Instantiating eap-leap >> Module: Linked to sub-module rlm_eap_gtc >> Module: Instantiating eap-gtc >> gtc { >> challenge = "Password: " >> auth_type = "PAP" >> } >> Module: Linked to sub-module rlm_eap_tls >> Module: Instantiating eap-tls >> tls { >> rsa_key_exchange = no >> dh_key_exchange = yes >> rsa_key_length = 512 >> dh_key_length = 512 >> verify_depth = 0 >> pem_file_type = yes >> private_key_file = "/usr/local/etc/raddb/certs/server.pem" >> certificate_file = "/usr/local/etc/raddb/certs/server.pem" >> CA_file = "/usr/local/etc/raddb/certs/ca.pem" >> private_key_password = "whatever" >> dh_file = "/usr/local/etc/raddb/certs/dh" >> random_file = "/usr/local/etc/raddb/certs/random" >> fragment_size = 1024 >> include_length = yes >> check_crl = no >> cipher_list = "DEFAULT" >> make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" >> cache { >> enable = no >> lifetime = 24 >> max_entries = 255 >> } >> } >> /usr/local/etc/raddb/certs/bootstrap: make: not found >> /usr/local/etc/raddb/certs/bootstrap: openssl: not found >> Exec-Program output: >> Exec-Program: returned: 1 >> rlm_eap: Failed to initialize type tls >> /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" >> /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find >> module "eap". >> /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing >> authenticate section. >> Errors initializing modules >> >> >> plz hlp me out >> >> >> > > -- View this message in context: http://old.nabble.com/-usr-local-sbin-radiusd--X-problem-tp24737309p2794202… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory
by John 18 Mar '10

18 Mar '10

Hello, We want to setup freeRADIUS with Peap/MSCHAPv2 talk to Apple Open Directory. I found this option 'use_open_directory'. But looks we need to install freeRADIUS on the same machine with Open Directory.(https://lists.freeradius.org/pipermail/freeradius-users/2010-Feb… Do we have to run freeRADIUS on the same machine with OpenDirectory? Is there a work-around that we can run freeRADIUS seperate from OpenDirectory? Best. John

2 2

freeradius and vlan assignment
by omega bk 18 Mar '10

18 Mar '10

hi, assume that the switch does not support the "auth-fail" and has 2 vlan ( vlan inside and vlan outside ), is it possible in the users file to put a condition like: if (user belong to Ldap-group=inside) assign to vlan = inside else assign to vlan = outside is that possible ? thanks

2 2