- Freeradius-Users - lists.freeradius.org

Framed-IP-Address Issue
by Tevfik Ceydeliler 02 Feb '10

02 Feb '10

Now i try to test with my freeradius. There are two tests: 1. User try to get IP from pool 2. Users try to get IP as Framed-IP-Address There is two log i deleted same lines. I send only differences ################################################################ ##Log for IP pool: ... ... [files] users: Matched entry tevfikceydeliler at line 98 ... Sending Access-Request of id 153 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172938111645" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x32 ... Sending Access-Request of id 153 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172938111645" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x32 ... rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=153, length=23 Proxy-State = 0x32 ... Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.5.80 [TESTPOOL] MD5 on 'key' directive maps to: 5d6bfe9b8c4b166a1386c56a8286087e [TESTPOOL] Searching for an entry for key: '5d6bfe9b8c4b166a1386c56a8286087e' rlm_ippool: Allocating ip to key: '5d6bfe9b8c4b166a1386c56a8286087e' [TESTPOOL] num: 1 [TESTPOOL] Allocated ip 172.30.64.12 to client key: 5d6bfe9b8c4b166a1386c56a8286087e ++[TESTPOOL] returns ok ... Sending Access-Accept of id 2 to 10.65.5.80 port 57928 Framed-IP-Address = 172.30.64.12 Framed-IP-Netmask = 255.255.240.0 ... ##Log For Framed-IP-Address: ... ... [files] users: Matched entry tevfikceydeliler at line 114 ... Sending Access-Request of id 129 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172915933501" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x31 ... Sending Access-Request of id 129 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172915933501" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x31 ... rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=129, length=23 Proxy-State = 0x31 ... Found Auth-Type = Local Found Auth-Type = Accept Warning: Found 2 auth-types on request for user 'tevfikceydeliler' Auth-Type = Accept, accepting the user +- entering group post-auth {...} [TESTPOOL] Could not find Pool-Name attribute. ++[TESTPOOL] returns noop [STATICPOOL] Could not find Pool-Name attribute. ... Sending Access-Accept of id 1 to 10.65.5.80 port 57927 ... ################################################################ 1.) I realized that for IP pool test there is only one Auth-Type. In Framed-IP-Address test there is two! 2.) IP pool Test has 0x32 as Proxy-State, Framed-IP-Address test has 0x31 3.) User can get Ip from pool, cant get ip as static. Again my question is... what change if a user gets ip from pool or use static ip? I try to solve this problem. I am newbie. Thanks for your assistance already.. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

ELOM ETSE invites you to connect
by ELOM ETSE via Yahoo! 02 Feb '10

02 Feb '10

Join ELOM ETSE on Yahoo! Messenger. Come chat with me, share files and more. Stay in the loop with all your friends. Get started : http://invite.msg.yahoo.com/invite?op=accept&intl=us&sig=Y4dC6BBsI0enNCyVwo… * Stay connected at home, at work, or on the go * Have fun with games, emoticons, and more * Join a community of over 100 million people from around the world Join Your Friends : http://invite.msg.yahoo.com/invite?op=accept&intl=us&sig=Y4dC6BBsI0enNCyVwo… -- this email was sent to you by an automated system - please do not reply directly

2 1

Auth-Type LDAP and testing for if(reject)
by Harry Hoffman 02 Feb '10

02 Feb '10

Hi, So, I'm trying to get multiple sources of authentication (i.e. LDAP and Active Directory via ntlm_auth) working from a Cisco ASA to freeradius-2.x. The username and password come over in clear text. The Auth-Type is being set to LDAP and works with ldap. If I switch from ldap to ntlm_auth in Auth-Type LDAP { ... } in the authenticate section of the default server then I can authenticate to Active Directory. I've tried doing the following to have a "continue on fail" authenticate{ ... Auth-Type LDAP{ ldap if(reject){ ntlm_auth } } This doesn't work. If I give my AD credentials the authenticate rejects on ldap and never goes to ntlm_auth. Any ideas what I can do to get this to work? Cheers, Harry

2 2

Allowing Access via 'users' when LDAP fails
by Amaru Netapshaak 02 Feb '10

02 Feb '10

Hello, I've got FreeRADIUS querying an OpenLDAP server successfully. Users can login and their appropriate VLAN information is returned and everythings great. Right now, if a user isnt found in the LDAP database, a reject is returned to the switch and the port goes offline. What I'd rather have,is RADIUS reply with a standard response (if the LDAP auth fails). I tried to do this in the users file, by moving 'files' to below 'ldap' in sites-enabled/default and then creating a DEFAULT entry in users that returned the VLAN information I wanted, but then it didnt include other relevant info that the switch needs. Am I on the right track? Thanks! -AMARU

5 12

Re: ldap machine account auth tutorial
by Phil Mayers 01 Feb '10

01 Feb '10

On 01/02/10 16:04, cd wrote: > thanks Phil > > but it looks like that i get an access-accept without ldap password validation ??! Please don't email me directly; I'm on the list. > rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=151, length=136 > NAS-IP-Address = 10.172.253.110 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe35737afd4fb25d9a9cab4dc24bffa77 > NAS-Port = 10 > Framed-MTU = 1490 > User-Name = "host/crid72-42ee2079" > Calling-Station-Id = "00-0C-29-7E-44-54" > EAP-Message = 0x020d001901686f73742f6372696437322d3432656532303739 SNIP; your LDAP debugging level is way, way too high. It's very hard to read the debugging output. > rlm_ldap: sambaNtPassword -> NT-Password == 0x3241384242423239424546354639314230324146363837323930414442344637 > [ldap_admin] performing user authorization for host/crid72-42ee2079 ...why are you running 2 LDAP modules? > +++[ldap_sw] returns ok > ++- policy redundant returns ok > rlm_ldap: Entering ldap_groupcmp() > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type mschapv2 > rlm_eap_mschapv2: Issuing Challenge > ++[eap] returns handled > } # server inner-tunnel > Sending Access-Challenge of id 151 to 192.168.10.254 port 1024 > EAP-Message = 0x010e002e1a010e002910924d24419c6082e80c304f8d76c22109686f73742f6372696437322d3432656532303739 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x517b79b8517563ae61de7219537f52df Ok, so EAP challenge sent. > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP NAK > [eap] EAP-NAK asked for EAP-Type/peap So it's using PEAP. Then after lots and lots of unnecessary LDAP debug output: > Sending Access-Accept of id 161 to 192.168.10.254 port 1024 > User-Name = "host/crid72-42ee2079" > MS-MPPE-Recv-Key = 0xc83951c8f97b57386194b58be2d66edbe3a7b37cbaead57df65c61d64cea65e1 > MS-MPPE-Send-Key = 0xeefc2477dc12da93c583c05676c8474a66fd2ad11b1cd90ef3ff575dcf876010 > EAP-Message = 0x03170004 > Message-Authenticator = 0x00000000000000000000000000000000 It succeeds. So what's the problem? Radius looked the NT password up in LDAP, and did a PEAP/MS-CHAP against it. It worked.

2 1

dictionary per nas
by Marcus Kipp 01 Feb '10

01 Feb '10

Hi @all, I want to replace our old CiscoSecure Radius-Server to a new version of FreeRadius (2.1.8). I´ve checked several things but one thing I miss on FreeRadius: On CiscoSecure it was possible to bound a NAS to a dedicated dictionary. I need this feature now on the FreeRadius I need that because I want to use one user-account for different NAS and set different reply-attributes for each NAS. Do anyone have an idea how to do this with FreeRadius ? Regards Marcus

2 1

Cisco ASA with fall through auth for LDAP and Active Directory
by Harry Hoffman 01 Feb '10

01 Feb '10

Hi all, I'm trying to setup freeradius-2.x to provide authentication for a Cisco ASA VPN. When the packet comes in I'd like to first check the LDAP database to see if the user/pass combination work and if it not then check against Active Directory (using ntlm_auth). Both LDAP and AD (via ntlm_auth) work separately. I've used the following URL to setup the AD connectivity (via /etc/modules/ntlm_auth for PAP and /etc/modules/mschap for MSCHAP): http://deployingradius.com/documents/configuration/active_directory.html Everything works as expected here. The username and password come across in clear text, from the VPN, and are handed to ntlm_auth which is then able to authenticate the user. I'm stuck at trying to get freeradius to first check LDAP and then check AD if the LDAP server says that the username and password combo are not good. I've searched both the mailing list and google but am confused by some of the answers given, specifically this message seems to be talking about a similar situation: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg59368.… Any help would be greatly appreciated. Cheers, Harry

1 0

Re: STILL Trying to get tunneling to work- resolved, and a question
by Mike Bernhardt 29 Jan '10

29 Jan '10

I found the major problem that caused my configuration to not work. This was in regards to getting freeradius to proxy EAP/PEAP to IAS servers as standard CHAP. I was using freeradius 2.1.7, and then 2.1.8 as recommended by someone. Neither worked. The solution was to back down to 2.1.4. Is this a bug that was introduced after that, or what? I can email config files to whomever needs them to work on it. So, I now have another question: I have set up 2 IAS servers in a pool. I would like to drastically reduce the timeout before freeradius fails over to the 2nd one. How do I do that? Right now it takes about 30 seconds but I don't see a variable to change that. I also noticed that the status requests, which begin after it has marked a server as bad, do not work. How do I use the user name and [bad] password to check status and bring it back sooner? It only seems to try it once and that's it. Thanks, Mike

2 1

Logging in more then once
by J Brandon Polley 29 Jan '10

29 Jan '10

I'm running FreeRadius Version: 2.1.8 SUSE Linux My problem is that people can login more then once. In e-directory I have it set to only allow the user to login once. When they are logged into novell then try to login to FreeRadius it lets them in. How do I make FreeRadius see this rule in e-directory? Is it even possible? Here is my debug screen: FreeRADIUS Version 2.1.8, for host i686-suse-linux-gnu, built on Jan 23 2010 at 01:51:06 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 172.16.33.2 { require_message_authenticator = no secret = "fake" shortname = "wlc-nsac-exteng-4404-6" nastype = "cisco" } client 172.16.33.4 { require_message_authenticator = no secret = "fake" shortname = "wlc-nsac-exteng-4404-7" nastype = "cisco" } client 172.16.19.130 { require_message_authenticator = no secret = "fake" nastype = "other" } client 172.16.19.132 { require_message_authenticator = no secret = "fake" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "172.16.3.52" port = 636 password = "fake" identity = "cn=FAKE,ou=USERS,o=NSAC" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/raddb/certs/cert.b64" require_cert = "demand" } basedn = "o=NSAC" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(FAKE=1)))" base_filter = "(objectclass=radiusprofile)" password_attribute = "nspmPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8188c20 Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests.

2 2

Proxied accounting
by Gabriel Blanchard 29 Jan '10

29 Jan '10

I'm currently running Freeradius 2.1.7 across 3 servers and have been having a recurring issue where proxied accounting packets stop being relayed to my customers approximately after 1 month of uptime. Auth still works just fine, but for some strange reason, acct just stops being relayed. At first, I was assuming it was a firewall problem but simply restarting radiusd fixes it. I don't have any debugging info about this unfortunately, is there a way I could use raddebug in a useful way to find where the problem is? Or am I out of luck here?

1 0