- Freeradius-Users - lists.freeradius.org

FreeRADIUS 2.1 proxy error "Inconsistent shared secret for home server"
by Adam Bultman 18 Aug '09

18 Aug '09

Good morning, everybody. I am setting up a new proxy realm inside proxy.conf. I have an existing proxy realm like this: realm proxydomain.com { type = radius authhost = x.x.x.x:1812 accthost = x.x.x.x:1813 secret = sharedsecret nostrip } I am trying to set up a new proxy realm, which is a different domain name, but uses the same authhost and accthost, but a new shared secret: realm anotherproxydomain.net { type = radius authhost = x.x.x.x:1812 accthost = x.x.x.x:1813 secret = differentsharedsecret nostrip } FreeRADIUS is giving me "Inconsistent shared secret for home server x.x.x.x". The authhost and accthost are reached via a VPN, and they are a "clearing house" of sorts - they proxy authentication and accounting for multiple companies (not just the one I'm worrying about). I've checked the FAQ and wiki, and haven't had any luck. I've googled for the error, and the hits I get related to source code files, which don't help. I've also looked in the freeradius docs that come with the binaries/source, etc. Is it not possible to have unique shared secrets for unique realms, proxied to the same auth and acct hosts? Thanks, Adam

2 1

NAS IPs
by Irina 18 Aug '09

18 Aug '09

Hello, I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina ===========================

1 1

Re: Freeradius-Users Digest, Vol 52, Issue 81
by Martin Silvero 18 Aug '09

18 Aug '09

Hello, I want to know if it would be possible to debug freeradius while running to a log file, thanks. 2009/8/18 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Huntgroups and SQL not being enforced (mikoi) > 2. Session-Timeout for unlimited? (Rakotomandimby Mihamina) > 3. Re: Session-Timeout for unlimited? (Stefan Winter) > 4. NAS IPs (Irina) > 5. Re: FreeRADIUS Server Version 2.1.6 has been released > (Alexandr Kovalenko) > 6. accounting through detail module help (ramesh p) > 7. Re: accounting through detail module help (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 18 Aug 2009 06:12:18 -0700 (PDT) > From: mikoi <mika.koivisto(a)logica.com> > Subject: Re: Huntgroups and SQL not being enforced > To: freeradius-users(a)lists.freeradius.org > Message-ID: <25024576.post(a)talk.nabble.com> > Content-Type: text/plain; charset=UTF-8 > > > Hi. > For info, i followed the information in the below link for my Huntgroups, > but without Auth-Type since it is not recommended. > > http://wiki.freeradius.org/SQL_Huntgroup_HOWTO > > I still can?t get huntgroups to be enforced properly. > > If i add Huntgroup-Name == VPN-Service to the radcheck table, it works for > my local users (the ones with a Cleartext-Password in Freeradius), but not > for my proxied users. > > Any hints? > > /M > -- > View this message in context: > http://www.nabble.com/Huntgroups-and-SQL-not-being-enforced-tp25019815p2502… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > > > ------------------------------ > > Message: 2 > Date: Tue, 18 Aug 2009 16:36:20 +0300 > From: Rakotomandimby Mihamina <mihamina(a)gulfsat.mg> > Subject: Session-Timeout for unlimited? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A8AAE54.3040803(a)gulfsat.mg> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi, > (Using freeRadius v2) > We have prepaid users, where the freeradius server should answer with some > non null integer Session-Timeout. > > We have also postpaid users, where the session should be unlimited. > > What is the Session-Timeout value corresponding to "unlimited"? > > Thank you. > > -- > Architecte Informatique chez Blueline/Gulfsat: > Administration Systeme, Recherche & Developpement > +261 34 29 155 34 > > > ------------------------------ > > Message: 3 > Date: Tue, 18 Aug 2009 15:46:38 +0200 > From: Stefan Winter <stefan.winter(a)restena.lu> > Subject: Re: Session-Timeout for unlimited? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A8AB0BE.8060000(a)restena.lu> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > > We have prepaid users, where the freeradius server should answer with > > some > > non null integer Session-Timeout. > > > > We have also postpaid users, where the session should be unlimited. > > > > What is the Session-Timeout value corresponding to "unlimited"? > > If you don't send Session-Timeout at all, the session will not be timing > out. > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > Ingenieur de Recherche > Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et de > la Recherche > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > > Tel: +352 424409 1 > Fax: +352 422473 > > > > ------------------------------ > > Message: 4 > Date: Mon, 17 Aug 2009 10:54:15 -0400 > From: "Irina" <irina(a)nas.net> > Subject: NAS IPs > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <3261AA0525664575BEADE48FB132EEA5(a)netaccess1.local> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > > > I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. > Can I use > > > > xx.xx.xx.112/29 > > > > Thank you for your help in advance > > > > Kindest Regards, > > Irina > > =========================== > >

2 1

accounting through detail module help
by ramesh p 18 Aug '09

18 Aug '09

Hi, At present our radius servers getting traffic of more than 3 million users. We have only two radius servers and one mysql server active. The server crashing whenever more traffic comes. Due to mysql overload and slow I'm planning to use detail module for accounting and then take these details and parse then put in database using program/script. Does this helps? Is there any script already available in freeradius? Does palcing one more radius server and using mysql clustering helps? Please suggest. Thanks, Rams.

2 1

FreeRADIUS Server Version 2.1.6 has been released
by Alan DeKok 18 Aug '09

18 Aug '09

The following is the change log. Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009; , urgency=medium Feature improvements * radclient exits with 0 on successful (accept / ack), and 1 otherwise (no response / reject) * Added support for %{sql:UPDATE ..}, and insert/delete Patch from Arran Cudbard-Bell * Added sample "do not respond" policy. See raddb/policy.conf and raddb/sites-available/do_not_respond * Cleanups to Suse spec file from Norbert Wegener * New VSAs for Juniper from Bjorn Mork * Include more RFC dictionaries in the default install * More documentation for the WiMAX module * Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap * Don't load pre/post-proxy if proxying is disabled. * Added %{md5:...}, which returns MD5 hash in hex. * Added configurable "retry_interval" and "poll_interval" for "detail" listeners. * Added "delete_mppe_keys" configuration option to rlm_wimax. Apparently some WiMAX clients misbehave when they see those keys. * Added experimental rlm_ruby from http://github.com/Antti/freeradius-server/tree/master * Add Tunnel attributes to ldap.attrmap * Enable virtual servers to be reloaded on HUP. For now, only the "authorize", "authenticate", etc. processing sections are reloaded. Clients and "listen" sections are NOT reloaded. * Updated "radwatch" script to be more robust. See scripts/radwatch * Added certificate compatibility notes in raddb/certs/README, for compatibility with different operating systems. (i.e. Windows) Bug fixes * Minor changes to allow building without VQP. * Minor fixes from John Center * Fixed raddebug example * Don't crash when deleting attributes via unlang * Be friendlier to very fast clients * Updated the "detail" listener so that it only polls once, and not many times in a row, leaking memory each time... * Update comparison for Packet-Src-IP-Address (etc.) so that the operators other than '==' work. * Did autoconf magic to work around weird libtool bug * Make rlm_perl keep tags for tagged attributes in more situations * Update UID checking for radmin * Added "include_length" field for TTLS. It's needed for RFC compliance, but not (apparently) for interoperability.

4 4

Session-Timeout for unlimited?
by Rakotomandimby Mihamina 18 Aug '09

18 Aug '09

Hi, (Using freeRadius v2) We have prepaid users, where the freeradius server should answer with some non null integer Session-Timeout. We have also postpaid users, where the session should be unlimited. What is the Session-Timeout value corresponding to "unlimited"? Thank you. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 1

Huntgroups and SQL not being enforced
by mikoi 18 Aug '09

18 Aug '09

Hello. I need some help to debug my configuration of Huntgroups in SQL and why they are not being enforced. Probably missing something obvious here. I´ve been staring myself blind with this problem. User gets Access-Accept although NAS-IP-Address is not a match. Here is the setup: Freeradius 2.1.6, MySQL. Tables in MySQL: RADCHECK mysql> select * from radcheck; +----+--------------+--------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+----------+ | 33 | testuser | Cleartext-Password | := | testuser | +----+--------------+--------------------+----+----------+ USERGROUP: mysql> select * from usergroup; +--------------+-----------+----------+ | UserName | GroupName | priority | +--------------+-----------+----------+ | testuser | VPN-AUTH | 0 | +--------------+-----------+----------+ RADGROUPCHECK: mysql> select * from radgroupcheck; +----+-----------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+-------------+ | 8 | VPN-AUTH | Huntgroup-Name | == | VPN-Service | +----+-----------+----------------+----+-------------+ RADHUNTGROUP: mysql> select * from radhuntgroup; +----+-------------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-------------+--------------+-----------+ | 6 | VPN-Service | 10.10.10.10 | NULL | +----+-------------+--------------+-----------+ sites-enabled/default: authorize # SQL query huntgroups update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" } Debug with correct NAS-IP-Address: rad_recv: Access-Request packet from host x.x.x.x port 1812, id=20, length=54 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.10.10.10 +- entering group authorize {...} ++[preprocess] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}" -> select groupname from radhuntgroup where nasipaddress="10.10.10.10" rlm_sql (sql): Reserving sql socket id: 3 sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}"} -> VPN-Service ++[request] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select authserver from authmethod where username ="%{User-Name}" -> select authserver from authmethod where username ="testuser" rlm_sql (sql): Reserving sql socket id: 2 sql_xlat finished rlm_sql (sql): Released sql socket id: 2 expand: %{sql:select authserver from authmethod where username ="%{User-Name}"} -> LOCAL ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-AUTH' ORDER BY id [sql] User found in group VPN-AUTH [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'VPN-AUTH' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testuser" [pap] Using clear text password "testuser" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] expand: %{User-Password} -> testuser [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:15:17') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:15:17') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 20 to x.x.x.x port 1812 Finished request 0. Debug from Wrong NAS-IP-Address: rad_recv: Access-Request packet from host x.x.x.x port 1812, id=26, length=54 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.10.10.11 +- entering group authorize {...} ++[preprocess] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}" -> select groupname from radhuntgroup where nasipaddress="10.10.10.11" rlm_sql (sql): Reserving sql socket id: 3 SQL query did not return any results rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}"} -> ++[request] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select authserver from authmethod where username ="%{User-Name}" -> select authserver from authmethod where username ="testuser" rlm_sql (sql): Reserving sql socket id: 2 sql_xlat finished rlm_sql (sql): Released sql socket id: 2 expand: %{sql:select authserver from authmethod where username ="%{User-Name}"} -> LOCAL ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-AUTH' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testuser" [pap] Using clear text password "testuser" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] expand: %{User-Password} -> testuser [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:18:58') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:18:58') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 26 to x.x.x.x port 1812 Finished request 0. -- View this message in context: http://www.nabble.com/Huntgroups-and-SQL-not-being-enforced-tp25019815p2501… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

Comparing live sessions between NAS and freeradius
by m3freak＠thesandhufamily.ca 18 Aug '09

18 Aug '09

Hi Everyone, I'm using SQL for Simultaneous Use checking. It works in that if someone tries to auth when they're already logged in, they're rejected. However, sometimes the acct stop packet never makes it to freeradius (for whatever reason) when the user logs off. This leaves the "acctstoptime" field in the radacct table as NULL, which freeradius interprets as a live session. Obviously, the session doesn't actually exist on the NAS. I've read what checkrad does. From what I understand after reading the config files, checkrad only works in conjunction with radutmp. I'm not using radutmp since I've deployed freeradius with SQL. So, how do I ensure what freeradius' understands to be a live session matches what the NAS sees? How do I update a user's acctstoptime when the NAS doesn't have a session for that user, but the DB shows as "NULL" (i.e. freeradius believes the user is live)? Is this where the "deletestalesessions" parameter in sql.conf comes in? What if users are logged in for days at a time? Should lease-duration just be bumped up to something that works better for us than the "3600" default? Regards, Ranbir

3 2

Stale Session and Simultaneous-Use Question
by Deepak 18 Aug '09

18 Aug '09

Hi, I am simulating the problem on what if the AP goes down (due to various reasons). I observed that user is not properly disconnected and result is stale session. When the AP is up and when the previous user tries to log in he/she gets login failed message because "Simultaneous-Use" is in effect while previous session is still ticking. I am trying to find how to detect this problem automatically. Did some google and found this http://bisagunsara.blogspot.com/2007/03/stale-wifi-sessions-and-simultaneou… Before getting my hands dirty, I want to know if this is the correct way to solve this problem in freeradius2 since the article is quite old. Or I am just missing something that needs to tweak few configs and is supported out of the box in freeradius2. It is suggested in the article that it will not work together with Simultaneous-Use enabled. I want to know how others have solved this problem. Need some suggestions Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

5 9

handling acctsesstiontime zero packets
by ramesh p 18 Aug '09

18 Aug '09

Hi All, When Radius gets acctterminatecause = "Nas Error" packets having Acct-session-time field = 0, user "" .i see an an error in Raidus log *Mon Aug 17 05:46:04 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas 'xx.xx.xx.xx']* how to count it as valid and process it. Please suggest. Thanks, Rams.

1 0