- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 52, Issue 81
by Martin Silvero 18 Aug '09

18 Aug '09

Hello, I want to know if it would be possible to debug freeradius while running to a log file, thanks. 2009/8/18 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Huntgroups and SQL not being enforced (mikoi) > 2. Session-Timeout for unlimited? (Rakotomandimby Mihamina) > 3. Re: Session-Timeout for unlimited? (Stefan Winter) > 4. NAS IPs (Irina) > 5. Re: FreeRADIUS Server Version 2.1.6 has been released > (Alexandr Kovalenko) > 6. accounting through detail module help (ramesh p) > 7. Re: accounting through detail module help (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 18 Aug 2009 06:12:18 -0700 (PDT) > From: mikoi <mika.koivisto(a)logica.com> > Subject: Re: Huntgroups and SQL not being enforced > To: freeradius-users(a)lists.freeradius.org > Message-ID: <25024576.post(a)talk.nabble.com> > Content-Type: text/plain; charset=UTF-8 > > > Hi. > For info, i followed the information in the below link for my Huntgroups, > but without Auth-Type since it is not recommended. > > http://wiki.freeradius.org/SQL_Huntgroup_HOWTO > > I still can?t get huntgroups to be enforced properly. > > If i add Huntgroup-Name == VPN-Service to the radcheck table, it works for > my local users (the ones with a Cleartext-Password in Freeradius), but not > for my proxied users. > > Any hints? > > /M > -- > View this message in context: > http://www.nabble.com/Huntgroups-and-SQL-not-being-enforced-tp25019815p2502… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > > > ------------------------------ > > Message: 2 > Date: Tue, 18 Aug 2009 16:36:20 +0300 > From: Rakotomandimby Mihamina <mihamina(a)gulfsat.mg> > Subject: Session-Timeout for unlimited? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A8AAE54.3040803(a)gulfsat.mg> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi, > (Using freeRadius v2) > We have prepaid users, where the freeradius server should answer with some > non null integer Session-Timeout. > > We have also postpaid users, where the session should be unlimited. > > What is the Session-Timeout value corresponding to "unlimited"? > > Thank you. > > -- > Architecte Informatique chez Blueline/Gulfsat: > Administration Systeme, Recherche & Developpement > +261 34 29 155 34 > > > ------------------------------ > > Message: 3 > Date: Tue, 18 Aug 2009 15:46:38 +0200 > From: Stefan Winter <stefan.winter(a)restena.lu> > Subject: Re: Session-Timeout for unlimited? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A8AB0BE.8060000(a)restena.lu> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > > We have prepaid users, where the freeradius server should answer with > > some > > non null integer Session-Timeout. > > > > We have also postpaid users, where the session should be unlimited. > > > > What is the Session-Timeout value corresponding to "unlimited"? > > If you don't send Session-Timeout at all, the session will not be timing > out. > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > Ingenieur de Recherche > Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et de > la Recherche > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > > Tel: +352 424409 1 > Fax: +352 422473 > > > > ------------------------------ > > Message: 4 > Date: Mon, 17 Aug 2009 10:54:15 -0400 > From: "Irina" <irina(a)nas.net> > Subject: NAS IPs > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <3261AA0525664575BEADE48FB132EEA5(a)netaccess1.local> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > > > I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. > Can I use > > > > xx.xx.xx.112/29 > > > > Thank you for your help in advance > > > > Kindest Regards, > > Irina > > =========================== > >

2 1

accounting through detail module help
by ramesh p 18 Aug '09

18 Aug '09

Hi, At present our radius servers getting traffic of more than 3 million users. We have only two radius servers and one mysql server active. The server crashing whenever more traffic comes. Due to mysql overload and slow I'm planning to use detail module for accounting and then take these details and parse then put in database using program/script. Does this helps? Is there any script already available in freeradius? Does palcing one more radius server and using mysql clustering helps? Please suggest. Thanks, Rams.

2 1

FreeRADIUS Server Version 2.1.6 has been released
by Alan DeKok 18 Aug '09

18 Aug '09

The following is the change log. Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009; , urgency=medium Feature improvements * radclient exits with 0 on successful (accept / ack), and 1 otherwise (no response / reject) * Added support for %{sql:UPDATE ..}, and insert/delete Patch from Arran Cudbard-Bell * Added sample "do not respond" policy. See raddb/policy.conf and raddb/sites-available/do_not_respond * Cleanups to Suse spec file from Norbert Wegener * New VSAs for Juniper from Bjorn Mork * Include more RFC dictionaries in the default install * More documentation for the WiMAX module * Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap * Don't load pre/post-proxy if proxying is disabled. * Added %{md5:...}, which returns MD5 hash in hex. * Added configurable "retry_interval" and "poll_interval" for "detail" listeners. * Added "delete_mppe_keys" configuration option to rlm_wimax. Apparently some WiMAX clients misbehave when they see those keys. * Added experimental rlm_ruby from http://github.com/Antti/freeradius-server/tree/master * Add Tunnel attributes to ldap.attrmap * Enable virtual servers to be reloaded on HUP. For now, only the "authorize", "authenticate", etc. processing sections are reloaded. Clients and "listen" sections are NOT reloaded. * Updated "radwatch" script to be more robust. See scripts/radwatch * Added certificate compatibility notes in raddb/certs/README, for compatibility with different operating systems. (i.e. Windows) Bug fixes * Minor changes to allow building without VQP. * Minor fixes from John Center * Fixed raddebug example * Don't crash when deleting attributes via unlang * Be friendlier to very fast clients * Updated the "detail" listener so that it only polls once, and not many times in a row, leaking memory each time... * Update comparison for Packet-Src-IP-Address (etc.) so that the operators other than '==' work. * Did autoconf magic to work around weird libtool bug * Make rlm_perl keep tags for tagged attributes in more situations * Update UID checking for radmin * Added "include_length" field for TTLS. It's needed for RFC compliance, but not (apparently) for interoperability.

4 4

Session-Timeout for unlimited?
by Rakotomandimby Mihamina 18 Aug '09

18 Aug '09

Hi, (Using freeRadius v2) We have prepaid users, where the freeradius server should answer with some non null integer Session-Timeout. We have also postpaid users, where the session should be unlimited. What is the Session-Timeout value corresponding to "unlimited"? Thank you. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 1

Huntgroups and SQL not being enforced
by mikoi 18 Aug '09

18 Aug '09

Hello. I need some help to debug my configuration of Huntgroups in SQL and why they are not being enforced. Probably missing something obvious here. I´ve been staring myself blind with this problem. User gets Access-Accept although NAS-IP-Address is not a match. Here is the setup: Freeradius 2.1.6, MySQL. Tables in MySQL: RADCHECK mysql> select * from radcheck; +----+--------------+--------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+----------+ | 33 | testuser | Cleartext-Password | := | testuser | +----+--------------+--------------------+----+----------+ USERGROUP: mysql> select * from usergroup; +--------------+-----------+----------+ | UserName | GroupName | priority | +--------------+-----------+----------+ | testuser | VPN-AUTH | 0 | +--------------+-----------+----------+ RADGROUPCHECK: mysql> select * from radgroupcheck; +----+-----------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+-------------+ | 8 | VPN-AUTH | Huntgroup-Name | == | VPN-Service | +----+-----------+----------------+----+-------------+ RADHUNTGROUP: mysql> select * from radhuntgroup; +----+-------------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-------------+--------------+-----------+ | 6 | VPN-Service | 10.10.10.10 | NULL | +----+-------------+--------------+-----------+ sites-enabled/default: authorize # SQL query huntgroups update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" } Debug with correct NAS-IP-Address: rad_recv: Access-Request packet from host x.x.x.x port 1812, id=20, length=54 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.10.10.10 +- entering group authorize {...} ++[preprocess] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}" -> select groupname from radhuntgroup where nasipaddress="10.10.10.10" rlm_sql (sql): Reserving sql socket id: 3 sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}"} -> VPN-Service ++[request] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select authserver from authmethod where username ="%{User-Name}" -> select authserver from authmethod where username ="testuser" rlm_sql (sql): Reserving sql socket id: 2 sql_xlat finished rlm_sql (sql): Released sql socket id: 2 expand: %{sql:select authserver from authmethod where username ="%{User-Name}"} -> LOCAL ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-AUTH' ORDER BY id [sql] User found in group VPN-AUTH [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'VPN-AUTH' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testuser" [pap] Using clear text password "testuser" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] expand: %{User-Password} -> testuser [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:15:17') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:15:17') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 20 to x.x.x.x port 1812 Finished request 0. Debug from Wrong NAS-IP-Address: rad_recv: Access-Request packet from host x.x.x.x port 1812, id=26, length=54 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.10.10.11 +- entering group authorize {...} ++[preprocess] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}" -> select groupname from radhuntgroup where nasipaddress="10.10.10.11" rlm_sql (sql): Reserving sql socket id: 3 SQL query did not return any results rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}"} -> ++[request] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select authserver from authmethod where username ="%{User-Name}" -> select authserver from authmethod where username ="testuser" rlm_sql (sql): Reserving sql socket id: 2 sql_xlat finished rlm_sql (sql): Released sql socket id: 2 expand: %{sql:select authserver from authmethod where username ="%{User-Name}"} -> LOCAL ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-AUTH' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testuser" [pap] Using clear text password "testuser" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] expand: %{User-Password} -> testuser [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:18:58') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testuser', 'Access-Accept', '2009-08-17 16:18:58') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 26 to x.x.x.x port 1812 Finished request 0. -- View this message in context: http://www.nabble.com/Huntgroups-and-SQL-not-being-enforced-tp25019815p2501… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

Comparing live sessions between NAS and freeradius
by m3freak＠thesandhufamily.ca 18 Aug '09

18 Aug '09

Hi Everyone, I'm using SQL for Simultaneous Use checking. It works in that if someone tries to auth when they're already logged in, they're rejected. However, sometimes the acct stop packet never makes it to freeradius (for whatever reason) when the user logs off. This leaves the "acctstoptime" field in the radacct table as NULL, which freeradius interprets as a live session. Obviously, the session doesn't actually exist on the NAS. I've read what checkrad does. From what I understand after reading the config files, checkrad only works in conjunction with radutmp. I'm not using radutmp since I've deployed freeradius with SQL. So, how do I ensure what freeradius' understands to be a live session matches what the NAS sees? How do I update a user's acctstoptime when the NAS doesn't have a session for that user, but the DB shows as "NULL" (i.e. freeradius believes the user is live)? Is this where the "deletestalesessions" parameter in sql.conf comes in? What if users are logged in for days at a time? Should lease-duration just be bumped up to something that works better for us than the "3600" default? Regards, Ranbir

3 2

Stale Session and Simultaneous-Use Question
by Deepak 18 Aug '09

18 Aug '09

Hi, I am simulating the problem on what if the AP goes down (due to various reasons). I observed that user is not properly disconnected and result is stale session. When the AP is up and when the previous user tries to log in he/she gets login failed message because "Simultaneous-Use" is in effect while previous session is still ticking. I am trying to find how to detect this problem automatically. Did some google and found this http://bisagunsara.blogspot.com/2007/03/stale-wifi-sessions-and-simultaneou… Before getting my hands dirty, I want to know if this is the correct way to solve this problem in freeradius2 since the article is quite old. Or I am just missing something that needs to tweak few configs and is supported out of the box in freeradius2. It is suggested in the article that it will not work together with Simultaneous-Use enabled. I want to know how others have solved this problem. Need some suggestions Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

5 9

handling acctsesstiontime zero packets
by ramesh p 18 Aug '09

18 Aug '09

Hi All, When Radius gets acctterminatecause = "Nas Error" packets having Acct-session-time field = 0, user "" .i see an an error in Raidus log *Mon Aug 17 05:46:04 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas 'xx.xx.xx.xx']* how to count it as valid and process it. Please suggest. Thanks, Rams.

1 0

Re: Authentication with mschap
by Eric Bourkland 17 Aug '09

17 Aug '09

It looks like I might have figured it out, I had commented out the line I had added that I actually needed. I wasn't telling Radius where to look in LDAP for the password field. I can get my windows XP laptops to connect without a problem, still having a bit of a problem with the Mac laptops since they have a few more options available to them, it is trying to do authentication other than PEAP/MSChapv2. Looks like EAP which won't work with the clear-text password. So just need to figure out how to set their request up properly. Is there a way for freeRadius to check both? for instance windows machines use the MSCHAPv2 and then Mac machines use pap or something else? I would think that this would work without a problem but need to configrm. Is it smart enough to know that if the request comes in from a Mac or someone with SecureW2 that it can do PAP and from Windows the request to use MSCHAPv2, it looks like it goes through every possible configuration and checks anyway. Thanks, ----- Original Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 17, 2009 9:17:46 AM GMT -05:00 US/Canada Eastern Subject: Re: Authentication with mschap Eric Bourkland wrote: > No Cleartext-Password configured. Cannot create LM-Password > No Cleartext-Password configured. Cannot create NT-Password > Told to do MS-CHAPv2 for test.user with NT-Password > FAILED: No NT/LM-Password. Cannot perform authentication. > FAILED: MS-CHAP2-Response is incorrect. Which is what you posted before. This doesn't help. > what it looks like to me is that Radius isn't getting the Cleartext-Password from the laptop client, I don't know if this the case or not. the laptop client is Window's XP pro build and some Vista, and whatever else a guest may bring in. I assumed that it would pass the password in the Cleartext-Password attribute when using the MS-CHAPv2, I need to confrim this. I can get it to work if I install SecureW2 but I've been told that asking everyone to install it on the laptops isn't an option. > This protocol is relatively new to me at least how all the various pieces of software handle it. > I know I'm close I just need help being pointed in the right direction on where the disconnect is occuring. right now I am pretty certain it is not between Radius and my openLDAP. The issue is that the NT password is NOT being read from LDAP, and is NOT being given to FreeRADIUS. Read the REST of the debug output to see why. Or failing that, post the debug output here, as suggested in the FAQ, README, INSTALL, "man" page, and nearly daily on this list. Posting the last 2-3 lines of "authentication failed" is nearly useless. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

NAS IPs
by Irina 17 Aug '09

17 Aug '09

Hello, I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina ===========================

2 1