- Freeradius-Users - lists.freeradius.org

segmentation fault with group in huntgroups
by François Mehault 11 Jun '09

11 Jun '09

Hi All, I want to use huntgroup to restrict access to certain huntgroups to certaingroups of users. So I edit my huntgroups file : swLabo NAS-IP-Address == 192.168.0.50 Group = administrateur I guess that administrateur is a Ldap-Group, isn't it ? And I use OpenLDAP to store my users and my radiusGroupName. dn: ou=Profiles,dc=netplus,dc=fr objectClass: organizationalUnit objectClass: top ou: Profiles dn: cn=administrateur,ou=Profiles,dc=netplus,dc=fr objectClass: radiusObjectProfile objectClass: top objectClass: radiusprofile radiusServiceType: NAS-Prompt-User radiusVSA: shell:priv-lvl=15 cn: administrateur dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: administrateur homeDirectory: /home/fmehault loginShell: /usr/local/bin/zsh cn: Francois MEHAULT gidNumber: 1203 userPassword: {SHA}C5wmJdwh7wX2rU3fR8XyA4N6oyw= So I understand that fmehault is able to authenticate on the NAS 192.168.0.50. But I have a segmentation fault of radiusd. I created also the posix group administrateur which includes fmehault. rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=67, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" User-Password = "mdp" +- entering group authorize {...} zsh: segmentation fault radiusd -X # id fmehault uid=1203(fmehault) gid=1203 groups=1203,1400(administrateur) What is the problem ? If someone has a documentation/howto about huntgroups and group, I am interested. Regards, François Mehault Netplus Communication

3 3

Robust proxy accounting
by Chris Howley 11 Jun '09

11 Jun '09

Ivan, When both RADIUS servers are operational robust proxying works. When one of the servers is unreachable the other server (that's attempting to proxy an accounting request) will delete the detail.work file from the listener's sub-directory after failing to get a response from the other server. Thanks for you help. Chris ++[exec] returns noop Sending Access-Accept of id 67 to 10.12.80.109 port 32769 User-Name = "isschrpg" MS-MPPE-Recv-Key = 0x240dd3ada2d5904bf049fc2bd7afdfc8b1a2b589b4eb3974235cf04143f138d1 MS-MPPE-Send-Key = 0x638979dd5d59705051793c16de1509508e39fd9722d56198d52da2286bb69879 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschrpg - student" Finished request 9. Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44",User-Name = "isschrpg"' [acct_unique] Acct-Unique-Session-ID = "aeb3d50af9d33fb8". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschrpg", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Thu Jun 11 08:39:20 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok [unix] ++returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschrpg ++[radutmp] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] expand: %{User-Name} -> isschrpg [sql] expand: %{%{User-Name}:-DEFAULT} -> isschrpg [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> isschrpg [sql] sql_set_user escaped user --> 'isschrpg' [sql] expand: %{Acct-Delay-Time} -> [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', ! '%{Calling-Station-Id} [sql] expand: /usr/local/var/log/radius/sqltrace.sql -> /usr/local/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('4a30b4a8/00:13:02:8d:f3:1f/44', 'aeb3d50af9d33fb8', 'isschrpg', '', 'WM07-1', '10.12.80.109', '29', '', '2009-06-11 08:39:20', '0000-00-00 00:00:00', '0', 'RADIUS', '', '', '0', '0', '10.12.80.109', '129.11.1.138', 'VLAN', 'IEEE-802', '3022', '', '', '', '1! 29.11.1.138', '0', '0') rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschrpg attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 66 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Proxying request 10 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 66 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Going to the next request Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.4 seconds. Cleaning up request 0 ID 58 with timestamp +4 Cleaning up request 1 ID 59 with timestamp +4 Cleaning up request 2 ID 60 with timestamp +4 Cleaning up request 3 ID 61 with timestamp +4 Cleaning up request 4 ID 62 with timestamp +4 Cleaning up request 5 ID 63 with timestamp +4 Cleaning up request 6 ID 64 with timestamp +4 Waking up in 0.2 seconds. Cleaning up request 7 ID 65 with timestamp +4 Cleaning up request 8 ID 66 with timestamp +5 Cleaning up request 9 ID 67 with timestamp +5 Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 Discarding duplicate request from client wism07-1 port 32769 - ID: 123 due to unfinished request 10 Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 Discarding duplicate request from client wism07-1 port 32769 - ID: 123 due to unfinished request 10 Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.6 seconds. Rejecting request 10 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] expand: %t -> Thu Jun 11 08:39:20 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 123 to 10.12.80.109 port 32769 Finished request 10. Cleaning up request 10 ID 123 with timestamp +9 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 19 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.3 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=123, length=157 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44",User-Name = "isschrpg"' [acct_unique] Acct-Unique-Session-ID = "aeb3d50af9d33fb8". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschrpg", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-11/accounting-detail-08:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Thu Jun 11 08:39:26 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok [unix] ++returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschrpg ++[radutmp] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] expand: %{User-Name} -> isschrpg [sql] expand: %{%{User-Name}:-DEFAULT} -> isschrpg [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> isschrpg [sql] sql_set_user escaped user --> 'isschrpg' [sql] expand: %{Acct-Delay-Time} -> [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0000-00-00 00:00:00', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', ! '%{Calling-Station-Id} [sql] expand: /usr/local/var/log/radius/sqltrace.sql -> /usr/local/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, tunneltype, tunnelmedium, tunnelgroupid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('4a30b4a8/00:13:02:8d:f3:1f/44', 'aeb3d50af9d33fb8', 'isschrpg', '', 'WM07-1', '10.12.80.109', '29', '', '2009-06-11 08:39:26', '0000-00-00 00:00:00', '0', 'RADIUS', '', '', '0', '0', '10.12.80.109', '129.11.1.138', 'VLAN', 'IEEE-802', '3022', '', '', '', '1! 29.11.1.138', '0', '0') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschrpg attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 23 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Proxying request 12 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 23 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313233 Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:20 BST" Acct-Delay-Time = 6 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 243 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 6 Proxy-State = 0x3231313537 Proxying request 13 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 243 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 6 Proxy-State = 0x3231313537 Going to the next request Waking up in 0.5 seconds. Waking up in 0.4 seconds. Waking up in 0.1 seconds. Waking up in 1.0 seconds. Waking up in 1.1 seconds. Waking up in 0.2 seconds. Waking up in 1.0 seconds. Waking up in 0.9 seconds. Rejecting request 12 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 [detail.example.com] expand: %t -> Thu Jun 11 08:39:26 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 123 to 10.12.80.109 port 32769 Finished request 12. Cleaning up request 12 ID 123 with timestamp +15 Going to the next request Waking up in 0.2 seconds. Waking up in 0.1 seconds. Rejecting request 13 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 13. Cleaning up request 13 ID 21157 with timestamp +15 Going to the next request Waking up in 0.9 seconds. Waking up in 23.9 seconds. Sending Status-Server of id 131 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 2.0 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:20 BST" Acct-Delay-Time = 42 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 247 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 42 Proxy-State = 0x3431353031 Proxying request 15 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 247 to 129.11.162.17 port 1813 User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 42 Proxy-State = 0x3431353031 Going to the next request Waking up in 0.8 seconds. Waking up in 0.1 seconds. Waking up in 0.8 seconds. Waking up in 0.7 seconds. Waking up in 0.7 seconds. Waking up in 1.1 seconds. Waking up in 1.0 seconds. Waking up in 0.4 seconds. Rejecting request 15 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 15. Cleaning up request 15 ID 41501 with timestamp +51 Going to the next request Waking up in 0.6 seconds. Waking up in 15.9 seconds. Sending Status-Server of id 34 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 10.0 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:20 BST" Acct-Delay-Time = 78 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 17. Cleaning up request 17 ID 9120 with timestamp +87 Going to the next request Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090611:08 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschrpg" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a30b4a8/00:13:02:8d:f3:1f/44" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "aeb3d50af9d33fb8" SQL-User-Name = "isschrpg" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 11 2009 08:39:26 BST" Acct-Delay-Time = 73 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 18. Cleaning up request 18 ID 39494 with timestamp +88 Going to the next request Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*

2 1

Re: PPTPD Bandwidth Shaping
by Neville 11 Jun '09

11 Jun '09

Dear Ivan, Appreciate your comment.... Can anyone else point me in the correct direction.. Thx Nev > Message: 1 > Date: Wed, 10 Jun 2009 00:07:22 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: PPTPD Bandwidth Shaping > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <50989.87.194.16.13.1244588842.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > >> Ok, I've got WISPr-Bandwidth-Max-Down in /var/run/radattr.ppp0 but the >> value is all wrong. >> >> I set WISPr-Bandwidth-Max-Down = 512000 (as a reply) >> >> and in /var/run/radattr.ppp0 its show as - WISPr-Bandwidth-Max-Down >> -1062731706 >> >> I just basically copied the dictionary.wispr to >> /usr/share/radiusclient-ng >> as in order to get it loaded in radattr.ppp0 :- >> >> [root@xxx radiusclient-ng]# more dictionary.wispr >> ATTRIBUTE WISPr-Location-ID 1 string >> ATTRIBUTE WISPr-Location-Name 2 string >> ATTRIBUTE WISPr-Logoff-URL 3 string >> ATTRIBUTE WISPr-Redirection-URL 4 string >> ATTRIBUTE WISPr-Bandwidth-Min-Up 5 integer >> ATTRIBUTE WISPr-Bandwidth-Min-Down 6 integer >> ATTRIBUTE WISPr-Bandwidth-Max-Up 7 integer >> ATTRIBUTE WISPr-Bandwidth-Max-Down 8 integer >> #ATTRIBUTE WISPr-Session-Terminate-Time 9 string >> #ATTRIBUTE WISPr-Session-Terminate-End-Of-Day 10 string >> ATTRIBUTE WISPr-Billing-Class-Of-Service 11 string >> >> Any ideas please. > > Try writing to the correct list. Your problem is not with freeradius. > > Ivan Kalik > Kalik Informatika ISP

2 1

DHCP code in 2.0.4+
by Martin Lorentz 11 Jun '09

11 Jun '09

Hello everyone from a long-time user of freeradius, but this is my first post on the list. While playing around with the experimental DHCP code in the latest freeradius releases, I came across a problem where the DHCP packet is not recognized, when the Message-Type is not the first among the list of options. Currently, the code uses a static offset to look for the message type in the packet. A patch is enclosed to fix the problem by iterating through the available options, but will most likely need fixing by someone who knows how to code :-) It applies to 2.0.6 and works in the lab, though. Also, I'm interested to hear about the plans for DHCP in freeradius. Personally, I'm evaluating a solution to assign static IPs based on the Agent-Circuit-Id without being tied to a specific MAC - something ISC dhcpd will not do by design. This is supposed to eventually replace PPPoE connections from CPEs. I guess freeradius could someday be able to handle this since the backend data store is really flexible. While most users will probably use the DHCP code with a leases database, in our scenario the configuration would just hand out a static IP calculated from the values in the Agent-Circuit-ID, probably by making use of scripting. Another suggestion with regards to the server design. Currently, the whole server needs to run as root to bind to port 67. That's not necessary for a RADIUS server binding only to ports above 1024. For the long run, would it be feasible to separate the DHCP server code into its own daemon, as a pure DHCP-to-RADIUS translator? Best regards, Martin Lorentz

10 59

Remote IP Authentication
by Barny Ritchley 11 Jun '09

11 Jun '09

Hello I am having trouble with authentication to freeradius. I cant find any info on the Cisco-compatible Remote IP authentication method. I have looked everywhere and cannot see how to authenticate by h323-remote-address to freeradius. The Radius Request looks like: User-Name = '2001' Calling-Station-Id = '2001' Called-Station-Id = '012356789' h323-remote-address = '172.101.91.1' i want to check against the h323-remote-address. If it is an ip which is stored against a username, then the authentication should be successful. i am using MySQL and i tried adding this to the radcheck table: attribute: h323-remote-address op: == value: 172.101.91.1 and variations on the above theme, but with no luck. All i get at the moment is: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Any help is really appreciated. Many thanks Barney

2 2

rlm_perl/radius issues with db connections
by Meyers, Dan 11 Jun '09

11 Jun '09

I'm having a few issues with FreeRadius 2.1.4 (2.1.6 isn't in ports yet) and MySQL 5.1 on FreeBSD 6.2. Specifically, I am using the CLONE method in my perl script to create my database handles every time a new thread is spawned. If I start radius and then do 'show processlist' on the MySQL server I see no connections from the radius server. If I then send a single update from radclient I get a connection in show processlist, and a timely response to my request. However in our live environment the radius server is fairly heavily used by a large number of NASes, so as soon as it is turned on it gets a large influx of requests, and the logs fill with 'Error: WARNING: Unresponsive child for request X' messages. This goes on for a good 10-20 seconds or so, during which the processlist on the MySQL server still shows no connections. Then, suddenly, the error messages stop and all my connections appear in the processlist. I'm *think* this delay is in instantiating perl for each radius thread, as the error messages still get spammed into the log for 10-20 seconds even if my authenticate and accounting perl functions simply contain 'return RLM_MODULE_OK;'. I am guessing that once perl has been instantiated for the radius thread the creation of db connections and such occurs quite quickly, but if radius suddenly tries to start a large number of perl processes at once the server gets bogged down. This behaviour can be replicated in our test environment using radclient. No matter how long I wait after starting the radius server, I always get these error messages as soon as I start bombarding the server with requests. And of course until I start bombarding it it doesn't need to start any extra threads. The initial issue was that we were getting these error messages in the live environment after some time of the server running, and they weren't ever going away. You had to restart radius to get rid of them, and there was a reasonable chance that they'd reappear as soon as you restarted it. I *believe* the issue there was actually to do with mysql requests hanging as well as perl starting, although I am still unsure as to why, as our client was compiled with the thread safe options and the server doesn't appear to have resource issues. That was, however, with 2.0.3. The issue of the threads never becoming responsive again doesn't *appear* to exist in 2.1.4, from my testing. An issue we are still seeing, however, is that sometimes no results are returned from the db. DBD doesn't throw an exception or error, we just get an empty result set back occasionally. I'm investigating that at the mo. I was just wondering if anyone else had come across any similar problems, and how you got around them. Ideally, i'd like for the perl process to be instantiated before radius starts trying to use the thread for requests. That way the radius server would simply not respond to a request if no threads were ready and free, and my NASes could retry/fail over/whatever, whereas at the moment it seems to be sending back rejects while perl is still instantiating in the thread. I could also then tell radius to start with a reasonable number of threads to handle 'normal' load, and it wouldn't actually say it was ready to process requests, and start sending anything back, until all my normal required threads and their respective perl processes had been started. -- Dan Meyers Network Specialist, Lancaster University E-Mail: d.meyers(a)lancaster.ac.uk

2 1

NAS MAC Authentication
by Jacob Baloul 11 Jun '09

11 Jun '09

Hi All, I have several NAS / Hotspots installed behind a NAT. They are all WRT54GL routers with OpenWRT + Chili and authenticating against FreeRadius + DaloRadius which is NOT in this NAT. Meaning FreeRadius sees all of the WRT's as coming from the same public IP, which also happens to be dynamic. My question is, can I authenticate and maintain session based on the NAS MAC address as apposed to the public dynamic ip address? Moving the Radius server into the NAT is not an option as it is being hosted in a different country. Thanks for the help, Jacob

2 1

Sleep before a response?
by Stephen Bowman 10 Jun '09

10 Jun '09

I have a broken NAS with a bad race condition, and need to delay responses to it (like "sleep 1;"). Is there an easy method (maybe via unlang?) to do this?

2 1

Re: Lower case - Solved
by Michel Bulgado 10 Jun '09

10 Jun '09

On Tue, 2009-06-09 at 16:09 -0700, Chris wrote: > On Jun 9, 2009, at 3:52 PM, Ivan Kalik wrote: > > >> I migrated my freeradius version 1.1.3-1.4.el5 that came with CentOS > >> 5.3 to version 2.1.6-2. > >> > >> I am looking for an option that I had in my previous configuration > >> and > >> does not find it on this new, maybe it is removed. the fact is that > >> many > >> of my users sometimes tend to write the username with the first > >> letter > >> in upper or miniscule. > > > > That works just for pap requests. Use lc perl function to rewrite > > username/pass in perl module. > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > Here's what I'm using: > > perl_tolower.pm: > > > use strict; > use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); > # > # This the remapping of return values > # > use constant RLM_MODULE_REJECT=> 0;# /* immediately > reject the request */ > use constant RLM_MODULE_FAIL=> 1;# /* module failed, > don't reply */ > use constant RLM_MODULE_OK=> 2;# /* the module is > OK, continue */ > use constant RLM_MODULE_HANDLED=> 3;# /* the module > handled the request, so stop. */ > use constant RLM_MODULE_INVALID=> 4;# /* the module > considers therequest invalid. */ > use constant RLM_MODULE_USERLOCK=> 5;# /* reject the > request (useris locked out) */ > use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found > */ > use constant RLM_MODULE_NOOP=> 7;# /* module succeeded > withoutdoing anything */ > use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs > modified) */ > use constant RLM_MODULE_NUMCODES=> 9;# /* How many > return codes there are */ > > sub authorize { > $RAD_REQUEST{'User-Name'} = lc($RAD_REQUEST{'User-Name'}); > return RLM_MODULE_OK; > } > > sub preacct { > $RAD_REQUEST{'User-Name'} = lc($RAD_REQUEST{'User-Name'}); > return RLM_MODULE_OK; > } > > sub xlat { > return RLM_MODULE_OK; > } > > radiusd.conf: > > modules { > perl { > module = /usr/local/etc/raddb/perl/perl_tolower.pm > } > ... > } > > Enable perl modules in authorize and preacct. I think order matters > here, so you probably want them near the top... > > sites-enabled/default: > > authorize { > perl > } > > preacct { > perl > } Thanks Chris I solved the problem with users who write their login in uppercase and lower case Michel

1 0

Authentication failure - PEAP - MS-CHAPv2
by kissg 10 Jun '09

10 Jun '09

Dear List, I'm having a strange issue with FreeRADIUS 2.1.4, using a configuration with the following items: - Cisco Aironet 1130AG access point - Ubuntu-based server with FreeRADIUS and OpenLDAP - Client machines (Windows XP SP2, Ubuntu 9.04) The issue I have is, that I don't get a response from the client after the server sends an Access-Challange packet. The certificates were made with the bootstrap script of FreeRADIUS, so it already contains the OIDs required by Windows. The AP is configured correctly, IP-address, port numbers and shared secret are properly set up, I've already checked them. Users are stored in an LDAP database and each user has a sambaNTPassword attribute, which contains an NT-hashed password. LDAP-RADIUS attribute mappings are properly set (NT-Password -> sambaNTPassword). The strange thing is, that I can successfully authenticate using an EAP test tool (eapol_test), no errors show up in the output. Using another AP with a slightly different configuration (using smbpasswd instead of LDAP for authorization) works, too. I've also read, that XP SP2 is incompatible with third-party RADIUS-servers. I decided to install SP3, but it did not help. What I can see, is an Access-Challange message at the end of the debug output. What can be wrong with my configuration? Can it be, that it's an incompatibility issue between FreeRADIUS and the access point? Thank you for your help in advance! Best regards: Gergely Kiss

5 8