- Freeradius-Users - lists.freeradius.org

Access proxied, Accounting not proxied
by Mr. K 28 May '09

28 May '09

Hi all, I am trying to use a FreeRadius server as a proxy server using the realm. Apparently my configuration is working for the Access-Request messages, but not for the Accounting-request messages. The proxy.conf is very simple: realm test.com { type = radius authhost = NNN.NNN.NN5.7:1812 accthost = NNN.NNN.NN5.7:1813 secret = ****** ldflag = round_robin nostrip } With this configuration, the access request messages are sent to the proper server, as you can see in the next radiusd –X output: We receive the message from the PDSN: Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.17.7.214:32786, id=6, length=337 Calling-Station-Id = "310008172268681" User-Name = "8177899857(a)test.com" NAS-IP-Address = 172.17.7.214 NAS-Identifier = "bws" The radius sent it to the proper server: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/usr/freeRadius/log/radius/radacct/172.17.7.214/auth-detail-20090528' rlm_detail: /usr/freeRadius/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/freeRadius/log/radius/radacct/172.17.7.214/auth-detail-20090528 modcall[authorize]: module "auth_log" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '/' in User-Name = "8177899857(a)test.com", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "IPASS" returns noop for request 2 rlm_realm: Looking up realm "test.com" for User-Name ="8177899857(a)test.com" rlm_realm: Found realm "test.com" rlm_realm: Proxying request from user 8177899857 to realm test.com rlm_realm: Adding Realm = "test.com" rlm_realm: Preparing to proxy authentication request to realm "test.com" modcall[authorize]: module "suffix" returns updated for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 radius_xlat: '8177899857(a)test.com' rlm_sql (sql): sql_set_user escaped user --> '8177899857(a)test.com' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '8177899857(a)test.com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '8177899857(a)test.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY usergroup.priority, radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '8177899857(a)test.com' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '8177899857(a)test.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY usergroup.priority, radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 2 radius_xlat: '/usr/freeRadius/log/radius/radacct/172.17.7.214/pre-proxy-detail-20090528' rlm_detail: /usr/freeRadius/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /usr/freeRadius/log/radius/radacct/172.17.7.214/pre-proxy-detail-20090528 modcall[pre-proxy]: module "pre_proxy_log" returns ok for request 2 modcall: leaving group pre-proxy (returns ok) for request 2 Sending Access-Request of id 1 to NNN.NNN.NN5.7 port 1812 Calling-Station-Id = "310008172268681" User-Name = "8177899857(a)test.com" NAS-IP-Address = 172.17.7.214 The problem arises, when the same PDSN ask for an Accounting-Request and the server. The server replies that the shared-key is not correct. Waking up in 2 seconds... rad_recv: Accounting-Request packet from host 172.17.7.214:32786, id=7, length=735 Received Accounting-Request packet from 172.17.7.214 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Finished request 3 The shared key configured is one per node in both the radius and the PDSN; so it is difficult for me to understand this behavior. Is there any configuration missing? Is it possible that the freeradius server is not checking shared key when sending the access-request message to it’s destination and checking the key while processing the accounting-request? Regards, K -- View this message in context: http://www.nabble.com/Access-proxied%2C-Accounting-not-proxied-tp23769897p2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

rc
by jon jon 28 May '09

28 May '09

Does freeradius come with a rc. startup file.Im am using slackware version 12.1. thanks jon

3 2

question about session resumption and reply attributes
by Anatoli Logvinski 28 May '09

28 May '09

Hi We are using dynamic VLAN assignment with freeradius 2.1.6 and tried to test session resumption. It looks like that freeradius doesn't cache all reply attributes and upon session resumption the VLAN assignment attributes don't get send. Is there any way to cache these attributes? The attributes are generated by rlm_perl in post-auth section of inner-tunnel virtual server

4 7

next
by jon jon 28 May '09

28 May '09

I have my freeradius working, I running slackware 12.1 with freeradius version 2.1.5. I used NTRAping utility to send packets to my freeradius server. I also used radtest and that was successful. So now I want to set freeradius with backend mysql database. I am looking for the script db_mysql.sql and cannot find this file. I installed mysql as a package, when I installed slackware. So, does that file even exist anymore? I have the radius book and the directory it shows doesn't contain any file with that name.

4 7

Windows XP SP2 and SP3 EAP problem followup
by Balgansuren Batsukh 28 May '09

28 May '09

Hello, Any suggestion Windows XP EAP problem? Balgaa

2 14

Accounting responce question.
by lamersons 28 May '09

28 May '09

Hello there, i have posted here few times and got very helpfull answers, so i desided to try my luck once more. Im using FreeRADIUS Version 2.0.4(slackware+postgre) on powerfull x86 server with alot of RAM, connected with gigabit to NAS. Load is about 5-15record/sec Once in a while we get double accounting records. I started to take traces at NAS side and saw that sometimes AAA doesnt responce to accounting record, NAS thinks that AAA didnt get it and sends it one more time. But AAA gets the first one even if it doesnt responce to request, therefore we get double record.(debug info is below) I have made debug trace at AAA side. Is it somehow possible to see from that trace that AAA did respond and that is NASes(or network) problem that it did not recieve responce ?(debug info is below) p.s. ------------------------------------------------------------------- I sent information to NAS vendor: Dear, Yesterday at 02:27:38 PDSN sent the "Accounting request start" message and then PDSN sent the same Accounting request start massage at 02:27:43 (see in traces of PI interface). Thanks Best regards, They answered me: • The AAA can’t start the new accounting session, until it stops the first one, so the AAA doesn’t reply to the Accounting Request Start. • The PDSN wait for TIMEOUT which is 5 seconds, and resend the Accounting message again. • When the PDSN resend the Accounting message, the AAA replies to it. ----------------------------------------------------------------------- ########################### First start record : request 11309 Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:27:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('0000000', '33187f91caa26b34', '247033715823092', 'Jul 18 2008 02:27:39 EEST', NULL,'0', '0', '0', '192.168.172.128', trim('triatel(a)triatel.lv'), '0', '0', '17934924', '0', '192.168.145.1') rlm_sql (sql): Reserving sql socket id: 18 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 18 ++[sql] returns ok Finished request 11309. Cleaning up request 11309 ID 18 with timestamp +769 Going to the next request ##################### second Start record : request 11380 Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:27:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 5 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('0000000', '33187f91caa26b34', '247033715823092', 'Jul 18 2008 02:27:39 EEST', NULL,'0', '0', '0', '192.168.172.128', trim('triatel(a)triatel.lv'), '0', '0', '17934924', '0', '192.168.145.1') rlm_sql (sql): Reserving sql socket id: 43 rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error duplicate key value violates unique constraint "radacct_acctuniqueid" rlm_sql_postgresql: Postgresql Fatal Error: [23505: UNIQUE VIOLATION] Occurred!! rlm_sql (sql): Couldn't insert SQL accounting START record - ERROR: duplicate key value violates unique constraint "radacct_acctuniqueid" expand: -> rlm_sql (sql): Released sql socket id: 43 ++[sql] returns ok Finished request 11380. ############################## Interim record ################### Ready to process requests. Acct-Status-Type = Interim-Update User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:42:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Acct-Session-Time = 900 Acct-Output-Octets = 0 Acct-Input-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Multi-Session-Id = "17934924" Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Session-Continue = 1 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Active-Time = 33 3GPP2-Number-Active-Transitions = 0 3GPP2-Received-HDLC-Octets = 0 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Last-User-Activity-Time = 1216337292 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: -> rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok Finished request 21837. ##########################################STOP record ########## Acct-Status-Type = Stop User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:43:01 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Acct-Session-Time = 922 Acct-Output-Octets = 0 Acct-Input-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = Idle-Timeout Acct-Multi-Session-Id = "17934924" Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Session-Continue = 0 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-Release-Indicator = 7 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Active-Time = 33 3GPP2-Number-Active-Transitions = 0 3GPP2-Received-HDLC-Octets = 0 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Last-User-Activity-Time = 1216337292 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: UPDATE radacct SET AcctStopTime = '%{Event-Timestamp}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '%{Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', CDMABadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', CDMACorrelationId = '%{3GPP2-Correlation-Id}', CDMAActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' -> UPDATE radacct SET AcctStopTime = 'Jul 18 2008 02:43:01 EEST', AcctSessionTime = '922', AcctInputOctets = '0', OutputPacket = '0', InputPacket = '0', AcctOutputOctets = '0', ReleaseIndicator = 'Idle-Timeout', CDMABadPPPFrameCount = '0', CDMACorrelationId = '17934924', CDMAActiveTime = '33' WHERE AcctUniqueId = '33187f91caa26b34' rlm_sql (sql): Reserving sql socket id: 25 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 25 ++[sql] returns ok Finished request 22102. -- View this message in context: http://www.nabble.com/Accounting-responce-question.-tp23756895p23756895.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

How to enter users in sql?
by Just E. Mail 27 May '09

27 May '09

I have successfully setup a freeRADIUS server with PostgreSQL backend (separate) server. When I start freeRADIUS in test mode 'radiusd -X', it connects to the sql server and there is no error. I have two general questions: 1. I need to add one or two test UID & PW in the SQL database. Is there a GUI application available to accomplish that or I have to do it manually entering the data? 2. When the freeRADIUS server is live (on-line) how does user authentication data gets added into the database? In MD5, LINUX has an application to add USER Name & Group (created automatically) which both email program (such as Postfix) and freeRADIUS authenticate against. How is it done in PostgreSQL? I have tried to post this question as clearly as I can. Please ask and clarification! Jennifer K.

2 1

Assigning IP address from RADIUS to Cisco PPTP users
by up＠3.am 27 May '09

27 May '09

Hi: I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems. Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common vpdn-group 1 accept-dialin protocol pptp virtual-template 1 interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

3 5

wired 802.1x for desktops (offtopic)
by Mikael Kermorgant 27 May '09

27 May '09

Hello, Sorry for this off-topic message, I have a question about 802.1x deployment and don't know where to ask. As freeradius is one of the element I think of, maybe someone here can help me find the solution ? My Goals : 1) authenticate access to the network from Open Public Access Catalog (OPAC) desktop machines available to every user of a biblioteque. 2) have a guest account with limited LAN access (no access to internet, or just a very short whitelist) 3) Keep the machines reachable from some servers (ghost server, monitoring, etc). (this criteria eliminates the solution of a captive portal) I thought 802.1x with dynamic vlans would be a nice solution as it should permit to put the guest account in a specific vlan. But how would it be possible to reach the machine from the management servers before someone authenticates ? Is it possible to have a default vlan activated on startup of the machine ? Or do you know where I should ask this question ? Regards, -- Mikael Kermorgant

4 4

Authenticating usernames with spaces using MySQL
by Justin Menga 27 May '09

27 May '09

Hi I have an issue where I authenticate incoming DHCP requests on a broadband aggregation router using the Option 82 Port ID information as the username attribute within the RADIUS authentication request. Unfortunately the Port ID information includes spaces - and this is causing an issue where authentication fails using MySQL database, even though a username with spaces is configured in the MySQL database. If I use the /etc/raddb/users file it works OK, but I want to use MySQL accounting etc... Any ideas on how to work around this issue? Thanks Justin

2 1