- Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 49, Issue 95
by Marco De Magistris 21 May '09

21 May '09

Hi Ivan, 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) ____________________________________________________________________________ > Radius Client --> Radius Proxy > 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > 192.168.24.3 --> IPS2(192.168.24.4) ____________________________________________________________________________ You say: >>Yes. Proxy server will change NAS-IP-Address from the original NAS >>address into it's own. That is OK. It not works. In my scenario I have two different NAS-IP-Address(a NAS-IP-Address for ISP1 and a NAS-IP-Address for ISP2). Radius Proxy sees 3 different ip address: - 192.168.1.3: ipaddress client side. - 192.168.14.3: ipaddress for isp1 - 192.168.14.3: ipaddress for isp2 In my opinion the packet (received from Radius Client) is sent towards the default gateway. The following link describes the same scenario: http://www.opensubscriber.com/message/freeradius-users@lists.freeradius.org… They introduce proxyip = 10.10.10.10 in proxy.conf. Thanks again. Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: mercoledì 20 maggio 2009 15.55 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 95 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: question about windows users (Bartosz Chodzinski) 2. Re: R: Sql Counter reads only the first 4 digits (Alan DeKok) 3. RE: Freeradius-Users Digest, Vol 49, Issue 93 (Ivan Kalik) 4. R: R: Sql Counter reads only the first 4 digits (Mauro Iorio - Smart Soft s.r.l.) 5. Re: question about windows users (Bartosz Chodzinski) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 May 2009 15:23:22 +0200 From: Bartosz Chodzinski <bartosz.c(a)gmail.com> Subject: Re: question about windows users To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1f06c2db0905200623k5e90f148naaadaf7402c82c16(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" ok I changed it to default proxy_requests = yes $INCLUDE proxy.conf /etc/freeradius/certs/Makefile was #client.crt: client.csr server.crt server.key index.txt serial # openssl ca -batch -keyfile server.key -cert server.crt -in client.csr -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf is now: client.crt: client.csr ca.pem ca.key index.txt serial openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_SERVER) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf changes in client.cnf was: certificate = $dir/server.pem serial = $dir/serial private_key = $dir/server.key commonName = user(a)example.com is now: certificate = $dir/ca.pem serial = $dir/serial private_key = $dir/ca.key commonName = user_certificate now after instalation ca.der and client.p12 in windows everything in certificate stores seams to be ok. there is no exclamation mark on user_certificate, and certification path is ok back to the server: Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206 port 1812, id=240, length=147 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "user_certificate" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501757365725f6365727469666963617465 Message-Authenticator = 0x0d65a52fd78035c3c828c30d2a2442d9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user_certificate", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 240 to 192.168.5.206 port 1812 EAP-Message = 0x0101001604100c91af03e9cd5c25126407d36f22684a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5a5cfd0b5a4cb20491e5ee122e4a622 Finished request 0. Going to the next request On Wed, May 20, 2009 at 2:39 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > >>> The steps you took show that you are NOT following the guide. > >>> Good luck. You clearly are *not* interested in solving the problem. > > > > the guide in radiusd.conf says: > > #The server has proxying turned on by default. If your system is NOT > > # set up to proxy requests to another server, then you can turn proxying > > # off here. This will save a small amount of resources on the server. > > I tried to read carefully with undrestanding, I dont use proxy, my system > > not sending request to another server, so I turned it off. > > You might not want to, but you *are* proxying your requests. You have > created client certificate with predefined data in client.cnf - which is > part of the proxy demonstration setup. So, leave proxy settings alone and > concentrate on doing what you have been advised - changing data in > client.cnf so created client certificate won't have @example.com as part > of the username. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

insert something into reply message
by Lajos Meszaros 21 May '09

21 May '09

Version 2.0.4 We use "digest" authentication. It works properly. (with a little problem I will ask in another thread) The essential part of the debug: Thu May 21 09:41:17 2009 : Debug: ++[digest] returns ok Thu May 21 09:41:17 2009 : Auth: Login OK: [599(a)10.14.2.10/<via Auth-Type = DIGEST>] (from client 10.14.1.5 port 0 cli 599(a)10.14.2.10) The reply message get at "client 10.14.1.5" but our system expects in the reply the "Session-Timeout". How to insert "Session-Timeout" into the reply message? I've read thoughtfully all parts of the configs where that parameter is mentioned. I've tried many - syntactically good an bad - config line without any success. Have I problem with reading? Ludwig M.

3 2

Interim Accouting
by Ming-Ching Tiew 21 May '09

21 May '09

May I know the common practise of radius accounting, it is common to expect the radius client to provide "interim" accounting, ie it sends accounting info every so many seconds interval before the session is closed ? I just checked Coova chilli, it does it for the clients session based on a configurable interval. But for the administrative account of the NAS itself, it does not do any interim accounting. Please comment. Regards.

4 3

Re: insert something into reply message
by Lajos Meszaros 21 May '09

21 May '09

>Post the output of radiusd -X and your user entry. The relevant part of the freeradius output is: ----------------------------------- rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "tequet" Digest-Nonce = "4a1527742cb58a911390a13daeab535c71b92a74" Digest-URI = "sip:" Digest-Method = "INVITE" Digest-CNonce = "1242900340" Digest-Nonce-Count = "00000001" Digest-QOP = "auth" Digest-User-Name = "user8" A1 = user8:tequet:pass8 A2 = INVITE:sip: H(A1) = 1a2bb1fd4713741dbc8dcd841b2754c5 H(A2) = 4c2df2005737eb44dbf0c9993285dc46 KD = 1a2bb1fd4713741dbc8dcd841b2754c5:4a1527742cb58a911390a13daeab535c71b92a74:00000001:1242900340:a uth:4c2df2005737eb44dbf0c9993285dc46 EXPECTED 10c0611670df125d841de06019a0ecd7 RECEIVED 10c0611670df125d841de06019a0ecd7 ++[digest] returns ok Login OK: [599(a)10.14.2.10/<via Auth-Type = DIGEST>] (from client 10.14.1.5 port 0 cli 599(a)10.14.2.10 ) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 199 to 10.14.1.5 port 40646 Finished request 0. Going to the next request -------------------------------------- The end of the "users" file (its other part is unchanged) --------------------------------------- user0 Cleartext-Password := "pass0" "user8" Cleartext-Password := "pass8" "599(a)10.14.2.10" Cleartext-Password := "pass8" ------------------------------------- Ludwig M.

1 0

Sql Counter reads only the first 4 digits
by Mauro Iorio - Smart Soft s.r.l. 21 May '09

21 May '09

Hi all, I've a strange problem with sql counter on freeradius both 1.1.7 and 2.1.5 versions. Actually executing SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' from SQL Server Management Studio gives me 294841 (Yes, that's a lot of seconds, is a test user) while the output of radiusd -X (ver 2.1.5) is: ------------------------------------ rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{ User-Name}'' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNam e='mauro' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserNa me='mauro'}' [sessioncounter] sql_xlat [sessioncounter] expand: %{User-Name} -> mauro [sessioncounter] sql_set_user escaped user --> 'mauro' [sessioncounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE U serName='mauro' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='maur o' [sessioncounter] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log /radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 query: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='mauro' [sessioncounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [sessioncounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct W HERE UserName='mauro'} -> 2948 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user mauro, check_item=3600, counter=2948 rlm_sqlcounter: Sent Reply-Item for user mauro, Type=Session-Timeout, value=652 ++[sessioncounter] returns ok ------------------------------------ That's' totally wrong since 294841 is much bigger than 3600 and not smaller... And this happens with users from different groups and with different SUM(AcctSessionTime). *Every* time SUM(AcctSessionTime) is bigger than 9999 it looses the fifth digit of the response, better it looses every digits after the fourth!!! What's wrong??? I'd appreciate any help or ideas. This happens on two different Slackware 12.1 and 12.2 machines both with freeradius 1.1.7 and a Slackware 12.2 with freeradius 2.1.5 Mauro Iorio.

4 11

Realms issues
by EMP 21 May '09

21 May '09

Hi all I have an issue where i'm trying to use realms to determine what LDAP server to authenticate a user against. What seems to happen is that the realm in my users file is never matched and hence the authentication fails. Any help would be greatly appreciated. My users file is - DEFAULT Realm == "NULL", Auth-Type := ldap-default, Autz-Type := ldap-default DEFAULT Realm == "test.com", Auth-Type :=test.com, Autz-Type := test.com DEFAULT Auth-Type := Reject my proxy.conf has the following - realm test.com { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } The radius.conf is - prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = /etc/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run log_file = ${logdir}/radiusd.log pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd libdir = /usr/lib/freeradius max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 256 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 1 max_servers = 4 min_spare_servers = 1 max_spare_servers = 3 max_requests_per_server = 0 } modules { pap { #auto_header = yes encryption_scheme = crypt } chap { authtype = CHAP } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes authtype = MS-CHAP # with_ntdomain_hack = yes } files { usersfile = ${confdir}/users compat = no } ### Added ldap test.com { server = "ldap1.test.com" #port = 389 port = 636 identity = "cn=xxxx" password = "xxx" basedn = "o=xxx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" tls_mode = yes tls_cacertfile = /etc/raddb/certs/cert.b64 tls_cacertdir = /etc/raddb/certs/ dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = yes password_attribute = nspmPassword } ldap ldap-default { server = "ldap1.test.com" #port = 389 port = 636 identity = "cn=xxxl" password = "xxx" basedn = "o=xxx" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" tls_mode = yes tls_cacertfile = /etc/raddb/certs/cert.b64 tls_cacertdir = /etc/raddb/certs/ dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = yes password_attribute = nspmPassword } ### // realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } ### Added Auth-Type test.com { test.com } Auth-Type ldap-default { ldap-default } ### // eap } authorize { chap mschap eap files ### Added Autz-Type test.com { test.com } Autz-Type ldap-default { ldap-default } ### // } post-auth { ldap-default Post-Auth-Type REJECT { ldap-default } } I then see the following - rad_recv: Access-Request packet from host xxx:40485, id=38, length=63 User-Name = "auto(a)test.com" User-Password = "xx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 9 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [auto(a)test.com/xxx] (from client xxx port 0) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 2 modcall[post-auth]: module "ldap-default" returns noop for request 2 modcall: leaving group REJECT (returns noop) for request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list ---

2 1

Re: Interim Accounting
by Ming-Ching Tiew 21 May '09

21 May '09

--- On Thu, 5/21/09, Ivan Kalik <tnt(a)kalik.net> wrote: > > > I just checked Coova chilli, it does it for the > clients session > > based on a configurable interval. But for the > administrative > > account of the NAS itself, it does not do any interim > > accounting. > > Why on Earth would it? Are you going to charge > administrators for using > your equipment? Or do you actually pay them to do that? > I did not say it does not make sense, did I ? I just put forward my observations. :) However, now that you are talking about it, I think it's not totally unreasonable to want to get accounting update on the 'administrator' account. There maybe cases where the accounting need to be done on ensamble basis of the traffic coming in/out of the whole box. Any agreement or objection ? :)

1 0

FreeRADIUS 2.1.6 RPM's for Fedora, RHEL 5, CentOS 5
by John Dennis 20 May '09

20 May '09

The new 2.1.6 FreeRADIUS has been built into a set of RPM's for Fedora, RHEL 5, and CentOS 5. For Fedora the rpm's are in the updates-testing repository for F-9 and F-10. The next release of Fedora is F-11 and is due out shortly, it is currently in the process of being composed for release and is locked preventing updates. F-11 still has the 2.1.3 version, but as soon as F-11 is released and the update channel opens for F-11 I will push a 2.1.6 update for F-11. The updates will likely stay in testing for two weeks, if there are no problems they'll be promoted to stable. Feedback on the Fedora 2.1.6 updates is welcome, this helps determine if the packages can be promoted to stable. Please report your experience with the package at the Fedora updates site: https://admin.fedoraproject.org/updates/search/freeradius Locate the package you installed, click on it, scroll to the bottom and add a comment. As promised current pre-built FreeRADIUS RPM's are now available for download on a tech preview basis, refer to the information here: http://wiki.freeradius.org/Red_Hat_FAQ The download site is: http://people.redhat.com/jdennis/freeradius-rhel-centos -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

RE: Freeradius-Users Digest, Vol 49, Issue 93
by Ivan Kalik 20 May '09

20 May '09

> >>What does that mean? IP of the original NAS packet? > > I have 2 interfaces towards the network. > > ____________________________________________________________________________ > Radius Client --> Radius Proxy > 192.168.1.2 192.168.1.3 192.168.14.3 --> IPS1(192.168.14.4) > 192.168.24.3 --> IPS2(192.168.24.4) > ____________________________________________________________________________ > > Steps: > 1)Radius Client ---> Send packet with NAS-IP-Address = 192.168.1.2 > towards Radius Proxy. > 2)Radius Proxy changes NAS-IP-Address with 192.168.14.3 for IPS1(or > 192.168.24.3 for IPS2) and sends it. > > > You say that changing NAS-IP-Address the packet is transmitted correctly. > Right? > > From 192.168.14.3 to IPS1(192.168.14.4) if NAS-IP-Address = > 192.168.14.3 > From 192.168.24.3 to IPS1(192.168.24.4) if NAS-IP-Address = > 192.168.24.3 > Yes. Proxy server will change NAS-IP-Address from the original NAS address into it's own. That is OK. >> That's in internal attribute Packet-Src-IP-Address. > > Should I modify this attribute or FreeRadius associates > Packet-Src-IP-Address = NAS-IP-Address. No, Packet-Src-IP-Address has the originating IP address for the radius packet (in your case it will be 192.168.1.2). If ISP needs to know the original NAS IP they should look in Packet-Src-IP-Address. Ivan Kalik Kalik Informatika ISP

1 0

question about windows users
by Bartosz Chodzinski 20 May '09

20 May '09

Hi, I have freeradius with eap support on debian etch, radius v1.1.3 "everthing" working fine but I'd like to have much more simple configuration only by certificate and nothing more, so I have few question: 1. fragment of my log first, before question Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206:1812, id=182, length=159 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "PC-01\\Administrator" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001b014e4c504c2d4943455c41646d696e6973747261746f72 Message-Authenticator = 0xe0b4e2966553f890137d9e56bebd0b3d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "PC-01\Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 my users file contain: "PC-01\\Administrator" User-Password == "passwd" how can I avoid this value PC-01 ?, its really annoying, I would like to have only real user, PC-01 is "my computer -> properties -> computer name -> full computer name". I would like to have only username (with no matter of case sensitive). sth like "administrator" User-Password == "passwd" 2. I would like to use only certificate to check wheter or not some computer should have network connection, I dont care about login or password, if client has a valid cacert.pem installed on pc (windows xp) it should grant acces to network, is it possible to do that? I tried do sth like: users: DEFAULT Auth-Type := Accept but it didn't work the perfect way for me is possiblity to set up something in radiusd.conf and live file users empty 3. when I read log from freeradius -X I see that one pc need to have 7requests in freeradius and in 8-th request is accepted, is it ok? modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 193 to 192.168.5.206 port 1812 MS-MPPE-Recv-Key = 0xc349694508a365a56e56e085069e36270cb13b60c3cc7847129b2386a7062dde MS-MPPE-Send-Key = 0xf93f6de4f455056df7f1d88aa3d12a26cd1a71994fdf6c31bb726612eaf2f038 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "PC-01\\Administrator" Finished request 8 ----------------------------------------------- my configuration files: eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/freeradius/eap/newkey.pem certificate_file = /etc/freeradius/eap/newcert.pem CA_file = /etc/freeradius/eap/eapCA/cacert.pem dh_file = /etc/freeradius/eap/dh random_file = /etc/freeradius/eap/random fragment_size = 1024 include_length = yes check_crl = no } peap { default_eap_type = mschapv2 } mschapv2 { } } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = freerad group = freerad max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

4 43