- Freeradius-Users - lists.freeradius.org

Help with LDAP groupOfNames?
by Jason Antman 08 Apr '09

08 Apr '09

Sorry to re-post, but I'm still banging my head against the wall with this... If anyone could help, or provide a pointer to something that (obviously) I'm missing, it would be greatly appreciated. Hi, I've googled this to no avail (have been working on it for about 4 hours now). I'm running FreeRADIUS 1.1.0 (SuSE package) and OpenLDAP 2.3.19. I have an access point that will do captive portal, but only via RADIUS, not via LDAP natively. I already have an LDAP server running, so I just added a new groupOfNames called "WirelessUsers". Basically, *all* I want RADIUS to do is check the username and password, and assuming they are correct, either allow or deny based on whether the user is a member of "WirelessUsers". According to radtest, I have it working with LDAP, but it allows everyone with a valid username and password access, regardless of the WirelessUsers group - and I'm not seeing anything related to that group in the LDAP logs. I can't seem to find anything online for freeradius1 relating to groupOfNames, so I've just been trying random things that I found online (for raddb/users) hoping one would work. radiusd.conf: ldap { server = "127.0.0.1" basedn = "dc=example,dc=com" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) groupmembership_attribute = "memberof" timeout = 4 timelimit = 3 net_timeout = 1 } users: #DEFAULT Auth-Type == LDAP # Fall-Through = Yes DEFAULT LDAP-Group == "WirelessUsers" Auth-Type := Reject #DEFAULT Ldap-Group != "WirelessUsers", Auth-Type := Reject # Reply-Message = "Sorry, your account has not yet been enabled for wireless access." #DEFAULT Huntgroup-Name == "wirelessusers", Ldap-Group=="WirelessUsers", Auth-Type = LDAP #DEFAULT Auth-Type := Reject #DEFAULT Ldap-Group == "WirelessUsers" # Fall-Through = no DEFAULT Ldap-Group == WirelessUsers Fall-Through = no DEFAULT Auth-Type := Reject I've tried all of the commented out stuff also, and none of it worked. All I want is (assuming username & password are correct) allow anyone who is in "WirelessUsers" group, deny everyone else. I'm sure this is horribly simple, but I just can't seem to figure it out from the docs or from extensive googling. Thanks for any help, Jason Antman

2 1

Redundant Load Balanced LDAP authentication fails when Primary is down
by Allers, Justin 08 Apr '09

08 Apr '09

Hello, I have two freeradius v2.1.3-1 servers setup to run with redundant load balancing with two Windows Active Directory LDAP servers for authentication. When the LDAP servers are running the radius will load-balance between them and authenticate fine. If I shut the primary LDAP server down radius doesn't authenticate properly against the second LDAP server. I have tested the secondary LDAP as the the primary in the radius configuration and it works fine. If I change the radius config to have a bogus primary name it will then authenticate with the secondary fine. But when it has the correct name and the primary is down the authentication fails. I believe it may have something to do with ntlm_auth but I don't understand why as in the other test instances with the bogus name it works. Below is the LDAP portion of my server along with a part of the debug of what happens when I shutdown the primary LDAP server. If anyone has any suggestions it would be much appreciated. Thank you, Justin Radius.conf ************************************************************************************************* ldap ds-01 { server = "ldap1.domain.org" port = 3268 identity = " bob(a)domain.org " password = "****" basedn = "dc=domain,dc=org" filter = "(sAMAccountname=%{mschap:User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf } ldap ds-02 { server = "ldap2.domain.org" port = 3268 identity = "****" password = "****" basedn = "dc=domain,dc=org" filter = "(sAMAccountname=%{mschap:User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf } instantiate { exec expr expiration logintime redundant-load-balance redundant_ldap { ds-01 ds-02 } } **************************************************************************************************** Debug file portion that points to ntlm_auth (as you can see the redundancy works except the ms-chap portion) **************************************************************************************************** ++- entering redundant-load-balance group redundant_ldap {...} [ds-01] performing user authorization for DoeJ [ds-01] expand: (sAMAccountname=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountname=DoeJ) [ds-01] expand: dc=domain,dc=org -> dc=domain,dc=org rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.domain.org:3268, authentication 0 rlm_ldap: bind as bob(a)domain.org/**** to ldap1.domain.org:3268 rlm_ldap: bob(a)domain.org bind to ldap1.domain.org:3268 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed [ds-01] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ds-01] returns fail [ds-02] performing user authorization for DoeJ [ds-02] expand: (sAMAccountname=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountname=DoeJ) [ds-02] expand: dc=domain,dc=org -> dc=domain,dc=org rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=org, with filter (sAMAccountname=DoeJ) [ds-02] looking for check items in directory... [ds-02] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ds-02] user DoeJ authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ds-02] returns ok ++- redundant-load-balance group redundant_ldap returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for DoeJ with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{mschap:User-Name}} -> --username=DoeJ [mschap] mschap2: 4d [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=92aa0495d9c105f7 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ab395391ee828796a6b2458cf767e8fa87eb8530457f7b67 Exec-Program output: No logon servers (0xc000005e) Exec-Program-Wait: plaintext: No logon servers (0xc000005e) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [domain\\DoeJ] (from client switch-man-lan port 0 via TLS tunnel) ****************************************************************************************************

2 1

Authorization question
by Larry Ross 07 Apr '09

07 Apr '09

Hello all :) So after getting my testing box current with FR 2.1.5 I have my config 97% there, but I am having a interesting situation occur that I am hoping is fairly straight forward. Overview of config. User accounts authenticated against Kerberos KDC (Working 100%) User Account Attributes held in LDAP, LM Hash for PEAP, Blacklist (if you are in there you are denied) (working 100%) I cannot inject values into LDAP, would like to but cannot... So all that is left is a little authorization work. In my passwd module I have the following. (made sense to have the group name appear as if it came from the authenticator... hence the ~) passwd noc_group { filename = /usr/local/etc/raddb/group format = "~Group-Name:*,User-Name" hashsize = 50 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } the "Group" file is formatted NOC:Usernamea,Usernameb etc Here is where I get a touch lost. The noc_group section appears to be working, when I look at the debug output it is properly finding the usernames in the list and reports [noc_group] Added Group-Name: 'NOC' to request_items ++[noc_group] returns ok Now where to go from here... Let me start by where I would like to go... I would like to have a block of vendor specific radius attributes sent back in the access accept (assuming they passed authentication...) This way when folks log into network devices they are granted the correct level of access (like with our switches... Some people are granted read only access to verify certain aspects, and admins who get read write, so while I am starting with the admin group there will be other groups with different vendor specific attr's I would like to have sent for them.) I am assuming unlang will be the way to go however when I attempt to utilize this method I fail (Radius will not start as currently I am simply trying to append a Reply message when NOC-Group scores a hit. I have tried this in the post-auth section within default in sites-enabled. if (%{request:Group-Name} == "NOC") { Reply-Message = 'Noc-Group Match' } I receive "Unknown action 'NOC-Group Match' and radius does not load. (Error Initializing Modules) So where should I be placing the unlang code and what parameters does it understand and can pass to and from the daemon. Thank you Larry

2 3

Proxy everything but eap-md5 via Unlang?
by Stephen Bowman 07 Apr '09

07 Apr '09

Is there a way to match on the EAP type in unlang? I need to be able to proxy everything except incoming eap-md5 requests (which need to be handled remotely).

2 1

Multiple sessions with same session_id
by Clare Scally 07 Apr '09

07 Apr '09

Hi, We are currently moving from Cistron Radius on Freebsd 6.2 to Freeradius 2.0.5 on Freebsd 6.2. We have 2 freeradius servers and 1 Cistron server on our live network. On our Dial up system, on Cistron records 1 Start/ 1 Stop per Acct-Session-ID sent from a NAS. On Freeradius 2.0.5 it seems that the same session can have multiple Starts and Stops against one Acct-Session-ID. Is this normal behaviour and should these multiple tickets with the same session be recorded as 1 session? We have both running con currently and are seeing the multiplte Starts/Stops only on the Freeradius setup. There have been no configuration changes to the NAS to create the extra tickets. I have looked for documentation on this but cannot find any answers so if anyone can point me to documentation or confirm or deny that this is normal in Freeradius. Thanks, Clare Scally, Eircom, Senior System Administrator, ISP Hosting & Managed Services, Internet House, Temple Bar, Dublin 2 Tel: 01-7010911 Mob: 085-1744297

2 1

problem with rlm_dbm_parser and DEFAULT Realms
by Seamus Bridgeman 07 Apr '09

07 Apr '09

Using freeradius2.1.3 and rlm_dbm module Having a problem with rlm_dbm_parser to create dbm file. Testing with 3 DEFAULT Realm records and two username/password. Seems to be overwriting DEFAULT Realm as only last one exists. rlm_dbm_parser reports all records read and no errors but rlm_dbm_cat shows only last Default. radclient tests naturally only succeed with DEFAULT domain_three Is there a know issue here on creating dbm files or have I missed some setting to allow multiple DEFAULT Realm=xxx records in dbm file. Desired approach is - dbm file with large numbers of DEFAULT Realm and all with no fallthru. - we have no other (catch-all) DEFAULTs with explicit accept or reject - ideally usernames matching these realms (proxy.conf) and DEFAULT Realm should respond with Accept straight away - no searching full subscriber base dbm file and then DEFAULT match. (e.g treat DEFAULT Realm =xxx as distinct from generic DEFAULT) - ideally have DEFAULT Realm=xxx be read in to hash/memory from separate file and DBM users just have subscriber base (user/pass). This way every time users.db updated/re-created/re-read - does not impact DEFAULT Realm=xxx records. The later Realms more static - subscriber base changes more dynamic. - Also using dbm as faster/ less memory resources and no need to restart radiusd as dbm files change - and do change constantly.. This possible? Logs below: Test users file -------------------- DEFAULT Realm == "domain_one", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm1", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 DEFAULT Realm == "domain_two", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm2", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 DEFAULT Realm == "domain_three", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm3", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 userone@one Cleartext-Password := "pass" Class = "xxxclass1xxx", Service-Type = Framed-User, Framed-Protocol = PPP usertwo@norealm Cleartext-Password := "pass", Calling-Station-Id == "123456" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.10.10.0, Framed-IP-Netmask = 255.255.255.240, ------------------------------------------------------------------ rlm_dbm_parser logs: %% # /usr/local/freeradius/bin/rlm_dbm_parser -c -xxx -i /usr/local/freeradius/etc/raddb/users_generic -o /usr/local/freeradius/etc/raddb/users Use dictionary in: /usr/local/freeradius/etc/raddb Found user: DEFAULT Found user: DEFAULT Found user: DEFAULT Found user: userone@one Found user: usertwo@norealm Record loaded: 5 Lines parsed: 41 Record skiped: 0 Warnings: 0 Errors: 0 %%# rlm_dbm_cat logs - only shows last DEFAULT Realm ------------------------------ %% # /usr/local/freeradius/bin/rlm_dbm_cat -f /usr/local/freeradius/etc/raddb/users DEFAULT Realm == "domain_three", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm3", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 userone@one Cleartext-Password := "pass" Class = "xxxclass1xxx", Service-Type = Framed-User, Framed-Protocol = PPP usertwo@norealm Cleartext-Password := "pass", Calling-Station-Id == "123456" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.10.10.0, Framed-IP-Netmask = 255.255.255.240 %%# ----------------------- Havent included radiusd -X logs as issue seems to be creating dbm file and hence before using Radius. radclient tests are successful when matching 3 records that do exit in dbm file. Problem is two missing records

2 3

EAP Outer and Inner Tunnel Behaviour Discussion
by Jacky Chan 07 Apr '09

07 Apr '09

Hi all, We are going to proxy EAP to another site with all freeradius (we are using 2.1.4, another site using 1.x), but there are some interest problems occurred, details are as follows: Our site only accept non “@domain” format for inner EAP tunnel authentication since user DB only store user name without suffix, (as I previous post, replier said that cannot change the EAP user name by terminal home server even using unlang or strip on proxy.conf, so I give up to chanage the inner EAP user name in our terminal home radius). But the administrator of another site which connect with us said that their user name store in file/DB also non suffix but can using “@domain” to pass the EAP/mschapv2 authentication with “stripped-user-name”, I’m not sure how and why, but after testing, I can using anonymous(a)aaa.net as user name of outer EAP tunnel and user1(a)aaa.net as user name of inner EAP tunnel to pass the authentication, and then I try to remove the “suffix from inner EAP user name“ or change the “outer user name” in client EAP supplicant (in our site change outer user name is accept, you can use any outer user name since proxy server only care suffix) , it get fail, so do you think that how about the user name actually store in another site DB, is it without suffix or with it? But if it is all without suffix, why I cannot login with non suffix user name of inner EAP tunnel? And how can remove the suffix in inner EAP tunnel while authentication? Or all account have suffix in another site DB. -- View this message in context: http://www.nabble.com/EAP-Outer-and-Inner-Tunnel-Behaviour-Discussion-tp229… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Problem with rlm_perl
by Волошин Вячеслав 07 Apr '09

07 Apr '09

Hello. Config: perl auth_perl_pppoe { module = /var/www/radius/radius_auth.pl func_accounting = accounting } perl acc_perl_pppoe { module = /var/www/radius/radius_accounting.pl func_authenticate = authenticate } ----------------------------------------------------------------- authenticate { Auth-Type PPPOE_AUTH { auth_perl_pppoe } } # # Accounting. Log the accounting data. # accounting { Acct-Type PPPOE_ACC { acc_perl_pppoe } detail unix radutmp } this error in radiusd -X: rad_recv: Access-Request packet from host 93.95.41.141 port 53773, id=8, length=146 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" CHAP-Challenge = 0x3b30fc1959ca610275bdc66582b579cf CHAP-Password = 0x013e0573332525cd3ebc797dbe68f0969d NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "pppoe_test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[mschap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry DEFAULT at line 7 [files] users: Matched entry DEFAULT at line 19 ++[files] returns ok ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = PPPOE_AUTH +- entering group PPPOE_AUTH {...} GOT CLONE -1209066800 0x91011d8 rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair CHAP-Password = 0x013e0573332525cd3ebc797dbe68f0969d rlm_perl: Added pair Huntgroup-Name = ntk_pppoe rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = internet rlm_perl: Added pair Calling-Station-Id = 00:13:77:60:60:CB rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = pppoe_test rlm_perl: Added pair CHAP-Challenge = 0x3b30fc1959ca610275bdc66582b579cf rlm_perl: Added pair NAS-Identifier = ntk-hsgw rlm_perl: Added pair NAS-IP-Address = 93.95.41.141 rlm_perl: Added pair NAS-Port = 100 rlm_perl: Added pair NAS-Port-Id = e2_v15 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Class = dialup rlm_perl: Added pair Mikrotik-Rate-Limit = 256k rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Auth-Type = PPPOE_AUTH ++[auth_perl_pppoe] returns ok Login OK: [pppoe_test] (from client ntk-hsgw port 100 cli 00:13:77:60:60:CB) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 8 to 93.95.41.141 port 53773 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6469616c7570 Mikrotik-Rate-Limit = "256k" Framed-Compression = Van-Jacobson-TCP-IP Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 93.95.41.141 port 57551, id=9, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" Class = 0x6469616c7570 Acct-Session-Id = "8170005c" Framed-IP-Address = 93.95.42.63 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2009 17:07:22 MSD" Acct-Status-Type = Start NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 100,Client-IP-Address = 93.95.41.141,NAS-IP-Address = 93.95.41.141,Acct-Session-Id = "8170005c",User-Name = "pppoe_test"' [acct_unique] Acct-Unique-Session-ID = "de65ab6044a69020". ++[acct_unique] returns ok [files] acct_users: Matched entry DEFAULT at line 29 ++[files] returns ok Found Acct-Type PPPOE_ACC +- entering group PPPOE_ACC {...} rlm_perl: perl_embed:: module = /var/www/radius/radius_accounting.pl , func = accounting exit status= Undefined subroutine &main::accounting called. Use of uninitialized value. rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Acct-Session-Id = 8170005c rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Acct-Unique-Session-Id = de65ab6044a69020 rlm_perl: Added pair Called-Station-Id = internet rlm_perl: Added pair Acct-Authentic = RADIUS rlm_perl: Added pair Acct-Status-Type = Start rlm_perl: Added pair NAS-IP-Address = 93.95.41.141 rlm_perl: Added pair NAS-Port-Id = e2_v15 rlm_perl: Added pair Huntgroup-Name = ntk_pppoe rlm_perl: Added pair Calling-Station-Id = 00:13:77:60:60:CB rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = pppoe_test rlm_perl: Added pair Event-Timestamp = Apr 7 2009 17:07:22 MSD rlm_perl: Added pair NAS-Identifier = ntk-hsgw rlm_perl: Added pair Framed-IP-Address = 93.95.42.63 rlm_perl: Added pair Class = 0x6469616c7570 rlm_perl: Added pair NAS-Port = 100 rlm_perl: Added pair Acct-Delay-Time = 0 rlm_perl: Added pair Acct-Type = PPPOE_ACC ++[acc_perl_pppoe] returns reject Finished request 1. Cleaning up request 1 ID 9 with timestamp +8 Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 93.95.41.141 port 57551, id=9, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" Class = 0x6469616c7570 Acct-Session-Id = "8170005c" Framed-IP-Address = 93.95.42.63 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2009 17:07:22 MSD" Acct-Status-Type = Start NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 Acct-Delay-Time = 4 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 100,Client-IP-Address = 93.95.41.141,NAS-IP-Address = 93.95.41.141,Acct-Session-Id = "8170005c",User-Name = "pppoe_test"' [acct_unique] Acct-Unique-Session-ID = "de65ab6044a69020". ++[acct_unique] returns ok [files] acct_users: Matched entry DEFAULT at line 29 ++[files] returns ok Found Acct-Type PPPOE_ACC +- entering group PPPOE_ACC {...} rlm_perl: perl_embed:: module = /var/www/radius/radius_accounting.pl , func = accounting exit status= Undefined subroutine &main::accounting called. Segmentation fault But accounting exist in /var/www/radius/radius_accounting.pl. Why it? Formula+ LTD, т.(8617) 61-02-01 ф.(8617) 61-34-16 м.(918) 634-7550 voloshin(a)maks.net www.formulaplus.ru

2 3

mrtg module for FreeRADIUS
by Tseveendorj 07 Apr '09

07 Apr '09

Hello, Does FreeRADIUS have mrtg module for monitoring bandwidth usage? Sincerely, Tseveen.

4 3

Problem with rlm_perl
by Волошин Вячеслав 07 Apr '09

07 Apr '09

Hello. Config: perl auth_perl_pppoe { module = /var/www/radius/radius_auth.pl func_accounting = accounting } perl acc_perl_pppoe { module = /var/www/radius/radius_accounting.pl func_authenticate = authenticate } ----------------------------------------------------------------- authenticate { Auth-Type PPPOE_AUTH { auth_perl_pppoe } } # # Accounting. Log the accounting data. # accounting { Acct-Type PPPOE_ACC { acc_perl_pppoe } detail unix radutmp } this error in radiusd -X: rad_recv: Access-Request packet from host 93.95.41.141 port 53773, id=8, length=146 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" CHAP-Challenge = 0x3b30fc1959ca610275bdc66582b579cf CHAP-Password = 0x013e0573332525cd3ebc797dbe68f0969d NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "pppoe_test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[mschap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry DEFAULT at line 7 [files] users: Matched entry DEFAULT at line 19 ++[files] returns ok ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = PPPOE_AUTH +- entering group PPPOE_AUTH {...} GOT CLONE -1209066800 0x91011d8 rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair CHAP-Password = 0x013e0573332525cd3ebc797dbe68f0969d rlm_perl: Added pair Huntgroup-Name = ntk_pppoe rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = internet rlm_perl: Added pair Calling-Station-Id = 00:13:77:60:60:CB rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = pppoe_test rlm_perl: Added pair CHAP-Challenge = 0x3b30fc1959ca610275bdc66582b579cf rlm_perl: Added pair NAS-Identifier = ntk-hsgw rlm_perl: Added pair NAS-IP-Address = 93.95.41.141 rlm_perl: Added pair NAS-Port = 100 rlm_perl: Added pair NAS-Port-Id = e2_v15 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Class = dialup rlm_perl: Added pair Mikrotik-Rate-Limit = 256k rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Auth-Type = PPPOE_AUTH ++[auth_perl_pppoe] returns ok Login OK: [pppoe_test] (from client ntk-hsgw port 100 cli 00:13:77:60:60:CB) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 8 to 93.95.41.141 port 53773 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6469616c7570 Mikrotik-Rate-Limit = "256k" Framed-Compression = Van-Jacobson-TCP-IP Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 93.95.41.141 port 57551, id=9, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" Class = 0x6469616c7570 Acct-Session-Id = "8170005c" Framed-IP-Address = 93.95.42.63 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2009 17:07:22 MSD" Acct-Status-Type = Start NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 100,Client-IP-Address = 93.95.41.141,NAS-IP-Address = 93.95.41.141,Acct-Session-Id = "8170005c",User-Name = "pppoe_test"' [acct_unique] Acct-Unique-Session-ID = "de65ab6044a69020". ++[acct_unique] returns ok [files] acct_users: Matched entry DEFAULT at line 29 ++[files] returns ok Found Acct-Type PPPOE_ACC +- entering group PPPOE_ACC {...} rlm_perl: perl_embed:: module = /var/www/radius/radius_accounting.pl , func = accounting exit status= Undefined subroutine &main::accounting called. Use of uninitialized value. rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Acct-Session-Id = 8170005c rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Acct-Unique-Session-Id = de65ab6044a69020 rlm_perl: Added pair Called-Station-Id = internet rlm_perl: Added pair Acct-Authentic = RADIUS rlm_perl: Added pair Acct-Status-Type = Start rlm_perl: Added pair NAS-IP-Address = 93.95.41.141 rlm_perl: Added pair NAS-Port-Id = e2_v15 rlm_perl: Added pair Huntgroup-Name = ntk_pppoe rlm_perl: Added pair Calling-Station-Id = 00:13:77:60:60:CB rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = pppoe_test rlm_perl: Added pair Event-Timestamp = Apr 7 2009 17:07:22 MSD rlm_perl: Added pair NAS-Identifier = ntk-hsgw rlm_perl: Added pair Framed-IP-Address = 93.95.42.63 rlm_perl: Added pair Class = 0x6469616c7570 rlm_perl: Added pair NAS-Port = 100 rlm_perl: Added pair Acct-Delay-Time = 0 rlm_perl: Added pair Acct-Type = PPPOE_ACC ++[acc_perl_pppoe] returns reject Finished request 1. Cleaning up request 1 ID 9 with timestamp +8 Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 93.95.41.141 port 57551, id=9, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" Class = 0x6469616c7570 Acct-Session-Id = "8170005c" Framed-IP-Address = 93.95.42.63 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2009 17:07:22 MSD" Acct-Status-Type = Start NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 Acct-Delay-Time = 4 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 100,Client-IP-Address = 93.95.41.141,NAS-IP-Address = 93.95.41.141,Acct-Session-Id = "8170005c",User-Name = "pppoe_test"' [acct_unique] Acct-Unique-Session-ID = "de65ab6044a69020". ++[acct_unique] returns ok [files] acct_users: Matched entry DEFAULT at line 29 ++[files] returns ok Found Acct-Type PPPOE_ACC +- entering group PPPOE_ACC {...} rlm_perl: perl_embed:: module = /var/www/radius/radius_accounting.pl , func = accounting exit status= Undefined subroutine &main::accounting called. Segmentation fault But accounting exist in /var/www/radius/radius_accounting.pl. Why it? Formula+ LTD, т.(8617) 61-02-01 ф.(8617) 61-34-16 м.(918) 634-7550 voloshin(a)maks.net www.formulaplus.ru

1 0