- Freeradius-Users - lists.freeradius.org

Problem with account multiplication in radacct
by tg_melo＠bol.com.br 04 Jul '08

04 Jul '08

Hi again, I solved the last trouble with ippool.db using the sqlippool instead. But I got a new shining problem. :) Now, almost everything seems to be working fine. Almost, cause I have some account multiplication in the radacct table. Only a few users are doing that. And the multiplication doesn't stop while the users remain logged on. Only a few appear in table, I'm using an unique index with acctstarttime and nasipaddress. And the numbers of radacctid jump a lot (from 1400 to 4000, for example). I'm using also the set rad_alive 40 in ppp.conf and in the radiusd.conf, cleanup_delay 8 and max_request_time 50. All that with chap authentication. Select on one of the users who get the problem: +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | naspor tid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ | 14419 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:31 | NULL | 0 | | | | 0 | 0 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | 0 | | | 14421 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:34 | NULL | 40 | | | NULL | 31795 | 102873 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | NULL | | | 14424 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:37 | NULL | 80 | | | NULL | 59226 | 215383 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | NULL | | +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ Radius log exact when the problem starts: 74242 Fri Jul 4 03:40:25 2008 : Info: Ready to process requests. 74243 Fri Jul 4 03:41:02 2008 : Info: Allocated IP: XXX.XXX.XXX.121 from valid (did cli 0 port 678 user x) 74244 Fri Jul 4 03:41:10 2008 : Info: Allocated IP: XXX.XXX.XXX.179 from valid (did cli 0 port 679 user x) 74245 Fri Jul 4 04:40:00 2008 : Info: Allocated IP: XXX.XXX.XXX.186 from valid (did cli 0 port 680 user x) 74246 Fri Jul 4 06:37:33 2008 : Info: Allocated IP: XXX.XXX.XXX.67 from valid (did cli 0 port 681 user x) 74247 Fri Jul 4 06:57:05 2008 : Info: Released IP XXX.XXX.XXX.67 (did cli 0 user x) 74248 Fri Jul 4 07:01:50 2008 : Info: Allocated IP: XXX.XXX.XXX.153 from valid (did cli 0 port 682 user x) 74249 Fri Jul 4 07:07:34 2008 : Info: Allocated IP: XXX.XXX.XXX.105 from valid (did cli 0 port 683 user x) 74250 Fri Jul 4 07:29:44 2008 : Info: Released IP XXX.XXX.XXX.186 (did cli 0 user x) 74251 Fri Jul 4 07:33:22 2008 : Info: Allocated IP: XXX.XXX.XXX.141 from valid (did cli 0 port 684 user x) 74252 Fri Jul 4 08:06:53 2008 : Info: Allocated IP: XXX.XXX.XXX.133 from valid (did cli 0 port 685 user x) 74253 Fri Jul 4 08:07:54 2008 : Info: Allocated IP: XXX.XXX.XXX.139 from valid (did cli 0 port 686 user x) 74254 Fri Jul 4 08:34:12 2008 : Info: Allocated IP: XXX.XXX.XXX.173 from valid (did cli 0 port 687 user x) 74255 Fri Jul 4 08:35:02 2008 : Info: Released IP XXX.XXX.XXX.133 (did cli 0 user x) 74256 Fri Jul 4 08:46:31 2008 : Info: Allocated IP: XXX.XXX.XXX.182 from valid (did cli 0 port 688 user user2) 74257 Fri Jul 4 08:47:11 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting ALIVE record - Duplicate entry '2008-07-0 08:46:31-XXX.XXX.XXX.252' for key 'radacct_whoson' 74258 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: Cannot store result 74259 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '2008-07-04 08:46:31-XXX.XXX.XXX.252' for ke 'radacct_whoson'' 74260 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: Cannot store result 74261 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '2008-07-04 08:46:31-XXX.XXX.XXX.252' for ke 'radacct_whoson'' 74262 Fri Jul 4 08:47:51 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting ALIVE record - Duplicate entry '2008-07-0 08:46:31-XXX.XXX.XXX.252' for key 'radacct_whoson' 74263 Fri Jul 4 08:47:51 2008 : Error: rlm_sql_mysql: Cannot store result And a tcpdump: Accounting Response (5), id: 0xb5, Authenticator: 3cffa31d3a8dd380caf25ceb110aca6c 08:46:27.957730 IP (tos 0x0, ttl 64, id 34131, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.62577 > XXX XXX.XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xce, Authenticator: 886040c74f1443cacfbed17841589bd9 Username Attribute (1), length: 14, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.141 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:27.962438 IP (tos 0x0, ttl 64, id 34132, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.62577: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xce, Authenticator: ffaf38da2a70212e3ce78afd032a525e 08:46:31.454218 IP (tos 0x0, ttl 64, id 34133, offset 0, flags [none], proto: UDP (17), length: 183) XXX.XXX.XXX.129.58869 > XXX .4XXX.XXX.129.1812: RADIUS, length: 155 Access Request (1), id: 0x1d, Authenticator: e44b21c5e2e38c76f6a119d317a157f5 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 CHAP Password Attribute (3), length: 19, Value: 0x0000: X [|radius] 08:46:31.459805 IP (tos 0x0, ttl 64, id 34134, offset 0, flags [none], proto: UDP (17), length: 63) XXX.XXX.XXX.129.1812 > XXX. XXX.XXX.129.58869: [udp sum ok] RADIUS, length: 35 Access Accept (2), id: 0x1d, Authenticator: c824b98efd857da27fa51a00998c3524 Filter ID Attribute (11), length: 9, Value: d256u96 0x0000: 6432 3536 7539 36 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X 08:46:31.482694 IP (tos 0x0, ttl 64, id 34135, offset 0, flags [none], proto: UDP (17), length: 208) XXX.XXX.XXX.129.60184 > XXX .XXX.XXX.129.1813: RADIUS, length: 180 Accounting Request (4), id: 0xc0, Authenticator: 0b59529ee5d6890d7c8800178b3566de Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:46:31.487710 IP (tos 0x0, ttl 64, id 34136, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.60184: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xc0, Authenticator: 399a20995afe01833bba61fb036795cf 08:46:34.244683 IP (tos 0x0, ttl 64, id 34143, offset 0, flags [none], proto: UDP (17), length: 72) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 46949+ A? dnl-us7.kaspersky-labs.com. (44) 08:46:34.244836 IP (tos 0x0, ttl 64, id 34144, offset 0, flags [none], proto: UDP (17), length: 88) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 46949 q: A? dnl-us7.kaspersky-labs.com. 1/0/0 dnl-us7.kaspersky-labs.com. A 195.200.84.5 (60) 08:46:34.955698 IP (tos 0x0, ttl 64, id 34154, offset 0, flags [none], proto: UDP (17), length: 64) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 249+ A? www.aresgalaxy.org. (36) 08:46:34.955849 IP (tos 0x0, ttl 64, id 34155, offset 0, flags [none], proto: UDP (17), length: 80) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 249 q: A? www.aresgalaxy.org. 1/0/0 www.aresgalaxy.org. A 66.98.222.3 (52) 08:46:48.279695 IP (tos 0x0, ttl 64, id 34183, offset 0, flags [none], proto: UDP (17), length: 247) XXX.XXX.XXX.129.55465 > XXX .XXX.XXX.129.1813: RADIUS, length: 219 Accounting Request (4), id: 0x8f, Authenticator: 12a34e1ff6be327bea5bf73a03a635af Username Attribute (1), length: 18, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.139 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] [|radius] 08:46:48.284459 IP (tos 0x0, ttl 64, id 34184, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.55465: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x8f, Authenticator: 2f2339fd34188a81f2d0a707623d217f 08:46:48.446680 IP (tos 0x0, ttl 64, id 34187, offset 0, flags [none], proto: UDP (17), length: 61) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 14077+ A? lan.startvg.com. (33) 08:46:48.446823 IP (tos 0x0, ttl 64, id 34188, offset 0, flags [none], proto: UDP (17), length: 77) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 14077 q: A? lan.startvg.com. 1/0/0 lan.startvg.com. A 74.55.200.146 (49) 08:46:49.446681 IP (tos 0x0, ttl 64, id 34200, offset 0, flags [none], proto: UDP (17), length: 60) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 12455+ A? w5.startvg.com. (32) 08:46:49.446865 IP (tos 0x0, ttl 64, id 34201, offset 0, flags [none], proto: UDP (17), length: 76) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 12455 q: A? w5.startvg.com. 1/0/0 w5.startvg.com. A 70.85.138.50 (48) 08:46:49.786702 IP (tos 0x0, ttl 64, id 34206, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.51839 > XXX .XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xb4, Authenticator: 3c8be7fa69dbb6607353d2ee04ab65f6 Username Attribute (1), length: 14, Value: user3 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.105 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:49.791404 IP (tos 0x0, ttl 64, id 34207, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.51839: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xb4, Authenticator: 2da35067aa3748f5f755e398f15b4139 08:46:50.629687 IP (tos 0x0, ttl 64, id 34234, offset 0, flags [none], proto: UDP (17), length: 63) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 20104+ A? www.google.com.br. (35) 08:46:50.629850 IP (tos 0x0, ttl 64, id 34235, offset 0, flags [none], proto: UDP (17), length: 159) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 20104 q: A? www.google.com.br. 5/0/0 www.google.com.br. CNAME www.google.com., [|domain] 08:46:50.874678 IP (tos 0x0, ttl 64, id 34249, offset 0, flags [none], proto: UDP (17), length: 75) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 38539+ A? pagead2.googlesyndication.com. (47) 08:46:50.874849 IP (tos 0x0, ttl 64, id 34250, offset 0, flags [none], proto: UDP (17), length: 153) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 38539 q: A? pagead2.googlesyndication.com. 4/0/0 pagead2.googlesyndication.com. CNAME[|domain] 08:46:52.001649 IP (tos 0x0, ttl 64, id 34258, offset 0, flags [none], proto: UDP (17), length: 231) XXX.XXX.XXX.129.59355 > XXX .XXX.XXX.129.1813: RADIUS, length: 203 Accounting Request (4), id: 0xdf, Authenticator: 8e381d93036159faf44668b400403a9f Username Attribute (1), length: 10, Value: user4 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.121 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:52.006180 IP (tos 0x0, ttl 64, id 34259, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.59355: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xdf, Authenticator: 71076d45f47f02944419c017c1408092 08:46:57.031248 IP (tos 0x0, ttl 64, id 34383, offset 0, flags [none], proto: UDP (17), length: 242) XXX.XXX.XXX.129.52499 > XXX .XXX.XXX.129.1813: RADIUS, length: 214 Accounting Request (4), id: 0x8b, Authenticator: 308ab2eea576048c9a8ab051ffdb2938 Username Attribute (1), length: 15, Value: user5 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.173 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 18, Value: [|radius] 0x0000: X [|radius] 08:46:57.035743 IP (tos 0x0, ttl 64, id 34384, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.52499: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x8b, Authenticator: b5966fd9dcda6cc7461c48b97d2bec15 08:46:59.532790 IP (tos 0x0, ttl 64, id 34395, offset 0, flags [none], proto: UDP (17), length: 243) XXX.XXX.XXX.129.58045 > XXX .XXX.XXX.129.1813: RADIUS, length: 215 Accounting Request (4), id: 0x5c, Authenticator: 4d6cb1252ea0b5762d34bbc841a3f9ed Username Attribute (1), length: 16, Value: user6 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.179 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:59.554103 IP (tos 0x0, ttl 64, id 34396, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.58045: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x5c, Authenticator: 7432260fa37dae970c78198a9e5e923a 08:47:07.580791 IP (tos 0x0, ttl 64, id 34407, offset 0, flags [none], proto: UDP (17), length: 233) XXX.XXX.XXX.129.60644 > XXX .XXX.XXX.129.1813: RADIUS, length: 205 Accounting Request (4), id: 0x4f, Authenticator: 0a9617838fba04faad448c44d06d71b6 Username Attribute (1), length: 11, Value: user7 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.153 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:47:07.585498 IP (tos 0x0, ttl 64, id 34408, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.60644: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x4f, Authenticator: 2fa9d8161b441a9f5336f630fe55e9fa 08:47:08.197706 IP (tos 0x0, ttl 64, id 34409, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.63164 > XXX .XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xb2, Authenticator: 2fe5ce8331e665ebbea87ec953075c2d Username Attribute (1), length: 14, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.141 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:47:08.202234 IP (tos 0x0, ttl 64, id 34410, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.63164: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xb2, Authenticator: 9308c51e608c6503d0ed826ca179d817 08:47:09.428670 IP (tos 0x0, ttl 64, id 34412, offset 0, flags [none], proto: UDP (17), length: 59) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 62382+ A? www.orkut.com. (31) 08:47:09.428851 IP (tos 0x0, ttl 64, id 34413, offset 0, flags [none], proto: UDP (17), length: 152) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 62382 q: A? www.orkut.com. 5/0/0 www.orkut.com. CNAME orkut.l.google.com., orkut.l.google.com.[|domain] 08:47:11.705737 IP (tos 0x0, ttl 64, id 34427, offset 0, flags [none], proto: UDP (17), length: 250) XXX.XXX.XXX.129.54776 > XXX .XXX.XXX.129.1813: RADIUS, length: 222 Accounting Request (4), id: 0x9e, Authenticator: f46cb516f565b2533b8f797708c04f41 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:47:14.722579 IP (tos 0x0, ttl 64, id 34462, offset 0, flags [none], proto: UDP (17), length: 250) XXX.XXX.XXX.129.54776 > XXX .XXX.XXX.129.1813: RADIUS, length: 222 Accounting Request (4), id: 0x9e, Authenticator: f46cb516f565b2533b8f797708c04f41 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:47:14.727705 IP (tos 0x0, ttl 64, id 34463, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.54776: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x9e, Authenticator: 2b5bbecd09941fda409322375fac86f5 08:47:28.519682 IP (tos 0x0, ttl 64, id 34515, offset 0, flags [none], proto: UDP (17), length: 247) XXX.XXX.XXX.129.51199 > XXX .XXX.XXX.129.1813: RADIUS, length: 219 Accounting Request (4), id: 0xc3, Authenticator: 1eacbab964455ecd42ae9251d6eeaee0 Username Attribute (1), length: 18, Value: user3 0x0000: X Service Type Attribute (6), length: 6, Value: Framed The ppp.log keeps on "Radius: Request re-sent" for that user. I'm trying to solve that for days, without success. Anything I tried to stop that multiple accounts doesn't help. So any help, like always, will be appreciated. Thanks in advance.

1 0

PopToP VPN + FreeRadius
by Victor Asavei 04 Jul '08

04 Jul '08

Hello, I am running a PopTop server with FreeRadius for authentification. I have configured FreeRadius to use Oracle and I can successfully authenticate the users that connect to the VPN. My questions is how can I after a certain-period of time or after a certain condition is true (for example a value in the db in a table reaches 0) to disconnect a certain user ? Reading the documentation from the site I understood that the NAS server is responsable with this. How can i then do this using PopTop & FreeRadius ? Any help or hint is appreciated ! Thank You

4 6

sqlippool
by Laar, Johan van de 04 Jul '08

04 Jul '08

Is it possible to use two sql instances (sql-instance-name) for the same IP pool? (with version 2.0.5) To achieve some redundancy when one of the databases crashes. Thank you in advance. Johan van de Laar

2 3

Re: Freeradius-Users Digest, Vol 39, Issue 18 topic 5: freeradius with multiple ldap servers
by Andy An 03 Jul '08

03 Jul '08

Hi Sambuddho: I met similar problem a few weeks ago. You need to set the ldap identity/password for your freeRadius server at modules/ldap: e.g. mine is like: server = "ldap.xxx.ca" identity = "cn=radius,ou=Applications,dc=xxx,dc=ca" password = "password" basedn = "ou=People,dc=xxx,dc=ca" The default setting is "read-only" anonymous search(i.e. without identity/password setting) and it will fail because ldap server does not allow anonymous search for other user's password. Hope this is helpful. Andy freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: =?UTF-8?Q?freeradius-proxy_+_PAP_works, > _PEAP_and_the_rest_doesn=C2=B4t?= (uni(a)christiankraus.de) > 2. Re: freeradius-proxy + PAP works, PEAP and the rest doesn?t > (Alan DeKok) > 3. Re: freeradius-proxy + PAP works, PEAP and the rest doesn?t > (Ivan Kalik) > 4. Re: sqlippool (Ivan Kalik) > 5. Re: freeradius with multiple ldap servers (Sambuddho Chakravarty) > 6. > Re:=?UTF-8?Q?freeradius-proxy_+_PAP_works,_PEAP_and_the_rest_doesn=C2=B4t?= > (A.L.M.Buxey(a)lboro.ac.uk) > > > ------------------------------ > > Message: 5 > Date: Thu, 03 Jul 2008 12:50:25 -0400 > From: Sambuddho Chakravarty <sc2516(a)columbia.edu> > Subject: Re: freeradius with multiple ldap servers > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <1215103825.8819.81.camel@insomniac> > Content-Type: text/plain; charset=utf-8 > > Hello Ivan > But I don't have a field in the database by that name . The name of the > field is "userPassword" . This is what the openLDAP migration scripts > generated. Please let me know what mistake I am doing . Also , my > question on failover. Is the failover used when the first LDAP server is > down / unresponsive to connection attempts or when it is not able to > authenticate (example bad username / password) ? > > Thanks > Sambuddho > On Thu, 2008-07-03 at 10:24 +0100, Ivan Kalik wrote: > >> Password (radius) attribute should be Crypt-Password not User-Password. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> >> Dana 3/7/2008, "Sambuddho Chakravarty" <sc2516(a)columbia.edu> pi?e: >> >> >>> Hello >>> >>> I set the password_header to = {crypt} and password_attribute to >>> "userPassword" (Thats the name of the field in the database). Now this >>> is what the logs show, >>> >>> rlm_ldap: performing search in ou=People,dc=example,dc=com, with filter >>> (uid=try) >>> rlm_ldap: Added User-Password = $1$n48a7wCp$RfvlOx1pZgiVNfmMmA2xS. in >>> check items >>> rlm_ldap: looking for check items in directory... >>> rlm_ldap: looking for reply items in directory... >>> rlm_ldap: user try authorized to use remote access >>> rlm_ldap: ldap_release_conn: Release Id: 0 >>> +++[ldap1] returns ok >>> ++- policy redundant returns ok >>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >>> !!! Replacing User-Password in config items with >>> Cleartext-Password. !!! >>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >>> !!! Please update your configuration so that the "known >>> good" !!! >>> !!! clear text password is in Cleartext-Password, and not in >>> User-Password. !!! >>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >>> auth: type Local >>> auth: user supplied User-Password does NOT match local User-Password >>> auth: Failed to validate the user. >>> Found Post-Auth-Type Reject >>> +- entering group REJECT >>> expand: %{User-Name} -> try >>> attr_filter: Matched entry DEFAULT at line 11 >>> >>> >>> >>> My guess is authorize{} worked but not authenticate {}. Also , I see >>> both modules ldap1 and ldap2 being loaded but whenever I try to >>> authenticate with the username/password that is found in ldap2 , the >>> radius server never attempts to connect to the other LDAP server. >>> Instead it search for the entries in the "ldap1"'s server only. >>> >>> Any suggestions ? >>> >>> Thanks >>> Sambuddho >>> >>> >>> On Wed, 2008-07-02 at 23:45 +0100, Ivan Kalik wrote: >>> >>>> http://wiki.freeradius.org/index.php/Rlm_ldap >>>> >>>> See use of password_header and password_attribute. >>>> >>>> Ivan Kalik >>>> Kalik Informatika ISP >>>> >>>> >>>> Dana 2/7/2008, "Sambuddho Chakravarty" <sc2516(a)columbia.edu> pi??e: >>>> >>>> >>>>> Hello >>>>> I think I know what the problem is. The radius server is looking up >>>>> using cleartext password , while the LDAP data base stores the hashed >>>>> passwords. How can I force the radiuse server to search for the password >>>>> as a hashed value (rather than searching for the clear-text value) ? >>>>> >>>>> Thanks >>>>> Sambuddho >>>>> On Wed, 2008-07-02 at 17:09 -0400, Sambuddho Chakravarty wrote: >>>>> >>>>>> Hello Alan >>>>>> I made sure this time that rlm_ldap was compiled. Now the following is >>>>>> the configuration >>>>>> >>>>>> ------/etc/raddb/modules/ldap----------- >>>>>> >>>>>> ldap ldap1 { >>>>>> server = "a.b.c.d" >>>>>> ... >>>>>> } >>>>>> >>>>>> ldap ldap2 { >>>>>> server = "w.x.y.z" >>>>>> ... >>>>>> } >>>>>> >>>>>> -----/etc/raddb/radiusd.conf----- >>>>>> >>>>>> >>>>>> authorize { >>>>>> ldap1 >>>>>> >>>>>> ldap2 >>>>>> >>>>>> } >>>>>> >>>>>> authenticate { >>>>>> ldap1 >>>>>> ldap2 >>>>>> } >>>>>> >>>>>> ------------------------------------ >>>>>> >>>>>> When I execute /sbin/radiusd -X >>>>>> >>>>>> It shows instantiating module ldap1 and module ldap2 >>>>>> >>>>>> .... >>>>>> Module: Instantiating ldap2 >>>>>> ldap ldap1 { >>>>>> server = "a.b.c.d" >>>>>> port = 389 >>>>>> .... >>>>>> Module: Instantiating ldap2 >>>>>> ldap ldap2 { >>>>>> server = "w.x.y.z" >>>>>> port = 389 >>>>>> .... >>>>>> >>>>>> When sending a radtest request using the following command (from the >>>>>> same machine as one which is running the server) >>>>>> >>>>>> $ radtest user "secret" localhost 2 testing123 >>>>>> >>>>>> I get ACCESS-REJECT reply from the sever. >>>>>> >>>>>> On the server the logs show something like this >>>>>> --------------------------------------------------- >>>>>> It shows binding to both LDAP servers one by one through something like >>>>>> this : >>>>>> >>>>>> rlm_ldap: performing user authorization for catch >>>>>> WARNING: Deprecated conditional expansion ":-". See "man unlang" for >>>>>> details >>>>>> expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=catch) >>>>>> expand: ou=People,dc=example,dc=example -> >>>>>> ou=People,dc=example,dc=example >>>>>> rlm_ldap: ldap_get_conn: Checking Id: 0 >>>>>> rlm_ldap: ldap_get_conn: Got Id: 0 >>>>>> rlm_ldap: attempting LDAP reconnection >>>>>> rlm_ldap: (re)connect to 30.0.0.2:389, authentication 0 >>>>>> rlm_ldap: bind as / to 30.0.0.2:389 >>>>>> rlm_ldap: waiting for bind result ... >>>>>> rlm_ldap: Bind was successful >>>>>> rlm_ldap: performing search in ou=People,dc=example,dc=example, with >>>>>> filter (uid=catch) >>>>>> rlm_ldap: object not found or got ambiguous search result >>>>>> rlm_ldap: search failed >>>>>> rlm_ldap: ldap_release_conn: Release Id: 0 >>>>>> ++[ldap1] returns notfound >>>>>> rlm_ldap: - authorize >>>>>> rlm_ldap: performing user authorization for catch >>>>>> WARNING: Deprecated conditional expansion ":-". See "man unlang" for >>>>>> details >>>>>> expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=catch) >>>>>> expand: ou=People,dc=example,dc=example -> >>>>>> ou=People,dc=example,dc=example >>>>>> rlm_ldap: ldap_get_conn: Checking Id: 0 >>>>>> rlm_ldap: ldap_get_conn: Got Id: 0 >>>>>> rlm_ldap: attempting LDAP reconnection >>>>>> rlm_ldap: (re)connect to 10.0.0.1:389, authentication 0 >>>>>> rlm_ldap: bind as / to 10.0.0.1:389 >>>>>> rlm_ldap: waiting for bind result ... >>>>>> rlm_ldap: Bind was successful >>>>>> rlm_ldap: performing search in ou=People,dc=example,dc=example, with >>>>>> filter (uid=catch) >>>>>> rlm_ldap: object not found or got ambiguous search result >>>>>> rlm_ldap: search failed >>>>>> rlm_ldap: ldap_release_conn: Release Id: 0 >>>>>> ++[ldap2] returns notfound >>>>>> >>>>>> auth: No authenticate method (Auth-Type) configuration found for the >>>>>> request: Rejecting the user >>>>>> auth: Failed to validate the user. >>>>>> >>>>>> You can see it is attempting to search both databases but fails. If I >>>>>> use a simple telnet or ssh to authenticate against the LDAP server it >>>>>> logs in fine. LDAP client login against the LDAP server is otherwise >>>>>> working fine. I know I have been bothering using trivial question. But >>>>>> any help would be appreciated :-) >>>>>> >>>>>> Thanks in advance. >>>>>> Sambuddho >>>>>> >>>>>> >>>>>> >>>>>> On Tue, 2008-07-01 at 22:33 +0200, Alan DeKok wrote: >>>>>> >>>>>>> Sambuddho Chakravarty wrote: >>>>>>> >>>>>>>> This is exactly what I did . I forgot to put the separate module names >>>>>>>> >>>>>>> The consistent problems you see make me think that the issue is more >>>>>>> than "forgot". >>>>>>> >>>>>>> >>>>>>>> And now when I try to start the server this is what the error I see : >>>>>>>> >>>>>>>> >>>>>>>> server { >>>>>>>> modules { >>>>>>>> Module: Checking authenticate {...} for more modules to load >>>>>>>> //etc/raddb/modules/ldap1[29]: Failed to link to module 'rlm_ldap': >>>>>>>> >>>>>>> So.... was that module built? Apparently not... >>>>>>> >>>>>>> >>>>>>>> When trying with a single server ,it matches the radius request against >>>>>>>> rlm_pap and not rlm_ldap. I am confused. >>>>>>>> >>>>>>> Perhaps reading the debug output (and that of "configure" and "make") >>>>>>> would help. >>>>>>> >>>>>>> Alan DeKok. >>>>>>> - >>>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>>>>>> >>>>>> - >>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>>>>> >>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml >>>>> >>>>> >>>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> > > > > ------------------------------ > > Message: 6 > Date: Thu, 3 Jul 2008 18:00:35 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: > Re:=?UTF-8?Q?freeradius-proxy_+_PAP_works,_PEAP_and_the_rest_doesn=C2=B4t?= > > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20080703170035.GA14834(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > hi, > > if you really are using freeradius as a proxy, as you stated, > then you dont need certificates...as the system will JUST > proxy. if you mean you want to terminate EAP on your > freeradius, then please dont call it a proxy. get the > terminology correct. > > what did you do wrong? > > well, since 1.1.7 and 2.0.5 need completely different configs, > i doubt you could make the same mistake twice...you CANT use a 1.1.7 > config on a 2.0.5 box. > > from what i can see, the daemon is clearly telling you something > is wrong with your DH stuff. read eap.conf properly. get rid > of that error. thats your primary task. > > alan > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 39, Issue 18 > ************************************************ > >

3 5

FreeRadius crashing
by Brooks, Kyle 03 Jul '08

03 Jul '08

Hello, We have been experiencing a weird crashing problem with FreeRadius 1.1.7 on fedora core 7 and was hoping someone would be able to help. The problem is that FreeRadius will crash several times each day and before each crash this error is displayed. error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Here is part of the log file Thu Jun 26 08:12:27 2008 : Auth: Login OK: [BaiE/<no User-Password attribute>] (from client localhost port 0) Thu Jun 26 08:12:27 2008 : Auth: Login OK: [BaiE/<no User-Password attribute>] (from client 10.0.1.11 port 50405 cli 00-08-74-CB-78-BA) Thu Jun 26 08:13:22 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu Jun 26 08:13:22 2008 : Auth: Login incorrect: [MooresJ/<no User-Password attribute>] (from client 10.0.1.11 port 50108 cli 00-18-8B-79-91-9B) <restart FreeRadius> Thu Jun 26 08:18:20 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jun 26 08:18:20 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jun 26 08:18:20 2008 : Info: rlm_eap_tls: Loading the certificate file as a chain Thu Jun 26 08:18:20 2008 : Info: WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! Thu Jun 26 08:18:20 2008 : Info: Ready to process requests. Thu Jun 26 08:18:24 2008 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Thu Jun 26 08:18:24 2008 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 26 08:18:24 2008 : Auth: Login OK: [MooresJ/<no User-Password attribute>] (from client localhost port 0) Thu Jun 26 08:18:24 2008 : Auth: Login OK: [MooresJ/<no User-Password attribute>] (from client 10.0.1.11 port 50108 cli 00-18-8B-79-91-9B) After this error message the log will show that authentication failed due to incorrect login (when it shouldn't have) and FreeRadius will then stop processing. Upon restart of the demon, it will then successfully authenticate the same user without crashing. FreeRadius is communicating with Active Directory to authenticate users. Thanks, Kyle

3 2

Re: freeradius-proxy + PAP works, PEAP and the rest doesn´t
by uni＠christiankraus.de 03 Jul '08

03 Jul '08

>> - External users should be able to login on WLAN via 802.1X with >> MSCHAPv2/PEAP in Windows XP. > That's relatively easy. In 2.0, just install it, configure a >user/password (see the FAQ), start it in debug mode as root, and >un-check "validate server certificate" on the Windows box. Well, this is already running with internal user. Those are correctly proxied to the local internal Radius Server. Also they don´t have to uncheck the "validate server certificate" They can authenticate it against against an valid CA. There everything runs great. The problem exists with external customers that are proxied to another one. >> When using local radtest to verify the user, everything looks okay. >>But as >> soon I take a windows client, properly configured, or the >>radeapclient, it >> doesn´t work. >> >> Here is the output from radius -X. >> It is 1.1.7, but the same errors occur on version 2.0.5: >Don't run 1.1.7. Honest. Well I tried 2.0.5 first, then I switched to 1.1.7 just for testing. Both don´t work. >> #/This message appears about 2000+ times >><shrug> It's 1.1.7. Well, the output from radius -X had 17,5MB of size... >> rad_recv: Access-Reject packet from host 139.212.22.110:1812, id=1, >> length=40 >> Reply-Message = "Request Denied" >> Proxy-State = 0x3931 >So... the home server is rejecting the user. >Have you run the home server in debug mode to see what it's doing, and >why it's rejecting the request? If not, why not? Is it even >FreeRADIUS? Well, I do not have any influence on that home server on my own. But... >>My guess is that the home server cannot do EAP. If so, why are you >>"going crazy with freeradius"? You're blaming the proxy for the >>actionsof the home server. ... >>Go fix the home server to do EAP. If you can't make it do EAP, throw >>it away, and replace it with FreeRADIUS. ... that Radius Server is an FreeRadius server. I called the administrator of it. And it is running great with all other Radius server within the rest of the "sharing WLAN access" community. It is in fact running now for years. So, must be another error, I guess?

4 3

freeradius-proxy + PAP works, PEAP and the rest doesn´t
by uni＠christiankraus.de 03 Jul '08

03 Jul '08

Hi, I´m really going crazy with freeradius. I want to setup a working freeradius proxy. Well, everything should have been configured correctly. I have my certificates, I have installed everything, so freeradius tells me no more errors when starting. Well, what do I want? - External users should be able to login on WLAN via 802.1X with MSCHAPv2/PEAP in Windows XP. When using local radtest to verify the user, everything looks okay. But as soon I take a windows client, properly configured, or the radeapclient, it doesn´t work. Here is the output from radius -X. It is 1.1.7, but the same errors occur on version 2.0.5: There are two different requests. On (working) with local radtest, the other one with radeapclient. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/src/freeradius/key-bamberg.pem" tls: certificate_file = "/usr/src/freeradius/freeradius-cert.pem" tls: CA_file = "/usr/src/freeradius/chain.txt" tls: private_key_password = "oft36fW!" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = yes peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:48444, id=88, length=82 User-Name = "user(a)domain.org" User-Password = "USERPASS" NAS-IP-Address = 255.255.255.255 NAS-Port = 1100 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "domain.org" for User-Name = "user(a)domain.org" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user bamtest to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 184 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 Sending Access-Request of id 0 to 139.212.22.110 port 1812 User-Name = "user(a)domain.org" User-Password = "USERPASS" NAS-IP-Address = 255.255.255.255 NAS-Port = 1100 Framed-Protocol = PPP Service-Type = Framed-User Proxy-State = 0x3838 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Accept packet from host 139.212.22.110:1812, id=0, length=24 Proxy-State = 0x3838 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 modcall[post-proxy]: module "eap" returns noop for request 0 modcall: leaving group post-proxy (returns noop) for request 0 authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type System rad_check_password: Found Auth-Type Warning: Found 2 auth-types on request for user 'user(a)domain.org' rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 88 to 127.0.0.1 port 48444 Finished request 0 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 88 with timestamp 486b8e97 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:50250, id=91, length=95 User-Name = "user(a)domain.org" Message-Authenticator = 0xbaff8358add39a88b6154d7d4d0fa754 EAP-Message = 0x02d2001d0162616d7465737440756e692e777565727a627572672e6465 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "domain.org" for User-Name = "user(a)domain.org" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user bamtest to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 1 rlm_eap: Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 Sending Access-Request of id 1 to 139.212.22.110 port 1812 User-Name = "user(a)domain.org" Message-Authenticator = 0x00000000000000000000000000000000 EAP-Message = 0x02d2001d0162616d7465737440756e692e777565727a627572672e6465 NAS-IP-Address = 127.0.0.1 Proxy-State = 0x3931 #This message appears about 2000+ times: --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 0 seconds... . . . Waking up in 0 seconds... --- Walking the entire request list --- Waking up in 0 seconds... #/This message appears about 2000+ times rad_recv: Access-Reject packet from host 139.212.22.110:1812, id=1, length=40 Reply-Message = "Request Denied" Proxy-State = 0x3931 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 1 modcall[post-proxy]: module "eap" returns noop for request 1 modcall: leaving group post-proxy (returns noop) for request 1 Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:50250, id=91, length=95 Sending Access-Reject of id 91 to 127.0.0.1 port 50250 Reply-Message = "Request Denied" --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 91 with timestamp 486b8ea2 Nothing to do. Sleeping until we see a request. The question is: What did I do wrong?

3 2

openbsd dhcpd + freeradius
by Raja Peer 03 Jul '08

03 Jul '08

Hi, Trying to get radiusd work with local dhcp server. radiusd: FreeRADIUS Version 2.0.6, for host i386-unknown-openbsd4.1, built on Jul 2 2008 at 08:57:18 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. And I do see bootp traffic when using tcpdump for port (P) [root@myhost~]# tcpdump -i fxp1 tcpdump: listening on fxp1, link-type EN10MB 17:18:44.151478 00:19:aa:ab:65:7a 00:19:aa:ab:65:7a loopback 60: 0000 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 17:18:45.610421 192.168.176.1.698 > 192.168.176.255.698: udp 24 [ttl 1] 17:18:47.077184 802.1Q vid 30 pri 0 arp who-has 169.254.220.241 tell 169.254.220.241 17:18:47.948216 802.1Q vid 30 pri 0 arp who-has 169.254.220.241 tell 169.254.220.241 17:18:48.850477 192.168.176.1.698 > 192.168.176.255.698: udp 48 [ttl 1] 17:18:48.948337 802.1Q vid 30 pri 0 arp who-has 169.254.220.241 tell 169.254.220.241 17:18:49.570523 192.168.176.1.698 > 192.168.176.255.698: udp 24 [ttl 1] 17:18:49.968100 802.1Q vid 30 pri 0 169.254.220.241 > IGMP.MCAST.NET: igmp-2 [v2] [ttl 1] 17:18:49.979637 802.1Q vid 30 pri 0 169.254.220.241.3791 > 239.255.255.250.ssdp: udp 133 [ttl 1] 17:18:50.024981 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:50.774829 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:50.948043 802.1Q vid 30 pri 0 169.254.220.241 > IGMP.MCAST.NET: igmp-2 [v2] [ttl 1] 17:18:51.430873 192.168.176.1.698 > 192.168.176.255.698: udp 32 [ttl 1] 17:18:51.524458 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:51.965832 802.1Q vid 30 pri 0 0.0.0.0.bootpc > 255.255.255.255.bootps: xid:0xa2b988cc flags:0x8000 [|bootp] 17:18:52.274437 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:52.979528 802.1Q vid 30 pri 0 169.254.220.241.3791 > 239.255.255.250.ssdp: udp 133 [ttl 1] 17:18:53.025063 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:53.410541 192.168.176.1.698 > 192.168.176.255.698: udp 20 [ttl 1] 17:18:53.774267 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:54.147699 00:19:aa:ab:65:7a 00:19:aa:ab:65:7a loopback 60: 0000 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 17:18:54.524253 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:55.274368 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 Checked to make sure dhcp module is included by radiusd -X. Does anyone have dhcp work with freeradius ? Thanks Raja -- View this message in context: http://www.nabble.com/openbsd-dhcpd-%2B-freeradius-tp18249568p18249568.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4

unix auth with mysql radreply
by Oguzhan Kayhan 03 Jul '08

03 Jul '08

Hello, I setup a freeradius for chilli-coova. It uses both unix accounting (which main users are there) and mysql at the same time for accounting and logging. Just i have a little problem. If i create a user on mysql and give an attribute in radreply, it works fine. But if i create an entry in radreply (Even tried with radgroupreply and usergroup) with unix/shadow authentication, i cant get the reply message. Just radacct records works fine without a problem. Do i have to enable smthing else on radius.conf or sql.conf to use radreply for unix accounting? And also i wonder is it possible to give a default value for everyuser that authenticated via freeradius? A default group for everybody???

2 1

Using OTP authentication with Freeradius 2
by Greg Woods 03 Jul '08

03 Jul '08

I am trying to migrate from freeradius 1.1.7 to freeradius 2.0.5 and I cannot get the OTP module to work. Basically it instantiates, but when I specify "Auth-Type = OTP" in a users file entry, it complains that this is not a valid value for that attribute. This worked fine under 1.1.7 . I have been Googling, grepping the source code and reading the wiki for a couple of days now without finding anything that directly pertains to this problem. I don't know if I messed up compiling the code or configuring the server. If this is documented somewhere, please forgive me, as I have been unable to find it. Here are the relevant snippets from the -X output; the full output is attached: including configuration file /usr/local/etc/raddb/modules/otp [...] including configuration file /usr/local/etc/raddb/otp.conf [...] Module: Linked to module rlm_otp Module: Instantiating otp otp { otpd_rp = "/var/run/otpd/socket" challenge_prompt = "Challenge: %s Response: " challenge_length = 6 challenge_delay = 30 allow_sync = yes allow_async = no mschapv2_mppe = 2 mschapv2_mppe_bits = 2 mschap_mppe = 2 mschap_mppe_bits = 2 } And then it craps out at the end with: /usr/local/etc/raddb/users[4]: Parse error (check) for entry DEFAULT: Unknown value otp for attribute Auth-Type Errors reading /usr/local/etc/raddb/users The entry that worked under 1.1.7 (and which results in the above error under 2.0.5) is: DEFAULT Auth-Type = OTP Fall-Through = No Thanks for any pointers; I am pretty much dead in the water in my migration at this point. --Greg

3 9