- Freeradius-Users - lists.freeradius.org

bug? in configure script
by Andrew Higginbotham 08 Jan '08

08 Jan '08

I was installing freeradius today and the only way I could get it to recognize my ssl install, which is in a custom location, was to change line 21268 of the 'configure' script to from LIBS="-lssl -lcrypto $LIBS" LIBS="-lssl $LIBS" For some reason, even when I add '-lcrypto' to LDFLAGS it does not work, which seems like a bug. Even stranger, config.log shows that when this is done -lcrypto is being called: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -I/usr/local/pkg/openssl/include -ldl -lcrypto -L/usr/local/pkg/openssl/lib conftest.c -lssl -lnsl -lresolv -lpthread >&5 /usr/local/pkg/openssl/lib/libssl.a(ssl_lib.o): In function `SSL_CTX_set_cert_store': ssl_lib.c:(.text+0x763): undefined reference to `X509_STORE_free' /usr/local/pkg/openssl/lib/libssl.a(ssl_lib.o): In function `SSL_CTX_get_ex_new_index': ssl_lib.c:(.text+0x813): undefined reference to `CRYPTO_get_ex_new_index' /usr/local/pkg/openssl/lib/libssl.a(ssl_lib.o): In function `SSL_get_ex_new_index': Note the '-lcrypto' in the gcc line. Now, without -lcrypto in LDFLAGS but with the line changed in the configure script this part of config.log becomes configure:21297: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -I/usr/local/pkg/openssl/include -ldl -L/usr/local/pkg/openssl/lib conftest.c -lssl -lcrypto -lnsl -lresolv -lpthread >&5 configure:21303: $? = 0 configure:21310: test -z "$ac_c_werror_flag" || test ! -s conftest.err configure:21313: $? = 0 configure:21320: test -s conftest configure:21323: $? = 0 configure:21337: result: yes The only difference that I can see is that '-lcrypto' is in a different position now. Does order matter in this case? ~Andrew

2 1

FreeRadius with SQL and Asterisk - FreeRadius inserts acct data toSQL database , but the data seems useless
by Antun Mihalicek 07 Jan '08

07 Jan '08

Hi! First of all, I apologize if I sent this to non-appropriate mailing list, but nevertheless I hope that you can help me. I installed FreeRadius because I wanted to see how it works in conjunction with Asterisk, only for accounting purposes. In my case, I managed to configure Asterisk to send RADIUS packets to FreeRadius server, as we can see from file /var/log/radius/radacct/127.0.0.1/detail-20080107: > Mon Jan 7 09:38:45 2008 > Acct-Status-Type = Stop > Asterisk-Acc-Code = "" > Asterisk-Src = "amihalicek" > Asterisk-Dst = "s" > Asterisk-Dst-Ctx = "default" > Asterisk-Clid = "amihalicek" > Asterisk-Chan = "SIP/5061-08b5f250" > Asterisk-Dst-Chan = "" > Asterisk-Last-App = "BackGround" > Asterisk-Last-Data = "demo-congrats" > Asterisk-Start-Time = "2008-01-07 08:38:38 +0000" > Asterisk-Answer-Time = "2008-01-07 08:38:39 +0000" > Asterisk-End-Time = "2008-01-07 08:38:45 +0000" > Asterisk-Duration = 7 > Asterisk-Bill-Sec = 6 > Asterisk-Disposition = "ANSWERED" > Asterisk-AMA-Flags = "DOCUMENTATION" > Asterisk-Unique-ID = "1199695118.0" > Asterisk-User-Field = "" > User-Name = "SIP/5061-08b5f250" > Acct-Session-Id = "1199695118.0" > NAS-Port = 0 > Acct-Delay-Time = 0 > NAS-IP-Address = 127.0.0.1 > Client-IP-Address = 127.0.0.1 > Acct-Unique-Session-Id = "e8e8e47588d22eed" > Timestamp = 1199695125 The problems start when I configure FreeRadius to insert RADIUS accounting data into SQL, in my case - postgreSQL database. I followed the steps on http://wiki.freeradius.org/SQL_HOWTO. FreeRadius creates SQL insert indeed, as you can see down below, but the thing is that the data from this table is totally useless, as e.g. acctstartime and acctstoptime fields are equal, which doesn't make sense. If we see the /var/log/radius/radacct/127.0.0.1/detail-20080107 file (see above), we can see that all of the AvPs are created in the SQL table, except the ones which have "Asterisk" as prefix (e.g. Asterisk-Acc-Code, Asterisk-Src, etc). I thought that FreeRadius will somehow map these values from Asterisk to values which can be put to radacct table, e.g. Asterisk-Start-Time ---> acctstarttime, etc. Obviously, it doesn't. I've been googling for whole day concerning this problem, and I wasn't able to find anything related to it, so probably other users had no problems with that. I assume that I would have to create a custom table for supporting asterisk RADIUS packets, but I wasn't able to find anything on google. I would appreciate any kind of help, hint, or advice. Below you can also see debug output from freeRADIUS. Thank you very much and sorry for the long e-mail, Antun Radacct table form postgreSQL: > radius=# select * from radacct; > radacctid | acctsessionid | acctuniqueid | username | > realm | nasipaddress | nasportid | nasporttype | > acctstarttime | acctstoptime | acctsessiontime | > acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets > | acctoutputoctets | calledstationid | callingstationid | > acctterminatecause | servicetype | framedprotocol | framedipaddress | > acctstartdelay | acctstopdelay | xascendsessionsvrkey | start-time | > starttime | asteriskstarttime > -----------+---------------+------------------+-------------------+-------+--------------+-----------+-------------+------------------------+------------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+------------+-----------+------------------- > 1 | 1199695118.0 | e8e8e47588d22eed | SIP/5061-08b5f250 > | | 127.0.0.1 | 0 | | 2008-01-07 > 09:38:45+01 | 2008-01-07 09:38:45+01 | | > | | | 0 > | 0 | | > | | | | > | | 0 | | > | | FreeRadius DEBUG: > [amihalicek@antun sbin]$ ./radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /home/amihalicek/radius/etc/raddb/proxy.conf > Config: including file: /home/amihalicek/radius/etc/raddb/clients.conf > Config: including file: /home/amihalicek/radius/etc/raddb/snmp.conf > Config: including file: /home/amihalicek/radius/etc/raddb/eap.conf > Config: including file: > /home/amihalicek/radius/etc/raddb/postgresql.conf > main: prefix = "/home/amihalicek/radius" > main: localstatedir = "/home/amihalicek/radius/var" > main: logdir = "/home/amihalicek/radius/var/log/radius" > main: libdir = "/home/amihalicek/radius/lib" > main: radacctdir = "/home/amihalicek/radius/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/home/amihalicek/radius/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/home/amihalicek/radius/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/home/amihalicek/radius/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /home/amihalicek/radius/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > pap: auto_header = yes > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded DIGEST > Module: Instantiated digest (digest) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/home/amihalicek/radius/etc/raddb/huntgroups" > preprocess: hints = "/home/amihalicek/radius/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/home/amihalicek/radius/etc/raddb/users" > files: acctusersfile = "/home/amihalicek/radius/etc/raddb/acct_users" > files: preproxy_usersfile = > "/home/amihalicek/radius/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded SQL > sql: driver = "rlm_sql_postgresql" > sql: server = "localhost" > sql: port = "" > sql: login = "radius" > sql: password = "radius" > sql: radius_db = "radius" > sql: nas_table = "nas" > sql: sqltrace = yes > sql: sqltracefile = "/home/amihalicek/radius/var/log/radius/sqltrace.sql" > sql: readclients = no > sql: deletestalesessions = yes > sql: num_sql_socks = 5 > sql: sql_user_name = "%{User-Name}" > sql: default_user_profile = "" > sql: query_on_not_found = no > sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, > Op ??FROM radcheck ??WHERE Username = '%{SQL-User-Name}' ??ORDER BY id" > sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, > Op ??FROM radreply ??WHERE Username = '%{SQL-User-Name}' ??ORDER BY id" > sql: authorize_group_check_query = "SELECT radgroupcheck.id, > radgroupcheck.GroupName, ??radgroupcheck.Attribute, > radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup > ??WHERE usergroup.Username = '%{SQL-User-Name}' AND > usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id" > sql: authorize_group_reply_query = "SELECT radgroupreply.id, > radgroupreply.GroupName, radgroupreply.Attribute, > ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup > ??WHERE usergroup.Username = '%{SQL-User-Name}' AND > usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id" > sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime = > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > AcctSessionTime = (EXTRACT(EPOCH FROM('%S'::timestamp with time zone > - AcctStartTime::timestamp with time zone > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, > AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = 0 > WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND > NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" > sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress > = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = > (EXTRACT(EPOCH FROM('%S'::timestamp with time zone > - AcctStartTime::timestamp with time zone > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, > AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) > + '%{Acct-Input-Octets:-0}'::bigint), > AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) > + '%{Acct-Output-Octets:-0}'::bigint) WHERE > AcctSessionId = '%{Acct-Session-Id}' AND UserName = > '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND > AcctStopTime IS NULL" > sql: accounting_update_query_alt = "INSERT into radacct > (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, > NASPortId, NASPortType, AcctStartTime, AcctSessionTime, > AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, > CallingStationId, ??ServiceType, FramedProtocol, FramedIPAddress, > XAscendSessionSvrKey) ??values('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', > '%{NAS-IP-Address}', ??'%{NAS-Port}', > '%{NAS-Port-Type}', ('%S'::timestamp - > '%{Acct-Delay-Time:-0}'::interval - > '%{Acct-Session-Time:-0}'::interval), ??'%{Acct-Session-Time}', > '%{Acct-Authentic}', ??(('%{Acct-Input-Gigawords:-0}'::bigint << 32) + > '%{Acct-Input-Octets:-0}'::bigint), > ??(('%{Acct-Output-Gigawords:-0}'::bigint << 32) + > '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', > ??'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', > ??NULLIF('%{Framed-IP-Address}', '')::inet, > '%{X-Ascend-Session-Svr-Key}')" > sql: accounting_start_query = "INSERT into radacct ??(AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, > CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay, XAscendSessionSvrKey) ??values('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', > '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > '%{Acct-Authentic}', '%{Connect-Info}', ??'%{Called-Station-Id}', > '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', > ??NULLIF('%{Framed-IP-Address}', '')::inet, 0, > '%{X-Ascend-Session-Svr-Key}')" > sql: accounting_start_query_alt = "UPDATE radacct ??SET AcctStartTime > = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > AcctStartDelay = 0, ??ConnectInfo_start = '%{Connect-Info}' WHERE > AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' > ??AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" > sql: accounting_stop_query = "UPDATE radacct ??SET AcctStopTime = > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), > ??AcctSessionTime = NULLIF('%{Acct-Session-Time}', '')::bigint, > ??AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + > '%{Acct-Input-Octets:-0}'::bigint), ??AcctOutputOctets = > (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + > '%{Acct-Output-Octets:-0}'::bigint), ??AcctTerminateCause = > '%{Acct-Terminate-Cause}', AcctStopDelay = 0, ??FramedIPAddress = > NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = > '%{Connect-Info}' ??WHERE AcctSessionId = '%{Acct-Session-Id}' AND > UserName = '%{SQL-User-Name}' ??AND NASIPAddress = '%{NAS-IP-Address}' > AND AcctStopTime IS NULL" > sql: accounting_stop_query_alt = "INSERT into radacct > ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, > NASPortId, NASPortType, AcctStartTime, AcctStopTime, > ??AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, > AcctOutputOctets, CalledStationId, CallingStationId, > ??AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStopDelay) ??values('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', > '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', > ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval - > '%{Acct-Session-Time:-0}'::interval), ??('%S'::timestamp - > '%{Acct-Delay-Time:-0}'::interval), NULLIF('%{Acct-Session-Time}', > '')::bigint, ??'%{Acct-Authentic}', '%{Connect-Info}', > ??(('%{Acct-Input-Gigawords:-0}'::bigint << 32) + > '%{Acct-Input-Octets:-0}'::bigint), > ??(('%{Acct-Output-Gigawords:-0}'::bigint << 32) + > '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', > ??'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', > '%{Service-Type}', '%{Framed-Protocol}', > ??NULLIF('%{Framed-IP-Address}', '')::inet, 0)" > sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE > UserName='%{SQL-User-Name}'" > sql: connect_failure_retry_delay = 60 > sql: simul_count_query = "" > sql: simul_verify_query = "" > sql: postauth_query = "INSERT INTO radpostauth (username, pass, > reply, authdate) VALUES ('%{User-Name}', > '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" > sql: safe-characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" > rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) > loaded and linked > rlm_sql (sql): Attempting to connect to radius@localhost:/radius > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 > rlm_sql (sql): Connected new DB handle, #4 > Module: Instantiated sql (sql) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/home/amihalicek/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/home/amihalicek/radius/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded radutmp > radutmp: filename = "/home/amihalicek/radius/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Accounting-Request packet from host 127.0.0.1:32773, id=148, > length=405 > Acct-Status-Type = Stop > Asterisk-Acc-Code = "" > Asterisk-Src = "amihalicek" > Asterisk-Dst = "s" > Asterisk-Dst-Ctx = "default" > Asterisk-Clid = "amihalicek" > Asterisk-Chan = "SIP/5061-08b5f250" > Asterisk-Dst-Chan = "" > Asterisk-Last-App = "BackGround" > Asterisk-Last-Data = "demo-congrats" > Asterisk-Start-Time = "2008-01-07 08:38:38 +0000" > Asterisk-Answer-Time = "2008-01-07 08:38:39 +0000" > Asterisk-End-Time = "2008-01-07 08:38:45 +0000" > Asterisk-Duration = 7 > Asterisk-Bill-Sec = 6 > Asterisk-Disposition = "ANSWERED" > Asterisk-AMA-Flags = "DOCUMENTATION" > Asterisk-Unique-ID = "1199695118.0" > Asterisk-User-Field = "" > User-Name = "SIP/5061-08b5f250" > Acct-Session-Id = "1199695118.0" > NAS-Port = 0 > Acct-Delay-Time = 0 > NAS-IP-Address = 127.0.0.1 > Processing the preacct section of radiusd.conf > modcall: entering group preacct for request 0 > modcall[preacct]: module "preprocess" returns noop for request 0 > rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = > 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = > "1199695118.0",User-Name = "SIP/5061-08b5f250"' > rlm_acct_unique: Acct-Unique-Session-ID = "e8e8e47588d22eed". > modcall[preacct]: module "acct_unique" returns ok for request 0 > rlm_realm: No '@' in User-Name = "SIP/5061-08b5f250", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[preacct]: module "suffix" returns noop for request 0 > modcall[preacct]: module "files" returns noop for request 0 > modcall: leaving group preacct (returns ok) for request 0 > Processing the accounting section of radiusd.conf > modcall: entering group accounting for request 0 > radius_xlat: > '/home/amihalicek/radius/var/log/radius/radacct/127.0.0.1/detail-20080107' > rlm_detail: > /home/amihalicek/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d > expands to > /home/amihalicek/radius/var/log/radius/radacct/127.0.0.1/detail-20080107 > modcall[accounting]: module "detail" returns ok for request 0 > modcall[accounting]: module "unix" returns ok for request 0 > radius_xlat: '/home/amihalicek/radius/var/log/radius/radutmp' > radius_xlat: 'SIP/5061-08b5f250' > rlm_radutmp: Logout for NAS localhost port 0, but no Login record > modcall[accounting]: module "radutmp" returns ok for request 0 > radius_xlat: 'SIP/5061-08b5f250' > rlm_sql (sql): sql_set_user escaped user --> 'SIP/5061-08b5f250' > radius_xlat: 'UPDATE radacct ??SET AcctStopTime = ('2008-01-07 > 09:38:45'::timestamp - '0'::interval), ??AcctSessionTime = NULLIF('', > '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), > ??AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), > ??AcctTerminateCause = '', AcctStopDelay = 0, ??FramedIPAddress = > NULLIF('', '')::inet, ConnectInfo_stop = '' ??WHERE AcctSessionId = > '1199695118.0' AND UserName = 'SIP/5061-08b5f250' ??AND NASIPAddress = > '127.0.0.1' AND AcctStopTime IS NULL' > radius_xlat: '/home/amihalicek/radius/var/log/radius/sqltrace.sql' > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql_postgresql: query: UPDATE radacct ??SET AcctStopTime = > ('2008-01-07 09:38:45'::timestamp - '0'::interval), ??AcctSessionTime > = NULLIF('', '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + > '0'::bigint), ??AcctOutputOctets = (('0'::bigint << 32) + > '0'::bigint), ??AcctTerminateCause = '', AcctStopDelay = 0, > ??FramedIPAddress = NULLIF('', '')::inet, ConnectInfo_stop = '' > ??WHERE AcctSessionId = '1199695118.0' AND UserName = > 'SIP/5061-08b5f250' ??AND NASIPAddress = '127.0.0.1' AND AcctStopTime > IS NULL > rlm_sql_postgresql: Status: PGRES_COMMAND_OK > rlm_sql_postgresql: affected rows = 0 > radius_xlat: 'stop packet with zero session length. [user > 'SIP/5061-08b5f250', nas '127.0.0.1']' > rlm_sql (sql) in sql_accounting: stop packet with zero session length. > [user 'SIP/5061-08b5f250', nas '127.0.0.1'] > rlm_sql (sql): Released sql socket id: 4 > radius_xlat: 'INSERT into radacct ??(AcctSessionId, AcctUniqueId, > UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, > AcctStopTime, ??AcctSessionTime, AcctAuthentic, ConnectInfo_stop, > AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, > ??AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStopDelay) ??values('1199695118.0', 'e8e8e47588d22eed', > 'SIP/5061-08b5f250', '', '127.0.0.1', ??'0', '', ('2008-01-07 > 09:38:45'::timestamp - '0'::interval - '0'::interval), ??('2008-01-07 > 09:38:45'::timestamp - '0'::interval), NULLIF('', '')::bigint, ??'', > '', ??(('0'::bigint << 32) + '0'::bigint), ??(('0'::bigint << 32) + > '0'::bigint), '', ??'', '', '', '', ??NULLIF('', '')::inet, 0)' > radius_xlat: '/home/amihalicek/radius/var/log/radius/sqltrace.sql' > rlm_sql_postgresql: query: INSERT into radacct ??(AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctStopTime, ??AcctSessionTime, AcctAuthentic, > ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, > CallingStationId, ??AcctTerminateCause, ServiceType, FramedProtocol, > FramedIPAddress, AcctStopDelay) ??values('1199695118.0', > 'e8e8e47588d22eed', 'SIP/5061-08b5f250', '', '127.0.0.1', ??'0', '', > ('2008-01-07 09:38:45'::timestamp - '0'::interval - '0'::interval), > ??('2008-01-07 09:38:45'::timestamp - '0'::interval), NULLIF('', > '')::bigint, ??'', '', ??(('0'::bigint << 32) + '0'::bigint), > ??(('0'::bigint << 32) + '0'::bigint), '', ??'', '', '', '', > ??NULLIF('', '')::inet, 0) > rlm_sql_postgresql: Status: PGRES_COMMAND_OK > rlm_sql_postgresql: affected rows = 1 > rlm_sql (sql): Released sql socket id: 4 > modcall[accounting]: module "sql" returns noop for request 0 > modcall: leaving group accounting (returns ok) for request 0 > Sending Accounting-Response of id 148 to 127.0.0.1 port 32773 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 148 with timestamp 4781e515 > Nothing to do. Sleeping until we see a request.

3 2

rpm for suse
by Norbert Wegener 07 Jan '08

07 Jan '08

The recent cvs seems to contain a new spec file for suse. With that spec I tried to build an rpm on 10.2. rpmbuild -ba freeradius.spec .... checking for SQLConnect in -liodbc... no checking for isql.h... no configure: error: set --without-rlm_sql_iodbc to disable it explicitly. configure: error: /bin/sh './configure' failed for ./drivers/rlm_sql_iodbc configure: error: ./configure failed for ./src/modules/rlm_sql error: Bad exit status from /var/tmp/rpm-tmp.19102 (%build) In Suse10.2 I don't find packages like *iodb* Which package contains the neccessary files? As I don't need everything, I modifyed the configure instruction in the spec-file and added: --without-rlm_sql_iodbc \ --without-rlm_sql_firebird \ --without-rlm_sql_db2 \ configure now runs without errors. Nevertheless, later on I get: gmake[10]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_firebird'^M gmake[10]: Für das Ziel »all« ist nichts zu tun.^M gmake[10]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_firebird'^M Making all in rlm_sql_freetds...^M gmake[10]: Entering directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_freetds'^M gmake[10]: *** Keine Regel, um »all« zu erstellen. Schluss.^M gmake[10]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers/rlm_sql_freetds'^M gmake[9]: *** [common] Fehler 2^M gmake[9]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers'^M gmake[8]: *** [all] Fehler 2^M gmake[8]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql/drivers'^M gmake[7]: *** [common] Fehler 2^M gmake[7]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql'^M gmake[6]: *** [build-module] Fehler 2^M gmake[6]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules/rlm_sql'^M gmake[5]: *** [common] Fehler 2^M gmake[5]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules'^M gmake[4]: *** [all] Fehler 2^M gmake[4]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src/modules'^M gmake[3]: *** [common] Fehler 2^M gmake[3]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src'^M gmake[2]: *** [all] Fehler 2^M gmake[2]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0/src'^M gmake[1]: *** [common] Fehler 2^M gmake[1]: Leaving directory `/usr/src/packages/BUILD/freeradius-server-2.0.0'^M make: *** [all] Fehler 2^M error: Bad exit status from /var/tmp/rpm-tmp.36031 (%build)^M ^M ^M RPM build errors:^M Bad exit status from /var/tmp/rpm-tmp.36031 (%build)^M de7018tc:/usr/src/packages/SPECS # exit^M Norbert Wegener

4 3

Bug?
by Dave Gibelli 07 Jan '08

07 Jan '08

This is a snippet from radiusd -X rad_recv: Access-Request packet from host 192.166.0.10:1645, id=216, length=78 NAS-IP-Address = 192.166.0.10 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "daveg" Calling-Station-Id = "192.166.0.231" User-Password = "abcdef" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "daveg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 My users file is just: DEFAULT Auth-Type == "PAP" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 1 there should be no match on line 1 because the check item doesn't match. I get the same match if I change PAP to EAP, is this a bug?

2 1

proxied connection - please example
by kupkar＠rkcompdesign.info 07 Jan '08

07 Jan '08

Hi Alan, thank you for your quick answer. Please send me some example about this proxy configuration. Rgdrs, Radim > Hi, > > > Everything work OK, Ovislink send request to FreeRadius > > server, FreeRadius send Access-Request to IAS (mschapv2) > > IAS send Access-Accept, but Ovislink received > Access-Challenge from FreeRadius, one two, three ... and > > on the end authetication failed. > > proxied connection - by default you will probably have the > default proxy attributes set - which will filter out > required attributes for successful replies to be returned. > you will need to add a new entry to 'trust' the IAS return > values - and have more attributes allowed through. > > alan > Hi all, > > I found very much usefull information about this > configuration on the internet. But I have still problem > with this configuration. I need terminated PEAP locally on > the Freeradius and redirect only mschapv2 to IAS server > for authentication. > > Authentication server: FreeRadius.net version: 1.1.7 > Supplicant: Win XP SP2 (with PEAP) > Authenticator: Ovislink WL-5460AP v2 > > - users.conf > DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm > := Safeword > > - proxy.conf > realm Safeword { > ??????? type = radius > ??????? authhost??????? = <ip>:1645 > ??????? accthost??????? = <ip>:1646 > ??????? secret????????? = <secret> > ??????? } > > - eap.conf > peap { > ? ???????????? default_eap_type = mschapv2 > ?????????????? proxy_tunneled_request_as_eap = no > } > > Everything work OK, Ovislink send request to FreeRadius > server, FreeRadius send Access-Request to IAS (mschapv2) > IAS send Access-Accept, but Ovislink received > Access-Challenge from FreeRadius, one two, three ... and > on the end authetication failed. > > If I use user database on FreeRadius everything work OK. > (Access-Request, Access-Accept) no problem. > > Is it possible configure FreeRadius as only resend reply > from IAS to Ovislink? Or I have problem with > configuration. > > If you want I send you configuration files and log from > debug mode. > > I want this configuration because I want use one time > password authetication, but Safeword plugin on Active > Directory doesn't understand PEAP protocol. > Only one way is use FreeRadius as proxy. > > Thank you for your help. > > Rgdrs, > Radim

2 1

RE: Error on radius
by Ackbar Joolia 07 Jan '08

07 Jan '08

Thanks Alan, will try this. -----Original Message----- Sent: 07 January 2008 12:40 To: FreeRadius users mailing list Subject: Re: Error on radius Hi, > Thanks Alan, > We are using SQL for authentication and accounting - do you think this could be the issue? > > I could potentially have thousands of requests coming in almost simultaneously, is this going to be too much for the process to handle? i dont know how good your SQL database is - specification or throughput capability etc. have you done benchmarks? I would personally suggest that you use the sqlrelay method for the accounting to stop the threads being caught in accounting processes - as accounting causes update/write to SQL which is a performance hit (compared to authentication which is just usually a read) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55 No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

1 0

RE: Error on radius
by Ackbar Joolia 07 Jan '08

07 Jan '08

Thanks Alan, We are using SQL for authentication and accounting - do you think this could be the issue? I could potentially have thousands of requests coming in almost simultaneously, is this going to be too much for the process to handle? Ackbar -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalplc.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalplc.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: 07 January 2008 10:40 To: FreeRadius users mailing list Subject: Re: Error on radius Hi, > 'The maximum number of threads (32) are active, cannot spawn new thread to handle request' FreeRADIUS is getting many many requests but cannot handle them in real time - usually due to the authentication or accounting being too slow - you use SQL or AD for authentication? SQL for accounting? > Also, do people know what is the maximum simultaneous incoming authentication calls that the radius process can handle? Or what ways can be adopted to deal with this? we have ours at over 128 without any local issues alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55 No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

2 1

Cisco command authorization
by Stefan Winter 07 Jan '08

07 Jan '08

Hi all, there are inquiries every once in a while here about how to enable command authorization for Cisco devices in a Cisco-AVPair. The usual answer is: find out if the NAS has an attribute for it. Now I'm myself trying to get rid of a haunting daemon, the tac_plus daemon, and so I investigated. Cisco claims that there is a complete mapping scheme to translate TACACS+ expressions into Cisco-AVPair Vendor-Specific. This works for example with the priv-lvl attribute: cisco-avpair = "shell:priv-lvl=15" There is a web page for Cisco IOS at http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_cha… detailing which TACACS+ commands exist, and it suggests that cisco-avpair = "shell:cmd=show" would do the trick to authorize the "show" command. EXCEPT that there is a tiny note for the commands "cmd" and "cmd-arg" saying that they cannot be used for encapsulation in the Vendor-Specific space. These two are the ONLY ones. Since it's just about parsing the string content of cisco-avpair at the router side, there is absolutely no technical reason why these two wouldn't go through. The only explanation then is that this is a deliberate step by Cisco to make sure that TACACS+ is "superior" to RADIUS by arbitrarily cutting down functionality. Probably the code in IOS is larger with an exception handling to make sure that it doesn't work. I must say: I'm pissed. But I hope I could at least clarify this topic. My next-best approach to circumvent this would be to define an intermediate privilege level that only has the permission to do the commands in question, and only assign the users in question to that lower priv-level. Scales poorly, but enough for us. Maybe that approach serves some others as well. Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 4

mschapv2 problem
by Cristian Novac 07 Jan '08

07 Jan '08

Hello all, I am trying to authenticate to freeradius using ttls with mschapv2 and i don't succeed; Attached is my eap.conf file; If you think something is wrong there or something should be added please tell me; also if you think other files should be configured as well. Thank you in advance! # -*- text -*- # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4.4.1 2006/01/04 14:29:29 nbk Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = ttls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # # md5 { # } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # # leap { # } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # # auth_type = PAP # } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { # private_key_password = whatever private_key_password = asb#1234 # private_key_file = ${raddbdir}/certs/cert-srv.pem private_key_file = ${raddbdir}/certs/NEW/server-key.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # certificate_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/NEW/server.pem # Trusted Root CA list # CA_file = ${raddbdir}/certs/demoCA/cacert.pem CA_file = ${raddbdir}/certs/NEW/ca-cert.pem dh_file = ${raddbdir}/certs/NEW/dh random_file = ${raddbdir}/certs/NEW/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # check_cert_cn = %{User-Name} } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. default_eap_type = mschapv2 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} copy_request_to_tunnel = yes # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} use_tunneled_reply = yes } sim { } # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. # default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. # copy_request_to_tunnel = no # use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes #} # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } }

3 7

reject proxy users
by Roar Pettersen 07 Jan '08

07 Jan '08

Hi ! We have a FreeRadius-1.1.7 which proxy radius request from several vpn servers. We need to reject students connecting to a employee vpn server. raddb/users : DEFAULT Realm == "student", NAS-IP-Address == 10.0.0.4, Auth-Type := Reject Reply-Message = "No VPN Access for students on 10.0.0.4", Fall-Through = 0 DEFAULT Realm == "student.domain.com", NAS-IP-Address == 10.0.0.4, Auth-Type := Reject Reply-Message = "No VPN Access for students on 10.0.0.4", Fall-Through = 1 The first with realm "student" doesn't work, but the last with realm "student.domain.com" does work. If I change the realm's then the first one always doesn't work, and the last one always work. -- Med vennlig hilsen / Regards; Roar Pettersen roar.pettersen(a)it.uib.no - http://www.uib.no

2 1