- Freeradius-Users - lists.freeradius.org

how to drop idle users
by vik 18 Jul '07

18 Jul '07

Thank you for your fast answer, but my radreply table is empty and there is no field Idle-Timeout. >This is usually done by the NAS IIRC. >Simply set an Idle-Timeout attribute in radreply for the user and the NAS >takes care of that. >Regards, >Liran. On 7/18/07, vik <vik_viktor at yahoo.com> wrote: >> >> Hi there, >> >> I have this problem, i would like to have idle users disconnected. With >> "idle" i mean users that have no activity with internet browsers. I'm not >> sure if there are other apllications using the 80 port the users are still >> idle. >> >> Thank you in advance. ____________________________________________________________________________________ Sick sense of humor? Visit Yahoo! TV's Comedy with an Edge to see what's on, when. http://tv.yahoo.com/collections/222

3 2

how to drop idle users
by vik 18 Jul '07

18 Jul '07

Hi there, I have this problem, i would like to have idle users disconnected. With "idle" i mean users that have no activity with internet browsers. I'm not sure if there are other apllications using the 80 port the users are still idle. Thank you in advance. ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/

3 2

certificates for TLS Tunnel (peap mschap v2 authentication)
by julien blanc 18 Jul '07

18 Jul '07

hi ! I'd like to set up an authentication system (for wireless clients) based on freeradius. I'm using a DC windows 2003 with Active Directory to manage my users and groups... i know ... its baaaad :-) but i don't have the choice ! I have built a linux server (fedora core 5), with freeradius, a kerberos client, samba and winbind to reach my domain. No problems so far. I'd like to authenticate my supplicants with PEAP-MSCHAP v2 and so i must set up a PKI for the TLS tunnel. My problem is here. I don't know how to use certificates in the freeradius directory: root.pem, root.p12, root.der cert-clt.pem, cert-clt.p12, cert-clt.der cert-srv.pem, cert-srv.p12, cert-srv.der any advice ... suggestions or anything else ??? Thanks ! Julien

3 4

Re: [Chillispot] Lack of Accounting ON/OFF in ChiliSpot RADIUS implementation
by Peter Nixon 17 Jul '07

17 Jul '07

After receiving your mail, I decided to do a little more ChilliSpot testing. a) Chillispot does not send an accounting ON packet on startup b) Chillispot does not send an accounting OFF packet on shutdown c) Chillispot does send an accounting Stop packet with "Acct-Terminate-Cause = NAS-reboot" for active sessions when shutdown cleanly. Now, c) is usefull in situations when you cleanly shutdown chillispot as it gives a proper stop record with the most information of the 3 options including final data counters. Instead of c) it would actually have been much easier to implement b) so I congratulate the chillispot author for his efforts. I still recommend that b) also be implemented however as it allows easy reporting of when the NAS was last shutdown. HOWEVER, If I only had the choice of ONE of the three options, I would pick option a) as it guarantees that the RADIUS server's idea of the active sessions will always be reset when the NAS boots. It is also the only one of the three options which (network conditions allowing) is always going to be delivered to the RADIUS server, as both b) and c) will not be sent in the case of a power outage or lockup of the NAS. To recap, ChilliSpot SHOULD send an accounting ON packet to the RADIUS server when it boots, and probably should send an OFF packet upon shutdown, although this is not critical given that it cleanly closes the sessions anyway. IF an accounting OFF packet is sent upon shutdown, it should be sent LAST, after all the session Stop packets are sent, otherwise the OFF packet will close all the active sessions on the RADIUS server, and the session Stop packets will generate duplicate SQL records as the radius server will err on the side of caution and prefer to duplicate records in the DB instead of possibly losing a session for which it did not receive a Start record. Regards Peter On Tue 17 Jul 2007, sophana wrote: > I'm receiving sometimes radius session stop requests with the terminate > cause "NAS-reboot". > Isn't it what you want? I don't know why it doesn't always work. > The problem is that it can't work reliably. > If there is a power off or whatever other reason, you don't get your > information. > Only the "on" information would be useful. > > Personally, I use trigger a periodic task that check open sessions which > haven't received alive requests since some time and close them. > If the user logs back before, you can detect that based on the > calling/called mac addresses and nasId and force the shutdown. > > Peter Nixon a écrit : > > Hi Guys > > > > I am one of the FreeRADIUS developers, as well as the openSUSE > > network:AAA project founder. As part of that project I also maintain > > ChilliSpot rpms. > > > > Over that last 6-9 months we have been getting increasing numbers of > > queries regarding ChilliSpot on the FreeRADIUS mailing list. One of the > > common queries we get is how to make FreeRADIUS "understand" when a > > chillispot NAS has been rebooted and all the users have been kicked off, > > but no accounting stop records have been received. > > > > I have taken a look at ChilliSpot and it generates an Auth packet > > similar to the following on initial start: > > > > rad_recv: Access-Request packet from host 192.168.2.67 port 2050, id=0, > > length=113 > > User-Name = "chillispot" > > User-Password = "chillispot" > > NAS-IP-Address = 192.168.1.7 > > Service-Type = Administrative-User > > NAS-Identifier = "demo" > > Called-Station-Id = "00:11:70:4f:01:aa" > > NAS-Port-Type = Wireless-802.11 > > Message-Authenticator = 0xdb58714687848c2c42bc8f5e91069891 > > > > However it does not generate an Accounting OFF record when it is shut > > down, nor an Accounting ON record when it is started. If these 2 > > features could be added to chillispot (10 or 20 lines of code at most > > given that you already generate an Auth packet on boot) then FreeRADIUS > > will know to automatically clear all active sessions from the accounting > > table (With its default configuration). Even if the power is lost from > > the device running chillispot if it sends an Accounting ON record on > > boot FreeRADIUS runs the following query on the accounting table: > > > > accounting_onoff_query = "UPDATE ${acct_table1} \ > > SET AcctStopTime = ('%S'::timestamp - > > '%{Acct-Delay-Time:-0}'::interval), \ AcctSessionTime = (EXTRACT(EPOCH > > FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with > > time zone \ > > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, \ > > AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = 0 \ > > WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND > > NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" > > > > And this query on the IP lease table: > > > > on-clear = "UPDATE ${ippool_table} \ > > SET nasipaddress = '', pool_key = 0, callingstationid = '', \ > > expiry_time = 'now'::timestamp(0) - '1 second'::interval \ > > WHERE nasipaddress = '%{Nas-IP-Address}'" > > > > If the chillispot developers could add this basic feature, it would: > > a) be usefull to chillispot users > > b) reduce some questions to the FR mailing list which we can currently > > do nothing about :-) > > > > I would be happy to help in any way necessary if you have any questions > > about this RADIUS feature. > > > > Regards > > _______________________________________________ > ChilliSpot mailing list > ChilliSpot(a)chillispot.org > http://chillispot.org/mailman/listinfo/chillispot_chillispot.org -- Peter Nixon http://peternixon.net/

1 0

OpenSER + FreeRadius implementations example
by FreeRadius-ML 17 Jul '07

17 Jul '07

Hi All, Ok, I'm a bit mixed up here, the documents are simply not cutting it. I'm wondering if any of you have a working OpenSER + FreeRadius configuration that I can look at and extrapulate my required settings? I've gone over all the material I could find, but all of it reverts back to the outdated how-to on the FreeRadius website. Assistance would be highly appreciated. Regards, Z2L

2 1

Interim-Updates
by Irina 17 Jul '07

17 Jul '07

Hello all, We enabled Cisco NAS to send Interim-Updates to the radius server, once an hour. Everything is great except for the following. There are users that use a lot of bandwidth. Seems, NAS wraps Acct-Input-Octets and Acct-Output-Octets at 4 GB. We have few users that may have their bandwidth reset to 0 within hour. When next Interim-Updates is sent, we don't have a proper number. Do I miss something in Radius configuration? Or is something that has to be handled by NAS? Any help is appreciated. Thank you. Irina

6 22

sqlcounters
by Mufasa 17 Jul '07

17 Jul '07

Is there a way to use the sqlcounters to count up data and reply with a session timeout or another attribute ? thx grant

3 3

1.1.7 problem with DEFAULT Auth-Type
by Hugh Messenger 17 Jul '07

17 Jul '07

I just had my first aborted attempt at running 1.1.7 on one of my live servers. Main problem is it just refuses to pick up the . DEFAULT Auth-Type = pam Fall-Through = 1 . in my users file, which is pretty much my entire users file, the only other entry is the standard PPP default entry. Everything else is in SQL. Unfortunately, I panicked after 5 mins of flailing around and reinstalled 1.1.6, and neglected to copy the -X output, which has since scrolled off the edge of the world. However, it definitely never printed any "Matched entry DEFAULT" lines, and complained that no Auth-Type was set. The same users file works fine in 1.1.6. -- hugh

2 2

radius log file problem
by Tevfik Kiziloren 17 Jul '07

17 Jul '07

I have a radius server working properly. However i can't see any log information within the radius.log file. I configured related part of my radius.conf file as below: ----------------------------------------------------------------- prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ... ... ... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = no # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ... ... ... ---------------------------------------------------------------------------------------- I could not see what's wrong with it. What could be the reason of this problem. Thanks in advance. Tevfik Kızılören -- View this message in context: http://www.nabble.com/radius-log-file-problem-tf4096623.html#a11648529 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

RLM_PERL Integration Issue
by FreeRadius-ML 17 Jul '07

17 Jul '07

Ok, now we are getting somewhere, I'm getting the following output: rad_recv: Access-Request packet from host 192.168.2.80:43835, id=102, length=234 User-Name = "101(a)192.168.2.80" Digest-Attributes = 0x0a05313031 Digest-Attributes = 0x010e3139322e3136382e322e3830 Digest-Attributes = 0x022a34363939653236343763333537313631373066343236656466366262383661666535633736636466 Digest-Attributes = 0x04127369703a3139322e3136382e322e3830 Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303134313333 Digest-Attributes = 0x081237633762663032366635646533653537 Digest-Response = "90ea471ad7040bab866ffa15ee80e21d" Service-Type = Authenticate-Only Sip-Uri-User = "101" NAS-Port = 5060 NAS-IP-Address = 192.168.2.80 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radius/radacct/192.168.2.80/auth-detail-20070715' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.2.80/auth-detail-20070715 modcall[authorize]: module "auth_log" returns ok for request 6 perl_pool: item 0x8af4268 asigned new request. Handled so far: 1 found interpetator at address 0x8af4268 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x8af4268 modcall[authorize]: module "perl" returns ok for request 6 modcall: leaving group authorize (returns ok) for request 6 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [101(a)192.168.2.80/<no User-Password attribute>] (from client openser port 5060) Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 2 seconds... I think I have a section missing from FreeRadius configuration, is that correct? Zap2Link -----Original Message----- From: freeradius-users-bounces+freeradius=zap2link.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+freeradius=zap2link.com@lists.freeradius.org] On Behalf Of tnt(a)kalik.co.yu Sent: Tuesday, July 17, 2007 12:08 PM To: FreeRadius users mailing list Subject: Re: RLM_PERL integration issue radiusd -X Ivan Kalik Kalik Informatika ISP Dana 17/7/2007, "freeradius(a)zap2link.com" <freeradius(a)zap2link.com> piše: >Hi All, > > > > I've followed the rlm_perl information to integrate a PERL based >example for Radius Authentication. > >I basically used the same example that is in the document. I know that >the script is loaded whe FreeRadius is loaded, however, It would seem >that all requests to the Radius server are not processed via rlm_perl. > > > > Is there a way to verify that rlm_perl is invoked? > > > >Zap2Link > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4