- Freeradius-Users - lists.freeradius.org

Re: [Chillispot] Lack of Accounting ON/OFF in ChiliSpot RADIUS implementation
by Peter Nixon 17 Jul '07

17 Jul '07

After receiving your mail, I decided to do a little more ChilliSpot testing. a) Chillispot does not send an accounting ON packet on startup b) Chillispot does not send an accounting OFF packet on shutdown c) Chillispot does send an accounting Stop packet with "Acct-Terminate-Cause = NAS-reboot" for active sessions when shutdown cleanly. Now, c) is usefull in situations when you cleanly shutdown chillispot as it gives a proper stop record with the most information of the 3 options including final data counters. Instead of c) it would actually have been much easier to implement b) so I congratulate the chillispot author for his efforts. I still recommend that b) also be implemented however as it allows easy reporting of when the NAS was last shutdown. HOWEVER, If I only had the choice of ONE of the three options, I would pick option a) as it guarantees that the RADIUS server's idea of the active sessions will always be reset when the NAS boots. It is also the only one of the three options which (network conditions allowing) is always going to be delivered to the RADIUS server, as both b) and c) will not be sent in the case of a power outage or lockup of the NAS. To recap, ChilliSpot SHOULD send an accounting ON packet to the RADIUS server when it boots, and probably should send an OFF packet upon shutdown, although this is not critical given that it cleanly closes the sessions anyway. IF an accounting OFF packet is sent upon shutdown, it should be sent LAST, after all the session Stop packets are sent, otherwise the OFF packet will close all the active sessions on the RADIUS server, and the session Stop packets will generate duplicate SQL records as the radius server will err on the side of caution and prefer to duplicate records in the DB instead of possibly losing a session for which it did not receive a Start record. Regards Peter On Tue 17 Jul 2007, sophana wrote: > I'm receiving sometimes radius session stop requests with the terminate > cause "NAS-reboot". > Isn't it what you want? I don't know why it doesn't always work. > The problem is that it can't work reliably. > If there is a power off or whatever other reason, you don't get your > information. > Only the "on" information would be useful. > > Personally, I use trigger a periodic task that check open sessions which > haven't received alive requests since some time and close them. > If the user logs back before, you can detect that based on the > calling/called mac addresses and nasId and force the shutdown. > > Peter Nixon a écrit : > > Hi Guys > > > > I am one of the FreeRADIUS developers, as well as the openSUSE > > network:AAA project founder. As part of that project I also maintain > > ChilliSpot rpms. > > > > Over that last 6-9 months we have been getting increasing numbers of > > queries regarding ChilliSpot on the FreeRADIUS mailing list. One of the > > common queries we get is how to make FreeRADIUS "understand" when a > > chillispot NAS has been rebooted and all the users have been kicked off, > > but no accounting stop records have been received. > > > > I have taken a look at ChilliSpot and it generates an Auth packet > > similar to the following on initial start: > > > > rad_recv: Access-Request packet from host 192.168.2.67 port 2050, id=0, > > length=113 > > User-Name = "chillispot" > > User-Password = "chillispot" > > NAS-IP-Address = 192.168.1.7 > > Service-Type = Administrative-User > > NAS-Identifier = "demo" > > Called-Station-Id = "00:11:70:4f:01:aa" > > NAS-Port-Type = Wireless-802.11 > > Message-Authenticator = 0xdb58714687848c2c42bc8f5e91069891 > > > > However it does not generate an Accounting OFF record when it is shut > > down, nor an Accounting ON record when it is started. If these 2 > > features could be added to chillispot (10 or 20 lines of code at most > > given that you already generate an Auth packet on boot) then FreeRADIUS > > will know to automatically clear all active sessions from the accounting > > table (With its default configuration). Even if the power is lost from > > the device running chillispot if it sends an Accounting ON record on > > boot FreeRADIUS runs the following query on the accounting table: > > > > accounting_onoff_query = "UPDATE ${acct_table1} \ > > SET AcctStopTime = ('%S'::timestamp - > > '%{Acct-Delay-Time:-0}'::interval), \ AcctSessionTime = (EXTRACT(EPOCH > > FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with > > time zone \ > > - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, \ > > AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = 0 \ > > WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND > > NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" > > > > And this query on the IP lease table: > > > > on-clear = "UPDATE ${ippool_table} \ > > SET nasipaddress = '', pool_key = 0, callingstationid = '', \ > > expiry_time = 'now'::timestamp(0) - '1 second'::interval \ > > WHERE nasipaddress = '%{Nas-IP-Address}'" > > > > If the chillispot developers could add this basic feature, it would: > > a) be usefull to chillispot users > > b) reduce some questions to the FR mailing list which we can currently > > do nothing about :-) > > > > I would be happy to help in any way necessary if you have any questions > > about this RADIUS feature. > > > > Regards > > _______________________________________________ > ChilliSpot mailing list > ChilliSpot(a)chillispot.org > http://chillispot.org/mailman/listinfo/chillispot_chillispot.org -- Peter Nixon http://peternixon.net/

1 0

OpenSER + FreeRadius implementations example
by FreeRadius-ML 17 Jul '07

17 Jul '07

Hi All, Ok, I'm a bit mixed up here, the documents are simply not cutting it. I'm wondering if any of you have a working OpenSER + FreeRadius configuration that I can look at and extrapulate my required settings? I've gone over all the material I could find, but all of it reverts back to the outdated how-to on the FreeRadius website. Assistance would be highly appreciated. Regards, Z2L

2 1

Interim-Updates
by Irina 17 Jul '07

17 Jul '07

Hello all, We enabled Cisco NAS to send Interim-Updates to the radius server, once an hour. Everything is great except for the following. There are users that use a lot of bandwidth. Seems, NAS wraps Acct-Input-Octets and Acct-Output-Octets at 4 GB. We have few users that may have their bandwidth reset to 0 within hour. When next Interim-Updates is sent, we don't have a proper number. Do I miss something in Radius configuration? Or is something that has to be handled by NAS? Any help is appreciated. Thank you. Irina

6 22

sqlcounters
by Mufasa 17 Jul '07

17 Jul '07

Is there a way to use the sqlcounters to count up data and reply with a session timeout or another attribute ? thx grant

3 3

1.1.7 problem with DEFAULT Auth-Type
by Hugh Messenger 17 Jul '07

17 Jul '07

I just had my first aborted attempt at running 1.1.7 on one of my live servers. Main problem is it just refuses to pick up the . DEFAULT Auth-Type = pam Fall-Through = 1 . in my users file, which is pretty much my entire users file, the only other entry is the standard PPP default entry. Everything else is in SQL. Unfortunately, I panicked after 5 mins of flailing around and reinstalled 1.1.6, and neglected to copy the -X output, which has since scrolled off the edge of the world. However, it definitely never printed any "Matched entry DEFAULT" lines, and complained that no Auth-Type was set. The same users file works fine in 1.1.6. -- hugh

2 2

radius log file problem
by Tevfik Kiziloren 17 Jul '07

17 Jul '07

I have a radius server working properly. However i can't see any log information within the radius.log file. I configured related part of my radius.conf file as below: ----------------------------------------------------------------- prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ... ... ... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = no # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ... ... ... ---------------------------------------------------------------------------------------- I could not see what's wrong with it. What could be the reason of this problem. Thanks in advance. Tevfik Kızılören -- View this message in context: http://www.nabble.com/radius-log-file-problem-tf4096623.html#a11648529 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

RLM_PERL Integration Issue
by FreeRadius-ML 17 Jul '07

17 Jul '07

Ok, now we are getting somewhere, I'm getting the following output: rad_recv: Access-Request packet from host 192.168.2.80:43835, id=102, length=234 User-Name = "101(a)192.168.2.80" Digest-Attributes = 0x0a05313031 Digest-Attributes = 0x010e3139322e3136382e322e3830 Digest-Attributes = 0x022a34363939653236343763333537313631373066343236656466366262383661666535633736636466 Digest-Attributes = 0x04127369703a3139322e3136382e322e3830 Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303134313333 Digest-Attributes = 0x081237633762663032366635646533653537 Digest-Response = "90ea471ad7040bab866ffa15ee80e21d" Service-Type = Authenticate-Only Sip-Uri-User = "101" NAS-Port = 5060 NAS-IP-Address = 192.168.2.80 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radius/radacct/192.168.2.80/auth-detail-20070715' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.2.80/auth-detail-20070715 modcall[authorize]: module "auth_log" returns ok for request 6 perl_pool: item 0x8af4268 asigned new request. Handled so far: 1 found interpetator at address 0x8af4268 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x8af4268 modcall[authorize]: module "perl" returns ok for request 6 modcall: leaving group authorize (returns ok) for request 6 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [101(a)192.168.2.80/<no User-Password attribute>] (from client openser port 5060) Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 2 seconds... I think I have a section missing from FreeRadius configuration, is that correct? Zap2Link -----Original Message----- From: freeradius-users-bounces+freeradius=zap2link.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+freeradius=zap2link.com@lists.freeradius.org] On Behalf Of tnt(a)kalik.co.yu Sent: Tuesday, July 17, 2007 12:08 PM To: FreeRadius users mailing list Subject: Re: RLM_PERL integration issue radiusd -X Ivan Kalik Kalik Informatika ISP Dana 17/7/2007, "freeradius(a)zap2link.com" <freeradius(a)zap2link.com> piše: >Hi All, > > > > I've followed the rlm_perl information to integrate a PERL based >example for Radius Authentication. > >I basically used the same example that is in the document. I know that >the script is loaded whe FreeRadius is loaded, however, It would seem >that all requests to the Radius server are not processed via rlm_perl. > > > > Is there a way to verify that rlm_perl is invoked? > > > >Zap2Link > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

RLM_PERL integration issue
by freeradius＠zap2link.com 17 Jul '07

17 Jul '07

Hi All, I've followed the rlm_perl information to integrate a PERL based example for Radius Authentication. I basically used the same example that is in the document. I know that the script is loaded whe FreeRadius is loaded, however, It would seem that all requests to the Radius server are not processed via rlm_perl. Is there a way to verify that rlm_perl is invoked? Zap2Link

2 1

Re : How to configure EAP Identity in 1.1.3
by Gaonkar, Kedar 17 Jul '07

17 Jul '07

Why is the Code field of the EAP message 01? Isn't that a REQUEST message? Please correct me if I am wrong, but I thought the RADIUS server should get a Response packet with Code 2 and Type should be 1 (EAP Resp/Identity packet). May be it didnt get the Identity packet, and hence it cannot verify the Identity. Regards - Kedar Gaonkar Date: Mon, 16 Jul 2007 15:58:57 +0000 (GMT) From: Eshun Benjamin <bkeshun(a)yahoo.fr> Subject: Re : How to configure EAP Identity in 1.1.3 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <952625.72889.qm(a)web26009.mail.ukl.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" Check on your AP, client.conf and naslist ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Govardhana K N <govardhan.nagarajaiah(a)gmail.com> ? : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoy? le : Lundi, 16 Juillet 2007, 13h28mn 28s Objet : How to configure EAP Identity in 1.1.3 I changed it but the same error is still coming. On 7/16/07, Eshun Benjamin <bkeshun(a)yahoo.fr> wrote: You have misconfigured the Nas-Identifier > govardhana Nas-Identifier == nas, Nas-Port-Type == 15 You have NAS-Identifier = "jrcnas" ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Govardhana K N < govardhan.nagarajaiah(a)gmail.com> ? : FreeRadius <freeradius-users(a)lists.freeradius.org > Envoy? le : Lundi, 16 Juillet 2007, 12h24mn 09s Objet : How to configure EAP Identity in 1.1.3 Hi, I was trying to configure FreeRadius server with EAP authentication. AS mentioned in "eap.conf", I didn't change the Auth-Type, but I was sending a EAP message, and Message-Authenticator attributes in Access-Request. When i tried sending an Access-Request with EAP-Message, I got the following error "rlm_eap: Identity Unknown, authentication failed". How to configure the Identity for EAP? debug log from server: --------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = no exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32813, id=179, length=95 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x64c5851b699cd2c027877bbb94fe7f8b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jrc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type request id 16 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry jrc at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 179 to 127.0.0.1 port 32813 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 179 with timestamp 469b9233 Nothing to do. Sleeping until we see a request. debug log from Client: ------------------------------------- cheux301:/home/govardhana# radeapclient -x localhost auth jrcsecret <access-request +++> About to send encoded packet: User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00 Sending Access-Request of id 179 to 127.0.0.1 port 1812 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=179, length=20 rlm_eap: EAP-Message not found <+++ EAP decoded packet: Thanks & Regards, Govardhana K N -- With Regards, Govardhana K N - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- With Regards, Govardhana K N - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 5

EAP/PEAP, LDAP and Dynamic VLAN Assignment HOW-TO
by Vincenzo Agosti 17 Jul '07

17 Jul '07

Hi, i would make this architecture: - authentication EAP/PEAP with MS-CHAPv2 with users in LDAP database. Better with encrypted password, but not necessary. - Every users have an attribute or something to assign it a VLAN. I have OpenLDAP and Freeradius 1.1.3, the distributuion presents in CentOS 5. Is it possible? Some suggestions? -------------------------------------- Vincenzo Agosti Università degli Studi di Salerno Ufficio Sistemi Tecnologici Coordinamento Servizi Informatici Via Ponte don Melillo, s.n.c. 84084 - Fisciano (SA) Tel. +39 089 96 6101 - 9776 Fax +39 089 96 6368 - 9806 Cell. +39 335 427674 --------------------------------------

2 1