- Freeradius-Users - lists.freeradius.org

EAP-TTLS inner auth methods for 802.1x
by James Lever 29 Jan '07

29 Jan '07

I have configured a working EAP-TLS system and am now migrating to use EAP-TTLS (with both client side certificates and a password authentication mechanism). I'm stuck trying to work out how to avoid sending the password unhashed to the server and think that some form of CHAP/MSCHAPv2 might be the right way to go. My current thoughts are that I should use PAP with SHA1 or SSHA1 but I seem to get the right config (if it is even possible). So, with this problem, can anybody suggest a way to use SHA1/SSHA1 or some other form of cryptographically secure, non-cleartext password within the inner authentication mechanism of EAP-TTLS for use in WPA2 Enterprise/802.1x. If this is feasible/possible, are there any gotcha's with the various supplicants to getting this to work from the client side and avoiding sending the passwords in cleartext (inside the EAP-TLS tunnel). Also, while I'm here, any suggestions for an appropriate backend password store so that there is never a cleartext password except for the initial entry (password change) on the server side would be appreciated. cheers, James

3 4

PEAP Fast Reconnect
by King, Michael 29 Jan '07

29 Jan '07

Does FreeRADIUS support PEAP Fast Reconnect?

3 3

rlm_python
by Peter Nixon 29 Jan '07

29 Jan '07

Hi Guys Is anyone actually using rlm_python in production? Unlike rlm_perl we don't seem to have any example code or any decent documentation. I am looking at using it myself and just looking for some feedback.. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

4 5

3Com SuperStack3 4400
by diego＠gigadata.it 29 Jan '07

29 Jan '07

Hi, I'm authing about 60 3com 4400 switch with mysql. Everithing goes ok until the switch sends a particular request to the server. This is the request: rad_recv: Access-Request packet from host 10.10.0.219:2049, id=57, length=87 User-Name = "a3Com" User-Password = "a3Com" NAS-Port-Type = Virtual NAS-IP-Address = 10.10.0.219 Service-Type = Administrative-User Framed-MTU = 1024 Message-Authenticator = 0xebe1ebfa3372940ad96d932c10457ff8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 84 modcall[authorize]: module "preprocess" returns ok for request 84 radius_xlat: 'a3Com' rlm_sql (sql): sql_set_user escaped user --> 'a3Com' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'a3Com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'a3Com' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'a3Com' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'a3Com' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 84 modcall: group authorize returns ok for request 84 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [a3Com] (from client XXXXXXXXX port 0) Sending Access-Accept of id 57 to 10.10.0.219:2049 Finished request 84 Going to the next request This is OK, but switch says "The RADIUS Authentication service is not responding." The strange thing is the userame a3Com that i've never seen in any switch configuration. Is something related to including dictionary.3Com in dictionary file ? I've googled a lot and searched in 3Com knowledge base but can't find anything.

3 2

2GB problems
by Tas Dionisakos 29 Jan '07

29 Jan '07

I have setup a captive portal with mysql,chilli, and freeradius. My portal allows users access base on data use (quota), I am using the rlm_sqlcounter (from freeradius 1.1.4) to measure the usage on login. The problem Im having is that if I assign a quota more than 2gb freeradius sees the bytes in a negative value for some reason, I have attached rad logs. This is the line I dont understand (rlm_sqlcounter: Rejected user will, check_item=-1149239296, counter=0). Yet in mysql its fine! Any help with this will be greatly appreciated! rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=195 User-Name = "will" User-Password = "pass" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-16-CB-BE-3A-41" Called-Station-Id = "00-14-5E-18-83-D9" NAS-Identifier = "nas01" Acct-Session-Id = "45b7e66b00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x0444eede46ea26a2629277905eb408f7 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "will", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'will' rlm_sql (sql): sql_set_user escaped user --> 'will' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'will' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'will' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'will' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'will' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' rlm_sql (sql): - sql_xlat radius_xlat: 'will' rlm_sql (sql): sql_set_user escaped user --> 'will' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user will, check_item=-1149239296, counter=0 modcall[authorize]: module "mb" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 -- ************************************* Tas Dionisakos IT Manager St Mary’s College and Newman College The University of Melbourne T: 03 9342 1708 M: 0439 655 565 E: tas(a)newman.unimelb.edu.au C: (0o (||||)(||||) o0) *************************************

3 3

expiration attribute as an offset?
by liran tal 28 Jan '07

28 Jan '07

Hey guys, Is it possible to set the expiration attribute to be of an offset type? Instead of entering an absolute date is it possible to enter the duration of which the user will be allowed from the first time that he logins? Say I set an offset of +30 days, and the user logins for the first time only 6 months from now. So once he login'ed once then the counter will start counting 30 days from his first login and then expire the account. Thanks.

5 15

TTLS-PAP authentication with LDAP bind
by Richard Hesse 28 Jan '07

28 Jan '07

First off, I'd like to say thanks in advance to anyone who can help me here. I've spent the past few days searching the list archives and other sites for information on how to accomplish this. The overwhelming message from these searches was that "it should just work" and that "the server will figure out what to do." Sadly, that's not the case here. My goals here are straightforward: -Authorize the user in LDAP if a corresponding entry exists (just checking against uid, nothing fancy). -Support TTLS-PAP and PEAP-GTC. The default Macintosh configuration supports PEAP-GTC with no config. SecureW2 will be used for TTLS-PAP on Windows clients. -Authenticate the user's clear-text password via a simple LDAP bind encrypted via TLS. No userPassword attribute checking here. A simple bind is all. Using version 1.14. Here's my eap.conf with comments stripped out: eap { default_eap_type = ttls timer_expire = 10 ignore_unknown_eap_types = no cisco_accounting_username_bug = no gtc { challenge = "Password: " auth_type = PAP } tls { private_key_password = foo private_key_file = ${raddbdir}/certs/key.pem certificate_file = ${raddbdir}/certs/cert.pem CA_file = ${raddbdir}/certs/sf_issuing.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ttls { default_eap_type = gtc } peap { default_eap_type = gtc } } Relevant sections of radius.conf are: ldap { server = "myserverentry" basedn = "myDN" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/intCA.pem tls_require_cert = "demand" access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess suffix ntdomain eap files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } If I force the Mac or Windows supplicants to use TTLS-PAP, the request is never passed to radiusd. I don't know what's going on but my AP (Aruba 200) seems to be detecting that something isn't right with its AAA server and not passing the request on. If I change the supplicants to use their default settings, the requests are sent to FreeRadius, but the requests fail. Again, the Aruba seems to think that something is wrong and presents its certificate instead of my server's. At one point, I had the clients seeing the server's certificate but I can't seem to get back in that state. So I don't think my AP is broken, I'm pretty sure it's my FreeRadius config that's broken. The users file is unchanged and the proper entries are in clients. Yes, I've run the server in debug mode (there are no requests coming in). Thanks, -richard ____________________________________________________________________________________ Have a burning question? Go to www.Answers.yahoo.com and get answers from real people who know.

2 1

SEVERE! radiusd 2.0 and 1.1.4 dying! Segmentation fault
by Guilherme Franco 28 Jan '07

28 Jan '07

Hi, Freeradius 2.0 alpha was working correctly since November 1st. Then, this month, suddenly the server started to die, complaining of "Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0". The server runs threaded with max_servers = 32 and num_sql_socks = 32 (there are 5 reqs per seconds, no more than that). Ok so I've tried to run it single threaded (-X), but then, it's slow and it missess some access requests, due to processing the accounting. I've uninstalled it and installed 1.1.4, but the same occurs! Restarting radiusd when it fails gives another 15 minutes before it dies again. Also, disabling accounting helps prolong the server lifetime. Any clue on that? Thanks. Sat Jan 27 19:13:16 2007 : Debug: modsingle[accounting]: returned from detail (rlm_detail) for request 108 Sat Jan 27 19:13:16 2007 : Debug: modcall[accounting]: module "detail" returns ok for request 108 Sat Jan 27 19:13:16 2007 : Debug: modsingle[accounting]: calling ippool (rlm_sqlippool) for request 108 Sat Jan 27 19:13:16 2007 : Debug: rlm_sql (sql_postgresql): Reserving sql socket id: 11 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'BEGIN' ********** Internal heap ERROR 17177 addr=(nil) ********* ****************************************************** HEAP DUMP heap name="Alloc statemen" desc=0x77e2b8 extent sz=0x1040 alt=32767 het=32767 rec=0 flg=2 opc=3 parent=0x77adb0 owner=(nil) nex=(nil) xsz=0x1040 EXTENT 0 addr=0x788818 Chunk 000788828 sz= 3752 free " " Chunk 0007896d0 sz= 312 freeable assoc with mark prv=(nil) nxt=(nil) Chunk 000789808 sz= 80 freeable assoc with mark prv=(nil) nxt=(nil) EXTENT 1 addr=0x77d3e8 Chunk 00077d3f8 sz= 2448 perm "perm " alo=32 Total heap size = 6592 FREE LISTS: Bucket 0 size=160 Bucket 1 size=288 Bucket 2 size=544 Bucket 3 size=1056 Bucket 4 size=2080 Chunk 000788828 sz= 3752 free " " Bucket 5 size=4128 Bucket 6 size=16416 Bucket 7 size=32800 Total free space = 3752 UNPINNED RECREATABLE CHUNKS (lru first): PERMANENT CHUNKS: Chunk 00077d3f8 sz= 2448 perm "perm " alo=32 Permanent space = 2448 ****************************************************** Hla: 255 ORA-21500: internal error code, arguments: [17177], [0x000000000], [], [], [], [], [], [] Errors in file : ORA-21500: internal error code, arguments: [17177], [0x000000000], [], [], [], [], [], [] ----- Call Stack Trace ----- calling call entry argument values in hex location type point (? means dubious value) -------------------- -------- -------------------- ---------------------------- Cannot seek to string table section header in /proc/11022/exe. Cannot seek to string table section header in /proc/11022/exe. 9688CDEF CALL 9660C588 0 ? 0 ? 774EC8 ? 0 ? 1 ? 0 ? 96DA64D8 CALLr 00000000 0 ? 0 ? 655680 ? 0 ? 4FA13060 ? 0 ? 96DA6CD4 CALL 965ED0E8 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'alfbericoz(a)foo.com' ORDER BY id' 0 ? 0 ? FF ? 0 ? 0 ? 0 ? 96DA6898 CALL 96605AC8 4FA13090 ? 0 ? 655680 ? 0 ? FF ? 0 ? 96D75B7F CALL 965FF0C8 0 ? 0 ? 0 ? 0 ? 788ED0 ? 0 ? 96D9135D CALL 96D757AA 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 966CA4FA CALL 96607898 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 966DF8CE CALL 966070F8 77DDA8 ? 0 ? 781BF0 ? 0 ? 4FA15E50 ? 0 ? 966DF582 CALL 965F7D68 0 ? 0 ? B0D0A8C0 ? 3E ? B0D0AE20 ? 3E ? 966DBF1E CALL 965FEC88 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 9678A292 CALL 9660F088 0 ? 0 ? 4FA161D0 ? 0 ? 772E10 ?Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'john(a)foo.com' ORDER BY id' 0 ? 962BB4F6 CALL 962BAD60 4FA160C0 ? 0 ? 6536A4 ? 0 ? 4FA162E2 ? 0 ? 0077C450 CALLs 00000000 ----- Argument/Register Address Dump ----- Argument/Register addr=774ec8. Dump of memory from 0x000774E88 to 0x000774FC8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 FFFFFFFF 00000000 007773F0 00000000 0077AB38 00000000 0077AEE0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 007748D0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 00000000 973DC7A0 0000002A 00001000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00FA865A 000000FF 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=655680. Dump of memory from 0x000655640 to 0x000655780 00000000 00000000 00000000 00000001 00000000 7273752F 636F6C2F 6C2F6C61 722F6269 00000000 735F6D6C 6F5F6C71 6C636172 2E312D65 2E342E31 00006F73 00000481 00000000 00000000 963BD000 0000002A 00654CC0 00000000 97657028 0000002A 00655B00 00000000 00000000 006551F0 00000000 00655680 00000000 00000000 00000000 00655AC8 00000000 00000000 00000000 00000000 97657078 0000002A 97657128 0000002A 97657118 0000002A 00000000 976570C8 0000002A 976570D8 0000002A 976570E8 0000002A 97657158 0000002A 00000000 97657168 0000002A 97657178 0000002A 976570F8 0000002A 97657108 0000002A 00000000 976570A8 0000002A 976570B8 0000002A 97657088 0000002A 97657098 0000002A 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 97657138 0000002A 00000000 00000000 97657188 0000002A 97657148 0000002A Argument/Register addr=4fa13060. Dump of memory from 0x04FA13020 to 0x04FA13160 00000000 4FA13060 00000000 96DA6CD9 0000002A 00774EC8 00000000 9688CBFE 0000002A 00000000 00000000 00000000 000000FF 00000000 00000000 00000000 00655680 00000000 00000000 4FA13140 00000000 96DA689D 0000002A 00000028 00000030 4FA13150 00000000 00000000 4FA13090 00000000 00655680 00000000 000000FF 00000000 97663E70 0000002A 00000000 000000FF 00000000 00000002 00000000 00000000 00000000 B0E2D800 0000003E 00000000 4FA131C0 00000000 B0A0A68A 0000003E 00000001 00000000 00000000 00000000 00000000 00774EC8 00000000 96411030 0000002A 00000000 00000000 B0A0A552 0000003E 00000000 00000000 00000000 00000002 00000000 00004319 00000000 00000000 00000000 00000000 00774EC8 00000000 00000000 00000000 B0E2D800 0000003E 00655680 00000000 00000000 4FA131C0 00000000 96D75B84 0000002A 00000000 0000003E 4FA13198 00000000 Argument/Register addr=788ed0. Dump of memory from 0x000788E90 to 0x000788FD0 00000000 00000000 00000000 00040000 00000000 00000000 00050001 00000029 009B51C0 00000000 009F97A6 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000105 00000029 00000000 00000000 00000000 00000000 00000000 00000000 00010001 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000029 00000000 00000002 00000002 00000002 00000000 00000000 00000000 00788E38 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00788B28 00000000 00000000 00000000 00000029 00000191 20B38F00 00788E18 00000000 00000000 00000000 00000000 00000000 00000000 F8E9DACB 00000604 Argument/Register addr=77dda8. Dump of memory from 0x00077DD68 to 0x00077DEA8 00000000 00000000 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000661 30B38F00 0077D3B8 00000000 00000000 00000000 00000000 00000000 00000000 F8E9DACB 00000401 007748D0 00000000 007748D0 00000000 00000000 40000400 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0077E2B8 00000000 00000000 00000000 00000000 00000000 0000007C 00000BFF 00000000 00000000 00000000 00000002 00000060 00000000 00000002 00000000 007896F0 00000000 00000112 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=781bf0. Dump of memory from 0x000781BB0 to 0x000781CF0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 007846C0 00000000 00000000 00000007 00000000 00000000 00000000 00028000 00000002 00000000 00000000 00000000 00000000 00000000 007834E4 00000000 0000000D 00000000 00000000 00000000 00000000 00783518 00000000 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0078351A 00000000 0077DDA8 00000000 00000000 00000000 00000000 00000000 00000000 00783530 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Repeat 1 times 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=4fa15e50. Dump of memory from 0x04FA15E10 to 0x04FA15F50 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00783530 00000000 00781BF0 00000000 007834C8 00000000 00000000 00781BE8 00000000 9734DE24 0000002A 4FA15F90 00000000 966DBF23 0000002A 00000000 0077DDA8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00774960 00000000 00000000 00000000 00000000 00000001 00000000 00000000 00000000 0077DDA8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0077C450 00000000 0077D128 00000000 00000000 00000000 00000000 4FA161D0 00000000 00772DB0 00000000 00653200 00000000 00772DB0 00000000 00000000 00000001 00000000 4FA15FE0 00000000 00000000 00000000 00000000 00000000 00000000 0077DDA8 00000000 0077EFB8 00000000 0077DE28 00000000 0077E178 00000000 00000000 0077E180 00000000 0077C8E8 00000000 Argument/Register addr=4fa161d0. Dump of memory from 0x04FA16190 to 0x04FA162D0 00000000 00000000 00000000 4FA16840 00000000 00000000 955729B2 0000002A 00000000 00000000 00000000 00000000 00000000 00000001 00000000 00000020 00000000 00000000 0000000A 454C4553 72205443 72676461 7270756F 00000000 796C7065 2C64692E 67646172 70756F72 6C706572 72472E79 4E70756F 2C656D61 00000000 67646172 70756F72 6C706572 74412E79 62697274 2C657475 67646172 70756F72 00000000 6C706572 61562E79 2C65756C 67646172 70756F72 6C706572 706F2E79 52462020 00000000 72204D4F 72676461 7270756F 796C7065 6573752C 6F726772 57207075 45524548 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'alfbericoz(a)foo.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '100.125.1.1' AND pool_key = '2952792152' AND username = 'manoel(a)foo.com' AND callingstationid = '#BRAS-01#E110#2136'' Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK 00000000 65737520 6F726772 552E7075 6E726573 20656D61 6D27203D 656C6C75 72616D72 Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = 0 Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = 00000000 736E6974 72657340 746D6F63 632E6C65 622E6D6F 41202772 7520444E 67726573 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '100.125.1.1' AND pool_key = '2147485784' AND username = 'manoel(a)foo.com' AND callingstationid = '#BRAS-01#E80#2136'' Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '100.125.1.1' AND pool_key = '2147485849' AND username = 'cezar(a)foo.com' AND callingstationid = '#BRAS-01#E80#2201'' Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'COMMIT' 00000000 70756F72 6F72472E 614E7075 3D20656D 64617220 756F7267 70657270 472E796C 00000000 70756F72 656D614E 44524F20 42205245 Argument/Register addr=772e10. Dump of memory from 0x000772DD0 to 0x000772F10 00000000 00000000 00000000 00000000 00000000 00000000 00748250 00000000 00000000 00000000 00772E10 00000000 00000000 00000000 00000000 00000000 00000000 00000051 00000000 007748D0 00000000 0077C450 00000000 00000000 0077D128 00000000 0077DDA8 00000000 009CB560 00000000 009E1E80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000071 00000000 00000000 00656480 00000000 00000000 00000000 B0E306B8 0000003E 0076D7A0 00000000 00000000 0076D370 00000000 00000000 00000000 0076D480 00000000 00000008 00000040 00000000 00772ED0 00000000 00000000 00000000 0076D690 00000000 00000007 00000020 00000000 00000000 00000000 00000091 00000000 B0E30828 0000003E B0E30828 0000003E 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=4fa160c0. Dump of memory from 0x04FA16080 to 0x04FA161C0 00000000 006528B0 00000000 984025B0 0000002A 0091DFA0 00000000 00772DB0 00000000 00000000 4FA161D0 00000000 961B5744 0000002A 00000000 00000000 4FA160D0 00000000 00000000 00000000 00000000 00A02350 00000000 6C6C756D 616D7265 6E697472 65734073 00000000 6D6F6372 2E6C6574 2E6D6F63 00007262 955728DF 0000002A 4FA167B0 00000000 00000000 4FA16776 00000000 00000002 73000000 00000320 00000000 00000000 00000000 00000000 00000000 00000000 4FA16360 00000000 FFFFFFFF 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000002 4FA16698 00000000 955729B2 0000002A 00000000 00000020 0000000E FFFFFFFF FFFFFFFF 00000000 00000000 4FA16840 00000000 00000000 955729B2 0000002A 00000000 00000000 00000000 00000000 00000000 00000001 Argument/Register addr=6536a4. Dump of memory from 0x000653664 to 0x0006537A4 00000000 472E7075 70756F72 656D614E 72203D20 72676461 7270756F 796C7065 00000000 6F72472E 614E7075 4F20656D 52454452 20594220 67646172 70756F72 6C706572 00000000 64692E79 00000000 000002D1 00000000 41445055 72204554 63616461 53207463 00000000 41205445 53746363 54706F74 3D656D69 445F4F54 28455441 27532527 7979272C 00000000 6D2D7979 64642D6D 32686820 696D3A34 2773733A 41202C29 53746363 69737365 00000000 69546E6F 283D656D 74786528 74636172 63657328 20646E6F 6D6F7266 75632820 00000000 6E657272 69745F74 7473656D 20706D61 5428202D 41445F4F 27284554 2C275325 00000000 79797927 6D6D2D79 2064642D 34326868 3A696D3A 29277373 20292929 7865202B 00000000 63617274 696D2874 6574756E 6F726620 6328206D 65727275 745F746E 73656D69 00000000 706D6174 28202D20 445F4F54 28455441 27532527 7979272C 6D2D7979 64642D6D 00000000 32686820 Argument/Register addr=4fa162e2. Dump of memory from 0x04FA162A2 to 0x04FA163E2 00000000 70756F72 6F72472E 614E7075 3D20656D 64617220 756F7267 70657270 472E796C 00000000 70756F72 656D614E 44524F20 42205245 61722059 6F726764 65727075 2E796C70 00000000 00006469 00000000 009F7BBC 00000000 4FA16440 00000000 955728D4 0000002A 00000000 00000006 00000000 984025B0 0000002A 009F7BBC 00000000 B0C5CFB9 0000003E 00000000 FBAD8001 00000000 009F7BBC 00000000 009F7BBC 00000000 009F7BBC 00000000 00000000 009F7BBC 00000000 009F7BC7 00000000 FFFFFFFF FFFFFFFF 009F7BBC 00000000 00000000 FFFFFFFF FFFFFFFF 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 4FA164F0 00000000 009CCBB0 00000000 00000000 4FA10000 00000000 00000000 00000000 000003F2 00000000 B0C48276 0000003E 00000000 00000018 00000030 00000000 00000000 4FA163E0 00000000 00521080 00000000 00000000 FFFFFFFF ----- End of Call Stack Trace ----- Segmentation fault

3 3

Change of Authorization
by Jeffrey Sewell 27 Jan '07

27 Jan '07

Apologies if this has been addressed before, but I can't find any references in the Wiki or the archives for the use of rfc 3576 Change of Authorization messages. Does FreeRADIUS have any built in way to trigger and/or send a CoA? How have others dealt with users who have exceeded certain limits but have not yet reached session-timout? --Jeffrey

3 3

Log notfound users
by Guilherme Franco 27 Jan '07

27 Jan '07

Hello, In authorize section I have the following: sql { notfound = reject } In post-auth: Post-Auth-Type REJECT { sql attr_filter.access_reject } Both works correctly but I would like to log notfound users into radpostauth table as well, just like in post-auth. How may I do this, please? Thank you.

1 1