- Freeradius-Users - lists.freeradius.org

Decreasing connection time (Session-Timeout)
by micobros 22 Oct '06

22 Oct '06

Hello, I have a wisp solution working with mysql+freeradius and chillispot (ver 1.1) working pretty well together (bandwdth limit, user/password, connection time, etc.). But. there's one more thing I need. Lets say a user has 1 hour of connection time (Session-Timeout := 3600) and stays on the network for 20 minutes than disconnects. Chillispot is informed of this and sends freeradius an "Accounting-Request" message with "Acct-Status-Type=stop" attribute and "Acct-Session-Time=1200" attribute. Now, how could I subtract the elapsed time from the original Session-Timeout time? So that the user will, at the next login, only have 40minutes left. Cheers, mico "The only way to get rid of a temptation is to yield to it." (Oscar Wilde)

1 0

radutmp and/or SQL Accounting
by Matt Harlum 22 Oct '06

22 Oct '06

Hey guys, I've got my radiusd setup to work from an SQL Database for WPA Enterprise encryption, However i cannot get radutmp or SQL accounting to work, i'm running it on OSX 10.4.8 My Radiusd.conf is attached

2 3

EAP-TTLS problem at phase 1
by Rafiqul Ahsan 21 Oct '06

21 Oct '06

Hi all, I have been trying to figure this out for couple days, but could not get any clue. My test is about authentication with EAP-TTLS/MSCHAPV2. I am using freeradius v - 1.1.3, on Solaris 10. No matter what I do, I get "rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request" at the server. Anybody can help me what went wrong ? Here is my configs..and logs (truncated) Awaits some solution... Rafi Here is my eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { rsa_key_exchange = yes dh_key_exchange = no rsa_key_length = 1024 dh_key_length = 1024 verify_depth = 2 pem_file_type = yes private_key_password = "wimax i2 test certs" private_key_file = /etc/freeradius/etc/certs/key2.pem certificate_file = /etc/freeradius/etc/certs/cert2.pem CA_file = /etc/freeradius/etc/certs/cacert.pem dh_file = /etc/freeradius/etc/certs/dh random_file = /etc/freeradius/etc/certs/random fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } ttls { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no } peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } mschapv2 { } } Here is my users file : "testuser" Auth-Type := EAP, User-Password := "testuser" DEFAULT Auth-Type := EAP Here is my supplicant config : # cat supplicant.conf ctrl_interface=/var/tmp/supplicant.ctl eap_trace=1 enableWiMAXauth=1 validateFNECerts=1 checkCRL=1 ignoreTimeOfDay=0 update_config=0 data_interface=/var/tmp/supplicant_data.ctl ap_scan=0 fast_reauth=1 load_dynamic=/usr/lib/wpa_supplicant/eap_ttls.so network={ eap=TTLS eap_workaround=1 anonymous_identity="anonymous_identity" ca_path="/var/tmp/truststore" ca_cert="/var/tmp/root.crt" client_cert="/var/tmp/cpe.crt" private_key="/var/tmp/key" private_key_passwd="wimax i2 test certs" phase2="auth=MSCHAPV2" } Here is the radius log (only shown the failed part) rlm_fastusers: checking defaults^M fastusers: Matched DEFAULT at 6^M modcall[authorize]: module "fastusers" returns updated for request 1^M modcall: leaving group authorize (returns updated) for request 1^M rad_check_password: Found Auth-Type EAP^M auth: type "EAP"^M Processing the authenticate section of radiusd.conf^M modcall: entering group authenticate for request 1^M rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request^M rlm_eap: Failed in handler^M modcall[authenticate]: module "eap" returns invalid for request 1^M modcall: leaving group authenticate (returns invalid) for request 1^M

2 4

how to force "Accept" and override default and null proxy realms?
by Mike 21 Oct '06

21 Oct '06

I would like to always send an Accept unconditionally if the User-Name is test[0-9], but proxy request to default or null realm for all other user names. I tried a configuration with authorize { files suffix } the "suffix" will match on default and null realms. I currently have a line in users file that looks like this: DEFAULT User-Name =~ "test[0-9]", Auth-Type: Accept however regardless of which user makes the request, even the "test" user (which does match), the request is still proxied. If I change "Auth-Type: Reject", then the test user is always rejected, but I am looking for the opposite behavior. Thanks in advance for any help or pointers.

2 1

CVS make error
by Jan Mulders 20 Oct '06

20 Oct '06

Hello all, After much trouble I've managed to get CVS to download the right version of freeradius (not radiusd-cistron...doh), and now I'm having some problems with making it. >From what I can see, there's some problems with EAP (which I happen to not need). Is it possible (or even recommended) to remove EAP from the compilation process? If so, how do I go about doing this? Failing that, if somebody is feeling really nice they could code a fix for CVS :) Regards, Jan /root/installs/radiusd-cvs/radiusd/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c -fPIC -DPIC -o .libs/radeapclient.o radeapclient.c: In function `radlog': radeapclient.c:111: warning: implicit declaration of function `va_start' radeapclient.c:111: warning: nested extern declaration of `va_start' radeapclient.c:113: warning: implicit declaration of function `va_end' radeapclient.c:113: warning: nested extern declaration of `va_end' radeapclient.c: In function `log_debug': radeapclient.c:124: warning: nested extern declaration of `va_start' radeapclient.c:111: warning: redundant redeclaration of 'va_start' radeapclient.c:111: warning: previous implicit declaration of 'va_start' was here radeapclient.c:126: warning: nested extern declaration of `va_end' radeapclient.c:113: warning: redundant redeclaration of 'va_end' radeapclient.c:113: warning: previous implicit declaration of 'va_end' was here radeapclient.c: In function `radlog': radeapclient.c:106: warning: 'ap' might be used uninitialized in this function radeapclient.c: In function `log_debug': radeapclient.c:121: warning: 'ap' might be used uninitialized in this function gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/installs/radiusd-cvs/radiusd/src -Ilibeap -c radeapclient.c -o radeapclient.o >/dev/null 2>&1 /root/installs/radiusd-cvs/radiusd/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libeap.la -lnsl -lresolv -lpthread -lcrypto -lssl -lcrypto gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/libeap.so -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,--rpath -Wl,/usr/local/lib .libs/radeapclient.o(.text+0x13b): In function `radlog': /root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:111: undefined reference to `va_start' .libs/radeapclient.o(.text+0x15a):/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:113: undefined reference to `va_end' .libs/radeapclient.o(.text+0x193): In function `log_debug': /root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:124: undefined reference to `va_start' .libs/radeapclient.o(.text+0x1b2):/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap/radeapclient.c:126: undefined reference to `va_end' collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/installs/radiusd-cvs/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/installs/radiusd-cvs/radiusd' make: *** [all] Error 2

2 1

freeradius-snapshot-20061020 make error
by Velikanov 20 Oct '06

20 Oct '06

Good Day. Such error in freeradius-snapshot-20061020 during "make" What to do? Making all in rlm_acct_unique... gmake[6]: Entering directory `/u01/data/freeradius-snapshot-20061020/src/modules/rlm_acct_unique' /u01/data/freeradius-snapshot-20061020/libtool --mode=compile gcc -g -O2 -I/u01/data/freeradius-snapshot-20061020/src -c rlm_acct_unique.c mkdir .libs gcc -g -O2 -I/u01/data/freeradius-snapshot-20061020/src -c rlm_acct_unique.c -fPIC -DPIC -o .libs/rlm_acct_unique.o In file included from rlm_acct_unique.c:28: /u01/data/freeradius-snapshot-20061020/src/freeradius-devel/radiusd.h:390: error: syntax error before "va_list" Thanks

3 2

Dialupadmin and PHP Question
by Darcy Parker 20 Oct '06

20 Oct '06

Good day all, I am running ubuntu 6.06, I have apache2, PHP5, and MySql installed. I ran the following command to install freeradius: root@postoffice:~# apt-get install freeradius freeradius-ldap freeradius-mysql freeradius-krb5 libperl5.8 I then ran the following command to get dialupadmin root@postoffice:~# apt-get install freeradius-dialupadmin Reading package lists... Done Building dependency tree... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. Since you only requested a single operation it is extremely likely that the package is simply not installable and a bug report against that package should be filed. The following information may help to resolve the situation: The following packages have unmet dependencies: freeradius-dialupadmin: Depends: php4 but it is not going to be installed E: Broken packages How do I make this work or is there something else I can use? (Webmin?????) Darcy

2 2

pppd/pptp + freeradius + static IP FYI
by Michael Gale 20 Oct '06

20 Oct '06

Hello, FYI - Requirements for me to give out static IP address to users using the following: pptpd-1.3.3-1.fc4 ppp-2.4.3-5.fc4 freeradius-mysql-1.1.3-1 freeradius-debuginfo-1.1.3-1 freeradius-1.1.3-1 freeradius-unixODBC-1.1.3-1 freeradius-postgresql-1.1.3-1 I have a rlm_perl module that I use to authenticate users and provide static IP addresses. I came across the following info / issues when setting this up: 1. /etc/raddb/users file This file contained a default entry for "Framed-IP-Address" which was overriding the value set by the rlm_perl module. The "DEFAULT" options needed to be changed to remove the setting of the IP address. 2. /etc/pptpd.conf file In this file I uncommented the "delegate" option to allow the IP address to be set by the radius or chap-secrets. So PPTP will NOT pass an IP address to pppd. So disables the localip and remoteip options at the bottom. * With this option commented out, the IP address returned by freeradius was still being taken and given to the client, however the pptpd documentation says to enable the "delegate" option if you are going to do that. 3. /etc/ppp/options.pptpd file Once the "delegate" option was enabled, pppd would fail with the error "Could not determine local IP address". Since this address is no longer being set. Simple added the same IP address used in pptpd.conf localip to the options.pptpd file in the format: ipaddress: According to the man page: OPTIONS <local_IP_address>:<remote_IP_address> Set the local and/or remote interface IP addresses. Either one may be omitted. The IP addresses can be specified with a host name or in decimal dot notation (e.g. 150.234.56.78). The default local address is the (first) IP address of the system (unless the noipdefault option is given). The remote address will be obtained from the peer if not specified in any option. Thus, in simple cases, this option is not required. If a local and/or remote IP address is specified with this option, pppd will not accept a different value from the peer in the IPCP negotiation, unless the ipcp-accept-local and/or ipcp-accept-remote options are given, respectively. I added the system's IP address with the colon, with allowed pppd to determine it's localip and radius to set the client's IP address. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

1 0

RE: static IP's with rlm_perl
by Garber, Neal 20 Oct '06

20 Oct '06

> $RAD_REPLY{'Framed-IP-Address'} = '192.168.77.200'; See if the following helps: use Socket; . . . $RAD_REPLY{'Framed-IP-Address'} = inet_aton('192.168.77.200');

3 2

Re: SNMP with Freeradius - Again
by Velikanov 20 Oct '06

20 Oct '06

Good Day. I use Oracle with Freeradius. The situation with SNMP is as follows now: 1. When i have sql in radiusd.conf and such string: snmp = no then i have working radiusd with Oracle 2. When i have no sql , but have snmp = yes then i have working radiusd with SNMP 3. When i have sql in radiusd.conf and snmp = yes i have not working radiusd, debug does not contain any strings with SMUX and it is finished with: Module: Instantiated sql (sql) Segmentation fault In all cases the configurations was the same, except pointed above I post you the radiusd -X of last case (3) with sql and snmp = yes Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/oraclesql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/etc/raddb/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = yes preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "Acct-Session-Id, NAS-IP-Address, Login-IP-Host, Login-TCP-Port" Module: Instantiated acct_unique (acct_PIX) exec: wait = yes exec: program = "/usr/local/etc/raddb/radius.auth" exec: input_pairs = "request" exec: output_pairs = "request" exec: packet_type = "(null)" Module: Instantiated exec (echo) Module: Loaded SQL sql: driver = "rlm_sql_oracle" sql: server = "192.168.98.100" sql: port = "1521" sql: login = "inter1_odessa" sql: password = "inter1_odessa" sql: radius_db = "(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = apusold)(PORT = 1521))(CONNECT_DATA = (SERVICE_NAME = APUSOLD)))" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT * FROM TABLE(CAST(INTERNET_SECURITY.CHECK_USER ?('%{SQL-User-Name}', ?'%{NAS-IP-Address}','%{NAS-Port-T sql: authorize_reply_query = "SELECT * FROM ?TABLE(CAST(INTERNET_SECURITY.REPLY_USER('%{SQL-User-Name}','%{NAS-IP-Addres s}','%{Framed-Protoc sql: authorize_group_check_query = "" sql: authorize_group_reply_query = "" sql: accounting_onoff_query = "UPDATE radacct ?SET AcctStopTime=TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), ?AcctSessionTime=((TO_DATE('%S','yyyy sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', ''), AcctStatusType = '%{Acct-St sql: accounting_update_query_alt = "INSERT into radacct ?(RadAcctId, AcctSessionId, AcctUniqueId, UserName, ?NASIPAddress, NASPort, NASPortT sql: accounting_start_query = "INSERT into radacct (UserName, NASIPAddress, NASPort, NASPortType, ServiceType, AcctStatusTy sql: accounting_start_query_alt = "UPDATE radacct SET ?AcctStartTime = TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'),AcctStartDelay = '%{Acct-Delay- sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), AcctStatusType = '%{Acct-Status-Type} sql: accounting_stop_query_alt = "INSERT into radacct ?(UserName, NASIPAddress, NASPort, NASPortType, ServiceType, ?AcctStatusType, ?AcctSe sql: group_membership_query = "SELECT SERVICE_NAME FROM usergroup ?WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct ?WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL ??AND NASIPAddress = '%{N sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, ?NASIPAddress, NASPort, FramedIPAddress, CallingStationId, ?FramedProt sql: postauth_query = "INSERT into radpostauth ?(id, username, user_password, sql_password, Packet_Type, ?AUTH_START_TIME, reply_message,ses sql: safe-characters = "$@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to inter1_odessa@192.168.98.100:1521/(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = apusold)(PORT = 1 rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_oracle #1 rlm_sql (sql): Attempting to connect rlm_sql_oracle #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_oracle #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_oracle #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=192.168.10.111,shortname=192.168.10.111,secret=test123 rlm_sql (sql): Adding client 192.168.10.111 (192.168.10.111) to clients list rlm_sql (sql): Read entry nasname=pix.asu.farlep.net,shortname=PIX,secret=pixfirewall rlm_sql (sql): Adding client 192.168.98.1 (PIX) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Instantiated sql (sql) Segmentation fault Thanks for your attention.

2 1