- Freeradius-Users - lists.freeradius.org

Re: only work with 5 users or clients
by Tom Miller 04 Oct '06

04 Oct '06

Now if I have only 1 to 4 user login then this hnguyen user will able to login. I similated it by comments out some users in the users file. This how I was able to determine the system only allow 5 user to sign in. As you can see in the log file these information did not pass to the radius when it is over five user or not working Tunnel-Server-Endpoint:0 = "12.12.126.5" Tunnel-Client-Endpoint:0 = "12.12.126.6" I am thinking the problem is with the NAS devices (7204). However, I can figure out what. Thanks again for look into my issues. **********This one doesn't work************ rad_recv: Access-Request packet from host 172.17.17.1:1645, id=202, length=95 NAS-IP-Address = 172.17.17.1 NAS-Port = 7 NAS-Port-Type = ISDN User-Name = "hnguyen(a)campbell.com" CHAP-Password = 0xc892e3c15917124c44f86fdbda34f524e7 Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: Looking up realm "campbell.com" for User-Name = "hnguyen(a)campbell.com" rlm_realm: Found realm "campbell.com" rlm_realm: Adding Stripped-User-Name = "hnguyen" rlm_realm: Proxying request from user hnguyen to realm campbell.com rlm_realm: Adding Realm = "campbell.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 18 users: Matched entry hnguyen at line 166 modcall[authorize]: module "files" returns ok for request 18 modcall: group authorize returns ok for request 18 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 202 to 172.17.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.172.15 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 18 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 18 ID 202 with timestamp 44f8a72e Nothing to do. Sleeping until we see a request. ******************************************************** **** THis one is working *********************** rad_recv: Accounting-Request packet from host 172.17.17.1:1646, id=199, length=232 NAS-IP-Address = 172.17.17.1 NAS-Port = 6 NAS-Port-Type = ISDN User-Name = "knguyen(a)campbell.com" Acct-Status-Type = Stop Acct-Authentic = RADIUS Service-Type = Framed-User Acct-Session-Id = "00000CD8" Framed-Protocol = PPP Tunnel-Server-Endpoint:0 = "12.12.126.5" Tunnel-Client-Endpoint:0 = "12.12.126.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "CAMPBELL" Tunnel-Server-Auth-Id:0 = "sfldse26rr.mi.AADS" Acct-Tunnel-Connection = "13441125" Framed-IP-Address = 192.168.172.12 Acct-Terminate-Cause = Admin-Reset Acct-Input-Octets = 281672 Acct-Output-Octets = 266074 Acct-Input-Packets = 4390 Acct-Output-Packets = 4154 Acct-Session-Time = 1967 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 15 modcall[preacct]: module "preprocess" returns noop for request 15 rlm_acct_unique: Hashing 'NAS-Port = 6,Client-IP-Address = 172.17.17.1,NAS-IP-Address = 172.17.17.1,Acct-Session-Id = "00000CD8",User-Name = "knguyen(a)campbell.com"' rlm_acct_unique: Acct-Unique-Session-ID = "eb18422da9f1337f". modcall[preacct]: module "acct_unique" returns ok for request 15 rlm_realm: Looking up realm "campbell.com" for User-Name = "knguyen(a)campbell.com" rlm_realm: Found realm "campbell.com" rlm_realm: Adding Stripped-User-Name = "knguyen" rlm_realm: Proxying request from user knguyen to realm campbell.com rlm_realm: Adding Realm = "campbell.com" rlm_realm: Accounting realm is LOCAL. modcall[preacct]: module "suffix" returns noop for request 15 modcall[preacct]: module "files" returns noop for request 15 modcall: group preacct returns ok for request 15 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 15 radius_xlat: '/usr/local/var/log/radius/radacct/172.17.17.1/ detail-20060901' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/172.17.17.1/detail- 20060901 modcall[accounting]: module "detail" returns ok for request 15 modcall[accounting]: module "unix" returns ok for request 15 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'knguyen(a)campbell.com' modcall[accounting]: module "radutmp" returns ok for request 15 modcall: group accounting returns ok for request 15 Sending Accounting-Response of id 199 to 172.17.17.1:1646 Finished request 15 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.17.17.1:1645, id=200, length=95 NAS-IP-Address = 172.17.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen(a)campbell.com" CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "preprocess" returns ok for request 16 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 16 modcall[authorize]: module "mschap" returns noop for request 16 rlm_realm: Looking up realm "campbell.com" for User-Name = "knguyen(a)campbell.com" rlm_realm: Found realm "campbell.com" rlm_realm: Adding Stripped-User-Name = "knguyen" rlm_realm: Proxying request from user knguyen to realm campbell.com rlm_realm: Adding Realm = "campbell.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 16 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 16 users: Matched entry knguyen at line 187 modcall[authorize]: module "files" returns ok for request 16 modcall: group authorize returns ok for request 16 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 172.17.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.172.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Accounting-Request packet from host 172.17.17.1:1646, id=201, length=196 NAS-IP-Address = 172.17.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen(a)campbell.com" Acct-Status-Type = Start Acct-Authentic = RADIUS Service-Type = Framed-User Acct-Session-Id = "00000CDE" Framed-Protocol = PPP Tunnel-Server-Endpoint:0 = "12.12.126.5" Tunnel-Client-Endpoint:0 = "12.12.126.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "CAMPBELL" Tunnel-Server-Auth-Id:0 = "sfldse26rr.mi.AADS" Acct-Tunnel-Connection = "13443112" Framed-IP-Address = 192.168.172.12 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 17 modcall[preacct]: module "preprocess" returns noop for request 17 rlm_acct_unique: Hashing 'NAS-Port = 3,Client-IP-Address = 172.17.17.1,NAS-IP-Address = 172.17.17.1,Acct-Session-Id = "00000CDE",User-Name = "knguyen(a)campbell.com"' rlm_acct_unique: Acct-Unique-Session-ID = "1bc07890bf12381b". modcall[preacct]: module "acct_unique" returns ok for request 17 rlm_realm: Looking up realm "campbell.com" for User-Name = "knguyen(a)campbell.com" rlm_realm: Found realm "campbell.com" rlm_realm: Adding Stripped-User-Name = "knguyen" rlm_realm: Proxying request from user knguyen to realm campbell.com rlm_realm: Adding Realm = "campbell.com" rlm_realm: Accounting realm is LOCAL. modcall[preacct]: module "suffix" returns noop for request 17 modcall[preacct]: module "files" returns noop for request 17 modcall: group preacct returns ok for request 17 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 17 radius_xlat: '/usr/local/var/log/radius/radacct/172.17.17.1/ detail-20060901' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/172.17.17.1/detail- 20060901 modcall[accounting]: module "detail" returns ok for request 17 modcall[accounting]: module "unix" returns ok for request 17 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'knguyen(a)campbell.com' modcall[accounting]: module "radutmp" returns ok for request 17 modcall: group accounting returns ok for request 17 Sending Accounting-Response of id 201 to 172.17.17.1:1646 Finished request 17 Going to the next request Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 15 ID 199 with timestamp 44f8a6aa Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 200 with timestamp 44f8a6ad Cleaning up request 17 ID 201 with timestamp 44f8a6ad Nothing to do. Sleeping until we see a request. ---- Original message ---- >Date: Wed, 04 Oct 2006 14:11:04 +1000 >From: James Wakefield <jamesw(a)deakin.edu.au> >Subject: Re: only work with 5 users or clients >To: tom(a)hostwebase.com >Cc: FreeRadius users mailing list <freeradius- users(a)lists.freeradius.org> > >Hi Tom, > >I see nothing that should cause the behaviour you're seeing, though bear >in mind I'm not a VPDN expert. > >Could you post: > >* An Access-Request packet logged when your setup is working >* The Access-Accept packet that corresponds with the above Access-Request >* An Access-Request packet when your setup is *not* working >* The Access-Accept packet that corresponds with the above Access-Request > >Could you also perhaps check on the general health of your router and >the AAA server when the setup isn't working? Does it coincide with >anomalous CPU usage, load average, memory usage etc? > >I don't *think* you need to check or reply with any tunnelling-related >attributes in simple cases of a VPDN setup, but as I say, I'm not an >expert in that area. > >Cheers, >James. > > >Tom Miller wrote: >> Here is a more details list of aaa for my Cisco 7204 >> configuration: >> >> aaa new-model >> aaa authentication login default local >> aaa authentication login console enable >> aaa authentication login telnet line >> aaa authentication login localauth local >> aaa authentication ppp default group radius local >> aaa authorization network default group radius local >> aaa accounting delay-start >> aaa accounting nested >> aaa accounting exec default start-stop group radius >> aaa accounting network default start-stop group radius >> >> >> ! >> vpdn enable >> vpdn aaa override-server 172.17.17.17 >> ! >> vpdn-group 1 >> accept-dialin >> protocol l2tp >> virtual-template 1 >> terminate-from hostname aaaabbbr.ca.AADS >> local name abc123456789cha >> lcp renegotiation always >> l2tp tunnel password 7 xxxxxxxxxxxxxxxx >> ! >> >> radius-server host 172.17.17.17 auth-port 1645 acct-port 1646 >> >> >> ! >> interface Virtual-Template1 >> mtu 1492 >> ip address 192.168.172.1 255.255.255.128 >> peer default ip address pool DSLCustomer >> ppp authentication chap callin >> ! >> ip local pool DSLCustomer 192.168.172.51 192.168.172.125 >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> ---- Original message ---- >>> Date: Mon, 02 Oct 2006 09:18:59 +1000 >>> From: James Wakefield <jamesw(a)deakin.edu.au> >>> Subject: Re: only work with 5 users or clients >>> To: tom(a)hostwebase.com, FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >>> Tom Miller wrote: >>>> I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and >>>> freeradius ( 1.0.4) >>>> >>>> I am having problem when number of users (clients) >>>> increase from 6 and up. >>>> >>>> It worked fine when I have only 5 users (clients) using >>>> the system. >>>> >>>> >>>> I found the max_requests was set at 1024 in radiusd.conf >> and >>>> have inscrease the number up to 50 clients (50x256=12800) >>>> >>>> max_requests = 12800 >>>> >>>> >>>> >>>> However, It doesn't seem to have any effect. What am I >> doing >>>> wrong. >>>> >>>> >>>> One things I noticed. The two users that can not connect >>>> will sent incomplete information >>>> to the radius server from NAS (7204) such as: >>>> >>>> >>>> Waking up in 6 seconds... >>>> rad_recv: Access-Request packet from host >> 192.168.17.1:1645, >>>> id=200, length=95 >>>> NAS-IP-Address = 192.168.17.1 >>>> NAS-Port = 3 >>>> NAS-Port-Type = ISDN >>>> User-Name = "knguyen(a)abc.net" >>>> CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e >>>> Service-Type = Framed-User >>>> Framed-Protocol = PPP >>>> >>>> auth: user supplied CHAP-Password matches local User- >> Password >>>> Sending Access-Accept of id 200 to 192.168.17.1:1645 >>>> Service-Type = Framed-User >>>> Framed-Protocol = PPP >>>> Framed-IP-Address = 209.101.222.12 >>>> Framed-IP-Netmask = 255.255.255.128 >>>> Framed-MTU = 1492 >>>> Finished request 16 >>>> Going to the next request >>>> >>>> >>>> >>>> >>>> *********** This is a log when it connected. It >> included >>>> the Tunnel server and client end point ********* >>>> >>>> >>>> >>>> rad_recv: Accounting-Request packet from host >>>> 192.168.17.1:1646, id=199, length=232 >>>> NAS-IP-Address = 192.168.17.1 >>>> NAS-Port = 6 >>>> NAS-Port-Type = ISDN >>>> User-Name = "knguyen(a)abc.net" >>>> Acct-Status-Type = Stop >>>> Acct-Authentic = RADIUS >>>> Service-Type = Framed-User >>>> Acct-Session-Id = "00000CD8" >>>> Framed-Protocol = PPP >>>> Tunnel-Server-Endpoint:0 = "10.10.6.5" >>>> Tunnel-Client-Endpoint:0 = "10.10.6.6" >>>> Tunnel-Type:0 = L2TP >>>> Tunnel-Client-Auth-Id:0 = "12345678" >>>> Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" >>>> Acct-Tunnel-Connection = "13441125" >>>> Framed-IP-Address = 209.101.222.12 >>>> Acct-Terminate-Cause = Admin-Reset >>>> Acct-Input-Octets = 281672 >>>> Acct-Output-Octets = 266074 >>>> Acct-Input-Packets = 4390 >>>> Acct-Output-Packets = 4154 >>>> Acct-Session-Time = 1967 >>>> Acct-Delay-Time = 0 >>>> Processing the preacct section of radiusd.conf >>>> >>> This is an accounting stop record, as opposed to the access >> accept >>> record you display above and below. It isn't necessarily >> indicative of >>> what freeradius sent to the NAS, or anything else that >> happened when the >>> client connected. >>> >>>> --- Walking the entire request list --- >>>> Waking up in 6 seconds... >>>> rad_recv: Access-Request packet from host >> 172.17.17.1:1645, >>>> id=200, length=95 >>>> NAS-IP-Address = 172.17.17.1 >>>> NAS-Port = 3 >>>> NAS-Port-Type = ISDN >>>> User-Name = "knguyen(a)eintegration.net" >>>> CHAP-Password = >> 0xcc3aeb78c7482c25ab08dc0625fcb4007e >>>> Service-Type = Framed-User >>>> Framed-Protocol = PPP >>>> >>>> auth: user supplied CHAP-Password matches local User- >> Password >>>> Sending Access-Accept of id 200 to 172.17.17.1:1645 >>>> Service-Type = Framed-User >>>> Framed-Protocol = PPP >>>> Framed-IP-Address = 38.101.172.12 >>>> Framed-IP-Netmask = 255.255.255.128 >>>> Framed-MTU = 1492 >>>> Finished request 16 >>>> Going to the next request >>>> >>>> >>>> What am I missing here? >>> How are you authenticating and authorizing your users? >> users file, some >>> sort of database or directory? Could you send some >> relevant excerpts >>>from those sources, eg: some users file stanzas if you're >> using the >>> users file, objects from your LDAP directory in LDIF if >> you're using LDAP? >>> My hunch is that freeradius isn't configured to send the >> necessary >>> attributes and your NAS is defaulting those attributes, but >> can't do >>> that for more than 5 concurrent users. Unless you're >> observing >>> considerable delay between the receipt of access-request >> and the sending >>> of access-accept (ie: more than a couple of seconds), or >> freeradius is >>> sending different attributes with the access-accept for the >> same user >>> when things seem to be going wrong to when they're going >> right, I think >>> you're missing some attributes or your NAS is misconfigured >> or both. >>> >>> Cheers, >>> -- >>> James Wakefield, >>> Unix Administrator, Information Technology Services Division >>> Deakin University, Geelong, Victoria 3217 Australia. >>> >>> Phone: 03 5227 8690 International: +61 3 5227 8690 >>> Fax: 03 5227 8866 International: +61 3 5227 8866 >>> E-mail: james.wakefield(a)deakin.edu.au >>> Website: http://www.deakin.edu.au > > >-- >James Wakefield, >Unix Administrator, Information Technology Services Division >Deakin University, Geelong, Victoria 3217 Australia. > >Phone: 03 5227 8690 International: +61 3 5227 8690 >Fax: 03 5227 8866 International: +61 3 5227 8866 >E-mail: james.wakefield(a)deakin.edu.au >Website: http://www.deakin.edu.au

1 0

dialupadmin & suse 10.1 binary
by Andrew Long 04 Oct '06

04 Oct '06

I installed the binary for SUSE 10.1 and dialupadmin. When I open "index.html" in the dialupadmin htdocs dir, firefox wants to open/save the buttons.php. Am I missing some required support for php? -- Regards, Andrew Long

3 2

sqlippool error
by igalatoczki＠contactnet.hu 04 Oct '06

04 Oct '06

Hi All! I use freeradius 1.1.3 with sqlippool but not work the ippool. The radius -X give netx message: Module: Loaded SQL IP Pool sqlippool: sql-instance-name = "sql" sqlippool: lease-duration = 3600 sqlippool: pool-name = "" sqlippool: allocate-begin = "BEGIN" sqlippool: allocate-clear = "UPDATE radippool SET nas_ip_address = '', pool_k ey = 0, calling_station_id = '', expiry_time = 'now'::timestamp(0) - '1 second '::interval WHERE pool_key = '%{Calling-Station-Id}'" sqlippool: allocate-find = "SELECT ip_address FROM radippool WHERE pool_name = '%{reply:Pool-Name}' AND expiry_time < 'now'::timestamp(0) ORDER BY pool_nam e, (username <> '%{User-Name}'), (calling_station_id <> '%{Calling-Station-Id}') , expiry_time LIMIT 1 FOR UPDATE" sqlippool: allocate-update = "UPDATE radippool SET nas_ip_address = '%{NAS-IP -Address}', pool_key = '%{Calling-Station-Id}', calling_station_id = '%{Callin g-Station-Id}', username = '%{User-Name}', expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE ip_address = '%I'" sqlippool: allocate-commit = "COMMIT" sqlippool: allocate-rollback = "ROLLBACK" sqlippool: start-begin = "BEGIN" sqlippool: start-update = "UPDATE radippool SET expiry_time = 'now'::timestam p(0) + '%J second'::interval WHERE nas_ip_address = '%n' AND nas_port = '%p' A ND pool_name = '%P'" sqlippool: start-commit = "COMMIT" sqlippool: start-rollback = "ROLLBACK" sqlippool: alive-begin = "BEGIN" sqlippool: alive-update = "UPDATE radippool SET expiry_time = 'now'::timestam p(0) + '3600 seconds'::interval WHERE nas_ip_address = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND calling_station_id = '%{Calling-Station-Id}' AND ip_address = '%{Framed-IP-Address}'" sqlippool: alive-commit = "COMMIT" sqlippool: alive-rollback = "ROLLBACK" sqlippool: stop-begin = "BEGIN" sqlippool: stop-clear = "UPDATE radippool SET nas_ip_address = '', pool_key = 0, calling_station_id = '', expiry_time = 'now'::timestamp(0) - '1 second'::i nterval WHERE nas_ip_address = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port} ' AND username = '%{User-Name}' AND calling_station_id = '%{Calling-Station-Id }' AND ip_address = '%{Framed-IP-Address}'" sqlippool: stop-commit = "COMMIT" sqlippool: stop-rollback = "ROLLBACK" sqlippool: on-begin = "BEGIN" sqlippool: on-clear = "UPDATE radippool SET nas_ip_address = '', pool_key = 0 , calling_station_id = '', expiry_time = 'now'::timestamp(0) - '1 second'::int erval WHERE nas_ip_address = '%{Nas-IP-Address}' AND username = '%{User-Name}' AND calling_station_id = '%{Calling-Station-Id}' AND ip_address = '%{Framed-I P-Address}'" sqlippool: on-commit = "COMMIT" sqlippool: on-rollback = "ROLLBACK" sqlippool: off-begin = "BEGIN" sqlippool: off-clear = "UPDATE radippool SET nas_ip_address = '', pool_key = 0, calling_station_id = '', expiry_time = 'now'::timestamp(0) - '1 second'::in terval WHERE nas_ip_address = '%{Nas-IP-Address}' AND username = '%{User-Name} ' AND calling_station_id = '%{Calling-Station-Id}' AND ip_address = '%{Framed- IP-Address}'" sqlippool: off-commit = "COMMIT" sqlippool: off-rollback = "ROLLBACK" rlm_sql (sql): Reserving sql socket id: 4 Module: Instantiated sqlippool (sqlippool) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. The Radcheck table in sql database: ID USERNAME ATTRIBUTE OP VALUE 1 test User-Password := 1234 2 test Simultaneous-Use := 1 3 test Pool-Name := testpool The Radippool table in sql database: ID POOLNAME IPADDRESS ....... USERNAME 1 testpool 192.168.1.0/24 test i use pppoe-server and if user connecting the radius.log : Wed Oct 4 11:35:49 2006 : Error: sqlippool_command: database query error Wed Oct 4 11:35:49 2006 : Error: sqlippool_query1: database query error Wed Oct 4 11:35:49 2006 : Info: rlm_sqlippool: ip=[] len=0 Wed Oct 4 11:35:49 2006 : Error: sqlippool_command: database query error Wed Oct 4 11:35:50 2006 : Error: sqlippool_command: database query error any ideas? ps: sorry my poor english steve

1 0

My FreeRadius don't log anything
by Didier Benza 04 Oct '06

04 Oct '06

Hi everybody, I am a real newbie to FreeRadius, I am migrating from an existing Livington radius. My concern here is this one : I am unable to configure my server to log auth requests. The two Auth-Type I use here are either "Local" or "System", the server doesn't log neither. Here a run with only one request. The log file and the pid file doesn't exists after this run. The directories used for logging are writable for the user under which the server is running. Any clue ? # /usr/local/radius/ppp/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/ppp/etc/raddb/clients.conf Config: including file: /usr/local/radius/ppp/etc/raddb/snmp.conf main: prefix = "/usr/local/radius/ppp" main: localstatedir = "/usr/local/radius/ppp/var" main: logdir = "/usr/local/radius/ppp/var/log/radius" main: libdir = "/usr/local/radius/ppp/lib" main: radacctdir = "/usr/local/radius/ppp/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/radius/ppp/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/ppp/var/run/radiusd/radiusd.pid" main: user = "radiusppp" main: group = "radiusppp" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/ppp/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/ppp/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded System unix: cache = no unix: passwd = "/usr/local/radius/ppp/etc/raddb/passwd" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/ppp/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/ppp/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/ppp/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/radius/ppp/etc/raddb/users" files: acctusersfile = "/usr/local/radius/ppp/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/ppp/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/usr/local/radius/ppp/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/ppp/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:35846, id=185, length=47 User-Name = "demogw" CHAP-Password = 0xb9f4107bffcf854f69e8eec05eb04cd67f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 users: Matched entry demogw at line 54 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [demogw] (from client localhost port 0) Sending Access-Accept of id 185 to 127.0.0.1 port 35846 User-Service-Type = Framed-User NAS-Port-Type = ISDN Port-Limit = 8 Framed-Protocol = PPP Framed-IP-Address = 193.48.223.129 Framed-IP-Netmask = 255.255.255.192 Framed-Routing = None Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 185 with timestamp 451d24bf Nothing to do. Sleeping until we see a request. -- Didier Benza Didier.Benza(a)sophia.inria.fr Tel : +33 492 38 7167 / Fax : +33 492 38 7602 INRIA 2004, Route des Lucioles, BP 93, 06902 Sophia Antipolis Cedex AC INRIA : http://igc.national.inria.fr/Doc/General/CertAC.html#certif

2 3

UPDATED: dumb humble question about sqlippool
by Guilherme Franco 04 Oct '06

04 Oct '06

Hello, I've installed Postgres with exactly the same configuration as Oracle's and Postgres works. The only point of failure using Oracle should be in radippool Framedipaddress which is VARCHAR in Oracle but is INET in Postgres. Could be a parsing error in rlm_sqlippool.c That's because xlat outputs: --------------------------------------------- 'SELECT framedipaddress FROM (select framedipaddress from radippool WHERE pool_name = 'SPW' ORDER BY dbms_random.value) where rownum = 1' sqlippool_query1: row[0] returned NULL rlm_sqlippool: ip=[] len=0 radius_xlat: 'COMMIT' rlm_sqlippool: IP number could not be allocated. --------------------------------------------- The same query on sqlplus is ok: SQL> SELECT framedipaddress FROM (select framedipaddress from radippool WHERE pool_name = 'SPW' ORDER BY dbms_random.value) where rownum = 1; FRAMEDIPADDRESS ------------------------------ 192.168.1.3 Now, considering that Postgres works like a breeze, how can I setup just sqlippool.conf to look in postgres, but the regular user and password queries to look in oracle? I've created a sql.conf containing oracle's confs (sql{..}) and sql2.conf containing postgres confs (sql2{...}). If I specify sql-instance-name = "sql2" in sqlippool.conf it does not works. I appreciate any help on this issue. Thanks! On 9/29/06, Peter Nixon <listuser(a)peternixon.net> wrote: > On Fri 29 Sep 2006 15:23, Guilherme Franco wrote: > > Thanks for all the answers Mr. Peter! > > > > To clarify some things: > > >> NONE of the ippool modules let you set the pool name. You HAVE to set > > >> Pool-Name = whatever as a check > > >> item!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > > > The radcheck table already have Pool-Name := "whatever" as a > > attribute, op, value for all users, but that's ok because I can set it > > manually in sqlippool.conf and the select DOES run in the correct > > table then (xlat outputs correctly then and I did a network sniff that > > shows the query is ok). > > If you set it in sqlippool.conf it is ignored by the module........ It will > make no difference to the operation at all. > > > > Other issue is related to multiple pools, one with dynamic IP's and > > > other with fixed ones (actually it's not possible to do that with only > > > just one sqlippool.conf file without modifying rlm_sqlippool.c). > > > > > >> IT IS!!!!!!!!!!!!!!!!!!!!!! > > >> Run two copies of the module! > > > > Sorry, i meant that I think that it is not possible without loading 2 > > or more modules (just with one module and one sqlippool.conf) dumb > > question, sorry. > > OK. We we specifically designed the module so you can run more than one > instance of it (like most other radius modules) and the different instances > may have different queries, tables and sql connections (Completely different > database types if you wish) > > > > Another thing lies in proxy -> if the proxy returns IP 255.255.255.254 > > > for me, sqlippool does not overrides it and do nothing (it doesn't > > > have the override = yes option like ippool). > > > > > >>This can be added. Although why would you return an IP like that when you > > >> dont need to? Just return the Pool-Name and let the module do its job. > > > > I didn't think about it, thanks. > > You are welcome :-) > > Infact we have added today the capability to detect an ip address of > 255.255.255.254 but this makes no sense except for when you are acting as a > proxy and wish to add an ip address from a pool to an accept packet comming > from a home server. Just use "Pool-Name" for all local users. > > > Besides that I had to remove the BEGIN statement of allocate-begin > > (and all other begins) because oracle does not need it, and if you > > need to specify begin, then it needs to be in a different way (through > > the sniff, I saw that the begin was stated, then 4 "space" chars and > > then a "/" which is the same as doing "BEGIN; /" in sqlplus, > > generating "ORA end-of-file errors") Don't know from where that "/" > > came from thought. To solve this, I had to change "BEGIN" in > > allocate-begin for "commit" (a normal oracle operation before any > > query). > > Please send me a copy (privately if you wish) of your existing sqlippool.conf > and working source code (or patch) so that we can integrate it into the > existing code. > > > About the postgresql installation, I was thinking in installing it. I > > will do that just to see it's behaviour, thanks. > > OK. I assumed that you had done this long ago. Please do it as a test. > > > THANKS A LOT AGAIN! > > Cheers > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >

2 4

Re: only work with 5 users or clients
by Tom Miller 04 Oct '06

04 Oct '06

Here is a more details list of aaa for my Cisco 7204 configuration: aaa new-model aaa authentication login default local aaa authentication login console enable aaa authentication login telnet line aaa authentication login localauth local aaa authentication ppp default group radius local aaa authorization network default group radius local aaa accounting delay-start aaa accounting nested aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius ! vpdn enable vpdn aaa override-server 172.17.17.17 ! vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname aaaabbbr.ca.AADS local name abc123456789cha lcp renegotiation always l2tp tunnel password 7 xxxxxxxxxxxxxxxx ! radius-server host 172.17.17.17 auth-port 1645 acct-port 1646 ! interface Virtual-Template1 mtu 1492 ip address 192.168.172.1 255.255.255.128 peer default ip address pool DSLCustomer ppp authentication chap callin ! ip local pool DSLCustomer 192.168.172.51 192.168.172.125 ---- Original message ---- >Date: Mon, 02 Oct 2006 09:18:59 +1000 >From: James Wakefield <jamesw(a)deakin.edu.au> >Subject: Re: only work with 5 users or clients >To: tom(a)hostwebase.com, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > >Tom Miller wrote: >> I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and >> freeradius ( 1.0.4) >> >> I am having problem when number of users (clients) >> increase from 6 and up. >> >> It worked fine when I have only 5 users (clients) using >> the system. >> >> >> I found the max_requests was set at 1024 in radiusd.conf and >> have inscrease the number up to 50 clients (50x256=12800) >> >> max_requests = 12800 >> >> >> >> However, It doesn't seem to have any effect. What am I doing >> wrong. >> >> >> One things I noticed. The two users that can not connect >> will sent incomplete information >> to the radius server from NAS (7204) such as: >> >> >> Waking up in 6 seconds... >> rad_recv: Access-Request packet from host 192.168.17.1:1645, >> id=200, length=95 >> NAS-IP-Address = 192.168.17.1 >> NAS-Port = 3 >> NAS-Port-Type = ISDN >> User-Name = "knguyen(a)abc.net" >> CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e >> Service-Type = Framed-User >> Framed-Protocol = PPP >> >> auth: user supplied CHAP-Password matches local User- Password >> Sending Access-Accept of id 200 to 192.168.17.1:1645 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-IP-Address = 209.101.222.12 >> Framed-IP-Netmask = 255.255.255.128 >> Framed-MTU = 1492 >> Finished request 16 >> Going to the next request >> >> >> >> >> *********** This is a log when it connected. It included >> the Tunnel server and client end point ********* >> >> >> >> rad_recv: Accounting-Request packet from host >> 192.168.17.1:1646, id=199, length=232 >> NAS-IP-Address = 192.168.17.1 >> NAS-Port = 6 >> NAS-Port-Type = ISDN >> User-Name = "knguyen(a)abc.net" >> Acct-Status-Type = Stop >> Acct-Authentic = RADIUS >> Service-Type = Framed-User >> Acct-Session-Id = "00000CD8" >> Framed-Protocol = PPP >> Tunnel-Server-Endpoint:0 = "10.10.6.5" >> Tunnel-Client-Endpoint:0 = "10.10.6.6" >> Tunnel-Type:0 = L2TP >> Tunnel-Client-Auth-Id:0 = "12345678" >> Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" >> Acct-Tunnel-Connection = "13441125" >> Framed-IP-Address = 209.101.222.12 >> Acct-Terminate-Cause = Admin-Reset >> Acct-Input-Octets = 281672 >> Acct-Output-Octets = 266074 >> Acct-Input-Packets = 4390 >> Acct-Output-Packets = 4154 >> Acct-Session-Time = 1967 >> Acct-Delay-Time = 0 >> Processing the preacct section of radiusd.conf >> > >This is an accounting stop record, as opposed to the access accept >record you display above and below. It isn't necessarily indicative of >what freeradius sent to the NAS, or anything else that happened when the >client connected. > >> --- Walking the entire request list --- >> Waking up in 6 seconds... >> rad_recv: Access-Request packet from host 172.17.17.1:1645, >> id=200, length=95 >> NAS-IP-Address = 172.17.17.1 >> NAS-Port = 3 >> NAS-Port-Type = ISDN >> User-Name = "knguyen(a)eintegration.net" >> CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e >> Service-Type = Framed-User >> Framed-Protocol = PPP >> >> auth: user supplied CHAP-Password matches local User- Password >> Sending Access-Accept of id 200 to 172.17.17.1:1645 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-IP-Address = 38.101.172.12 >> Framed-IP-Netmask = 255.255.255.128 >> Framed-MTU = 1492 >> Finished request 16 >> Going to the next request >> >> >> What am I missing here? > >How are you authenticating and authorizing your users? users file, some >sort of database or directory? Could you send some relevant excerpts >from those sources, eg: some users file stanzas if you're using the >users file, objects from your LDAP directory in LDIF if you're using LDAP? > >My hunch is that freeradius isn't configured to send the necessary >attributes and your NAS is defaulting those attributes, but can't do >that for more than 5 concurrent users. Unless you're observing >considerable delay between the receipt of access-request and the sending >of access-accept (ie: more than a couple of seconds), or freeradius is >sending different attributes with the access-accept for the same user >when things seem to be going wrong to when they're going right, I think >you're missing some attributes or your NAS is misconfigured or both. > > >Cheers, >-- >James Wakefield, >Unix Administrator, Information Technology Services Division >Deakin University, Geelong, Victoria 3217 Australia. > >Phone: 03 5227 8690 International: +61 3 5227 8690 >Fax: 03 5227 8866 International: +61 3 5227 8866 >E-mail: james.wakefield(a)deakin.edu.au >Website: http://www.deakin.edu.au

2 1

Re: only work with 5 users or clients
by Tom Miller 04 Oct '06

04 Oct '06

Thank you so much for respond to my issues. I think you are right. I am missing something on the Cisco 7204 but I don't now what it is. I have captured debug log files from both radius and Cisco. Please let me know if you want me to post them. *****Here is what I have for our cisco 7204.******** aaa new-model aaa authentication login default local aaa authentication login console enable aaa authentication login telnet line aaa authentication ppp default group radius local aaa authorization network default group radius local aaa accounting delay-start aaa accounting nested aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius enable secret 5 $1$xxxxxxxxxxxxxxxxxxxxxx/ vpdn enable vpdn aaa override-server 172.17.17.17 ! radius-server host 172.17.17.17 auth-port 1645 acct-port 1646 **** Here is one of our users profile (users file) **** campbell Auth-Type := Local, User-Password == "1etelrx23" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = x.x.172.7, Framed-IP-Netmask = 255.255.255.128, Framed-MTU = 1492 # DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 1492, Service-Type = Framed-User, Framed-Protocol = PPP, MS-Primary-DNS-Server = x.x.230.195, MS-Secondary-DNS-Server = x.x.230.196, Session-Timeout = 86400 What am I missing? Thanks, Tom ---- Original message ---- >Date: Mon, 02 Oct 2006 09:18:59 +1000 >From: James Wakefield <jamesw(a)deakin.edu.au> >Subject: Re: only work with 5 users or clients >To: tom(a)hostwebase.com, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > >Tom Miller wrote: >> I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and >> freeradius ( 1.0.4) >> >> I am having problem when number of users (clients) >> increase from 6 and up. >> >> It worked fine when I have only 5 users (clients) using >> the system. >> >> >> I found the max_requests was set at 1024 in radiusd.conf and >> have inscrease the number up to 50 clients (50x256=12800) >> >> max_requests = 12800 >> >> >> >> However, It doesn't seem to have any effect. What am I doing >> wrong. >> >> >> One things I noticed. The two users that can not connect >> will sent incomplete information >> to the radius server from NAS (7204) such as: >> >> >> Waking up in 6 seconds... >> rad_recv: Access-Request packet from host 192.168.17.1:1645, >> id=200, length=95 >> NAS-IP-Address = 192.168.17.1 >> NAS-Port = 3 >> NAS-Port-Type = ISDN >> User-Name = "knguyen(a)abc.net" >> CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e >> Service-Type = Framed-User >> Framed-Protocol = PPP >> >> auth: user supplied CHAP-Password matches local User- Password >> Sending Access-Accept of id 200 to 192.168.17.1:1645 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-IP-Address = 209.101.222.12 >> Framed-IP-Netmask = 255.255.255.128 >> Framed-MTU = 1492 >> Finished request 16 >> Going to the next request >> >> >> >> >> *********** This is a log when it connected. It included >> the Tunnel server and client end point ********* >> >> >> >> rad_recv: Accounting-Request packet from host >> 192.168.17.1:1646, id=199, length=232 >> NAS-IP-Address = 192.168.17.1 >> NAS-Port = 6 >> NAS-Port-Type = ISDN >> User-Name = "knguyen(a)abc.net" >> Acct-Status-Type = Stop >> Acct-Authentic = RADIUS >> Service-Type = Framed-User >> Acct-Session-Id = "00000CD8" >> Framed-Protocol = PPP >> Tunnel-Server-Endpoint:0 = "10.10.6.5" >> Tunnel-Client-Endpoint:0 = "10.10.6.6" >> Tunnel-Type:0 = L2TP >> Tunnel-Client-Auth-Id:0 = "12345678" >> Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" >> Acct-Tunnel-Connection = "13441125" >> Framed-IP-Address = 209.101.222.12 >> Acct-Terminate-Cause = Admin-Reset >> Acct-Input-Octets = 281672 >> Acct-Output-Octets = 266074 >> Acct-Input-Packets = 4390 >> Acct-Output-Packets = 4154 >> Acct-Session-Time = 1967 >> Acct-Delay-Time = 0 >> Processing the preacct section of radiusd.conf >> > >This is an accounting stop record, as opposed to the access accept >record you display above and below. It isn't necessarily indicative of >what freeradius sent to the NAS, or anything else that happened when the >client connected. > >> --- Walking the entire request list --- >> Waking up in 6 seconds... >> rad_recv: Access-Request packet from host 172.17.17.1:1645, >> id=200, length=95 >> NAS-IP-Address = 172.17.17.1 >> NAS-Port = 3 >> NAS-Port-Type = ISDN >> User-Name = "knguyen(a)eintegration.net" >> CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e >> Service-Type = Framed-User >> Framed-Protocol = PPP >> >> auth: user supplied CHAP-Password matches local User- Password >> Sending Access-Accept of id 200 to 172.17.17.1:1645 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-IP-Address = 38.101.172.12 >> Framed-IP-Netmask = 255.255.255.128 >> Framed-MTU = 1492 >> Finished request 16 >> Going to the next request >> >> >> What am I missing here? > >How are you authenticating and authorizing your users? users file, some >sort of database or directory? Could you send some relevant excerpts >from those sources, eg: some users file stanzas if you're using the >users file, objects from your LDAP directory in LDIF if you're using LDAP? > >My hunch is that freeradius isn't configured to send the necessary >attributes and your NAS is defaulting those attributes, but can't do >that for more than 5 concurrent users. Unless you're observing >considerable delay between the receipt of access-request and the sending >of access-accept (ie: more than a couple of seconds), or freeradius is >sending different attributes with the access-accept for the same user >when things seem to be going wrong to when they're going right, I think >you're missing some attributes or your NAS is misconfigured or both. > > >Cheers, >-- >James Wakefield, >Unix Administrator, Information Technology Services Division >Deakin University, Geelong, Victoria 3217 Australia. > >Phone: 03 5227 8690 International: +61 3 5227 8690 >Fax: 03 5227 8866 International: +61 3 5227 8866 >E-mail: james.wakefield(a)deakin.edu.au >Website: http://www.deakin.edu.au

1 0

WPA problem
by Giuseppina Venezia 03 Oct '06

03 Oct '06

Hello all, I've chillispot + freeradius (with openldap), with chillispot in proxy mode. I use WPA Enterprise and when I try to connect a client using WPA the client can't connect but apparently freeradius give no error. (without WPA all work perfectly). I attach you full log of freeradius and chillispot, if you can give me some help i'll be grate. Hope you can help me. My freeradius log: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1027, id=0, length=125 User-Name = "prof1" EAP-Message = 0x0200000a0170726f6631 Message-Authenticator = 0x862370a8c24c3cc15e9b7f7687d06281 Calling-Station-Id = "00-17-F2-44-11-C2" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "localhost" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "prof1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mydepartment,dc=mydomain,dc=it' radius_xlat: '(uid=prof1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=it/PASSWORD to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (&(cn=professor)(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmydepartment\2cdc\3dmydomain\2cdc\3dit)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Maurizio Costanzo,ou=faculty,ou=dspsa,ou=mydepartment,dc=mydomain,dc=it, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group professor rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for prof1 radius_xlat: '(uid=prof1)' radius_xlat: 'ou=mydepartment,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mydepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: checking if remote access for prof1 is allowed by userPassword rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusGroupName as Ldap-Group, value professor & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-05-5D-25-12-5B & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-02-C7-8F-A0-16 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-0B-6B-4A-22-E8 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-17-F2-44-11-C2 & op=21 rlm_ldap: Adding userPassword as User-Password, value a & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prof1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-05-5D-25-12-5B rlm_checkval: Value Name: Calling-Station-Id, Value: 00-02-C7-8F-A0-16 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-0B-6B-4A-22-E8 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 modcall[authorize]: module "checkval" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 127.0.0.1 port 1027 Service-Type == Framed-User EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb4d93d9a9cf87543d81689d41e41f3f4 Finished request 0 ==================================== My chilli log: chilli.c: 3027: 0 (Success) ChilliSpot version 1.0 started. tun.c: 653: 0 (Success) TX queue length set to 100chilli.c: 3162: 0 (Success) Waiting for client request... chilli.c: 2424: 0 (Success) New DHCP request from MAC=00-11-95-C2-93-0Achilli.c: 2430: 0 (Success) New DHCP connection established chilli.c: 2354: 0 (Success) DHCP requested IP address chilli.c: 2394: 0 (Success) Client MAC=00-11-95-C2-93-0A assigned IP 192.168.182.10chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! chilli.c: 1457: 0 (Success) Radius access request received! chilli.c: 1484: 0 (Success) Calling Station ID is: chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 7chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Fchilli.c: 1485: 0 (Success) 2chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Cchilli.c: 1485: 0 (Success) 2chilli.c: 1486: 0 (Success) chilli.c: 1523: 0 (Success) Username is: chilli.c: 1524: 0 (Success) pchilli.c: 1524: 0 (Success) rchilli.c: 1524: 0 (Success) ochilli.c: 1524: 0 (Success) fchilli.c: 1524: 0 (Success) 1chilli.c: 1524: 0 (Success) chilli.c: 1525: 0 (Success) chilli.c: 2424: 0 (Success) New DHCP request from MAC=00-17-F2-44-11-C2chilli.c: 2430: 0 (Success) New DHCP connection established chilli.c: 1854: 0 (Success) Received access request confirmation from radius server chilli.c: 1884: 0 (Success) Received access challenge from radius server chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! radius.c: 1608: 0 (Success) Received unknown radius packet 11!chilli.c: 3267: 0 (Success) radius_proxy_ind() failed!chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! chilli.c: 1457: 0 (Success) Radius access request received! chilli.c: 1484: 0 (Success) Calling Station ID is: chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 7chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Fchilli.c: 1485: 0 (Success) 2chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Cchilli.c: 1485: 0 (Success) 2chilli.c: 1486: 0 (Success) chilli.c: 1523: 0 (Success) Username is: chilli.c: 1524: 0 (Success) pchilli.c: 1524: 0 (Success) rchilli.c: 1524: 0 (Success) ochilli.c: 1524: 0 (Success) fchilli.c: 1524: 0 (Success) 1chilli.c: 1524: 0 (Success) chilli.c: 1525: 0 (Success) chilli.c: 1854: 0 (Success) Received access request confirmation from radius server chilli.c: 1884: 0 (Success) Received access challenge from radius server chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! radius.c: 1608: 0 (Success) Received unknown radius packet 11!chilli.c: 3267: 0 (Success) radius_proxy_ind() failed!chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! chilli.c: 1457: 0 (Success) Radius access request received! chilli.c: 1484: 0 (Success) Calling Station ID is: chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 7chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Fchilli.c: 1485: 0 (Success) 2chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Cchilli.c: 1485: 0 (Success) 2chilli.c: 1486: 0 (Success) chilli.c: 1523: 0 (Success) Username is: chilli.c: 1524: 0 (Success) pchilli.c: 1524: 0 (Success) rchilli.c: 1524: 0 (Success) ochilli.c: 1524: 0 (Success) fchilli.c: 1524: 0 (Success) 1chilli.c: 1524: 0 (Success) chilli.c: 1525: 0 (Success) chilli.c: 1854: 0 (Success) Received access request confirmation from radius server chilli.c: 1884: 0 (Success) Received access challenge from radius server chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! radius.c: 1608: 0 (Success) Received unknown radius packet 11!chilli.c: 3267: 0 (Success) radius_proxy_ind() failed!chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! chilli.c: 1457: 0 (Success) Radius access request received! chilli.c: 1484: 0 (Success) Calling Station ID is: chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 7chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Fchilli.c: 1485: 0 (Success) 2chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Cchilli.c: 1485: 0 (Success) 2chilli.c: 1486: 0 (Success) chilli.c: 1523: 0 (Success) Username is: chilli.c: 1524: 0 (Success) pchilli.c: 1524: 0 (Success) rchilli.c: 1524: 0 (Success) ochilli.c: 1524: 0 (Success) fchilli.c: 1524: 0 (Success) 1chilli.c: 1524: 0 (Success) chilli.c: 1525: 0 (Success) chilli.c: 1854: 0 (Success) Received access request confirmation from radius server chilli.c: 1884: 0 (Success) Received access challenge from radius server chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! radius.c: 1608: 0 (Success) Received unknown radius packet 11!chilli.c: 3267: 0 (Success) radius_proxy_ind() failed!chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! chilli.c: 1457: 0 (Success) Radius access request received! chilli.c: 1484: 0 (Success) Calling Station ID is: chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 7chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Fchilli.c: 1485: 0 (Success) 2chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) 4chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) Cchilli.c: 1485: 0 (Success) 2chilli.c: 1486: 0 (Success) chilli.c: 1523: 0 (Success) Username is: chilli.c: 1524: 0 (Success) pchilli.c: 1524: 0 (Success) rchilli.c: 1524: 0 (Success) ochilli.c: 1524: 0 (Success) fchilli.c: 1524: 0 (Success) 1chilli.c: 1524: 0 (Success) chilli.c: 1525: 0 (Success) chilli.c: 1854: 0 (Success) Received access request confirmation from radius server chilli.c: 1884: 0 (Success) Received access challenge from radius server chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! radius.c: 1608: 0 (Success) Received unknown radius packet 11!chilli.c: 3267: 0 (Success) radius_proxy_ind() failed!chilli.c: 2544: 0 (Success) cb_dhcp_data_ind. Packet received. DHCP authstate: 5 chilli.c: 2547: 0 (Success) Received packet with spoofed source!!! chilli.c: 1457: 0 (Success) Radius access request received! chilli.c: 1484: 0 (Success) Calling Station ID is: chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) 0chilli.c: 1485: 0 (Success) -chilli.c: 1485: 0 (Success) 1chilli.c: 1485: 0 (Succes

2 4

Design question
by Torkel Mathisen 03 Oct '06

03 Oct '06

Hi We have a very simple freeradius setup today. We use freeradius 1.0.5 with PEAP/MS-CHAPv2 and users file. My boss has asked be about making this configuration a bit more flexible and easier to admin. He also wants some new "features". The keywords are hotspot, web-frontend and possibly billing and "smartcards". Basically what he wants is for external consultant to be able to bring their laptops and just connect to a hotspot webserver and from there on authorize on to the WiFi. He also wants the possibility of billing. I want to know what kind of design you guys would recommend here. I'm thinking freeradius (1.1.3 now) with a mysql db and some web-frontend for adding users (what?). Then Chillipot on a new server for hotspot access. How does that sound? Will Chillipot be able to authorize users based on PEAP/MS-CHAPv2 ? How would you be able to do billing with this setup? And lastly is the situation with "smartcards". My boss was thinking about some cards or something that the consultant can pick up in the reception that will give them access to the WiFi for a certain amount of time. At the end of the day they have to deliver it again. There is also a possibility of doing billing from that. Will this kind of configuration require some commercial software or is freeradius able to do that? The last thing is not THAT important, but I want to know if anyone has a setup like this. I hope someone got some recommentations. Regards, Torkel

2 1

how to make freeradius support RFC 3576 ?
by zengkh 03 Oct '06

03 Oct '06

----- Original Message ----- From: zengkh To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, October 03, 2006 3:44 PM Subject: how to make freeradius support RFC 3576 ? i have a question about how to make freeradius support RFC 3576 - Dynamic Authorization Extensions to Remote Authentication Dial In User Service , thanks. BS: I can not write code to implement.

3 2