- Freeradius-Users - lists.freeradius.org

rlm_sqlippool
by Chris Knipe 29 Aug '06

29 Aug '06

Hi, I know this is new, and not yet documented, but I saw some good posts about it being stable, so I'm looking at implementing it at the moment... But alas, I'm confused and the lack of documentation is not helping. doc/rlm_sqlippool states: The only required fields are, pool_name and ip_address. A pool consists of one or more rows in the table with the same pool_name and a different ip_address. The is no restriction on which ip addresses/ranges may be in the same pool, and addresses do not need to be concurrent. Yet, raddb/sqlippool.conf, makes absolutely NO sense to me at the moment at all, and there is WAY more than merely a pool name and a IP address referenced in the queries... I understand that there is some unique elements required in the table to indicate that a IP is allocated, and to know where the IP is allocated (and obviously to release that IP once the session terminates). Can someone perhaps please just take a moment to explain what exactly is going on in those queries?? I'm not referring to the SQL as such, but rather as to what is updated, and why. A table structure accompanying those queries in sqlippool.conf may help significantly as well, as I'm guessing at the moment what needs to go where :( Regards, Chris. PS: FR 1.1.3, is the NAS tables being used yet in this release??

4 13

Ip Pool group assignment
by Giuseppina Venezia 29 Aug '06

29 Aug '06

Hi all, I've tried to assign ip via ippool. I have freeradius 1.1.2 and i use chillispot as captive portal and OpenLdap to manage user. When i log in directly with default user (user "prova" , defined in users file) it seems to assign ip, but it really doesn't (the client doesn't obtain the assigned ip address). When i log in directly with an OpenLdap user, it says that can't find Pool-Name attribute. I will paste the output of "radiusd -X" whit the operation listed above and the conf files. Thanks in advance. Giusy radius -X -----------------------------------------------------------------------------  Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=mydomain,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "xxxxxxx" ldap: basedn = "ou=statistica,dc=mydomain,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "radiusGroupName" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139940 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = yes rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/usr/local/etc/raddb/db.ippool" ippool: ip-index = "/usr/local/etc/raddb/db.ipindex" ippool: range-start = 192.168.182.129 IP address [192.168.182.129] ippool: range-stop = 192.168.182.254 IP address [192.168.182.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1043, id=0, length=215 User-Name = "prova" CHAP-Challenge = 0x55e75e2624e19c07877bcf36aa16c024 CHAP-Password = 0x002dcc1e416cd9f6b116102c3c3f65de71 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.4 Calling-Station-Id = "00-16-C7-8F-A0-02" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Identifier = "nas01" Acct-Session-Id = "44f032f900000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x1dc4e649177a2b3eda2541fe0d773729 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "prova", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry prova at line 80 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for prova radius_xlat: '(uid=prova)' radius_xlat: 'ou=statistica,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=it/xxxxxxx to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=statistica,dc=mydomain,dc=it, with filter (uid=prova) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-16-C7-8F-A0-02 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: 0.0.0.0/1 rlm_ippool: Searching for an entry for nas/port: 0.0.0.0/1 rlm_ippool: Allocating ip to nas/port: 0.0.0.0/1 rlm_ippool: num: 1 rlm_ippool: Allocated ip 192.168.182.231 to client on nas 0.0.0.0,port 1 modcall[post-auth]: module "main_pool" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 0 to 127.0.0.1 port 1043 Service-Type = Framed-User Framed-IP-Address = 192.168.182.231 Framed-IP-Netmask = 255.255.255.0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 127.0.0.1:1041, id=0, length=130 Acct-Status-Type = Start User-Name = "prova" Calling-Station-Id = "00-16-C7-8F-A0-02" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "nas01" Framed-IP-Address = 192.168.182.4 Acct-Session-Id = "44f032f900000001" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "44f032f900000001",User-Name = "prova"' rlm_acct_unique: Acct-Unique-Session-ID = "6b96572558c4da26". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "prova", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'prova' modcall[accounting]: module "radutmp" returns ok for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "main_pool" returns noop for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 0 to 127.0.0.1 port 1041 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 44f0331f Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 44f0331e Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 127.0.0.1:1041, id=1, length=178 Acct-Status-Type = Stop User-Name = "prova" Calling-Station-Id = "00-16-C7-8F-A0-02" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "nas01" Framed-IP-Address = 192.168.182.4 Acct-Session-Id = "44f032f900000001" Acct-Input-Octets = 2333 Acct-Output-Octets = 7498 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 23 Acct-Output-Packets = 27 Acct-Session-Time = 6 Acct-Terminate-Cause = User-Request Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "44f032f900000001",User-Name = "prova"' rlm_acct_unique: Acct-Unique-Session-ID = "6b96572558c4da26". modcall[preacct]: module "acct_unique" returns ok for request 2 rlm_realm: No '@' in User-Name = "prova", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 2 modcall[preacct]: module "files" returns noop for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826 modcall[accounting]: module "detail" returns ok for request 2 modcall[accounting]: module "unix" returns ok for request 2 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'prova' modcall[accounting]: module "radutmp" returns ok for request 2 rlm_ippool: Searching for an entry for nas/port: 0.0.0.0/1 rlm_ippool: Deallocated entry for ip/port: 192.168.182.231/1 rlm_ippool: num: 0 modcall[accounting]: module "main_pool" returns ok for request 2 modcall: leaving group accounting (returns ok) for request 2 Sending Accounting-Response of id 1 to 127.0.0.1 port 1041 Finished request 2 Going to the next request --- Walking the entire request list --- Cleaning up request 2 ID 1 with timestamp 44f03325 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1043, id=0, length=216 User-Name = "user1" CHAP-Challenge = 0x1669c921cccf393ea4c3cd6fb04cad51 CHAP-Password = 0x00998b87a9c04a1ae386929663e9f4fbff NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.4 Calling-Station-Id = "00-16-C7-8F-A0-02" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Identifier = "nas01" Acct-Session-Id = "44f0332500000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x8db3bf8679635fe3528607ab31299415 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 154 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=statistica,dc=mydomain,dc=it' radius_xlat: '(uid=user1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=statistica,dc=mydomain,dc=it, with filter (uid=user1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn\3dAntonio Piccolo\2cou\3dfaculty\2cou\3ddepartment\2cou\3dstatistica\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dAntonio Piccolo\2cou\3dfaculty\2cou\3ddepartment\2cou\3dstatistica\2cdc\3dmydomain\2cdc\3dit)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=statistica,dc=mydomain,dc=it, with filter (&(radiusGroupName=professor)(|(&(objectClass=GroupOfNames)(member=cn\3dAntonio Piccolo\2cou\3dfaculty\2cou\3ddepartment\2cou\3dstatistica\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dAntonio Piccolo\2cou\3dfaculty\2cou\3ddepartment\2cou\3dstatistica\2cdc\3dmydomain\2cdc\3dit)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group professor not found or user is not a member. modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for user1 radius_xlat: '(uid=user1)' radius_xlat: 'ou=statistica,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=statistica,dc=mydomain,dc=it, with filter (uid=user1) rlm_ldap: checking if remote access for user1 is allowed by userPassword rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusGroupName as Ldap-Group, value professor & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value C4-5A-5E-D0-1F-F4 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-16-C7-8F-A0-02 & op=21 rlm_ldap: Adding userPassword as User-Password, value a & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user user1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-16-C7-8F-A0-02 rlm_checkval: Value Name: Calling-Station-Id, Value: C4-5A-5E-D0-1F-F4 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-16-C7-8F-A0-02 modcall[authorize]: module "checkval" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 3 rlm_chap: login attempt by "user1" with CHAP password rlm_chap: Using clear text password a for user user1 authentication. rlm_chap: chap user user1 authenticated succesfully modcall[authenticate]: module "chap" returns ok for request 3 modcall: leaving group CHAP (returns ok) for request 3 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 3 modcall: leaving group post-auth (returns noop) for request 3 Sending Access-Accept of id 0 to 127.0.0.1 port 1043 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 127.0.0.1:1041, id=2, length=131 Acct-Status-Type = Start User-Name = "user1" Calling-Station-Id = "00-16-C7-8F-A0-02" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "nas01" Framed-IP-Address = 192.168.182.4 Acct-Session-Id = "44f0332500000001" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 4 modcall[preacct]: module "preprocess" returns noop for request 4 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "44f0332500000001",User-Name = "user1"' rlm_acct_unique: Acct-Unique-Session-ID = "03b237c32d98c65e". modcall[preacct]: module "acct_unique" returns ok for request 4 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 4 modcall[preacct]: module "files" returns noop for request 4 modcall: leaving group preacct (returns ok) for request 4 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826 modcall[accounting]: module "detail" returns ok for request 4 modcall[accounting]: module "unix" returns ok for request 4 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'user1' modcall[accounting]: module "radutmp" returns ok for request 4 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "main_pool" returns noop for request 4 modcall: leaving group accounting (returns ok) for request 4 Sending Accounting-Response of id 2 to 127.0.0.1 port 1041 Finished request 4 Going to the next request Cleaning up request 4 ID 2 with timestamp 44f03347 Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 127.0.0.1:1041, id=3, length=179 Acct-Status-Type = Stop User-Name = "user1" Calling-Station-Id = "00-16-C7-8F-A0-02" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "nas01" Framed-IP-Address = 192.168.182.4 Acct-Session-Id = "44f0332500000001" Acct-Input-Octets = 2328 Acct-Output-Octets = 7447 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 23 Acct-Output-Packets = 26 Acct-Session-Time = 6 Acct-Terminate-Cause = User-Request Processing the preacct section of radiusd.conf modcall: entering group preacct for request 5 modcall[preacct]: module "preprocess" returns noop for request 5 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "44f0332500000001",User-Name = "user1"' rlm_acct_unique: Acct-Unique-Session-ID = "03b237c32d98c65e". modcall[preacct]: module "acct_unique" returns ok for request 5 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 5 modcall[preacct]: module "files" returns noop for request 5 modcall: leaving group preacct (returns ok) for request 5 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 5 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20060826 modcall[accounting]: module "detail" returns ok for request 5 modcall[accounting]: module "unix" returns ok for request 5 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'user1' modcall[accounting]: module "radutmp" returns ok for request 5 rlm_ippool: Searching for an entry for nas/port: 0.0.0.0/1 rlm_ippool: Deallocated entry for ip/port: 192.168.182.231/1 modcall[accounting]: module "main_pool" returns ok for request 5 modcall: leaving group accounting (returns ok) for request 5 Sending Accounting-Response of id 3 to 127.0.0.1 port 1041 Finished request 5 Going to the next request --- Walking the entire request list --- Cleaning up request 3 ID 0 with timestamp 44f03347 Cleaning up request 5 ID 3 with timestamp 44f0334d Nothing to do. Sleeping until we see a request. ----------------------------------------------------------------------------- Ldap user ================================ dn: cn=AntonioPiccolo,ou=faculty,ou=department,ou=statistica,dc=mydomain,dc=it uid: user1 objectClass: top objectClass: inetOrgPerson objectClass: radiusprofile sn: Piccolo cn: AntonioPiccolo structuralObjectClass: inetOrgPerson entryUUID: 495881e0-addd-102a-9362-d731fc0d1eff creatorsName: cn=Manager,dc=mydomain,dc=it createTimestamp: 20060722145122Z userPassword:: YQ== radiusCallingStationId: C4-5A-5E-D0-1F-F4 radiusCallingStationId: 00-02-C7-8F-A0-16 radiusGroupName: professor entryCSN: 20060826113921Z#000000#00#000000 modifiersName: cn=Manager,dc=mydomain,dc=it modifyTimestamp: 20060826113921Z ---------------------------------------------------------------------------------------------------------- radius.conf ........... modules { ........... ldap { server="localhost" port="389" identity = "cn=Manager,dc=uniroma1,dc=it" password = P1PP3R0 basedn="ou=statistica,dc=uniroma1,dc=it" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "userPassword" dictionary_mapping = ${raddbdir}/ldap.attrmap authtype = ldap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } .................... } ippool main_pool { range-start = 192.168.182.129 range-stop = 192.168.182.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } accounting { detail unix main_pool } post-auth { main_pool } --------------------------------------------------------------- users prova Pool-Name:="main_pool", Auth-Type := Local, User-Password == "a" Service-Type = Framed-User, Fall-Through = no DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Ldap-Group == professor, Pool-Name :="main_pool" Service-Type == Framed-User, Fall-Through = no DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP -------------------------------------------------------------------------------------------- ldap.attrmap checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem User-Password userPassword checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress checkItem Ldap-Group radiusGroupName replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage ------------------------------------------------------------------------------------------------------

2 8

Multiple registers in my DB with the same information
by Santiago Balaguer García 29 Aug '06

29 Aug '06

Hi people, I use freeradius 1.1.0 in a debian servers for several years. Now I use my radius server more than before. So in my DB it appears some strange duplicate registers which have the same inforrmation. I show a snapshoot with an account where the problem happens: ------------------------------------ radacctid|acctsessionid|acctuniqueid|username|realm|nasipaddress|nasportid|nasporttype|acctstarttime|acctstoptime|acctsessiontime|acctauthentic|connectinfo_start|connectinfo_stop|acctinputoctets|acctoutputoctets|calledstationid|callingstationid|acctterminatecause|servicetype|framedprotocol|framedipaddress|acctstartdelay|acctstopdelay 153270|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 14:40:59.614916+02|2006-07-26 17:20:52.812241+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129|0|0 153395|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:29.945729+02|2006-07-26 17:20:52.945729+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||16 153392|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:29.902309+02|2006-07-26 17:20:52.902309+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||4 153393|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:29.929558+02|2006-07-26 17:20:52.929558+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||8 153394|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:29.966051+02|2006-07-26 17:20:52.966051+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||12 153396|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:29.983671+02|2006-07-26 17:20:52.983671+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||20 153397|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:30.019645+02|2006-07-26 17:20:53.019645+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||24 153398|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:30.047495+02|2006-07-26 17:20:53.047495+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||28 153401|A2000001|9c4661a9f1471d42|aabo6098||172.19.242.50|0|Async|2006-07-26 15:03:29.204327+02|2006-07-26 17:20:52.204327+02|8243||||264229589|18168071|00-50-E8-02-42-FB|00-13-02-1D-12-58|Session-Timeout|||10.5.0.129||88 --------------------------------------------- I attach this info in a file <<registro.csv>> As you can realize the last integer after the IP is acctstopdely. this values are 0, 4, 8, 12, 16, 20, 24, 28, 88. It is not usual this atribute was upper than 1. My request timeout is 4 secs. Well, this situation is very important because I have a ttriger to decrease the credit of this account. Moreover, the time which this account spent is NOT real. What I don't know if the problem is in my NAS or there is a mistake in my freeradius configuration. Any sugestion?? _________________________________________________________________ Acepta el reto MSN Premium: Correos más divertidos con fotos y textos increíbles en MSN Premium. Descárgalo y pruébalo 2 meses gratis. http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_correosmasdi…

2 1

FreeRADIUS and Postgres annoyance
by Joe Warren-Meeks 29 Aug '06

29 Aug '06

radiusd: FreeRADIUS Version 1.1.2, for host , built on Jul 27 2006 at 16:42:40 Linux auth2 2.6.15-23-server #1 SMP Tue May 23 15:10:35 UTC 2006 i686 GNU/Linux Hey there, I had radiusd working nicely with MySQL, but apparently we have to use Postgres, which is fine.. Recompiled it with postgres support and I have it talking to the db, in that it successfully opens up 4 connections to the database. I've also setup postgresql.conf too, looks ok.. However, when I try to authenticate, the DB isn't returning any results. I can take the query string and run it from psql and get the right result, but radiusd doesn't seem to get the answer. radius=> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'joetest' ORDER BY id; id | username | attribute | value | op ----+----------+-----------+---------+---- 3 | joetest | Password | letmein | == (1 row) radius=> (a log is appended to the end, showing the output of radiusd -Xx) On a side note, I also can't see where to configure radiusd to use the nas table to get its list of clients from, pointers?) Thanks for any help I can get -- joe. Tue Aug 8 10:33:12 2006 : Info: Starting - reading configuration files ... Tue Aug 8 10:33:12 2006 : Debug: reread_config: reading radiusd.conf Tue Aug 8 10:33:12 2006 : Debug: Config: including file: /usr/ local/freeradius/etc/raddb/clients.conf Tue Aug 8 10:33:12 2006 : Debug: Config: including file: /usr/ local/freeradius/etc/raddb/snmp.conf Tue Aug 8 10:33:12 2006 : Debug: Config: including file: /usr/ local/freeradius/etc/raddb/eap.conf Tue Aug 8 10:33:12 2006 : Debug: Config: including file: /usr/ local/freeradius/etc/raddb/postgresql.conf Tue Aug 8 10:33:12 2006 : Debug: main: prefix = "/usr/local/ freeradius" Tue Aug 8 10:33:12 2006 : Debug: main: localstatedir = "/usr/local/ freeradius/var" Tue Aug 8 10:33:12 2006 : Debug: main: logdir = "/usr/local/ freeradius/var/log/radius" Tue Aug 8 10:33:12 2006 : Debug: main: libdir = "/usr/local/ freeradius/lib" Tue Aug 8 10:33:12 2006 : Debug: main: radacctdir = "/usr/local/ freeradius/var/log/radius/radacct" Tue Aug 8 10:33:12 2006 : Debug: main: hostname_lookups = no Tue Aug 8 10:33:12 2006 : Debug: main: max_request_time = 30 Tue Aug 8 10:33:12 2006 : Debug: main: cleanup_delay = 5 Tue Aug 8 10:33:12 2006 : Debug: main: max_requests = 1024 Tue Aug 8 10:33:12 2006 : Debug: main: delete_blocked_requests = 0 Tue Aug 8 10:33:12 2006 : Debug: main: port = 0 Tue Aug 8 10:33:12 2006 : Debug: main: allow_core_dumps = no Tue Aug 8 10:33:12 2006 : Debug: main: log_stripped_names = no Tue Aug 8 10:33:12 2006 : Debug: main: log_file = "/usr/local/ freeradius/var/log/radius/radius.log" Tue Aug 8 10:33:12 2006 : Debug: main: log_auth = no Tue Aug 8 10:33:12 2006 : Debug: main: log_auth_badpass = no Tue Aug 8 10:33:12 2006 : Debug: main: log_auth_goodpass = no Tue Aug 8 10:33:12 2006 : Debug: main: pidfile = "/usr/local/ freeradius/var/run/radiusd/radiusd.pid" Tue Aug 8 10:33:12 2006 : Debug: main: user = "nobody" Tue Aug 8 10:33:12 2006 : Debug: main: group = "nogroup" Tue Aug 8 10:33:12 2006 : Debug: main: usercollide = no Tue Aug 8 10:33:12 2006 : Debug: main: lower_user = "no" Tue Aug 8 10:33:12 2006 : Debug: main: lower_pass = "no" Tue Aug 8 10:33:12 2006 : Debug: main: nospace_user = "no" Tue Aug 8 10:33:12 2006 : Debug: main: nospace_pass = "no" Tue Aug 8 10:33:12 2006 : Debug: main: checkrad = "/usr/local/ freeradius/sbin/checkrad" Tue Aug 8 10:33:12 2006 : Debug: main: proxy_requests = no Tue Aug 8 10:33:12 2006 : Debug: security: max_attributes = 200 Tue Aug 8 10:33:12 2006 : Debug: security: reject_delay = 1 Tue Aug 8 10:33:12 2006 : Debug: security: status_server = no Tue Aug 8 10:33:12 2006 : Debug: main: debug_level = 0 Tue Aug 8 10:33:12 2006 : Debug: read_config_files: reading dictionary Tue Aug 8 10:33:12 2006 : Debug: read_config_files: reading naslist Tue Aug 8 10:33:12 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Aug 8 10:33:12 2006 : Debug: read_config_files: reading clients Tue Aug 8 10:33:12 2006 : Debug: read_config_files: reading realms Tue Aug 8 10:33:12 2006 : Debug: radiusd: entering modules setup Tue Aug 8 10:33:12 2006 : Debug: Module: Library search path is /usr/ local/freeradius/lib Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded exec Tue Aug 8 10:33:12 2006 : Debug: exec: wait = yes Tue Aug 8 10:33:12 2006 : Debug: exec: program = "(null)" Tue Aug 8 10:33:12 2006 : Debug: exec: input_pairs = "request" Tue Aug 8 10:33:12 2006 : Debug: exec: output_pairs = "(null)" Tue Aug 8 10:33:12 2006 : Debug: exec: packet_type = "(null)" Tue Aug 8 10:33:12 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated exec (exec) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded expr Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated expr (expr) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded PAP Tue Aug 8 10:33:12 2006 : Debug: pap: encryption_scheme = "crypt" Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated pap (pap) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded CHAP Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated chap (chap) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded MS-CHAP Tue Aug 8 10:33:12 2006 : Debug: mschap: use_mppe = yes Tue Aug 8 10:33:12 2006 : Debug: mschap: require_encryption = no Tue Aug 8 10:33:12 2006 : Debug: mschap: require_strong = no Tue Aug 8 10:33:12 2006 : Debug: mschap: with_ntdomain_hack = no Tue Aug 8 10:33:12 2006 : Debug: mschap: passwd = "(null)" Tue Aug 8 10:33:12 2006 : Debug: mschap: ntlm_auth = "(null)" Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated mschap (mschap) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded System Tue Aug 8 10:33:12 2006 : Debug: unix: cache = no Tue Aug 8 10:33:12 2006 : Debug: unix: passwd = "(null)" Tue Aug 8 10:33:12 2006 : Debug: unix: shadow = "(null)" Tue Aug 8 10:33:12 2006 : Debug: unix: group = "(null)" Tue Aug 8 10:33:12 2006 : Debug: unix: radwtmp = "/usr/local/ freeradius/var/log/radius/radwtmp" Tue Aug 8 10:33:12 2006 : Debug: unix: usegroup = no Tue Aug 8 10:33:12 2006 : Debug: unix: cache_reload = 600 Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated unix (unix) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded eap Tue Aug 8 10:33:12 2006 : Debug: eap: default_eap_type = "md5" Tue Aug 8 10:33:12 2006 : Debug: eap: timer_expire = 60 Tue Aug 8 10:33:12 2006 : Debug: eap: ignore_unknown_eap_types = no Tue Aug 8 10:33:12 2006 : Debug: eap: cisco_accounting_username_bug = no Tue Aug 8 10:33:12 2006 : Debug: rlm_eap: Loaded and initialized type md5 Tue Aug 8 10:33:12 2006 : Debug: rlm_eap: Loaded and initialized type leap Tue Aug 8 10:33:12 2006 : Debug: gtc: challenge = "Password: " Tue Aug 8 10:33:12 2006 : Debug: gtc: auth_type = "PAP" Tue Aug 8 10:33:12 2006 : Debug: rlm_eap: Loaded and initialized type gtc Tue Aug 8 10:33:12 2006 : Debug: mschapv2: with_ntdomain_hack = no Tue Aug 8 10:33:12 2006 : Debug: rlm_eap: Loaded and initialized type mschapv2 Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated eap (eap) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded preprocess Tue Aug 8 10:33:12 2006 : Debug: preprocess: huntgroups = "/usr/ local/freeradius/etc/raddb/huntgroups" Tue Aug 8 10:33:12 2006 : Debug: preprocess: hints = "/usr/local/ freeradius/etc/raddb/hints" Tue Aug 8 10:33:12 2006 : Debug: preprocess: with_ascend_hack = no Tue Aug 8 10:33:12 2006 : Debug: preprocess: ascend_channels_per_line = 23 Tue Aug 8 10:33:12 2006 : Debug: preprocess: with_ntdomain_hack = no Tue Aug 8 10:33:12 2006 : Debug: preprocess: with_specialix_jetstream_hack = no Tue Aug 8 10:33:12 2006 : Debug: preprocess: with_cisco_vsa_hack = no Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated preprocess (preprocess) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded realm Tue Aug 8 10:33:12 2006 : Debug: realm: format = "suffix" Tue Aug 8 10:33:12 2006 : Debug: realm: delimiter = "@" Tue Aug 8 10:33:12 2006 : Debug: realm: ignore_default = no Tue Aug 8 10:33:12 2006 : Debug: realm: ignore_null = no Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated realm (suffix) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded files Tue Aug 8 10:33:12 2006 : Debug: files: usersfile = "/usr/local/ freeradius/etc/raddb/users" Tue Aug 8 10:33:12 2006 : Debug: files: acctusersfile = "/usr/local/ freeradius/etc/raddb/acct_users" Tue Aug 8 10:33:12 2006 : Debug: files: preproxy_usersfile = "/usr/ local/freeradius/etc/raddb/preproxy_users" Tue Aug 8 10:33:12 2006 : Debug: files: compat = "no" Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated files (files) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded SQL Tue Aug 8 10:33:12 2006 : Debug: sql: driver = "rlm_sql_postgresql" Tue Aug 8 10:33:12 2006 : Debug: sql: server = "192.168.3.17" Tue Aug 8 10:33:12 2006 : Debug: sql: port = "" Tue Aug 8 10:33:12 2006 : Debug: sql: login = "radius" Tue Aug 8 10:33:12 2006 : Debug: sql: password = "thatllbemypasswordthen" Tue Aug 8 10:33:12 2006 : Debug: sql: radius_db = "radius" Tue Aug 8 10:33:12 2006 : Debug: sql: nas_table = "nas" Tue Aug 8 10:33:12 2006 : Debug: sql: sqltrace = yes Tue Aug 8 10:33:12 2006 : Debug: sql: sqltracefile = "/usr/local/ freeradius/var/log/radius/sqltrace.sql" Tue Aug 8 10:33:12 2006 : Debug: sql: readclients = no Tue Aug 8 10:33:12 2006 : Debug: sql: deletestalesessions = yes Tue Aug 8 10:33:12 2006 : Debug: sql: num_sql_socks = 5 Tue Aug 8 10:33:12 2006 : Debug: sql: sql_user_name = "%{User-Name}" Tue Aug 8 10:33:12 2006 : Debug: sql: default_user_profile = "" Tue Aug 8 10:33:12 2006 : Debug: sql: query_on_not_found = no Tue Aug 8 10:33:12 2006 : Debug: sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" Tue Aug 8 10:33:12 2006 : Debug: sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" Tue Aug 8 10:33:12 2006 : Debug: sql: authorize_group_check_query = "SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupche ck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = '%{SQL- User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" Tue Aug 8 10:33:12 2006 : Debug: sql: authorize_group_reply_query = "SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupre ply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL- User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{Acct-Delay- Time:-0}'::interval), AcctSessionTime = (EXT RACT(EPOCH FROM('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay- Time:-0}'::interval)))::BIGINT, AcctTerminateCause='%{Acct-Terminate-Cau se}', AcctStopDelay = '%{Acct-Delay-Time:-0}' WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP- Address}' AND AcctStartTime <= '%S'::timestamp" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = (EXTRACT(EPOC H FROM('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, AcctInputOctets = (('%{Acct-Input-Gigawords:-0}': :bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output- Octets:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, A cctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress) values('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '% {Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', ('% S'::timestamp - '%{Acct-Delay-Time:-0}'::i nterval - '%{Acct-Session-Time:-0}'::interval), '%{Acct-Session- Time}', '%{Acct-Authentic}', (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output- Octets:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station- Id}', '%{Service-Type}', '%{Framed-Protocol}', N ULLIF('%{Framed-IP-Address}', '')::inet)" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctSt artTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct- Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP- Address}', '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '% {Acct-Delay-Time:-0}'::interval), '%{Acct-Authe ntic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station- Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP- Address}', '')::inet, '%{Acct-Delay-Time :-0}')" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = ('%S'::timestamp - '%{Acct-Delay- Time:-0}'::interval), AcctStartDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User- Name}' AND NASIPAddress = '%{NAS-IP-Address} ' AND AcctStopTime IS NULL" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{Acct-Delay- Time:-0}'::interval), AcctSessionTime = NULLI F('%{Acct-Session-Time}', '')::bigint, AcctInputOctets = (('%{Acct- Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input- Octets:-0}'::bigint), AcctOutputOctets = (('%{Acct-Output- Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '% {Acct-Delay-Time:-0}', FramedIPAddress = N ULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '% {Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{ NAS-IP-Address}' AND AcctStopTime IS NULL" Tue Aug 8 10:33:12 2006 : Debug: sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, Acc tStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType , FramedProtocol, FramedIPAddress, AcctStopDelay) values('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '% {Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', ' %{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay- Time:-0}'::interval - '%{Acct-Session-Time:-0}'::interval), ('% S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), NULLIF('% {Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}', '%{Connect- Info}', (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input- Octets:-0}'::bigint), (('%{Acct-Output-G igawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), '% {Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate- Cause}', '%{Service-Type}', '%{Framed-Prot ocol}', NULLIF('%{Framed-IP-Address}', '')::inet, '%{Acct-Delay- Time:-0}')" Tue Aug 8 10:33:12 2006 : Debug: sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" Tue Aug 8 10:33:12 2006 : Debug: sql: connect_failure_retry_delay = 60 Tue Aug 8 10:33:12 2006 : Debug: sql: simul_count_query = "" Tue Aug 8 10:33:12 2006 : Debug: sql: simul_verify_query = "" Tue Aug 8 10:33:12 2006 : Debug: sql: postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '% {reply:Packet-Type}', NOW())" Tue Aug 8 10:33:12 2006 : Debug: sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Tue Aug 8 10:33:12 2006 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Tue Aug 8 10:33:12 2006 : Info: rlm_sql (sql): Attempting to connect to radius@192.168.3.17:/radius Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): starting 0 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Connected new DB handle, #0 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): starting 1 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Connected new DB handle, #1 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): starting 2 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Connected new DB handle, #2 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): starting 3 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Connected new DB handle, #3 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): starting 4 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 Tue Aug 8 10:33:12 2006 : Debug: rlm_sql (sql): Connected new DB handle, #4 Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated sql (sql) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded Acct-Unique-Session-Id Tue Aug 8 10:33:12 2006 : Debug: acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated acct_unique (acct_unique) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded detail Tue Aug 8 10:33:12 2006 : Debug: detail: detailfile = "/usr/local/ freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Tue Aug 8 10:33:12 2006 : Debug: detail: detailperm = 384 Tue Aug 8 10:33:12 2006 : Debug: detail: dirperm = 493 Tue Aug 8 10:33:12 2006 : Debug: detail: locking = no Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated detail (detail) Tue Aug 8 10:33:12 2006 : Debug: Module: Loaded radutmp Tue Aug 8 10:33:12 2006 : Debug: radutmp: filename = "/usr/local/ freeradius/var/log/radius/radutmp" Tue Aug 8 10:33:12 2006 : Debug: radutmp: username = "%{User-Name}" Tue Aug 8 10:33:12 2006 : Debug: radutmp: case_sensitive = yes Tue Aug 8 10:33:12 2006 : Debug: radutmp: check_with_nas = yes Tue Aug 8 10:33:12 2006 : Debug: radutmp: perm = 384 Tue Aug 8 10:33:12 2006 : Debug: radutmp: callerid = yes Tue Aug 8 10:33:12 2006 : Debug: Module: Instantiated radutmp (radutmp) Tue Aug 8 10:33:12 2006 : Debug: Listening on authentication *:1812 Tue Aug 8 10:33:12 2006 : Debug: Listening on accounting *:1813 Tue Aug 8 10:33:12 2006 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.3.20:32770, id=65, length=47 User-Name = "joetest" User-Password = "letmein" Tue Aug 8 10:33:15 2006 : Debug: Processing the authorize section of radiusd.conf Tue Aug 8 10:33:15 2006 : Debug: modcall: entering group authorize for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Tue Aug 8 10:33:15 2006 : Debug: rlm_realm: No '@' in User-Name = "joetest", looking up realm NULL Tue Aug 8 10:33:15 2006 : Debug: rlm_realm: No such realm "NULL" Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Tue Aug 8 10:33:15 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Tue Aug 8 10:33:15 2006 : Debug: users: Matched entry DEFAULT at line 152 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 0 Tue Aug 8 10:33:15 2006 : Debug: radius_xlat: 'joetest' Tue Aug 8 10:33:15 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'joetest' Tue Aug 8 10:33:15 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'joetest' ORDER BY id' Tue Aug 8 10:33:15 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'joetest' ORDER BY id Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: affected rows = Tue Aug 8 10:33:15 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupche ck, usergroup WHERE usergroup.Username = 'joetest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'joetest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: affected rows = Tue Aug 8 10:33:15 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'joetest' ORDER BY id' Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'joetest' ORDER BY id Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: affected rows = Tue Aug 8 10:33:15 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupre ply,usergroup WHERE usergroup.Username = 'joetest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FRO M radgroupreply,usergroup WHERE usergroup.Username = 'joetest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Tue Aug 8 10:33:15 2006 : Debug: rlm_sql_postgresql: affected rows = Tue Aug 8 10:33:15 2006 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall: leaving group authorize (returns ok) for request 0 Tue Aug 8 10:33:15 2006 : Debug: rad_check_password: Found Auth- Type System Tue Aug 8 10:33:15 2006 : Debug: auth: type "System" Tue Aug 8 10:33:15 2006 : Debug: Processing the authenticate section of radiusd.conf Tue Aug 8 10:33:15 2006 : Debug: modcall: entering group authenticate for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall[authenticate]: module "unix" returns notfound for request 0 Tue Aug 8 10:33:15 2006 : Debug: modcall: leaving group authenticate (returns notfound) for request 0 Tue Aug 8 10:33:15 2006 : Debug: auth: Failed to validate the user. Tue Aug 8 10:33:15 2006 : Debug: Delaying request 0 for 1 seconds Tue Aug 8 10:33:15 2006 : Debug: Finished request 0 Tue Aug 8 10:33:15 2006 : Debug: Going to the next request Tue Aug 8 10:33:15 2006 : Debug: --- Walking the entire request list --- Tue Aug 8 10:33:15 2006 : Debug: Waking up in 1 seconds... Tue Aug 8 10:33:16 2006 : Debug: --- Walking the entire request list ---

5 6

FreeNAC: OpenSource NAC
by Hector.Ortiz＠swisscom.com 29 Aug '06

29 Aug '06

FreeNAC provides easy to use VLAN assignment and LAN access control for Cisco Switches and all kind of network devices (Servers, Workstations, Printers, IP-Phones, Webcams...). FreeNAC can be considered as having two phases. Initially, we have taken OpenVMPS (which provides MAC based access control), added a MySQL back end, a GUI, improved access control algorithms, scalability, redundancy, alerting etc. This tool has been published as OpenSource on FreeNAC.net. Next, we are testing 802.1x support by tying in FreeRadius (802.1x provides better security and is not limited to Cisco switches) and moving the Delphi GUI to a web based user interface. The 'plan' is for the project to move forward to eventually become THE OpenSource Enterprise tool for dynamic VLAN assignment and LAN/WLAN authentication. So, we wish to solicite community opinions, expertise, help and feedback. Are you interested in this tool, would you like to use it or even like to contribute to it (documentation, support, development, promotion, architecture, review...)? Please visit us on www.FreeNAC.net!

1 0

EAP PEAP, unable to load certificate
by Nick Larsen 28 Aug '06

28 Aug '06

Hi Subscribers, I'm currently setting up a wireless hotspot for a cafe, and am currently stuck with the EAP part in FreeRADIUS. I'm running "FreeRADIUS Version 1.1.1" on FreeBSD `uname -a` output: FreeBSD radius02.01.net.nz 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Wed Nov 2 22:33:15 UTC 2005 root@s-dallas.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC sparc64 I'm trying to connect my i-mate PDA2k (PDA) to the Linksys WAG54g access point. The access point is set up to use WPA-RADIUS, but when I attempt to connect to it from the PDA, It say's the Linksys isn't sending a User-Password or CHAP-Password attribute, so this is where I thought I needed EAP. We want to make is as easy as possible for people with mobile devices to connect to the AP, so I decided to use the PEAP method, which requires tls{} to be enabled. I have created an SSL certificate (CA) and private key file, and put them in /etc/raddb/certs and referenced them correctly in eap.conf under tls{} but when I enable peap{} I get the following output from radiusd -XA: (On the 8th to last line, you'll see fopen, and it has nothing between the quotes in the 1st argument.) Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 5120 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.10.1.18 IP address [10.10.1.18] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter sqlcounter: counter-name = "Daily-Session-Time" sqlcounter: check-name = "Max-Daily-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "daily" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1830 rlm_sqlcounter: Check attribute Max-Daily-Session is number 1831 rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Next reset 1156507200 [2006-08-26 00:00:00] rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Prev reset 1156420800 [2006-08-25 00:00:00] Module: Instantiated sqlcounter (dailycounter) sqlcounter: counter-name = "Monthly-Session-Time" sqlcounter: check-name = "Max-Monthly-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "monthly" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Counter attribute Monthly-Session-Time is number 1832 rlm_sqlcounter: Check attribute Max-Monthly-Session is number 1833 rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Next reset 1157025600 [2006-09-01 00:00:00] rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Prev reset 1154347200 [2006-08-01 00:00:00] Module: Instantiated sqlcounter (monthlycounter) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/private/cakey.pem" tls: certificate_file = "(null)" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "*******" tls: dh_file = "(null)" tls: random_file = "(null)" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 1062:error:0200100E:system library:fopen:Bad address:bss_file.c:352:fopen('','r') 1062:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: 1062:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:720: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1906] Unknown module "eap". radiusd.conf[1853] Failed to parse authenticate section. Does anyone know what could cause this, or is there a better method to get ease of use for wireless clients? Please let me know if there's other info you need which may help, as I'm sure I would have forgotten something. Thanks in advance, -- Regards, Nick Larsen Wellington NEW ZEALAND

3 5

Please help !!!
by Kartthik 28 Aug '06

28 Aug '06

3 2

RE: Report Generator
by Edward.Shih＠rcc.edu 28 Aug '06

28 Aug '06

Thank you, Sean. Have a great day. Edward -----Original Message----- From: freeradius-users-bounces+edward.shih=rcc.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+edward.shih=rcc.edu@lists.freeradius.or g] On Behalf Of Sean Sent: Monday, August 28, 2006 10:45 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: Report Generator Hi Andre, You can download the work to date here http://swarmhotspots.com/phpreports.tar.gz I'm integrating phpMyPrepaid and Dialup Admin into it at the moment, so there are a lot of redundant files included in the tar file. You can have a look at how it works at http://topup.ie/reports username testuser, password testuser. Some reports ask for a client user name use seanb52, some reports ask for a NAS ID use palm1 and some reports request the NAS IP use 82.153.112.235 Please give me some feedback. I'd like to know if any of this would be useful or worth putting onto Sourceforge when it's ready for release. There is no documentation ready yet but if you need help send me an email. Don't tie up the FreeRadius list with private correspondence. Regards, Sean Bracken http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Suggestions about captive portal
by Giuseppina Venezia 28 Aug '06

28 Aug '06

Hi all, I would like to know what Captive Portal you advise to use and in particular what supports better Freeradius. For the moment I'am using Chillispot. My problem is always the same: set the NAS to accept the IP address, assigned by IP pool, from FreeRADIUS. I have searched documentation related to my NAS (Doc, forum, mailing list, ecc.ecc.) but I haven't find nothing of useful for my problem. Fort this reason i would to use another captive portal (that support freeradius) that can solve my problem. Thanks in advance for every advice or help. Best regards. Giusy

1 0

RE: Report Generator
by Sean 28 Aug '06

28 Aug '06

Hi Andre, You can download the work to date here http://swarmhotspots.com/phpreports.tar.gz I'm integrating phpMyPrepaid and Dialup Admin into it at the moment, so there are a lot of redundant files included in the tar file. You can have a look at how it works at http://topup.ie/reports username testuser, password testuser. Some reports ask for a client user name use seanb52, some reports ask for a NAS ID use palm1 and some reports request the NAS IP use 82.153.112.235 Please give me some feedback. I'd like to know if any of this would be useful or worth putting onto Sourceforge when it's ready for release. There is no documentation ready yet but if you need help send me an email. Don't tie up the FreeRadius list with private correspondence. Regards, Sean Bracken http://swarmhotspots.com

1 0