- Freeradius-Users - lists.freeradius.org

RE: How Getting accounting informations ?
by Vincent MARGUERIE 28 Mar '06

28 Mar '06

Hi, I've always got the same problem with accounting informations...sorry to query you one more time !! But I've made a new test with radclient and I have this log (maybe it will be helpfull) > echo "User-Password = tata, User-Name = tata, Accounting-Status-Type = Start" | radclient -x -d /usr/local/etc/raddb/ radius:1813 acct whatever rad_recv: Accounting-Request packet from host 192.168.0.1:32768, id=218, length=44 User-Password = "\256\032\246\027\310$!\305\313UBc\306." User-Name = "tata" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 7 modcall[preacct]: module "preprocess" returns noop for request 7 rlm_realm: No '@' in User-Name = "tata", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 7 modcall: leaving group preacct (returns noop) for request 7 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 7 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/detail-20060328 modcall[accounting]: module "detail" returns ok for request 7 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 7 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 7 radius_xlat: '*packet has no accounting status type*. [user 'tata', nas '192.168.0.1']' rlm_sql (sql) in sql_accounting: packet has no accounting status type. [user 'tata', nas '192.168.0.1'] modcall[accounting]: module "sql" returns invalid for request 7 modcall: leaving group accounting (returns invalid) for request 7 Finished request 7 Going to the next request --- Walking the entire request list --- Cleaning up request 7 ID 218 with timestamp 44289161 Nothing to do. Sleeping until we see a request. What does "*packet has no accounting status type*" means ? Is it the reason for accounting doesn't work ? I fell lost...please help :-) ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- For the auth section....there's no problem (see the following lines) > echo "User-Password = tata, User-Name = tata, Accounting-Status-Type = Start" | radclient -x -d /usr/local/etc/raddb/ radius:1812 auth whatever rad_recv: Access-Request packet from host 192.168.0.1:32768, id=215, length=44 User-Password = "tata" User-Name = "tata" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/auth-detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/auth-detail-20060328 modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tata", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 radius_xlat: 'tata' rlm_sql (sql): sql_set_user escaped user --> 'tata' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tata' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tata' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tata' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tata' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/reply-detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/reply-detail-20060328 modcall[post-auth]: module "reply_log" returns ok for request 4 rlm_sql (sql): Processing sql_postauth radius_xlat: 'tata' rlm_sql (sql): sql_set_user escaped user --> 'tata' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW())' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 0 modcall[post-auth]: module "sql" returns ok for request 4 rlm_sql_log (sql_log): Processing sql_log_postauth radius_xlat: 'INSERT INTO radpostauth ?? (user, pass, reply, date) VALUES ?? ('tata', 'tata', ?? 'Access-Accept', '2006-03-28 03:22:25');' radius_xlat: '/usr/local/var/log/radius/radacct/sql-relay' modcall[post-auth]: module "sql_log" returns ok for request 4 modcall: leaving group post-auth (returns ok) for request 4 Sending Access-Accept of id 215 to 192.168.0.1 port 32768 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 215 with timestamp 44288fd1 Nothing to do. Sleeping until we see a request. Regards, Vincent

1 1

rlm_eap_tls sometimes fails to read files after HUP
by Ben Thompson 27 Mar '06

27 Mar '06

Hi I have just upgraded to FreeRADIUS 1.1.1 after previously using the 1.0.1 RedHat package. At first startup it works fine but sometimes when the server receives a HUP signal (we do this every 15 mins) to re-read the config files I am getting the following errors :- Wed Mar 22 16:48:45 2006 : Info: Reloading configuration files. Wed Mar 22 16:48:47 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:48:47 2006 : Error: rlm_eap_tls: Error reading certificate file Wed Mar 22 16:48:47 2006 : Error: rlm_eap: Failed to initialize type tls Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[9]: eap: Module instantiation failed. Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1719] Unknown module "eap". Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1666] Failed to parse authenticate section. At this point I have to restart. As I said this only happens sometimes, at other times it is successful and I just get this :- Wed Mar 22 16:47:36 2006 : Info: Reloading configuration files. Wed Mar 22 16:47:36 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:47:37 2006 : Info: Ready to process requests. Could someone advise how to go about debugging this problem? Thanks Ben Thompson

3 5

RE: Still having issue with radtest
by Atkins, Dwane P 27 Mar '06

27 Mar '06

I apologize for not using proper terms since this is new to me, I tend to associate to something I do know. 1.) Since I attempting to use the sql database for authentication purpose, would it be best if I made sure that radius@localhost (my username I chose) be in the users file and also be granted privileges on the sql database (I chose to call it radius as well) 2.) When doing the radtest, would the proper syntax be radtest radius radiustest localhost 1645 baseball (with baseball being the shared secret also entered into the clients.conf file) or should there be quotes around the shared secret. My apologies for calling it a preshare key. This is an IPSec term that I have used for a few years. 3.) I have read documentation. I have bought the O'Reilly Book and read it. I have reinstalled my server and all to no avail. I appreciate the help you all give, but I am stuck. I am sure I overlooked the issue, but at this point, I cannot see it. Thanks again. Dwane ________________________________ From: Atkins, Dwane P Sent: Sat 3/25/2006 11:34 AM To: freeradius-users(a)lists.freeradius.org Subject: Still having issue with radtest A couple questions I have not asked about this issue? Do both the user@localhost and localhost need access to the Sql database. I am at a loss as to why everytime I run this process, it tells me that I have an invalid preshare key. Do they preshare keys need to be in quotes. If I have a user called radius with a password of radiustest and my localhost preshare is BASEBALL, then would my syntax be, radtest radius radiustest localhost 1645 BASEBALL ? Or woudl I need to put quotes around the alpha characters. I cannot move on until I get this resolved obviously and I am not sure where to try. I can get issues resolved with the SQL portion, but to get it to see the local host, I am at a loss. If anyone can think of anything else I can possibly try, please let me know. If not, I appreciate all your efforts. Dwane

3 2

RE: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available?
by Jonathan De Graeve 27 Mar '06

27 Mar '06

Uh, huntgroups? J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens John > Mylchreest > Verzonden: maandag 27 maart 2006 15:00 > Aan: FreeRadius users mailing list > Onderwerp: RE: Different user attributes based on NAS-IP-Address? > AlsoSuffixwildcards available? > > Funnily enough, I asked the very same thing recently. We do it quite > crudely at the moment, but it works. > > We add an nshortname field to radreply/anything else necessary, and in > sql.conf we link it to the user reply. Ie: > > Something like this would work: > > authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op > FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = > %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR > radreply.nshortname is NULL) ORDER BY id" > > If you find any cleaner solution using the default schema, I would LOVE to > hear about it, since that's the problem/task I'm currently facing. > > -----Original Message----- > From: freeradius-users- > bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius- > users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org] On Behalf Of > Andy Coates > Sent: 27 March 2006 13:35 > To: freeradius-users(a)lists.freeradius.org > Subject: Different user attributes based on NAS-IP-Address? Also > Suffixwildcards available? > > > Hey, > > Is this even possible? > > The basic problem is that I have 2 devices that will use the same > username. > For example, one device handles dialup, one handles DSL. I'd like the > user > to have the same username, and depending on the NAS sending the request > the > correct IP/Netmask would be returned. > > I've setup huntgroups for the NAS, and can match them in various setups in > the users file - but this only seems like it would work for group based > attributes (i.e. common fields). Returning unique fields for each user > based on the NAS-IP-Address doesn't seem possible? > > That aside, does anyone know if its possible to use wildcards with Suffix > when stripping usernames? I've tried "@*" or "@*.domain.com" and it > doesn't > seem to match :( > > Thanks in advance, > Andy. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Communications on or through ioko's computer systems may be monitored or > recorded to secure effective system operation and for other lawful > purposes. > > Unless otherwise agreed expressly in writing, this communication is to be > treated as confidential and the information in it may not be used or > disclosed except for the purpose for which it has been sent. If you have > reason to believe that you are not the intended recipient of this > communication, please contact the sender immediately. No employee is > authorised to conclude any binding agreement on behalf of ioko with > another party by e-mail without prior express written confirmation. > > ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Different user attributes based on NAS-IP-Address? Also Suffix wildcards available?
by Andy Coates 27 Mar '06

27 Mar '06

Hey, Is this even possible? The basic problem is that I have 2 devices that will use the same username. For example, one device handles dialup, one handles DSL. I'd like the user to have the same username, and depending on the NAS sending the request the correct IP/Netmask would be returned. I've setup huntgroups for the NAS, and can match them in various setups in the users file - but this only seems like it would work for group based attributes (i.e. common fields). Returning unique fields for each user based on the NAS-IP-Address doesn't seem possible? That aside, does anyone know if its possible to use wildcards with Suffix when stripping usernames? I've tried "@*" or "@*.domain.com" and it doesn't seem to match :( Thanks in advance, Andy.

2 1

RE: Version 1.1.1 stops responding
by King, Michael 27 Mar '06

27 Mar '06

Mine seg faulted as well.. (This time I didn't overwrite the log) rad2:/home/mking# /usr/sbin/freeradius -X -A >crash.log Segmentation fault rad2:/home/mking# I don't believe running /usr/sbin/freeradius -X -A is capturing anything useful. Is there something else I can do? Here's the last few lines of the freeradius -X -A rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.0.1.32/auth-detail-20060324 modcall[authorize]: module "auth_log" returns ok for request 1002 modcall[authorize]: module "chap" returns noop for request 1002 modcall[authorize]: module "mschap" returns noop for request 1002 rlm_realm: No '@' in User-Name = "BSC\ddelutis", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1002 rlm_eap: EAP packet type response id 28 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1002 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1002 modcall: leaving group authorize (returns updated) for request 1002 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1002 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11

3 2

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 27 Mar '06

27 Mar '06

> > Since you seem to know something about this, can you either: > > > > A) Explain what the "extended key oid nonsense" is? > > B) Point me to some place I can read about it? > > http://www.freeradius.org/doc/ > > See the EAP-TLS stuff. > > Microsoft requires magic stuff in the server certificate, otherwise > the windows supplicants silently stop talking to the AP. Ok, I read the document, but I still do not understand something... I am proxying the packets from the Cisco through the FreeRADIUS server to the IAS server. EAP messages are exchanged between the supplicant and the IAS server; the Cisco AP and FreeRADIUS server do not touch them, correct? They just do RADIUS stuff and encapsulate the EAP messages, right? And, if that is the case, then the IAS server and the supplicant are doing all the TLS stuff. The IAS server obviously supports those OID extensions. So, shouldn't the supplicant work properly? I mean, we are not creating a TLS tunnel from the supplicant to the FreeRADIUS server and another from the FreeRADIUS server to the IAS server -- it should be from the supplicant to the IAS server, encapsulated in RADIUS, proxied through the FreeRADIUS server. And, in that kind of setup, the FreeRADIUS server should not be causing any problems, correct?

2 1

Sqlcounter - Data Download limiting
by Jaco van Tonder 27 Mar '06

27 Mar '06

I would like to use sqlcounter to limit the max number of bytes a user can download via a NAS. My NAS supports this, but I need sqlcounter to return a different attribute (eg. RecvLimit) and not Session-Timeout. I have also seen that this is possible with the counter module but not with sqlcounter Has anyone done this before / or have a patch for the sqlcounter module to enable this Jaco van Tonder

1 0

Zombie accounting processes
by George-Cristian Bîrzan 27 Mar '06

27 Mar '06

Hello! I've been having a rather annoying problem with FreeRADIUS, including version 1.1.0. I've set up authentication and accounting via a Perl script. -- George-Cristian Bîrzan Network Engineer _______________________________________ RCS & RDS Constanta Tel.: +40341.400.401 / +40341.400.402 Fax: +40341.400.450 http://www.rcs-rds.ro _______________________________________ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

4 10

RE: Different user attributes based on NAS-IP-Address? Also Suffixwildcards available?
by John Mylchreest 27 Mar '06

27 Mar '06

Funnily enough, I asked the very same thing recently. We do it quite crudely at the moment, but it works. We add an nshortname field to radreply/anything else necessary, and in sql.conf we link it to the user reply. Ie: Something like this would work: authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR radreply.nshortname is NULL) ORDER BY id" If you find any cleaner solution using the default schema, I would LOVE to hear about it, since that’s the problem/task I'm currently facing. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Andy Coates Sent: 27 March 2006 13:35 To: freeradius-users(a)lists.freeradius.org Subject: Different user attributes based on NAS-IP-Address? Also Suffixwildcards available? Hey, Is this even possible? The basic problem is that I have 2 devices that will use the same username. For example, one device handles dialup, one handles DSL. I'd like the user to have the same username, and depending on the NAS sending the request the correct IP/Netmask would be returned. I've setup huntgroups for the NAS, and can match them in various setups in the users file - but this only seems like it would work for group based attributes (i.e. common fields). Returning unique fields for each user based on the NAS-IP-Address doesn't seem possible? That aside, does anyone know if its possible to use wildcards with Suffix when stripping usernames? I've tried "@*" or "@*.domain.com" and it doesn't seem to match :( Thanks in advance, Andy. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0