- Freeradius-Users - lists.freeradius.org

Problem returning attributes to Bluesocket
by David L Wolford 23 Feb '06

23 Feb '06

Hi, I am trying to set a wireless network where a client will use a Bluesocket gateway in conjunction with Freeradius to perform authentication. I want the radius server to authenticate a user in LDAP and return certain attributes to the Bluesocket gateway so that the gateway can place the user in a role based on those attributes. A sniffer trace of the attempted authentication reveals that the Freeradius does request the attributes that I am interested in (x121address and edupersonprimaryaffiliation) and does receive the values back from LDAP. My problem is that these values are not then passed on to the Bluesocket gateway. What am I missing? Output from debug mode follows: rad_recv: Access-Request packet from host A.B.C.D:32801, id=140, length=145 User-Name = "someuser" User-Password = "somepwd" NAS-IP-Address = A.B.C.D Service-Type = Login-User Framed-IP-Address = W.X.Y.Z Called-Station-Id = "00:90:0B:02:DF:24" Calling-Station-Id = "" NAS-Identifier = "wg1.wireless.uab.edu" Acct-Session-Id = "00:90:0B:02:DF:24:1140706217" NAS-Port-Type = Wireless-802.11 rlm_ldap: - authorize rlm_ldap: performing user authorization for someuser rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to myldap.com:389, authentication 0 rlm_ldap: bind as / to myldap.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: Adding edupersonprimaryaffiliation as edupersonprimaryaffiliation, value staff & op=21 rlm_ldap: Adding x121address as radiusx121address, value wifi & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user someuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "someuser" with password "somepwd" rlm_ldap: user DN: uid=someuser, ou=people, dc=uab, dc=edu rlm_ldap: (re)connect to myldap.com:389, authentication 1 rlm_ldap: bind as uid=someuser, ou=people, dc=uab, dc=edu/somepwd to ldap.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user someuser authenticated succesfully Sending Access-Accept of id 140 to A.B.C.D:32801 Portion of ldap.attrmap follows: checkItem radiusx121address x121address checkItem edupersonprimaryaffiliation edupersonprimaryaffiliation replyItem x121address radiusx121address LDAP portion of radiusd.conf follows: ldap { server = myldap.com # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = dc=uab,dc=edu filter = "(uid=%u)" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Thanks, dwolford

2 1

Duplicate entries and incorrect accounting and authorization
by bdab＠hushmail.com 23 Feb '06

23 Feb '06

I was using freeradius 1.05 with MYSQL 4.0 without any problems. I've upgraded the OS in my server (freebsd 5.1 to 6.0), upgraded to freeradius 1.10 and MySQL 4.1, copied the previous working raddb directory, initially preserving the same configuration files and I couldn't get things working back again. Basically I've got duplicate entries in radpostauth, no entries in radacct and the NAS does not recognize the successful authentication even though from the radius server point of view it seems to get authentication right. I've read the FAQ (my server has a single NIC), docs in the release (before, I was using the sqlcounter module but now I've decided to remove it since radiusd.conf already has the dailycounter and monthlycounter functionality that I needed) but still I can not get it right. Here's the relevant info: ............................................ root@rds# /usr/local/sbin/radiusd -X -y Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = YYY.YYY.YYY.YYY IP address [YYY.YYY.YYY.YYY] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/auth- detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "password" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = yes sql: sqltracefile = "/var/log/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL- User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL- User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,rad groupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,rad groupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate- Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP- Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input- Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP- Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay- Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station- Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed- Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct- Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User- Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL- User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS- Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station- Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed- Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL- User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap- Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- _: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded SQL Counter sqlcounter: counter-name = "Daily-Session-Time" sqlcounter: check-name = "Max-Daily-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "daily" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- _: /" rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1830 rlm_sqlcounter: Check attribute Max-Daily-Session is number 1831 rlm_sqlcounter: Current Time: 1140529038 [2006-02-21 10:37:18], Next reset 1140577200 [2006-02-22 00:00:00] rlm_sqlcounter: Current Time: 1140529038 [2006-02-21 10:37:18], Prev reset 1140490800 [2006-02-21 00:00:00] Module: Instantiated sqlcounter (dailycounter) sqlcounter: counter-name = "Monthly-Session-Time" sqlcounter: check-name = "Max-Monthly-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "monthly" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- _: /" rlm_sqlcounter: Counter attribute Monthly-Session-Time is number 1832 rlm_sqlcounter: Check attribute Max-Monthly-Session is number 1833 rlm_sqlcounter: Current Time: 1140529038 [2006-02-21 10:37:18], Next reset 1141182000 [2006-03-01 00:00:00] rlm_sqlcounter: Current Time: 1140529038 [2006-02-21 10:37:18], Prev reset 1138762800 [2006-02-01 00:00:00] Module: Instantiated sqlcounter (monthlycounter) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail- %Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication YYY.YYY.YYY.YYY:1812 Listening on accounting YYY.YYY.YYY.YYY:1813 Ready to process requests. rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 User-Name = "test0001" CHAP-Challenge = 0xbb9b786a9857418d627cec741434bf5a CHAP-Password = 0x00e71611e921e4fd929f9bcdd5aeff2172 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-04-23-63-0F-A7" Called-Station-Id = "00-13-46-70-3E-CF" NAS-Identifier = "mynas" Acct-Session-Id = "43fb0eac00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xda8261dfb84b5ea5f4ff88c67780d76d WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radacct/XXX.XXX.XXX.XXX/auth-detail- 20060221' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail- %Y%m%d expands to /var/log/radacct/XXX.XXX.XXX.XXX/auth-detail- 20060221 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test0001", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test0001' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test0001' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,rad groupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,rad groupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test0001' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test0001' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,rad groupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,rad groupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' rlm_sql (sql): - sql_xlat radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' radius_xlat: '/var/log/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800' rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user test0001, check_item=54000, counter=0 rlm_sqlcounter: Sent Reply-Item for user test0001, Type=Session- Timeout, value=102112 modcall[authorize]: module "dailycounter" returns ok for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' rlm_sql (sql): - sql_xlat radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' radius_xlat: '/var/log/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800' rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 2 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user test0001, check_item=54000, counter=0 rlm_sqlcounter: Sent Reply-Item for user test0001, Type=Session- Timeout, value=54000 modcall[authorize]: module "monthlycounter" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [test0001] (from client mynas port 0 cli 00-04-23-63-0F- A7) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test0001', 'Chap-Password', 'Access-Accept', NOW())' radius_xlat: '/var/log/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test0001', 'Chap- Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test0001', 'Chap-Password', 'Access- Accept', NOW()) rlm_sql (sql): Released sql socket id: 1 modcall[post-auth]: module "sql" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 Session-Timeout = 54000 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 Sending duplicate reply to client mynas:32770 - ID: 0 Re-sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 Sending duplicate reply to client mynas:32770 - ID: 0 Re-sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 Sending duplicate reply to client mynas:32770 - ID: 0 Re-sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 43fb17c0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 User-Name = "test0001" CHAP-Challenge = 0xbb9b786a9857418d627cec741434bf5a CHAP-Password = 0x00e71611e921e4fd929f9bcdd5aeff2172 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-04-23-63-0F-A7" Called-Station-Id = "00-13-46-70-3E-CF" NAS-Identifier = "mynas" Acct-Session-Id = "43fb0eac00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xda8261dfb84b5ea5f4ff88c67780d76d WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radacct/XXX.XXX.XXX.XXX/auth-detail- 20060221' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail- %Y%m%d expands to /var/log/radacct/XXX.XXX.XXX.XXX/auth-detail- 20060221 modcall[authorize]: module "auth_log" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test0001", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test0001' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test0001' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,rad groupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,rad groupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test0001' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test0001' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,rad groupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,rad groupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test0001' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 1 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' rlm_sql (sql): - sql_xlat radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800'' radius_xlat: '/var/log/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT SUM(AcctSessionTime - GREATEST((1140490800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1140490800' rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 4 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user test0001, check_item=54000, counter=0 rlm_sqlcounter: Sent Reply-Item for user test0001, Type=Session- Timeout, value=102106 modcall[authorize]: module "dailycounter" returns ok for request 1 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' rlm_sql (sql): - sql_xlat radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800'' radius_xlat: '/var/log/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctSessionTime - GREATEST((1138762800 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='test0001' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1138762800' rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user test0001, check_item=54000, counter=0 rlm_sqlcounter: Sent Reply-Item for user test0001, Type=Session- Timeout, value=54000 modcall[authorize]: module "monthlycounter" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [test0001] (from client mynas port 0 cli 00-04-23-63-0F- A7) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test0001' rlm_sql (sql): sql_set_user escaped user --> 'test0001' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test0001', 'Chap-Password', 'Access-Accept', NOW())' radius_xlat: '/var/log/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test0001', 'Chap- Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'test0001', 'Chap-Password', 'Access- Accept', NOW()) rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 1 modcall: leaving group post-auth (returns ok) for request 1 Sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 Session-Timeout = 54000 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 Sending duplicate reply to client mynas:32770 - ID: 0 Re-sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:32770, id=0, length=216 Sending duplicate reply to client mynas:32770 - ID: 0 Re-sending Access-Accept of id 0 to XXX.XXX.XXX.XXX port 32770 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 43fb17c6 Nothing to do. Sleeping until we see a request. .................................................. Entries in radius DB: mysql> SELECT * FROM radcheck; +-----+----------+---------------------+----+-------+ | id | UserName | Attribute | op | Value | +-----+----------+---------------------+----+-------+ | 459 | test0001 | Password | == | 0001 | | 461 | test0001 | Max-Monthly-Session | := | 54000 | | 463 | test0001 | Max-Daily-Session | := | 54000 | +-----+----------+---------------------+----+-------+ 3 rows in set (0.00 sec) mysql> SELECT * FROM radpostauth; +----+----------+---------------+---------------+------------------- --+ | id | user | pass | reply | date | +----+----------+---------------+---------------+------------------- --+ | 35 | test0001 | Chap-Password | Access-Accept | 2006-02-21 10:12:12 | | 36 | test0001 | Chap-Password | Access-Accept | 2006-02-21 10:12:18 | +----+----------+---------------+---------------+------------------- --+ 2 rows in set (0.00 sec) mysql> SELECT * FROM usergroup; +-----+----------+-----------+ | id | UserName | GroupName | +-----+----------+-----------+ | 115 | test0001 | dynamic | +-----+----------+-----------+ 1 row in set (0.00 sec) ................................................... this is my radiusd.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = YYY.YYY.YYY.YYY port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail- %Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { expr } authorize { preprocess auth_log chap mschap suffix sql dailycounter monthlycounter } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql } session { radutmp } post-auth { sql } pre-proxy { } post-proxy { } ............................................ Any help would be most appreciated. thanks! Bill Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485

2 1

NTLM
by Gilmour, Scott 23 Feb '06

23 Feb '06

I read that you need to setup ntlm_auth to get Machine Authentication to work with Active Directory. How do I properly set up ntlm_auth to do this? Thanks, Scott Gilmour Software Engineer ENET, & ENSRT Enterasys Networks Phone: 978-684-1236 Email:sgilmour@enterasys.com <mailto:sgilmour@enterasys.com> www: http://www.enterasys.com <http://www.enterasys.com>

5 12

limit the RADIUS threads
by DilipSimha.N.M 23 Feb '06

23 Feb '06

hi, i would like to have 2-3 instances of FREERADIUS running on my system. so is there any method to limit the number of threads(2-3) that start when FREERADIUS is started??? --DilipSimha

2 1

how to configure my scenario
by Peter Manckok 23 Feb '06

23 Feb '06

Hy all, I am not sure how to configure my scenario. I explain it to you: We have 3 LDAP servers running. We authenticate against one or other depending the type of access (GPRS, Callback...). I am going to create three instances of the ldap module. But I dont know how and where to say which is the instance to use for the authorization and authentication in each case. For example, if I have a GPRS access I would like to authenticate against my first LDAP server (instance ldap1). How can I say to the FreeRadius server to use the authenticate method of the l1 instance? Thanks Regards, Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

6 10

users authorization
by ???????, ?? ???????? 23 Feb '06

23 Feb '06

I've got several questions on freeradius. My task is to send reject to users whose usernames can be found in the data base. Now, as far as I understand, sql-module supposes authorization for users, who are included in the data base. That is to say, it works vice versa (sends accept if the user is included in the data base). Could you, please, help me with implementation of my variant of authorization? PS: Earlier I was using xtradius and running-up perl-script, which was sending request to the base. But, unfortunately, it's ineffective, because a permanent connection to mysql is necessary. That's why I decided to deal with freeradius. ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

1 0

SV: SV: Any Trusted CA problem
by Torkel Mathisen 23 Feb '06

23 Feb '06

Alan DeKok wrote: > "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > > I don't use client certificates I think. Atleast I haven't installed any > > certificates on my clients. > > It looks like the client is sending one. > > > So how can I fix that? Just delete the client certificate from the > > radius server ? > > No, delete it from the client. I'm sorry, but I don't understand why this is the client certificate. The problem is that on my clients I have to uncheck the "Validate server certificate" option. Only when i uncheck that, the authentication with radius works. And the problem is that some drivers don't let you do that. Even if its set to "Any trusted CA" it doesn't work. There is a picture of that option here: (even though this is for EAP-TLS, which I'm not using): http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html (search for "Validate server certificate") Regards, Torkel

1 0

Help needed with MS-CHAP
by Charles Blake 23 Feb '06

23 Feb '06

Dear friends: I am trying to set up a freeradius-1.1.0 server for authenticating users using MS-CHAP passwords. I pretend to authenticate users against shadow. I am using the default radius.conf and users files. I have included the microsoft dictionary in radiusclient.conf file. radtest shows ok: # radtest mts mypassowrd localhost 0 testing123 Sending Access-Request of id 160 to 127.0.0.1 port 1812 User-Name = "mts" User-Password = "rfhs1229" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=160, length=20 But when I try to authenticate an user using MS-CHAP, I am getting this output: rad_recv: Access-Request packet from host 127.0.0.1:1027, id=5, length=146 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "mts" MS-CHAP-Challenge = 0x6b61b1ed954a289c0fa3aebedc329ac6 MS-CHAP2-Response = 0x8f0001684e1d34295e1232edb0682bd04e6e00000000000000002caaa9579823e00501812d3e2dce9225b7dd251c02e1fd89 Calling-Station-Id = "172.16.255.11" NAS-IP-Address = 192.168.181.254 NAS-Port = 0 Wed Feb 22 20:47:07 2006 : Debug: Processing the authorize section of radiusd.conf Wed Feb 22 20:47:07 2006 : Debug: modcall: entering group authorize for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "mschap" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_realm: No '@' in User-Name = "mts", looking up realm NULL Wed Feb 22 20:47:07 2006 : Debug: rlm_realm: No such realm "NULL" Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 152 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 171 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 183 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall: leaving group authorize (returns ok) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rad_check_password: Found Auth-Type MS-CHAP Wed Feb 22 20:47:07 2006 : Debug: auth: type "MS-CHAP" Wed Feb 22 20:47:07 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Feb 22 20:47:07 2006 : Debug: modcall: entering group MS-CHAP for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: Told to do MS-CHAPv2 for mts with NT-Password Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Wed Feb 22 20:47:07 2006 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authenticate]: module "mschap" returns reject for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall: leaving group MS-CHAP (returns reject) for request 0 Wed Feb 22 20:47:07 2006 : Debug: auth: Failed to validate the user. Wed Feb 22 20:47:07 2006 : Debug: Delaying request 0 for 1 seconds Wed Feb 22 20:47:07 2006 : Debug: Finished request 0 Wed Feb 22 20:47:07 2006 : Debug: Going to the next request Wed Feb 22 20:47:07 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:07 2006 : Debug: Waking up in 1 seconds... Wed Feb 22 20:47:08 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:08 2006 : Debug: Waking up in 1 seconds... Wed Feb 22 20:47:09 2006 : Debug: --- Walking the entire request list --- Sending Access-Reject of id 5 to 127.0.0.1 port 1027 Wed Feb 22 20:47:09 2006 : Debug: Waking up in 4 seconds... Wed Feb 22 20:47:13 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:13 2006 : Debug: Cleaning up request 0 ID 5 with timestamp 43fd141b Wed Feb 22 20:47:13 2006 : Debug: Nothing to do. Sleeping until we see a request. What I am doing wrong? Thank you for your help, Charles

1 0

CA.all Execution Error!
by 艳华杨 23 Feb '06

23 Feb '06

Hi, everyone I installed FreeRADIUS and OpenSSL on my computer, then I want to create self-signed certificates using scripts CA.all in freeradius source package, but I got error like: Using Configuration from /usr/local/openssl/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 1653: error :02001002: system library: fopen: No such file or directory: bss_file.c:352:fopen ('./demoCA/serial', 'r') 1653: error: 20074002: BIO routines: FILE_CTRL:system lib: bss_file.c: 354: + openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out cert-srv.p12 -clcerts -passin pass: whatever -passout pass: whatever No certificate matches private key + openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin pass: whatever -passout pass: whatever 1655: error: 0D07207B: asn1 encoding routines: ASN1_get_object:header too long: asn1_lib.c: 150: +openssl x509 -inform PEM -outform DER -in cert-srv.pem -out cert-srv.der unable to load certificate 1656:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting:TRUSTED CERTIFICATE So what's the problem? Is the CA.all self error? Anyone could help me? Thanks!! Helen --------------------------------- 雅虎1G免费邮箱百分百防垃圾信雅虎助手-搜索、杀毒、防骚扰

1 0

Cisco EAP/TLS not working
by Robert Myers 22 Feb '06

22 Feb '06

I'm having a problem with my Cisco 2950 and EAP/TLS...I've already configured this to work on my HP 5300, so I'd assume that everything on the freeradius end is proper... However I am receiving this from the debug log: rad_recv: Access-Request packet from host 192.168.2.161:1812, id=9, length=116 NAS-IP-Address = 192.168.2.161 NAS-Port = 50012 NAS-Port-Type = Ethernet User-Name = "client" Called-Station-Id = "00-09-7C-3E-92-0C" Calling-Station-Id = "00-11-11-64-A1-E6" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x Message-Authenticator = 0x21afff7782222d4fa2ead6e802a75517 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: Got EAP_START message modcall[authorize]: module "eap" returns handled for request 0 modcall: group authorize returns handled for request 0 Sending Access-Challenge of id 9 to 192.168.2.161:1812 EAP-Message = 0x0101000501 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 9 with timestamp 43fc4990 Nothing to do. Sleeping until we see a request. Then this from the switch: 000043: *Mar 1 01:16:24: %DOT1X-5-ERR_INVALID_AAA_ATTR: Got invalid AAA attribute settings from RADIUS server My question is, for anyone who has set this up, what must I do in the Cisco world to make this work? -Bob

2 1