- Freeradius-Users - lists.freeradius.org

Proxim AP-700 AcctUniqueId
by Uwe Driessen 29 Jul '05

29 Jul '05

Hello i have a Problem with the Proxim AP700 to get a Unique Session ID or AcctUniqueId There only MAC Authentication. Has anyone Experience with the AP-700. To avoidance that more than one record for a session in the radacct-table i have made Username and AcctUniqueID Unique. The Problem is that the AP-700 deliver only this Information : As rad_recv: Access-Request packet from host 192.168.0.232:6001, id=9, length=125 User-Name = "001195-0942e8" User-Password = "secret" NAS-IP-Address = 192.168.0.232 Called-Station-Id = "00-20-a6-56-38-ff:wireless-people-AP002" Calling-Station-Id = "00-11-95-09-42-e8" NAS-Port = 0 Processing the authorize section of radiusd.conf There missing the Framed-IP-Adress and the Acctsession-ID is the MAC from the Calling Station with this Information the Unique session Id is alway for this User the same and after a separation the Radius write in the same record. So i get 1 record per User and Month but only for the latest session. I hope you can help me. Sorry for this long posting and my english As Start from the AP comes User-Name = "000f3d-47ba87" Acct-Session-Id = "000f3d-47ba87" NAS-Identifier = "Wireless-People-AP001" NAS-IP-Address = 192.168.0.231 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Acct-Authentic = RADIUS Acct-Status-Type = Start Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Session-Time = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = 0 Acct-Delay-Time = 0 As Alive comes User-Name = "001195-0a21d8" Acct-Session-Id = "001195-0a21d8" NAS-Identifier = "Wireless-People-AP001" NAS-IP-Address = 192.168.0.231 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Acct-Authentic = RADIUS Acct-Status-Type = Alive Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Session-Time = 608 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = 999 Acct-Delay-Time = 0 With this Information the freeradius don't create a UniqueSessionId, so i think i make the unique by mysql with this statement: accounting_start_query = "select @sesid := MD5(Concat(count(*),'%{Calling-Station-Id}', '%{NAS-IP-Address}',now())) FROM ${acct_table1};INSERT into ${acct_table1}(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime,AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId,CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', @sesid, '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" In MySQL the Statement with filled values is write a correct record, from FreeRadius i get fail, the same Statement in MySQL brings OK and the data insert in the Table. I not see what is wrong rlm_sql (sql): sql_set_user escaped user --> '001195-0942e8' radius_xlat: 'select @sesid := MD5(Concat(count(*),'', '192.168.0.232',now())) FROM radacct;INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime,AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('001195-0942e8', @sesid, '001195-0942e8', '', '192.168.0.232', '2', 'Wireless-802.11', '2005-07-26 02:03:20', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '0', '0')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 5 rlm_sql_mysql: query: select @sesid := MD5(Concat(count(*),'', '192.168.0.232',now())) FROM radacct;INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime,AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('001195-0942e8', @sesid, '001195-0942e8', '', '192.168.0.232', '2', 'Wireless-802.11', '2005-07-26 02:03:20', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '0', '0') rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): Couldn't insert SQL accounting START record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ';INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Rea radius_xlat: 'select @sesid := AcctUniqueId, @matime :=max(AcctStartTime) from radacct Where UserName = '001195-0942e8' and AcctStopTime ='0' group by UserName;UPDATE radacct SET AcctStartTime = '2005-07-26 02:03:20', AcctStartDelay = '0', ConnectInfo_start = '' WHERE AcctUniqueId = @sesid AND UserName = '001195-0942e8' AND NASIPAddress = '192.168.0.232'' To filter what is the correct record for this user i made this statement. It is testet with MySQL and OK and the same problem when it comes from radius. accounting_update_query = "select @sesid := AcctUniqueId, @matime :=max(AcctStartTime) from ${acct_table1} Where UserName = '%{SQL-User-Name}' and `AcctStopTime` ='0' group by UserName;UPDATE ${acct_table1} SET FramedIPAddress = '%{Framed-IP-Address}',lastupd = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" Mit freundlichen Grüßen Drießen Es liegt was in der Luft www.feilbingert.net Uwe Drießen Software & Computer

2 3

Problems with Simultaneous-Use
by jck-freeradius＠southwestern.edu 29 Jul '05

29 Jul '05

Hello, I am having problems with Simultaneous-Use and checkrad. I know that checkrad is not running because: grep debug /usr/local/sbin/checkrad # Config: $debug is the file you want to put debug messages in #$debug = ""; $debug = "$logdir/checkrad.log"; and: -- tail -F /var/log/radius/checkrad.log Fri Jul 29 12:57:30 2005 checkrad Usage: checkrad nas_type nas_ip nas_port login session_id -- (nothing new is showing up in the checkrad log file, except for when I run it by hand) I have both the Perl SNMP modules installed, along with NET-SNMP (and the correct syntax for NET used in the checkrad script, even though it should be using the perl modules first). I am able to manually use snmpwalk /fine/. Here is how my SQL table looks: mysql> select * from radgroupcheck; +----+------------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+------------+------------------+----+-------+ | 1 | pirate | Simultaneous-Use | := | 2 | | 2 | pirate-stu | Simultaneous-Use | := | 2 | | 3 | pirate-stf | Simultaneous-Use | := | 2 | | 4 | pirate-fac | Simultaneous-Use | := | 2 | | 5 | pirate-its | Simultaneous-Use | := | 1 | +----+------------+------------------+----+-------+ Here are the related sections from my radiusd.conf file: radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 # callerid = "yes" } # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } And here is my sql.conf file: # Simultaneous Use Checking Queries ####################################################################### # simul_count_query - query for the number of current connections # - If this is not defined, no simultaneouls use checking # - will be performed by this module instance # simul_verify_query - query to return details of current connections for verification # - Leave blank or commented out to disable verification step # - Note that the returned field order should not be changed. ####################################################################### # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Here is how my radacct table looks: mysql> select * from radacct order by RadAcctId desc limit 1; +-----------+---------------+------------------+----------+-------+---------------+-----------+-----------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+ | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | +-----------+---------------+------------------+----------+-------+---------------+-----------+-----------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+ | 281 | 0000019F | c91763dbcdfe02cb | johnk | | 192.168.0.49 | 558 | Wireless-802.11 | 2005-07-29 15:03:06 | 0000-00-00 00:00:00 | 0 | RADIUS | | | 0 | 0 | 0014.691e.e9c0 | 000e.35b5.eb8f | | Framed-User | | | 0 | 0 | +-----------+---------------+------------------+----------+-------+---------------+-----------+-----------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------- hecate:/etc/raddb # tail naspasswd # WARNING: Always make sure that this file has the "-r------" permission. # And, don't set the passwords on your other systems to the same # passwords that can be found below. # # #203.172.90.118 !root TufFseCrET #203.172.42.152 !root ToTaLCnTl 192.168.0.49 hecate:/etc/raddb # grep 192.168 -A 3 clients.conf client 192.168.0.49 { secret = xXxXxXxX shortname = Aironet1100-johnk nastype = cisco The proper accounting configuration lines have been included in my Cisco AP conf. My username is part of the pirate-its group; 1 connection allowed. What I find interesting is that if I connect once: radwho Login Name What TTY When From Location johnk John Koen shell S534 Fri 14:57 192.168.0 ...then if I open a second connection (from another machine, at the same time as the first connection): radwho Login Name What TTY When From Location johnk John Koen shell S535 Fri 14:58 192.168.0 Notice that radutmp seems to forget about the first connection, and only remember the newest (connection number 2) connection. On this 2nd connection attempt I should be Rejected instead of Accepted. I see nothing in the checkrad log of checkrad running. What else can I try? --johnk

1 0

Limiting the number of connections
by Jose Divino de Lima 29 Jul '05

29 Jul '05

Hi people, I need your help. We´ve a solution that use SER athenticating, athotizing and accounting in a freeRadius+mySQL. I´ve a challenge now to limit thu number of simultaneous connections (i.e: we can permit only ten connections at the same time). Does anybody has any idea to implement this in freeRadius+mySQL ? I imagine that i need to change the sql queries in sql.conf, but i´m not sure.. Any ideas ? Tks, Lima

2 1

Freeradius + AP + Access Point Client
by ManyX 29 Jul '05

29 Jul '05

How can I authenticate my access point CLIENT to AP in freeradius ?? In my network I have EAP/TLS authenticate and everything go well when I authenticate users with windows xp and WLAN cart, but one of my user have a access point client and this is a problem becouse I dont now how can I configure my freeradius. I need tell my access point that this access point client is authenticate to let in. The best soluton will be check ip and mac of access point client. how can I do that?? thank a lot many(a)poczta.fm

2 3

RE: adding user-name to post-proxy logs
by Tariq Rashid 29 Jul '05

29 Jul '05

Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > since the state must be maintained in the freeradius proxy - is it possible > to add it to the logs so that troubleshooting is easier? currently i have to > match the timestamps. Which log are you talking about? Alan DeKok. --- those that are at $PREFIX/var/log/radius/radacct/1.2.3.4/post-proxy-detail-20050729 and $PREFIX/var/log/radius/radacct/1.2.3.4/pre-proxy-detail-20050729 for example - written by the following directgives in radiusd.conf : # This module logs packets proxied to a home server. # # You will also need to un-comment the 'pre_proxy_log' line # in the 'pre-proxy' section, below. # detail pre_proxy_log { detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } # # This module logs response packets from a home server. # # You will also need to un-comment the 'post_proxy_log' line # in the 'post-proxy' section, below. # detail post_proxy_log { detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 }

2 1

Re: Authentication Responses during error conditions
by Doug Hardie 29 Jul '05

29 Jul '05

I am a bit confused now. I understood that if a module returns RLM_MODULE_FAIL that radiusd would not return an authorization reject. However, it appears that it still does. rad_recv: Access-Request packet from host 127.0.0.1:53579, id=193, length=71 User-Name = "visitor" User-Password = "asdfjkle" Called-Station-Id = "8053342021" Calling-Station-Id = "3232546586" rad_lowerpair: User-Name now 'visitor' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 59 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry visitor at line 51 modcall[authorize]: module "files" returns ok for request 0 rlm_lafn: Found USER_NAME rlm_lafn: Found NAS rlm_lafn: Found Calling ID rlm_lafn: Found Called ID rlm_lafn: Found Hint get_time returns 60 Unable to connect to 0: Can't connect to MSQL server on 0 modcall[authorize]: module "lafn" returns fail for request 0 modcall: group authorize returns fail for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 193 to 127.0.0.1:53579 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 193 with timestamp 42e96be9 Nothing to do. Sleeping until we see a request. zool# ./visitor Received response ID 193, code 3, length = 20 From radiusd.conf: # Authorization. First preprocess (hints and huntgroups files), authorize { preprocess files lafn }

3 5

Simultaneous-Use Problem
by Jeremy Kenney 29 Jul '05

29 Jul '05

I have posted this twice now I was wondering if someone would be kind enough to possibly answer it Hello, I am a very frustrated free radius user at this point. Its most likely my brain not working right but here is my problem I have a free radius server that does authentication for our slipstream accelerator. The accelerator passes an attribute to the radius server and identifies the client into a group. This works fine. How ever I am having problems else where we currently want to use the same radius server to do dialup authentication. It currently is working to do this. We use freeradius with mysql. I am having problems with users dialing into the system more then once from more then one location at the sometime. I.E a simultaneous use problem. I cannot check against the NAS because we dont have our own nases and are doing pass-thru radius authentication. I need to do some kind of simultaneous use checking Im really frustrated can someone point me in the right direction.

3 3

EAP-TTLS and PAP inner tunnel authentication
by lists.mailing＠surasoft.com 29 Jul '05

29 Jul '05

Hi, >From a suggestion on the mailing list I plan on using EAP-TTLS and PAP inner tunnel authentication. The reason I'm going this route is because I want to authenticate against linux user accounts and the password is encrypted in /etc/shadow so the ms-chap route is no good since it can't work with encrypted passwords. How do I configure free radius to work with EAP-TTLS and PAP inner tunnel authentication, I wasn't able to find much on the net. I'm quite a fast learner however. Are there any sample config files for what I'm after? Setting up the clients seems easy from here. http://vuksan.com/linux/dot1x/wpa-client-config.html Sura

2 1

ICRadius to FreeRadius Migration
by Karma Foxx 29 Jul '05

29 Jul '05

Hello all. I've been put in a situation in which I am forced to replace our old icradius server. Upon finding support and development for icradius has been discontinued for quite some time, I was persuaded to give FreeRadius a shot due to its widespread acceptance, praise, and most naturally its snappy web front-end. I'm now stuck with the task of migrating our old (mySQL) databases, as we have far too many users to re-enter manually. Wilst I have done my best to make the original icradius tables congruent with the new freeradius setup, my efforts have been rewarded with a week of frustration. Unfortunately, even the wise google has come up nearly empty handed in our searches for a tutorial or even some small scrap of information relevant to quick-and-painless or just slightly painful migration; thus I turn to this mailing list - if anyone has come across and could point myself and fellow archive-searchers in the direction of a resource no matter how mind-tearing or vague, it would be very much appreciated; any place to start is a good place as I'm just picking this up as I go along. My basic setup is as such: Old ICRadius server -------------- Mandrake 9.1, Apache 2x, icradius 0.18 with php front-end, mysql 4 installed locally New FreeRadius server -------------- Gentoo Linux, apache 2x, php4x, freeradius 1.0.2-5, freeradius-dialupadmin 1.70, mysql installed elsewhere Standalone mySQL Server ------------- Gentoo Linux, Apache 2x, php4x, phpMyAdmin 2.6.3 (which is what I have done the bulk of my table-tinkering with), mySQL 4.0.24 I presently have the old icradius database sitting in the standalone sql server (while the production and up-to-date version remains on the original server) as 'oldradius' and the freeradius installation-script-generated database as 'radius'. All I've really done thus far is modify the structure of the tables in 'oldradius' so that they can be easily copied. Unfortunately, this presents the problem of having several columns with null or incorrect values. It would really help to know if there are some key default values that will get things done even in the dirtiest of manners if anyone is familliar with the differences between icradius and freeradius in dealing with mySQL. Thanks in advance to any who reply; if nothing at all, it will certainly be beneficial to the apparent lack of documentation on these situations. Karma Foxx

3 3

dialup_admin CVS produces checkrad defunct
by Muenz, Michael 29 Jul '05

29 Jul '05

Hi, yesterday I've updated dialup_admin to CVS version. Most things works great, but my radiusd produce many defunct processes now. Any ideas? radius01:/usr/local/dialup_admin/bin# pstree init-+-atd [..] |-mysqld_safe---mysqld---mysqld---22*[mysqld] |-radiusd---radiusd-+-2*[radiusd---6*[checkrad]] | |-radiusd---5*[checkrad] | |-radiusd---10*[checkrad] | `-radiusd---9*[checkrad] radius01:/usr/local/dialup_admin/bin# ps ax [...] 21874 ? Z 0:00 [checkrad <defunct>] 22080 ? Z 0:00 [checkrad <defunct>] 22335 ? Z 0:00 [checkrad <defunct>] 22501 ? Z 0:00 [checkrad <defunct>] [...] I have a second radius machine with an old CVS version (1.75) and there are no defunct's. FreeRadius is running 1.0.4 on both machines, and use mysql for usermanagement. Michael

2 1