- Freeradius-Users - lists.freeradius.org

IPv6 accounting RADIUS SQL schema?
by Michael Ducharme 20 Aug '18

20 Aug '18

Hello, I am wondering whether there is any standard SQL schema for IPv6 radius accounting, and standard queries? I understand from doing a bit of research that to store the IPv6 schema we have to manually add fields to the SQL database and the queries to the queries.conf. That is certainly doable and is easy enough, however instead of naming them what I want, I would rather have some official guidance as to what the fields should be named and what the queries should be. The reason is that we use some third party software that reads accounting data directly out out of the FreeRADIUS radacct table, and it expects the standard field names to be used - unfortunately there seem to not be standardized field names for SQL for IPv6 RADIUS accounting yet, and it would simply save us some future headache if we had this. They seem to not want to build support for IPv6 until there is some standard schema released by FreeRADIUS that gives the MySQL field names for IPv6 accounting info. Also small ISPs are beginning to roll out IPv6 more and more, ISPs that use FreeRADIUS, so it might be good to add those into the standard install at some point? Just an idea. Thanks!

5 22

Re: Freeradius-Users Digest, Vol 160, Issue 33
by Imdad Hasan 19 Aug '18

19 Aug '18

Thank you Nathan Ward, Actually i want to make daily usage report, but if that session is older than one or two days than i dont get proper daily data usage report. For now, i was make script that disconnect all users with pod at midnight 12. Any other way to achieve this idea without disconnecting users. Warm Regard's Imdadali Kadiwala On Sun 19 Aug, 2018, 11:19 AM , < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Renew the session at midnight 12 o clock (Imdad Hasan) > 2. Re: Renew the session at midnight 12 o clock (Nathan Ward) > 3. Re: IPv6 accounting RADIUS SQL schema? (Nathan Ward) > 4. Re: IPv6 accounting RADIUS SQL schema? (Michael Ducharme) > 5. Re: IPv6 accounting RADIUS SQL schema? (Nathan Ward) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 19 Aug 2018 03:04:18 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Renew the session at midnight 12 o clock > Message-ID: > < > CAPidyMV-OmZWUxBwrH8RvxfP5COBVpTcUZu2gAfmCUvCZoq-rA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Respected All, > > How can i kill old accounting sessions and generate new sessions without > disconnect the users at every midnight 12 o clock. > > > Warm Regard's > Imdadali Kadiwala > > > ------------------------------ > > Message: 2 > Date: Sun, 19 Aug 2018 15:21:48 +1200 > From: Nathan Ward <lists+freeradius(a)daork.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Renew the session at midnight 12 o clock > Message-ID: <33845DBE-D464-4713-B980-0479726912C9(a)daork.net> > Content-Type: text/plain; charset=utf-8 > > > > On 19/08/2018, at 9:34 AM, Imdad Hasan <imdadalikadiwala0(a)gmail.com> > wrote: > > > > Respected All, > > > > How can i kill old accounting sessions and generate new sessions without > > disconnect the users at every midnight 12 o clock. > > Accounting sessions are managed by the NAS and distinguished by > Acct-Session-Id etc., so, you can’t really unless your NAS can do this - > but I’ve never seen such a “feature”. > > Often we return a “Class” in an Access-Accept message, which is included > in Accounting requests and is what FreeRADIUS uses to distinguish unique > sessions. **Maybe** you can update Class in a CoA, but, that would almost > certainly be NAS specific. Additionally, this would not cause the NAS to > reset the counters to zero, nor send an accounting start type message. > > This is quite a specific question - short answer is “you can’t” - but > perhaps we can help if we know what you are doing. What are you looking to > achieve? Why do you want new accounting sessions? > > -- > Nathan Ward > > > > > ------------------------------ > > Message: 3 > Date: Sun, 19 Aug 2018 15:37:23 +1200 > From: Nathan Ward <lists+freeradius(a)daork.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: IPv6 accounting RADIUS SQL schema? > Message-ID: <786ED99C-8491-4A52-AEB3-B9D9FCC3E540(a)daork.net> > Content-Type: text/plain; charset=utf-8 > > Hi, > > > On 19/08/2018, at 9:11 AM, Michael Ducharme <mducharme(a)gmail.com> wrote: > > > > I would say it is even more complicated: > > > > If assigning framed prefixes is enabled on the NAS, each customer is > given a /64 prefix and router advertisements are sent out so that the CPE > can get a global address via SLAAC (reported as Framed-IPv6-Prefix and > Framed-Interface-Id). > > > > If DHCPv6-PD is enabled on the NAS, each customer who requests a prefix > will be assigned one, typically a /56 (reported as Delegated-IPv6-Prefix). > If DHCPv6 address assignment is enabled, then the CPE can get a global IP > through DHCPv6 (reported as Framed-IPv6-Address). > > Yep that’s right - in my prev. message, the /128 is a CIDR, so can be any > length. If one uses SLAAC for CPE WAN interfaces, the prefix for that needs > to be unique per subscriber so you can identify them, as SLAAC doesn’t give > the BNG any indication of the address(es) which are selected. > > > So if the customer has a router that supports everything and has > everything enabled, it could get two addresses on its WAN port, one via > SLAAC and one via DHCPv6, and then a prefix via DHCPv6-PD for use on the > internal network (LAN ports, guest wifi, etc.). If only routers are > connecting via PPP and not customer computers directly, you can look at the > Delegated-IPv6-Prefix to see what prefix the customer's computers are > using. If customer computers connected directly to the NAS (ex. through an > L2TP VPN), then the computer will use either a global address via SLAAC > (found in the Framed-IPv6-Prefix and Framed-Interface-Id accounting) or a > global address via DHCPv6 (found in Framed-IPv6-Address), or both. > > While I agree that this is technically possible, it is unusual to have > both SLAAC and DHCPv6 IA-NA at the same time on one device. DHCPv6 is > triggered by flags in the RA. If you’ve got a broadband type environment > where both happen, I would suggest changing that to support only SLAAC, or > only DHCPv6 IA-NA. > > Regardless, this is possible, so is something that should probably be > permitted. > > > Because, depending on the exact situation, the end user device may be on > an address in the Delegated-IPv6-Prefix (this is the case if they go > through a router) or an address in the Framed-IPv6-Prefix (if they are on > SLAAC) or an address in Framed-IPv6-Address (if they receive an address > through DHCPv6 address assignment), all three fields must be stored. As an > ISP, we are required to forward copyright infringement notices to > customers, and in order to look up the address on the notice, we need to > search all three fields (unlike in IPv4 where we only search one field). > > Additionally, it is common that WAN side addresses are not assigned at all > - and only DHCPv6 IA-PD is assigned - and there may even be multiple IA-PD > assigned. > > I think the short story is that a RADIUS “session” can have 0+ IPv6 > addresses/prefixes. This is I suppose similar to IPv4, if you use > Framed-Route to give customers additional addresses - these can exist in > Accounting-Request messages. > > I don’t know if this is something that FreeRADIUS should attempt to solve > in a generic way, or if there should perhaps be some examples and have it > left up to the operator. If it is solved in a generic way, how would that > be done? > - Additional tables for prefix assignments? > - ARRAY support in SQL? (Not in MySQL, but is in other SQL DBs) > - JSON or some other serialisation of an array in to text? > - ARRAY for most DBs, JSON blob for others? > > -- > Nathan Ward > > > > > ------------------------------ > > Message: 4 > Date: Sat, 18 Aug 2018 22:21:19 -0700 > From: Michael Ducharme <mducharme(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: IPv6 accounting RADIUS SQL schema? > Message-ID: <5f9b3c0e-23ee-f7c0-46aa-5618b2274cd3(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > Hi, > > On 8/18/2018 8:37 PM, Nathan Ward wrote: > > Additionally, it is common that WAN side addresses are not assigned at > all - and only DHCPv6 IA-PD is assigned - and there may even be multiple > IA-PD assigned. > Yes, I am aware - we do not assign WAN side addresses. An unfortunate > side effect of this is that *many* consumer routers will then not > function - quite a few consumer routers ask for address and prefix, and > if offered a prefix with no address, will refuse it instead of correctly > accepting the prefix. Once our NAS vendor adds proper RADIUS accounting > support for IPv6, we might assign WAN-side addresses for that reason only. > > We are only starting to provide managed residential gateways to our > customers - our network has been historically BYOR > (bring-your-own-router), and we even have some customers who have no > computer and no router, only an xbox plugged into their modem configured > with the PPPoE credentials. At the moment, the way our network is > configured, those xbox customers are out of luck for IPv6, since the > xbox is unlikely to request a prefix via DHCPv6-PD. Given our > environment, as long as we have decent RADIUS accounting, we are likely > to enable both SLAAC framed-prefix and DHCPv6 address provisioning, if > only to provide working IPv6 connectivity to as many customers as > possible, given the plethora of different ways they can connect. > > > I think the short story is that a RADIUS “session” can have 0+ IPv6 > addresses/prefixes. This is I suppose similar to IPv4, if you use > Framed-Route to give customers additional addresses - these can exist in > Accounting-Request messages. > The big difference with Framed-Route in IPv4 is there is not generally a > mechanism for customers to be automatically assigned their own prefix > with IPv4 -- at least I have never heard of a means to do so. The only > way that the customer is going to get an IPv4 prefix is if the attribute > is provided via RADIUS in the Access-Accept packet, and in that event, > you don't necessarily need the accounting to know that the customer has > that prefix (since somewhere else in the same RADIUS database there is > the attribute that provided it in the first place). This is different > with IPv6, where the customer can get a Delegated-IPv6-Prefix and/or > Framed-IPv6-Prefix by automatic means without that prefix having been > originally assigned via RADIUS, and having the accounting record is > therefore more crucial. > > > > I don’t know if this is something that FreeRADIUS should attempt to > solve in a generic way, or if there should perhaps be some examples and > have it left up to the operator. If it is solved in a generic way, how > would that be done? > > - Additional tables for prefix assignments? > > - ARRAY support in SQL? (Not in MySQL, but is in other SQL DBs) > > - JSON or some other serialisation of an array in to text? > > - ARRAY for most DBs, JSON blob for others? > > I considered the idea of another table, because it is tempting to have > the idea of a structure that represents IPv6 addresses that the customer > has in a single place, but that increases complexity in its own way. If > you did have a second table, however, it would be even more tempting to > have it store all other attributes that aren't recorded elsewhere, with > fields for radacctid (to associate it with the correct accounting > record), attribute name, and attribute value. It's always a weakness of > the DB-field-per-attribute SQL approach that you aren't recording all > accounting fields in the database, and the separate table would provide > that - the database could record every value that the NAS provides. > Alternatively as you suggest, you could have a JSON blob that records > the remaining attributes. I don't personally like the idea of using a > type like ARRAY that MySQL doesn't support, especially since it is > probably the case that most FreeRADIUS SQL implementations out there are > using MySQL. > > However, I don't think it is necessarily a technical problem to have > three different fields to store the IPv6 address and searching across > three fields. The biggest risk is going to be lack of understanding of > what the fields are for, where developers who create billing systems or > web interfaces that offer some kind of address search function may only > program it to search one of the three fields, not understanding the > purpose of the different fields. I expect that a developer extending > their billing system or web interface to IPv6, not having an > understanding of some of the technicalities, would think that search of > a "framedipv6address" field was sufficient and not bother to search the > "framedipv6prefix" and "delegatedipv6prefix" fields, and that would end > up creating issues for end users. > > Michael > > > ------------------------------ > > Message: 5 > Date: Sun, 19 Aug 2018 17:49:21 +1200 > From: Nathan Ward <lists+freeradius(a)daork.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: IPv6 accounting RADIUS SQL schema? > Message-ID: <1BF16ACE-882B-4F49-A696-A2E1685F9A62(a)daork.net> > Content-Type: text/plain; charset=utf-8 > > Hi, > > > On 19/08/2018, at 5:21 PM, Michael Ducharme <mducharme(a)gmail.com> wrote: > > > > However, I don't think it is necessarily a technical problem to have > three different fields to store the IPv6 address and searching across three > fields. The biggest risk is going to be lack of understanding of what the > fields are for, where developers who create billing systems or web > interfaces that offer some kind of address search function may only program > it to search one of the three fields, not understanding the purpose of the > different fields. I expect that a developer extending their billing system > or web interface to IPv6, not having an understanding of some of the > technicalities, would think that search of a "framedipv6address" field was > sufficient and not bother to search the "framedipv6prefix" and > "delegatedipv6prefix" fields, and that would end up creating issues for end > users. > > > If this would be the approach then I think it’s best left as examples of > what could be done, rather than change the standard schema - a standard > schema needs to support 0+ of each of the fields you suggest here, not > simply 0-1. > > -- > Nathan Ward > > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 160, Issue 33 > ************************************************* >

3 4

Re: Freeradius-Users Digest, Vol 160, Issue 34
by Imdad Hasan 19 Aug '18

19 Aug '18

Thanks Nathan Ward, Sure, Say for example: if any user "XYZ" have a one accounting session with the acct-start-time = "2018-08-16 05:00:00" and acct-stop-time = " 2018-08-19 11:16:46". Ok. Means only one accounting session 3 days. So, in this example how can i calculate OR get the "2018-08-17" OR "2018-08-18" s' data usage of that "XYZ" user? Warm Regard's Imdadali Kadiwala On Sun, Aug 19, 2018 at 3:18 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: IPv6 accounting RADIUS SQL schema? (Michael Ducharme) > 2. Re: Freeradius-Users Digest, Vol 160, Issue 33 (Imdad Hasan) > 3. Re: daily usage report (Nathan Ward) > 4. Re: IPv6 accounting RADIUS SQL schema? (Nathan Ward) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 18 Aug 2018 23:57:19 -0700 > From: Michael Ducharme <mducharme(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: IPv6 accounting RADIUS SQL schema? > Message-ID: <2ac45a24-7dbf-7c03-c31e-b70cf41f5b60(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 8/18/2018 10:49 PM, Nathan Ward wrote: > > If this would be the approach then I think it’s best left as examples > > of what could be done, rather than change the standard schema - a > > standard schema needs to support 0+ of each of the fields you suggest > > here, not simply 0-1. > There *needs* to be a standard schema for IPv6 soon, the billing system > we use does not support IPv6 RADIUS accounting yet mainly because there > are no standard FreeRADIUS/MySQL field names to read the data from > (hence the reason for my question and my pull request). How can I get > our billing system vendor to support IPv6 RADIUS accounting in > FreeRADIUS/MySQL when there are not even standard fields for storing > this data? > > And, regarding 0+ instead of 0-1, even though the attributes may > technically be usable multiple times, how often does this happen in > practice? I would expect extremely rarely, based on what I have seen, > especially in an automated sense. If there are multiple > Delegated-IPv6-Prefix attributes, chances are that it is not due to an > automated system but instead due to RADIUS assignment of > Delegated-IPv6-Prefix, and that case is like the IPv4 Framed-Route > attribute. If Delegated-IPv6-Prefix is assigned via RADIUS from the > beginning, then at least there is a record that that prefix was assigned > to that customer besides the accounting record. > > I just don't want this to turn into a "lets do nothing" situation, due > to a few potential corner case situations, because then nothing is going > to happen. > > Michael > > > ------------------------------ > > Message: 2 > Date: Sun, 19 Aug 2018 15:08:21 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius-Users Digest, Vol 160, Issue 33 > Message-ID: > <CAPidyMX7ZM-8f4gujFTiQK84ZuhLmZAFPihoEvA=E > Jr1d+OdKA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Thank you Nathan Ward, > > Actually i want to make daily usage report, but if that session is older > than one or two days than i dont get proper daily data usage report. For > now, i was make script that disconnect all users with pod at midnight 12. > > Any other way to achieve this idea without disconnecting users. > > Warm Regard's > Imdadali Kadiwala > > On Sun 19 Aug, 2018, 11:19 AM , < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Renew the session at midnight 12 o clock (Imdad Hasan) > > 2. Re: Renew the session at midnight 12 o clock (Nathan Ward) > > 3. Re: IPv6 accounting RADIUS SQL schema? (Nathan Ward) > > 4. Re: IPv6 accounting RADIUS SQL schema? (Michael Ducharme) > > 5. Re: IPv6 accounting RADIUS SQL schema? (Nathan Ward) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Sun, 19 Aug 2018 03:04:18 +0530 > > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Renew the session at midnight 12 o clock > > Message-ID: > > < > > CAPidyMV-OmZWUxBwrH8RvxfP5COBVpTcUZu2gAfmCUvCZoq-rA(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > Respected All, > > > > How can i kill old accounting sessions and generate new sessions without > > disconnect the users at every midnight 12 o clock. > > > > > > Warm Regard's > > Imdadali Kadiwala > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 19 Aug 2018 15:21:48 +1200 > > From: Nathan Ward <lists+freeradius(a)daork.net> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Renew the session at midnight 12 o clock > > Message-ID: <33845DBE-D464-4713-B980-0479726912C9(a)daork.net> > > Content-Type: text/plain; charset=utf-8 > > > > > > > On 19/08/2018, at 9:34 AM, Imdad Hasan <imdadalikadiwala0(a)gmail.com> > > wrote: > > > > > > Respected All, > > > > > > How can i kill old accounting sessions and generate new sessions > without > > > disconnect the users at every midnight 12 o clock. > > > > Accounting sessions are managed by the NAS and distinguished by > > Acct-Session-Id etc., so, you can’t really unless your NAS can do this - > > but I’ve never seen such a “feature”. > > > > Often we return a “Class” in an Access-Accept message, which is included > > in Accounting requests and is what FreeRADIUS uses to distinguish unique > > sessions. **Maybe** you can update Class in a CoA, but, that would almost > > certainly be NAS specific. Additionally, this would not cause the NAS to > > reset the counters to zero, nor send an accounting start type message. > > > > This is quite a specific question - short answer is “you can’t” - but > > perhaps we can help if we know what you are doing. What are you looking > to > > achieve? Why do you want new accounting sessions? > > > > -- > > Nathan Ward > > > > > > > > > > ------------------------------ > > > > Message: 3 > > Date: Sun, 19 Aug 2018 15:37:23 +1200 > > From: Nathan Ward <lists+freeradius(a)daork.net> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: IPv6 accounting RADIUS SQL schema? > > Message-ID: <786ED99C-8491-4A52-AEB3-B9D9FCC3E540(a)daork.net> > > Content-Type: text/plain; charset=utf-8 > > > > Hi, > > > > > On 19/08/2018, at 9:11 AM, Michael Ducharme <mducharme(a)gmail.com> > wrote: > > > > > > I would say it is even more complicated: > > > > > > If assigning framed prefixes is enabled on the NAS, each customer is > > given a /64 prefix and router advertisements are sent out so that the CPE > > can get a global address via SLAAC (reported as Framed-IPv6-Prefix and > > Framed-Interface-Id). > > > > > > If DHCPv6-PD is enabled on the NAS, each customer who requests a prefix > > will be assigned one, typically a /56 (reported as > Delegated-IPv6-Prefix). > > If DHCPv6 address assignment is enabled, then the CPE can get a global IP > > through DHCPv6 (reported as Framed-IPv6-Address). > > > > Yep that’s right - in my prev. message, the /128 is a CIDR, so can be any > > length. If one uses SLAAC for CPE WAN interfaces, the prefix for that > needs > > to be unique per subscriber so you can identify them, as SLAAC doesn’t > give > > the BNG any indication of the address(es) which are selected. > > > > > So if the customer has a router that supports everything and has > > everything enabled, it could get two addresses on its WAN port, one via > > SLAAC and one via DHCPv6, and then a prefix via DHCPv6-PD for use on the > > internal network (LAN ports, guest wifi, etc.). If only routers are > > connecting via PPP and not customer computers directly, you can look at > the > > Delegated-IPv6-Prefix to see what prefix the customer's computers are > > using. If customer computers connected directly to the NAS (ex. through > an > > L2TP VPN), then the computer will use either a global address via SLAAC > > (found in the Framed-IPv6-Prefix and Framed-Interface-Id accounting) or a > > global address via DHCPv6 (found in Framed-IPv6-Address), or both. > > > > While I agree that this is technically possible, it is unusual to have > > both SLAAC and DHCPv6 IA-NA at the same time on one device. DHCPv6 is > > triggered by flags in the RA. If you’ve got a broadband type environment > > where both happen, I would suggest changing that to support only SLAAC, > or > > only DHCPv6 IA-NA. > > > > Regardless, this is possible, so is something that should probably be > > permitted. > > > > > Because, depending on the exact situation, the end user device may be > on > > an address in the Delegated-IPv6-Prefix (this is the case if they go > > through a router) or an address in the Framed-IPv6-Prefix (if they are on > > SLAAC) or an address in Framed-IPv6-Address (if they receive an address > > through DHCPv6 address assignment), all three fields must be stored. As > an > > ISP, we are required to forward copyright infringement notices to > > customers, and in order to look up the address on the notice, we need to > > search all three fields (unlike in IPv4 where we only search one field). > > > > Additionally, it is common that WAN side addresses are not assigned at > all > > - and only DHCPv6 IA-PD is assigned - and there may even be multiple > IA-PD > > assigned. > > > > I think the short story is that a RADIUS “session” can have 0+ IPv6 > > addresses/prefixes. This is I suppose similar to IPv4, if you use > > Framed-Route to give customers additional addresses - these can exist in > > Accounting-Request messages. > > > > I don’t know if this is something that FreeRADIUS should attempt to solve > > in a generic way, or if there should perhaps be some examples and have it > > left up to the operator. If it is solved in a generic way, how would that > > be done? > > - Additional tables for prefix assignments? > > - ARRAY support in SQL? (Not in MySQL, but is in other SQL DBs) > > - JSON or some other serialisation of an array in to text? > > - ARRAY for most DBs, JSON blob for others? > > > > -- > > Nathan Ward > > > > > > > > > > ------------------------------ > > > > Message: 4 > > Date: Sat, 18 Aug 2018 22:21:19 -0700 > > From: Michael Ducharme <mducharme(a)gmail.com> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Re: IPv6 accounting RADIUS SQL schema? > > Message-ID: <5f9b3c0e-23ee-f7c0-46aa-5618b2274cd3(a)gmail.com> > > Content-Type: text/plain; charset=utf-8; format=flowed > > > > Hi, > > > > On 8/18/2018 8:37 PM, Nathan Ward wrote: > > > Additionally, it is common that WAN side addresses are not assigned at > > all - and only DHCPv6 IA-PD is assigned - and there may even be multiple > > IA-PD assigned. > > Yes, I am aware - we do not assign WAN side addresses. An unfortunate > > side effect of this is that *many* consumer routers will then not > > function - quite a few consumer routers ask for address and prefix, and > > if offered a prefix with no address, will refuse it instead of correctly > > accepting the prefix. Once our NAS vendor adds proper RADIUS accounting > > support for IPv6, we might assign WAN-side addresses for that reason > only. > > > > We are only starting to provide managed residential gateways to our > > customers - our network has been historically BYOR > > (bring-your-own-router), and we even have some customers who have no > > computer and no router, only an xbox plugged into their modem configured > > with the PPPoE credentials. At the moment, the way our network is > > configured, those xbox customers are out of luck for IPv6, since the > > xbox is unlikely to request a prefix via DHCPv6-PD. Given our > > environment, as long as we have decent RADIUS accounting, we are likely > > to enable both SLAAC framed-prefix and DHCPv6 address provisioning, if > > only to provide working IPv6 connectivity to as many customers as > > possible, given the plethora of different ways they can connect. > > > > > I think the short story is that a RADIUS “session” can have 0+ IPv6 > > addresses/prefixes. This is I suppose similar to IPv4, if you use > > Framed-Route to give customers additional addresses - these can exist in > > Accounting-Request messages. > > The big difference with Framed-Route in IPv4 is there is not generally a > > mechanism for customers to be automatically assigned their own prefix > > with IPv4 -- at least I have never heard of a means to do so. The only > > way that the customer is going to get an IPv4 prefix is if the attribute > > is provided via RADIUS in the Access-Accept packet, and in that event, > > you don't necessarily need the accounting to know that the customer has > > that prefix (since somewhere else in the same RADIUS database there is > > the attribute that provided it in the first place). This is different > > with IPv6, where the customer can get a Delegated-IPv6-Prefix and/or > > Framed-IPv6-Prefix by automatic means without that prefix having been > > originally assigned via RADIUS, and having the accounting record is > > therefore more crucial. > > > > > > I don’t know if this is something that FreeRADIUS should attempt to > > solve in a generic way, or if there should perhaps be some examples and > > have it left up to the operator. If it is solved in a generic way, how > > would that be done? > > > - Additional tables for prefix assignments? > > > - ARRAY support in SQL? (Not in MySQL, but is in other SQL DBs) > > > - JSON or some other serialisation of an array in to text? > > > - ARRAY for most DBs, JSON blob for others? > > > > I considered the idea of another table, because it is tempting to have > > the idea of a structure that represents IPv6 addresses that the customer > > has in a single place, but that increases complexity in its own way. If > > you did have a second table, however, it would be even more tempting to > > have it store all other attributes that aren't recorded elsewhere, with > > fields for radacctid (to associate it with the correct accounting > > record), attribute name, and attribute value. It's always a weakness of > > the DB-field-per-attribute SQL approach that you aren't recording all > > accounting fields in the database, and the separate table would provide > > that - the database could record every value that the NAS provides. > > Alternatively as you suggest, you could have a JSON blob that records > > the remaining attributes. I don't personally like the idea of using a > > type like ARRAY that MySQL doesn't support, especially since it is > > probably the case that most FreeRADIUS SQL implementations out there are > > using MySQL. > > > > However, I don't think it is necessarily a technical problem to have > > three different fields to store the IPv6 address and searching across > > three fields. The biggest risk is going to be lack of understanding of > > what the fields are for, where developers who create billing systems or > > web interfaces that offer some kind of address search function may only > > program it to search one of the three fields, not understanding the > > purpose of the different fields. I expect that a developer extending > > their billing system or web interface to IPv6, not having an > > understanding of some of the technicalities, would think that search of > > a "framedipv6address" field was sufficient and not bother to search the > > "framedipv6prefix" and "delegatedipv6prefix" fields, and that would end > > up creating issues for end users. > > > > Michael > > > > > > ------------------------------ > > > > Message: 5 > > Date: Sun, 19 Aug 2018 17:49:21 +1200 > > From: Nathan Ward <lists+freeradius(a)daork.net> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: IPv6 accounting RADIUS SQL schema? > > Message-ID: <1BF16ACE-882B-4F49-A696-A2E1685F9A62(a)daork.net> > > Content-Type: text/plain; charset=utf-8 > > > > Hi, > > > > > On 19/08/2018, at 5:21 PM, Michael Ducharme <mducharme(a)gmail.com> > wrote: > > > > > > However, I don't think it is necessarily a technical problem to have > > three different fields to store the IPv6 address and searching across > three > > fields. The biggest risk is going to be lack of understanding of what the > > fields are for, where developers who create billing systems or web > > interfaces that offer some kind of address search function may only > program > > it to search one of the three fields, not understanding the purpose of > the > > different fields. I expect that a developer extending their billing > system > > or web interface to IPv6, not having an understanding of some of the > > technicalities, would think that search of a "framedipv6address" field > was > > sufficient and not bother to search the "framedipv6prefix" and > > "delegatedipv6prefix" fields, and that would end up creating issues for > end > > users. > > > > > > If this would be the approach then I think it’s best left as examples of > > what could be done, rather than change the standard schema - a standard > > schema needs to support 0+ of each of the fields you suggest here, not > > simply 0-1. > > > > -- > > Nathan Ward > > > > > > > > > > ------------------------------ > > > > Subject: Digest Footer > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > > > End of Freeradius-Users Digest, Vol 160, Issue 33 > > ************************************************* > > > > > ------------------------------ > > Message: 3 > Date: Sun, 19 Aug 2018 21:43:29 +1200 > From: Nathan Ward <lists+freeradius(a)daork.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: daily usage report > Message-ID: <D01DBD1C-9EC8-4FF5-8344-BA924FB40D65(a)daork.net> > Content-Type: text/plain; charset=utf-8 > > You might want to subscribe to the list non-digest :-) > > > On 19/08/2018, at 9:38 PM, Imdad Hasan <imdadalikadiwala0(a)gmail.com> > wrote: > > > > Thank you Nathan Ward, > > > > Actually i want to make daily usage report, but if that session is older > > than one or two days than i dont get proper daily data usage report. For > > now, i was make script that disconnect all users with pod at midnight 12. > > > > Any other way to achieve this idea without disconnecting users. > > Sure there are plenty of ways. What is the problem re. the sessions being > older than one or two days? Please be explicit about your problem and what > you’re trying to achieve, and include as much detail as possible. I can > guess, but, I am not exactly sure so I won’t. “Proper” is not an objective > term - can you expand on that? > > -- > Nathan Ward > > > > > ------------------------------ > > Message: 4 > Date: Sun, 19 Aug 2018 21:47:54 +1200 > From: Nathan Ward <lists+freeradius(a)daork.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: IPv6 accounting RADIUS SQL schema? > Message-ID: <CB334B87-4076-4673-9FA3-E0FBF0CA1E61(a)daork.net> > Content-Type: text/plain; charset=utf-8 > > > > On 19/08/2018, at 6:57 PM, Michael Ducharme <mducharme(a)gmail.com> wrote: > > > > On 8/18/2018 10:49 PM, Nathan Ward wrote: > >> If this would be the approach then I think it’s best left as examples > of what could be done, rather than change the standard schema - a standard > schema needs to support 0+ of each of the fields you suggest here, not > simply 0-1. > > There *needs* to be a standard schema for IPv6 soon, the billing system > we use does not support IPv6 RADIUS accounting yet mainly because there are > no standard FreeRADIUS/MySQL field names to read the data from (hence the > reason for my question and my pull request). How can I get our billing > system vendor to support IPv6 RADIUS accounting in FreeRADIUS/MySQL when > there are not even standard fields for storing this data? > > I would query why that data is in your billing system, but, I’m sure you > have your reasons. > Generally I prefer to expose data to “external” systems through APIs, > rather than give them direct database access and tightly couple two > applications together though a DB schema which may need to change for one > side or the other. > > > And, regarding 0+ instead of 0-1, even though the attributes may > technically be usable multiple times, how often does this happen in > practice? I would expect extremely rarely, based on what I have seen, > especially in an automated sense. If there are multiple > Delegated-IPv6-Prefix attributes, chances are that it is not due to an > automated system but instead due to RADIUS assignment of > Delegated-IPv6-Prefix, and that case is like the IPv4 Framed-Route > attribute. If Delegated-IPv6-Prefix is assigned via RADIUS from the > beginning, then at least there is a record that that prefix was assigned to > that customer besides the accounting record. > > > I just don't want this to turn into a "lets do nothing" situation, due > to a few potential corner case situations, because then nothing is going to > happen. > > I don’t think this is a hard problem to solve in a more flexible manner. > Given that, I think we should do so. > > -- > Nathan Ward > > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 160, Issue 34 > ************************************************* >

1 0

Renew the session at midnight 12 o clock
by Imdad Hasan 19 Aug '18

19 Aug '18

Respected All, How can i kill old accounting sessions and generate new sessions without disconnect the users at every midnight 12 o clock. Warm Regard's Imdadali Kadiwala

2 1

Python Module Threading Issue
by Gary Gwin 18 Aug '18

18 Aug '18

I've attached radius.log, a simple example Python program, and the mods-enabled configs for two instances: mods-enabled/python1 mods-enabled/python2 that when invoked from the authorization sections of: sites-enabled/default sites-enabled/inner-tunnel result in a freeradius server crash. This only happens for threaded tests, for example: ./radperf -s -p 10 -D stats.out -f test-small.csv 127.0.0.1 auth testing123 The crash does not occur if the test client doesn't thread requests or if I run 'freeradius -X' with console output. Depending upon the execution, I see these fatal errors: Fatal Python error: GC object already tracked Fatal Python error: PyEval_SaveThread: NULL tstate Thoughts? Thanks, Gary

3 6

3GPP user location info
by taymour samir 18 Aug '18

18 Aug '18

Hi In the user location info I get 16 bit and decoded it , but I have also a 26 bit entry can someone send a simple way to decode it to get all the location info Regards Sent from my iPhone

1 0

Re: Re: Dynamic Vlan Assignment Active Directory with winbind
by Kevin Virk 16 Aug '18

16 Aug '18

Thank you for the help! From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Thursday, August 16, 2018 3:00 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 160, Issue 27 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Dynamic Vlan Assignment Active Directory with winbind EAP-TLS 802.1x (Matthew Newton) 2. Re: I need to disconnect users (Brian Julin) 3. Apache with mod_auth_radius starts X requests (Carsten Schulze) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Aug 2018 18:37:29 +0100 From: Matthew Newton <mcn(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Dynamic Vlan Assignment Active Directory with winbind EAP-TLS 802.1x Message-ID: <1534354649.5024.21.camel(a)freeradius.org> Content-Type: text/plain; charset="UTF-8" On Wed, 2018-08-15 at 17:28 +0000, Kevin Virk wrote: > I came across this thread in my search for answers > http://freeradius.1045715.n5.nabble.com/FreeRadius-3-0-11-and- > Winbind-td5743424.html and it is stating that winbind is not the > preferred method for dynamic vlan assignment. This thread is about > two years old so I was hoping if anyone could answer if this was > still the case. It's still the same. > I am using FreeRADIUS Version 2.2.8. As this was what was downloaded > using the deb package on Ubuntu 16.04. 2.2.8 is obsolete. You should upgrade to 3.0.17. Or at least 2.2.10 (which is still obsolete). > The setup I am hoping to achieve is EAP-TLS 802.1x that can > dynamically assign vlans to users based off active directory > information and has the ability to revoke certs and check active > directory for disabled accounts and not allow them to auth. Is this > possible? Yes. As you want EAP-TLS you don't need winbind. Still use LDAP to get data about the user from AD. -- Matthew ------------------------------ Message: 2 Date: Wed, 15 Aug 2018 17:43:35 +0000 From: Brian Julin <BJulin(a)clarku.edu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: I need to disconnect users Message-ID: <BN7PR03MB376278619C1874D45813909CB43F0(a)BN7PR03MB3762.namprd03.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" Alan DeKok <aland(a)deployingradius.com> > No, that's wrong, sorry. You were right both times... :-) I have to do the former because we use a NAS client wildcard, and you can't originate-coa to a dynamically created NAS last time I checked. Works fine, even at a medium volume of users. ------------------------------ Message: 3 Date: Thu, 16 Aug 2018 07:38:29 +0200 From: Carsten Schulze <carsten.schulze(a)leuphana.de> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Apache with mod_auth_radius starts X requests Message-ID: <5d8a22ab-bf78-d2aa-1366-1af30135c7a0(a)leuphana.de> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi, I'm using Debian9 with Apache + radius_mod_auth to authenticate some user while accessing a directory on that server. But that didn't work. I can see Radius Access-Request and Access-Accepts via tcpdump, the probleme is, that the request never ends. I interrupted the request with an Apache restart after 3Minutes and 1500 Radius-Request (still running). 07:10:14.010157 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept .... 07:13:27.547061 IP 10.19.56.57.1026 > Radius-IP.1812: RADIUS, Access-Request (1), id: 0xc2 length: 80 07:13:27.674561 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept (2), id: 0xc2 length: 20 3000 packets captured Any Idea about that? I used that guid for configuration: https://github.com/FreeRADIUS/mod_auth_radius P.S: I can't turn on the debug option, the server wouldn't start. Regards Carsten

1 0

Getting Reject response from Server for MAC Auth
by Victor Credidio 16 Aug '18

16 Aug '18

Hello masters! I'm trying to use a freeradius server 3 (running on CentOS7) with my ruckus AP (model R610). I followed this wiki article, specifically this two topics below to configure it properly: https://wiki.freeradius.org/guide/mac-auth#plain-mac-auth https://wiki.freeradius.org/guide/mac-auth#additional-modifications_mac-aut… I'm trying to log to my WLAN with my phone. It's MAC is already in the "authorized_macs" file (/etc/raddb/authorized_macs), and the server is receiving it's requests. I can see my phone's MAC Address, my AP MAC Address, the AP SSID, and some other stuff. Problem is, I still get rejected. For more than three days I've been trying to make it work like that, but still no progress, so I thought it was better to consult the experts. Here's the output of the radiusd -X command. I put the line numbers so it would be easier to locate or reference something. The first "reject" I get is on line 72: 1 (0) Received Access-Request Id 47 from 10.85.0.222:40680 to 10.85.2.46:1812 length 197 2 (0) User-Name = "70-4d-7b-53-cb-38" 3 (0) User-Password = "70-4d-7b-53-cb-38" 4 (0) Calling-Station-Id = "70-4D-7B-53-CB-38" 5 (0) NAS-IP-Address = 10.85.0.222 6 (0) Called-Station-Id = "90-3A-72-65-47-AC:PMJG-AD-ACC" 7 (0) Service-Type = Framed-User 8 (0) NAS-Port-Type = Wireless-802.11 9 (0) NAS-Identifier = "90-3A-72-65-47-AC" 10 (0) Ruckus-SSID = "PMJG-AD-ACC" 11 (0) Message-Authenticator = 0x5d564ee23f2090acd3bc2002e4b8a23b 12 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default 13 (0) authorize { 14 (0) policy filter_username { 15 (0) if (&User-Name) { 16 (0) if (&User-Name) -> TRUE 17 (0) if (&User-Name) { 18 (0) if (&User-Name =~ / /) { 19 (0) if (&User-Name =~ / /) -> FALSE 20 (0) if (&User-Name =~ /@[^@]*@/ ) { 21 (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE 22 (0) if (&User-Name =~ /\.\./ ) { 23 (0) if (&User-Name =~ /\.\./ ) -> FALSE 24 (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { 25 (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE 26 (0) if (&User-Name =~ /\.$/) { 27 (0) if (&User-Name =~ /\.$/) -> FALSE 28 (0) if (&User-Name =~ /(a)\./) { 29 (0) if (&User-Name =~ /(a)\./) -> FALSE 30 (0) } # if (&User-Name) = notfound 31 (0) } # policy filter_username = notfound 32 (0) policy rewrite_called_station_id { 33 (0) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { 34 (0) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> TRUE 35 (0) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { 36 (0) update request { 37 (0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} 38 (0) --> 90-3A-72-65-47-AC 39 (0) &Called-Station-Id := 90-3A-72-65-47-AC 40 (0) } # update request = noop 41 (0) if ("%{8}") { 42 (0) EXPAND %{8} 43 (0) --> PMJG-AD-ACC 44 (0) if ("%{8}") -> TRUE 45 (0) if ("%{8}") { 46 (0) update request { 47 (0) EXPAND %{8} 48 (0) --> PMJG-AD-ACC 49 (0) &Called-Station-SSID := PMJG-AD-ACC 50 (0) } # update request = noop 51 (0) } # if ("%{8}") = noop 52 (0) [updated] = updated 53 (0) } # if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) = updated 54 (0) ... skipping else: Preceding "if" was taken 55 (0) } # policy rewrite_called_station_id = updated 56 (0) policy rewrite_calling_station_id { 57 (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { 58 (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE 59 (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { 60 (0) update request { 61 (0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} 62 (0) --> 70-4D-7B-53-CB-38 63 (0) &Calling-Station-Id := 70-4D-7B-53-CB-38 64 (0) } # update request = noop 65 (0) [updated] = updated 66 (0) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated 67 (0) ... skipping else: Preceding "if" was taken 68 (0) } # policy rewrite_calling_station_id = updated 69 (0) if (!ok) { 70 (0) if (!ok) -> TRUE 71 (0) if (!ok) { 72 (0) [reject] = reject 73 (0) } # if (!ok) = reject 74 (0) } # authorize = reject 75 (0) Using Post-Auth-Type Reject 76 (0) # Executing group from file /etc/raddb/sites-enabled/default 77 (0) Post-Auth-Type REJECT { 78 (0) attr_filter.access_reject: EXPAND %{User-Name} 79 (0) attr_filter.access_reject: --> 70-4d-7b-53-cb-38 80 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 81 (0) [attr_filter.access_reject] = updated 82 (0) [eap] = noop 83 (0) policy remove_reply_message_if_eap { 84 (0) if (&reply:EAP-Message && &reply:Reply-Message) { 85 (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE 86 (0) else { 87 (0) [noop] = noop 88 (0) } # else = noop 89 (0) } # policy remove_reply_message_if_eap = noop 90 (0) } # Post-Auth-Type REJECT = updated 91 (0) Delaying response for 1.000000 seconds 92 Waking up in 0.3 seconds. 93 Waking up in 0.6 seconds. 94 (0) Sending delayed response 95 (0) Sent Access-Reject Id 47 from 10.85.2.46:1812 to 10.85.0.222:40680 length 20 96 Waking up in 3.9 seconds. 97 (0) Cleaning up request packet ID 47 with timestamp +11 Greetings, -- Victor B. C.

2 2

Re: Freeradius-Users Digest, Vol 160, Issue 18
by Arun NP 16 Aug '18

16 Aug '18

Hi , I tried doing the wget method in the link which you gave . But I am not able to see the "archive" directory in that path. I am using the github account (cisco specific) Please let me know how I can get the access for that file Thanks, Arun On Mon, Aug 13, 2018 at 3:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. "Suite B TLS cipher suite" support (elmerhe) > 2. RE: Freeradius-Users Digest, Vol 160, Issue 16 > (WAGHORN, Jason (NHS BORDERS)) > 3. Re: Filtering out Proxy-State in COA to fix broken Cisco NAS > (Fraser McGlinn) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 13 Aug 2018 14:13:47 +0800 > From: "elmerhe" <elmerhe(a)aliyun.com> > To: "freeRADIUS" <freeradius-users(a)lists.freeradius.org> > Subject: "Suite B TLS cipher suite" support > Message-ID: <8dc3d6ec-70d8-40a4-a678-b30ec918500e.elmerhe(a)aliyun.com> > Content-Type: text/plain; charset="UTF-8" > > > Hi Freeradius experts, > > I want to know if freeRADIUS supports "Suite B TLS cipher suite" which is > required by WPA3-enterprise. If yes, any specific configuration is needed? > > Thanks, > John. > > ------------------------------ > > Message: 2 > Date: Mon, 13 Aug 2018 07:21:44 +0000 > From: "WAGHORN, Jason (NHS BORDERS)" <j.waghorn1(a)nhs.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius-Users Digest, Vol 160, Issue 16 > Message-ID: <4ed9474f7f044be5b3e178da3b3bb936(a)NH-SLPEX176.AD1.NHS.NET> > Content-Type: text/plain; charset="utf-8" > > >From: Freeradius-Users [mailto:freeradius-users-bounces+j.waghorn1= > nhs.net(a)lists.freeradius.org] On Behalf Of Arun NP > > >Hi , > >I am doing a yum install & it is supposed to bring the latest version rt > ? > >. Please let me know how I can get the version which you are using > (3.0.17) > >. I am using centos 7 does the version which you mentioned exist for the > >same ? please inform me > > http://networkradius.com/freeradius-packages/ or compile it yourself > using the instructions in the Wiki > https://wiki.freeradius.org/building/RHEL%20and%20Centos > > Jason Waghorn > Senior Infrastructure Engineer > > NHS Borders | IT Services | Huntlyburn Terrace | Borders General Hospital > | Melrose | TD6 9BS > > N direct: 01896 827 760 | ext: 27760 | email:j.waghorn1@nhs.net |@ > mobile: 0747 100 5116 > > > > > ******************************************************************************************************************** > > This message may contain confidential information. If you are not the > intended recipient please inform the > sender that you have received the message in error before deleting it. > Please do not disclose, copy or distribute information in this e-mail or > take any action in relation to its contents. To do so is strictly > prohibited and may be unlawful. Thank you for your co-operation. > > NHSmail is the secure email and directory service available for all NHS > staff in England and Scotland. NHSmail is approved for exchanging patient > data and other sensitive information with NHSmail and other accredited > email services. > > For more information and to find out how you can switch, > https://portal.nhs.net/help/joiningnhsmail > > > > > ------------------------------ > > Message: 3 > Date: Mon, 13 Aug 2018 17:56:26 +1000 > From: Fraser McGlinn <fraser(a)frizianz.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Filtering out Proxy-State in COA to fix broken Cisco NAS > Message-ID: <2660278386ca44f737aaed0528fae149(a)frizianz.com> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Thanks Alan, that helps a lot. Great info in that draft RFC. > > On 2018-08-10 22:12, Alan DeKok wrote: > > On Aug 8, 2018, at 9:19 PM, Fraser McGlinn <fraser(a)frizianz.com> wrote: > >> > >> Trying to get COA proxying working with a Cisco NAS. Unfortunately > >> they have a broken implementation where if Proxy-State is in the > >> request it drops it. > > > > That's based on a naive reading of RFC 5176. Happily, my new draft > > clarifies this. It should be an RFC this year: > > > > https://tools.ietf.org/html/draft-ietf-radext-coa-proxy-03 > > > >> I dug and found this old thread > >> > http://lists.freeradius.org/pipermail/freeradius-users/2012-April/060456.ht… > >> implying that we can filter out Proxy-State in attr_filter, however > >> i've had some issues getting this working. Although this was relevant > >> to freeradius 2x, i'm running 3.0.16. > >> > >> Any other ways to achieve this? Hoping someone can point me in the > >> right direction. > > > > You can delete the Proxy-State attribute in the "pre-proxy" section: > > > > pre-proxy { > > ... > > update proxy-request { > > Proxy-State !* ANY > > } > > ... > > } > > > > Hope that helps. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 160, Issue 18 > ************************************************* >

1 0

I need to disconnect users
by Ariel García Reyes 15 Aug '18

15 Aug '18

I need to disconnect users that in 1 month already have consumed 1gbyte of data. The NAS sends me the traffic of the network every 5 minutes. The question is: how to do that when I get the data that the user has already consumed the traffic that was assigned, the freeradius disconnect the user ?. I am using the RadiusDesk implementation, I have configured plans and they work, but the consumption check is when the user is going to log in only. -- ________________________________________________ Lic. Ariel García Reyes. GNU/Linux Registered User #357058

3 3