- Freeradius-Users - lists.freeradius.org

Re: Re: User authentication for remote NAS'?
by wefwe fewfew 05 Apr '17

05 Apr '17

Brian, Apologies for mailing you directly, that wasn't my intention, Hi all, I played around with the mikrotik-total-limit right after installing. When sending that as a radreply attribute it works for that session alone but that makes sense. I tried modifying the counter to reflect mikrotik-total-time instead of session-time as explained on the wiki. https://wiki.freeradius.org/modules/Rlm_sqlcounter#scenarios_lifetime-limit… Unfortunately it doesn't seem to be as easy as simply changing the attribute and query ;) Would a similar counter for data usage have to go into the sqlcounter_expire_on_login file? Am I correct in thinking that in such a case the maximum data usage would become part of the radcheck just as for the session time? Is there any way to check what is sent as part of radcheck? Sending something as a attribute under radreply makes it show up under freeradius -X and on Mikrotik radius log but radcheck doesn't show anything. It must be sending something because trying the wiki example I got it working (though its half broken after I tried to change some things, even though I changed all my settings back. I'll have to look into that...) but I would like to be able to see what it's sending. Different question but is it possible to "stack" the time limit as per the wiki? E.g. Check total, monthly, weekly and daily max session time limits? I want to be able to give for example 1gb of usage per day, but a total of 5gb max per week. I guess that would involve doing unlang (something like check weeklycounter, if smaller then allowed, goto dailycounter else reject) in the sites-enabled/default file? Can you put unlang in there? ________________________________ From: wefwe fewfew <totallimpbizkit(a)hotmail.com> Sent: Tuesday, April 4, 2017 9:39:28 AM To: Brian Candler Subject: Re: Re: User authentication for remote NAS'? Hi Brian, I played around with the mikrotik-total-limit right after installing. When sending that as a radreply attribute it works for that session alone but that makes sense. I tried modifying the counter to reflect mikrotik-total-time instead of session-time as explained on the wiki. https://wiki.freeradius.org/modules/Rlm_sqlcounter#scenarios_lifetime-limit… Unfortunately it doesn't seem to be as easy as simply changing the attribute and query ;) Would a similar counter for data usage have to go into the sqlcounter_expire_on_login file? Am I correct in thinking that in such a case the maximum data usage would become part of the radcheck just as for the session time? Is there any way to check what is sent as part of radcheck? Sending something as a attribute under radreply makes it show up under freeradius -X and on Mikrotik radius log but radcheck doesn't show anything. It must be sending something because trying the wiki example I got it working (though its half broken after I tried to change some things, even though I changed all my settings back. I'll have to look into that...) but I would like to be able to see what it's sending. Different question but is it possible to "stack" the time limit as per the wiki? E.g. Check total, monthly, weekly and daily max session time limits? I want to be able to give for example 1gb of usage per day, but a total of 5gb max per week. I guess that would involve doing unlang (something like check weeklycounter, if smaller then allowed, goto dailycounter else reject) in the sites-enabled/default file? Can you put unlang in there? ________________________________ From: Brian Candler <b.candler(a)pobox.com> Sent: Monday, April 3, 2017 10:52:01 AM To: wefwe fewfew; FreeRadius users mailing list Subject: Re: Re: User authentication for remote NAS'? On 03/04/2017 09:52, wefwe fewfew wrote: > Long story short is that I want FR/mysql to check how long a user is still allowed online or how much bandwidth he has left and reject access/disconnect a user based on that. If you can *pre-calculate* this at the time the user connects, then you may be able to set an attribute at the start of the session and let the NAS kick them off when it's exceeded. Session-Timeout is a standard attribute and gives the time limit (in seconds). But that's not what you want. For limiting the bytes uploaded/downloaded, then it's entirely vendor specific. I notice in dictionary.mikrotik you'll find: ATTRIBUTE Mikrotik-Recv-Limit 1 integer ATTRIBUTE Mikrotik-Xmit-Limit 2 integer ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer ATTRIBUTE Mikrotik-Total-Limit 17 integer ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer (An integer is a 32-bit value, so if you want to give a value greater than 4GB you'll have to split it a 64-bit value into high and low 32-bit words, and use Gigawords for the high value. See RFC2869) So maybe that will do what you want. You could check at authentication time what their monthly limit is (say 40GB) and how much they've used so far this month (say 10GB), and then set the limit to 30GB. Otherwise, you'll have to run a process which periodically checks how much data a user has consumed, and tell the NAS interactively to kick them off. That again is very NAS-specific. Some NASes support a CoA packet for this; some NASes support an SNMP SET to do this; others you may need to script a login to the CLI and issue a command to kick them off. Sorry, I can't give you an off-the-shelf recipe to do this for Mikrotik, as I've never used their gear. FreeRADIUS can happily accumulate the accounting information into a database, to give you the source of info you need. (If you have a huge number of users then it might be an idea to use something like a Redis database instead of SQL) You will however want to ensure that you get accounting updates during a long-lived session, rather than waiting until the user disconnects which is the default. The way to do this is by including the Acct-Interim-Interval attribute in the authentication response: e.g. Acct-Interim-Interval = 600 This means "send me an update of usage for this session every 10 minutes". Most NASes won't let you set it lower than 5 or 10 minutes. For an ISP network I'd probably set it to 2 hours. HTH, Brian.

1 0

Unlang check if module exists before if else block
by Arnab Roy 04 Apr '17

04 Apr '17

Hello, Is it possible to check in unlang if module is enabled for e.g. something like this if(mschap) --> if mschap is enabled in mods-enabled/ { ..... } else{ ......... } Any pointers would be greatly appreciated. Many Thanks Arnab

2 2

Wrong datetime
by HugLeo 04 Apr '17

04 Apr '17

Something wrong with freeradius datetime. Linux local time is: Tue Apr 4 13:04:34 -03 2017 But freeradius set acctstarttime to: 2017-04-04 13:11:27 looks like freeradius is setting acctstarttime 7 minutes ahead than localtime. The diaclect is mysql in mods-enabled/sql. What can it be?

2 1

largest length of numeric comparison in unlang?
by adrian.p.smith＠bt.com 04 Apr '17

04 Apr '17

If I'm doing a <= or >= comparison in unlang, is there a limit to the size of the numbers? i.e. I'm guessing that they use some sort of number type in the code? Thanks.

2 1

Cleartext-Password or User-Password
by HugLeo 04 Apr '17

04 Apr '17

In my older freeradius installations I configure the radcheck username with: +---------+----------+---------------+----+--------+ | id | username | attribute | op | value | +---------+----------+---------------+----+--------+ | 1 | test | User-Password | == | 123456 | But now for freeradius 3 I have to do: +---------+----------+--------------------+----+--------+ | id | username | attribute | op | value | +---------+----------+--------------------+----+--------+ | 1 | test | Cleartext-Password | := | 123456 | +---------+----------+--------------------+----+--------+ Are there a way that I can keep using User-Password or need I now use just Cleartext-Password?

2 1

Re: Freeradius-Users Digest, Vol 144, Issue 6
by dahili.network＠gmail.com 04 Apr '17

04 Apr '17

radacct table related problems exists on every version of freeradius i made custom session script to solve this problem i use that since two years i also used custom addons radacc watch own dyn dns mechanism to use dynamic ip's also NAS side scripts helps to solve this kind of problems Oguz Ersoz Dahili Network ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, April 04, 2017 10:42 AM Subject: Freeradius-Users Digest, Vol 144, Issue 6 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. "[sql] stop packet with zero session length" problem > (Selahattin Cilek) > 2. perl and SQL question (Anton) > 3. Re: perl and SQL question (Herwin Weststrate) > 4. FreeRadius 3.0.13 - Using SSID to check AD groups (Pierre de Jong) > 5. Re: perl and SQL question (Anton) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 4 Apr 2017 05:25:11 +0000 > From: Selahattin Cilek <> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: "[sql] stop packet with zero session length" problem > Message-ID: > <VI1P18901MB0240723C6A133647731D6A85ED0B0(a)VI1P18901MB0240.EURP189.PROD.OUTLOOK.COM> > > Content-Type: text/plain; charset="utf-8" > > I have been trying to get the Unifi AP line of products to work with > FreeRADIUS (v 2.2.9) seamlessly for quite some time now; but with little > success, I am afraid to say. It turned out that the portion of the > firmware that deals with RADIUS accounting is a complete mess. I have sent > them many e-mails with detailed information for the many bugs I have > discovered. They say they will fix them all and I am still waiting. > > Since I cannot tell the site owners to dump all their Ubiquiti hardware > and buy new equipment, my only option is to make the most of FreeRADIUS > configuration and MySQL programming to compensate for the firmware bugs in > the UAP. However, there is one bug for which I have not been able to find > a workaround. > > Sometimes, and for some reason that is unknown to me, when a user connects > to a UAP NAS, he is immediately kicked out. We can see that in the > accounting details log of the NAS: > > Tue Apr 4 08:02:36 2017 > Acct-Session-Id = "58D911BB-00001F5D" > Acct-Status-Type = Start > Acct-Authentic = RADIUS > User-Name = "99481225842" > NAS-Identifier = "44d9e77a2de5" > NAS-Port = 0 > Called-Station-Id = "46-D9-E7-7B-2D-E5:YEMEKHANE" > Calling-Station-Id = "28-ED-6A-30-55-5A" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 0Mbps 802.11b" > Class = 0x3939343831323235383432 > NAS-IP-Address = 192.168.0.31 > FreeRADIUS-Acct-Session-Start-Time = "Apr 4 2017 08:02:36 MSK" > Timestamp = 1491282156 > > Tue Apr 4 08:02:36 2017 > Acct-Session-Id = "58D911BB-00001F5D" > Acct-Status-Type = Stop > Acct-Authentic = RADIUS > User-Name = "99481225842" > NAS-Identifier = "44d9e77a2de5" > NAS-Port = 0 > Called-Station-Id = "46-D9-E7-7B-2D-E5:YEMEKHANE" > Calling-Station-Id = "28-ED-6A-30-55-5A" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 0Mbps 802.11b" > Class = 0x3939343831323235383432 > Acct-Session-Time = 0 > Acct-Input-Packets = 11 > Acct-Output-Packets = 12 > Acct-Input-Octets = 1289 > Acct-Output-Octets = 3415 > Event-Timestamp = "Apr 4 2017 08:02:35 MSK" > Acct-Terminate-Cause = User-Request > NAS-IP-Address = 192.168.0.31 > FreeRADIUS-Acct-Session-Start-Time = "Apr 4 2017 08:02:36 MSK" > Timestamp = 1491282156 > > > I believe this is ridiculous. How on earth could someone be connected to a > WLAN for 0 seconds, right? We can observe this bug in FreeRADIUS log > messages too: > > Apr 4 08:02:36 radiusd 96187 [sql] stop packet with zero > session length. [user '99481225842', nas '192.168.0.31'] > > So what is the problem? Well, the problem is that when FreeRADIUS receives > the first packet, it runs a custom MySQL stored procedure I have written > myself, which enters a record into the radacct table. But because it > refuses to accept the second packet, I end up with a suspended session. > And because users allowed to connect one device only to the network > (Simultaneous-Use := 1), they will have to wait for 10 minutes for the > suspended session to drop, thanks to a custom bash script. > > My question is: > How can I make the sql module to accept accounting packets with zero > session length? > > PS: Upgrading to FreeRADIUS 3.x is not an option. > > > Thanks in advance. > > Selahattin CILEK > > > > > > > > > > > [https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-anima…]<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> > Virus-free. > www.avast.com<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> > > ------------------------------ > > Message: 2 > Date: Tue, 4 Apr 2017 15:13:13 +0700 > From: Anton <zav(a)tomica.ru> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: perl and SQL question > Message-ID: <20170404151313.6f6ceb2c@zav-wrk> > Content-Type: text/plain; charset=US-ASCII > > Hi. > > I have next code in perl module to communicate with postgresql: > > ... > our $pgclientsn = "DBI:Pg:dbname=mydb;host=10.14.2.66;port=5432;"; > ... > sub CLONE { > ... > # remote psql > $pgclientdbh = DBI->connect($pgclientsn, 'username', > 'password',{AutoCommit => 1,pg_server_prepare => 1}); > > # accoutning stop insert (?) > $astopins = $pgclientdbh->prepare("INSERT INTO telephonecallacct > (username,acctstarttime,acctstoptime,acctsessiontime,callingstationid,calledstationid,calldirection) > VALUES (?,TO_TIMESTAMP(?),TO_TIMESTAMP(?),?,?,?,?)"); > ... > # check service status for tel.number -- check number status > $numstatcheck = $pgclientdbh->prepare("SELECT s.enabled FROM > telephony_numbers AS tn, service AS s WHERE number = ? AND tn.sid = > s.id"); > ... > } > > today postgres was unaccessible for 10 minits (some pg processes were core > dumped). freeradius started responding "Invalid user" and stayed in > this state until the freeradius restart. > > How should I modify perl code to restart sql connection automatically or > periodically or something else to prevent sql connection problems ? > If this possible at all ? > > > > ------------------------------ > > Message: 3 > Date: Tue, 4 Apr 2017 10:23:55 +0200 > From: Herwin Weststrate <herwin(a)quarantainenet.nl> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: perl and SQL question > Message-ID: <381dda30-1f58-450b-f843-dd43cf9545e7(a)quarantainenet.nl> > Content-Type: text/plain; charset=utf-8 > > On 04-04-17 10:13, Anton wrote: >> Hi. >> >> I have next code in perl module to communicate with postgresql: >> >> ... >> our $pgclientsn = "DBI:Pg:dbname=mydb;host=10.14.2.66;port=5432;"; >> ... >> sub CLONE { >> ... >> # remote psql >> $pgclientdbh = DBI->connect($pgclientsn, 'username', >> 'password',{AutoCommit => 1,pg_server_prepare => 1}); >> >> # accoutning stop insert (?) >> $astopins = $pgclientdbh->prepare("INSERT INTO telephonecallacct >> (username,acctstarttime,acctstoptime,acctsessiontime,callingstationid,calledstationid,calldirection) >> VALUES (?,TO_TIMESTAMP(?),TO_TIMESTAMP(?),?,?,?,?)"); >> ... >> # check service status for tel.number -- check number status >> $numstatcheck = $pgclientdbh->prepare("SELECT s.enabled FROM >> telephony_numbers AS tn, service AS s WHERE number = ? AND tn.sid = >> s.id"); >> ... >> } >> >> today postgres was unaccessible for 10 minits (some pg processes were >> core dumped). freeradius started responding "Invalid user" and stayed in >> this state until the freeradius restart. >> >> How should I modify perl code to restart sql connection automatically or >> periodically or something else to prevent sql connection problems ? >> If this possible at all ? > > You probably shouldn't. The CLONE sub is executed every time a thread is > spawned [1], so the code snippet you posted is probably wrong (it might > be cropped too heavy, but it looks as if the database inserts are > performed inside the CLONE sub). > > You *might* be able to move $pgclientdbh to an "our" variable in the > outer scope of the file and do something like "reconnect() unless > $pgclientdbh->ping" I have no idea if it works or not. > > But looking at your code once again: I don't see anything here that > can't be done by the sql module. And even if it has, you can still make > it more robust by moving the select and insert statements to specific > sql-modules and storing results in temporary variables. This removes the > database handling from the perl script. > > > [1] > http://perldoc.perl.org/perlguts.html#Should-I-do-anything-special-if-I-cal… > > -- > Herwin Weststrate > > > ------------------------------ > > Message: 4 > Date: Tue, 4 Apr 2017 10:30:01 +0200 > From: Pierre de Jong <pierredejong(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: FreeRadius 3.0.13 - Using SSID to check AD groups > Message-ID: > <CAHAvaJ5rgFj+UOnS+jms6MW=BSTW61DbS==bTH6dqDRMnHndbA(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > > I am currently trying to set up a single FreeRadius 3.0.13 server to > handle > diffenrents SSID on a network. > Users should be allowed to use certain SSID IF they are in certain AD > Group. > > We (my collegue and myself) have been to work things out, BUT we would > like > to optimise. > > Here is what has been done: > > In the DEFAULT site: > > Authenticate --> With the MSCHAP via NTLM_Auth > > Authorize ---> we have configured the LDAP module to be able to query the > AD > > > We could see that is was working, in the "radiusd -X" output. > > Then we implemented this, under.... > > But the first "if" does not work, although it should be ENOUGH and really > enought dynamic.... if the SSID and AD Group are created the right way. > > We encountered the following problem: > > UNABLE to use "%{Called-Station-SSID}" (nor %Called-Station-SSID) > > But %{User-Name} works great. > > > - rewrite_called_station_id --> has been called in "authorized" that > should "instantiate" the Called-Station-SSID > > post-auth { > if (LDAP-Group == "grp-ssid-%{Called-Station-SSID}") { > update reply { > Reply-Message = "Hello %{User-Name}: accès > permis sur %{Called-Station-SSID} a" > } > ok > return > } > if (LDAP-Group == "grp-ssid-GRP-Radius" && > Called-Station-SSID == "GRP-Radius") { > update reply { > Reply-Message = "Hello %{User-Name}: accès > permis sur %{Called-Station-SSID} b" > } > ok > return > } > if (LDAP-Group == "grp-ssid-GRP-Radius2" && > Called-Station-SSID == "GRP-Radius2") { > update reply { > Reply-Message = "Hello %{User-Name}: accès > permis sur %{Called-Station-SSID} " > } > ok > return > } else { > update reply { > Reply-Message = "Hello %{User-Name}: Vous > n'avez pas accès" > } > reject > } > #### > > > - Is there any ways to use that "CALLED-STATION-SSID"? anywhere.... or, > where is it "usable". > - Is that kind of "mechanisme" the good way to go ? > - Is there a way to initialise a "global" variable, so that we can use it > "anywhere" ? (UNLANG) > > Thanks in advance > > Pierre de Jong > -.-.-.-.-.-.-.-.-.-.- > > > ------------------------------ > > Message: 5 > Date: Tue, 4 Apr 2017 15:42:20 +0700 > From: Anton <zav(a)tomica.ru> > To: Herwin Weststrate <herwin(a)quarantainenet.nl> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: perl and SQL question > Message-ID: <20170404154220.06d0db81@zav-wrk> > Content-Type: text/plain; charset=UTF-8 > > Herwin, I have "->prepare" in CLONE, so INSERTs and SELECTs are not > executed in CLONE functions. They are only prepared > on sql-server for next execution in more effective way. There is only one > place I know for "sql prepare" -- CLONE function. > > Thanks for You reply. Spawned theads did not help me for some unknown > reason. > > > On Tue, 4 Apr 2017 10:23:55 +0200 > Herwin Weststrate <herwin(a)quarantainenet.nl> wrote: > >> On 04-04-17 10:13, Anton wrote: >> > Hi. >> > >> > I have next code in perl module to communicate with postgresql: >> > >> > ... >> > our $pgclientsn = "DBI:Pg:dbname=mydb;host=10.14.2.66;port=5432;"; >> > ... >> > sub CLONE { >> > ... >> > # remote psql >> > $pgclientdbh = DBI->connect($pgclientsn, 'username', >> > 'password',{AutoCommit => 1,pg_server_prepare => 1}); >> > >> > # accoutning stop insert (?) >> > $astopins = $pgclientdbh->prepare("INSERT INTO telephonecallacct >> > (username,acctstarttime,acctstoptime,acctsessiontime,callingstationid,calledstationid,calldirection) >> > VALUES >> > (?,TO_TIMESTAMP(?),TO_TIMESTAMP(?),?,?,?,?)"); ... # check service >> > status for tel.number -- check number status >> > $numstatcheck = $pgclientdbh->prepare("SELECT s.enabled FROM >> > telephony_numbers AS tn, service AS s WHERE number = ? AND tn.sid = >> > s.id"); >> > ... >> > } >> > >> > today postgres was unaccessible for 10 minits (some pg processes were >> > core dumped). freeradius started responding "Invalid user" and stayed >> > in >> > this state until the freeradius restart. >> > >> > How should I modify perl code to restart sql connection automatically >> > or periodically or something else to prevent sql connection problems ? >> > If this possible at all ? >> >> You probably shouldn't. The CLONE sub is executed every time a thread is >> spawned [1], so the code snippet you posted is probably wrong (it might >> be cropped too heavy, but it looks as if the database inserts are >> performed inside the CLONE sub). >> >> You *might* be able to move $pgclientdbh to an "our" variable in the >> outer scope of the file and do something like "reconnect() unless >> $pgclientdbh->ping" I have no idea if it works or not. >> >> But looking at your code once again: I don't see anything here that >> can't be done by the sql module. And even if it has, you can still make >> it more robust by moving the select and insert statements to specific >> sql-modules and storing results in temporary variables. This removes the >> database handling from the perl script. >> >> >> [1] >> http://perldoc.perl.org/perlguts.html#Should-I-do-anything-special-if-I-cal… >> > > > > > -- > Anton, > инженер отдела управления сетью связи, > ООО "ИКА" (Томика) 634050 г. Томск > пр. Ленина 55, оф. 101 > Тел: 701-855 > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 144, Issue 6 > ************************************************ >

1 0

perl and SQL question
by Anton 04 Apr '17

04 Apr '17

Hi. I have next code in perl module to communicate with postgresql: ... our $pgclientsn = "DBI:Pg:dbname=mydb;host=10.14.2.66;port=5432;"; ... sub CLONE { ... # remote psql $pgclientdbh = DBI->connect($pgclientsn, 'username', 'password',{AutoCommit => 1,pg_server_prepare => 1}); # accoutning stop insert (?) $astopins = $pgclientdbh->prepare("INSERT INTO telephonecallacct (username,acctstarttime,acctstoptime,acctsessiontime,callingstationid,calledstationid,calldirection) VALUES (?,TO_TIMESTAMP(?),TO_TIMESTAMP(?),?,?,?,?)"); ... # check service status for tel.number -- check number status $numstatcheck = $pgclientdbh->prepare("SELECT s.enabled FROM telephony_numbers AS tn, service AS s WHERE number = ? AND tn.sid = s.id"); ... } today postgres was unaccessible for 10 minits (some pg processes were core dumped). freeradius started responding "Invalid user" and stayed in this state until the freeradius restart. How should I modify perl code to restart sql connection automatically or periodically or something else to prevent sql connection problems ? If this possible at all ?

2 2

Shared key mismatch
by Ondřej Lauer 03 Apr '17

03 Apr '17

Hello, I have a PacketFence set up using FreeRADIUS v. 3.0.13. In PacketFence GUI I have set up a RADIUS secret key - a letter "x" for testing purposes, but when I try using radtest -x test test localhost:18120 0 x the radiusd -X -xx -d /usr/local/pf/raddb -n auth output is following : Mon Apr 3 17:01:03 2017 : Debug: (0) Received Access-Request Id 196 from 127.0.0.1:37337 to 127.0.0.1:18120 length 79 Mon Apr 3 17:01:03 2017 : Info: Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Mon Apr 3 17:01:03 2017 : Debug: Waking up in 0.3 seconds. Mon Apr 3 17:01:03 2017 : Debug: (0) Cleaning up request packet ID 196 with timestamp +64 Mon Apr 3 17:01:03 2017 : Info: Ready to process requests Mon Apr 3 17:01:08 2017 : Debug: (1) Received Access-Request Id 196 from 127.0.0.1:37337 to 127.0.0.1:18120 length 79 Mon Apr 3 17:01:08 2017 : Info: Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Mon Apr 3 17:01:08 2017 : Debug: Waking up in 0.3 seconds. Mon Apr 3 17:01:08 2017 : Debug: (1) Cleaning up request packet ID 196 with timestamp +69 Mon Apr 3 17:01:08 2017 : Info: Ready to process requests The shared key should be the same - is there any way how do debug it on a lower level ? Thank you very much

2 5

Help request: LDAP syntax authorization
by Aaron Dalla-Longa 03 Apr '17

03 Apr '17

Freeradius version 3 Is it possible to deny a user based on an attribute that LDAP sends through, and if so, what is the syntax for it? Alternatively, if there is a well-put together guide on Freeradius LDAP syntax, could you link it to me? Something that I would be looking for would be something like the pseudo-code below: if (user_attribute "delinquency" == "no") { accept { else { reject } Our LDAP directory is a list of library patrons, and I would want the LDAP module to reject based on one or other attributes. -- *Aaron Dalla-Longa* Systems Administrator Shortgrass Library System tf: 1.866.529.0550 | p: 403.529.0550

2 3

No Accounting records from only 1 NAS
by Andrés Gómez 03 Apr '17

03 Apr '17

Hi dear friends I have a FreeRADIUS Version 2.1.12 working fine!! I have several NAS devices working fine. Freeradius server records all their accounting record in mysql database, table radacct. It works!! But I have one NAS device that can authenticate its users, and it sends Accounting data, but the freeradius server is not recording that data in the mysql database. I know that accounting data is arriving to the server because the log. Example: Mon Apr 3 07:07:28 2017 Acct-Status-Type = Start User-Name = "0003AB94EF3F" Framed-IP-Address = 192.168.24.56 NAS-IP-Address = 192.168.50.2 Calling-Station-Id = "0003ab94ef3f" NAS-Identifier = "ApNextel" NAS-Port-Id = "WIFIGRATIS-NEXTEL" NAS-Port-Type = Wireless-802.11 NAS-Port = 3232248322 Called-Station-Id = "000456b94fc0" Framed-MTU = 1400 Acct-Session-Id = "00-04-56-B9-4F-C0-00-00-00-11-00-03-AB-94-EF-3F" Event-Timestamp = "Apr 3 2017 07:07:27 COT" Acct-Delay-Time = 0 Acct-Unique-Session-Id = "44582e4931b31778" Timestamp = 1491221248 Mon Apr 3 07:17:28 2017 Acct-Status-Type = Interim-Update User-Name = "0003AB94EF3F" Framed-IP-Address = 192.168.24.56 NAS-IP-Address = 192.168.50.2 Calling-Station-Id = "0003ab94ef3f" NAS-Identifier = "ApNextel" NAS-Port-Id = "WIFIGRATIS-NEXTEL" NAS-Port-Type = Wireless-802.11 NAS-Port = 3232248322 Called-Station-Id = "000456b94fc0" Framed-MTU = 1400 Acct-Session-Id = "00-04-56-B9-4F-C0-00-00-00-11-00-03-AB-94-EF-3F" Event-Timestamp = "Apr 3 2017 07:17:27 COT" Acct-Input-Packets = 1453 Acct-Output-Packets = 1461 Acct-Input-Octets = 309768 Acct-Output-Octets = 784758 Acct-Session-Time = 600 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "44582e4931b31778" Timestamp = 1491221848 Looking in the mysql database, I can see all the record from all other devices, but not form this one. What can I chech? Regards Andrés --

2 2