- Freeradius-Users - lists.freeradius.org

Freeradius Max-Daily-Session in custom authentication
by Polarix 01 Apr '16

01 Apr '16

Actually i have AAA by mysql and everything work fine. Especially the use *Max-Daily-Session*attribute to disconnect the user after 10min (600sec) connection. I recently changed the way authenticazione using a custom php script. In sites-enabled/default file: authorize{ update control { Auth-Type := `/usr/bin/php -f /etc/raddb/yourscript.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'`} In /etc/freeradius/users: DEFAULT Auth-Type = AcceptExec-Program-Wait = "/usr/bin/php -f /etc/raddb/attributes.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'" In attributes.php: <?php $User = $argv[1]; $Pass = $argv[2]; $Ip = $argv[3];if ($User == "test") echo "Max-Daily-Session:=600";?> It seems that the server does not care about the Max-Daily-Session attribute and does not send the Packet of Disconnect. What changes between mysql and custom authentication?

2 4

audispd stopping radiusd due to memory violation
by Christopher Michael Allison 01 Apr '16

01 Apr '16

I am seeing this happen on one of our radius servers. We are running FreeRADIUS 3.0.11. This started happening more frequently on one of our radius. Yesterday has been the most it has done it. It was 3 times in like a 6 hour period. We had this issue when I first upgraded our servers to 3.0.11 but I found another avenue that this was due to and it was that the MozNSS compile openldap libraries were causing this issue. I have since fixed that I have compiled openldap based upon openssl and this has stopped happening on all our other servers. This one server keeps dying because of a memory violation. The error message follows: audispd[902]: node="radius-server-hostname" type=ANOM_ABEND msg=audit(1459467717.181:189187): auid=4294967295 uid=977 gid=2010 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 pid=40239 comm="radiusd" reason="memory violation" sig=11 Thanks, CHRISTOPHER ALLISON Network Engineer I Information Technology Mail Code 4622 625 Wham Drive Carbondale, Illinois 62901 chris.m.allison(a)siu.edu<mailto:%20chris.m.allison@siu.edu> M - F 7:30 AM - 4 PM P: 618 / 453 - 8415 F: 618 / 453 - 5261 INFOTECH.SIU.EDU<http://infotech.siu.edu/> [http://asset.siu.edu/_assets/images/email_sig/SIU_email_2line.gif] "Choose a job you love, and you will never have to work a day in your life." Confucius

3 2

OCSP URL format
by Alex Sharaz 01 Apr '16

01 Apr '16

Quick question about OCSP URLs. When overriding the cert specified OCSP URL, can you specify more than one just in case a server dies for example? Just been off site and our F5 that load balances requests to our OCSP service decided not to forward them hence the only way to connect to eduroam was to delete the TLS profile and use PEAP. Talking to all the individual OCSP servers worked just fine. Rgds Alex

5 11

Wiki updates - Debian instructions
by Matthew Newton 31 Mar '16

31 Mar '16

Just a heads-up here as I know people often point at the Debian building instructions on the wiki. I've done a little reorganising. The main "Build" page has been getting rather long, so I've separated the Debian build instructions off into the (already existing) "Debian" page. So Debian and Ubuntu now point there: http://wiki.freeradius.org/building/Build points to http://wiki.freeradius.org/building/Debian Essentially, the cluebat for "I'm using 2.1.12 on Debian" should now be http://wiki.freeradius.org/building/Debian The build instructions now also include mk-build-deps to automatically install the build-deps, rather than using apt-get build-dep, which actually installs the build-deps for the version in the Debian repository (probably 2.1.12...) rather than (hopefully) 3.x. And I've removed some prehistoric stuff regarding OpenSSL from 2.1.8 or so. I've also taken the liberty to expand that page to include instructions on building Debian Samba packages that include the libwbclient patches to enable direct communication with winbind. This is required because the latest version of Samba in Debian Jessie is still less than 4.2.1, but is now much easier than it was with Samba 3 in Wheezy. I've tested most combinations of building from the instructions, but shout (or correct them) if it doesn't work for any particular situation. If anyone has Oracle and wants to update the section on building with support for that then please do so. It links to a remote site that is now five years old. I don't have a copy of Oracle (hey, it's not free) so can't update that. At some point I plan to add instructions for building clean packages using sbuild as well. The current instructions are fine for installing on the same machine it was built on, but not good for distribution. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 3

Issue with building FR 3.0.x packages on Ubuntu 14.04
by Alex Sharaz 31 Mar '16

31 Mar '16

This has been with me for a while. When ever I try building packages I end up with *dh_installdirs install -d debian/freeradi* *us/var/tmp/freera**dius-server-3.0**.x-290316/debia**n/freeradius.di**rs: 1: /var/tmp/freera**dius-server-3.0**.x-290316/debia**n/freeradius.di**rs: usr/lib/freerad* *ius: not found/var/tmp/freera**dius-server-3.0**.x-290316/debia* *n/freeradius.di**rs: 2: /var/tmp/freera**dius-server-3.0**.x-290316/debia* *n/freeradius.di**rs: var/log/freerad* *ius: not founddh_installdirs: problem reading debian/freeradi* *us.dirs:make: * [install-arch] Error 127dpkg-buildpacka**ge: error: fakeroot debian/rules binary gave error exit status 2* Eventually gave up and went to talk to helpful linux systems person upstairs. Here's what he said ..... The only changes I made were to remove execute permission from a lot of the files in debian/, which seems to affect how the dh suite treats the files. That's probably dependent on the version of the build utilities, but they shouldn't have random execute permissions on things, really. *chmod -x debian/*.{docs,**examples,instal**l,lintian-overr* *ides,manpages,p**ostinst,postrm,**preinst,prerm}* *chmod -x debian/README.** Those are the changes after unpacking; then I literally did *fakeroot dpkg-buildpacka**ge -b -us -uc* ..... then another message saying ... ..and here's the change to the build tools which made this all break! https://anonscm.debian.org/git/debhelper/debhelper.git/commit/?h=9.20120115… If the FR folk want to fix this, they should either (a) fix the file permissions under debian/ as mentioned above, or they should change debian/compat to "8" instead of "9"..... I've just changed debian/compat to "8" and ....... package files built successfully on Ubuntu 14.04 AND on my Raspberry Pi 3 running Ubuntu MATE

5 7

Multiple SQL DB for different authentication sources
by Max .M 31 Mar '16

31 Mar '16

Hi, i'm just wondering if what I have in mind is feasible. If it is, i'd really appreciate being pointed to the right direction or documentation :) I need to have 3 different SQL databases which will be used for authentication of different sites. How can I use a particular SQL DB for a particular Client ? E.G. : 1 db would be used for guest authentication and another db would be used for other internal authentication stuff. Thanks a lot !

3 3

Attribute to show authentication method
by Jonathan Gazeley 31 Mar '16

31 Mar '16

Is there an easy well to determin in post-auth which authentication method was used to authenticate a user? We have a fairly complex setup where a user can be "authenticated" by MAC address in the Authorize section or via EAP-TLS or EAP-PEAP, both with their own virtual servers. In the outer post-auth I want to call a logging module that explicitly says how the user was authenticated but I can't find an attribute which I can reliably check. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

3 4

CA.all
by Tevfik Ceydeliler 31 Mar '16

31 Mar '16

CA. all file is old file and not exist in newer freeradius source ? Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz. The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

FreeRADIUS 3.1.x not changing the status of a failed home server
by Donald Sherker 31 Mar '16

31 Mar '16

I am testing 3.1.x and I have a proxy server that will forward access-requests to a realm containing two home servers. If one of the home servers fails to respond the proxy server is not marking it a zombie, and does not start sending status-server checks to see if the failed server recovers. The proxy server is configured to sent status-server checks. The pool the home servers are in is using keyed-balance. All of the servers in question are running 3.1.x. Please let me know if you need any more configuration information on the proxy, or home servers. Mar 17 10:39:26 (231) Received Access-Request Id 26 from X.X.X.X:50708 to Y.Y.Y.Y:1812 via eth0 length 199 Mar 17 10:39:26 (231) User-Name = "User-Name" Mar 17 10:39:26 (231) NAS-IP-Address = X.X.X.X Mar 17 10:39:26 (231) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:26 (231) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:26 (231) NAS-Port = 0 Mar 17 10:39:26 (231) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:26 (231) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:26 (231) Acct-Session-Id = "56EABCC1-0000000D" Mar 17 10:39:26 (231) Framed-MTU = 1400 Mar 17 10:39:26 (231) EAP-Message = 0x02a3000d017161726573646f6e Mar 17 10:39:26 (231) Location-Capable = 3 Mar 17 10:39:26 (231) HS20-AP-Version = 1 Mar 17 10:39:26 (231) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:26 (231) Message-Authenticator = 0x20ddbd35221f67aeb9f8c2fa0cdded10 Mar 17 10:39:26 (231) Running section authorize from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:26 (231) authorize { Mar 17 10:39:26 (231) if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) { Mar 17 10:39:26 (231) update control { Mar 17 10:39:26 (231) EXPAND %{Calling-Station-Id} Mar 17 10:39:26 (231) --> 10417f1906f1 Mar 17 10:39:26 (231) &control:Load-Balance-Key := 10417f1906f1 Mar 17 10:39:26 (231) } # update control (noop) Mar 17 10:39:26 (231) } # if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) (noop) Mar 17 10:39:26 (231) else { Mar 17 10:39:26 (231) ... skipping else for request 231: Preceding "if" was taken Mar 17 10:39:26 (231) } Mar 17 10:39:26 (231) if (&User-Name == 'anonymous@realm0') { Mar 17 10:39:26 (231) ... Mar 17 10:39:26 (231) } Mar 17 10:39:26 (231) else { Mar 17 10:39:26 (231) update request { Mar 17 10:39:26 (231) &Login-Method := 802.1x Mar 17 10:39:26 (231) } # update request (noop) Mar 17 10:39:26 (231) } # else (noop) Mar 17 10:39:26 (231) preprocess (ok) Mar 17 10:39:26 (231) cui.authorize { Mar 17 10:39:26 (231) if ("%{client:add_cui}" == 'yes') { Mar 17 10:39:26 (231) EXPAND %{client:add_cui} Mar 17 10:39:26 (231) --> yes Mar 17 10:39:26 (231) update request { Mar 17 10:39:26 (231) &Chargeable-User-Identity := 0x00 Mar 17 10:39:26 (231) } # update request (noop) Mar 17 10:39:26 (231) } # if ("%{client:add_cui}" == 'yes') (noop) Mar 17 10:39:26 (231) } # cui.authorize (noop) Mar 17 10:39:26 (231) if (&User-Name =~ /anonymous.*(a)provider1\.com/) { Mar 17 10:39:26 (231) ... Mar 17 10:39:26 (231) } Mar 17 10:39:26 (231) elsif (&User-Name != "healthcheck") { Mar 17 10:39:26 (231) update control { Mar 17 10:39:26 (231) &control:Proxy-To-Realm := proxyrealm0 Mar 17 10:39:26 (231) } # update control (noop) Mar 17 10:39:26 (231) } # elsif (&User-Name != "healthcheck") (noop) Mar 17 10:39:26 (231) files - Found match "DEFAULT" one line 243 of /usr/local/etc/raddb/mods-config/files/authorize Mar 17 10:39:26 (231) files (ok) Mar 17 10:39:26 (231) suffix - Checking for suffix after "@" Mar 17 10:39:26 (231) suffix - No '@' in User-Name = "User-Name", looking up realm NULL Mar 17 10:39:26 (231) suffix - No such realm "NULL" Mar 17 10:39:26 (231) suffix (noop) Mar 17 10:39:26 (231) expiration (noop) Mar 17 10:39:26 (231) logintime (noop) Mar 17 10:39:26 (231) pap (noop) Mar 17 10:39:26 (231) } # authorize (ok) Mar 17 10:39:26 (231) Running section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:26 (231) pre-proxy { Mar 17 10:39:26 (231) cui.pre-proxy { Mar 17 10:39:26 (231) if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) { Mar 17 10:39:26 (231) EXPAND %{request:Packet-Type} Mar 17 10:39:26 (231) --> Access-Request Mar 17 10:39:26 (231) EXPAND %{client:add_cui} Mar 17 10:39:26 (231) --> yes Mar 17 10:39:26 (231) update proxy-request { Mar 17 10:39:26 (231) &proxy-request:Chargeable-User-Identity = 0x00 Mar 17 10:39:26 (231) } # update proxy-request (noop) Mar 17 10:39:26 (231) } # if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) (noop) Mar 17 10:39:26 (231) } # cui.pre-proxy (noop) Mar 17 10:39:26 (231) } # pre-proxy (noop) Mar 17 10:39:26 (231) Proxying request to home server Z.Z.Z.Z port 1812 timeout 20.000000 Mar 17 10:39:26 (231) Sent Access-Request Id 59 from 0.0.0.0:36831 to Z.Z.Z.Z:1812 length 212 Mar 17 10:39:26 (231) User-Name = "User-Name" Mar 17 10:39:26 (231) NAS-IP-Address = X.X.X.X Mar 17 10:39:26 (231) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:26 (231) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:26 (231) NAS-Port = 0 Mar 17 10:39:26 (231) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:26 (231) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:26 (231) Acct-Session-Id = "56EABCC1-0000000D" Mar 17 10:39:26 (231) Framed-MTU = 1400 Mar 17 10:39:26 (231) EAP-Message = 0x02a3000d017161726573646f6e Mar 17 10:39:26 (231) Location-Capable = 3 Mar 17 10:39:26 (231) HS20-AP-Version = 1 Mar 17 10:39:26 (231) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:26 (231) Message-Authenticator = 0x20ddbd35221f67aeb9f8c2fa0cdded10 Mar 17 10:39:26 (231) Event-Timestamp = "Mar 17 2016 10:39:26 EDT" Mar 17 10:39:26 (231) Chargeable-User-Identity := 0x00 Mar 17 10:39:26 (231) Proxy-State = 0x3236 Mar 17 10:39:26 Thread 5 waiting to be assigned a request Mar 17 10:39:27 (231) Expecting proxy response no later than 19.668615 seconds from now Mar 17 10:39:27 Waking up in 0.3 seconds. Mar 17 10:39:27 Thread 5 handling request 231, (251 handled so far) Mar 17 10:39:27 (231) Clearing existing &reply: attributes Mar 17 10:39:27 (231) Found Post-Proxy-Type Fail-Authentication Mar 17 10:39:27 (231) Post-Proxy-Type sub-section not found. Ignoring. Mar 17 10:39:27 (231) Login incorrect (Home Server failed to respond): [User-Name] (from client Client-A.A.A.A port 0 cli 10417f1906f1) Mar 17 10:39:27 (231) There was no response configured: rejecting request Mar 17 10:39:27 (231) Using Post-Auth-Type Reject Mar 17 10:39:27 (231) Running Post-Auth-Type Reject from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:27 (231) Post-Auth-Type REJECT { Mar 17 10:39:27 (231) attr_filter.access_reject - EXPAND %{User-Name} Mar 17 10:39:27 (231) attr_filter.access_reject - --> User-Name Mar 17 10:39:27 (231) attr_filter.access_reject - Matched entry DEFAULT at line 11 Mar 17 10:39:27 (231) attr_filter.access_reject (updated) Mar 17 10:39:27 (231) remove_reply_message_if_eap { Mar 17 10:39:27 (231) if (&reply:EAP-Message && &reply:Reply-Message) { Mar 17 10:39:27 (231) ... Mar 17 10:39:27 (231) } Mar 17 10:39:27 (231) else { Mar 17 10:39:27 (231) noop (noop) Mar 17 10:39:27 (231) } # else (noop) Mar 17 10:39:27 (231) } # remove_reply_message_if_eap (noop) Mar 17 10:39:27 (231) } # Post-Auth-Type REJECT (updated) Mar 17 10:39:27 (231) Sent Access-Reject Id 26 from Y.Y.Y.Y:1812 to X.X.X.X:50708 via eth0 length 0 Mar 17 10:39:27 (231) Finished request Mar 17 10:39:27 Thread 5 waiting to be assigned a request Mar 17 10:39:27 Waking up in 4.6 seconds. Mar 17 10:39:28 Waking up in 0.3 seconds. Mar 17 10:39:28 Thread 5 handling request 232, (252 handled so far) Mar 17 10:39:28 (232) Received Access-Request Id 27 from X.X.X.X:50708 to Y.Y.Y.Y:1812 via eth0 length 199 Mar 17 10:39:28 (232) User-Name = "User-Name" Mar 17 10:39:28 (232) NAS-IP-Address = X.X.X.X Mar 17 10:39:28 (232) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:28 (232) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:28 (232) NAS-Port = 0 Mar 17 10:39:28 (232) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:28 (232) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:28 (232) Acct-Session-Id = "56EABCC1-0000000E" Mar 17 10:39:28 (232) Framed-MTU = 1400 Mar 17 10:39:28 (232) EAP-Message = 0x025d000d017161726573646f6e Mar 17 10:39:28 (232) Location-Capable = 3 Mar 17 10:39:28 (232) HS20-AP-Version = 1 Mar 17 10:39:28 (232) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:28 (232) Message-Authenticator = 0xc390ccf8b070c383d30e99baf1025738 Mar 17 10:39:28 (232) Running section authorize from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:28 (232) authorize { Mar 17 10:39:28 (232) if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) { Mar 17 10:39:28 (232) update control { Mar 17 10:39:28 (232) EXPAND %{Calling-Station-Id} Mar 17 10:39:28 (232) --> 10417f1906f1 Mar 17 10:39:28 (232) &control:Load-Balance-Key := 10417f1906f1 Mar 17 10:39:28 (232) } # update control (noop) Mar 17 10:39:28 (232) } # if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) (noop) Mar 17 10:39:28 (232) else { Mar 17 10:39:28 (232) ... skipping else for request 232: Preceding "if" was taken Mar 17 10:39:28 (232) } Mar 17 10:39:28 (232) if (&User-Name == 'anonymous@realm0') { Mar 17 10:39:28 (232) ... Mar 17 10:39:28 (232) } Mar 17 10:39:28 (232) else { Mar 17 10:39:28 (232) update request { Mar 17 10:39:28 (232) &Login-Method := 802.1x Mar 17 10:39:28 (232) } # update request (noop) Mar 17 10:39:28 (232) } # else (noop) Mar 17 10:39:28 (232) preprocess (ok) Mar 17 10:39:28 (232) cui.authorize { Mar 17 10:39:28 (232) if ("%{client:add_cui}" == 'yes') { Mar 17 10:39:28 (232) EXPAND %{client:add_cui} Mar 17 10:39:28 (232) --> yes Mar 17 10:39:28 (232) update request { Mar 17 10:39:28 (232) &Chargeable-User-Identity := 0x00 Mar 17 10:39:28 (232) } # update request (noop) Mar 17 10:39:28 (232) } # if ("%{client:add_cui}" == 'yes') (noop) Mar 17 10:39:28 (232) } # cui.authorize (noop) Mar 17 10:39:28 (232) if (&User-Name =~ /anonymous.*(a)provider1\.com/) { Mar 17 10:39:28 (232) ... Mar 17 10:39:28 (232) } Mar 17 10:39:28 (232) elsif (&User-Name != "healthcheck") { Mar 17 10:39:28 (232) update control { Mar 17 10:39:28 (232) &control:Proxy-To-Realm := proxyrealm0 Mar 17 10:39:28 (232) } # update control (noop) Mar 17 10:39:28 (232) } # elsif (&User-Name != "healthcheck") (noop) Mar 17 10:39:28 (232) files - Found match "DEFAULT" one line 243 of /usr/local/etc/raddb/mods-config/files/authorize Mar 17 10:39:28 (232) files (ok) Mar 17 10:39:28 (232) suffix - Checking for suffix after "@" Mar 17 10:39:28 (232) suffix - No '@' in User-Name = "User-Name", looking up realm NULL Mar 17 10:39:28 (232) suffix - No such realm "NULL" Mar 17 10:39:28 (232) suffix (noop) Mar 17 10:39:28 (232) expiration (noop) Mar 17 10:39:28 (232) logintime (noop) Mar 17 10:39:28 (232) pap (noop) Mar 17 10:39:28 (232) } # authorize (ok) Mar 17 10:39:28 (232) Running section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:28 (232) pre-proxy { Mar 17 10:39:28 (232) cui.pre-proxy { Mar 17 10:39:28 (232) if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) { Mar 17 10:39:28 (232) EXPAND %{request:Packet-Type} Mar 17 10:39:28 (232) --> Access-Request Mar 17 10:39:28 (232) EXPAND %{client:add_cui} Mar 17 10:39:28 (232) --> yes Mar 17 10:39:28 (232) update proxy-request { Mar 17 10:39:28 (232) &proxy-request:Chargeable-User-Identity = 0x00 Mar 17 10:39:28 (232) } # update proxy-request (noop) Mar 17 10:39:28 (232) } # if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) (noop) Mar 17 10:39:28 (232) } # cui.pre-proxy (noop) Mar 17 10:39:28 (232) } # pre-proxy (noop) Mar 17 10:39:28 (232) Proxying request to home server Z.Z.Z.Z port 1812 timeout 20.000000 Mar 17 10:39:28 (232) Sent Access-Request Id 194 from 0.0.0.0:36831 to Z.Z.Z.Z:1812 length 212 Mar 17 10:39:28 (232) User-Name = "User-Name" Mar 17 10:39:28 (232) NAS-IP-Address = X.X.X.X Mar 17 10:39:28 (232) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:28 (232) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:28 (232) NAS-Port = 0 Mar 17 10:39:28 (232) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:28 (232) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:28 (232) Acct-Session-Id = "56EABCC1-0000000E" Mar 17 10:39:28 (232) Framed-MTU = 1400 Mar 17 10:39:28 (232) EAP-Message = 0x025d000d017161726573646f6e Mar 17 10:39:28 (232) Location-Capable = 3 Mar 17 10:39:28 (232) HS20-AP-Version = 1 Mar 17 10:39:28 (232) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:28 (232) Message-Authenticator = 0xc390ccf8b070c383d30e99baf1025738 Mar 17 10:39:28 (232) Event-Timestamp = "Mar 17 2016 10:39:28 EDT" Mar 17 10:39:28 (232) Chargeable-User-Identity := 0x00 Mar 17 10:39:28 (232) Proxy-State = 0x3237 Mar 17 10:39:28 Thread 5 waiting to be assigned a request Mar 17 10:39:28 Waking up in 0.3 seconds. Mar 17 10:39:28 Waking up in 0.3 seconds. Mar 17 10:39:28 Thread 5 handling request 233, (253 handled so far) Mar 17 10:39:28 Thread 5 waiting to be assigned a request Mar 17 10:39:29 (232) Expecting proxy response no later than 19.668392 seconds from now Mar 17 10:39:29 Thread 5 handling request 232, (254 handled so far) Mar 17 10:39:29 (232) Clearing existing &reply: attributes Mar 17 10:39:29 (232) Found Post-Proxy-Type Fail-Authentication Mar 17 10:39:29 (232) Post-Proxy-Type sub-section not found. Ignoring. Mar 17 10:39:29 (232) Login incorrect (Home Server failed to respond): [User-Name] (from client Client-A.A.A.A port 0 cli 10417f1906f1) Mar 17 10:39:29 (232) There was no response configured: rejecting request Mar 17 10:39:29 (232) Using Post-Auth-Type Reject Mar 17 10:39:29 (232) Running Post-Auth-Type Reject from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:29 (232) Post-Auth-Type REJECT { Mar 17 10:39:29 (232) attr_filter.access_reject - EXPAND %{User-Name} Mar 17 10:39:29 (232) attr_filter.access_reject - --> User-Name Mar 17 10:39:29 (232) attr_filter.access_reject - Matched entry DEFAULT at line 11 Mar 17 10:39:29 (232) attr_filter.access_reject (updated) Mar 17 10:39:29 (232) remove_reply_message_if_eap { Mar 17 10:39:29 (232) if (&reply:EAP-Message && &reply:Reply-Message) { Mar 17 10:39:29 (232) ... Mar 17 10:39:29 (232) } Mar 17 10:39:29 (232) else { Mar 17 10:39:29 (232) noop (noop) Mar 17 10:39:29 (232) } # else (noop) Mar 17 10:39:29 (232) } # remove_reply_message_if_eap (noop) Mar 17 10:39:29 (232) } # Post-Auth-Type REJECT (updated) Mar 17 10:39:29 (232) Sent Access-Reject Id 27 from Y.Y.Y.Y:1812 to X.X.X.X:50708 via eth0 length 0 Mar 17 10:39:29 (232) Finished request Mar 17 10:39:29 Thread 5 waiting to be assigned a request Mar 17 10:39:29 Waking up in 0.3 seconds. Mar 17 10:39:29 Waking up in 2.4 seconds. Mar 17 10:39:30 Waking up in 0.3 seconds. Mar 17 10:39:30 Thread 5 handling request 234, (255 handled so far) Thanks, Don

2 2

proxy accounting to two other radius servers
by Bill Schoolfield 31 Mar '16

31 Mar '16

I have a accounting only proxy in place to a single radius server. Works fine. I now need to proxy certain accounting packets to another server. Both request types have the same realm but there is a unique suffix to the username portion. I looked over the docs but I can't seem to figure out how to modify the configuration to do this. Can someone point me in the right direction? Bill

2 3