- Freeradius-Users - lists.freeradius.org

RE: Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Thanks Arran, I can certainly test it. Quite happy to do extended testing if you want me to also. Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 12 November 2015 16:10 To: FreeRadius users mailing list Subject: Re: Attributes not being copied to inner tunnel > On 12 Nov 2015, at 09:49, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Thanks Alan! I'll try any updating to see what happens. > Most of the Siemens attributes are copied, just not these two, it's odd. That's really weird... It's just a string. In the new attribute tree it looks correct... VENDOR "Siemens" vendor: 0 (0), num: 10e9 (4329), type: vendor, flags: ATTRIBUTE "Siemens-URL-Redirection" vendor: 10e9 (4329), num: 1 (1), type: string, flags: is_pointer ATTRIBUTE "Siemens-AP-Name" vendor: 10e9 (4329), num: 2 (2), type: string, flags: is_pointer ATTRIBUTE "Siemens-AP-Serial" vendor: 10e9 (4329), num: 3 (3), type: string, flags: is_pointer The dictionary code is about to get a large update to allow deeply nested TLVs, so that may fix it. Probably push the changes later today. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

chap authenticatin fail
by Yukou Katori 12 Nov '15

12 Nov '15

Hi, Sorry for my basic question though, I'm setting up chap-md5 authentication FreeRadius3 with traffic tester (Spirent). But authentication failed. [topo] tester ----- (pppoe) --- authenticator --- (radius) --- FR3 [issue] <-pppoe, lcp -> OK <------------------- challenge -------------------> response ------------------> radius rewuest <------ radius reject!!! I tried local test with "radtest -x -4 -t chap user1@yk testing! 127.0.0.1 1812 testing123", and it worked (authenticaton success). On the tester, I configured "user@yk" as ID and "testing!" as PW and "chap md5 authenticaton" as method. Then I saw chap failure as follows (summary by wireshark): Sending challenge : Challenge (NAME='R3', VALUE=0x457e20c349a6c2bd) Response challenge : Response (NAME='user1@yk', VALUE=0x9e913a644c3c15e78d31a540f5d8e90b) Sending Radius-Req : Access-Request(1) (id=58, l=77) Responding Radius-Rej : Access-Reject(3) (id=58, l=20) >From debug: Fri Nov 13 00:08:28 2015 : Debug: (0) Found Auth-Type = CHAP Fri Nov 13 00:08:28 2015 : Debug: (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Fri Nov 13 00:08:28 2015 : Debug: (0) Auth-Type CHAP { Fri Nov 13 00:08:28 2015 : Debug: (0) modsingle[authenticate]: calling chap (rlm_chap) for request 0 Fri Nov 13 00:08:28 2015 : ERROR: (0) chap: &control:Cleartext-Password is required for authentication Fri Nov 13 00:08:28 2015 : Debug: (0) modsingle[authenticate]: returned from chap (rlm_chap) for request 0 Fri Nov 13 00:08:28 2015 : Debug: (0) [chap] = fail Fri Nov 13 00:08:28 2015 : Debug: (0) } # Auth-Type CHAP = fail Fri Nov 13 00:08:28 2015 : Debug: (0) Failed to authenticate the user Fri Nov 13 00:08:28 2015 : Auth: (0) Login incorrect (chap: &control:Cleartext-Password is required for authentication): [user1@yk] (from client R3 port 0) Of course, I set "Cleartext-Password" Home$raddb/users too. I tried lots of combination on it, so I omit the configuraton of it. What does "ERROR: (0) chap: &control:Cleartext-Password is required for authentication" mean first of all... I made sure to configure "Cleartext-Password". I just thought if each PW between pppoe client and server is identical, that works successfully as chap authentication. Is there any parameter I should care about when configuring chap authentication? Regards, yk

2 1

RE: Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Thanks Alan! I'll try any updating to see what happens. Most of the Siemens attributes are copied, just not these two, it's odd. > I'd try the v3.1.x head. But the code copies everything... it doesn't care which attributes are being copied. So it's a little weird that only Siemens attributes aren't copied. > I'll take a look later today and see if I can reproduce it. > Alan DeKok.

2 1

Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Hi all, This is probably obvious but I can't understand it! FR 3.1 from git, although not updated for a little while.. When the inner tunnel is called in PEAP/mschapv2, some of the attrs from our request aren't making their way through. Extreme wireless (siemens), the Siemens-AP-Name and Siemens-AP-Serial attributes seem to be missing, unfortunately we use/record some of these otherwise it wouldn't be a problem. My pre-proxy section has the attr_filter.pre-proxy commented out.. PEAP module tunnel copy is enabled (see bottom) Sorry for the regular "help me!" posts, still learning! Thanks Andy Starting request: (10) Received Access-Request Id 187 from 192.168.116.10:52330 to 192.168.176.123:1812 length 421 (10) User-Name = 'SATH\\franksa' (10) NAS-IP-Address = 0.0.0.0 (10) NAS-Port = 106 (10) Framed-MTU = 1400 (10) Called-Station-Id = '20:b3:99:ea:a8:5a' (10) Acct-Session-Id = '5644626401a5' (10) Calling-Station-Id = '00:18:39:0e:77:a2' (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Identifier = 'RSH_WiFi_2_VNS' (10) Service-Type = Framed-User (10) Siemens-AP-Serial = '14351087085D0000' (10) Siemens-AP-Name = 'RSH-AP1125' (10) Siemens-VNS-Name = 'RSH_WiFi_2_VNS' (10) Siemens-SSID = 'RSH_WiFi_2' (10) Siemens-BSS-MAC = '20:b3:99:ea:a8:5a' (10) Siemens-Policy-Name = 'No_Access' (10) Siemens-Topology-Name = 'VLAN200_AP_T' Proxy: (10) EAP-Message = 0x020900471a020900423151ad822a193537467947d21c25db073300000000000000001f4ec99cdb09ee5c7421b6264c4f5cc10e5c0c2db2c039bf00534154485c4652414e4b5341 (10) FreeRADIUS-Proxied-To = 127.0.0.1 (10) User-Name = 'SATH\\franksa' (10) State = 0xd86926bed9603cd4e2325db6a06e5230 (10) NAS-IP-Address = 0.0.0.0 (10) NAS-Port = 106 (10) Framed-MTU = 1400 (10) Called-Station-Id = '20:b3:99:ea:a8:5a' (10) Acct-Session-Id = '5644626401a5' (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Identifier = 'RSH_WiFi_2_VNS' (10) Service-Type = Framed-User (10) Siemens-VNS-Name = 'RSH_WiFi_2_VNS' (10) Siemens-SSID = 'RSH_WiFi_2' (10) Siemens-BSS-MAC = '20:b3:99:ea:a8:5a' (10) Siemens-Policy-Name = 'No_Access' (10) Siemens-Topology-Name = 'VLAN200_AP_T' (10) Calling-Station-Id := '00-18-39-0e-77-a2' PEAP section of relevant EAP mod: peap { tls = tls-common default_eap_type = tls copy_request_to_tunnel = yes use_tunnelled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" # EAP-TLS-Require-Client-Cert = Yes # require_client_cert = yes }

3 2

RE: If block in authenticate statement
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Hi, Sorry I didn't complete this email the other day.. I didn't realise you could set the EAP-Type to force the inner, that's great - thanks, it seems there are a good few better ways than an IF .. in the auth section. As for the authenticate bit, just for learning sake, and theory, should the below work? It seems daft putting if (ok) { ok } in there , but putting the explicit ok in anywhere else didn't seem to work, but this doesn't either. The mschap auth seems to be called from the Auth-Type inner-eap as a "sub-auth", and here I have a module catch for other failures, but not for ok : It's still doing a noop (I've edited the mschap script call out, which complete ok, just to keep the mail shorter): if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) { (12) eap_mschapv2: if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) -> TRUE (12) eap_mschapv2: if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) { .. .. mschap: Adding MS-CHAPv2 MPPE keys (12) [mschap] = ok (12) if ok { (12) if ok -> TRUE (12) if ok { (12) [ok] = ok (12) } # if ok = ok (12) ... skipping else for request 12: Preceding "if" was taken (12) } # if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) = ok (12) ... skipping else for request 12: Preceding "if" was taken (12) } # Auth-Type MS-CHAP = noop (12) inner-eap: Freeing handler (12) [inner-eap] = reject Auth-Type inner-eap { inner-eap { reject = 1 invalid = 1 } if (!ok) { ... Auth-Type MS-CHAP { # get ssid so we can check against mschapv2 allowed ssids get_ssid # allowed ssids. Commented out 06-11-2015 due to return status issues. if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) { mschap { reject = 1 invalid = 1 } if ok { ok } else { if (Module-Failure-Message) { # Could be that we've got a failure message or just debug information, depending on whether mschap i$ # seems sometimes that the failure goes straight to reject, sometimes via the outer tunnel which is $ # tunnel (above in mschap), and the outer anyway, so should be ok. update outer.control { Debug-RejectInformation := "%{Module-Failure-Message}" } } reject } } else { update control { Debug-RejectInformation := "PEAP - EAP - MSCHAPv2 not allowed!" } reject } } -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 09 November 2015 13:45 To: FreeRadius users mailing list Subject: Re: If block in authenticate statement On Nov 9, 2015, at 8:28 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > I did try the OK bit at the end of the module, but it still returns noop, which is what confuses me. What was the exact configuration you tried? > Whether I did the ok bit in the correct place is debateable but I did try it in the logical places. Does the ok placement need to be after an "else" statement? It needs to be wherever you want to set the return code to be "ok". > Anyway, onto why - I don't want to flat reject people using that SSID, just people who use PEAP and use mschapv2 (instead of TLS) on certain SSIDs. In certain circumstances I might want them to be allowed if they bring me sweets at Christmas for example. Then configure that... authorize { ... eap ... if ((SSID == "no-peap") && (EAP-Type == PEAP)) { reject } ... } Or, you can do the same thing in the inner tunnel. But realistically, why ban certain configurations? Why not configure the client correctly? And then configure the server to use only one authentication method? > The problem is we (afaik) don't find out what the auth type is until the authorize stage where that module (eap in this case) sets it, and the inner auth type here is a few layers into the onion, that's why it sort of made sense to me to do it at "final" authenticate stage. I could probably also do it post-auth too I guess, pass it then check and reject.. That would work, too. Or, you could just set EAP-Type for particular users. server inner-tunnel { authorize { ... if (WiFi == "no-inner-mschap") { update control { EAP-Type := TLS # force outer PEAP, inner TLS } } ... eap ... } } > The custom debug message was an "overall" delivery message to the indicate why failure had occurred at any point in the chain. Module-Failure-Message only works on certain modules afaik (or did when I last asked) so failures in certain areas would yield blanks. I'd quite happily ditch that if all modules do it now! Most should... more do in v3.1.x. > I also think (from unreliable memory) that I had issues copying some of the attributes from inner to outer, some worked and some didn't - does the module-failure-message get automatically copied now from inner to outer layer? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

True on the dev code learning but we are using nice things like if (Attr[*] == ..), some nice changes in ldap for caching group and so on and I'm not sure if the codes has been merged into stable. Something to try though I guess! Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Matthew Newton Sent: 12 November 2015 12:28 To: FreeRadius users mailing list Subject: Re: Attributes not being copied to inner tunnel On Thu, Nov 12, 2015 at 10:29:50AM +0000, Franks Andy (IT Technical Architecture Manager) wrote: > FR 3.1 from git, although not updated for a little while.. You're probably best not learning on development code... > Sorry for the regular "help me!" posts, still learning! Does it work on latest stable (3.0.x) code? If so then may be a bug in 3.1. Though most of that code hasn't changed in 5 years. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Using OpenWRT nas, identical shared secret, told "Shared secret is incorrect."
by Toyam Cox 11 Nov '15

11 Nov '15

Hey folks, Using FreeRadius on OpenBSD, version 2.2.7. I'm using a OpenWRT based nas client, identical shared secret, be it "testsecret" "secret1" "supersecure" or whatever, I'm told "Shared secret is incorrect." Below is my radiusd -X (Wow, my database password is in there. Glad I don't care about it) and the relevant configuration details on both the NAS table in Postgresql and the wireless configuration on the OpenWRT box. radiusd: FreeRADIUS Version 2.2.7, for host x86_64-unknown-openbsd5.8, built on Aug 8 2015 at 13:06:28 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/postgresql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "_freeradius" group = "_freeradius" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file KQ@?D? modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Loading virtual module filter_username Module: Linked to module rlm_always Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/raddb/modules/detail.log detail auth_log { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "radius" password = "J89DtRVV0m7kOAXPmDQ10BEqCYYTiagwJ/1yyoIRMPlJMvfq8b68bZVBosAzvWZw/pDe4uOaTbVf" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT, AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = NULLIF('%{Acct-Session-Time}','')::BIGINT, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_update_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}','')::BIGINT, '%{Acct-Authentic}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctStartDelay = 0, ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN (EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE NULLIF('%{Acct-Session-Time}','')::BIGINT END, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}', '%{Connect-Info}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0)" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #27 rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radius@localhost:radius rlm_sql (sql): Failed to connect DB handle #27 rlm_sql (sql): starting 28 rlm_sql (sql): starting 29 rlm_sql (sql): starting 30 rlm_sql (sql): starting 31 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Ignoring unconnected handle 31.. rlm_sql (sql): Ignoring unconnected handle 30.. rlm_sql (sql): Ignoring unconnected handle 29.. rlm_sql (sql): Ignoring unconnected handle 28.. rlm_sql (sql): Ignoring unconnected handle 27.. rlm_sql (sql): Reserving sql socket id: 26 rlm_sql (sql): got socket 26 after skipping 5 unconnected handles, tried to reconnect 0 though rlm_sql_postgresql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 6 rlm_sql (sql): Read entry nasname=10.0.0.10,shortname=frank,secret=secret_shared rlm_sql (sql): Adding client 10.0.0.10 (frank, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 26 Module: Linked to module rlm_counter Module: Instantiating module "daily" from file /etc/raddb/modules/counter counter daily { filename = "/etc/raddb/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11273 rlm_counter: Current Time: 1447234857 [2015-11-11 04:40:57], Next reset 1447304400 [2015-11-12 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.10 port 2071, id=0, length=127 Received packet from 10.0.0.10 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. Cleaning up request 0 ID 0 with timestamp +20 Ready to process requests. Seeing NAS configuration: SELECT * FROM nas; id | nasname | shortname | type | ports | secret | server | community | description ----+-----------+-----------+-------+-------+---------------+--------+-----------+---------------------- 1 | 10.0.0.10 | frank | other | | secret_shared | | | Wifi on Frank (1 row) Wireless settings on the AP (OpenWRT device): root@frank:~# uci show wireless wireless.wl0=wifi-device wireless.wl0.type=broadcom wireless.wl0.channel=11 wireless.@wifi-iface[0]=wifi-iface wireless.(a)wifi-iface[0].device=wl0 wireless.(a)wifi-iface[0].network=lan wireless.(a)wifi-iface[0].mode=ap wireless.(a)wifi-iface[0].ssid=CleverSSID wireless.(a)wifi-iface[0].encryption=wpa2 wireless.(a)wifi-iface[0].server=10.0.0.5 wireless.(a)wifi-iface[0].key=secret_shared

5 12

Fw: new message
by jerzykolosowski＠poczta.onet.pl 11 Nov '15

11 Nov '15

Hey! New message, please read <http://theilovemesomemeexperience.com/should.php?au0> jerzykolosowski(a)poczta.onet.pl --- لقد تم التحقق من خلو هذا البريد الإلكتروني من الفيروسات بواسطة برنامج أفاست مضاد الفيروسات. https://www.avast.com/antivirus

1 0

Fw: new message
by Business Director 11 Nov '15

11 Nov '15

Hey! New message, please read <http://rxforhope.com/cut.php?54hqd> Business Director

1 0

Different IP Pool for different group user
by Yanrui Hu 11 Nov '15

11 Nov '15

Guys, Let me explain my problem briefly. I want different group user get different ip pool. Here is the settings: *===users* DEFAULT Pool-Name := "tc_pool" Fall-Through = Yes *===sites-enabled/default* post_auth...... if (SQL-Group == "restricted") { tc_pool } else { main_pool } *===modules/ippool* ippool main_pool { range-start = 172.16.10.1 range-stop = 172.16.10.254 netmask = 255.255.255.0 cache-size = 254 session-db = ${raddbdir}/db.ipmainpool ip-index = ${raddbdir}/db.ipmainindex override = no maximum-timeout = 0 } ippool tc_pool { range-start = 172.26.11.1 range-stop = 172.26.11.254 netmask = 255.255.255.0 cache-size = 254 session-db = ${raddbdir}/db.ipsecondary26pool ip-index = ${raddbdir}/db.ipsecondary26index override = no maximum-timeout = 0 } *Test result, if use a user in restricted group. There will be a Frame_IP_address in access_accept.* *But if a user not in this group, the radius log is:* ? Evaluating (SQL-Group == "restricted") -> FALSE ++? if (SQL-Group == "restricted") -> FALSE ++else else { +++[main_pool] = noop ++} # else else = noop ...... Sending Access-Accept of id 140 to 127.0.0.1 port 60577 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xb4c7f85ed7a94628e635e6b7d933c39a MS-MPPE-Recv-Key = 0x024db770d98a83bdf54a7512e8f4a4ad EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "3dd5ac675d704831a89e2475f97f575f" Finished request 2. -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

1 0