- Freeradius-Users - lists.freeradius.org

Alive sessions in radacct table
by Anisa Allahdadi 30 Sep '15

30 Sep '15

Hi all, My FreeRADIUS is up and running. However, in 'radacct' table, there are only 'acctstarttime' and 'acctstoptime' being recorded, how about 'alive'? In the real world situation we can record Alive sessions every 10-15 min. Could anybody tell me if it is possible in FreeRADIUS as well? Many thanks Anisa

7 28

buffered_sql problem
by Ricardo Larrañaga 29 Sep '15

29 Sep '15

Hello Guys: I was wondering if you could help me with an issue that i am having with my buffered_sql configuration. I am using freeradius 3.0.4, under centos 7, and with buffered sql configuration, and since 3 days ago, no accounting records are being imported into my database. detail and detail.work files are in the proper directory, but detail.work keeps growing and it does not look like it is offloading any data to the DB, Almost like buffered_sql would not be reading the detail.work file anymore. Now, i did run the server in debug mode, and i see the detail.work file being read. I do see one problem with the db insertion of some accounting records. It looks like it looks like some acct records are coming with a acctuniqueid that is already in the db, so those fail, but my question is, will the server keep trying to insert that record and not try any others in the detail.work file? My buffered_sql config is pretty standard: server buffered-sql { listen { type = detail filename = "/buffer_disk/detail" load_factor = 10 poll_interval = 1 retry_interval = 30 } preacct { preprocess acct_unique files } accounting { sql_radacct } The first packet in the detail.work file fails with a db error for having a duplicated acctuniqueid. Will the server continue processing other packets? Will that packet stay in the file? At this point i have a really big amount of packets in the file, and no accounting records on my db, so i am really looking forward to fix this issue. Thanks for any help you could provide. Regards

5 14

Excluding traffic from one ip in accounting
by Randeep 29 Sep '15

29 Sep '15

Hi All, We have a couple of streaming servers in our network. We would like to exclude the traffic from these servers to client from accounting. How we can do that? We tried to put a filter in accounting section when interim accounts is processed. But in interim accounts, only the data usage is receiving. It doesn't have any ip information in those. How can we achieve this. Please suggest. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 11

Accepting expired CA using EAP-TLS
by Alexandros Gougousoudis 29 Sep '15

29 Sep '15

Hi, I'am using FR 2.1.10 für EAP-TLS over Wifi. The problem is, that our CA has expired and I have to renew it (and it seems also all depending certs), but we're a little late with that. The Wifi-Clients can't connect anymore, because FR says that the CA has expired, which also means, I can't install them the new cert. Is there a dirty hack in EAP to make FR ignore this? TIA Alex

3 2

Freeradius with Kamailio integration
by Marian Pandoranum 28 Sep '15

28 Sep '15

Hello, I have a problem regarding the integration between Freeradius and Kamailio. In order to do that I followed this tutorial [1]http://www.kamailio.org/docs/openser-radius-1.0.x.html . Kamailio, radiusclient and freeradius are running on the same machine. My config files includes the following: /etc/raddb/radiusd.conf: ... modules { ... $INCLUDE sql.conf $INCLUDE ${confdir}/modules/ #here I have digest module } /etc/raddb/dictionary: ... $INCLUDE /etc/radiusclient-ng/dictionary.kamailio ... /etc/raddb/clients.conf .... client localhost {... ipaddr = 127.0.0.1,.....secret=mysecret......} In /etc/raddb/sql.conf I have set database to postgresql, server =localhost,...... /etc/raddb/sites-enabled/default : authorize{... sql digest..... } authenticate{... digest.... } accounting{.... sql..... } /etc/radiusclient-ng/radiusclient.conf: authserver and acctserver = localhost seqfile = /var/run/kamailio_radius.seq -----> should I have something set here !? /etc/radiusclient-ng/servers: localhost mysecret ---> Also, I've tried 127.0.0.1 mysecret ---> the result is the same /usr/share/radiusclient-ng/dictionary: $INCLUDE /etc/radiusclient-ng/dictionary.kamailio /etc/kamailio/dictionary.freeradius and /etc/radiusclient-ng/dictionary.kamailio are the same. I am using auth_radius module in kamailio.cfg but when I am running radiusd -X i can't see any requests from Kamailio. Also, I am using radclient command like in the above link...and everything it's OK. I am receiveing : code 2, length = 45 Reply-Message = "Hello, test with digest" Did I miss something in the configuration process ? Thank you for any help you can provide ! References 1. http://www.kamailio.org/docs/openser-radius-1.0.x.html

2 1

EAP authentication and DHCP
by Hernán Freschi 28 Sep '15

28 Sep '15

I would like to authenticate WiFi users with EAP and assign an IP address based on their username. I realize this is a two step process: first, the user must be authenticated with EAP. Once this is done, the user will request an IP address via DHCP. But there is no connection between the EAP username, and the client's MAC address which EAP uses. With EAP, the MAC address is the Calling-Station-ID for the Anonymous identity. The tunneled identity has no ID. Is it possible to use the post-auth section to log both username and MAC, so the DHCP module can look up the username from MAC address, and assign the address from the right pool? By default the post-auth module writes two records to the radpostauth table: one, from the anonymous identity with the Calling-Station-ID set to the MAC address, and another, for the tunneled identity, with an empty calling ID. Thanks, Hernan

3 8

Normalizing MAC address for database storage?
by Hernán Freschi 28 Sep '15

28 Sep '15

I'm trying to use EAP and DHCP together: EAP authenticates the client, the MAC address is stored to database along with username, and then the DHCP module looks up the MAC and uses it as a key to retrieve the username, which will be used to find the user group, which will be the ip pool for the address. Anyway, the problem I've found is that the device I'm using sends the Calling-Station-Id as uppercase separated with hyphen: AA-BB-CC-DD-EE-FF, while DHCP uses the lowercase-colon format: aa:bb:cc:dd:ee:ff. How can I normalize the formats before writing to database? I've found the "tolower" case function which solves half the problem. But I can't find a way to convert "-" into ":". I could do it on SQL but I'd rather do it on Freeradius before it's stored. Maybe even a more minimalistic format would be better for MAC address: all lowercase, no separators: aabbccddeeff. A simple regex could discard anything that's not 0123456789abcdef, and then convert to lowercase. Thanks, Hernan

5 4

rfc6929 radius ext - nested tlv format question
by Vereecke, Katrien (Katrien) 28 Sep '15

28 Sep '15

Hello, I have a question regarding the nesting of radius attributes according to rfc6929. I am using the freeradius-server version V3.0.x and I defined as test the following in my dictionary : ATTRIBUTE Test-Attr-50 241.50 tlv ATTRIBUTE Test-Attr-50_1 241.50.1 octets ATTRIBUTE Test-Attr-50_1_2 241.50.1.2 string And in the users file : Test-Attr-50_1 = 0x112233, Test-Attr-50_1_2 = "testString50", These attributes are sent in the access-accept: (156) Sent Access-Accept Id 247 from 138.203.10.191:1812 to 138.203.10.123:64395 length 0 (156) Test-Attr-50_1 = 0x112233 (156) Test-Attr-50_1_2 = "testString50" I expected that this would give problems because the attribute 241.50.1 is not defined as tlv in the dictionary, but the wireshark shows that the attribute includes both the octets for Test-Attr-50_1 and the nested attribute Test-Attr-50_1_2 . Is the above a valid configuration? When decoding this attribute, how can one distinguish whether 241.50.1 contains real data or again a nested attribute 241.50.1.2? f1 18 32 01 05 11 22 33 01 10 02 0e 74 65 73 74 53 74 72 69 6e 67 35 30 Thanks, Kind regards, Katrien.

2 3

Log problem
by Marian Pandoranum 28 Sep '15

28 Sep '15

Hello, I have set auth=yes in log section from radiusd.conf file in order to be able to see all the logs for authentication requests, in radius.log file from /var/log/radius directory. Unfrortunately, I can't see them. Is there an other setting that I have to do ? thank you for any help you can provide !

2 1

Custom counter aggregating data from two sources - freeradius 3.0.x
by Michal Tomaszewski 27 Sep '15

27 Sep '15

Hello, Can you suggest how can I make a custom counter that uses e.g. sql query and redis query in single counter? Is there any possibility to include ulang logic into sqlcounter conf, make a redis query and/or combine data? Or should I use some other module? Is there a possibility to make queries using different sql pools inside one counter? I would like to cache some data in redis and reuse it if available. If it is not available - then make a full sql query (long lasting…). The same logic I would like to implement in several different counters. I would be grateful for any advice. Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

2 4