- Freeradius-Users - lists.freeradius.org

Proxy check request problem
by Peter Balsianok 21 Sep '15

21 Sep '15

Hi I have following proxy configuration: Hi, I have following proxy configuration for 3rd party server (only piece of the configuration). .... require_message_authenticator = yes type = auth+acct port = 1812 # Status check via existing user status_check = request check_interval = 6 num_answers_to_alive = 3 username = "orange-system" password = "incorrect" # We don't need Access-Accept, enough is Access-Reject .... My server recieves only auth/autz requests which are proxied to 3rd party servers. In case of 3rd party unavailability the server sends request to check status of the 3rd party server. Question is why does server send Accounting Request instead of Access Accept ? Another question for clarification: If i use type=auth+acct, what is correct value for the port ? Is it correct port=1812 ? 15:34:29.016422 IP (tos 0x0, ttl 64, id 8072, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xea, Authenticator: 50365561fa7ae6cca5a956834b05dea8 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:29 2015 0x0000: 5600 0765 NAS ID Attribute (32), length: 33, Value: Status Check 64. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 342e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f 15:34:36.918919 IP (tos 0x0, ttl 64, id 8074, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xe9, Authenticator: 2f14cead04b5c267c9c85514235e5d48 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:36 2015 0x0000: 5600 076c NAS ID Attribute (32), length: 33, Value: Status Check 65. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 352e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f Thx.

2 1

Re: Freeradius - Client not authenticated
by Matthew Newton 21 Sep '15

21 Sep '15

Hi, [Please keep replies on-list] On Mon, Sep 21, 2015 at 02:31:29PM +0100, Federico Olivieri wrote: > Pre-configured profile --> Auth-Type Reject > Mine --> Auth-Type Accept > > Obviously, I didn't know what I was doing :) > Which kind of Authorization I need to use? Just remove that line. You shouldn't be setting Auth-Type to anything unless, as I said, you know what you're doing. The server figures it out itself. > In terms of password, it was already configured in clear text OK, you should hopefully be good to go then. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

accounting stop with TLS
by Riccardo locatelli 21 Sep '15

21 Sep '15

Hi I use freeradius 2.2.6 and i have configure both ttls and tls (I bought a certificate). My problem is about accounting with tls (used from client win7 and previous). They send always access request but rarely accounting stop! I have also configure simultaneous-use, but if client not send accounting stop, its session remains open and it will not be able to reconnect! TTLS clients have never had a problem aboute accouting. this is my configuration: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-unknown-linux-gnu, built on F eb 18 2015 at 16:53:34 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_l ogin including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = no allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/loc▒▒▒▒ modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/ms chap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "mschapv2" timer_expire = 2 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.key" certificate_file = "/usr/local/etc/raddb/certs/server.pem" private_key_password = "RadiusPwdOut" dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = no url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/module s/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM na s" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Grou p}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Grou p}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timest amp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctsto pdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct- Input-Gigawords}:-0}' << 32 | '%{%{Acct-Inpu t-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:- 0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoct ets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctsta rtdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-I d}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Ti me}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic} ', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Ac ct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '% {Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key} ')" accounting_start_query = " INSERT INTO radacct (ac ctsessionid, acctuniqueid, username, realm, nasip address, nasportid, nasporttype, acctstarttime, acctsto ptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calle dstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdela y, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Re alm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S' , NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', ' ', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time }:-0}', connectinfo_start = '%{Connect-Info}' WHERE accts essionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Na me}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acct stoptime = '%S', acctsessiontime = '%{%{Acct-Session-Time} :-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', ac ctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = ' %{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time }:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acct sessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User -Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, naspor tid, nasporttype, acctstarttime, acctstoptime, acctses siontime, acctauthentic, connectinfo_start, connectinfo_stop, accti nputoctets, acctoutputoctets, calledstationid, callingstationid, ac ctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-S ession-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port -Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session -Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '% S', '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{Conne ct-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{ %{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}' , '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0 ', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM r adacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (use rname, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap -Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, t ype, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 31 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Read entry nasname=192.168.16.249,shortname=cisco121,secret=DMedi aRadius rlm_sql (sql): Adding client 192.168.16.249 (cisco121, server=<none>) to clients list rlm_sql (sql): Read entry nasname=192.168.100.110,shortname=SysEdit Trunk,secret =DMediaRadius rlm_sql (sql): Adding client 192.168.100.110 (SysEdit Trunk, server=<none>) to c lients list rlm_sql (sql): Read entry nasname=192.168.10.9,shortname=Treviglio,secret=DMedia Radius rlm_sql (sql): Adding client 192.168.10.9 (Treviglio, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modul es/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-P ort" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /usr/local/etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/l ocal/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/e tc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunne l modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 39619 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. -- Riccardo Locatelli

4 6

Proxy request check problem
by Peter Balsianok 21 Sep '15

21 Sep '15

Hi, I have following proxy configuration require_message_authenticator = yes type = auth port = 1812 secret = "pT65w44WzAqYOraNgE" #response_window = 20 # Not necessary defined in home_server default section #zombie_period = 40 # Without status check #status_check = none #revive_interval = 120 # Status check via existing user status_check = request check_interval = 6 num_answers_to_alive = 3 username = "orange-system" password = "incorrect" # We dont need Access-Accept, enougth is Access-Reject 15:34:29.016422 IP (tos 0x0, ttl 64, id 8072, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xea, Authenticator: 50365561fa7ae6cca5a956834b05dea8 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:29 2015 0x0000: 5600 0765 NAS ID Attribute (32), length: 33, Value: Status Check 64. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 342e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f 15:34:36.918919 IP (tos 0x0, ttl 64, id 8074, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xe9, Authenticator: 2f14cead04b5c267c9c85514235e5d48 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:36 2015 0x0000: 5600 076c NAS ID Attribute (32), length: 33, Value: Status Check 65. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 352e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f

1 0

Freeradius DHCP and radius accounting
by Alain Cocconi 21 Sep '15

21 Sep '15

Hi, I've a working configuration with Freeradius doing radius AAA for PPPoE subscribers on a Cisco ASR1006 BRAS and proxiing accounting packets to a Subscriber Management Policer (SMP) server. Each time a subscriber is authenticated, a radius Class attribute is send into the replied packet, then the BRAS put it in each radius accounting packets. Those accounting packets are proxied to the SMP server by the Freeradius server. These configuration is working fine since many many years now. But because of FTTH is coming in my region now, I've to switch from PPPoE to a IPoE and using DHCP. So I've done a lab with a working Freeradius DHCP server (Freeradius DHCP is working great!), but after checking again and again docs, wiki and web, I can't find a solution to do a radius accounting packet instead of a DHCP accounting packet or asking my cisco to do radius accounting and not DHCP accounting. If someone has an idea it would be nice to share it with me. Regards --

2 1

Freeradius - Client not authenticated
by Federico Olivieri 21 Sep '15

21 Sep '15

Hi All, That's my first e-mail and freeradius installation. Sorry if I didn't give you all info required or if my e-mail is wrong. I just finished to set up freeradius with MySQL and daloRADIUS on my Raspi. Exciting!!! (I followed this link - http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-freeradius-server… ) I added a user via daloRADIUS, I can see the entry in MySQL but I m not able to authenticate my wifi device. I enabled the debug mode with freeradius-XXX command and I got as following: rad_recv: Access-Request packet from host 192.168.0.5 port 48785, id=0, length=121 User-Name = "wiko" NAS-IP-Address = 192.168.0.5 Called-Station-Id = "54a0505814c4" Calling-Station-Id = "00738da980df" NAS-Identifier = "54a0505814c4" NAS-Port = 54 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000090177696b6f Message-Authenticator = 0x3fea51568bbe9b1d3e4803bed98db11b Fri Sep 18 21:57:15 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Sep 18 21:57:15 2015 : Info: +- entering group authorize {...} Fri Sep 18 21:57:15 2015 : Info: ++[preprocess] returns ok Fri Sep 18 21:57:15 2015 : Info: ++[chap] returns noop Fri Sep 18 21:57:15 2015 : Info: ++[mschap] returns noop Fri Sep 18 21:57:15 2015 : Info: ++[digest] returns noop Fri Sep 18 21:57:15 2015 : Info: [suffix] No '@' in User-Name = "wiko", looking up realm NULL Fri Sep 18 21:57:15 2015 : Info: [suffix] No such realm "NULL" Fri Sep 18 21:57:15 2015 : Info: ++[suffix] returns noop Fri Sep 18 21:57:15 2015 : Info: [eap] EAP packet type response id 0 length 9 Fri Sep 18 21:57:15 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Sep 18 21:57:15 2015 : Info: ++[eap] returns updated Fri Sep 18 21:57:15 2015 : Info: ++[files] returns noop Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{User-Name} -> wiko Fri Sep 18 21:57:15 2015 : Info: [sql] sql_set_user escaped user --> 'wiko' Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wiko' ORDER BY id Fri Sep 18 21:57:15 2015 : Info: [sql] User found in radcheck table Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wiko' ORDER BY id Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'wiko' ORDER BY priority Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'WiFi_Users' ORDER BY id Fri Sep 18 21:57:15 2015 : Info: [sql] User found in group WiFi_Users Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'WiFi_Users' ORDER BY id Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Sep 18 21:57:15 2015 : Info: ++[sql] returns ok Fri Sep 18 21:57:15 2015 : Info: ++[expiration] returns noop Fri Sep 18 21:57:15 2015 : Info: ++[logintime] returns noop Fri Sep 18 21:57:15 2015 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Fri Sep 18 21:57:15 2015 : Info: ++[pap] returns noop Fri Sep 18 21:57:15 2015 : Info: Found Auth-Type = Accept Fri Sep 18 21:57:15 2015 : Info: Auth-Type = Accept, accepting the user Fri Sep 18 21:57:15 2015 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Fri Sep 18 21:57:15 2015 : Info: +- entering group post-auth {...} Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{User-Name} -> wiko Fri Sep 18 21:57:15 2015 : Info: [sql] sql_set_user escaped user --> 'wiko' Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{User-Password} -> Fri Sep 18 21:57:15 2015 : Info: [sql] ... expanding second conditional Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{Chap-Password} -> Fri Sep 18 21:57:15 2015 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wiko', '', 'Access-Accept', '2015-09-18 21:57:15') Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wiko', '', 'Access-Accept', '2015-09-18 21:57:15') Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Released sql socket id: 1 Fri Sep 18 21:57:15 2015 : Info: ++[sql] returns ok Fri Sep 18 21:57:15 2015 : Info: ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.0.5 port 48785 Fri Sep 18 21:57:15 2015 : Info: Finished request 1. Fri Sep 18 21:57:15 2015 : Debug: Going to the next request Fri Sep 18 21:57:15 2015 : Debug: Waking up in 4.9 seconds. Fri Sep 18 21:57:20 2015 : Info: Cleaning up request 1 ID 0 with timestamp +95 Fri Sep 18 21:57:20 2015 : Info: Ready to process requests. I don't understand the majority of those messages. Can someone help me to understand where is the error? Thanks Federico

2 1

filtering accounting
by Randeep 21 Sep '15

21 Sep '15

Hi, We are using FreeRadius 3.0.8. and Mikrotik NAS. We have a MPLS vpn where our clients are connected. We are providing IPTV in our LAN and also internet through the same connection. The problem is, We want to account only internet traffic. Not IPTV traffic. How we can filter it. In the interim update, we are not getting any ip information. Else we could have omitted the traffic where our streaming server ips are included. Please suggest some solution. Regards, Randeep

1 0

EAP-FAST Support
by Wegener, Norbert 21 Sep '15

21 Sep '15

EAP-FAST seems not being widely used. The latest thread on this topic that I found is: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/07358… There it is mentioned, that: rlm_eap2 was removed from v3.0.x so if you're building 3.0.0 the module won't be available. As EAP-FAST could be used with the experimental rlm_eap2 : Does this mean, Freeradius 3.x does not support EAP FAST? Norbert Wegener

6 9

custom message for ldap authentication
by Daniele Mantovani 19 Sep '15

19 Sep '15

Hi, I've started using freeradius (current version 2.2.5) on a debian machine to authenticate user on a wifi hotspot. I'm currently using it without any problem, and it work greats! At the moment I'm using ldap (on a windows server 2008 active directory), pop and exec module to authenticate different realm. I only need to improve a little bit the replay message when an authentication fail. Currently I've a generic replay message on the end of the users file, but I want to make some specific message for the ldap user: I'm checking if a user is part of an ldap group to give them access. Here's a little bit of configuration users file DEFAULT Realm == NULL, osdbLDAP-Ldap-Group =="InternetAccess",Autz-Type := osdbLDAP, Auth-Type := osdbLDAP DEFAULT Auth-Type := Reject Reply-Message = "You are not authorized" radiusd.conf ldap osdbLDAP{ dictionary_mapping = ${raddbdir}/ldap.attrmap server = "*****" basedn = "cn=Users,dc=osdbsesto,dc=local" filter = "(sAMAccountName=%{Stripped-User-Name})" identity = "cn=ldap-proxy,cn=Users,dc=osdbsesto,dc=local" password = "****" #groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))" groupmembership_attribute = "memberOf" chase_referrals = yes rebind =yes } My goal is to have an error message for not valid user credential, and one message for user not in group. I've red the documentation about the ldap module, and I've seen 2 possible way of get this: -using the post-auth in the virtual server, and checking the group: I've seen in the ldap module documentation that I can check the group in the post-auth of my virtual server, but it's not documented well, so I've many questions: --to do that, I simply need to remove the 'osdbLDAP-Ldap-Group == "InternetAccess"' part in users file, and add something like this in post-auth block? if (osdbLDAP-Ldap-Group == "InternetAccess") { noop } else { reject } -- can I user the unlang in this block? for example, can I do this? else { Reply-Message = "You aren't in the right group" reject } -- does this check work with the recursive group filter? (I'm checking if user is in the group, or in a sub group) (groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))") -- can I catch somewhere the "not authenticate" state? (where I can set a custom message) - the other way I've found to do this is add a second line in the users file, after the line that authenticate if user is valid and in the group, and to the same check as before, but without the group. In that case, I can set a custom replay message (the user is valid but not in the group) and, stopping the fall trough, I think I can reject the user. This should work, but, if I'm not wrong, this will do another call to the ldap server Any suggestion, tip, link or documentation I can read? Thanks to all Best Regards Mix

2 1

problem solved: "Couldn't connect socket to PostgreSQL server"
by Kurt Weiß 19 Sep '15

19 Sep '15

Hi Community. I spent about two hours to figure out following problem: although my configuration was correct, freeradius didn't connect with my postgres database. following error was logged: Info: rlm_sql (sql): Attempting to connect to radius@127.0.0.1:5432/radius Info: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radius@127.0.0.1:radius Error: rlm_sql (sql): Failed to connect DB handle #0 after searching for (not existent) configuration failures i looked into the postgres log. (wow, what for an idea!) There was an entry: CEST LOG: could not accept SSL connection: EOF detected Postgres was configured to work over SSL. Freeradius does not seem to support Postgres over SSL. I deactivated SSL in Postgres and the freeradius server connected. Because no such info seems to exist in Internet, i decided to write it into this list. greetings...

4 3