- Freeradius-Users - lists.freeradius.org

Attribute NOT being returned in access-accept but is returned in Access-Challenge
by Jake He 27 Jun '15

27 Jun '15

Hi, I have a problem where Attribute MT-Recv-Limit is returned in Access-Challenge but not in Access-Accept. This is my setup. FR 3.0.8 I have configured following in the eap.conf file in the ttls section : copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" /etc/freeradius/sites-available/inner-tunnel. post-auth block, uncommented. update { &outer.session-state: += &reply: } update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } I have a fixed radreply attribute Session-Timeout in the database. This is sent in the Access-Accept. MT-Recv-Limit is sent by a perl script <https://raw.githubusercontent.com/zhex900/radius-config/master/version.3/mo…>. This script add a new radreply $RAD_REPLY{'Mikrotik-Recv-Limit'}. This is called in the site-available/default authorize block. Mikrotik-Recv-Limit does appear in the Access-Challenge but not in the Access-Accept. Any ideas? Jake

3 8

Re: Using AD and SQL to authenticate Wi-Fi users
by Andrés Gómez 26 Jun '15

26 Jun '15

Hi Bruno. Can you help me with the configuation to Active Directory to authenticate WiFi users? is it different to this guide? http://wiki.freeradius .org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO Regards. 2015-06-18 12:34 GMT-05:00 Bruno de Paula Larini < bruno.larini(a)riosoft.com.br>: > Hi guys, > I've been using FR (3.0.4) to authenticate Wi-Fi users against Active > Directory and it is working fine. But now I need to check users in SQL > database too, like this: > > SSID1 -> check for users in AD > SSID2 -> check for users in SQL database > > I've managed to get it working, but only if the other authentication > method is disabled. Only one would work at a time. > To get SQL working, I've either commented the ntlm_auth from > mods-enabled/mschap or added the following to the authorize section in > sites-enabled/inner-tunnel: > > ... > update control { > MS-CHAP-Use-NTLM-Auth := No > } > mschap > ... > > Removing the above and/or uncommenting the ntlm_auth line, users from AD > are authenticated successfully but SQL users are not. > > I wanted to use unlang to check if the request came from a specific > Called-Station-Id, but the inner-tunnel doesn't bring this information and > always return false. > > Is there some check I can use to know where the request came from? > > Thank you! > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html -- *C. Andrés Gómez R.*

2 1

Conditional SQL module and server wide variables
by Ricardo Larrañaga 26 Jun '15

26 Jun '15

Hello Guys. I am running freeradius 3.0.4 on centos 7, and have 2 questions, i was wondering if someone can help me. 1) I use the file module and the sql module. On the users file, i might have an exact entry for a user, or a DEFAULT entry for a user. What i would like to do is: -If i match an exact entry, do not run sql module -If i match a DEFAULT entry, run sql module. Is this possible? As far as i could see, File module returns [ok], both for exact and default match entries, so i am not sure on how to differentiate those. 2) Server Wide variables. I am about to implement copy-acct-to-home-server in order to replicate accounting between servers (cool feature!). Now, I understand that i am responsible of writing a policy to drop packets in case one of the servers i am copying accounting to goes down. What i would like to know is if i can define a server wide variable like a counter, where i could increment the number of times a server has not responded. If this goes over a threshold, i can start dropping packets, in order not to load the server. Thank you very much! Regards

2 4

Need your help friends
by femibanjiajayi 26 Jun '15

26 Jun '15

Hi all, i have been struggling with this on freeradius. My radclient has not been working and i have tried all sorts. My freeradius version is ... freeradius: FreeRADIUS Version 2.1.12 Note the issue: root@olufemi-Lenovo-G50-70:/etc/freeradius# radclient 127.0.0.1 auto testing123 -f 4088_06_acct_start.txt radclient: Request was "auto", but request 2 in file 4088_06_acct_start.txt did not contain Packet-Type My debug is: localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client jradius { ipaddr = 192.168.1.101 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = no sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Linked to module rlm_sqlcounter Module: Instantiating module "dailycounter" from file /etc/freeradius/modules/counter sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL(SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)),0) FROM radacct WHERE username = '%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Daily-Session-Time is number 3000 rlm_sqlcounter: Check attribute Max-Daily-Session is number 3001 rlm_sqlcounter: Current Time:1435323155 [2015-06-26 14:52:35], Next reset 1435356000 [2015-06-27 00:00:00] rlm_sqlcounter: Current Time:1435323155 [2015-06-26 14:52:35], Prev reset 1435269600 [2015-06-26 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Instantiating module "sradutmp" from file /etc/freeradius/modules/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 420 callerid = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 56942 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Note also: i used all the files as stated in Dirk Van Der Walt : Beginner's Guide. Its been really frustrating just to get the radclient working while radtest works as below....................... root@olufemi-Lenovo-G50-70:/etc/freeradius# radtest alice passme127.0.0.1 100 testing123 Sending Access-Request of id 241 to 127.0.0.1 port 1812 User-Name = "alice" User-Password = "passme" NAS-IP-Address = 127.0.1.1 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=241, length=79 Framed-IP-Address = 192.168.1.65 Reply-Message = "Hello, alice" WISPr-Session-Terminate-Time = "2012-01-10T22:00:00+02:00" Session-Timeout = 1800 4088_06_acct_start.txt ............ Packet-Type=4 Packet-Dst-Port=1813 Acct-Session-Id = "4D2BB8AC-00000098" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "alice" NAS-Port = 0 Called-Station-Id = "00-02-6F-AA-AA-AA:My Wireless" Calling-Station-Id = "00-1C-B3-AA-AA-AA" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 48Mbps 802.11b" -UU-:----F1 4088_06_acct_start.txt All L10 (Text) ------------------------ I will be so glad if you can help. Regards Olufemi Banji-Ajayi South Africa Regards Olufemi Banji-Ajayi Sent from my Samsung device

2 1

moving from WPA2 to WPA2 Enterprise
by Jochen Demmer 26 Jun '15

26 Jun '15

Hi, I want to move away from PSK and use 802.1x in the future for our wireless clients. - 2 CentOS 7 Servers with Freeradius from repo, currently version: 3.0.4 - User Backend shall be OpenLDAP with passwords hashed in SSHA (inetOrgPerson/posixAccount) - Clients: Android 3,x or 4,x or bigger, iOS 7+, Windows 7+ but mainly 7 - Within our self-managed CA we will create a certificate that every client will get manually installed - We prefer credential based authentication over certificate based client authentication questions 1) A colleague mentioned that we would have a problem with connecting to LDAP, because the passwords stored there are SSHA and he also said that only unencrypted/unhashed passwords will do or NTLM. What road do we need to choose when it comes to authentication methods. 2) What do I have to consider when choosing the common name for the certificate? Thank you in advance -- Peakwork Signature *Jochen Demmer* Network Administrator T: +49-(0)241-4131146-29 jochen.demmer(a)peakwork.com peakwork AG | Sonnenweg 15 a | D-52070 Aachen | T: +49-(0)241-4131146-29 | F: +49-(0)241-4131146-17 peakwork AG (Headquarter) | Flinger Str. 36 | D-40213 Düsseldorf | T: +49-(0)211-91368-500 | F: +49-(0)211-91368-509 Executive board: Ralf Usbeck (chairman) | Markus Pfau | Michael Schmidt | Dr. Thomas van Kaldenkerken Chairman of the supervisory board: Markus Voelkel Company register: Amtsgericht Düsseldorf HRB 71223 | VAT ID.: DE264960677 Peakwork Logo www.peakwork.com | www.peakwork.de

8 18

sql counter is not working
by Randeep 26 Jun '15

26 Jun '15

Hi all, We are having a unlimit plan with after 30GB there will be FUP applied. Initlially the speed will be 4 mbps and after 30G the speed will be 2mbps. I have done the following. Created a counter in counter.conf sqlcounter testcounter { counter-name = Max-Data-Used check-name = Max-Data reply-name = Mikrotik-Rate-Limit sqlmod-inst = sql key = User-Name # reset = daily reset = monthly reply-message = "You have reached your 10 MB bandwidth limit" sqlmod-inst = sql query = "SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='%{${key}}'" } in post-auth I have given the following: #Added for the FUP implementation: update control { #sum of the AcctInputOctets+AcctOutputOctets for this month. (From the first day of the current month to till date) Tmp-Integer-0 := "%{sql:SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where (acctstarttime between DATE_FORMAT(NOW() ,'%Y-%m-01') AND NOW() AND acctstoptime between DATE_FORMAT(NOW() ,'%Y-%m-01') AND NOW()) AND radacct.username='%{User-Name}'}" #Value of Max-Data from the radgroupcheck for the group of the user Tmp-Integer-1 := "%{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radus ergroup.username='%{User-Name}' AND radgroupcheck.attribute='Max-Data'}" } if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") { update reply { Reply-Message := "Fair Usage Policy Enforced, Bandwidth Limited" Mikrotik-Rate-Limit := "512K/512K" } But the counter is not working: It is just not letting the user log in. If the limit is reached it is sending access-reject instead of letting the user login with less internet speed. Please see then logs below. rad_recv: Access-Request packet from host 192.168.1.1 port 58768, id=153, length=194 NAS-Port-Type = Ethernet Calling-Station-Id = "38:63:BB:AA:23:C8" Called-Station-Id = "server1" NAS-Port-Id = "LAN" User-Name = "randeep" NAS-Port = 2150629401 Acct-Session-Id = "80300019" Framed-IP-Address = 192.168.1.178 Mikrotik-Host-IP = 192.168.1.178 CHAP-Challenge = 0x618cb729fc30bb997aee7574fcd41676 CHAP-Password = 0x343254f5155e8862a8486eee2a0c7f45c8 Service-Type = Login-User WISPr-Logoff-URL = "http://192.168.1.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.1 Wed Jun 24 17:34:33 2015 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Jun 24 17:34:33 2015 : Info: +- entering group authorize {...} Wed Jun 24 17:34:33 2015 : Info: ++[preprocess] returns ok Wed Jun 24 17:34:33 2015 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.1/auth-detail-20150624 Wed Jun 24 17:34:33 2015 : Info: [auth_log] /var/log/radius/radacct/%{ Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/ 192.168.1.1/auth-detail-20150624 Wed Jun 24 17:34:33 2015 : Info: [auth_log] expand: %t -> Wed Jun 24 17:34:33 2015 Wed Jun 24 17:34:33 2015 : Info: ++[auth_log] returns ok Wed Jun 24 17:34:33 2015 : Info: [chap] Setting 'Auth-Type := CHAP' Wed Jun 24 17:34:33 2015 : Info: ++[chap] returns ok Wed Jun 24 17:34:33 2015 : Info: ++[mschap] returns noop Wed Jun 24 17:34:33 2015 : Info: [suffix] No '@' in User-Name = "randeep", looking up realm NULL Wed Jun 24 17:34:33 2015 : Info: [suffix] No such realm "NULL" Wed Jun 24 17:34:33 2015 : Info: ++[suffix] returns noop Wed Jun 24 17:34:33 2015 : Info: [eap] No EAP-Message, not doing EAP Wed Jun 24 17:34:33 2015 : Info: ++[eap] returns noop Wed Jun 24 17:34:33 2015 : Info: ++[files] returns noop Wed Jun 24 17:34:33 2015 : Info: [sql] expand: %{User-Name} -> randeep Wed Jun 24 17:34:33 2015 : Info: [sql] sql_set_user escaped user --> 'randeep' Wed Jun 24 17:34:33 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Wed Jun 24 17:34:33 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'randeep' ORDER BY id Wed Jun 24 17:34:33 2015 : Debug: WARNING: Found User-Password == "...". Wed Jun 24 17:34:33 2015 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Wed Jun 24 17:34:33 2015 : Debug: WARNING: See "man rlm_pap" for more information. Wed Jun 24 17:34:33 2015 : Info: [sql] User found in radcheck table Wed Jun 24 17:34:33 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'randeep' ORDER BY id Wed Jun 24 17:34:33 2015 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'randeep' ORDER BY priority Wed Jun 24 17:34:33 2015 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admins' ORDER BY id Wed Jun 24 17:34:33 2015 : Info: [sql] User found in group admins Wed Jun 24 17:34:33 2015 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admins' ORDER BY id Wed Jun 24 17:34:33 2015 : Debug: rlm_sql (sql): Released sql socket id: 3 Wed Jun 24 17:34:33 2015 : Info: ++[sql] returns ok Wed Jun 24 17:34:33 2015 : Debug: rlm_sqlcounter: Entering module authorize code Wed Jun 24 17:34:33 2015 : Debug: sqlcounter_expand: 'SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='%{User-Name}'' Wed Jun 24 17:34:33 2015 : Info: [testcounter] expand: SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='%{User-Name}' -> SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='randeep' Wed Jun 24 17:34:33 2015 : Debug: WARNING: Please replace '%S' with '${sqlmod-inst}' Wed Jun 24 17:34:33 2015 : Debug: sqlcounter_expand: '%{sql:SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='randeep'}' Wed Jun 24 17:34:33 2015 : Info: [testcounter] sql_xlat Wed Jun 24 17:34:33 2015 : Info: [testcounter] expand: %{User-Name} -> randeep Wed Jun 24 17:34:33 2015 : Info: [testcounter] sql_set_user escaped user --> 'randeep' Wed Jun 24 17:34:33 2015 : Info: [testcounter] expand: SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='randeep' -> SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='randeep' Wed Jun 24 17:34:33 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Wed Jun 24 17:34:33 2015 : Info: [testcounter] sql_xlat finished Wed Jun 24 17:34:33 2015 : Debug: rlm_sql (sql): Released sql socket id: 2 Wed Jun 24 17:34:33 2015 : Info: [testcounter] expand: %{sql:SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='randeep'} -> 42164020 Wed Jun 24 17:34:33 2015 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Wed Jun 24 17:34:33 2015 : Debug: rlm_sqlcounter: Rejected user randeep, check_item=10240000, counter=42164020 Wed Jun 24 17:34:33 2015 : Info: ++[testcounter] returns reject Wed Jun 24 17:34:33 2015 : Auth: Invalid user (rlm_sqlcounter: Maximum monthly usage time reached): [randeep] (from client mikrotik port 2150629401 cli 38:63:BB:AA:23:C8) Wed Jun 24 17:34:33 2015 : Info: Using Post-Auth-Type Reject Wed Jun 24 17:34:33 2015 : Info: # Executing group from file /etc/raddb/sites-enabled/default Wed Jun 24 17:34:33 2015 : Info: +- entering group REJECT {...} Wed Jun 24 17:34:33 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> randeep Wed Jun 24 17:34:33 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Jun 24 17:34:33 2015 : Info: ++[attr_filter.access_reject] returns updated Wed Jun 24 17:34:33 2015 : Info: Delaying reject of request 0 for 1 seconds Wed Jun 24 17:34:33 2015 : Debug: Going to the next request Wed Jun 24 17:34:33 2015 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 58768, id=153, length=194 Wed Jun 24 17:34:34 2015 : Info: Waiting to send Access-Reject to client mikrotik port 58768 - ID: 153 Wed Jun 24 17:34:34 2015 : Debug: Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 58768, id=153, length=194 Wed Jun 24 17:34:34 2015 : Info: Waiting to send Access-Reject to client mikrotik port 58768 - ID: 153 Wed Jun 24 17:34:34 2015 : Debug: Waking up in 0.3 seconds. Wed Jun 24 17:34:34 2015 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 153 to 192.168.1.1 port 58768 Reply-Message = "Your maximum monthly usage time has been reached" Wed Jun 24 17:34:34 2015 : Debug: Waking up in 4.9 seconds. Please help. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 5

How to properly originate CoA?
by firing neurons 26 Jun '15

26 Jun '15

Hi. I have a 3.0.8 server with auth, acct and CoA working. I am only sending NAS-IP-Address and User-Name in the CoA request right now. I have the update coa in accouting so that a CoA is sent on each interim update. Also, I have a custom counter that does monthly bytes counting working. I want to rate limit users for X amount of data and then throttle or disconnect (send Acceses-Reject) them based on the group they belong to. My current plan: Have the data and speed limits assgined by groups. So there will be group check items for the data consumed and group reply items that will assign the speed limit via NAS specific attributes. I use mpd. It doesn't support the Max-Octets attributes :/. So disconnection and rate change can only be done either by a hard timeoute (bad) or by CoA. Questions: How can I send diffrent values of rate in the CoA requests depending upon the data usage? I have the basic idea that I have to use xlat sql query but I don't speak sql. Has the query already been done? The monthly counter takes care of preventing users from connecting once they cross the data limit but they must be disconnected once. How do I send PoD or CoA based on the group of the user? Where can I find the documentaion for state variables? How can I avoid the recalculation of acct data on each interim update and unnessasory CoA requests? FN

2 1

3.0.8: Matching request attribute against multiple check items using unlang
by Adam Hammond 25 Jun '15

25 Jun '15

Hi list, I need your help again. I am revisiting a solution I had worked out using version 2.x and the 'checkval' module: I had the module checking the Calling-Station-Id attribute in the request against multiple values I had added for a user in the 'radcheck' table. e.g. radcheck: id | username | attribute | op | value ----+----------------+----------------------+----+---------------------------------- 1 | callingtest | MD5-Password | := | ae2b1fca515949e5d54fb22b8ed95575 2 | callingtest | Calling-Station-Id | += | 07-08-09-04-05-06 3 | callingtest | Calling-Station-Id | += | 01-02-03-04-05-06 4 | callingtest | Calling-Station-Id | += | 11-11-11-22-22-22 Only if the attribute in the request matched any of these entries could the request be granted. It worked well. Noting that this module has been removed in 3.x and that I should use unlang instead I have been trying to make this work and have got stuck. I haven't been able to find a solution looking through the list archives and I've probably misunderstood how unlang works somehow. Testing my solution thus far, and using the same entries in radcheck as above, only a request with a Calling-Station-Id that matches the value with the lowest id in radcheck gets accepted - the first attribute of it's name in the control list. Here is my messy unlang attempt. Reject a request unless I can match the Calling-Station-Id. NOTE: I've expanded the attributes in the if statement to show you what I mean in the debug output below. authorize { sql pap update control { Auth-Type := "Reject" } foreach &control:Calling-Station-Id { if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") { update control { Auth-Type := "Accept" } break } } debug_control } NOTE: 'break' doesn't seem to do what I'm expecting it to here (break out of the for loop) so should I just remind myself unlang isn't a programming language (not that I'm a coder) and not try such things? If I put it before the update command then the update isn't executed either: it seems to be breaking the if statement. In debug the server appears to be looping through the entries the right number of times (if I have x number of Called-Station-Id entries in radcheck for the user then it loops x times) and the control list certainly has all the entries in it, yet only the first is ever checked and therefore matched. Any pointers to what I'm doing wrong most appreciated. Cheers in advance, Adam Debug splurge (2 requests, both which should be accepted. Output edited for the sake of brevity) Received Access-Request Id 30 from 10.0.10.30:39227 to 10.0.10.31:31812 length 107 User-Name = 'callingtest' User-Password = 'testing' Acct-Session-Id = '5371b4ba00000008' Calling-Station-Id = '01-02-03-04-05-06' Called-Station-Id = '00-01-C0-12-36-88' (0) Received Access-Request packet from host 10.0.10.30 port 39227, id=30, length=107 (0) User-Name = 'callingtest' (0) User-Password = 'testing' (0) Acct-Session-Id = '5371b4ba00000008' (0) Calling-Station-Id = '01-02-03-04-05-06' (0) Called-Station-Id = '00-01-C0-12-36-88' (0) # Executing section authorize from file /etc/raddb/sites-enabled/test (0) authorize { … edited out… (0) [sql] = ok (0) pap : Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes (0) [pap] = updated (0) update control { (0) Auth-Type := Reject (0) } # update control = noop (0) foreach &control:Calling-Station-Id (0) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") (0) EXPAND %{control:Calling-Station-Id} (0) --> 07-08-09-04-05-06 (0) EXPAND %{request:Calling-Station-Id} (0) --> 01-02-03-04-05-06 (0) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") -> FALSE (0) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") (0) EXPAND %{control:Calling-Station-Id} (0) --> 07-08-09-04-05-06 (0) EXPAND %{request:Calling-Station-Id} (0) --> 01-02-03-04-05-06 (0) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") -> FALSE (0) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") (0) EXPAND %{control:Calling-Station-Id} (0) --> 07-08-09-04-05-06 (0) EXPAND %{request:Calling-Station-Id} (0) --> 01-02-03-04-05-06 (0) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") -> FALSE (0) } # foreach &control:Calling-Station-Id = updated (0) debug_control debug_control { (0) if ("%{debug_attr:control:}" == '') (0) Attributes matching "control:" (0) control:MD5-Password = 0xae2b1fca515949e5d54fb22b8ed95575 (0) control:Calling-Station-Id = '07-08-09-04-05-06' (0) control:Calling-Station-Id = '01-02-03-04-05-06' (0) control:Calling-Station-Id = '11-11-11-22-22-22' (0) control:Auth-Type := Reject (0) EXPAND %{debug_attr:control:} (0) --> (0) if ("%{debug_attr:control:}" == '') -> TRUE (0) if ("%{debug_attr:control:}" == '') { (0) [noop] = noop (0) } # if ("%{debug_attr:control:}" == '') = noop (0) } # debug_control debug_control = noop (0) } # authorize = updated (0) Found Auth-Type = Reject (0) Auth-Type = Reject, rejecting user (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Sending Access-Reject packet to host 10.0.10.30 port 39227, id=30, length=0 (0) Session-Timeout = 320 Sending Access-Reject Id 30 from 10.0.10.31:31812 to 10.0.10.30:39227 Session-Timeout = 320 (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 30 with timestamp +4 Ready to process requests Received Access-Request Id 78 from 10.0.10.30:34511 to 10.0.10.31:31812 length 107 User-Name = 'callingtest' User-Password = 'testing' Acct-Session-Id = '5371b4ba00000007' Calling-Station-Id = '07-08-09-04-05-06' Called-Station-Id = '00-01-C0-12-36-88' (1) Received Access-Request packet from host 10.0.10.30 port 34511, id=78, length=107 (1) User-Name = 'callingtest' (1) User-Password = 'testing' (1) Acct-Session-Id = '5371b4ba00000007' (1) Calling-Station-Id = '07-08-09-04-05-06' (1) Called-Station-Id = '00-01-C0-12-36-88' (1) # Executing section authorize from file /etc/raddb/sites-enabled/test (1) authorize { … edited out … (1) [sql] = ok (1) pap : Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes (1) [pap] = updated (1) update control { (1) Auth-Type := Reject (1) } # update control = noop (1) foreach &control:Calling-Station-Id (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") (1) EXPAND %{control:Calling-Station-Id} (1) --> 07-08-09-04-05-06 (1) EXPAND %{request:Calling-Station-Id} (1) --> 07-08-09-04-05-06 (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") -> TRUE (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") { (1) update control { (1) Auth-Type := Accept (1) } # update control = noop (1) # break Foreach-Variable-0 (1) } # if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") = noop (1) # unwind to enclosing foreach (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") (1) EXPAND %{control:Calling-Station-Id} (1) --> 07-08-09-04-05-06 (1) EXPAND %{request:Calling-Station-Id} (1) --> 07-08-09-04-05-06 (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") -> TRUE (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") { (1) update control { (1) Auth-Type := Accept (1) } # update control = noop (1) # break Foreach-Variable-0 (1) } # if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") = noop (1) # unwind to enclosing foreach (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") (1) EXPAND %{control:Calling-Station-Id} (1) --> 07-08-09-04-05-06 (1) EXPAND %{request:Calling-Station-Id} (1) --> 07-08-09-04-05-06 (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") -> TRUE (1) if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") { (1) update control { (1) Auth-Type := Accept (1) } # update control = noop (1) # break Foreach-Variable-0 (1) } # if ("%{request:Calling-Station-Id}" == "%{control:Calling-Station-Id}") = noop (1) # unwind to enclosing foreach (1) } # foreach &control:Calling-Station-Id = noop (1) debug_control debug_control { (1) if ("%{debug_attr:control:}" == '') (1) Attributes matching "control:" (1) control:MD5-Password = 0xae2b1fca515949e5d54fb22b8ed95575 (1) control:Calling-Station-Id = '07-08-09-04-05-06' (1) control:Calling-Station-Id = '01-02-03-04-05-06' (1) control:Calling-Station-Id = '11-11-11-22-22-22' (1) control:Auth-Type := Accept (1) EXPAND %{debug_attr:control:} (1) --> (1) if ("%{debug_attr:control:}" == '') -> TRUE (1) if ("%{debug_attr:control:}" == '') { (1) [noop] = noop (1) } # if ("%{debug_attr:control:}" == '') = noop (1) } # debug_control debug_control = noop (1) } # authorize = updated (1) Found Auth-Type = Accept (1) Auth-Type = Accept, accepting the user (1) Found Auth-Type = Accept (1) Auth-Type = Accept, accepting the user (1) Sending Access-Accept packet to host 10.0.10.30 port 34511, id=78, length=0 (1) Session-Timeout = 320 Sending Access-Accept Id 78 from 10.0.10.31:31812 to 10.0.10.30:34511 Session-Timeout = 320 (1) Finished request

2 1

Implementing COA (FreeRadius + Mysql)
by Randeep 25 Jun '15

25 Jun '15

Hi all, Can anyone provide some useful links on implementing COA (Dynamic Bandwidth reduction) with FreeRadius and Mikrotik(Or procedure with some other NAS) TIA, -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 4

radiusd not starting at boot.
by firing neurons 25 Jun '15

25 Jun '15

I am using 3.0.8. The result of service radiusd status: Redirecting to /bin/systemctl status -l radiusd.service ● radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/ radiusd.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Fri 2015-06-26 00:08:14 IST; 5h 24min left Process: 819 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=1/FAILURE) Process: 794 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Jun 26 00:08:11 localhost.localdomain systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Jun 26 00:08:14 localhost.localdomain systemd[1]: radiusd.service: control process exited, code=exited status=1 Jun 26 00:08:14 localhost.localdomain systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Jun 26 00:08:14 localhost.localdomain systemd[1]: Unit radiusd.service entered failed state. Jun 26 00:08:14 localhost.localdomain systemd[1]: radiusd.service failed. result of service radiusd start: Redirecting to /bin/systemctl start radiusd.service Job for radiusd.service failed. See "systemctl status radiusd.service" and "journalctl -xe" for details. [cleardot.gif] result of journalctl -xe: Jun 25 18:50:56 localhost.localdomain setroubleshoot[2449]: SELinux is preventin g radiusd from read access on the file /etc/raddb/dictionary. For complete SELin ux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 Jun 25 18:50:56 localhost.localdomain python[2449]: SELinux is preventing radius d from read access on the file /etc/raddb/dictionary. ***** Plugin restorecon (99 .5 confidence) suggests ************************ If you want to fix the label . /etc/raddb/dictionary defaul t label should be radiusd_etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/r addb/dictionary ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that radiusd should be allowed read access on the dictionary file by default. Then you should report this as a bug. You can generate a local pol icy module to allow this access. Do allow this access for now by executing: # grep radiusd /var/log/audi t/audit.log | audit2allow -M mypol # semodule -i mypol.pp Jun 25 18:50:56 localhost.localdomain setroubleshoot[2449]: SELinux is preventin g radiusd from read access on the file /etc/raddb/clients.conf. For complete SEL inux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 Jun 25 18:50:56 localhost.localdomain python[2449]: SELinux is preventing radius d from read access on the file /etc/raddb/clients.conf. ***** Plugin restorecon (99 .5 confidence) suggests ************************ If you want to fix the label . /etc/raddb/clients.conf defa ult label should be radiusd_etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/r addb/clients.conf ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that radiusd should be allowed read access on the clients.conf file by default. Then you should report this as a bug. You can generate a local pol icy module to allow this access. Do allow this access for now by executing: # grep radiusd /var/log/audi t/audit.log | audit2allow -M mypol # semodule -i mypol.pp Jun 25 18:50:56 localhost.localdomain polkitd[660]: Unregistered Authentication Agent for unix-process:2678:78843 (system bus name :1.64, object path /org/freed esktop/PolicyKit1/AuthenticationAgent, locale en_IN.UTF-8) (disconnected from bu s) Jun 25 18:51:00 localhost.localdomain polkitd[660]: Registered Authentication Ag ent for unix-process:2863:79253 (system bus name :1.65 [/usr/bin/pkttyagent --no tify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAge nt, locale en_IN.UTF-8) Jun 25 18:51:00 localhost.localdomain systemd[1]: Starting FreeRADIUS high perfo rmance RADIUS server.... -- Subject: Unit radiusd.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit radiusd.service has begun starting up. Jun 25 18:51:00 localhost.localdomain audit[2886]: <audit-1400> avc: denied { sys_ptrace } for pid=2886 comm="radiusd" capability=19 scontext=system_u:syste m_r:radiusd_t:s0 tcontext=system_u:system_r:radiusd_t:s0 tclass=capability permi ssive=0 Jun 25 18:51:00 localhost.localdomain kernel: ptrace of pid 2885 was attempted b y: radiusd (pid 2886) Jun 25 18:51:00 localhost.localdomain audit[2885]: <audit-1400> avc: denied { read } for pid=2885 comm="radiusd" name="dictionary" dev="dm-1" ino=1711521 sco ntext=system_u:system_r:radiusd_t:s0 tcontext=unconfined_u:object_r:user_home_t: s0 tclass=file permissive=0 Jun 25 18:51:00 localhost.localdomain audit[2885]: <audit-1400> avc: denied { read } for pid=2885 comm="radiusd" name="clients.conf" dev="dm-1" ino=1711520 s context=system_u:system_r:radiusd_t:s0 tcontext=unconfined_u:object_r:user_home_ t:s0 tclass=file permissive=0 Jun 25 18:51:00 localhost.localdomain systemd[1]: radiusd.service: control proce ss exited, code=exited status=1 Jun 25 18:51:00 localhost.localdomain systemd[1]: Failed to start FreeRADIUS hig h performance RADIUS server.. -- Subject: Unit radiusd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit radiusd.service has failed. -- -- The result is failed. Jun 25 18:51:00 localhost.localdomain systemd[1]: Unit radiusd.service entered f ailed state. Jun 25 18:51:00 localhost.localdomain systemd[1]: radiusd.service failed. Jun 25 18:51:00 localhost.localdomain audit[1]: <audit-1130> pid=1 uid=0 auid=42 94967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=radiusd comm= "systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed ' Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is preventin g radiusd from using the sys_ptrace capability. For complete SELinux messages. r un sealert -l cac781eb-1cae-4673-b684-6308a2c7ff2b Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing radius d from using the sys_ptrace capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that radiusd should have the sys_ptrace capability by default. Then you should report this as a bug. You can generate a local pol icy module to allow this access. Do allow this access for now by executing: # grep radiusd /var/log/audi t/audit.log | audit2allow -M mypol # semodule -i mypol.pp Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is preventin g radiusd from read access on the file /etc/raddb/dictionary. For complete SELin ux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing radius d from read access on the file /etc/raddb/dictionary. ***** Plugin restorecon (99 .5 confidence) suggests ************************ If you want to fix the label . /etc/raddb/dictionary defaul t label should be radiusd_etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/r addb/dictionary ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that radiusd should be allowed read access on the dictionary file by default. Then you should report this as a bug. You can generate a local pol icy module to allow this access. Do allow this access for now by executing: # grep radiusd /var/log/audi t/audit.log | audit2allow -M mypol # semodule -i mypol.pp Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is preventin g radiusd from read access on the file /etc/raddb/clients.conf. For complete SEL inux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing radius d from read access on the file /etc/raddb/clients.conf. ***** Plugin restorecon (99 .5 confidence) suggests ************************ If you want to fix the label . /etc/raddb/clients.conf defa ult label should be radiusd_etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/r addb/clients.conf ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that radiusd should be allowed read access on the clients.conf file by default. Then you should report this as a bug. You can generate a local pol icy module to allow this access. Do allow this access for now by executing: # grep radiusd /var/log/audi t/audit.log | audit2allow -M mypol # semodule -i mypol.pp Jun 25 18:51:01 localhost.localdomain polkitd[660]: Unregistered Authentication Agent for unix-process:2863:79253 (system bus name :1.65, object path /org/freed esktop/PolicyKit1/AuthenticationAgent, locale en_IN.UTF-8) (disconnected from bu s)

2 1