- Freeradius-Users - lists.freeradius.org

Re: Question about multiple sql databases!
by Haviaras Kostas 04 Mar '15

04 Mar '15

On Mar 2, 2015, at 4:39 AM, Haviaras Kostas <[hidden email] <http://freeradius.1045715.n5.nabble.com/user/SendEmail.jtp?type=node&node=5…>> wrote: > Each database is for different company! I will change to have different > username and passwords. > Then you will need different SQL queries. If you use the same SQL queries for each company, > > you will get the same response. > This isn’t really a RADIUS problem. > Alan DeKok. I just tested, you are right, I am getting the same result! You know how to solve this ??? Thanks

2 1

online users not showing in fr/mysql cli
by JAHANZAIB SYED 04 Mar '15

04 Mar '15

I have freeradius 2.2.0 with mysql DB in CENTOS 6.6. The radius is working fine, I want to pull some information via CLI to see online users by using following query. select username from radacct where acctstoptime=null; OR select username from radacct where acctstoptime=0; but it always return following TextEmpty set (0.00 sec) I have also tried this TextSELECT COUNT(*) FROM radacct WHERE username = 'username' AND acctstoptime IS NULL; +----------+ | COUNT(*) | +----------+ | 0 | +----------+ 1 row in set (0.00 sec) When I check with phpmyadmin in radius / radacct rable, I can see the radacct table with appropriate values but its not showing user with my cli. How can I troubleshoot it ? This is my radiusd -X output. =========================== FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Mar 4 2015 at 04:09:49 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sqlippool.conf including configuration file /usr/local/etc/raddb/sql/mysql/ippool.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 101.11.11.255 { require_message_authenticator = no secret = "testing123" shortname = "Mikrotik" } client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "Localhost" } client 192.168.0.3 { require_message_authenticator = no secret = "testing123" shortname = "Linux" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /usr/local/etc/raddb/users reading pairlist file /usr/local/etc/raddb/acct_users reading pairlist file /usr/local/etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radius123" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate, nasipaddress) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S', '%{NAS-IP-Address}')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_sqlippool Module: Instantiating module "sqlippool" from file /usr/local/etc/raddb/sqlippool.conf sqlippool { sql-instance-name = "sql" lease-duration = 3600 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 56177 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ======================================= Regard's Jz!

2 5

Unprintable Characters
by Adam Bishop 04 Mar '15

04 Mar '15

We have a set of NAS's that are at the end of an unreliable (GSM) connection managed by a third party. Sometimes the AuthN requests are sent to us malformed - like you'd see if the shared secret is correct, except it can't be because well formed requests are interspersed with malformed ones, seconds apart with the same source and destination servers. Unfortunately the user name is almost always intact, so the request is valid enough to be processed and, eventually lockout the afflicted user's account. While the vendor tries to fix their problem so this doesn't happen, I need to filter out the malformed requests. I can do this by writing a regex to bin any requests that contain any unprintable characters (as FreeRADIUS does using fr_utf8_char()), but before I sit down and try and figure that out is there a better way to do this? Is the check done by FreeRADIUS for unprintable characters available to unlang (or if not, would this be easy to expose)? Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 1

How to set multiple reply values via a single SQL query?
by James Wood 03 Mar '15

03 Mar '15

Hi Is there any way to set multiple reply items via a single SQL query? At the moment, I have a table called settings and within that I have a number of columns like Session-Timeout. I am having to do multiple SQL queries to pull these out, even though they are in the same table, which is both introducing time and load on the server. I am using: update reply { Session-Timeout = "%{sql:SELECT `Session-Timeout` FROM settings WHERE router_mac = \"%{Called-Station-Id}\"}" Idle-Timeout = "%{sql:SELECT `Idle-Timeout` FROM settings WHERE router_mac = \"%{Called-Station-Id}\"}" Filter-Id = "%{sql:SELECT `Filter-Id` FROM settings WHERE router_mac = \"%{Called-Station-Id}\"}" } Is there any way to do this in a single query? The SQL query above is simplified as we join some other tables in (which is why we are not just using entries in radreply) but that's a different topic. Thanks, James

4 5

Aliases in radcheck
by J Kephart 03 Mar '15

03 Mar '15

This may seem an odd question, but is there a way to create an alias in radcheck that refers to another record, similar to how DNS works? For example: user1 Cleartext-Password := testing user2 alias user1 In this way, one would be able to use /either/ username to log on, but attributes would only need to be set once, for 'user1'. Still being rather new at FR, I'm just looking to see if there are possibilities such as those. Thanks, Jim

2 2

dynamic vlan for failure authentication
by Sautron Nick 03 Mar '15

03 Mar '15

Hello everyone, I will want to know how to put a dynamic VLAN for authentication failure in the users file please? Best Regards

2 1

Problem to copy attribute Tunnel-Private-Group-ID to inner-tunnel (eap) - freeradius 3.0.7
by joaocdc＠gmail.com 02 Mar '15

02 Mar '15

Hello guys, In the last version freeradius (3.0.7), some attributes are not visible inside the inner-tunnel, like as Tunnel-Private-Group-ID, this attribute have de VLAN ID from client. Before I was using freeradius version 3.0.1 and always work fine, in 3.0.7 version this attribute is visible in default server, but it not is copied to inner-tunnel. In EAP configuration session, when I upgrade from 3.0.1 to 3.0.7, I changed the configs to: in eap module: use_tunneled_reply = no And uncomment in inner-tunnel post-auth from: update { &outer.session-state: += &reply: } and update outer.session-state { MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY } In accord with documentation, this replace use_tunneled_reply = yes in 3.0.5 version In debug below we can see the missing attribute Tunnel-Private-Group-ID in EAP check, this produce de error: “ERROR: Failed retrieving values required to evaluate condition” (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) if (User-Name !~ /@/){ (8) if (User-Name !~ /@/) -> TRUE (8) if (User-Name !~ /@/) { (8) update request { (8) Realm := 'pti' (8) } # update request = noop (8) } # if (User-Name !~ /@/) = noop (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) suffix: Request already has destination realm set. Ignoring (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := 'LOCAL' (8) } # update control = noop (8) eap: Peer sent code Response (2) ID 10 length 66 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop *(8) if (Tunnel-Private-Group-ID == "5"){(8) ERROR: Failed retrieving values required to evaluate condition(8) if (Tunnel-Private-Group-ID == "81"){(8) ERROR: Failed retrieving values required to evaluate condition(8) if (Tunnel-Private-Group-ID == "62"){(8) ERROR: Failed retrieving values required to evaluate condition* (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xdf2cb347df26a950 (8) eap: Finished EAP session with state 0xdf2cb347df26a950 (8) eap: Previous EAP request found for state 0xdf2cb347df26a950, released from the list (8) eap: Peer sent method MSCHAPv2 (26) (8) eap: EAP MSCHAPv2 (26) (8) eap: Calling eap_mschapv2 to process EAP data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) eap_mschapv2: Auth-Type MS-CHAP { (8) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (8) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (8) mschap: Creating challenge hash with username: 0013006 (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (8) mschap: ERROR: MS-CHAP2-Response is incorrect (8) [mschap] = reject (8) } # Auth-Type MS-CHAP = reject (8) eap: Freeing handler (8) [eap] = reject (8) } # authenticate = reject (8) Failed to authenticate the user (8) Login incorrect (Failed retrieving values required to evaluate condition): [0013006] (from client controladora-wlan-1 port 4 cli e0-f8-47-30-8d-82 via TLS tunnel) (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) Post-Auth-Type REJECT { (8) if ( Realm == "vst" ) { (8) if ( Realm == "vst" ) -> FALSE (8) if ( Realm == "srv" ) { (8) if ( Realm == "srv" ) -> FALSE Thanks for help -- João Paulo de Lima Barbosa "Para chegar aonde a maioria não chega, você precisa fazer o que a maioria não faz."

2 5

rlm_cache NT-Password with EAP-PEAP
by Sherker, Donald 02 Mar '15

02 Mar '15

We are trying to setup a freeradius 3.0.7 server that uses EAP-PEAP and EAP-TTLS, both with MSCHAPv2. This server reads a users Cleartext-Password from an ldap server. In order to minimize the calls to the ldap server we are trying to use rlm_cache to cache the NT-Password and LM-Password so that when a user logs in after the initial log in freeradius does not need to query the ldap server. This works with EAP-TTLS, but it does not work with EAP-PEAP. The NT-Password and LM-Password do not seem to be available to the caching module with EAP-PEAP. I am pasting the parts of the config files related to this below. Please let me know if there is any other information needed. mods-enabled/cache: update { control:NT-Password := "%{control:NT-Password}" control:LM-Password := "%{control:LM-Password}" } mods-enabled/eap: eap { default_eap_type = peap ignore_unknown_eap_types = no ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } } sites-enabled/inner-tunnel: authorize { eap { ok = return } update control { Cache-Status-Only = 'yes' } cache if (notfound) { ldap } else { cache } mschap } post-auth { cache } I am also posting excerpts from the debug, again if more is needed let me know. This is for en EAP-TTLS session: Tue Feb 24 16:32:57 2015 : Debug: (7) modsingle[post-auth]: calling cache (rlm_cache) for request 7 Tue Feb 24 16:32:57 2015 : Debug: %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:32:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:32:57 2015 : Debug: attribute --> User-Name Tue Feb 24 16:32:57 2015 : Debug: attribute --> Calling-Station-Id Tue Feb 24 16:32:57 2015 : Debug: (7) cache: EXPAND %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:32:57 2015 : Debug: (7) cache: --> andyresd022be6e8229 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Mutex acquired Tue Feb 24 16:32:57 2015 : Debug: (7) cache: No cache entry found for "andyresd022be6e8229" Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Creating new cache entry Tue Feb 24 16:32:57 2015 : Debug: %{control:NT-Password} Tue Feb 24 16:32:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:32:57 2015 : Debug: attribute --> NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: EXPAND %{control:NT-Password} Tue Feb 24 16:32:57 2015 : Debug: (7) cache: --> 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: control:NT-Password := 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Merging cache entry into request Tue Feb 24 16:32:57 2015 : Debug: (7) cache: &control:NT-Password := 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: FROM 1 TO 6 MAX 7 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: Examining NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: OVERWRITING NT-Password FROM 0 TO 4 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: TO in 6 out 6 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[0] = Proxy-To-Realm Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[1] = Ldap-UserDn Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[2] = Cleartext-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[3] = Auth-Type Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[4] = NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[5] = LM-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Commited entry, TTL 86400 seconds Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Mutex released Tue Feb 24 16:32:57 2015 : Debug: (7) modsingle[post-auth]: returned from cache (rlm_cache) for request 7 Tue Feb 24 16:32:57 2015 : Debug: (7) [cache] = updated Tue Feb 24 16:32:57 2015 : Debug: (7) } # post-auth = updated Tue Feb 24 16:32:57 2015 : Debug: (7) } # server inner-tunnel This is for an EAP-PEAP Session: Tue Feb 24 16:34:57 2015 : Debug: (8) modsingle[post-auth]: calling cache (rlm_cache) for request 8 Tue Feb 24 16:34:57 2015 : Debug: %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> User-Name Tue Feb 24 16:34:57 2015 : Debug: attribute --> Calling-Station-Id Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> qaresdonE8-99-C4-72-33-D8 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Mutex acquired Tue Feb 24 16:34:57 2015 : Debug: (8) cache: No cache entry found for "qaresdonE8-99-C4-72-33-D8" Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Creating new cache entry Tue Feb 24 16:34:57 2015 : Debug: %{control:NT-Password} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{control:NT-Password} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> Tue Feb 24 16:34:57 2015 : Debug: (8) cache: control:NT-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: %{control:LM-Password} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{control:LM-Password} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> Tue Feb 24 16:34:57 2015 : Debug: (8) cache: control:LM-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Merging cache entry into request Tue Feb 24 16:34:57 2015 : Debug: (8) cache: &control:NT-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: &control:LM-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: FROM 2 TO 4 MAX 6 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: Examining NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: APPENDING NT-Password FROM 0 TO 4 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: Examining LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: APPENDING LM-Password FROM 1 TO 5 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: TO in 4 out 6 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[0] = Proxy-To-Realm Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[1] = Auth-Type Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[2] = Ldap-UserDn Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[3] = Cleartext-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[4] = NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[5] = LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Commited entry, TTL 86400 seconds Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Mutex released ________________________________ CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. **If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

4 16

RADIUS Monitoring tool
by Clement Ogedengbe 02 Mar '15

02 Mar '15

On two occasions in the last 2 weeks, our RADIUS server suddenly started to reject ALL users. Even though we have set up a failover system. Unfotunately, the fail-over system did not kick in because the RADIUS service was still running, only that it was rejecting all users for some strange reasons. Does anyone know of any monitoring script/tool that can be used to test that the RADIUS server is authenticating properly and which can send an alert by email or text in the event that the server rejects authentication of a valid user credentials a number of times. Best Regards Clement Ogedengbe -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Tevfik Ceydeliler Sent: 25 February 2015 12:44 To: freeradius-users(a)lists.freeradius.org Subject: Re: GGSN/APN Freeradius and Proxy On 02/24/2015 06:00 PM, Alan DeKok wrote: > On Feb 24, 2015, at 10:14 AM, Tevfik Ceydeliler <tevfik.ceydeliler(a)astron.yasar.com.tr> wrote: >> I use Kobil Secovid as Motp , home server and its log very primitive like this: >> "Tue Feb 24 11:40:21 2015: sending reject for vantacgida4's query from 10.43.1.51" >> It not help me to understand why reject. > So… ask the Kobil people why their RADIUS server is broken. No support we paid :( > >> Differences are very obvious: > So… use FreeRADIUS to edit the proxied packet, so that it looks more like the one from radtest. That’s what the “pre-proxy” section is for. There are lots of examples and documentation for this. > >> rad_recv: Access-Request packet from host 172.30.80.1 port 24208, >> id=136, length=372 Comes from GGSN: >> Calling-Station-Id = "905344776557" >> User-Name = "vantacgida4” >> ... >> User-Password = "5080+00526417” > Does that name / password work for radtest? If not, then stop > wasting your time, and throw the home server in the garbage. Get one > that works, I cant test this use bec. It is reseller. But I create another user and can test it. ######################################################## root@radiuspnb:/etc/freeradius# radtest kivanccepel 475224928708 10.1.1.51 10 geheim Sending Access-Request of id 21 to 10.1.1.51 port 1812 User-Name = "kivanccepel" User-Password = "475224928708" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=21, length=2 ########################################################### As you see it works. But from GGSN not work. I really wish to throw taht home-serve rto garbage. But more that 300 reseller connect via this home-server. OK lets change home server. I have another one for internal usage. In this case, ##################################################################33 ad_recv: Access-Request packet from host 172.30.80.1 port 24144, id=10, length=377 Calling-Station-Id = "905303630245" User-Name = "biryudumgida3" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015918760926" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 50711443 3GPP-GPRS-Negotiated-QoS-profile = "05-13921F7396F7FE74620846006400" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.116 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610eb2acd62 3GPP-Attr-23 = 0x8020 3GPP-IMEISV = "9800670040325323" 3GPP-PDP-Type = 0 NAS-Port = 41524 User-Password = "645327067460" 3GPP-Charging-Gateway-Address = 10.200.211.27 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "biryudumgida3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> biryudumgida3 [sql] sql_set_user escaped user --> 'biryudumgida3' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'biryudumgida3' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'biryudumgida3' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'biryudumgida3' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'UGR_TcellOtonomYBB-Secovid' ORDER BY id [sql] User found in group UGR_TcellOtonomYBB-Secovid [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'UGR_TcellOtonomYBB-Secovid' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 80 to 10.1.1.51 port 1812 Calling-Station-Id = "905303630245" User-Name = "biryudumgida3" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015918760926" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 50711443 3GPP-GPRS-Negotiated-QoS-profile = "05-13921F7396F7FE74620846006400" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.116 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610eb2acd62 3GPP-Attr-23 = 0x8020 3GPP-IMEISV = "9800670040325323" 3GPP-PDP-Type = 0 NAS-Port = 41524 User-Password = "645327067460" 3GPP-Charging-Gateway-Address = 10.200.211.27 Proxy-State = 0x3130 Proxying request 4 to home server 10.1.1.51 port 1812 Sending Access-Request of id 80 to 10.1.1.51 port 1812 Calling-Station-Id = "905303630245" User-Name = "biryudumgida3" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015918760926" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 50711443 3GPP-GPRS-Negotiated-QoS-profile = "05-13921F7396F7FE74620846006400" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.116 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610eb2acd62 3GPP-Attr-23 = 0x8020 3GPP-IMEISV = "9800670040325323" 3GPP-PDP-Type = 0 NAS-Port = 41524 User-Password = "645327067460" 3GPP-Charging-Gateway-Address = 10.200.211.27 Proxy-State = 0x3130 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=80, length=24 Proxy-State = 0x3130 # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 3 [sqlippool] expand: %{User-Name} -> biryudumgida3 [sqlippool] sql_set_user escaped user --> 'biryudumgida3' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '172.30.80.1' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'IP_TcellOtonomYBB' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'biryudumgida3'), (callingstationid <> '905303630245'), expiry_time LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 21600 SECOND WHERE framedipaddress = '172.30.64.190' AND expiry_time IS NULL -> UPDATE radippool SET nasipaddress = '172.30.80.1', pool_key = '41524', callingstationid = '905303630245', username = 'biryudumgida3', expiry_time = NOW() + INTERVAL 21600 SECOND WHERE framedipaddress = '172.30.64.190' AND expiry_time IS NULL [sqlippool] Allocated IP 172.30.64.190 [be401eac] [sqlippool] expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 3 [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 172.30.64.190 from IP_TcellOtonomYBB (did yasarapn cli 905303630245 port 41524 user biryudumgida3) Allocated IP: 172.30.64.190 from IP_TcellOtonomYBB (did yasarapn cli 905303630245 port 41524 user biryudumgida3) ++[sqlippool] returns ok ++[exec] returns noop Sending Access-Accept of id 10 to 172.30.80.1 port 24144 Framed-IP-Address = 172.30.64.190 Finished request 4. Going to the next request Waking up in 4.9 seconds. Cleaning up request 4 ID 10 with timestamp +133 Ready to process requests. rad_recv: Access-Request packet from host 172.30.80.1 port 24144, id=10, length=377 Calling-Station-Id = "905303630245" User-Name = "biryudumgida3" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015918760926" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 50711443 3GPP-GPRS-Negotiated-QoS-profile = "05-13921F7396F7FE74620846006400" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.116 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610eb2acd62 3GPP-Attr-23 = 0x8020 3GPP-IMEISV = "9800670040325323" 3GPP-PDP-Type = 0 NAS-Port = 41524 User-Password = "645327067460" 3GPP-Charging-Gateway-Address = 10.200.211.27 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "biryudumgida3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> biryudumgida3 [sql] sql_set_user escaped user --> 'biryudumgida3' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'biryudumgida3' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'biryudumgida3' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'biryudumgida3' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'UGR_TcellOtonomYBB-Secovid' ORDER BY id [sql] User found in group UGR_TcellOtonomYBB-Secovid [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'UGR_TcellOtonomYBB-Secovid' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 101 to 10.1.1.51 port 1812 Calling-Station-Id = "905303630245" User-Name = "biryudumgida3" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015918760926" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 50711443 3GPP-GPRS-Negotiated-QoS-profile = "05-13921F7396F7FE74620846006400" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.116 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610eb2acd62 3GPP-Attr-23 = 0x8020 3GPP-IMEISV = "9800670040325323" 3GPP-PDP-Type = 0 NAS-Port = 41524 User-Password = "645327067460" 3GPP-Charging-Gateway-Address = 10.200.211.27 Proxy-State = 0x3130 Proxying request 5 to home server 10.1.1.51 port 1812 Sending Access-Request of id 101 to 10.1.1.51 port 1812 Calling-Station-Id = "905303630245" User-Name = "biryudumgida3" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015918760926" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 50711443 3GPP-GPRS-Negotiated-QoS-profile = "05-13921F7396F7FE74620846006400" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.116 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610eb2acd62 3GPP-Attr-23 = 0x8020 3GPP-IMEISV = "9800670040325323" 3GPP-PDP-Type = 0 NAS-Port = 41524 User-Password = "645327067460" 3GPP-Charging-Gateway-Address = 10.200.211.27 Proxy-State = 0x3130 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 10.1.1.51 port 1812, id=101, length=24 Proxy-State = 0x3130 # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> biryudumgida3 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 10 to 172.30.80.1 port 24144 Waking up in 4.9 seconds. Cleaning up request 5 ID 10 with timestamp +143 Ready to process requests. ####################################################3 User somes from GGSN SQL detect username and IP pool and profile Freeradius receive Access-Accept message from home server: rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=80, length=24 Proxy-State = 0x3130 # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 3 [sqlippool] expand: %{User-Name} -> biryudumgida3 [sqlippool] sql_set_user escaped user --> 'biryudumgida3' [sqlippool] expand: START TRANSACTION -> START TRANSACTION Then again SQL query Again and again. really dont know why happen > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html -- <br> <img src="http://www.yasar.com.tr/banner/yhbanner.jpg"> </img> <br><br> Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

8 11

test succeeds but can't connect?
by Brian 02 Mar '15

02 Mar '15

Hello, I am using FreeRADIUS Version 2.1.12 on CentOS 6. I set up Freeradius and MSCHAPV2 according to these guides. http://safesrv.net/install-and-setup-freeradius-on-centos-5/ http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html The tests succeed. Sending Access-Request of id 148 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=148, length=20 However when I tried to implement it in WPA2 enterprise on my DD-WRT router, I can't connect. It just keeps trying to authenticate on my device but never succeeds. I did make sure to select peap/mschapv2. I also made sure port 1812 was open on the server and it is, both incoming and outgoing. I can't find any log file that would show any useful info. I apologize if this is a noob problem but I can't find anything that would give a simple answer. Thank you all.

2 1