- Freeradius-Users - lists.freeradius.org

Re: Problem with the sqlcounter!
by Haviaras Kostas 04 Dec '14

04 Dec '14

I finally manage to solve my problem, I just add the fall-through "Yes" on the radreply and radgroupreply tables and it works.

1 0

Accounting-Start and Accounting-Off
by Frank Wei 03 Dec '14

03 Dec '14

Hi All, I have a few questions about the "Accounting-Start" and "Accounting-Off". 1. If a NAS configured to have a primary and a backup RADIUS server. To start with all the "Accounting-Start" records will be in the primary RADIUS server. Later on the primary server goes down (Primary server won't tell the NAS?). When sessions stop, the NAS sends the "Accounting-Stop" to the secondary. I understand the "Start-Stop" record with the same "user name" and "session-id" ideally should be recorded in the same server. If this situation happens what should both the NAS and RADIUS server do? 2. A NAS configured to have a primary and backup RADIUS server. To start with all the "Accounting-Start" records will be in the primary RADIUS server. Later on the administrator decided to change the primary server (as there are problems with the previous primary). sessions stop, the NAS sends the "Accounting-Stop" to the new primary. This ends up the "Accounting-Start" and "Accounting-Stop" with the same "user name" and "session Id" in two RADIUS servers. To summarize, how to avoid the "start-stop" pair ends up in different servers ? If it does, is it an issue for RADIUS application ? Cheers, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

1 1

Re: Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

I must add the value "All-Hour-Used" and "Max-Hour-Used" on the dictionary ? Thanks

1 0

Re: Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

Sorry I have make wrong the reply but this post is related with http://lists.freeradius.org/pipermail/freeradius-users/2014-October/074124.…

1 0

Re: Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

Here all the debug output http://pastebin.com/KdpSkNuQ Thanks

1 0

Problem with the sqlcounter!
by Haviaras Kostas 03 Dec '14

03 Dec '14

Here all the debug output http://pastebin.com/KdpSkNuQ Thanks

1 0

SQL insert on TLs failure
by Dean Goldhill 03 Dec '14

03 Dec '14

Hello, I want to write a record to the MySQL database when a client sends a TLS close notification. So when a laptop is not properly configured to trust our CA, the client sends a TLS close notification. And in the log we see something like: "Auth: Login incorrect (TLS Alert read:warning:close notify):" I know why this is happening, but I just want to write an entry to the database so we have a record of which users are failing because of this reason. Is it possible to do this? Thanks. Dean

2 2

radtest failed to send request to radius server having ipv6 address.
by timingsrc src 03 Dec '14

03 Dec '14

Hello, I have made radius server 3.0.5 setup in my PC. It worked fine with IPV4 addresses, radtest fails to send request with IPV6 addresses. Below command worked fine,user authenticated. radtest -x USER 72e#05 192.168.242.43 1812 testinglab Where as with IPV6 address it throws an error. radtest -x -6 USER 72e#05 2001:e30:1400:1:208:c7ff:fecf:9f0f 1812 testinglab (0) Error parsing "-": ip_hton: No address associated with hostname Please let me know how i should send radius auth requests with IPV6 address. Thanks, Manjunath

2 1

"Accounting-On" and "Accouting-Off"
by Frank Wei 03 Dec '14

03 Dec '14

Hi all, I am new to RADIUS. I understand "Accounting-off" can be sent before the NAS shutting down to inform the server that all the currently opened session to be closed. "Accounting -on" is to mark the start of the accounting upon booting. There are also per "session-id" based "Accounting-start" and "Accounting-stop". It seems to me if we can apply all the session IDs to "Accounting-start" and "Accounting-stop" then we do not need to use "Accounting-off" and "Accounting-on". Please somebody to explain to me when we have to use "Accounting-off" and "Accounting-on"? Regards, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

3 2

FR 3.0.4: MS-CHAP2-Response is incorrect
by Heiko O 02 Dec '14

02 Dec '14

Hello all, i have two question on realms: Authenication works fine when Users only enter "username",but i want the users to login with something like "username(a)thedomain.net". But when doing this i get (0) preprocess : --> testuser (0) [preprocess] = ok (0) [chap] = noop (0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "testuser", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> testuser (0) sql : SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'testuser' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'testuser' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'testuser' ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (0) sql : User found in radreply table (0) sql : EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT GroupName FROM radusergroup WHERE UserName='testuser' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT GroupName FROM radusergroup WHERE UserName='testuser' ORDER BY priority' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type MS-CHAP { (0) mschap : Found Cleartext-Password, hashing to create LM-Password (0) mschap : Found Cleartext-Password, hashing to create NT-Password (0) mschap : Creating challenge hash with username: testuser (0) mschap : Client is using MS-CHAPv2 (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject (0) Failed to authenticate the user I did a lot of try-and-error with suffix ans Strip and configuring, but i can't get mschap to work. How can I teach mschap to work with "user(a)thedomain.net"? BTW: The radcheck-table contains simply "username" with no realms, and that cannot be changed. The second question is about proxying. Since the is only one RADIUS-Server, proxying is not needed. I wonder if i really have to add a realm and proxy the request to localhost. Is there a way to say "Hey, just answer all queries with @thedomain.org and don't proxy it to yourself"? Thanks for your help and suggestions. Heiko

4 3