- Freeradius-Users - lists.freeradius.org

version 2.2.5 repo
by Rando Nakarmi 29 Sep '14

29 Sep '14

HI, I see both in RHEL and epel , the freeradius version 2.1.12-4 is available but not the 2.2.5 which is the newest version on 2.x.x series. I am used to do yum, where can I get version 2.2.5 in yum repo for RHEL base linux. R

3 3

Re: Regarding Radmin
by Himanshu Pandey 29 Sep '14

29 Sep '14

UNDERSTOOD! THANKS! From: "Fajar A. Nugraha" <list(a)fajar.net> Sent: Mon, 29 Sep 2014 15:06:46 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Regarding Radmin On Mon, Sep 29, 2014 at 4:07 PM, Himanshu Pandey <pandey_himanshu80(a)rediffmail.com> wrote: Hi, I was using radmin to view the server statistics. But I am not getting and finding examples of the usage of these few radmin commands. For e.g., 1. set module <command> --- What is command overhere? 2. show <command> ----  What is command overhere? 3. stats <command> ----  What is command overhere? 4. add <command> ---- What is command overhere? 5. set <command> ---- What is command overhere? Please give me examples so that I can understand them. Did you try typing "help"? radmin> helpadd <command> - do sub-command of adddebug <command> - debugging commandsdel <command> - do sub-command of delhup [module] - sends a HUP signal to the server, or optionally to one moduleinject <command> - commands to inject packets into a running serverreconnect - reconnect to a running serverterminate - terminates the server, and cause it to exitset <command> - do sub-command of setshow <command> - do sub-command of showstats <command> - do sub-command of statsradmin> help add  add <command> - do sub-command of adddebug <command> - debugging commandsdel <command> - do sub-command of delhup [module] - sends a HUP signal to the server, or optionally to one moduleinject <command> - commands to inject packets into a running serverreconnect - reconnect to a running serverterminate - terminates the server, and cause it to exitset <command> - do sub-command of setshow <command> - d! o sub-command of showstats <command> - do sub-command of stats radmin> add helpadd client <command> - Add client configuration commands radmin> add client helpadd client file <filename> - Add new client definition from <filename> radmin> debug help debug condition [condition] - Enable debugging for requests matching [condition]debug level <number> - Set debug level to <number>.  Higher is more debugging.debug file [filename] - Send all debugging output to [filename] -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Regarding Radmin
by Fajar A. Nugraha 29 Sep '14

29 Sep '14

On Mon, Sep 29, 2014 at 4:07 PM, Himanshu Pandey < pandey_himanshu80(a)rediffmail.com> wrote: > Hi, > > I was using radmin to view the server statistics. But I am not getting and > finding examples of the usage of these few radmin commands. For e.g., > > 1. set module <command> --- What is command overhere? > > 2. show <command> ---- What is command overhere? > > 3. stats <command> ---- What is command overhere? > > 4. add <command> ---- What is command overhere? > > 5. set <command> ---- What is command overhere? > > Please give me examples so that I can understand them. > > Did you try typing "help"? radmin> help add <command> - do sub-command of add debug <command> - debugging commands del <command> - do sub-command of del hup [module] - sends a HUP signal to the server, or optionally to one module inject <command> - commands to inject packets into a running server reconnect - reconnect to a running server terminate - terminates the server, and cause it to exit set <command> - do sub-command of set show <command> - do sub-command of show stats <command> - do sub-command of stats radmin> help add add <command> - do sub-command of add debug <command> - debugging commands del <command> - do sub-command of del hup [module] - sends a HUP signal to the server, or optionally to one module inject <command> - commands to inject packets into a running server reconnect - reconnect to a running server terminate - terminates the server, and cause it to exit set <command> - do sub-command of set show <command> - do sub-command of show stats <command> - do sub-command of stats radmin> add help add client <command> - Add client configuration commands radmin> add client help add client file <filename> - Add new client definition from <filename> radmin> debug help debug condition [condition] - Enable debugging for requests matching [condition] debug level <number> - Set debug level to <number>. Higher is more debugging. debug file [filename] - Send all debugging output to [filename] -- Fajar

1 0

Re: freeradius sql groups not working
by James w 29 Sep '14

29 Sep '14

Here is the sql module being loaded: It shows the group queries so not sure why it doesn't process them # Loaded module rlm_sql # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "123456" radius_db = "radius" read_groups = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" } post-auth { reference = ".query" } mysql { tls { } }rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to database "radius"rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_delay = 5 idle_timeout = 60 spread = no }rlm_sql (sql): Opening additional connection (0)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (1)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (2)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (3)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (4)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Processing generate_sql_clientsrlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nasrlm_sql (sql): Reserved connection (4)rlm_sql (sql): Executing query: 'SELECT id, nasname, shortname, type, secret, server FROM nas'rlm_sql (sql): Released connection (4) } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/raddb/radiusd.conf} # serverserver default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading virtual module filter_usernameWARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading virtual module acct_unique # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} # Loading virtual module remove_reply_message_if_eap # Loading virtual module remove_reply_message_if_eap} # server defaultserver inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...}} # server inner-tunnelradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}Listening on auth address * port 1812 as server defaultListening on acct address * port 1813 as server defaultListening on auth address 127.0.0.1 port 18120 as server inner-tunnelOpening new proxy address * port 1814Listening on proxy address * port 1814Ready to process requests. > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 113, Issue 129 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 29 Sep 2014 09:29:30 +0200 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Beginner need help (unrecognized clients) (Frank Wei) > 2. Re: freeradius sql groups not working (James w) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 29 Sep 2014 05:09:58 +0000 > From: Frank Wei <Frank.Wei(a)4rf.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Beginner need help (unrecognized clients) > Message-ID: > <36A567FFA4FB734C89ABF498A70F83AE9615B3BA(a)4rf-nz-orion.local.4rf.com> > Content-Type: text/plain; charset="us-ascii" > > Dear friends, > > I have added clients > > client private-network-1 { > ipaddr = 192.168.0.244 > netmask = 24 > secret = testing123-1 > shortname = private-network-1 > } > > To the clients.conf. > > And run command "radius -X". From the debug message I can see the added client loaded. > > Then from my NAS (with IP 192.168.0.244) I sent a "authentication only" request to the server. The server showed me a message: > > Ignored,.....Unrecognized client "192.168.0.244" port "1222". > > What is wrong with my config? > > Regards, > Frank > > > -----Original Message----- > From: freeradius-users-bounces+frank.wei=4rf.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+frank.wei=4rf.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk > Sent: Thursday, 25 September 2014 6:49 p.m. > To: FreeRadius users mailing list > Subject: Re: Beginner need help > > Hi, > > > My understanding is that source IP address of the Access-Request packets must be the NAS IP address which is "NAS-IP-Address". Apparently this is different to the Attribute description. > > > > Could anybody explain? > > sure. > > the NAS-IP-Address is set by the NAS - so it SHOULD be its IP address in a nice world. okay > thats clear....however, the packet might be reaching your RADIUS server via some other > route - lets say, eg a NAT gateway, a RADIUS server (it has been proxied) or from some > central controller (thinking of some of the WiFi solutions out there) - in which case > the NAS-IP-Address is NOT the source IP address of the packet. > > > the NAS-IP-Address is also part of the RADIUS datagram - so you've already started to > analyse the packet contents really before you can - eg how did you ensure the packet > contents were correct, verify the message authenticator or ensured the content values > by using the shared secret? you didnt. > > the RADIUS datagram comes in. you see the source address of the packet. look up the client, > get its shared secret, work on the packet. > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it). > > > ------------------------------ > > Message: 2 > Date: Mon, 29 Sep 2014 07:29:26 +0000 > From: James w <spyda46(a)hotmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: freeradius sql groups not working > Message-ID: <DUB123-W2A21F9FBF92014A289545B2BA0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Does anybody have any suggestions, could this be a bug ? Shall i try another version, its running on RHEL 7 Free radius version 3.0.1 > > > From: freeradius-users-request(a)lists.freeradius.org > > Subject: Freeradius-Users Digest, Vol 113, Issue 128 > > To: freeradius-users(a)lists.freeradius.org > > Date: Mon, 29 Sep 2014 04:06:31 +0200 > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Re: How to send disconnect message to the NAS? (Alan DeKok) > > 2. Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? (Oleksandr Yermolenko) > > 3. Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? (Oleksandr Yermolenko) > > 4. version 2.2.5 repo (Rando Nakarmi) > > 5. Re: version 2.2.5 repo (Alan DeKok) > > 6. Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? (Alan DeKok) > > 7. Re: Problem in Module Statistics in freeradius (Himanshu Pandey) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Sun, 28 Sep 2014 11:08:16 -0400 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: How to send disconnect message to the NAS? > > Message-ID: <54282460.1090603(a)deployingradius.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Xin wrote: > > > Thanks a lot for your reply, I have understood I can use update control > > > section to control send or not. And one more question, what is the virtual > > > server in home_server_pool section. Just find the server > > > originate-coa.example.com section? > > > > The behavior is documented in that file. > > > > > If this is right, can you tell me the > > > usage of pre-proxy section? I have already understand the purpose of the > > > post-proxy is to handle the COA/DM response. > > > > Read the file. This is documented. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 28 Sep 2014 18:52:59 +0300 > > From: Oleksandr Yermolenko <aae(a)sumix.com> > > To: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? > > Message-ID: <54282EDB.20904(a)sumix.com> > > Content-Type: text/plain; charset=utf-8; format=flowed > > > > > > >> Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or > > >> EAP-TLS ...) with rlm_perl. > > > What does that mean? > > can I use authenticate, authorize, accounting hooks (or post_auth)? > > I looked at example.pl. > > > > Just put "perl" in somewhere eap.conf file? > > > > > > > > You can run the perl module when the server receives a packet. It > > > doesn't matter whether the packet contains PAP, CHAP, MS-CHAP, or any > > > EAP type. > > > > > > What do you want to *do* in rlm_perl? Knowing that probably more > > > useful, and will get you a better answer. > > authenticate a lot of VPN clients (currently I can choose EAP method), > > keeping them in mysql or ldap. According their properties give a > > personal access to > > different local resources. Accounting: updating start/stop/alive > > messages. POD if it's possible > > for strongswan. > > > > > > Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 3 > > Date: Sun, 28 Sep 2014 18:52:59 +0300 > > From: Oleksandr Yermolenko <aae(a)sumix.com> > > To: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? > > Message-ID: <54282EDB.20904(a)sumix.com> > > Content-Type: text/plain; charset=utf-8; format=flowed > > > > > > >> Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or > > >> EAP-TLS ...) with rlm_perl. > > > What does that mean? > > can I use authenticate, authorize, accounting hooks (or post_auth)? > > I looked at example.pl. > > > > Just put "perl" in somewhere eap.conf file? > > > > > > > > You can run the perl module when the server receives a packet. It > > > doesn't matter whether the packet contains PAP, CHAP, MS-CHAP, or any > > > EAP type. > > > > > > What do you want to *do* in rlm_perl? Knowing that probably more > > > useful, and will get you a better answer. > > authenticate a lot of VPN clients (currently I can choose EAP method), > > keeping them in mysql or ldap. According their properties give a > > personal access to > > different local resources. Accounting: updating start/stop/alive > > messages. POD if it's possible > > for strongswan. > > > > > > Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 4 > > Date: Sun, 28 Sep 2014 19:14:18 +0000 > > From: Rando Nakarmi <randonakarmi(a)gmail.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: version 2.2.5 repo > > Message-ID: > > <CAG+85v_XJ_v8cJGu-tMqi+eWNSsnME=7mZcv5yqAhB6d9K+_KA(a)mail.gmail.com> > > Content-Type: text/plain; charset="utf-8" > > > > HI, > > > > I see both in RHEL and epel , the freeradius version 2.1.12-4 is available > > but not the 2.2.5 which is the newest version on 2.x.x series. > > > > I am used to do yum, where can I get version 2.2.5 in yum repo for RHEL > > base linux. > > > > R > >

1 0

Re: Problem in Module Statistics in freeradius
by Himanshu Pandey 29 Sep '14

29 Sep '14

DONE. From: Alan DeKok <aland(a)deployingradius.com> Sent: Sun, 28 Sep 2014 19:25:18 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Problem in Module Statistics in freeradius Himanshu Pandey wrote: > I added the following code in modcall.c under the function > modcall_recurse():  This list is for *using* FreeRADIUS.  It's not for learning how to program.  You're making beginners errors in the code.  Don't do that.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

EAP and rlm_perl. Is it possible to build custom logic for VPN peers?
by Oleksandr Yermolenko 28 Sep '14

28 Sep '14

Hello, Started a new project and trying to make solution, I can't find the answer on the following: Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or EAP-TLS ...) with rlm_perl. Thanks a lot for your time and any advices. Alex. // <http://wiki.freeradius.org/modules/Rlm_perl>

2 3

How to send disconnect message to the NAS?
by Xin 28 Sep '14

28 Sep '14

Hi, I want to send disconnect message to the user who has exceeded the limited traffic. I have done the following steps: 1. Create a sqlCounter: sqlcounter monthlytrafficcounter { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Monthly-Traffic-Limit sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM radacct WHERE U serName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'" } 2. add the monthlytrafficcounter to "sites-enabled/default" authorize section. 3. It worked when user login to NAS(NAS reject the user's request), but failed when the user connection connected. The Accounting request like following below: ================================================================ rad_recv: Accounting-Request packet from host NAS-IP port 48378, id=188 , length=175 Acct-Status-Type = Interim-Update Acct-Session-Id = "1411720910-19" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 19 NAS-Port-Id = "radius" NAS-IP-Address = NAS-IP Called-Station-Id = "NAS-IP[4500]" Calling-Station-Id = "User-IP[5476]" User-Name = "kirito" Framed-IP-Address = 10.0.0.1 Acct-Output-Octets = 549938 Acct-Output-Packets = 602 Acct-Input-Octets = 77110 Acct-Input-Packets = 785 Acct-Session-Time = 122 NAS-Identifier = "strongSwan" # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 19,NAS-Identifier = "strongSwan",NAS-IP-Addres s = NAS-IP,Acct-Session-Id = "1411720910-19",User-Name = "kirito"' [acct_unique] Acct-Unique-Session-ID = "afe2593237df22fa". ++[acct_unique] = ok [suffix] No '@' in User-Name = "kirito", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop +} # group preacct = ok # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/defa ult +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> NAS-IP [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Addr ess}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/rad acct/NAS-IP/detail-20140926 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet- Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11 6.251.216.197/detail-20140926 [detail] expand: %t -> Fri Sep 26 21:19:07 2014 ++[detail] = ok [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> kirito [sql] expand: %{%{User-Name}:-DEFAULT} -> kirito [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> kirito [sql] sql_set_user escaped user --> 'kirito' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> 77110 [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> 549938 [sql] expand: UPDATE radacct SET framedipadd ress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Sessio n-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessioni d = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET framedipaddress = '10.0.0.1', acctsessionti me = '122', acctinputoctets = '0' << 32 | '77110', acctoutputoctets = '0' << 32 | '549938' WHERE acctsessionid = '14117209 10-19' AND username = 'kirito' AND na rlm_sql (sql): Reserving sql socket id: 12 rlm_sql (sql): Released sql socket id: 12 ++[sql] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> kirito attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 188 to NAS-IP port 48378 Finished request 6. Cleaning up request 6 ID 188 with timestamp +157 Going to the next request Ready to process requests. ================================================================= I think it may have a way to send the Disconnect Message to NAS when FreeRadius server get the Accounting-Request message. But I don't know how do I do. Appreciate for your response.

3 10

Problem in Module Statistics in freeradius
by Himanshu Pandey 28 Sep '14

28 Sep '14

Dear Alan, I added the following code in modcall.c under the function modcall_recurse(): rlm_rcode_t result; module_t module; int i; result = call_modsingle(c->method, sp, request); module.rtcode[result] = module.rtcode[result] + 1; /*Used printf to view the array elements*/ for (i = 0; i < RLM_MODULE_NUMCODES; i++) { printf("\nRTCODE[%d]=%ld\n",i,module.rtcode[i]); } In module_t structure I added my unsigned long array: uint64_t rtcode[RLM_MODULE_NUMCODES]; //Used for module return codes But I am getting junk values in array at times and I don't know where exactly shall I do memset(module.rtcode,0,sizeof(module.rtcode)); Please help to resolve this. Following debug log is generated when I run radiusd -X. Starting - reading configuration files ... including dictionary file /opt/freeradius/share/freeradius/dictionary including dictionary file /opt/freeradius/share/freeradius/dictionary.dhcp including dictionary file /opt/freeradius/share/freeradius/dictionary.vqp including dictionary file /opt/freeradius/etc/raddb/dictionary including configuration file /opt/freeradius/etc/raddb/radiusd.conf including configuration file /opt/freeradius/etc/raddb/proxy.conf including configuration file /opt/freeradius/etc/raddb/clients.conf including files in directory /opt/freeradius/etc/raddb/mods-enabled/ including configuration file /opt/freeradius/etc/raddb/mods-enabled/always including configuration file /opt/freeradius/etc/raddb/mods-enabled/logintime including configuration file /opt/freeradius/etc/raddb/mods-enabled/digest including configuration file /opt/freeradius/etc/raddb/mods-enabled/cache_eap including configuration file /opt/freeradius/etc/raddb/mods-enabled/exec including configuration file /opt/freeradius/etc/raddb/mods-enabled/dynamic_clients including configuration file /opt/freeradius/etc/raddb/mods-enabled/files including configuration file /opt/freeradius/etc/raddb/mods-enabled/passwd including configuration file /opt/freeradius/etc/raddb/mods-enabled/replicate including configuration file /opt/freeradius/etc/raddb/mods-enabled/pap including configuration file /opt/freeradius/etc/raddb/mods-enabled/realm including configuration file /opt/freeradius/etc/raddb/mods-enabled/attr_filter including configuration file /opt/freeradius/etc/raddb/mods-enabled/ntlm_auth including configuration file /opt/freeradius/etc/raddb/mods-enabled/detail including configuration file /opt/freeradius/etc/raddb/mods-enabled/dhcp including configuration file /opt/freeradius/etc/raddb/mods-enabled/utf8 including configuration file /opt/freeradius/etc/raddb/mods-enabled/chap including configuration file /opt/freeradius/etc/raddb/mods-enabled/unpack including configuration file /opt/freeradius/etc/raddb/mods-enabled/sradutmp including configuration file /opt/freeradius/etc/raddb/mods-enabled/mschap including configuration file /opt/freeradius/etc/raddb/mods-enabled/expiration including configuration file /opt/freeradius/etc/raddb/mods-enabled/eap including configuration file /opt/freeradius/etc/raddb/mods-enabled/unix including configuration file /opt/freeradius/etc/raddb/mods-enabled/expr including configuration file /opt/freeradius/etc/raddb/mods-enabled/radutmp including configuration file /opt/freeradius/etc/raddb/mods-enabled/soh including configuration file /opt/freeradius/etc/raddb/mods-enabled/linelog including configuration file /opt/freeradius/etc/raddb/mods-enabled/detail.log including configuration file /opt/freeradius/etc/raddb/mods-enabled/preprocess including configuration file /opt/freeradius/etc/raddb/mods-enabled/echo including files in directory /opt/freeradius/etc/raddb/policy.d/ including configuration file /opt/freeradius/etc/raddb/policy.d/operator-name including configuration file /opt/freeradius/etc/raddb/policy.d/canonicalization including configuration file /opt/freeradius/etc/raddb/policy.d/dhcp including configuration file /opt/freeradius/etc/raddb/policy.d/debug including configuration file /opt/freeradius/etc/raddb/policy.d/eap including configuration file /opt/freeradius/etc/raddb/policy.d/cui including configuration file

2 1

freeradius sql groups not working
by James w 28 Sep '14

28 Sep '14

Hi, I am having some trouble with freeradius and the SQL module. The issue i have is the radgroupcheck and radgroupreply tables never get read by freeradius. I cannot find a reason why the group tables aren't being used, they meet the requirements according the the wiki. Specifically my Pool-Name is not being pulled and assigned to the user from the groupcheck. If i set the pool name in radcheck and not radgroupcheck it works and the user is assigned an IP from the pool. In the sql.conf i have checked "read_groups = yes" is set The sqlippool and sql modules are enabled in the default sites setup hence it works when set in radcheck. This problem is because the groups are not being read. I would really like some help as to why my groups aren't working Here is my config and a debug out of radiusd -X MariaDB [radius]> select * from radcheck;+----+----------+--------------------+----+-------+| id | username | attribute | op | value |+----+----------+--------------------+----+-------+| 1 | user | Cleartext-Password | := | pass |+----+----------+--------------------+----+-------+4 rows in set (0.00 sec) MariaDB [radius]> select * from radusergroup;+----------+-----------+----------+| username | groupname | priority |+----------+-----------+----------+| user | vpngroup | 1 |+----------+-----------+----------+1 row in set (0.00 sec) MariaDB [radius]> select * from radgroupcheck;+----+-----------+--------------+----+-------+| id | groupname | attribute | op | value |+----+-----------+--------------+----+-------+| 3 | vpngroup | Pool-Name | := | pool1 |+----+-----------+--------------+----+-------+2 rows in set (0.01 sec) MariaDB [radius]> select * from radippool;+----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+| id | pool_name | framedipaddress | nasipaddress | calledstationid | callingstationid | expiry_time | username | pool_key |+----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+| 1 | pool1 | 172.16.15.1 | | | | NULL | | 0 || 2 | pool1 | 172.16.15.2 | | | | NULL | | || 3 | pool1 | 172.16.15.3 | | | | NULL | | |+----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+3 rows in set (0.00 sec) >From the above it meets the requirements set out in the wiki - http://wiki.freeradius.org/modules/Rlm_sql "The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes' " >From the debug out you can see it doesn't check the groups then moves on and says " (0) sqlippool : No Pool-Name defined." I have also checked the file /etc/raddb/mods-config/sql/main/mysql/queries.conf and i see the queries for the groupcheck its just not doing it Ready to process requests.rad_recv: Access-Request packet from host 192.168.1.109 port 55758, id=53, length=146 Service-Type = Framed-User Framed-Protocol = PPP User-Name = 'test' MS-CHAP-Challenge = 0x7098b7e479b88ea6ea646493435c771e MS-CHAP2-Response = 0x7a002c2ae80d2311583f5e38117753a3dc7a0000000000000000eef14310bcc325e0edb4908298df6014328fc042ddaf2360 Calling-Station-Id = '192.168.1.70' NAS-IP-Address = 127.0.0.1 NAS-Port = 0(0) # Executing section authorize from file /etc/raddb/sites-enabled/default(0) authorize {(0) filter_username filter_username {(0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'test'(0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE(0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE(0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE(0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE(0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE(0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE(0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE(0) } # filter_username filter_username = notfound(0) [preprocess] = ok(0) auth_log : expand: "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" -> '/var/log/radius/radacct/192.168.1.109/auth-detail-20140926'(0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.109/auth-detail-20140926(0) auth_log : expand: "%t" -> 'Fri Sep 26 06:51:18 2014'(0) [auth_log] = ok(0) [chap] = noop(0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap'(0) [mschap] = ok(0) [digest] = noop(0) suffix : No '@' in User-Name = "test", looking up realm NULL(0) suffix : No such realm "NULL"(0) [suffix] = noop(0) eap : No EAP-Message, not doing EAP(0) [eap] = noop(0) files : users: Matched entry DEFAULT at line 181(0) [files] = ok(0) sql : expand: "%{User-Name}" -> 'test'(0) sql : SQL-User-Name set to 'test'rlm_sql (sql): Reserved connection (4)(0) sql : expand: "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id'rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id'(0) sql : User found in radcheck table(0) sql : Check items matched(0) sql : expand: "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id'rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id'(0) sql : expand: "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" -> 'SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority'rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority'rlm_sql (sql): Released connection (4)rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3)rlm_sql_mysql: Socket destructor called, closing socket(0) [sql] = ok(0) [expiration] = noop(0) [logintime] = noop(0) WARNING: pap : Auth-Type already set. Not setting to PAP(0) [pap] = noop(0) } # authorize = ok(0) Found Auth-Type = MSCHAP(0) # Executing group from file /etc/raddb/sites-enabled/default(0) Auth-Type MS-CHAP {(0) mschap : Found Cleartext-Password, hashing to create LM-Password(0) mschap : Found Cleartext-Password, hashing to create NT-Password(0) mschap : Creating challenge hash with username: test(0) mschap : Client is using MS-CHAPv2 for test, we need NT-Password(0) mschap : adding MS-CHAPv2 MPPE keys(0) [mschap] = ok(0) } # Auth-Type MS-CHAP = ok(0) Login OK: [test/<via Auth-Type = MSCHAP>] (from client 192.168.1.109 port 0 cli 192.168.1.70)(0) # Executing section post-auth from file /etc/raddb/sites-enabled/default(0) post-auth {(0) sql : expand: ".query" -> '.query'(0) sql : Using query template 'query'rlm_sql (sql): Reserved connection (4)(0) sql : expand: "%{User-Name}" -> 'test'(0) sql : SQL-User-Name set to 'test'(0) sql : expand: "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" -> 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '', 'Access-Accept', '2014-09-26 06:51:18')'rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '', 'Access-Accept', '2014-09-26 06:51:18')'rlm_sql (sql): Released connection (4)(0) [sql] = ok(0) sqlippool : No Pool-Name defined.(0) sqlippool : expand: "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" -> 'No Pool-Name defined (did cli 192.168.1.70 port 0 user test)'(0) [sqlippool] = noop(0) [exec] = noop(0) remove_reply_message_if_eap remove_reply_message_if_eap {(0) ? if (reply:EAP-Message && reply:Reply-Message) (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE(0) else else {(0) [noop] = noop(0) } # else else = noop(0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop(0) } # post-auth = okSending Access-Accept of id 53 from 192.168.1.67 port 1812 to 192.168.1.109 port 55758 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x7a533d30383134394335414641303837374636373833433934413034313938373737363341344231433632 MS-MPPE-Recv-Key = 0xa2232b07eab47e9464305946464fdd13 MS-MPPE-Send-Key = 0xf1ab397d79c4eb450b5dde7dad811f1d MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4(0) Finished request 0.Waking up in 0.2 seconds.Waking up in 4.7 seconds.rad_recv: Accounting-Request packet from host 192.168.1.109 port 35133, id=54, length=110 Acct-Session-Id = '5425A63435B300' User-Name = 'test' Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = '192.168.1.70' Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.1.1 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0(1) # Executing section preacct from file /etc/raddb/sites-enabled/default(1) preacct {(1) [preprocess] = ok(1) acct_unique acct_unique {(1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (1) expand: "%{string:Class}" -> ''(1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE(1) else else {(1) update request {(1) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '84b95fb1219c04cd5fd1f53d294840aa'(1) Acct-Unique-Session-Id := "84b95fb1219c04cd5fd1f53d294840aa"(1) } # update request = noop(1) } # else else = noop(1) } # acct_unique acct_unique = noop(1) suffix : No '@' in User-Name = "test", looking up realm NULL(1) suffix : No such realm "NULL"(1) [suffix] = noop(1) [files] = noop(1) } # preacct = ok(1) # Executing section accounting from file /etc/raddb/sites-enabled/default(1) accounting {(1) detail : expand: "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/var/log/radius/radacct/192.168.1.109/detail-20140926'(1) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.109/detail-20140926(1) detail : expand: "%t" -> 'Fri Sep 26 06:51:20 2014'(1) [detail] = ok(1) [unix] = okrlm_sql (sql): Reserved connection (4)(1) sqlippool : expand: "%{User-Name}" -> 'test'(1) sqlippool : SQL-User-Name set to 'test'(1) sqlippool : expand: "START TRANSACTION" -> 'START TRANSACTION'rlm_sql (sql): Executing query: 'START TRANSACTION'(1) sqlippool : expand: "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" -> 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''rlm_sql (sql): Executing query: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''(1) sqlippool : expand: "COMMIT" -> 'COMMIT'rlm_sql (sql): Executing query: 'COMMIT'rlm_sql (sql): Released connection (4)rlm_sql (sql): Closing connection (1): Too many free connections (4 > 3)rlm_sql_mysql: Socket destructor called, closing socket(1) [sqlippool] = ok(1) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.start.query'(1) sql : Using query template 'query'rlm_sql (sql): Reserved connection (4)(1) sql : expand: "%{User-Name}" -> 'test'(1) sql : SQL-User-Name set to 'test'(1) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5425A63435B300', '84b95fb1219c04cd5fd1f53d294840aa', 'test', '', '127.0.0.1', '0', 'Async', FROM_UNIXTIME(1411710680), FROM_UNIXTIME(1411710680), NULL, '0', 'RADIUS', '', '', '0', '0', '', '192.168.1.70', '', 'Framed-User', 'PPP', '192.168.1.1')'rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5425A63435B300', '84b95fb1219c04cd5fd1f53d294840aa', 'test', '', '127.0.0.1', '0', 'Async', FROM_UNIXTIME(1411710680), FROM_UNIXTIME(1411710680), NULL, '0', 'RADIUS', '', '', '0', '0', '', '192.168.1.70', '', 'Framed-User', 'PPP', '192.168.1.1')'rlm_sql (sql): Released connection (4)(1) [sql] = ok(1) [exec] = noop(1) attr_filter.accounting_response : expand: "%{User-Name}" -> 'test'(1) attr_filter.accounting_response : Matched entry DEFAULT at line 12(1) [attr_filter.accounting_response] = updated(1) } # accounting = updatedSending Accounting-Response of id 54 from 192.168.1.67 port 1813 to 192.168.1.109 port 35133(1) Finished request 1.Waking up in 0.2 seconds.(1) Cleaning up request packet ID 54 with timestamp +14Waking up in 2.7 seconds.(0) Cleaning up request packet ID 53 with timestamp +12Ready to process requests.rad_recv: Accounting-Request packet from host 192.168.1.109 port 59458, id=55, length=146 Acct-Session-Id = '5425A63435B300' User-Name = 'test' Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 4 Acct-Output-Octets = 0 Acct-Input-Octets = 2804 Acct-Output-Packets = 0 Acct-Input-Packets = 36 Calling-Station-Id = '192.168.1.70' NAS-Port-Type = Async Acct-Terminate-Cause = User-Request Framed-IP-Address = 192.168.1.1 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0(2) # Executing section preacct from file /etc/raddb/sites-enabled/default(2) preacct {(2) [preprocess] = ok(2) acct_unique acct_unique {(2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (2) expand: "%{string:Class}" -> ''(2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE(2) else else {(2) update request {(2) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '84b95fb1219c04cd5fd1f53d294840aa'(2) Acct-Unique-Session-Id := "84b95fb1219c04cd5fd1f53d294840aa"(2) } # update request = noop(2) } # else else = noop(2) } # acct_unique acct_unique = noop(2) suffix : No '@' in User-Name = "test", looking up realm NULL(2) suffix : No such realm "NULL"(2) [suffix] = noop(2) [files] = noop(2) } # preacct = ok(2) # Executing section accounting from file /etc/raddb/sites-enabled/default(2) accounting {(2) detail : expand: "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/var/log/radius/radacct/192.168.1.109/detail-20140926'(2) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.109/detail-20140926(2) detail : expand: "%t" -> 'Fri Sep 26 06:51:23 2014'(2) [detail] = ok(2) [unix] = okrlm_sql (sql): Reserved connection (4)(2) sqlippool : expand: "%{User-Name}" -> 'test'(2) sqlippool : SQL-User-Name set to 'test'(2) sqlippool : expand: "START TRANSACTION" -> 'START TRANSACTION'rlm_sql (sql): Executing query: 'START TRANSACTION'(2) sqlippool : expand: "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" -> 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''rlm_sql (sql): Executing query: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''(2) sqlippool : expand: "COMMIT" -> 'COMMIT'rlm_sql (sql): Executing query: 'COMMIT'(2) sqlippool : expand: "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" -> 'Released IP 192.168.1.1 (did cli 192.168.1.70 user test)'rlm_sql (sql): Released connection (4)(2) [sqlippool] = ok(2) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.stop.query'(2) sql : Using query template 'query'rlm_sql (sql): Reserved connection (4)(2) sql : expand: "%{User-Name}" -> 'test'(2) sql : SQL-User-Name set to 'test'(2) sql : expand: "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1411710683), acctsessiontime = '4', acctinputoctets = '0' << 32 | '2804', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', connectinfo_stop = '' WHERE acctsessionid = '5425A63435B300' AND username = 'test' AND nasipaddress = '127.0.0.1''rlm_sql (sql): Executing query: 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1411710683), acctsessiontime = '4', acctinputoctets = '0' << 32 | '2804', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', connectinfo_stop = '' WHERE acctsessionid = '5425A63435B300' AND username = 'test' AND nasipaddress = '127.0.0.1''rlm_sql (sql): Released connection (4)(2) [sql] = ok(2) [exec] = noop(2) attr_filter.accounting_response : expand: "%{User-Name}" -> 'test'(2) attr_filter.accounting_response : Matched entry DEFAULT at line 12(2) [attr_filter.accounting_response] = updated(2) } # accounting = updatedSending Accounting-Response of id 55 from 192.168.1.67 port 1813 to 192.168.1.109 port 59458(2) Finished request 2.Waking up in 0.3 seconds.(2) Cleaning up request packet ID 55 with timestamp +17Ready to process requests.

2 2

MSCHAP2 local Password change failure - "MS-CHAP-New-Cleartext-Password" char buffer not \0 terminated
by Isaac Boukris 27 Sep '14

27 Sep '14

Hello, I've encounter this issue while running some tests with the new MSCHAP2 password change feature. My setup consists of the following. # radiusd -v radiusd: FreeRADIUS Version 3.0.5 (git #b6c3143), for host i686-pc-linux-gnu, built on Sep 19 2014 at 01:28:18 /etc/raddb/users: anna Cleartext-Password := 'aaaa', SMB-Account-Ctrl-Text := '[Ue]' /etc/raddb/mods-enabled/mschap (under passchange): local_cpw = "%{exec:/bin/mys %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" When I first enter the password I get the proper error of user expired, when I enter the new password radiusd crashes. This is what 'radiusd -X' shows before it exits: (2) mschap : MS-CHAPv2 password change request received (2) mschap : Password change payload valid (2) mschap : Doing MS-CHAPv2 password change locally CONSISTENCY CHECK FAILED src/lib/cursor.c[151]: VALUE_PAIR "MS-CHAP-New-Cleartext-Password" char buffer not \0 terminated SOFT ASSERT FAILED src/lib/debug.c[1008]: 0 CAUGHT SIGNAL: User defined signal 1 Backtrace of last 35 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x105)[0x82d281] ... When I add: RDEBUG("length is: %d - and new pass is %s", new_pass->length, new_pass->vp_strvalue); At: https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/rlm… I get: (2) mschap : length is: 4 - and new pass is bbbb?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? So adding the following line at the same place makes it work ok (my script gets the new password and I get access-accept): x[new_pass->length] = '\0'; But I am not sure it is a proper solution as I am still reading about encoding stuff. If any additional information or tests are needed i'll be glad to supply. Thanks a lot for the great open software. Isaac Boukris

2 4