- Freeradius-Users - lists.freeradius.org

Re: rlm_sqlcounter: Max-Daily-Session.
by * 12 May '14

12 May '14

Thank you for your reply. Here is my radius -X > radiusd: FreeRADIUS Version 3.0.1, for host x86_64-pc-linux-gnu, built on Apr 15 2014 at 14:04:23 > > Copyright (C) 1999-2014 The FreeRADIUS server project and contributors > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > > PARTICULAR PURPOSE > > You may redistribute copies of FreeRADIUS under the terms of the > > GNU General Public License > > For more information about these matters, see the file named COPYRIGHT > > Starting - reading configuration files ... > > including dictionary file /etc/freeradius/dictionary > > including configuration file /etc/freeradius/radiusd.conf > > including configuration file /etc/freeradius/proxy.conf > > including configuration file /etc/freeradius/clients.conf > > including files in directory /etc/freeradius/mods-enabled/ > > including configuration file /etc/freeradius/mods-enabled/eap > > including configuration file /etc/freeradius/mods-enabled/always > > including configuration file /etc/freeradius/mods-enabled/dynamic_clients > > including configuration file /etc/freeradius/mods-enabled/detail.log > > including configuration file /etc/freeradius/mods-enabled/detail > > including configuration file /etc/freeradius/mods-enabled/sradutmp > > including configuration file /etc/freeradius/mods-enabled/expiration > > including configuration file /etc/freeradius/mods-enabled/preprocess > > including configuration file /etc/freeradius/mods-enabled/logintime > > including configuration file /etc/freeradius/mods-enabled/soh > > including configuration file /etc/freeradius/mods-enabled/dhcp > > including configuration file /etc/freeradius/mods-enabled/radutmp > > including configuration file /etc/freeradius/mods-enabled/digest > > including configuration file /etc/freeradius/mods-enabled/exec > > including configuration file /etc/freeradius/mods-enabled/echo > > including configuration file /etc/freeradius/mods-enabled/replicate > > including configuration file /etc/freeradius/mods-enabled/cache_eap > > including configuration file /etc/freeradius/mods-enabled/linelog > > including configuration file /etc/freeradius/mods-enabled/utf8 > > including configuration file /etc/freeradius/mods-enabled/attr_filter > > including configuration file /etc/freeradius/mods-enabled/chap > > including configuration file /etc/freeradius/mods-enabled/realm > > including configuration file /etc/freeradius/mods-enabled/passwd > > including configuration file /etc/freeradius/mods-enabled/ntlm_auth > > including configuration file /etc/freeradius/mods-enabled/sql > > including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf > > including configuration file /etc/freeradius/mods-enabled/sqlcounter > > including configuration file /etc/freeradius/mods-enabled/pap > > including configuration file /etc/freeradius/mods-enabled/perl > > including configuration file /etc/freeradius/mods-enabled/files > > including configuration file /etc/freeradius/mods-enabled/expr > > including configuration file /etc/freeradius/mods-enabled/unix > > including configuration file /etc/freeradius/mods-enabled/mschap > > including files in directory /etc/freeradius/policy.d/ > > including configuration file /etc/freeradius/policy.d/eap > > including configuration file /etc/freeradius/policy.d/cui > > including configuration file /etc/freeradius/policy.d/operator-name > > including configuration file /etc/freeradius/policy.d/dhcp > > including configuration file /etc/freeradius/policy.d/control > > including configuration file /etc/freeradius/policy.d/filter > > including configuration file /etc/freeradius/policy.d/canonicalization > > including configuration file /etc/freeradius/policy.d/accounting > > including files in directory /etc/freeradius/sites-enabled/ > > including configuration file /etc/freeradius/sites-enabled/inner-tunnel > > including configuration file /etc/freeradius/sites-enabled/default > > main { > > security { > > user = "freerad" > > group = "freerad" > > allow_core_dumps = no > > } > > } > > main { > > name = "freeradius" > > prefix = "/usr" > > localstatedir = "/var" > > sbindir = "/usr/sbin" > > logdir = "/var/log/freeradius" > > run_dir = "/var/run/freeradius" > > libdir = "/usr/lib/freeradius" > > radacctdir = "/var/log/freeradius/radacct" > > hostname_lookups = no > > max_request_time = 30 > > cleanup_delay = 5 > > max_requests = 1024 > > pidfile = "/var/run/freeradius/freeradius.pid" > > checkrad = "/usr/sbin/checkrad" > > debug_level = 0 > > proxy_requests = no > > log { > > stripped_names = no > > auth = no > > auth_badpass = no > > auth_goodpass = no > > colourise = yes > > } > > security { > > max_attributes = 200 > > reject_delay = 1 > > status_server = yes > > } > > } > > radiusd: #### Loading Realms and Home Servers #### > > proxy server { > > retry_delay = 5 > > retry_count = 3 > > default_fallback = no > > dead_time = 120 > > wake_all_if_all_dead = no > > } > > home_server localhost { > > ipaddr = 127.0.0.1 > > port = 1812 > > type = "auth" > > secret = "testing123" > > response_window = 20 > > max_outstanding = 65536 > > zombie_period = 40 > > status_check = "status-server" > > ping_interval = 30 > > check_interval = 30 > > num_answers_to_alive = 3 > > revive_interval = 120 > > status_check_timeout = 4 > > coa { > > irt = 2 > > mrt = 16 > > mrc = 5 > > mrd = 30 > > } > > limit { > > max_connections = 16 > > max_requests = 0 > > lifetime = 0 > > idle_timeout = 0 > > } > > } > > home_server_pool my_auth_failover { > > type = fail-over > > home_server = localhost > > } > > realm example.com { > > auth_pool = my_auth_failover > > } > > realm LOCAL { > > } > > radiusd: #### Loading Clients #### > > client localhost { > > ipaddr = 127.0.0.1 > > require_message_authenticator = no > > secret = "radius" > > shortname = "localhost" > > nas_type = "other" > > proto = "*" > > limit { > > max_connections = 16 > > lifetime = 0 > > idle_timeout = 30 > > } > > } > > client 27.33.228.125 { > > require_message_authenticator = no > > secret = "radius" > > shortname = "14kimberleyst" > > nas_type = "mikrotik" > > limit { > > max_connections = 16 > > lifetime = 0 > > idle_timeout = 30 > > } > > } > > client 220.244.108.10 { > > require_message_authenticator = no > > secret = "radius" > > shortname = "30cookst" > > nas_type = "mikrotik_snmp" > > limit { > > max_connections = 16 > > lifetime = 0 > > idle_timeout = 30 > > } > > } > > client 10.1.1.22/24 { > > require_message_authenticator = no > > secret = "radius" > > shortname = "MikroTik" > > limit { > > max_connections = 16 > > lifetime = 0 > > idle_timeout = 30 > > } > > } > > client 99hamilton.no-ip.biz { > > require_message_authenticator = no > > secret = "radius" > > shortname = "99hamilton" > > nas_type = "mikrotik" > > limit { > > max_connections = 16 > > lifetime = 0 > > idle_timeout = 30 > > } > > } > > radiusd: #### Instantiating modules #### > > instantiate { > > } > > modules { > > # Loaded module rlm_eap > > # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap > > eap { > > default_eap_type = "md5" > > timer_expire = 60 > > ignore_unknown_eap_types = no > > mod_accounting_username_bug = no > > max_sessions = 4096 > > } > > # Linked to sub-module rlm_eap_md5 > > # Linked to sub-module rlm_eap_leap > > # Linked to sub-module rlm_eap_gtc > > gtc { > > challenge = "Password: " > > auth_type = "PAP" > > } > > # Linked to sub-module rlm_eap_tls > > tls { > > tls = "tls-common" > > } > > tls-config tls-common { > > rsa_key_exchange = no > > dh_key_exchange = yes > > rsa_key_length = 512 > > dh_key_length = 512 > > verify_depth = 0 > > ca_path = "/etc/freeradius/certs" > > pem_file_type = yes > > private_key_file = "/etc/freeradius/certs/server.pem" > > certificate_file = "/etc/freeradius/certs/server.pem" > > ca_file = "/etc/freeradius/certs/ca.pem" > > private_key_password = "whatever" > > dh_file = "/etc/freeradius/certs/dh" > > fragment_size = 1024 > > include_length = yes > > check_crl = no > > cipher_list = "DEFAULT" > > ecdh_curve = "prime256v1" > > cache { > > enable = yes > > lifetime = 24 > > max_entries = 255 > > } > > verify { > > } > > ocsp { > > enable = no > > override_cert_url = yes > > url = "http://127.0.0.1/ocsp/" > > use_nonce = yes > > timeout = 0 > > softfail = yes > > } > > } > > # Linked to sub-module rlm_eap_ttls > > ttls { > > tls = "tls-common" > > default_eap_type = "md5" > > copy_request_to_tunnel = no > > use_tunneled_reply = no > > virtual_server = "inner-tunnel" > > include_length = yes > > require_client_cert = no > > } > > Using cached TLS configuration from previous invocation > > # Linked to sub-module rlm_eap_peap > > peap { > > tls = "tls-common" > > default_method = "mschapv2" > > copy_request_to_tunnel = no > > use_tunneled_reply = no > > proxy_tunneled_request_as_eap = yes > > virtual_server = "inner-tunnel" > > soh = no > > require_client_cert = no > > } > > Using cached TLS configuration from previous invocation > > # Linked to sub-module rlm_eap_mschapv2 > > mschapv2 { > > with_ntdomain_hack = no > > send_error = no > > } > > # Loaded module rlm_always > > # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always > > always fail { > > rcode = "fail" > > simulcount = 0 > > mpp = no > > } > > # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always > > always reject { > > rcode = "reject" > > simulcount = 0 > > mpp = no > > } > > # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always > > always noop { > > rcode = "noop" > > simulcount = 0 > > mpp = no > > } > > # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always > > always handled { > > rcode = "handled" > > simulcount = 0 > > mpp = no > > } > > # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always > > always updated { > > rcode = "updated" > > simulcount = 0 > > mpp = no > > } > > # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always > > always notfound { > > rcode = "notfound" > > simulcount = 0 > > mpp = no > > } > > # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always > > always ok { > > rcode = "ok" > > simulcount = 0 > > mpp = no > > } > > # Loaded module rlm_dynamic_clients > > # Instantiating module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients > > # Loaded module rlm_detail > > # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log > > detail auth_log { > > filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" > > header = "%t" > > permissions = 384 > > dir_permissions = 493 > > locking = no > > log_packet_header = no > > } > > rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output > > # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log > > detail reply_log { > > filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" > > header = "%t" > > permissions = 384 > > dir_permissions = 493 > > locking = no > > log_packet_header = no > > } > > # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log > > detail pre_proxy_log { > > filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" > > header = "%t" > > permissions = 384 > > dir_permissions = 493 > > locking = no > > log_packet_header = no > > } > > # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log > > detail post_proxy_log { > > filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" > > header = "%t" > > permissions = 384 > > dir_permissions = 493 > > locking = no > > log_packet_header = no > > } > > # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail > > detail { > > filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" > > header = "%t" > > permissions = 384 > > dir_permissions = 493 > > locking = no > > log_packet_header = no > > } > > # Loaded module rlm_radutmp > > # Instantiating module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp > > radutmp sradutmp { > > filename = "/var/log/freeradius/sradutmp" > > username = "%{User-Name}" > > case_sensitive = yes > > check_with_nas = yes > > permissions = 420 > > caller_id = no > > } > > # Loaded module rlm_expiration > > # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration > > # Loaded module rlm_preprocess > > # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess > > preprocess { > > huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" > > hints = "/etc/freeradius/mods-config/preprocess/hints" > > with_ascend_hack = no > > ascend_channels_per_line = 23 > > with_ntdomain_hack = no > > with_specialix_jetstream_hack = no > > with_cisco_vsa_hack = no > > with_alvarion_vsa_hack = no > > } > > reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups > > reading pairlist file /etc/freeradius/mods-config/preprocess/hints > > # Loaded module rlm_logintime > > # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime > > logintime { > > minimum_timeout = 60 > > } > > # Loaded module rlm_soh > > # Instantiating module "soh" from file /etc/freeradius/mods-enabled/soh > > soh { > > dhcp = yes > > } > > # Loaded module rlm_dhcp > > # Instantiating module "dhcp" from file /etc/freeradius/mods-enabled/dhcp > > # Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp > > radutmp { > > filename = "/var/log/freeradius/radutmp" > > username = "%{User-Name}" > > case_sensitive = yes > > check_with_nas = yes > > permissions = 384 > > caller_id = yes > > } > > # Loaded module rlm_digest > > # Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest > > # Loaded module rlm_exec > > # Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec > > exec { > > wait = no > > input_pairs = "request" > > shell_escape = yes > > timeout = 10 > > } > > # Instantiating module "echo" from file /etc/freeradius/mods-enabled/echo > > exec echo { > > wait = yes > > program = "/bin/echo %{User-Name}" > > input_pairs = "request" > > output_pairs = "reply" > > shell_escape = yes > > } > > # Loaded module rlm_replicate > > # Instantiating module "replicate" from file /etc/freeradius/mods-enabled/replicate > > # Loaded module rlm_cache > > # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap > > cache cache_eap { > > key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" > > ttl = 15 > > max_entries = 16384 > > epoch = 0 > > add_stats = no > > } > > # Loaded module rlm_linelog > > # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog > > linelog { > > filename = "/var/log/freeradius/linelog" > > permissions = 384 > > format = "This is a log message for %{User-Name}" > > reference = "%{%{Packet-Type}:-format}" > > } > > # Loaded module rlm_utf8 > > # Instantiating module "utf8" from file /etc/freeradius/mods-enabled/utf8 > > # Loaded module rlm_attr_filter > > # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter > > attr_filter attr_filter.post-proxy { > > filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" > > key = "%{Realm}" > > relaxed = no > > } > > reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy > > # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter > > attr_filter attr_filter.pre-proxy { > > filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" > > key = "%{Realm}" > > relaxed = no > > } > > reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy > > # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter > > attr_filter attr_filter.access_reject { > > filename = "/etc/freeradius/mods-config/attr_filter/access_reject" > > key = "%{User-Name}" > > relaxed = no > > } > > reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject > > # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter > > attr_filter attr_filter.access_challenge { > > filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" > > key = "%{User-Name}" > > relaxed = no > > } > > reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge > > # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter > > attr_filter attr_filter.accounting_response { > > filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" > > key = "%{User-Name}" > > relaxed = no > > } > > reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response > > # Loaded module rlm_chap > > # Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap > > # Loaded module rlm_realm > > # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm > > realm IPASS { > > format = "prefix" > > delimiter = "/" > > ignore_default = no > > ignore_null = no > > } > > # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm > > realm suffix { > > format = "suffix" > > delimiter = "@" > > ignore_default = no > > ignore_null = no > > } > > # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm > > realm realmpercent { > > format = "suffix" > > delimiter = "%" > > ignore_default = no > > ignore_null = no > > } > > # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm > > realm ntdomain { > > format = "prefix" > > delimiter = "\" > > ignore_default = no > > ignore_null = no > > } > > # Loaded module rlm_passwd > > # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd > > passwd etc_passwd { > > filename = "/etc/passwd" > > format = "*User-Name:Crypt-Password:" > > delimiter = ":" > > ignore_nislike = no > > ignore_empty = yes > > allow_multiple_keys = no > > hash_size = 100 > > } > > rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no > > # Instantiating module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth > > exec ntlm_auth { > > wait = yes > > program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" > > shell_escape = yes > > } > > # Loaded module rlm_sql > > # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql > > sql { > > driver = "rlm_sql_mysql" > > server = "localhost" > > port = "3306" > > login = "radius" > > password = "fheman" > > radius_db = "radius" > > read_groups = yes > > read_clients = yes > > delete_stale_sessions = yes > > sql_user_name = "%{User-Name}" > > default_user_profile = "" > > client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" > > authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" > > authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" > > authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" > > authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" > > group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" > > simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" > > simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" > > safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" > > } > > accounting { > > reference = "%{tolower:type.%{Acct-Status-Type}.query}" > > } > > post-auth { > > reference = ".query" > > } > > mysql { > > tls { > > } > > } > > rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked > > rlm_sql (sql): Attempting to connect to database "radius" > > rlm_sql (sql): Initialising connection pool > > pool { > > start = 5 > > min = 4 > > max = 10 > > spare = 3 > > uses = 0 > > lifetime = 0 > > cleanup_delay = 5 > > idle_timeout = 60 > > spread = no > > } > > rlm_sql (sql): Opening additional connection (0) > > rlm_sql_mysql: Starting connect to MySQL server > > ...

3 3

FR 2.2.5 64 bit
by Mohd Alkhaldi 12 May '14

12 May '14

HI, Can FR 2.2.5 64 bit be compiled on Solaris 10. Thanks; Alwaad Alhaq

4 7

EAP-TTLS session resumption does not work.
by hashimotoku＠nttdata.co.jp 12 May '14

12 May '14

Hello FreeRadius mailing list users. I am using FreeRadius on our WiFi system. I enabled EAP-TTLS session resumption, but it seems the functionality does not work well. - Our system. (a)WiFi supplicant -- (b)WiFi access point -- (c)WiFi Controler -- (d)FreeRadius -- (e)RADIUS server (d) listen on 10.180.4.19:18120. (e) listen on 127.0.0.1:18150. (d) and (e) are installed on the same server. - Authentication Method. Outer authentication: EAP-TTLS Inner authentication: PAP We are using one-time-password on RADIUS server(e) for authentication. - Symptom. (1)[Near the access point A] I input my username and password (authenticate) on supplicant installed in my laptop PC, then I can connect our WiFi network. (2)[Move from the access point A to the access point B] I move my laptop PC. Access point hands over from A to B. (3)[Near the access point B] I lost WiFi connectivity. To connect WiFi again, I have to re-enter username and password. - Wish. I want to resume WiFi connectivity automatically without one-time-password authentication, when I move between WiFi access point. - FreeRadius version. 3.0.1 - Below is our configuration <radiusd.conf>. etcdir = /usr/local/freeradius/etc confdir = ${etcdir}/raddb pidfile = /var/run/radius/freeradius.pid max_requests = 1024 listen { ipaddr = 10.180.4.19 port = 18120 type = auth } authorize { eap } authenticate { eap } post-proxy { eap } server inner-tunnel { authorize { update control { Proxy-To-Realm := "tinyradius" } } authenticate { eap } } modules { eap { default_eap_type = ttls max_sessions = 16384 timer_expire = 120 tls-config tls-common { certsdir = ${confdir}/certs private_key_file = ${certsdir}/our.key certificate_file = ${certsdir}/our.cer dh_file = ${certsdir}/dh cache { enable = yes lifetime = 12 max_entries = 1024 } } ttls { tls = tls-common virtual_server = inner-tunnel } } } client 10.0.0.0/8 { secret = xxxx } realm tinyradius { authhost = 127.0.0.1:18150 secret = xxxx nostrip } log { destination = syslog facility = local1 } Regards. --- Kouki Hashimoto hashimotoku(a)nttdata.co.jp

3 2

RADIUS accounting request not sent: no response
by Osvaldo T Crispim Filho 11 May '14

11 May '14

A few days back here I started getting these messages on mikrotiks: " RADIUS accounting request not sent: no response " Any help? My environment: NAS: RB1100 e RB1100AHx2 NAS: APs Ubiquiti (WPAe EAP PEAP) Server: ubuntu 64 12:04 freeradius 2.1.10+dfsg-3ubuntu0.12.04.2 freeradius-postgresql Messages on freeradius: 00:35:05 hotspot,warning,debug 00:27:22:52:48:5B (1x7.19.xxx.xxx): RADIUS accounting request not sent: no response 00:35:06 hotspot,warning,debug 00:15:6D:F8:D6:2B (1x7.19.xxx.xx): RADIUS accounting request not sent: no response Sat May 10 21:26:30 2014 : Info: ++[preprocess] returns ok Sat May 10 21:26:30 2014 : Info: [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent Sat May 10 21:26:30 2014 : Info: [acct_unique] WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent Sat May 10 21:26:30 2014 : Info: [acct_unique] WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent -- - Osvaldo T Crispim Filho -

2 3

Re: Freeradius.net Authentication wrong
by Serdar Metin 10 May '14

10 May '14

How can i achieve this? but there is also something else i noticed:for request 4auth: Failed to validate the user.Login incorrect: [bob/<no User-Password attribute>] (from client testing123 port 0 cli 00-1F-3B-B2-F5-09i'm 100 sure this user and some password is beeing saved in the users.conf file

4 5

LDAP for Authorization
by Walter Reynolds 10 May '14

10 May '14

I would like to use LDAP to be able to authorize a user so if there have a certain attribute I can return a radius AVP with a VLAN ID in the access-accept. This would be used for allowing access to licensed library resources. However, I am not sure if I can do this the way my LDAP stuff is set up. The attribute that has the data I need is multi-valued. - StudentAA, StudentDBRN, and StudentFLNT (continuing and incoming students regardless of enrollment; includes detached study); - EnrolledStudentAA, EnrolledStudentDBRN, EnrolledStudentFLNT (enrolled in at least one credit hour for ""current"" term; next term information is used during gap between terms) - AlumniAA, AlumniDBRN, AlumniFLNT (any person who has completed at least one semester in a degree-granting program) - FacultyAA, FacultyDBRN, FacultyFLNT (defined as academic, instructional, and research appointments; includes emeritus faculty) - RegularStaffAA, RegularStaffDBRN, RegularStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave); - TemporaryStaffAA, TemporaryStaffDBRN, TemporaryStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave) - Retiree (retired from any U-Mcampus, regardless of other appoints that may still be active) - SponsoredAffiliateAA, SponsoredAffiliateDBRN, SponsoredAffiliateFLNT (has at least one departmental sponsorship). However, only 5 of them (StudentAA, EnrolledStudentAA, FacultyAA, RegularStaffAA and TemoraryStaffAA) should get the radius AVP and be allowed access. However, when I query I get something like the following ldapsearch -h ldap.umich.edu -ZZ -z0 -x -D <cut> -b ou=people,dc=umich,dc=edu -LLL -s sub uniqueid=<username> umichinstroles dn: uid=royboy,ou=People,dc=umich,dc=edu umichinstroles: RegularStaffAA umichinstroles: AlumniFLNT So that is not realyy a group membership. Is this something I will be able to do? If not natively can folks mention other options/solutions? ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438

2 1

LDAP for defining AVP
by Walter Reynolds 09 May '14

09 May '14

I would like to use LDAP to be able to authorize a user so if there have a certain attribute I can return a radius AVP with a VLAN ID in the access-accept. This would be used for allowing access to licensed library resources. However, I am not sure if I can do this the way my LDAP stuff is set up. The attribute that has the data I need is multi-valued. - StudentAA, StudentDBRN, and StudentFLNT (continuing and incoming students regardless of enrollment; includes detached study); - EnrolledStudentAA, EnrolledStudentDBRN, EnrolledStudentFLNT (enrolled in at least one credit hour for ""current"" term; next term information is used during gap between terms) - AlumniAA, AlumniDBRN, AlumniFLNT (any person who has completed at least one semester in a degree-granting program) - FacultyAA, FacultyDBRN, FacultyFLNT (defined as academic, instructional, and research appointments; includes emeritus faculty) - RegularStaffAA, RegularStaffDBRN, RegularStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave); - TemporaryStaffAA, TemporaryStaffDBRN, TemporaryStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave) - Retiree (retired from any U-Mcampus, regardless of other appoints that may still be active) - SponsoredAffiliateAA, SponsoredAffiliateDBRN, SponsoredAffiliateFLNT (has at least one departmental sponsorship). However, only 5 of them (StudentAA, EnrolledStudentAA, FacultyAA, RegularStaffAA and TemoraryStaffAA) should get the radius AVP and be allowed access. However, when I query I get something like the following ldapsearch -h ldap.umich.edu -ZZ -z0 -x -D <cut> -b ou=people,dc=umich,dc=edu -LLL -s sub uniqueid=<username> umichinstroles dn: uid=<username>,ou=People,dc=umich,dc=edu umichinstroles: RegularStaffAA umichinstroles: AlumniFLNT So that is not really a group membership. Is this something I will be able to do? If I can not do it natively can folks mention other options/solutions? ------------------------ ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438

1 0

FreeRADIUS v2.2.5 Fedora packages available
by Nikolai Kondrashov 09 May '14

09 May '14

Hi everyone, Fedora packages of FreeRADIUS release v2.2.5 are available [1]. Users of Fedora 19 are welcome to test and leave karma feedback [2]. Nick [1] https://admin.fedoraproject.org/updates/freeradius-2.2.5-1.fc19 [2] http://fedoraproject.org/wiki/How_to_test_updates

1 0

FreeRADIUS not receiving password from WLC
by Richard Long 08 May '14

08 May '14

Hi all, I'm a bit stuck. I've stood up a CentOS server with FreeRADIUS so I can authenticate against Active Directory using a Cisco Wireless Controller. As you can see from the output below, I've got ntlm_auth and radtest working correctly, however, the wireless controller doesn't seem to be passing passwords to FreeRADIUS. I very obviously got something wrong in my setup, but I can't figure out what. I appreciate any help. [root@san-prod-rad-01 /]# ntlm_auth –-request-nt-key –-domain=NOTTELLING --username=mschmidt password: NT_STATUS_OK: Success (0x0) ------------------------------------------------------------------------ [root@san-prod-rad-01 /]# radtest mschmidt ########## 127.0.0.1 0 C@tHelm3t Sending Access-Request of id 155 to 127.0.0.1 port 1812 User-Name = "mschmidt" User-Password = "#######" NAS-IP-Address = 10.X.X.111 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=155, length=20 ------------------------------------------------------------------------ [root@san-prod-rad-01 ~]# radiusd -X FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "C@tHelm3t" nastype = "other" } client 192.168.X.X { require_message_authenticator = no secret = "C@tHelm3t" shortname = "sano-wlc-01" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = NTLM Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=NOTTELLING --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/radiusd.conf mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-NOTTELLING} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 55274 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.130.5 port 32768, id=98, length=240 User-Name = "mschmidt" Chargeable-User-Identity = "" Location-Capable = Civix-Location Calling-Station-Id = "54-26-96-3b-c7-b9" Called-Station-Id = "04-da-d2-b3-ec-80:QP_USER" NAS-Port = 1 Cisco-AVPair = "audit-session-id=c0a882050000124653690841" NAS-IP-Address = 192.168.130.5 NAS-Identifier = "sano-wlc-01" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3301" EAP-Message = 0x0201000d01616e74686f6e7962 Message-Authenticator = 0xa700edf63895515ddddc22454448b583 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mschmidt", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 131 ++[files] returns ok [sql] expand: %{User-Name} -> mschmidt [sql] sql_set_user escaped user --> 'mschmidt' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mschmidt' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mschmidt' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User mschmidt not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=mschmidt [ntlm_auth] expand: --password=%{User-Password} -> --password= Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mschmidt attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 98 to 192.168.130.5 port 32768 Waking up in 4.9 seconds. Cleaning up request 0 ID 98 with timestamp +26 Ready to process requests.

4 4

dhcp and rlm_python am i missing something?
by Serge Krawczenko 08 May '14

08 May '14

all i need is just to invoke my python script from dhcp section to perform my actions and return some values. if i got it right, there are handlers in python module, for corresponding sections in radiusd.conf for example, i have instantiate section in radiusd.conf and def instantiate(_params) function in my script and it is being invoked successfully there's python module config as well, where we define module and appropriate function for each event, such as mod_instantiate = "test_freeradius" func_instantiate = "instantiate" next, i've not found any mention of 'dhcp' section in rlm_python sources and even added it. and added module and func_dhcp='dhcp' in the module config nothing happened indeed now, the question. how do i call my python function from dhcp {whatever} section? python script is being called but there's no entry point, like 'python returns noop' therefore i can't return any values into radius instance. weird feeling i'm doing it first in the universe, please any help appreciated, spent over a week on this issue. thanks. ps i dont need any auth, acct, detail, post-auth logic. all i need is to call my python scipt from dhcp section and return values.

5 14