- Freeradius-Users - lists.freeradius.org

Not processing accounting packet
by Tyller D 01 May '13

01 May '13

Hi All, I'm having a problem that I can't find a solution to. The process I'm using is as follows. User connects to landing page, landing page sends access-request to server with users details. FreeRADIUS then sends a COA to the NAS to change the state and apply attributes. However when FreeRADIUS gets the accounting-start packet, it does nothing with it. Can someone please tell me how I can log this normally in radacct table? In my accounting section i have accounting { sql } sql_xlat finished rlm_sql (sql): Released sql socket id: 4 expand: %{sql:SELECT IFNULL((SELECT IF(ims.vouchers.`data`= 0, 0,IF((ims.vouchers.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets))) < 0,-1, ims.vouchers.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets)))) AS voucherdata FROM radius.radacct,ims.vouchers WHERE radius.radacct.username='%{request:User-Name}' AND radius.radacct.username = ims.vouchers.voucher AND radius.radacct.acctterminatecause<>'Hotspot Restart'),(SELECT ims.vouchers.`data` FROM ims.vouchers WHERE ims.vouchers.voucher='%{request:User-Name}')) as voucherdata} -> 1048576 ++[control] returns noop sql_xlat expand: %{User-Name} -> 10269783 sql_set_user escaped user --> '10269783' expand: SELECT IFNULL((SELECT IF(ims.user_account.`data`= 0, 0,IF((ims.user_account.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets))) < 0,-1, ims.user_account.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets)))) AS voucherdata FROM radius.radacct,ims.user_account WHERE radius.radacct.username='%{request:User-Name}' AND radius.radacct.username = ims.user_account.username AND radius.radacct.acctterminatecause<>'Hotspot Restart'),(SELECT ims.user_account.`data` FROM ims.user_account WHERE ims.user_account.username='%{request:User-Name}')) as voucherdata -> SELECT IFNULL((SELECT IF(ims.user_account.`data`= 0, 0,IF((ims.user_account.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets))) < 0,-1, ims.user_account.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets)))) AS voucherdata FROM radius.radacct,ims.user_account WHERE radius.radacct.username='10269783' AND radius.radacct.username = rlm_sql (sql): Reserving sql socket id: 3 row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 expand: %{sql:SELECT IFNULL((SELECT IF(ims.user_account.`data`= 0, 0,IF((ims.user_account.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets))) < 0,-1, ims.user_account.`data` - (SUM(radius.radacct.acctinputoctets)+SUM(radius.radacct.acctoutputoctets)))) AS voucherdata FROM radius.radacct,ims.user_account WHERE radius.radacct.username='%{request:User-Name}' AND radius.radacct.username = ims.user_account.username AND radius.radacct.acctterminatecause<>'Hotspot Restart'),(SELECT ims.user_account.`data` FROM ims.user_account WHERE ims.user_account.username='%{request:User-Name}')) as voucherdata} -> ++[control] returns noop ++? if (control:IMS-ActiveDirectory == 0) ? Evaluating (control:IMS-ActiveDirectory == 0) -> FALSE ++? if (control:IMS-ActiveDirectory == 0) -> FALSE ++? if (control:IMS-Timeout < 0) ? Evaluating (control:IMS-Timeout < 0) -> FALSE ++? if (control:IMS-Timeout < 0) -> FALSE ++? elsif (control:IMS-Timeout > 0) ? Evaluating (control:IMS-Timeout > 0) -> FALSE ++? elsif (control:IMS-Timeout > 0) -> FALSE ++? if (control:IMS-Data < 0) ? Evaluating (control:IMS-Data < 0) -> FALSE ++? if (control:IMS-Data < 0) -> FALSE ++? if (control:IMS-Data > 0) ? Evaluating (control:IMS-Data > 0) -> TRUE ++? if (control:IMS-Data > 0) -> TRUE ++- entering if (control:IMS-Data > 0) {...} expand: %{control:IMS-Data} -> 1048576 +++[reply] returns noop ++- if (control:IMS-Data > 0) returns noop ++? if (control:IMS-UserData < 0) ? Evaluating (control:IMS-UserData < 0) -> FALSE ++? if (control:IMS-UserData < 0) -> FALSE ++? if (control:IMS-UserData > 0) ? Evaluating (control:IMS-UserData > 0) -> FALSE ++? if (control:IMS-UserData > 0) -> FALSE ++[reply] returns noop } # server ims Sending Access-Accept of id 79 to 127.0.0.1 port 51340 Trapeze-Qos-Profile = "MB100" Mikrotik-Total-Limit = 1048576 Acct-Interim-Interval = 120 # Executing section pre-proxy from file /etc/freeradius/sites-enabled/ims +- entering group pre-proxy {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/detail-20130501 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20130501 [detail] expand: %t -> Wed May 1 09:58:20 2013 ++[detail] returns ok Sending CoA-Request of id 91 to 172.16.255.35 port 3799 Calling-Station-Id = "04:54:53:85:ca:82" NAS-IP-Address = 172.16.255.35 Trapeze-COA-Replace-Username = "10269783" Filter-Id = "MB100" Finished request 3. Going to the next request Waking up in 2.4 seconds. rad_recv: CoA-ACK packet from host 172.16.255.35 port 3799, id=91, length=26 Event-Timestamp = "May 1 2013 09:58:34 SAST" # Executing section post-proxy from file /etc/freeradius/sites-enabled/ims +- entering group post-proxy {...} [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/detail-20130501 [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20130501 [detail] expand: %t -> Wed May 1 09:58:20 2013 ++[detail] returns ok server ims { } # server ims Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 172.16.255.35 port 20000, id=200, length=244 Acct-Status-Type = Start Acct-Multi-Session-Id = "SESS-464-72c952-395089-4201e" Acct-Session-Id = "SESS-464-72c952-395089-4201e" User-Name = "10269783" Event-Timestamp = "May 1 2013 09:58:34 SAST" Trapeze-VLAN-Name = "DataA" Calling-Station-Id = "04-54-53-85-CA-82" NAS-Port-Id = "AP13/2" Called-Station-Id = "AC-4B-C8-02-23-41:BTC HOTSPOT - FAIRGROUND" Trapeze-Attr-19 = 0x69706164 Trapeze-Attr-21 = 0x696f73 NAS-Port = 464 Framed-IP-Address = 172.16.100.18 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.255.35 NAS-Identifier = "XON" Acct-Delay-Time = 0 WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. Finished request 4. Cleaning up request 4 ID 200 with timestamp +47 Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 79 with timestamp +47 rad_recv: Accounting-Request packet from host 172.16.255.35 port 20000, id=201, length=244 Acct-Status-Type = Start Acct-Multi-Session-Id = "SESS-464-72c952-395089-4201e" Acct-Session-Id = "SESS-464-72c952-395089-4201e" User-Name = "10269783" Event-Timestamp = "May 1 2013 09:58:34 SAST" Trapeze-VLAN-Name = "DataA" Calling-Station-Id = "04-54-53-85-CA-82" NAS-Port-Id = "AP13/2" Called-Station-Id = "AC-4B-C8-02-23-41:BTC HOTSPOT - FAIRGROUND" Trapeze-Attr-19 = 0x69706164 Trapeze-Attr-21 = 0x696f73 NAS-Port = 464 Framed-IP-Address = 172.16.100.18 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.255.35 NAS-Identifier = "XON" Acct-Delay-Time = 5 WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. Finished request 5. Cleaning up request 5 ID 201 with timestamp +52 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 172.16.255.35 port 20000, id=202, length=244 Acct-Status-Type = Start Acct-Multi-Session-Id = "SESS-464-72c952-395089-4201e" Acct-Session-Id = "SESS-464-72c952-395089-4201e" User-Name = "10269783" Event-Timestamp = "May 1 2013 09:58:34 SAST" Trapeze-VLAN-Name = "DataA" Calling-Station-Id = "04-54-53-85-CA-82" NAS-Port-Id = "AP13/2" Called-Station-Id = "AC-4B-C8-02-23-41:BTC HOTSPOT - FAIRGROUND" Trapeze-Attr-19 = 0x69706164 Trapeze-Attr-21 = 0x696f73 NAS-Port = 464 Framed-IP-Address = 172.16.100.18 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.255.35 NAS-Identifier = "XON" Acct-Delay-Time = 10 WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. Finished request 6. Cleaning up request 6 ID 202 with timestamp +57 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 172.16.255.35 port 20000, id=203, length=274 Acct-Status-Type = Stop Acct-Multi-Session-Id = "SESS-464-72c952-395089-4201e" Acct-Session-Id = "SESS-464-72c952-395089-4201e" User-Name = "10269783" Event-Timestamp = "May 1 2013 10:03:16 SAST" Trapeze-VLAN-Name = "DataA" Calling-Station-Id = "04-54-53-85-CA-82" NAS-Port-Id = "AP13/2" Called-Station-Id = "AC-4B-C8-02-23-41:BTC HOTSPOT - FAIRGROUND" Trapeze-Attr-19 = 0x69706164 Trapeze-Attr-21 = 0x696f73 NAS-Port = 464 Framed-IP-Address = 172.16.100.18 NAS-Identifier = "XON" Acct-Session-Time = 282 Acct-Output-Octets = 58993 Acct-Input-Octets = 35737 Acct-Output-Packets = 177 Acct-Input-Packets = 393 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.255.35 Acct-Delay-Time = 0 WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. Finished request 7. Cleaning up request 7 ID 203 with timestamp +329 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 172.16.255.35 port 20000, id=204, length=274 Acct-Status-Type = Stop Acct-Multi-Session-Id = "SESS-464-72c952-395089-4201e" Acct-Session-Id = "SESS-464-72c952-395089-4201e" User-Name = "10269783" Event-Timestamp = "May 1 2013 10:03:16 SAST" Trapeze-VLAN-Name = "DataA" Calling-Station-Id = "04-54-53-85-CA-82" NAS-Port-Id = "AP13/2" Called-Station-Id = "AC-4B-C8-02-23-41:BTC HOTSPOT - FAIRGROUND" Trapeze-Attr-19 = 0x69706164 Trapeze-Attr-21 = 0x696f73 NAS-Port = 464 Framed-IP-Address = 172.16.100.18 NAS-Identifier = "XON" Acct-Session-Time = 282 Acct-Output-Octets = 58993 Acct-Input-Octets = 35737 Acct-Output-Packets = 177 Acct-Input-Packets = 393 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.255.35 Acct-Delay-Time = 5 WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. Finished request 8. Cleaning up request 8 ID 204 with timestamp +334 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 172.16.255.35 port 20000, id=205, length=274 Acct-Status-Type = Stop Acct-Multi-Session-Id = "SESS-464-72c952-395089-4201e" Acct-Session-Id = "SESS-464-72c952-395089-4201e" User-Name = "10269783" Event-Timestamp = "May 1 2013 10:03:16 SAST" Trapeze-VLAN-Name = "DataA" Calling-Station-Id = "04-54-53-85-CA-82" NAS-Port-Id = "AP13/2" Called-Station-Id = "AC-4B-C8-02-23-41:BTC HOTSPOT - FAIRGROUND" Trapeze-Attr-19 = 0x69706164 Trapeze-Attr-21 = 0x696f73 NAS-Port = 464 Framed-IP-Address = 172.16.100.18 NAS-Identifier = "XON" Acct-Session-Time = 282 Acct-Output-Octets = 58993 Acct-Input-Octets = 35737 Acct-Output-Packets = 177 Acct-Input-Packets = 393 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.255.35 Acct-Delay-Time = 10 WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. Finished request 9. Cleaning up request 9 ID 205 with timestamp +339 Going to the next request Ready to process requests.

2 2

SQL and Huntgroups
by gregoire.leroy＠retenodus.net 01 May '13

01 May '13

Hello, I'm translating a flat file configuration into a MySQL configuration, but I have some difficulties with huntgroups. An example of what I have in my flat file : 21 example@domain>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Cleartext-Password := "password" 22 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Service-Type = Framed-User, 23 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Framed-Protocol = PPP, 24 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Type = L2TP, 25 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Medium-Type = IP, 26 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Assignment-ID = "RAN.DOM.I.P", 27 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Server-Endpoint = "RAN.DOM.I.P", 28 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Client-Auth-ID = "auth_id", 29 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Tunnel-Password = "password_tunnel", 30 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Fall-Through = Yes 31 32 example@domain>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Cleartext-Password := "password", Huntgroup-Name == "one_huntgroup_name" 33 >⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅>⋅⋅⋅⋅⋅⋅⋅Framed-IP-Address = STAT.IC.I.P So, if the request doesn't have the huntgroup set, only the first part is applied. Else, both are applied. In SQL, I'm going to create a group "example_users", with all the common data (line 22 to 30), an user "example@domain" who belongs to "example_users". I'm going to create an entry in radhuntgroup, with my "one_huntgroup_name" and the IP of my NAS. Now, I see one problem : how can I differenciate when a request has the user/pass/huntgroup and when it has only the user/pass ? I suppose that create 3 entries in readcheck won't work because it seems awkward. ( example@domain | Cleartext-Password | password | =: example@domain | Huntgroup-Name | one_huntgroup_name | == example@domain | Cleartext-Password | password | =: ) Does someone know a solution to this problem ? Thank you, Regards, Grégoire

5 17

rlm_ippool vs rlm_sqlippool
by George Chelidze 01 May '13

01 May '13

Greetings, We use rlm_ippool for pool management. Each pool is configured with 16K addresses. About 10K are used in the peek time (per pool). I believe we have almost reached our IO capacity, because heavy IO operations like gzipping a 300M file cause freeradius to throw errors like: Error: Discarding duplicate request from client C port 65038 - ID: 109 due to unfinished request 34797335 Error: Discarding duplicate request from client C port 65035 - ID: 98 due to unfinished request 34797336 and a bit later: Error: WARNING: Unresponsive child for request 34797366, in component post-auth module ippool-A Error: WARNING: Unresponsive child for request 34797382, in component post-auth module ippool-A Will it make any sense to switch to rlm_sqlippool? Will it be less IO sensitive? I know it's worth a try, however any additional information would be helpful. Thank you in advance, -- George Chelidze

3 4

Radius Server Segmentation Fault
by Mitch Yackobeck 30 Apr '13

30 Apr '13

2 2

Digest using an external database for the Password
by Mike Brennan 30 Apr '13

30 Apr '13

Hi I am running version 2.1.12. I want to use FreeRadius in the following way: - Use Digest Authentication - The password is stored in an external database (it has a complicated schema) that I am connecting to via sql.conf. - I want to extract the password from this database so that it can be used in Digest Authentication (SIP – using RFC 4590) Now I have tested FreeRadius with the radclient using digest authentication by placing the Cleartext-Password in the users file – this worked. Is it possible to get the Cleartext-Password (or is it the User-Password) from my external database through authorize_check_query ? If so, how do I assign this attribute to the value returned in my query? I can’t store any information in my external database as I am not allowed to create any tables The following query would return the password – can I use it in authorize_check_query? authorize_check_query="SELECT password FROM fusion.cdm_credentials WHERE person_id=(SELECT person_id FROM fusion.cdm_person WHERE user_name='%{User-Name}');" As you can see in the query I have to use password as it is a column entry in my database There is a similar mechanism for LDAP where you can use the passsword_attribute Or am I totally off track? Thx Mike -------------------- Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Thrupoint, Inc. nXaR2cC3

3 10

pptpd+freeradius+ldap: which password encryption can I use?
by Alberto Aldrigo 30 Apr '13

30 Apr '13

Hi Everybody, I'm trying to setup a PPTPD server which would authenticate users using my openLDAP user database, in doing so I need freeradius. By now the only setup that actually works is: users in LDAP with clear text password. Obviously I want to use some kind of encryption for passwords and I don't like the solution of using cleartext passwords and the use of a specific user allowed to access to the password attribute, so my question is: which other possibilities I have? Looking to this table http://deployingradius.com/documents/protocols/compatibility.html I understand that I can use pap + sha1 but I can't understand how. Can anyone help me understand what is possible and what not? Many thanks Alberto

3 2

EAP-AKA testing without HLR/HSS
by antoni milton 30 Apr '13

30 Apr '13

Hi, Please let me know , if its possible to test EAP-AKA authentication without HLR/HSS using freeradius. i.e can freeradius gernarte the quients from given RAND, Key value ?. if yes means , where can get the code for this algorithm? Thanks Antoni Milton.

3 4

Session-Timeout
by David Peterson 30 Apr '13

30 Apr '13

3 4

Grab request password with ASCII character
by Mehdi Ravanbakhsh 30 Apr '13

30 Apr '13

Hi Alll i need to Grab request password to insert in database if Cleartext-Password is "import" so i write this unlang script in authenticate section : Auth-Type PAP { pap { reject = 1 } if (reject) { if ("%{control:Cleartext-Password}"=="import" ) { ok update control { password-import = "%{sql:SELECT change_impoprt_password ('%{User-Name}'::varchar,'%{User-Password}'::varchar)}" Log-State := "New Password Is Imported" } } else { if (("%{control:Bad-Password-Pool}") && ("%{control:Bad-Password-Pool}" != "" ) ) { ok update control { Auth-Type := "Accept" Pool-Name := "%{control:Bad-Password-Pool}" Log-State := "PAP Password Is Not Correct" } update reply { Reply-Message = "Your Password in not correct in system" } } else { update control { Log-State := "PAP Password Is Not Correct - Reject" Auth-Type := "Reject" } update reply { Reply-Message := "Your Password in not correct in system" } } } ok } } but if user use symbols like ! @#& or any character that is based on ASCII character i can not get real password character for example : import password is : "test!@#" request:user-password is : "test=21@=23" do we have any way to get or convert request:user-password to none ASCII .

3 4

Re: How to fix the proxy source port
by Okis Chuang 30 Apr '13

30 Apr '13

> Chuang Okis wrote: > > I think you misunderstanding my point a bit. Maybe I don't express it clear > enough. > > I only need fixing my *source port* instead of random port, I don't care IP > address at all. > > Ah, OK. > > > Actually, due to some maintenance issue, we want to know that could we fix > our arc port while our freeRADIUS AS A ROAMING CENTER. We are trying > reducing the number of firewall logs. That's why we want to keep src port the > same. > > No there's no way to fix the source port. > > Even if you did, the server would dynamically open *new* source ports > when it gets busy. That's how UDP applications work. > Ok, now I've saved lots of time finding any possible way to do this. Thanks for being so concise about this issue. > It should be OK to have a firewall rule which allows packets FROM the > proxy IP, TO the home server IP and home server port. Adding the source > port is pretty much pointless. > > Alan DeKok. > Hmm. That sounds making sense. I'll discuss with our firewall policy manager about it. However, thank you very much Alan. Okis.

1 0