- Freeradius-Users - lists.freeradius.org

don't wait rlm_sql response
by Mitsuhiro Nakamura 02 Apr '13

02 Apr '13

Hi all, When using rlm_sql, it always wait for response from database. Is there any way to configure to avoid it? (We don't wanna wait for its result after prosessing) accounting { detail sql <-wish to prosess it here without waiting for result } We'd appreciate if anyone can answer this promptly. Thank you,

4 4

auto-config of 802.1x supplicant windows 8 fail (wpa2-ent/peap)
by mike.albano＠unlv.edu 01 Apr '13

01 Apr '13

Trying post again (hopefully html email turned off this time). If someone knows how to delete a previous/duplicate post let me know.: I've been running FR for a while w/ out issue. Windows 8, however fails, when using auto-config (selecting the network and letting Windows figure out supplicant settings). I believe it's failing b/c of: "[mschap] FAILED: MS-CHAP2-Response is incorrect" This only happens on Windows 8 "auto-configuration" of it's 802.1x supplicant. In other words, if I manually add the network, selecting only "wpa2-enterprise", it works. It also works on OSX, Linux, Android and every other version of Windows, using 'autoconfiguration'...ie I do not need to manually configure the supplicant. I've debugged my wireless lan controller, but nothing interesting (I can attach if requested). It shows the EAP messages back/forth endinig up with processing the Access-Reject packet. Like many environments, I'm doing PEAP, with an OpenLDAP directory, though for this test the user is local. (test user is 'steve') I've got VM's of fresh-installed Win8 & Win7, passing same USB wireless NIC & same driver version. As previously mentioned, Win7 works with no manual supplicant configuration. I've included the -X at the bottom of the win7 auth. I do not believe this to be a FR issue, but I am wondering if anyone else has seen this. We are a large campus with ~30K auth's/day, though I'm concerned that Win8 is new enough that we havn't had any complaints yet. dpkg -l | grep freerad ii freeradius 2.1.12+dfsg-1.1 amd64 high-performance and highly configurable RADIUS server ii freeradius-common 2.1.12+dfsg-1.1 all FreeRADIUS common files ii freeradius-ldap 2.1.12+dfsg-1.1 amd64 LDAP module for FreeRADIUS server ii freeradius-utils 2.1.12+dfsg-1.1 amd64 FreeRADIUS client utilities ii libfreeradius2 2.1.12+dfsg-1.1 amd64 FreeRADIUS shared library Debugs at pastebin (too large): http://pastebin.com/gXhwSzZb

1 0

auto-config of 802.1x supplicant not working windows 8 only (wpa2-ent/peap)
by mike.albano＠unlv.edu 01 Apr '13

01 Apr '13

1 0

cisco attribute
by Mehdi Ravanbakhsh 01 Apr '13

01 Apr '13

which attribute on cisco work like this attribute in mikrotik to limit data transfer of user? Mikrotik-Xmit-Limit Mikrotik-Xmit-Limit-Gigawords i can limit user band with by Cisco-AVPair but i can not find any way to limit user volume. Best regrads.

1 0

noresetcounter
by Muhammad Nuzaihan Kamal Luddin 01 Apr '13

01 Apr '13

Hi, My objective to configure freeradius is that the user automatically gets logged out during the accounting process by noresetcounter statement. But currently, the user that is logged in keeps being connected even when the time is up. Here's my counter.conf: --- sqlcounter noresetcounter { counter-name = Session-Timeout # check-name = Max-All-Session check-name = Session-Timeout reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never # query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } --- And the logs: rad_recv: Access-Request packet from host 192.168.233.9 port 2052, id=0, length=200 User-Name = "34" User-Password = "EEawKbR3" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-26-82-15-4E-3D" Called-Station-Id = "00-0F-66-59-DD-33" NAS-Identifier = "taqihotspot1" Acct-Session-Id = "515a088400000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x48faf6d6c674bceef3469467121e5eae WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Mon Apr 1 21:22:51 2013 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Apr 1 21:22:51 2013 : Info: +- entering group authorize {...} Mon Apr 1 21:22:51 2013 : Info: ++[preprocess] returns ok Mon Apr 1 21:22:51 2013 : Info: ++[chap] returns noop Mon Apr 1 21:22:51 2013 : Info: ++[mschap] returns noop Mon Apr 1 21:22:51 2013 : Info: ++[digest] returns noop Mon Apr 1 21:22:51 2013 : Info: [suffix] No '@' in User-Name = "34", looking up realm NULL Mon Apr 1 21:22:51 2013 : Info: [suffix] No such realm "NULL" Mon Apr 1 21:22:51 2013 : Info: ++[suffix] returns noop Mon Apr 1 21:22:51 2013 : Info: [eap] No EAP-Message, not doing EAP Mon Apr 1 21:22:51 2013 : Info: ++[eap] returns noop Mon Apr 1 21:22:51 2013 : Info: [sql] expand: %{User-Name} -> 34 Mon Apr 1 21:22:51 2013 : Info: [sql] sql_set_user escaped user --> '34' Mon Apr 1 21:22:51 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Mon Apr 1 21:22:51 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '34' ORDER BY id Mon Apr 1 21:22:51 2013 : Info: [sql] User found in radcheck table Mon Apr 1 21:22:51 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '34' ORDER BY id Mon Apr 1 21:22:51 2013 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '34' ORDER BY priority Mon Apr 1 21:22:51 2013 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '3mins' ORDER BY id Mon Apr 1 21:22:51 2013 : Debug: rlm_sql (sql): Released sql socket id: 4 Mon Apr 1 21:22:51 2013 : Info: ++[sql] returns ok Mon Apr 1 21:22:51 2013 : Info: ++[logintime] returns noop Mon Apr 1 21:22:51 2013 : Info: ++[pap] returns updated Mon Apr 1 21:22:51 2013 : Debug: rlm_sqlcounter: Entering module authorize code Mon Apr 1 21:22:51 2013 : Debug: rlm_sqlcounter: Could not find Check item value pair Mon Apr 1 21:22:51 2013 : Info: ++[noresetcounter] returns noop Mon Apr 1 21:22:51 2013 : Debug: rlm_sqlcounter: Entering module authorize code Mon Apr 1 21:22:51 2013 : Debug: rlm_sqlcounter: Could not find Check item value pair Mon Apr 1 21:22:51 2013 : Info: ++[chillispot_max_bytes] returns noop Mon Apr 1 21:22:51 2013 : Info: Found Auth-Type = PAP Mon Apr 1 21:22:51 2013 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Apr 1 21:22:51 2013 : Info: !!! Replacing User-Password in config items with Cleartext-Password. !!! Mon Apr 1 21:22:51 2013 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Apr 1 21:22:51 2013 : Info: !!! Please update your configuration so that the "known good" !!! Mon Apr 1 21:22:51 2013 : Info: !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Mon Apr 1 21:22:51 2013 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Apr 1 21:22:51 2013 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Mon Apr 1 21:22:51 2013 : Info: +- entering group PAP {...} Mon Apr 1 21:22:51 2013 : Info: [pap] login attempt with password "EEawKbR3" Mon Apr 1 21:22:51 2013 : Info: [pap] Using clear text password "EEawKbR3" Mon Apr 1 21:22:51 2013 : Info: [pap] User authenticated successfully Mon Apr 1 21:22:51 2013 : Info: ++[pap] returns ok Mon Apr 1 21:22:51 2013 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Mon Apr 1 21:22:51 2013 : Info: +- entering group post-auth {...} Mon Apr 1 21:22:51 2013 : Info: ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.233.9 port 2052 Mon Apr 1 21:22:51 2013 : Info: Finished request 5. Mon Apr 1 21:22:51 2013 : Debug: Going to the next request Mon Apr 1 21:22:51 2013 : Debug: Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.233.9 port 2050, id=0, length=134 Acct-Status-Type = Start User-Name = "34" Calling-Station-Id = "00-26-82-15-4E-3D" Called-Station-Id = "00-0F-66-59-DD-33" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "taqihotspot1" Framed-IP-Address = 192.168.182.2 Acct-Session-Id = "515a088400000000" Mon Apr 1 21:22:51 2013 : Info: # Executing section preacct from file /etc/freeradius/sites-enabled/default Mon Apr 1 21:22:51 2013 : Info: +- entering group preacct {...} Mon Apr 1 21:22:51 2013 : Info: ++[preprocess] returns ok Mon Apr 1 21:22:51 2013 : Info: [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.233.9,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "515a088400000000",User-Name = "34"' Mon Apr 1 21:22:51 2013 : Info: [acct_unique] Acct-Unique-Session-ID = "589c09967ffad6f7". Mon Apr 1 21:22:51 2013 : Info: ++[acct_unique] returns ok Mon Apr 1 21:22:51 2013 : Info: [suffix] No '@' in User-Name = "34", looking up realm NULL Mon Apr 1 21:22:51 2013 : Info: [suffix] No such realm "NULL" Mon Apr 1 21:22:51 2013 : Info: ++[suffix] returns noop Mon Apr 1 21:22:51 2013 : Info: ++[files] returns noop Mon Apr 1 21:22:51 2013 : Info: # Executing section accounting from file /etc/freeradius/sites-enabled/default Mon Apr 1 21:22:51 2013 : Info: +- entering group accounting {...} Mon Apr 1 21:22:51 2013 : Info: [detail] expand: %{Packet-Src-IP-Address} -> 192.168.233.9 Mon Apr 1 21:22:51 2013 : Info: [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.233.9/detail-20130401 Mon Apr 1 21:22:51 2013 : Info: [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.233.9/detail-20130401 Mon Apr 1 21:22:51 2013 : Info: [detail] expand: %t -> Mon Apr 1 21:22:51 2013 Mon Apr 1 21:22:51 2013 : Info: ++[detail] returns ok Mon Apr 1 21:22:51 2013 : Info: ++[unix] returns ok Mon Apr 1 21:22:51 2013 : Info: [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp Mon Apr 1 21:22:51 2013 : Info: [radutmp] expand: %{User-Name} -> 34 Mon Apr 1 21:22:51 2013 : Info: ++[radutmp] returns ok Mon Apr 1 21:22:51 2013 : Info: [sql] expand: %{User-Name} -> 34 Mon Apr 1 21:22:51 2013 : Info: [sql] sql_set_user escaped user --> '34' Mon Apr 1 21:22:51 2013 : Info: [sql] expand: %{Acct-Delay-Time} -> Mon Apr 1 21:22:51 2013 : Info: [sql] ... expanding second conditional Mon Apr 1 21:22:51 2013 : Info: [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', Mon Apr 1 21:22:51 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Mon Apr 1 21:22:51 2013 : Debug: rlm_sql (sql): Released sql socket id: 3 Mon Apr 1 21:22:51 2013 : Info: ++[sql] returns ok Mon Apr 1 21:22:51 2013 : Info: ++[exec] returns noop Mon Apr 1 21:22:51 2013 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> 34 Mon Apr 1 21:22:51 2013 : Debug: attr_filter: Matched entry DEFAULT at line 12 Mon Apr 1 21:22:51 2013 : Info: ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 0 to 192.168.233.9 port 2050 Mon Apr 1 21:22:51 2013 : Info: Finished request 6. Mon Apr 1 21:22:51 2013 : Info: Cleaning up request 6 ID 0 with timestamp +1106 Mon Apr 1 21:22:51 2013 : Debug: Going to the next request Mon Apr 1 21:22:51 2013 : Debug: Waking up in 4.9 seconds. Mon Apr 1 21:22:56 2013 : Info: Cleaning up request 5 ID 0 with timestamp +1106 Mon Apr 1 21:22:56 2013 : Info: Ready to process requests. ---- Regards, Muhammad Nuzaihan Bin Kamal Luddin

2 1

Accept users that not define
by Mehdi Ravanbakhsh 01 Apr '13

01 Apr '13

Hi ALL I need to allow all user to be connected even if user not define in database . But if user not define it should get some specified replay atribute . I think i should use DEFAULT in user file but i not sure . do he have any other way? can i use DEFAULT user in user file( I use SQL module)? Best tegards.

2 3

use control attribute in sql.conf (sql module config file) query
by Mehdi Ravanbakhsh 31 Mar '13

31 Mar '13

Can use control attribute in sql.conf (sql module config file) query ? if yes so what about a new control attribute that define dictionary ? Best regards.

1 0

change Group-Name in unlang
by Mehdi Ravanbakhsh 30 Mar '13

30 Mar '13

I can change Pool-Name in unlang after if condition but if i use Group-Name for change the group of user it not work ....!!! in authorize { sql if (notfound) { update control { Auth-Type := "Accept" Group-Name := "Bad-User" } } In rad group check table i define " Bad-User := Pool-Name Bad-User-Pool " do i have any mistake in unlang ?

2 3

how i can check if password is not correct ?
by Mehdi Ravanbakhsh 30 Mar '13

30 Mar '13

Hi All if password in request is not correct wich module handele this and reject the client? where i can check if password is not correct ? and what the module return when password is not match ? Best regards.

2 2

How to check MODULE RETURN CODES
by Mehdi Ravanbakhsh 30 Mar '13

30 Mar '13

Hi all How can i check MODULE RETURN CODES in unlang? for example if SQL module in authorize section return notfound

2 2