- Freeradius-Users - lists.freeradius.org

PROBLEM: RLM SQL_DAILY COUNTER DO NOT REST
by Russell Mike 15 Jan '13

15 Jan '13

Dear List & Alan D. Greetings. I read the wiki documentation & also checked the mail archive before posting on the list. Please accept my apologies if topic has been replied before. My "noresetcounter" works fine as expected but *"sql daily counter"*also do not reset everyday. i tried to dig lot but could not understand the cause. then i upgrade the Freeradius installation from v2.1.12.x to v2.2 but still, daily counter do not reset. i need your help. Due to size restriction i will reduce the output information but i am willing to send more info on request. if a user logs in for 3600 seconds, he can never login again even next day when counting through daily counter, daily counter behaves like noresetcounter. *sqlcounter dailycounter* { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" sqlmod-inst = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime - GREATEST((%b-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } ================================================================================== *Attributes applied to the radius profile for the user:* Check Items: Session-Timeout = 3600 Max-Daily-Session = 3600 Reply Items: ideal-Timeout = 60 Acct-Interim-Interval = 120 Session-Timeout = 3600 ================================================================================== [root@radius mike]# radiusd -X FreeRADIUS *Version 2.2.0*, for host x86_64-unknown-linux-gnu, built on Oct 18 2012 at 13:58:38 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/sites-enabled/default more includes .............. main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Instantiating module "dailycounter" from file /etc/raddb/sql/mysql/counter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-Daily-Session is number 11277 rlm_sqlcounter: Current Time: 1358236678 [2013-01-15 07:57:58], Next reset 1358294400 [2013-01-16 00:00:00] rlm_sqlcounter: Current Time: 1358236678 [2013-01-15 07:57:58], Prev reset 1358208000 [2013-01-15 00:00:00] } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "XXXXXX" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret= jhr75hitflcv98rk rlm_sql (sql): Adding client 127.0.0.1 (localhost, server=<none>) to clients list rlm_sql (sql): Read entry nasname=172.21.45.33,shortname=pfSense Box,secret=jhr75hitflcv98rk rlm_sql (sql): Adding client 172.21.45.33 (Box, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 55408 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 *Ready to process requests.* ==================================================================================== *USER LOGIN REQUEST: THIS USER WAS LAST LOGIN 4 DAYS BACK, ONLY FIRST & LAST TIME. * rad_recv: Access-Request packet from host 127.0.0.1 port 51696, id=136, length=78 User-Name = "russell" User-Password = "rootadmin" NAS-IP-Address = 172.21.45.33 NAS-Port = 1812 Message-Authenticator = 0x7c4bb5c2fa912975d790cb33058d50c5 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "russell", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> russell [sql] sql_set_user escaped user --> 'russell' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'russell' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'russell' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'russell' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'One_Hour_Access' ORDER BY id [sql] User found in group One_Hour_Access [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'One_Hour_Access' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [expiration] Checking Expiration time: '20 Jan 2013' ++[expiration] returns ok ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code WARNING: Please replace '%k' with '${key}' sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' -> SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'}' [dailycounter] sql_xlat [dailycounter] expand: %{User-Name} -> russell [dailycounter] sql_set_user escaped user --> 'russell' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' -> SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' rlm_sql (sql): Reserving sql socket id: 1 [dailycounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 1 [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'} -> 2146567019 rlm_sqlcounter: (Check item - counter) is less than zero *rlm_sqlcounter: Rejected user russell, check_item=3600, counter=2576267* ++[dailycounter] returns reject Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> russell [sql] sql_set_user escaped user --> 'russell' [sql] expand: %{User-Password} -> rootadmin [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'russell', 'rootadmin', 'Access-Reject', '2013-01-15 07:59:31') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'russell', 'rootadmin', 'Access-Reject', '2013-01-15 07:59:31') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> russell attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 136 to 127.0.0.1 port 51696 *Reply-Message = "Your maximum daily usage time has been reached"* Waking up in 4.9 seconds. Cleaning up request 1 ID 136 with timestamp +93 Ready to process request I would grateful for your assistance & advice.. Thanks / Russell

1 0

wiki.freeradius.org will be down for upgrades
by Alan DeKok 14 Jan '13

14 Jan '13

We'll take it down for a few hours to do some upgrades. It should be back up later today. Alan DeKok.

1 0

(no subject)
by Yashaswini Sathyanarayana 14 Jan '13

14 Jan '13

Hi all, I want to configure the free radius to return access- reject based on the value of a particular column in database . How do i do that ??? please help.... Thanks & Regards, Yashaswini | Prod Engg | Tech Mahindra Ltd. 9 / 7 Hosur Road, Bangalore - 560029, India. (Office: +91 80 40243000, Extn: 3478 Mobile: +91 9611591177 www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

EAP-SIM Authentication Failure-FreeRadius-V2.2.0
by Ratnesh Sinha 13 Jan '13

13 Jan '13

Hi, I am trying to test EAP-SIM Authentication using 802.1x Access Node and a Wifi enabled phone with EAP-SIM support. I have configured Radius Server 2.2.0 based on instructions. I am getting the following error: [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT ############################################################################ ############################### The full trace below: ############################################################################ ############################### Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=7, length=244 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013134303434353030313234373839333540776c616e2e6d6e633034352e6d6363 3430342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x558781ab0d6f653bc2fcf8af9ee61260 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 245 ++[eap] returns handled Sending Access-Challenge of id 7 to 10.0.0.1 port 1047 EAP-Message = 0x01f50014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf445757cf4b067d13eec4c46dac51c4a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=8, length=294 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f50058120a00000705000021846d8ebd5ce97d1b79c5501a95ac64100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0xf445757cf4b067d13eec4c46dac51c4a Message-Authenticator = 0xe1d4bbed7648690e15b0720f9277206c # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 245 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f50058120a00000705000021846d8ebd5ce97d1b79c5501a95ac64100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0xf445757cf4b067d13eec4c46dac51c4a Message-Authenticator = 0xe1d4bbed7648690e15b0720f9277206c EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x000021846d8ebd5ce97d1b79c5501a95ac64 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333134303434353030313234373839333540776c616e2e6d6e633034352e6d6363343034 2e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 246 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.0.0.1 port 1047 EAP-Message = 0x01f60050120b0000010d000030000000000000000000000000000000310000000000000000 00000000000000320000000000000000000000000000000b050000bb28c3433b5a561015daaf 0ea141811e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf445757cf5b367d13eec4c46dac51c4a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=9, length=218 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f6000c120e000016010000 State = 0xf445757cf5b367d13eec4c46dac51c4a Message-Authenticator = 0xca05315c11be75a0938baf8f708367e2 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 246 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 9 to 10.0.0.1 port 1047 EAP-Message = 0x04f60004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.9 seconds. Cleaning up request 0 ID 7 with timestamp +19 Cleaning up request 1 ID 8 with timestamp +19 Waking up in 4.0 seconds. Cleaning up request 2 ID 9 with timestamp +22 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=10, length=244 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013134303434353030313234373839333540776c616e2e6d6e633034352e6d6363 3430342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x74523b39f4caeb2704555e3a35630534 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 255 ++[eap] returns handled Sending Access-Challenge of id 10 to 10.0.0.1 port 1047 EAP-Message = 0x01ff0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x067ab3ff0685a127aaec9be0764c9b76 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=11, length=294 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02ff0058120a000007050000f3c0d40d24735995cd2aa194ccc3e9ae100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0x067ab3ff0685a127aaec9be0764c9b76 Message-Authenticator = 0x4e16bb97083e9c782af073721b309c20 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 255 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02ff0058120a000007050000f3c0d40d24735995cd2aa194ccc3e9ae100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0x067ab3ff0685a127aaec9be0764c9b76 Message-Authenticator = 0x4e16bb97083e9c782af073721b309c20 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000f3c0d40d24735995cd2aa194ccc3e9ae EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333134303434353030313234373839333540776c616e2e6d6e633034352e6d6363343034 2e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 0 ++[eap] returns handled Sending Access-Challenge of id 11 to 10.0.0.1 port 1047 EAP-Message = 0x01000050120b0000010d000030000000000000000000000000000000310000000000000000 00000000000000320000000000000000000000000000000b0500008ed118746ac218cc6ea072 1d59d42518 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x067ab3ff077aa127aaec9be0764c9b76 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=12, length=218 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c120e000016010000 State = 0x067ab3ff077aa127aaec9be0764c9b76 Message-Authenticator = 0x9a08d17e00177ea24b2a90933b12d4c0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 12 to 10.0.0.1 port 1047 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.9 seconds. Cleaning up request 3 ID 10 with timestamp +29 Cleaning up request 4 ID 11 with timestamp +29 Waking up in 4.0 seconds. Cleaning up request 5 ID 12 with timestamp +32 Ready to process requests. ############################################################################ ############################### simtriplets.dat content below ############################################################################ ############################### 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,300000000000000000000000 00000000,30112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,310000000000000000000000 00000000,31112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,320000000000000000000000 00000000,32112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,330000000000000000000000 00000000,33112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,340000000000000000000000 00000000,34112233,445566778899AABB ############################################################################ ############################### Regards, Ratnesh

1 0

dhcp sqlippool reauthenticate users every minute
by Ethan Hayon 12 Jan '13

12 Jan '13

Hi, I'm trying to set up FreeRADIUS 2.2 to act as an authentication and accounting system as well as a DHCP server. (I'm relaying DHCP requests from a pfSense box). I am trying to use sqlippools on FreeRADIUS, but I have noticed that my ippools are filling up quickly (I am only testing with two devices). I have pfSense configured to reauthenticate user every minute, so I believe that FreeRADIUS is running post-auth dhcp leasing each time the user is reauthenticated. FreeRADIUS is serving the same client a new IP address each minute. I have adjusted my policy conf to the below. I may be approaching this the wrong way, but this is essentially what I am trying to do: I want to have multiple pools on different subnets. When a new client connects to the network (they don't yet have a radius account) they are sent to a default (pending) pool. This may be on the 192.168.1/24 subnet. After they have set up their account and have been added to the RADIUS database, they will be given a pool-name, maybe `pool2`. `pool2` will be on a different subnet, for example, 192168.2/24. The pfsense box knows how to route these subnets, so that is not a problem. I only want clients to receive a different IP address if their pool-name changes for whatever reason, if there are no changes to their account, they shouldn't be leased a new IP every time they reauthenticate (every minute). Eventually I will disable the reauthenticate every minute feature as the production system would not be able to handle this many requests. Am I approaching this problem correctly? I have written some un-lang in the policy.conf file for handling some of this. I am getting hung up on this problem. The pool is getting exhausted in minutes since each client is leased a new ip every minute. Any help is appreciated! Thanks, Ethan …. dhcp_sqlippool.post-auth { # Do some minor hacks to the request so that it looks # like a RADIUS request to the SQL IP Pool module. # check whether the requester is a user or not, if they do not have a pool-name, send them to pfpriv by default if("%{sql: SELECT COUNT(*) FROM radcheck where username='%{DHCP-Client-Hardware-Address}' AND attribute='Pool-Name'}" != "0") { update control { Pool-Name := "%{sql: SELECT `value` FROM radcheck WHERE username = '%{DHCP-Client-Hardware-Address}' AND attribute='Pool-Name'}" } } else { update control { Pool-Name := "pfpriv" # default pool if the user doesn't have an account } } update reply { DHCP-Domain-Name-Server = "192.168.1.1" # we will ultimately create a mysql table `radpoolinfo` to store per-pool attributes DHCP-Router-Address = "192.168.0.1" # this will also be in `radpoolinfo` eventually } update request { User-Name = "DHCP-%{DHCP-Client-Hardware-Address}" Calling-Station-Id = "%{DHCP-Client-Hardware-Address}" NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}" Acct-Status-Type = Start } # Call the actual module # # Uncomment this in order to really call it! dhcp_sqlippool #fail # Convert Framed-IP-Address to DHCP, but only if we # actually allocated an address. if (ok) { update reply { DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" } } } …

2 5

C External Program
by Ali Majdzadeh 11 Jan '13

11 Jan '13

Hi I wrote the following code to accept any user/pass in a C external program: Main() { fprintf (stdout, "Auth-Type := Accept\n"); return 0; } It works well with PAP but does not work in CHAP/MSCHAP. I know I should return Cleartext-Password but I want to permit any user/pass to loggin in. So how can I do that?

1 0

rlm_perl changing User-Name and proxy requests
by Ti Leggett 11 Jan '13

11 Jan '13

I have an issue with rlm_perl changing the request User-Name attribute but the proxy request not honoring it. First I'll describe what I'm trying to accomplish and why and then what I'm doing. I'm running a branch of 2.2.1 that has some krb5 realm fixes in it. I have multiple realms that users can authenticate against: our division has replayable password (handled by kerberos) and one time passwords (handled by both YubiKeys and Crypto Card), our lab has replayable passwords (handled by AD) and a separate one time password system (handled by Crypto Card). For services that we want to allow replayable passwords (like IMAP access for instance), we want to allow the user to choose which service to use (division or lab). For services requiring OTP we want the user to choose which OTP token they want to use (some people have multiple because of external requirements). We want users to be able to change these auth preferences on their own and not have this require changing the RADIUS configuration (a.k.a., the users file) to do this. Our account information is kept in LDAP. This is all well and good except that usernames between the division and the lab aren't guaranteed to match - User A might have lastname as their division name, but lastnamefirst as their lab username. For the kerberos and AD request the RADIUS server can handle the request directly using rlm_krb5, but for all the OTP requests the server must proxy to the correct OTP server to handle the request. Here's my plan for accomplishing this. During authorization, rlm_ldap is used to make sure if the user is in LDAP. If not the request is rejected outright (this should help with brute force attempts bogging down all the servers for bogus attempts). Next an rlm_perl module is called to get the user's preferred realm and what username to use in that realm from LDAP. An example would be leggett@ yubi.division.example.com (signifying that I want to use YubiKey from my division). The rlm_perl module updates the request User-Name to be this preference and Auth-Type to be System (see http://pastie.org/5670077) Lastly rlm_realm checks the request to determine if it should be proxied or not. The problem is this: Everything works if the username doesn't change. For instance, if I'm leggett(a)yubi.division.example.com and leggett(a)crypto.example.com, things work. The User-Name change being done by rlm_perl is being recognized by rlm_realm and rlm_realm is routing to the proper realm; however, rlm_realm seems to want to clobber User-Name in its own way, so that by the time proxying happens User-Name is set to whatever the initial username was - if I started the process as leggett and wanted my username to eventually be ti.leggett(a)crypto.example.com, by the time it reaches the proxy phase my User-Name attribute has been reset back to leggett even if I rerun the rlm_perl module after rlm_realm (see http://pastie.org/5670076) I notice that rlm_suffix doesn't overwrite the Stripped-User-Name rlm_perl adds, but appends another entry. This is fine for my purposes since the rlm_perl one is added first subsequent calls use that value. I'm afraid the same is happening with User-Name in that rlm_perl is appending another entry instead of overwriting the ones there. So is there any way around this or am I completely insane with this approach?

4 10

Different IP addresses from home radius server
by Greg Rutz 11 Jan '13

11 Jan '13

We are using FreeRadius 2.1.12 as a proxy to a remote radius server. The remote server (not under our direct control) receives RADIUS request messages on one IP address, but sends the response out a different interface (and thus has a diffferent IP). FreeRadius is rejecting the response since the IP does not match that of the request. Is there a way to configure FreeRadius to allow this? Greg

2 2

Re: LDAP Reply Attributes
by Alan Buxey 11 Jan '13

11 Jan '13

Switch config issue? Ensure your switch is configured to authorize over RADIUS as well as to authenticate over RADIUS. (sounds like its doing the latter but not the former) alan

2 1

LDAP Reply Attributes
by Tyler Brady 11 Jan '13

11 Jan '13

I'm sure this is an easy issue to solve, but my simple brain can't seem to put the pieces together. Any help would be greatly appreciated. I'm trying to authorize a login into a Cisco switch with admin privileges. Users: DEFAULT = LDAP-Group == Radius-Users" Reply-Message = "Welcome Message Test", Cisco-AVPair = "shell:priv-lvl=15" Note: I've tried many different combinations of attributes with no luck. (Service-Type = Administrative-User, Service-Type = NAS-Prompt-User) Output: Sending Access-Accept of id 61 to 172.28.64.3 port 1645 Reply-Message = "Welcome Message Test" Cisco-AVPair = "shell:priv-lvl=15" The switch login successfully shows "Welcome Message Test," but still kicks into user exec mode without applying the Cisco-AVPair = "shell:priv-lvl=15" I noticed that there is a mapping for the Reply-Message found in ldap.attrmap, but none for Cisco-AVPair. Is this why it's not working? If so, I have not been able to find the correct syntax for adding it to ldap.attrmap. Thanks in advance, T. Brady

1 0