- Freeradius-Users - lists.freeradius.org

Send Access-Reject when user does not match any group?
by Bogdan Enache 18 Jan '13

18 Jan '13

Hi, Is there a way to configure FreeRadius 2.1.10 to send Access-Reject on users which don't match any of the defined groups? I tried with: DEFAULT Group-Name !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No and DEFAULT Group !* "", Auth-Type := Reject Reply-Message = "Account rejected.", Fall-Through = No as the last and only rule in "users" but it isn't working, freeradius still sends Access-Accept, even if the user does not match any groups. Thanks!

2 7

Question on attributes
by Tiago 17 Jan '13

17 Jan '13

Hello everyone, I'm struggling with something that should be simple to fix. I have a rp-pppoe NAS server here that correctly understand a few attributes (radreply) that come from freeradius 1.x (w/mysql database). Example: Download (for download rates) attribute Simple real example, from pppoe server: # cat /var/run/radattr.ppp479 .... Framed-Compression Van-Jacobson-TCP-IP Framed-Protocol PPP Framed-MTU 1500 Download 12000 Upload 3072 Its ok. However, when I change the auth target to redirect auth requests to my freeradius 2.x (using the same database as freeradius 1.x), I will get the customer authenticated perfectly, but: # cat /var/run/radattr.pppxxx .... Framed-Compression Van-Jacobson-TCP-IP Framed-Protocol PPP Framed-MTU 1500 Without Download/Upload attributes. Debugging my freeradius 2.x I get a few relevant lines: including dictionary file /etc/freeradius/dictionary (which contains the same attributes as freeradius 1.x, including Download/Upload) .... few sql lines here... [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lokan' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lokan' ORDER BY id .... few other SQL lines here rlm_sql (sql): Released sql socket id: 19 ++[sql] returns ok Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "852236" [pap] Using clear text password "852236" [pap] User authenticated successfully ++[pap] returns ok Login OK: [lokan/852236] (from client pppoe01 port 110 cli 52:E6:FC:9C:54:E7) # +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 192 to NASPPPOE01 port 48956 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cliente = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Framed-MTU = 1500 WISPr-Bandwidth-Max-Down = 256000 WISPr-Bandwidth-Max-Up = 256000 Finished request 0. Going to the next request What I'm missing? it seems like the attributes are not being sent to NAS, but I could be wrong. Thanks in advance for any help.

3 9

Re: Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Ajay Garg 17 Jan '13

17 Jan '13

I tried attaching the debug log-file, but the mail-message was rejected by the mailing list for exceeding 100KB How am I supposed to attach the complete logs? On Mon, Jan 7, 2013 at 11:35 AM, Ajay Garg <ajaygargnsit(a)gmail.com> wrote: > > > On Sun, Jan 6, 2013 at 8:00 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> Ajay Garg wrote: >> > I just realised that I can put the issue in a simpler realm (not >> > requiring any externally written client-code files ) :: >> > >> > I am unable to get "TLS-authentication" working, when a >> > "Fedora-17-client" tries to connect to a "WPA/WPA2-Enterprise network" >> > through "gnome-shell-applet", via Freeradius-running-on-Fedora-17". >> >> Look at the debug logs on the server. And on the client. Without >> that, your message is content-free. >> > > > Thanks Alan for the reply. > > a) > Alan, I am attaching the logs of "sudo /usr/sbin/radiusd -X". > These logs show failure-decryption errors. > > b) > Also, I tried taking up the "/var/log/messages" for only the > trying-to-connect duration (via "sudo rm /var/log/messages"; "sudo touch > /var/log/messages"), but the file then showed empty :( Please let me > know if this is indeed required; if yes, I will post this file too. > > c) > Also, I am attaching a snapshot of the settings entered for connecting to > the network. > > > > >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > > -- > Regards, > Ajay > -- Regards, Ajay

5 30

Use of %{Framed-IP-Address} in dialup.conf
by Örn Arnarson 16 Jan '13

16 Jan '13

I'm logging into MySQL via post_auth_query = SQL query. I've added some fields that I want to log, such as the allocated IP address, the NAS IP address and the Calling-Station-ID. All fields are logging fine except for Framed-IP-Address which just seems to be absent. Is that variable not supposed to be accessible at that point? Here's an example entry from radreply, showing that I am indeed using Framed-IP-Address: +-----+---------------------+-------------------+----+--------------+ | id | username | attribute | op | value | +-----+---------------------+-------------------+----+--------------+ | 1 | username(a)host.com | Framed-IP-Address | := | 10.10.10.10 | Here's what I have in dialup.conf: postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, response, nas, location, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%{Framed-IP-Address}', \ '%{NAS-IP-Address}', \ '%{Calling-Station-ID}', '%S')" Is there anything obvious that I'm missing? Any suggestions on where to look for problems? Best regards, Örn

3 5

Slow Ldap Authorization
by Tyler Brady 15 Jan '13

15 Jan '13

Version 2.1.10 Since adding LDAP authorization, my login time has slowed down quite a bit. It takes 4 or 5 seconds longer for freeRadius to get through all of the [ldap] fields and send an Access-Accept. Is this a normal amount of time, or is there something in my configuration that is causing this slow down? LDAP Module: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "172.28.64.10" identity = "CN=User Name,OU=Phoenix_Users,DC=company,DC=com" password = password basedn = "DC=company,DC=com" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{contr$ groupmembership_attribute = memberOf # base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 Debug: Ready to process requests. rad_recv: Access-Request packet from host 172.28.64.3 port 1645, id=98, length=85 User-Name = "RadiusUser" User-Password = "password" NAS-Port = 3 NAS-Port-Id = "tty3" NAS-Port-Type = Virtual Calling-Station-Id = "172.28.64.119" NAS-IP-Address = 172.28.64.3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "RadiusUser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [files] expand: DC=company,DC=com -> DC=company,DC=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> RadiusUser [files] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=RadiusUser)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.28.64.10:389, authentication 0 [ldap] bind as CN=User Name,OU=Alaska_Users,DC=company,DC=com/password to 172.28.64.10:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=company,DC=com, with filter (&(sAMAccountName=RadiusUser)) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=com, with filter (&(cn=Radius-Users)(|(&(objectClass=GroupOfNames)(member=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dUser Name\2cOU\3dAlaska_Users\2cDC\3dcompany\2cDC\3dcom)))) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=User Name,OU=Alaska_Users,DC=company,DC=com, with filter (objectclass=*) [ldap] performing search in CN=Radius-Users,OU=Alaska_Users,DC=company,DC=com, with filter (cn=Radius-Users) rlm_ldap::ldap_groupcmp: User found in group Radius-Users [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok [ldap] performing user authorization for RadiusUser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> RadiusUser [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=RadiusUser)) [ldap] expand: DC=company,DC=com -> DC=company,DC=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=com, with filter (&(sAMAccountName=RadiusUser)) [ldap] rebind to URL ldap://ForestDnsZones.company.com/DC=ForestDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://DomainDnsZones.company.com/DC=DomainDnsZones,DC=company,DC=com [ldap] rebind to URL ldap://company.com/CN=Configuration,DC=company,DC=com [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user RadiusUser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> TRUE ++? if (!control:Auth-Type) -> TRUE ++- entering if (!control:Auth-Type) {...} +++[control] returns noop ++- if (!control:Auth-Type) returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=RadiusUser [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 98 to 172.28.64.3 port 1645 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Motorola-WIBB-Auth-Role = security-officer-role Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 98 with timestamp +17 Ready to process requests. T. Brady

3 7

how to test a user in db from free-radius server
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi All, I have configured freeradius server + oracle database 11g. I send user1 in the Access-Request from radclient to the free-radius server. I need to check whether user1 is exists in user_test table, which is in oracle database 11g. The table contains username - 'user1' and status--'valid' If user found in user_test table Access-Accept else Access-Reject should return to the radclient. Note : should not use 'users' file Please help me how can do that?........................ Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

how to call stored procedure with output varaibles in free-radius
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi All, How to call my own stored procedure ,which takes input and output variable in free-radius server. How do i do that ??? please help.................... Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 (Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

6 7

how to call stored procedure in free-radius server
by Lakshmi Narayana Baliah 15 Jan '13

15 Jan '13

Hi Arran, Thanks for your reply.... have created stored procedure(myS1Request) in oracle database 11g as shown below, procedure takes input and output parameters. The below procedure should be called in the SQL module in Free-radius for Authentication and Authorization purpose. PROCEDURE myS1Request( UserName IN VARCHAR2, MessageType IN LONG, RemoteAddress IN LONG, FemtoAp IN VARCHAR2, RadCoverageInd IN LONG, RadCellId IN LONG, Rad3GCellId IN LONG, RadGeoCord IN LONG, RadAltDirection IN LONG, HNBIPAddress IN LONG, RadPLMNId IN LONG, HNBCellIdentity IN LONG, RadLocAreaLAC IN LONG, RadRoutAreaCode IN LONG, RadServiceArCode IN LONG, RadCSGId IN LONG, RadUECap IN LONG, Result OUT VARCHAR2, RadRegRejCau OUT LONG, RadLocBlacklInd OUT LONG, HNBCellId OUT LONG, RadServiceAreaC OUT LONG, RadLocationAreaI OUT LONG, RadRoutAreaC OUT LONG ) please help me how can proceed........... . Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com Message: 2 Date: Tue, 15 Jan 2013 10:46:08 +0000 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: how to call stored procedure with output varaibles in free-radius Message-ID: <C47F1EE1-3524-4709-85FA-79D0B268C5D6(a)freeradius.org> Content-Type: text/plain; charset=us-ascii On 15 Jan 2013, at 06:22, "Lakshmi Narayana Baliah" <LB0074453(a)techmahindra.com> wrote: > Hi All, > > How to call my own stored procedure ,which takes input and output variable in free-radius server. > > How do i do that ??? please help.................... Guessing you're referring to stored procedures in SQL? Or are you misusing SQL terminology to refer to something like a subroutine or function writen in the policy language? -Arran ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 93, Issue 42 ************************************************ ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

3 2

PROBLEM: RLM SQL_DAILY COUNTER DO NOT REST
by Russell Mike 15 Jan '13

15 Jan '13

Dear List & Alan D. Greetings. I read the wiki documentation & also checked the mail archive before posting on the list. Please accept my apologies if topic has been replied before. My "noresetcounter" works fine as expected but *"sql daily counter"*also do not reset everyday. i tried to dig lot but could not understand the cause. then i upgrade the Freeradius installation from v2.1.12.x to v2.2 but still, daily counter do not reset. i need your help. Due to size restriction i will reduce the output information but i am willing to send more info on request. if a user logs in for 3600 seconds, he can never login again even next day when counting through daily counter, daily counter behaves like noresetcounter. *sqlcounter dailycounter* { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" sqlmod-inst = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime - GREATEST((%b-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" } ================================================================================== *Attributes applied to the radius profile for the user:* Check Items: Session-Timeout = 3600 Max-Daily-Session = 3600 Reply Items: ideal-Timeout = 60 Acct-Interim-Interval = 120 Session-Timeout = 3600 ================================================================================== [root@radius mike]# radiusd -X FreeRADIUS *Version 2.2.0*, for host x86_64-unknown-linux-gnu, built on Oct 18 2012 at 13:58:38 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/sites-enabled/default more includes .............. main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Instantiating module "dailycounter" from file /etc/raddb/sql/mysql/counter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-Daily-Session is number 11277 rlm_sqlcounter: Current Time: 1358236678 [2013-01-15 07:57:58], Next reset 1358294400 [2013-01-16 00:00:00] rlm_sqlcounter: Current Time: 1358236678 [2013-01-15 07:57:58], Prev reset 1358208000 [2013-01-15 00:00:00] } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "XXXXXX" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret= jhr75hitflcv98rk rlm_sql (sql): Adding client 127.0.0.1 (localhost, server=<none>) to clients list rlm_sql (sql): Read entry nasname=172.21.45.33,shortname=pfSense Box,secret=jhr75hitflcv98rk rlm_sql (sql): Adding client 172.21.45.33 (Box, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 55408 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 *Ready to process requests.* ==================================================================================== *USER LOGIN REQUEST: THIS USER WAS LAST LOGIN 4 DAYS BACK, ONLY FIRST & LAST TIME. * rad_recv: Access-Request packet from host 127.0.0.1 port 51696, id=136, length=78 User-Name = "russell" User-Password = "rootadmin" NAS-IP-Address = 172.21.45.33 NAS-Port = 1812 Message-Authenticator = 0x7c4bb5c2fa912975d790cb33058d50c5 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "russell", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> russell [sql] sql_set_user escaped user --> 'russell' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'russell' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'russell' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'russell' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'One_Hour_Access' ORDER BY id [sql] User found in group One_Hour_Access [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'One_Hour_Access' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [expiration] Checking Expiration time: '20 Jan 2013' ++[expiration] returns ok ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code WARNING: Please replace '%k' with '${key}' sqlcounter_expand: 'SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' -> SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'}' [dailycounter] sql_xlat [dailycounter] expand: %{User-Name} -> russell [dailycounter] sql_set_user escaped user --> 'russell' [dailycounter] expand: SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' -> SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000' rlm_sql (sql): Reserving sql socket id: 1 [dailycounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 1 [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1358208000-UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='russell' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1358208000'} -> 2146567019 rlm_sqlcounter: (Check item - counter) is less than zero *rlm_sqlcounter: Rejected user russell, check_item=3600, counter=2576267* ++[dailycounter] returns reject Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> russell [sql] sql_set_user escaped user --> 'russell' [sql] expand: %{User-Password} -> rootadmin [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'russell', 'rootadmin', 'Access-Reject', '2013-01-15 07:59:31') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'russell', 'rootadmin', 'Access-Reject', '2013-01-15 07:59:31') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> russell attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 136 to 127.0.0.1 port 51696 *Reply-Message = "Your maximum daily usage time has been reached"* Waking up in 4.9 seconds. Cleaning up request 1 ID 136 with timestamp +93 Ready to process request I would grateful for your assistance & advice.. Thanks / Russell

1 0

wiki.freeradius.org will be down for upgrades
by Alan DeKok 14 Jan '13

14 Jan '13

We'll take it down for a few hours to do some upgrades. It should be back up later today. Alan DeKok.

1 0