- Freeradius-Users - lists.freeradius.org

EAP-SIM authentication with Huawei
by akinpelu emmanuel 09 Jan '13

09 Jan '13

Dear All, Please has there been anyone that has successfully implemented EAP-SIM with Huawei HLR? I would appreciate head-start on how possible this is. Thank you

2 1

rml_sqlcounter dailycounter do not reset
by Prabhpal S. Mavi 09 Jan '13

09 Jan '13

Dear List Members, i have come across the problem that "dailycounter" that is (rlm_sqlcounter) do not reset. Users are rejected by the following message. "Your maximum daily usage time has been reached" i am trying to figure out the cause but unable to. Counter & Query in use: sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" sqlmod-inst = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" logs: rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user prabhpal, check_item=3600, counter=2147056619 ++[dailycounter] returns reject Thanks

1 0

Memory leak in FR 2.1.10 and 2.2.0 ?
by Philippe MARASSE 08 Jan '13

08 Jan '13

Hello, I'm experiencing an infinitely growth of memory footprint of freeradius process in our production environment (of course, in our test env. everything goes right). Clients : - ~60 Alcatel omnistack OS6200 switches doing MAC Authentication (via EAP-MD5), - a few WiFi AP doing either EAP-TLS or EAP-PEAP. - Average load : 5 auth/minute On my first environment production I used : - Server : CentOS 5.6 32 bits on VM, 2 CPUs, 512 Mb RAM - freeradius2 2.1.10-1 i686 packages - MySQL on a different CentOS 5.6 server used for NAS, postauth, checks, etc. process get killed by kernel in less than 48 hours. As it was not the latest freeradius release, I recently moved to : - Server : Debian 4 32 bits on VM, 2 CPUs, 256 Mb RAM - freeradius 2.2.0 downloaded directly, and packaged on the debian server using this wiki page : http://wiki.freeradius.org/building/Build#Building-Debian-packages process get killed by kernel in less than 36 hours. As I cannot reproduce this on my test environment by using eapol_test, I suspect alcatel frames to trigger a kind of memory leak in freeradius. I collected different things : - pcap of eap-md5 exchange between freeradius and a switch - valgrind log on my production server - pidstat showing memory usage of freeradius process For now, i'm running out of new ideas to fix this issue... Rgds. -- Philippe MARASSE Service Informatique - Centre Hospitalier Henri Laborit BP 587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

4 7

EAP-SIM configuration on FreeRadius
by Muhammad Usman 08 Jan '13

08 Jan '13

Dear All, I am trying to configure freeradius for EAP-SIM authentication, for that i compiled FreeRadius with "./configure --with-modules="rlm_sim" --with-modules="rlm_sim_files"". Freeradius is installed successfully as i have tested it using radtest, as suggested on Freeradius wikis. i have installed freeradius version 2.2.0 Now in order to test EAP-SIM, i have added the below block in eap.conf file after mschapv2 block, sim { } I am trying to successfully run /src/tests/eapsim-03 example, i have copied the the below in users file, 1244070100000001(a)eapsim.foo Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0x101112131415161718191a1b1c1d1e1f, EAP-Sim-SRES1 = 0xd1d2d3d4, EAP-Sim-Rand2 = 0x202122232425262728292a2b2c2d2e2f, EAP-Sim-SRES2 = 0xe1e2e3e4, EAP-Sim-Rand3 = 0x303132333435363738393a3b3c3d3e3f, EAP-Sim-SRES3 = 0xf1f2f3f4, EAP-Sim-KC1 = 0xa0a1a2a3a4a5a6a7, EAP-Sim-KC2 = 0xb0b1b2b3b4b5b6b7, EAP-Sim-KC3 = 0xc0c1c2c3c4c5c6c7, 1232420100000015 Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0x30000000000000000000000000000000, EAP-Sim-SRES1 = 0x30112233, EAP-Sim-KC1 = 0x445566778899AABB, EAP-Sim-Rand2 = 0x31000000000000000000000000000000, EAP-Sim-SRES2 = 0x31112233, EAP-Sim-KC2 = 0x445566778899AABB, EAP-Sim-Rand3 = 0x32000000000000000000000000000000, EAP-Sim-SRES3 = 0x32112233, EAP-Sim-KC3 = 0x445566778899AABB, eapsim Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC3 = 0x30415263748596a7 but when i try to run client.sh, it gets the following logs, Sending Access-Request packet to host 127.0.0.1 port 1812, id=64, length=0 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 EAP-Code = Response EAP-Type-Identity = 0x65617073696d Message-Authenticator = 0x30 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 EAP-Message = 0x023f000b0165617073696d Received Access-Challenge packet from host 127.0.0.1 port 1812, id=64, length=78 EAP-Message = 0x01f30014120a00000f0200020001000011010100 Message-Authenticator = 0x81ffe249ace5353152e1476e8f7f890b State = 0x9a9ec8169a6dda46839134a50c8e1d5d EAP-Id = 243 EAP-Code = Request EAP-Type-SIM = 0x0a00000f0200020001000011010100 Sending Access-Request packet to host 127.0.0.1 port 1812, id=65, length=71 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 EAP-Code = Response Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 EAP-Sim-State = 1 EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d EAP-Id = 243 EAP-Message = 0x02f3002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d Received Access-Challenge packet from host 127.0.0.1 port 1812, id=65, length=138 EAP-Message = 0x01f40050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b050000cd1494bcf2173b38d26c31c3872b60f9 Message-Authenticator = 0x11986571b4665594edefbf3d811efbae State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Id = 244 EAP-Code = Request EAP-Type-SIM = 0x0b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b050000cd1494bcf2173b38d26c31c3872b60f9 Input was: identity: (len=6)65617073696d nonce_mt: c9615ec963ada36f11bd4e81093a7271 rand0: 00000000000000000000000000000000 rand1: 00000000000000000000000000000000 rand2: 00000000000000000000000000000000 sres0: 1234abcd sres1: 234abcd1 sres2: 34abcd12 Kc0: 0011223344556677 Kc1: 1021324354657687 Kc2: 30415263748596a7 versionlist[2]: 0001 select 00 01 Output mk: 8502e062_35537770_2c0a7c2c_9cfc9fc4_dc4d21d6 K_aut: b89dafa5_99422bee_db010d3a_6dcded9c K_encr: d8a6df78_25d9ad9d_2535083c_33a5c1c6 msk: f5feb9c1_9dbea4dd_cd94b140_17892e4b_f96327cc 84b16260_f0e6447b_b201018f_102b2217_bb6717c8 351115b9_a8248f46_aa33c120_f6e5979f_b27f1c98 69da98ed emsk: 8c1c04ef_4b345a29_50980817_563fc216_844d8e0d c2e4bc15_886523be_2e149835_ef850c3e_076722dc e27926e8_d01d1929_3da147a1_62833433_391b8a9a 20711dd2 calculated MAC (c412722f_ab82c18d_f5404f45_da872e93_cd950d07 did not match Sending Access-Request packet to host 127.0.0.1 port 1812, id=66, length=122 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 EAP-Code = Response Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 EAP-Sim-State = 0 EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d EAP-Id = 244 State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Message = 0x02f4002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 Received Access-Challenge packet from host 127.0.0.1 port 1812, id=66, length=138 EAP-Message = 0x01f50050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b0500006a93d1ff0e02e0b507f2940ce8e59251 Message-Authenticator = 0x6c9b33feb4d0851ed9d2c72e94640cc2 State = 0x9a9ec816986bda46839134a50c8e1d5d EAP-Id = 245 EAP-Code = Request EAP-Type-SIM = 0x0b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b0500006a93d1ff0e02e0b507f2940ce8e59251 radeapclient: sim in state init message challenge is illegal. Reply dropped. --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- This is the eapsim-in.txt file used in client.sh script User-Name = "eapsim" NAS-IP-Address = marajade.sandelman.ottawa.on.ca EAP-Code = Response EAP-Type-Identity = "eapsim" Message-Authenticator = 0 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-Sres1 = 0x1234abcd EAP-Sim-Sres2 = 0x234abcd1 EAP-Sim-Sres3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- while on radius debugging console, it says rad_recv: Access-Request packet from host 127.0.0.1 port 29859, id=64, length=71 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xcdbcb987fbfe7846c70edb63de2af9bb NAS-Port = 0 EAP-Message = 0x023f000b0165617073696d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eapsim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop can not open /usr/local/etc/raddb/simtriplets.dat: No such file or directory ++[sim_files] returns notfound [eap] EAP packet type response id 63 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry eapsim at line 24 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 243 ++[eap] returns handled Sending Access-Challenge of id 64 to 127.0.0.1 port 29859 EAP-Message = 0x01f30014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 29859, id=65, length=122 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xa62ac94a97d1f99105aef11ea7f7f802 NAS-Port = 0 EAP-Message = 0x02f3002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eapsim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop can not open /usr/local/etc/raddb/simtriplets.dat: No such file or directory ++[sim_files] returns notfound [eap] EAP packet type response id 243 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry eapsim at line 24 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xa62ac94a97d1f99105aef11ea7f7f802 NAS-Port = 0 EAP-Message = 0x02f3002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d0000 [eap] Underlying EAP-Type set EAP ID to 244 ++[eap] returns handled Sending Access-Challenge of id 65 to 127.0.0.1 port 29859 EAP-Message = 0x01f40050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b050000cd1494bcf2173b38d26c31c3872b60f9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9ec8169b6ada46839134a50c8e1d5d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 29859, id=66, length=122 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0x0066414e52eb81de434cb323e73182dc NAS-Port = 0 State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Message = 0x02f4002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eapsim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop can not open /usr/local/etc/raddb/simtriplets.dat: No such file or directory ++[sim_files] returns notfound [eap] EAP packet type response id 244 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry eapsim at line 24 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0x0066414e52eb81de434cb323e73182dc NAS-Port = 0 State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Message = 0x02f4002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d0000 [eap] Underlying EAP-Type set EAP ID to 245 ++[eap] returns handled Sending Access-Challenge of id 66 to 127.0.0.1 port 29859 EAP-Message = 0x01f50050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b0500006a93d1ff0e02e0b507f2940ce8e59251 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9ec816986bda46839134a50c8e1d5d Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 64 with timestamp +9 Cleaning up request 1 ID 65 with timestamp +9 Cleaning up request 2 ID 66 with timestamp +9 Ready to process requests. Can anybody help me to identify where i am going wrong, and what are the missing steps here. Thanks in Advance.

2 4

Re: rlm_sqlcounter always return 0 Resolved !!!!!
by Mike Russell 08 Jan '13

08 Jan '13

On Tue, Jan 8, 2013 at 12:05 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > > Alan DeKok Wrote: > > The sqlcounter module should be pretty simple. Configure accounting data > to go into SQL, and ensure that the server is receiving accounting packets. > Then, configure the sqlcounter module. > > My rlm_sqlnoresetcounter module: > > sqlcounter noresetcounter { > counter-name = Max-All-Session-Time > check-name = Max-All-Session > sqlmod-inst = sql > key = User-Name > reset = never > query = "SELECT IFNULL(SUM(AcctSessionTime),0) > FROM radacct WHERE UserName='${key}'" > > Alan DeKok Wrote: You edited the default configuration, and broke it. Don't do that. The default uses %{${key}}, not ${key}. They're different. Russell Wrote: Yes, Alan D. That's Brilliant, You hit the nail in the head strate, your advice fixed the problem. Configuration is now working!!! Counter is retuning the values back and prepaid users are in control now. I was struggling about a week now. Billion of thanks man. World is grateful for the work you are doing. Secondly, You are right, i broke the server by changing the veritable in query. I was advised to change make changes and i did it wrong **my mistake**. Kindly advice me for this warnings as well. Can i safely ignore them? They caused me to change the default query When i start the server is debug mode and users authenticate. i get this two lines. Are they safe to ignore? WARNING: Please replace '%k' with '${key}' WARNING: Please replace '%S' with '${sqlmod-inst}' Thanks Alan you saved my life.

2 1

Re: Kerberos - Radius does not get password
by Alan Buxey 08 Jan '13

08 Jan '13

Hmm, having run FR with AD authentication using winbindd and samba for many many years I am interested in what problems with those daemons you were having ... why need the frequent restarts etc. eduroam certainly wouldn't have had the high take-up we've seen in eg Europe if all sites had to reengineer their backend authentication and couldn't use PEAP/MSCHAPv2 alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 5

Freeradius2-2.1.12-4 crashes everyday
by Faisal M.A 08 Jan '13

08 Jan '13

Hi, My radius server is crashing almost everyday and I'm not sure what is the issue. Here is what i see, /etc/init.d/radiusd status radiusd dead but pid file exists I don't see any obvious message in my Syslog either. I'm using the free-radius on Centos 5.8 (2.6.18-308.16.1.el5PAE) freeradius2-ldap-2.1.12-4.el5_8 freeradius2-2.1.12-4.el5_8 Any idea ? Is there any bug ? Regards, Duke

4 5

default Fall-Through = Yes for groups
by Strong, Mark 08 Jan '13

08 Jan '13

Guys, Is there an option to set Fall-Through = Yes for groups as default, just wanted to avoid having Fall-Through = Yes in every group I have in radgroupreply. So if a user is a member of three groups I didn't want to have to put the Fall-Through attib in at least the first two groups, so he inherits the attibs from all three groups, thought there might be a setting in a config file for Fall-Through defaulting to Yes for groups, but couldn't see one. Regards Mark Strong

2 1

dictionary_kineto
by Yashaswini Sathyanarayana 08 Jan '13

08 Jan '13

How to add kineto specific attributes to free radius ?? Thanks & Regards, Yashaswini | Prod Engg | Tech Mahindra Ltd. 9 / 7 Hosur Road, Bangalore - 560029, India. (Office: +91 80 40243000, Extn: 3478 Mobile: +91 9611591177 www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

4 6

Fwd: rlm_sqlcounter always return 0
by Mike Russell 08 Jan '13

08 Jan '13

Dear Alan D. & List Users, I am reposting this message only because it bounced last due to size error. I tried to reduce the size but less information to see. Apologies if it was sent but i received bounce and no response from any member. ---------------: Orignal Message : ----------- I tried to search the mail archives for the similar topic but did not find matched results. Then read wiki again to crosscheck that if i have done it well before posting on the mailing list. I am sorry if similar post has been answered before. I have problem with "rlm_sqlcounter" module. That is "noresetcounter" it always return "0". But if i manually run the query to gerp the users accounting data from MySQL DB, i get accounting results. it seems that everything is in place but unable to know why sql counter still returns zero. whereas dailycounter works fine without any problem. My rlm_sqlnoresetcounter module: sqlcounter noresetcounter { driver = rlm_sqlcounter counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='${key}'" } To Prove the point i would also need to send radtest results for comparison: rad_recv: Access-Request packet from host 127.0.0.1 port 47871, id=159, length=84 User-Name = "KV60Rp2vtrEe5B" User-Password = "yuxNtwKbSH" NAS-IP-Address = 31.241.205.211 NAS-Port = 1812 Message-Authenticator = 0x2e53acc3936310719d3dc335a640afd4 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "KV60Rp2vtrEe5B", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> KV60Rp2vtrEe5B [sql] sql_set_user escaped user --> 'KV60Rp2vtrEe5B' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'KV60Rp2vtrEe5B' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'KV60Rp2vtrEe5B' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'KV60Rp2vtrEe5B' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'One_Hour_Access' ORDER BY id [sql] User found in group One_Hour_Access [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'One_Hour_Access' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[pap] returns updated rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name'' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' *WARNING: Please replace '%S' with '${sqlmod-inst}'* sqlcounter_expand: '%{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> KV60Rp2vtrEe5B [noresetcounter] sql_set_user escaped user --> 'KV60Rp2vtrEe5B' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' rlm_sql (sql): Reserving sql socket id: 2 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 2 [noresetcounter] expand: %{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name'} -> 0 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user KV60Rp2vtrEe5B, check_item=3600, counter=0 <------- This Value rlm_sqlcounter: Sent Reply-Item for user KV60Rp2vtrEe5B, Type=Session-Timeout, value=3600 ++[noresetcounter] returns ok [expiration] Checking Expiration time: '10 Jan 2013' ++[expiration] returns ok ++[logintime] returns noop Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "yuxNtwKbSH" [pap] Using clear text password "yuxNtwKbSH" [pap] User authenticated successfully ++[pap] returns ok # Executing section session from file /etc/raddb/sites-enabled/default +- entering group session {...} [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> KV60Rp2vtrEe5B ++[radutmp] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> KV60Rp2vtrEe5B [sql] sql_set_user escaped user --> 'KV60Rp2vtrEe5B' [sql] expand: %{User-Password} -> yuxNtwKbSH [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'KV60Rp2vtrEe5B', 'yuxNtwKbSH', 'Access-Accept', '2013-01-07 08:41:59') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'KV60Rp2vtrEe5B', 'yuxNtwKbSH', 'Access-Accept', '2013-01-07 08:41:59') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 159 to 127.0.0.1 port 47871 Session-Timeout := 3600 Idle-Timeout := 60 Acct-Interim-Interval := 120 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 159 with timestamp +311 Ready to process requests. Now lets grep the accounting value from database for the same user (returned "0" earlier) This user has "Max-All-Session" attribute applied and exist in "radgroupreply" table. mysql> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='KV60Rp2vtrEe5B'; +--------------------------------+ | IFNULL(SUM(AcctSessionTime),0) | +--------------------------------+ | 380802 | +--------------------------------+ 1 row in set (0.00 sec) Why rlm_counter returns the zero value. Thanks / Russell M.

2 1