- Freeradius-Users - lists.freeradius.org

EAP-TLS Failed in handler question
by PENZ Robert 02 Jan '13

02 Jan '13

Hi! I've 802.1x (EAP-TLS) on a wired network activated, and it works 99% of the time ... just some authentications fail, but some minutes later the same client authenticates without a problem. As it happens only once every few days and always with a new client I cannot put a sniffer between the PC and switch, as I don't know which client is the next. But I enabled the debug logging on the freeradius server. The Clients are Windows 7 PCs and I'm running freeradius2-2.1.12-3.el5 on RHEL5. My first question is, how can I decode a EAP-Message from the debug log to check if the request is itself ok. Here is first packet from this client in some time, and it already generates the error. But the same client worked before and after it for days without a problem: rad_recv: Access-Request packet from host 10.xxx.xxx.4 port 44519, id=151, length=244 User-Name = "host/xxxxxxxxxxxxx.tirol.local" EAP-Message = 0x02ff00690d800000005f160301005a01000056030150a6115ee4ca2d9456a7fa7edad2fb1c7b221fc747eb78eb4d789ff077c48ef8000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 NAS-IP-Address = 10.xxx.xxx.4 Service-Type = Login-User Calling-Station-Id = "xx-xx-xx-xx-xx-xx" NAS-Port-Id = "2:3" NAS-Port = 2003 NAS-Port-Type = Ethernet State = 0x8df2b5f98df2b8eb6e43e372671f4335 Message-Authenticator = 0x6822006f5e7cf03d00a08b04869d19d8 and the relevant other log lines: ++? if (!EAP-Message) ? Evaluating !(EAP-Message) -> FALSE ++? if (!EAP-Message) -> FALSE ++- entering else else {...} [eap] EAP packet type response id 255 length 105 [eap] No EAP Start, assuming it's an on-going EAP conversation +++[eap] returns updated ++- else else returns updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group EAP {...} rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Invalid means I return a reject ... should I return something else? Is this a client problem or a misconfiguration on my part? Thx for your help! Mit freundlichen Grüßen Robert Penz -------------------------------------------------------------- Dipl.Inf. Robert Penz DVT - Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 (0)512 508 3334 / Fax: +43 (0)512 508 3355 E-Mail: robert.penz(a)tirol.gv.at

2 12

SQL Counter for Expiration Attribute - Prepaid Cards
by Prabhpal S. Mavi 01 Jan '13

01 Jan '13

Dear List Members, i have working setup of FreeRadius 2x (freeradius-2.1.12-4.el6_3.x86_64) including "rlm_sqlcounter" (Max-Daily-Session). User are logged off alright when "Max Session Timeout" is reached. But users can re login to gain access. The username and passwords are for hotspot. We do not want the username and password to work again once it has been used. For example: prepaid voucher (MySQL username & password) has 1 hour access. User should be able to use sum of one hour, either continuously once they are logged in or in parts (30min today & 30min tomorrow so on) username & password must never work for more than 1 hour to access our network. i am bit confuse attribute to use, i would grateful if someone can advice the correct attribute to use for the purpose. Thanks Hi Members, after working for four days still unable to make it work. Alan Buxey advised me to implemented "Expiration" Attribute. Expiration works just fine. If i specify any date (01 Sep 2013). But i am working to expire username after certain amount of time, such as one hour (not one hour after first log in) sum of one hour internet used either by one time login or multiple logins (30Min morning & 30min afternoon etc..). i understand i would need sql_counter to achieve. I am trying but not working. my configuration. 1.) Created Counter: sqlcounter expiration { count-attribute = "Acct-Session-Time" counter-name = "Max-Allowed-Session" check-name = "Expiration" sqlmod-inst = "sql" key = "User-Name" reset = "never" query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='${key}' ORDER BY AcctStartTime LIMIT 1;" 2.) Added in radiusd.conf instantiate { expiration } 3.) Added under auth section: authorize { expiration } When we expire account with expiration attribute which kind of value can we define to the attribute so that account gets expire after 1 hour of internet use (using sql counter). Date format is working alright (01 Sep 2013). Thanks everyone for attending to this material.

2 1

Re: SQL Counter for Expiration Attribute - Prepaid Cards
by Mulindwa 01 Jan '13

01 Jan '13

Hi there, You can use the frontend tool called daloradius, it will sort you out in what you are trying to achieve, it uses freeradius as the back end. ------------------------------ On Tue, Jan 1, 2013 12:01 PM MSK Prabhpal S. Mavi wrote: > >Dear List Members, > >i have working setup of FreeRadius 2x (freeradius-2.1.12-4.el6_3.x86_64) >including "rlm_sqlcounter" (Max-Daily-Session). User are logged off >alright when "Max Session Timeout" is reached. But users can re login to >gain access. The username and passwords are for hotspot. We do not want >the username and password to work again once it has been used. > >For example: prepaid voucher (MySQL username & password) has 1 hour >access. User should be able to use sum of one hour, either continuously >once they are logged in or in parts (30min today & 30min tomorrow so on) >username & password must never work for more than 1 hour to access our >network. i am bit confuse attribute to use, i would grateful if someone >can advice the correct attribute to use for the purpose. > >Thanks > > >Hi Members, > > >after working for four days still unable to make it work. Alan Buxey >advised me to implemented "Expiration" Attribute. Expiration works just >fine. If i specify any date (01 Sep 2013). But i am working to expire >username after certain amount of time, such as one hour (not one hour >after first log in) sum of one hour internet used either by one time login >or multiple logins (30Min morning & 30min afternoon etc..). > >i understand i would need sql_counter to achieve. I am trying but not >working. my configuration. > >1.) Created Counter: > >sqlcounter expiration { > count-attribute = "Acct-Session-Time" > counter-name = "Max-Allowed-Session" > check-name = "Expiration" > sqlmod-inst = "sql" > key = "User-Name" > reset = "never" > query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), >MIN(AcctStartTime))),0) FROM radacct WHERE >UserName='${key}' ORDER BY AcctStartTime LIMIT 1;" > > >2.) Added in radiusd.conf > > >instantiate { > expiration >} > > >3.) Added under auth section: > > >authorize { > expiration >} > > >When we expire account with expiration attribute which kind of value can >we define to the attribute so that account gets expire after 1 hour of >internet use (using sql counter). Date format is working alright (01 Sep >2013). > > >Thanks everyone for attending to this material. > > > > > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

freeradius down every Sun Dec 30 06:50:40 2012 : Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY)
by EasyHorpak.com 31 Dec '12

31 Dec '12

Dear all I found freeradius down every Sun Dec 30 06:50:40 2012 : Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY) with the error code Sun Dec 30 06:50:40 2012 : Info: Received HUP signal. Sun Dec 30 06:50:40 2012 : Info: HUP - Re-reading configuration files Sun Dec 30 06:50:40 2012 : Error: rlm_sql_mysql: MYSQL Error: No Fields Sun Dec 30 06:50:40 2012 : Error: rlm_sql_mysql: MYSQL error: Sun Dec 30 06:50:40 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Dec 30 06:50:40 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Dec 30 06:50:40 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sun Dec 30 06:50:40 2012 : Error: rlm_sql (sql): failed after re-connect Sun Dec 30 06:50:40 2012 : Info: HUP - loading modules Sun Dec 30 06:50:40 2012 : Info: Module: Reloaded module "files" Sun Dec 30 06:50:40 2012 : Info: Module: Reloaded module "suffix" Sun Dec 30 06:50:40 2012 : Info: Module: Reloaded module "pap" Sun Dec 30 06:50:40 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Dec 30 06:50:40 2012 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Dec 30 06:50:40 2012 : Info: Module: Reloaded module "radutmp" Sun Dec 30 06:50:40 2012 : Info: Loaded virtual server inner-tunnel Sun Dec 30 06:50:40 2012 : Info: Loaded virtual server <default> Sun Dec 30 06:50:40 2012 : Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY) Regards Chuan Chudabut

2 3

Re: Freeradius Attribute For HotSpot Users
by Alan Buxey 30 Dec '12

30 Dec '12

Use expiration . Once a user has logged in for the first time then set the expiration for that account to the required value....or set it when the counter is reached. Et voila, next time they try to login they can't (then you can do fancy extra stuff like telling them that their account has expired on the login window etc....) alan

1 0

Re: freeradius down every Sun Dec 30 06:50:40 2012 : Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY)
by Alan Buxey 30 Dec '12

30 Dec '12

This fails without fail every Sunday? In that case check what happens... eg if that HUP'ING of the freeradius is a weekly crontab then investigate what else is going on at that time ...eg there appear to be mysql errors - ate you using mysql? If so, its not good having errors with that module (and can be the cause if the problem...) I wouldn't say just stop that job....it has a purpose...but see if you are also eg dealing with mysql logrotating at the same time and if you are, don't. I would advise doing a restart of the daemon rather than a HUP and contact your distro maintainers to get latest version. 2.1.10 is really really old. alan

1 0

Freeradius Attribute For HotSpot Users
by Prabhpal S. Mavi 30 Dec '12

30 Dec '12

Dear List Members, i have working setup of FreeRadius 2x (freeradius-2.1.12-4.el6_3.x86_64) including "rlm_sqlcounter" (Max-Daily-Session). User are logged off alright when "Max Session Timeout" is reached. But users can re login to gain access. The username and passwords are for hotspot. We do not want the username and password to work again once it has been used. For example: prepaid voucher (MySQL username & password) has 1 hour access. User should be able to use sum of one hour, either continuously once they are logged in or in parts (30min today & 30min tomorrow so on) username & password must never work for more than 1 hour to access our network. i am bit confuse attribute to use, i would grateful if someone can advice the correct attribute to use for the purpose. Thanks

1 0

getting additional functionality, snmp or external program
by Duane Cox 29 Dec '12

29 Dec '12

I think this is possible, but wanted to make sure and ask what would be the best way to do this... ie. Execute an external program or create a module. I'm authenticating cable modems using freeradius with a sql database backend. What I want to do, is after the authentication process, query the cable modem using snmp (retrieving data) and store this data back into the already connected database. Is anyone doing such a thing? Thanks, Duane

2 1

HELP !! Access Period Attribute FreeRadius
by Prabhpal S. Mavi 29 Dec '12

29 Dec '12

Dear List Members, i have working setup of FreeRadius 2x (freeradius-2.1.12-4.el6_3.x86_64) including "rlm_sqlcounter" (Max-Daily-Session). User are logged off alright when "Max Session Timeout" is reached. But users can re login to gain access. The username and passwords are for hotspot. We do not want the username and password to work again once it has been used. For example: prepaid voucher (MySQL username & password) has 1 hour access. User should be able to use sum of one hour, either continuously once they are logged in or in parts (30min today & 30min tomorrow so on) username & password must never work for more than 1 hour to access our network. After the research i configured "Access Period" attribute using rlm_sqlcounter. According to the logs accessperiod counter is configured correctly and it returns OK. But users can still re use the one hour voucher (username/password). Is there any entry required in "/etc/raddb/dictionary" file for it to work? Something is still missing or i am not using correct attribute for the purpose. i would very grateful if someone can identify what is missing in my configuration or advice the correct attribute to use. I have tried the following: STEP A: Created rlm_sqlcounter and query. sqlcounter accessperiod { counter-name = Max-Access-Period-Time check-name = Access-Period sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='${key}' ORDER BY AcctStartTime LIMIT 1;" } LOGS FOR ACCESS PERIOD COUNTER USING radiusx -X: rlm_sqlcounter: Sent Reply-Item for user prabhpal, Type=Session-Timeout, value=3600 ++[accessperiod] returns ok STEP B: "radiusd.conf" instantiate { exec expr daily noresetcounter dailycounter monthlycounter accessperiod expiration logintime } STEP C: authorize { some other entries ... daily noresetcounter dailycounter monthlycounter accessperiod expiration STEP D: assign the access period attribute to user or group STEP E: Restart radiusd & Testing Thanks

1 0

RE: AP> FR> LDAP authentication reject
by Phil Mayers 28 Dec '12

28 Dec '12

Sigh. No. There are no packets in that debug. How do you expect people to read a debug unless it contains an authentication attempt? > ... adding new socket proxy address * port 51195 >Listening on authentication address * port 1812 >Listening on accounting address * port 1813 >Listening on command file /var/run/radiusd/radiusd.sock >Listening on authentication address 127.0.0.1 port 18120 as server >inner-tunnel >Listening on proxy address * port 1814 >Ready to process requests. >. >. >. -- Sent from my mobile device, please excuse brevity and typos.

1 0