- Freeradius-Users - lists.freeradius.org

help with DHCP server functionality
by Duane Cox 12 Nov '12

12 Nov '12

List: Hello. I have been working on this for a few days and have turned here for help. The server is listening on port 67 and when a DHCP packet comes in the server processes it, but in debug mode it give an error "No Pool-Name defined". I have done some reading and I have added the following to the users file (for testing purposes). DEFAULT Pool-Name := main_pool Fall-Through = Yes This doesn't seem to define the Pool-Name nor do I see where the server is processing any sql queries to determine the Pool-Name either. Am I mistaken? I thought that I could get a DHCP packet to be received/processed by the server and hand out a response. Thanks in advance, Duane Cox debug: Received DHCP-Discover of id 9daef956 from 10.11.156.70:68 to 10.12.100.90:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 2645490006 DHCP-Number-of-Seconds = 56 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.11.152.62 DHCP-Client-Hardware-Address = 00:d0:b7:c0:f6:8a DHCP-Message-Type = DHCP-Discover DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Hostname server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.11.152.1' to reply_items ++[mac2ip] returns ok ++- entering policy dhcp_sqlippool.post-auth {...} expand: DHCP-%{DHCP-Client-Hardware-Address} -> DHCP-00:d0:b7:c0:f6:8a expand: %{DHCP-Client-Hardware-Address} -> 00:d0:b7:c0:f6:8a expand: %{DHCP-Gateway-IP-Address} -> 10.11.152.62 expand: %{%{DHCP-Gateway-IP-Address}:-127.0.0.1} -> 10.11.152.62 +++[request] returns ok [dhcp_sqlippool] No Pool-Name defined. [dhcp_sqlippool] expand: DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> DHCP: No Pool-Name defined (did cli 00:d0:b7:c0:f6:8a port user DHCP-00:d0:b7:c0:f6:8a) DHCP: No Pool-Name defined (did cli 00:d0:b7:c0:f6:8a port user DHCP-00:d0:b7:c0:f6:8a) +++[dhcp_sqlippool] returns noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE ++- policy dhcp_sqlippool.post-auth returns noop ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.192 DHCP-Router-Address = 10.11.152.62 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.12.100.90 Sending DHCP-Offer of id 9daef956 to 10.11.152.62:68 Finished request 6. Cleaning up request 6 ID -1649477290 with timestamp +219 Going to the next request Ready to process requests.

2 4

Dialup admin lingering sessions
by Serge Paquin 12 Nov '12

12 Nov '12

Hello, I'm having an issue from time to time where a PPPoE session will drop and relogin which is fine but the "Online Users" doesn't seem to clear the old session. I check on the NAS and there is only the 1 session active. Not sure how to properly clear stale sessions. Serge.

1 0

accounting data
by Periko Support 11 Nov '12

11 Nov '12

Hi. Centos 5.x FreeRadius 2.1.1. I'm reading the book freeradius beginners Guide chapter 6: accounting. Page 139. Amount of Time. I have follow the book, would like to setup my freeradius and be able to manage users time per day. Following the book, it say that to test we better setup 3 files: start session stop session Make some changes to freeradius config files. Now, with this things ready, I follow the steps to see how it works: step 7) auth user. step 8)

2 5

Debian 6.0.6 amd64 freeradius + xl2tpd + strongswan ipsec
by Dmitry Korzhevin 11 Nov '12

11 Nov '12

Hello guys, Can you please advice good howto/guide to configure l2tp with radius server? I am already have configured pptp (poptop) and ipsec (strongSwan) on server, getting user logins and passwords from file. Now planning to use freeradius for auth. Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

2 1

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user
by Shravan S G 11 Nov '12

11 Nov '12

Hi all, I am trying to configure FreeRadius 2.2.0. I am trying to test with the radtest utility. However, when I run radtest, on my radiusd server, I get the following error - "ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user". I know this is some issue with the authentication part. However, I have not been able to pinpoint the problem. Also, I haven't been able to find any relevant solutions on the web. I have just untarred the 2.2.0 tarball, and added just one line the users file: gokul Cleartext-Password:="abcde" Below is the output on the server and the client side: Server: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 47080, id=238, length=75 User-Name = "gokul" User-Password = "abcde" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0xf92ae1fda2ea8f435d95c4a7294e1e55 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "gokul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> gokul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 238 to 127.0.0.1 port 47080 Waking up in 4.9 seconds. Cleaning up request 0 ID 238 with timestamp +19 Ready to process requests. Client: shravan@ubuntu:~/freeradius-server-2.2.0/raddb$ sudo radtest gokul abcde localhost 0 testing123 [sudo] password for shravan: Sending Access-Request of id 238 to 127.0.0.1 port 1812 User-Name = "gokul" User-Password = "abcde" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=238, length=20 shravan@ubuntu:~/freeradius-server-2.2.0/raddb$ This is m first attempt at using FreeRadius, so please let me know if I have made any rookie mistakes. :) Thanks in advance. Shravan

3 3

Concatenating/inserting strings with backslashes
by Brian Candler 10 Nov '12

10 Nov '12

Here's something weird. I'm trying to concatenate some strings which contain <backslash> <n> (i.e. not a newline). In a normal string literal, I have to enter four backslashes: update reply { Reply-Message := "a\\\\nb" } ("\\n" gives a newline, "\\\n" gives backslash followed by newline) But when I try to insert one string into another it goes completely haywire. update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\nbaz" } This gives me "foo" <newline> "bar" <newline> "baz". That is, even the second \\\\n is being collapsed into a newline! Some more test cases: update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "qux\\\\nbaz" } correctly gives me "qux" <backslash> <n> "baz" update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "%{Wibble:-qux}\\\\nbaz" } gives me <newline> "baz". In fact, I need *eight* backslashes to get a literal backslash here: Reply-Message := "%{Wibble:-qux}\\\\\\\\nbaz" So somehow, the presence of a string expansion within a string affects the interpretation of subsequent backslashes within that string. Now, this works: update reply { Reply-Message := "foo\\\\\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\\\\\nbaz" } But then if I do another layer of string insertion they get translated to newlines again. update reply { Reply-Message := "foo\\\\\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\\\\\nbaz" } update reply { Reply-Message := "%{reply:Reply-Message}" } This seems pretty broken to me, but if someone would care to explain how to deal with it, please do. Or is there another way I can concatenate strings, which doesn't involve expanding them into another string? Thanks, Brian.

4 5

LDAP group child domain
by Menard, Yannick 10 Nov '12

10 Nov '12

Hi, I'm in an active directory domain with child domain, tata as my primary, and toto as my child domain. I'm doing authorization based on LDAP group. My User connect to freeradius using 802.1x and PEAP. Using mschap and ntlm this is working great. Now I want to give users access/or radius attribute based on their active directory group. I was able to do this using the LDAP module and users file. The problem I am have now is; If I have a user group with the same name in my primary domain (tata) and in my child domain (toto.tata), the freeradius does not seems to see the difference (for exemple the domain users group). In user file my LDAP policy look like that: DEFAULT Ldap-Group == "groupname" What I would like to do is write it like that: DEFAULT Ldap-Group == "cn=groupname, ou=OUofGroup, dc=toto, dc=tata" I'm pretty sure I have to work with those config in ldap: groupname_attribute groupmembership_filter groupmembership_attribute right now they are like that: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf If anyone got some insight on how to solve this problem, I would greatly appreciate. Thank you, Yann ---------------------------------------------------------------------------------------------------------- Ce courriel a �t� filtr� par ModusGate et Webshield afin de le certifier comme l�gitime et exempt de virus.

2 1

Aliased IPs
by James Devine 09 Nov '12

09 Nov '12

I have a freeradius server which has multiple IPs aliased on the same interface. This works if I specify each IP explicitly in its own listen { } section but if I try to listen on * all responses are sent from the same IP regardless of which IP the request was received on.

2 2

Dynamic IP Allocation
by Bill Schoolfield 09 Nov '12

09 Nov '12

Hi I'm trying to get dynamic ip allocation working. I ran a test via radtest: > [root@freerad raddb]# radtest billtest2 "this#x7g" localhost 0 mysecret > Sending Access-Request of id 53 to 192.168.111.55 port 1812 > User-Name = "billtest2" > User-Password = "this#x7g" > NAS-IP-Address = 192.168.111.55 > NAS-Port = 0 > Message-Authenticator = 0x00000000000000000000000000000000 > rad_recv: Access-Accept packet from host 192.168.111.55 port 1812, id=53, length=32 > Framed-IP-Address = 192.168.1.215 > Framed-IP-Netmask = 255.255.255.0 and I'm getting a IP that's not from my pool. Here is the pertinent section in radiud.conf: > ippool main_pool { > range-start = 204.101.13.2 > range-stop = 204.101.13.252 > netmask = 255.255.255.0 > } which is within the modules section. Database wise the billtest2 user is a user that belongs to a group linked to this pool. The default site file has this pool in the post auth section. Below is the radius log? What am I missing? Bill > /usr/sbin/radiusd -X > FreeRADIUS Version 2.1.10, for host x86_64-redhat-linux-gnu, built on Mar 25 2011 at 10:54:38 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/unix > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/mac2vlan > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/ntlm_auth > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/opendirectory > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/relay_detail > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/mschap > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/dynamic_clients > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/sql.conf > including configuration file /etc/raddb/sql/mysql/dialup.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/default.orig > including configuration file /etc/raddb/sites-enabled/inner-tunnel > including configuration file /etc/raddb/sites-enabled/control-socket > including configuration file /etc/raddb/sites-enabled/copy-acct-to-home-server > including configuration file /etc/raddb/sites-enabled/default > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/radius" > libdir = "/usr/lib64/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = yes > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = yes > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > home_server myhomeserver { > ipaddr = 192.168.111.57 > port = 1813 > type = "acct" > secret = "testing123" > response_window = 30 > max_outstanding = 65536 > zombie_period = 40 > status_check = "none" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 300 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool poolit { > type = fail-over > home_server = myhomeserver > } > realm home_realm { > acct_pool = poolit > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client 192.168.5.73 { > require_message_authenticator = no > secret = "mysecret" > shortname = "testbypeter" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating module "exec" from file /etc/raddb/modules/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating module "expr" from file /etc/raddb/modules/expr > Module: Linked to module rlm_expiration > Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating module "pap" from file /etc/raddb/modules/pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating module "chap" from file /etc/raddb/modules/chap > Module: Linked to module rlm_mschap > Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating module "unix" from file /etc/raddb/modules/unix > unix { > radwtmp = "/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating module "eap" from file /etc/raddb/eap.conf > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 4096 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/etc/raddb/certs" > pem_file_type = yes > private_key_file = "/etc/raddb/certs/server.pem" > certificate_file = "/etc/raddb/certs/server.pem" > CA_file = "/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/raddb/certs/dh" > random_file = "/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_realm > Module: Instantiating module "suffix" from file /etc/raddb/modules/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating module "files" from file /etc/raddb/modules/files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > Module: Checking session {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Linked to module rlm_attr_filter > Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > } > } # modules > } # server > server copy-acct-to-home-server { # from file /etc/raddb/sites-enabled/copy-acct-to-home-server > modules { > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess > preprocess { > huntgroups = "/etc/raddb/huntgroups" > hints = "/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_always > Module: Instantiating module "ok" from file /etc/raddb/modules/always > always ok { > rcode = "ok" > simulcount = 0 > mpp = no > } > } # modules > } # server > server { # from file /etc/raddb/radiusd.conf > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_digest > Module: Instantiating module "digest" from file /etc/raddb/modules/digest > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_sql > Module: Instantiating module "sql" from file /etc/raddb/sql.conf > sql { > driver = "rlm_sql_mysql" > server = "localhost" > port = "" > login = "radius" > password = "radpass" > radius_db = "radius" > read_groups = yes > sqltrace = no > sqltracefile = "/var/log/radius/sqltrace.sql" > readclients = yes > deletestalesessions = yes > num_sql_socks = 5 > lifetime = 0 > max_queries = 0 > sql_user_name = "%{User-Name}" > default_user_profile = "" > nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" > authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" > authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" > authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" > authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" > accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" > accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Inp! ut-Gigaw ords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" > accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type! }', '%{F ramed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" > accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct! -Input-G igawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" > group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" > connect_failure_retry_delay = 60 > simul_count_query = "" > simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" > postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" > safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" > } > rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked > rlm_sql (sql): Attempting to connect to radius@localhost:/radius > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 > rlm_sql_mysql: Starting connect to MySQL server for #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 > rlm_sql_mysql: Starting connect to MySQL server for #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 > rlm_sql_mysql: Starting connect to MySQL server for #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 > rlm_sql_mysql: Starting connect to MySQL server for #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 > rlm_sql_mysql: Starting connect to MySQL server for #4 > rlm_sql (sql): Connected new DB handle, #4 > rlm_sql (sql): Processing generate_sql_clients > rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql (sql): Read entry nasname=192.168.111.55,shortname=localhost,secret=mysecret > rlm_sql (sql): Adding client 192.168.111.55 (localhost, server=<none>) to clients list > rlm_sql (sql): Read entry nasname=204.101.13.1,shortname=ERX2,secret=juniper > rlm_sql (sql): Adding client 204.101.13.1 (ERX2, server=<none>) to clients list > rlm_sql (sql): Read entry nasname=192.168.5.66,shortname=testcomp,secret=mysecret > rlm_sql (sql): Adding client 192.168.5.66 (testcomp, server=<none>) to clients list > rlm_sql (sql): Read entry nasname=204.101.13.2,shortname=ERX01,secret=juniper-erx01 > rlm_sql (sql): Adding client 204.101.13.2 (ERX01, server=<none>) to clients list > rlm_sql (sql): Released sql socket id: 4 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating module "detail" from file /etc/raddb/modules/detail > detail { > detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Instantiating module "relay_detail" from file /etc/raddb/modules/relay_detail > detail relay_detail { > detailfile = "/var/log/radius/radacct/relay-detail" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Linked to module rlm_ippool > Module: Instantiating module "main_pool" from file /etc/raddb/modules/ippool > ippool main_pool { > session-db = "/etc/raddb/db.ippool" > ip-index = "/etc/raddb/db.ipindex" > key = "%{NAS-IP-Address} %{NAS-Port}" > range-start = 192.168.1.1 > range-stop = 192.168.3.254 > netmask = 255.255.255.0 > cache-size = 800 > override = no > maximum-timeout = 0 > } > Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter > attr_filter attr_filter.accounting_response { > attrsfile = "/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/var/run/radiusd/radiusd.sock" > } > } > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > listen { > type = "detail" > listen { > filename = "/var/log/radius/radacct/relay-detail" > load_factor = 10 > poll_interval = 1 > retry_interval = 30 > } > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file /var/run/radiusd/radiusd.sock > Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel > Listening on detail file /var/log/radius/radacct/relay-detail as server copy-acct-to-home-server > Detail listener /var/log/radius/radacct/relay-detail state unopened signalled 0 waiting 1.000000 sec > Listening on proxy address * port 1814 > Waking up in 0.9 seconds. > Polling for detail file /var/log/radius/radacct/relay-detail > Detail listener /var/log/radius/radacct/relay-detail state unopened signalled 0 waiting 1.048359 sec > Waking up in 1.0 seconds. > Polling for detail file /var/log/radius/radacct/relay-detail > Detail listener /var/log/radius/radacct/relay-detail state unopened signalled 0 waiting 1.088540 sec > Waking up in 1.0 seconds. > Polling for detail file /var/log/radius/radacct/relay-detail > Detail listener /var/log/radius/radacct/relay-detail state unopened signalled 0 waiting 0.924103 sec > Waking up in 0.9 seconds. > Polling for detail file /var/log/radius/radacct/relay-detail > Detail listener /var/log/radius/radacct/relay-detail state unopened signalled 0 waiting 1.058053 sec > Waking up in 1.0 seconds. > rad_recv: Access-Request packet from host 192.168.111.55 port 47873, id=53, length=79 > User-Name = "billtest2" > User-Password = "this#x7g" > NAS-IP-Address = 192.168.111.55 > NAS-Port = 0 > Message-Authenticator = 0x21fd7bff584e72ed67fa7b6eda583d9d > # Executing section authorize from file /etc/raddb/sites-enabled/default.orig > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "billtest2", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[files] returns noop > [sql] expand: %{User-Name} -> billtest2 > [sql] sql_set_user escaped user --> 'billtest2' > rlm_sql (sql): Reserving sql socket id: 3 > [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'billtest2' ORDER BY id > [sql] User found in radcheck table > [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'billtest2' ORDER BY id > [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'billtest2' ORDER BY priority > [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id > [sql] User found in group dynamic > [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id > rlm_sql (sql): Released sql socket id: 3 > ++[sql] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > ++[pap] returns updated > Found Auth-Type = PAP > # Executing group from file /etc/raddb/sites-enabled/default.orig > +- entering group PAP {...} > [pap] login attempt with password "this#x7g" > [pap] Using clear text password "this#x7g" > [pap] User authenticated successfully > ++[pap] returns ok > Login OK: [billtest2] (from client localhost port 0) > # Executing section post-auth from file /etc/raddb/sites-enabled/default.orig > +- entering group post-auth {...} > [main_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 192.168.111.55 0 > [main_pool] MD5 on 'key' directive maps to: d3bc3a5505bb6cb4c21fbfb7e218aad6 > [main_pool] Searching for an entry for key: 'd3bc3a5505bb6cb4c21fbfb7e218aad6' > [main_pool] Found a stale entry for ip: 192.168.1.43 > [main_pool] num: 0 > rlm_ippool: Allocating ip to key: 'd3bc3a5505bb6cb4c21fbfb7e218aad6' > [main_pool] num: 1 > [main_pool] Allocated ip 192.168.1.215 to client key: d3bc3a5505bb6cb4c21fbfb7e218aad6 > ++[main_pool] returns ok > ++[exec] returns noop > Sending Access-Accept of id 53 to 192.168.111.55 port 47873 > Framed-IP-Address = 192.168.1.215 > Framed-IP-Netmask = 255.255.255.0 > Finished request 0. > Going to the next request > Waking up in 0.3 seconds. > Polling for detail file /var/log/radius/radacct/relay-detail

1 2

EAP-TLS Machine-Auth Windows: difference between LAN and WiFi
by Alexandros Gougousoudis 09 Nov '12

09 Nov '12

Hi, we're using FR 2.0 for our machine authentication for XP to Win7 with EAP-TLS. Everything is working so far, but I noticed a difference between authenticating via WLAN and LAN, which starts to be a problem for us now. If I make a auth via LAN the provided username ist <hostname>, if I do it via WLAN it is host/<hostname>. While we use "host/" as a realm for our Radsecproxy, I'd like to change the behauviour for the authentication via LAN and add a string to the <hostname> (i.e. "host/" or something else) to unify the login for WLAN an LAN. So how or where can I change that? A hint will be really welcome. TIA Alex

6 20