- Freeradius-Users - lists.freeradius.org

How to know packet-type when using perl script
by moshe levi 23 Jul '12

23 Jul '12

Hi, I have add perl script execution to recv-coa section in my coa virtual server in the script I want to do different operation if I am getting CoA-Request or Disconnect-Request How do I do that? how can I tell which packet-type arrive in the perl script.

1 0

Problems with Freeradius password encryption
by Andrei Petru Mura 23 Jul '12

23 Jul '12

I'm trying to do some performance tests with FR 2.1.10. I'm using radperf tool. I have two different machines with freeradius installed on them. In one of them the test is going well for now, but in the other (where I'm more interested on) the test fails with the following error: rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=50, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Bellow I'll put the output from the freeradius run with -XXX with some comments on it: rad_recv: Access-Request packet from host 127.0.0.1 port 38027, id=50, length=45 User-Name = "test1" User-Password = "\340<V#\307\177\221\034\355\366M\255\364\271\340\253" /*** comment 1: the User-Password on the machine with well-working freeradius isn't encrypted. It looks simple like this: User-Password = "test1" ***/ Mon Jul 23 11:36:48 2012 : Info: # Executing section authorize from file /netnfork/radius//etc/raddb/sites-enabled/default Mon Jul 23 11:36:48 2012 : Info: +- entering group authorize {...} Mon Jul 23 11:36:48 2012 : Info: ++[preprocess] returns ok Mon Jul 23 11:36:48 2012 : Info: ++[chap] returns noop Mon Jul 23 11:36:48 2012 : Info: [suffix] No '@' in User-Name = "test1", looking up realm NULL Mon Jul 23 11:36:48 2012 : Info: [suffix] No such realm "NULL" Mon Jul 23 11:36:48 2012 : Info: ++[suffix] returns noop Mon Jul 23 11:36:48 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Jul 23 11:36:48 2012 : Info: ++[eap] returns noop Mon Jul 23 11:36:48 2012 : Info: [sql] expand: %{User-Name} -> test1 Mon Jul 23 11:36:48 2012 : Info: [sql] sql_set_user escaped user --> 'test1' Mon Jul 23 11:36:48 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Mon Jul 23 11:36:48 2012 : Info: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'test1' ORDER BY id Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 5 Mon Jul 23 11:36:48 2012 : Info: [sql] User found in radcheck table Mon Jul 23 11:36:48 2012 : Info: [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'test1' ORDER BY id Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 5 Mon Jul 23 11:36:48 2012 : Info: [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='test1' ORDER BY priority Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Mon Jul 23 11:36:48 2012 : Debug: rlm_sql_postgresql: query affected rows = 0 , fields = 1 Mon Jul 23 11:36:48 2012 : Debug: rlm_sql (sql): Released sql socket id: 0 Mon Jul 23 11:36:48 2012 : Info: ++[sql] returns ok Mon Jul 23 11:36:48 2012 : Info: ++[expiration] returns noop Mon Jul 23 11:36:48 2012 : Info: ++[logintime] returns noop Mon Jul 23 11:36:48 2012 : Info: ++[pap] returns updated Mon Jul 23 11:36:48 2012 : Info: Found Auth-Type = PAP Mon Jul 23 11:36:48 2012 : Info: # Executing group from file /netnfork/radius//etc/raddb/sites-enabled/default Mon Jul 23 11:36:48 2012 : Info: +- entering group PAP {...} Mon Jul 23 11:36:48 2012 : Info: [pap] login attempt with password "�<V#�??��M��" Mon Jul 23 11:36:48 2012 : Info: [pap] Using clear text password "test1" Mon Jul 23 11:36:48 2012 : Info: [pap] Passwords don't match Mon Jul 23 11:36:48 2012 : Info: ++[pap] returns reject /*** comment 2: the last four lines in the well-working server are: Mon Jul 23 11:32:15 2012 : Info: [pap] login attempt with password "test92" Mon Jul 23 11:32:15 2012 : Info: [pap] Using clear text password "test92" Mon Jul 23 11:32:15 2012 : Info: [pap] User authenticated successfully Mon Jul 23 11:32:15 2012 : Info: ++[pap] returns ok ***/ Mon Jul 23 11:36:48 2012 : Info: Failed to authenticate the user. Mon Jul 23 11:36:48 2012 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Mon Jul 23 11:36:48 2012 : Info: Using Post-Auth-Type Reject Mon Jul 23 11:36:48 2012 : Info: # Executing group from file /netnfork/radius//etc/raddb/sites-enabled/default Mon Jul 23 11:36:48 2012 : Info: +- entering group REJECT {...} Mon Jul 23 11:36:48 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test1 Mon Jul 23 11:36:48 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 23 11:36:48 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 23 11:36:48 2012 : Info: Delaying reject of request 3 for 1 seconds Mon Jul 23 11:36:48 2012 : Debug: Going to the next request Mon Jul 23 11:36:48 2012 : Debug: Waking up in 0.9 seconds. Mon Jul 23 11:36:49 2012 : Info: Sending delayed reject for request 3 Sending Access-Reject of id 50 to 127.0.0.1 port 38027 Mon Jul 23 11:36:49 2012 : Debug: Waking up in 4.9 seconds. Mon Jul 23 11:36:54 2012 : Info: Cleaning up request 3 ID 50 with timestamp +250 Mon Jul 23 11:36:54 2012 : Info: Ready to process requests. >From the output I understand that the password shouldn't be encrypted when is sent. Can anybody suggest me how to fix that problem?

2 1

freeradius down and shows Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY)
by EasyHorpak.com 23 Jul '12

23 Jul '12

Dear all i fond my freeradius is down and show log below Sun Jul 22 06:25:05 2012 : Info: Module: Reloaded module "detail" Sun Jul 22 06:25:05 2012 : Info: Module: Reloaded module "pap" Sun Jul 22 06:25:05 2012 : Info: Module: Reloaded module "radutmp" Sun Jul 22 06:25:05 2012 : Info: Module: Reloaded module "suffix" Sun Jul 22 06:25:05 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Jul 22 06:25:05 2012 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Jul 22 06:25:05 2012 : Info: Loaded virtual server inner-tunnel Sun Jul 22 06:25:05 2012 : Info: Loaded virtual server <default> Sun Jul 22 06:25:05 2012 : Error: ASSERT FAILED modcall.c[106]: (p->type > MOD_SINGLE) && (p->type <= MOD_POLICY) thank you in advance Chuan Chudabut EasyZone Hotspot Billing v2.9.7 VLAN http://www.easyzonecorp.net

3 2

Re: Radius reject the request
by Alan Buxey 23 Jul '12

23 Jul '12

You are editing the wrong file. Read the output of radiusd -X The server config files will be eg /usr/local/etc/raddb/ alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

4 5

RE: sql returns fail for some stop requests
by Amir Tal 22 Jul '12

22 Jul '12

Adding unique key to the database results in the following being returned from rlm_sql, What happen to accounting data when a duplicate entry is encountered? In addition, currently there is no scheduled clearing of the data in radacct table, wont this increase in occurrence? -- [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> shimoni [sql] sql_set_user escaped user --> 'shimoni' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 0 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 0 [sql] expand: %{Acct-Delay-Time} -> 12 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-22 02:03:28', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '12', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:172.29.81.67:3280:96f8:1aa8:87fb:4d2:0062712021' AND username = 'shimoni' AND nasipaddress = '109.226.1.12' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql_mysql: MYSQL check_error: 1062 received [sql] Couldn't insert SQL accounting STOP record - Duplicate entry 'c6d3d253355b3dcf' for key 2 rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry 'c6d3d253355b3dcf' for key 2' rlm_sql (sql): Released sql socket id: 11 ++[sql] returns fail -- [detail.moreshet] /var/log/radius/radacct/moreshet.relay expands to /var/log/radius/radacct/moreshet.relay [sql] expand: %{Acct-Delay-Time} -> 0 [detail.moreshet] expand: %t -> Sun Jul 22 02:03:34 2012 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-22 02:03:34', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:172.24.245.233:2653:c9e:101:e0ba:4d2:0062712040' AND username = 'mosh19703' AND nasipaddress = '109.226.1.12' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql [detail.moreshet] expand: /var/log/radius/radacct/moreshet.relay -> /var/log/radius/radacct/moreshet.relay [detail.moreshet] /var/log/radius/radacct/moreshet.relay expands to /var/log/radius/radacct/moreshet.relay [detail.moreshet] expand: %t -> Sun Jul 22 02:03:34 2012 ++[detail.moreshet] returns ok rlm_sql_mysql: MYSQL check_error: 1062 received [sql] Couldn't insert SQL accounting ALIVE record - Duplicate entry '923952cbd6569744' for key 2 rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry '923952cbd6569744' for key 2' rlm_sql (sql): Released sql socket id: 27 ++[sql] returns fail -- Just wanted to state that I had started with the default provided configuration files, Alredy changed the rlm_sql source code, default SQL queries, default DB structure. There are still unclosed accounting packets existing. Log shows a lot of warning messages: rlm_sql (sql): Reserving sql socket id: 31 rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.23.184.73:dd94:1847:fcca:a66:4d2:0051412783' AND username = 'yali4780' AND nasipaddress = '109.226.1.20' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 0 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 0 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:147.235.134.62:3742:41fe:4d2:5019:56ac253:0062712137' AND username = '8532433' AND nasipaddress = '109.226.1.12' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 30 rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:147.235.134.62:3742:41fe:4d2:5019:56ac253:0062712137' AND username = '8532433' AND nasipaddress = '109.226.1.12' WARNING: Child is hung for request 5763408 in component <core> module <queue>. WARNING: Child is hung for request 5763409 in component <core> module <queue>. WARNING: Child is hung for request 5763410 in component <core> module <queue>. rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): Reserving sql socket id: 20 rlm_sql (sql): got socket 20 after skipping 0 unconnected handles, tried to reconnect 1 though rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '9', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.20.11.9:a3b4:30bf:3c4d:3ae3:4d2:0051412759' AND username = 'l100200' AND nasipaddress = '109.226.1.20' WARNING: Child is hung for request 5763411 in component <core> module <queue>. WARNING: Child is hung for request 5763412 in component <core> module <queue>. rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): Reserving sql socket id: 18 rlm_sql (sql): got socket 18 after skipping 0 unconnected handles, tried to reconnect 1 though rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', acctstopdelay = '6', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.28.242.195:f4ad:67aa:a8d9:ffcf:4d2:0051412766' AND username = 'avico313' AND nasipaddress = '109.226.1.20' rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): Reserving sql socket id: 9 rlm_sql (sql): got socket 9 after skipping 0 unconnected handles, tried to reconnect 1 though rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.20.5.237:f847:c445:f249:dfce:4d2:0051412782' AND username = 'sapir25' AND nasipaddress = '109.226.1.20' Child is finally responsive for request 5755840 Child is finally responsive for request 5755841 Child is finally responsive for request 5758217 Child is finally responsive for request 5758218 Child is finally responsive for request 5758219 Child is finally responsive for request 5757227 Child is finally responsive for request 5758220 Child is finally responsive for request 5757228 Child is finally responsive for request 5757229 Child is finally responsive for request 5757230 Child is finally responsive for request 5758221 Child is finally responsive for request 5758222 Child is finally responsive for request 5758223 Child is finally responsive for request 5758224 WARNING: Child is hung for request 5763245 in component <core> module <queue>. WARNING: Child is hung for request 5763246 in component <core> module <queue>. WARNING: Child is hung for request 5763247 in component <core> module <queue>. WARNING: Child is hung for request 5763248 in component <core> module <queue>. WARNING: Child is hung for request 5763249 in component <core> module <queue>. WARNING: Child is hung for request 5763063 in component <core> module <queue>. WARNING: Child is hung for request 5763072 in component <core> module <queue>. WARNING: Child is hung for request 5763073 in component <core> module <queue>. WARNING: Child is hung for request 5763074 in component <core> module <queue>. WARNING: Child is hung for request 5763075 in component <core> module <queue>. Amir.

3 2

Re: Duplicate clients entry & segmentation fault after killing radius server
by Alan Buxey 21 Jul '12

21 Jul '12

...and what information are you providing? I see nothing with this report (ps if this is with an version, then the first thing you do is try the latest release as it may have already been fixed) alan

1 0

Duplicate clients entry & segmentation fault after killing radius server
by Prateek Kumar 21 Jul '12

21 Jul '12

Hi, I have 2 ldap modules which are selected by unlang logic and I have configured my certificates as default. Now when I put a dupticate client entry in clients.conf file & then kill the radius server I got a error like *** glibc detected *** radiusd: free(): invalid pointer: 0xb778e994. Also some time I get the error like munmap_chunk(): invalid pointer. If I remove the duplicate client entry then I don't see the error. radiusd -X . My freerdaius version -> FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Oct 27 2009 at 17:05:49. including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.38 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 172.20.1.146 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 192.168.1.1 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 192.168.1.1 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } WARNING: Ignoring duplicate client 192.168.1.1 radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_ldap Module: Instantiating HR ldap HR { server = "127.0.0.1" port = 389 password = "mypass" identity = "cn=Administrator,dc=prateek,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=HR,dc=prateek,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute HR-Ldap-Group rlm_ldap: Registering ldap_groupcmp for HR-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name HR rlm_ldap: Over-riding set_auth_type, as there is no module HR listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xb78b2628 Module: Instantiating dev ldap dev { server = "127.0.0.1" port = 389 password = "mypass" identity = "cn=Administrator,dc=prateek,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=development,dc=prateek,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute dev-Ldap-Group rlm_ldap: Registering ldap_groupcmp for dev-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name dev rlm_ldap: Over-riding set_auth_type, as there is no module dev listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xb78b3af8 Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_counter Module: Instantiating daily counter daily { filename = "/etc/raddb/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11278 rlm_counter: Current Time: 1342783833 [2012-07-20 17:00:33], Next reset 1342809000 [2012-07-21 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" mode = "rw" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Ready to process requests. Exiting normally.

4 5

Radius reject the request
by Reza Hajjizadeh 21 Jul '12

21 Jul '12

Hello I'm newbie in Linux, install a new radius server as http://wiki.freeradius.org/Build explain tar zxvf freeradius-server-2.1.12.tar.gz ./configure make su - root make install edit /home/reze/freeradius-server-2.1.12/users at top of file add testing Cleartext-Password :="123456" and start radius #radius -X > output.txt on another terminal type #radtest resting 123456 127.0.0.1 10 testing123 but reject the request. Please help me to solve this problem. Best Regards

2 2

Proxim Wireless - Vendor Specific Attributes
by Simha 20 Jul '12

20 Jul '12

All, Will FreeRADIUS support Proxim Wireless (IANA ID - 841) - Vendor Specific Attributes? I have few Tsunami 8000 - MP-8100-BSU and MP-8150-CPEs and need to provision VLAN and QoS using FreeRADIUS. Any information in this regard will be helpful. BR, Simha.

3 2

Re: Re: FreeRADIUS in failover - HA setup (question)(Arran Cudbard-Bell)
by Aldo Zavala 20 Jul '12

20 Jul '12

Arran, many thanks for your reply. After read you reply I have two basic questions below: 1.- Although there are more options to achieve redundancy in MySQL I will choose either MySQL Cluster or MySQL Replication in which I believe (please correct me any time if I am wrong) you have the option of have a floating IP address, all nodes will be master in Cluster, and Master/Slave combinations could be setup in Replication in any case I will always connect to one MySQL IP address so why would I need to call more than one instance of SQL module? 2.- Also, I think Sun (x86 or 64) with Solaris 10 OS will be my platform of choice for the MySQL Cluster or Replication setup, would you recommend me to compile the FreeRADIUS 3.0 (from Git), in other words: - Is there any special document or list of tips to compile FreeRADIUS 3.0 it under Solaris 10?, I have seen many post of people having compilation issues. - In general, is Solaris 10 a recommended platform to run FreeRADIUS 3.0 ? Thanks again! Aldo Zavala ----- Original Message ----- On 19 Jul 2012, at 01:11, Aldo Zavala wrote: > Hi, everybody. > > I was reading the "Deploying FreeRADIUS with the MySQL Cluster Database" whitepaper downloaded from MySQL website, it mentions in "3.1 Deployment Topologies" section that MySQL cluster can be integrated with FreeRADIUS but it always mention FreeRADIUS to be installed in a single node, would be a way to setup FreeRADIUS to be also failover the same way MySQL is, and not run just in a single node always? Yes. You use multiple instances of the SQL module and point them at different SQL nodes, the local node and then any other SQL node in the cluster. You can then use the redundant construct to switch between them in case of failure: redundant { sql sql_remote0 sql_remote1 sql_remoteN } The problem is (with 2.1x and 3.0) is that if all the connections in the SQL connection pool are down, the SQL module will only fail once its tried to establish a new connection and failed. Only one thread can be modifying the contents of the connection pool at a given time because its protected by a mutex. Only one thread can try and open a new connection, and until that connection succeeds or fails all the other threads will block. This causes a bottleneck where a bunch of threads block waiting for their turn to try and re-establish the connection before failing over. Because the server is largely stateless this happens on every request. I believe a good fix would be to check the state of the pool and the mutex, and if were at 0 connections and the pool is locked, to fail instantly. I'll talk to Alan and see what he thinks, maybe it should be configurable. If you're using SQL via a unix socket you should be fine, but as soon as you hit a remote server where you have to wait for the TCP connection to time out, I can almost guarantee that the server will just lock up completely. So unlike the example above, i'd recommend you only specify one local node and one remote node. Or wait and we'll try and fix something for 3.0. -Arran > > Note: Before reply saying that this question should be posted in MySQL forums please consider that I am not asking about MySQL configurations, I am asking about FreeRADIUS product, many thanks to everybody! > > > Aldo Zavala

2 1