- Freeradius-Users - lists.freeradius.org

Cisco WLC - Freeradius Vlan assigment problem
by Martin Silvero 28 Jun '12

28 Jun '12

Hi Matthew, I checked that out and it's configured as you suggested. The AAA Override option is enabled. The vlan attributes are these: Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = VLAN_ID It works fine when we use the AP against the radius server, but when we use the WLC against the Radius server the process is not getting to the attributes assignment part, because (I guess) it's not getting something in the Huntgroup variable. This is the difference. The one that works: server inner-tunnel { +- entering group authorize {...} ++[preprocess] returns ok ++? if (!Huntgroup-Name) ? Evaluating !(Huntgroup-Name) -> FALSE ++? if (!Huntgroup-Name) -> FALSE ++? if (Huntgroup-Name == "list") ? Evaluating (Huntgroup-Name == "list") -> TRUE ++? if (Huntgroup-Name == "list") -> TRUE ++- entering if (Huntgroup-Name == "list") {...} +++? if (Ldap-Group == "WIFI-Direccion") "WIFI-Direccion" is the first LDAP group to check if the user is in. The one that does not work: server inner-tunnel { +- entering group authorize {...} ++[preprocess] returns ok ++? if (!Huntgroup-Name) ? Evaluating !(Huntgroup-Name) -> TRUE ++? if (!Huntgroup-Name) -> TRUE ++- entering if (!Huntgroup-Name) {...} +++[reply] returns ok ++- if (!Huntgroup-Name) returns ok ++? if (Huntgroup-Name == "list") (Attribute Huntgroup-Name was not found) Apart from this, I see differencies in other parts of the radius debug like this: The one that works: rad_recv: Access-Request packet from host 10.32.2.39 port 1645, id=199, length=136 User-Name = "fcanales" Framed-MTU = 1400 Called-Station-Id = "001d.4551.7da0" Calling-Station-Id = "5894.6b0d.e86c" Service-Type = Login-User Message-Authenticator = 0x645687565f9d60e3b76f5ffac29b74a1 EAP-Message = 0x0202000d016663616e616c6573 NAS-Port-Type = Wireless-802.11 NAS-Port = 59460 NAS-IP-Address = 10.32.2.39 NAS-Identifier = "ap-Reco32" The one that does not work: rad_recv: Access-Request packet from host 10.32.2.81 port 32768, id=113, length=232 User-Name = "fcanales" Calling-Station-Id = "58-94-6b-0d-e8-6c" Called-Station-Id = "30-37-a6-4b-9f-90:IReconquista" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0a2002510000000f4eaaf051" NAS-IP-Address = 10.32.2.81 NAS-Identifier = "Iplan_wcs" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "60" EAP-Message = 0x0202000d016663616e616c6573 Message-Authenticator = 0x77344c030301e2389311b1dde163a5b7 The differencies in "Calling-Station-Id", "Called-Station-Id" and " Service-Type", for example. Is it posible that WCL is sending the information in a way that Radius cannot process? Thanks!

3 3

EAP fails when proxying to a realm
by Christopher Manigan 28 Jun '12

28 Jun '12

I am trying to use MSCHAPv2 to authenticate users. This works ok, except when I try to proxy to a realm. Pasted below is the debug of a user trying to authenticate. The realm is a prefix of the username. What I see buried in the debug is: # radiusd -X FreeRADIUS Version 2.1.11, for host i686-pc-linux-gnu, built on Jun 28 2012 at 11:37:39 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth+acct" secret = "t0werstream" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } realm myrealm { auth_pool = mypool } realm LOCAL { } home_server_pool my_auth_failover { type = fail-over home_server = localhost } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/raddb/modules/detail.log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_realm Module: Instantiating module "IPASS" from file /etc/raddb/modules/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "password" radius_db = "radiusdb" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 50 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radiusdb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 rlm_sql (sql): starting 32 rlm_sql (sql): Attempting to connect rlm_sql_mysql #32 rlm_sql_mysql: Starting connect to MySQL server for #32 rlm_sql (sql): Connected new DB handle, #32 rlm_sql (sql): starting 33 rlm_sql (sql): Attempting to connect rlm_sql_mysql #33 rlm_sql_mysql: Starting connect to MySQL server for #33 rlm_sql (sql): Connected new DB handle, #33 rlm_sql (sql): starting 34 rlm_sql (sql): Attempting to connect rlm_sql_mysql #34 rlm_sql_mysql: Starting connect to MySQL server for #34 rlm_sql (sql): Connected new DB handle, #34 rlm_sql (sql): starting 35 rlm_sql (sql): Attempting to connect rlm_sql_mysql #35 rlm_sql_mysql: Starting connect to MySQL server for #35 rlm_sql (sql): Connected new DB handle, #35 rlm_sql (sql): starting 36 rlm_sql (sql): Attempting to connect rlm_sql_mysql #36 rlm_sql_mysql: Starting connect to MySQL server for #36 rlm_sql (sql): Connected new DB handle, #36 rlm_sql (sql): starting 37 rlm_sql (sql): Attempting to connect rlm_sql_mysql #37 rlm_sql_mysql: Starting connect to MySQL server for #37 rlm_sql (sql): Connected new DB handle, #37 rlm_sql (sql): starting 38 rlm_sql (sql): Attempting to connect rlm_sql_mysql #38 rlm_sql_mysql: Starting connect to MySQL server for #38 rlm_sql (sql): Connected new DB handle, #38 rlm_sql (sql): starting 39 rlm_sql (sql): Attempting to connect rlm_sql_mysql #39 rlm_sql_mysql: Starting connect to MySQL server for #39 rlm_sql (sql): Connected new DB handle, #39 rlm_sql (sql): starting 40 rlm_sql (sql): Attempting to connect rlm_sql_mysql #40 rlm_sql_mysql: Starting connect to MySQL server for #40 rlm_sql (sql): Connected new DB handle, #40 rlm_sql (sql): starting 41 rlm_sql (sql): Attempting to connect rlm_sql_mysql #41 rlm_sql_mysql: Starting connect to MySQL server for #41 rlm_sql (sql): Connected new DB handle, #41 rlm_sql (sql): starting 42 rlm_sql (sql): Attempting to connect rlm_sql_mysql #42 rlm_sql_mysql: Starting connect to MySQL server for #42 rlm_sql (sql): Connected new DB handle, #42 rlm_sql (sql): starting 43 rlm_sql (sql): Attempting to connect rlm_sql_mysql #43 rlm_sql_mysql: Starting connect to MySQL server for #43 rlm_sql (sql): Connected new DB handle, #43 rlm_sql (sql): starting 44 rlm_sql (sql): Attempting to connect rlm_sql_mysql #44 rlm_sql_mysql: Starting connect to MySQL server for #44 rlm_sql (sql): Connected new DB handle, #44 rlm_sql (sql): starting 45 rlm_sql (sql): Attempting to connect rlm_sql_mysql #45 rlm_sql_mysql: Starting connect to MySQL server for #45 rlm_sql (sql): Connected new DB handle, #45 rlm_sql (sql): starting 46 rlm_sql (sql): Attempting to connect rlm_sql_mysql #46 rlm_sql_mysql: Starting connect to MySQL server for #46 rlm_sql (sql): Connected new DB handle, #46 rlm_sql (sql): starting 47 rlm_sql (sql): Attempting to connect rlm_sql_mysql #47 rlm_sql_mysql: Starting connect to MySQL server for #47 rlm_sql (sql): Connected new DB handle, #47 rlm_sql (sql): starting 48 rlm_sql (sql): Attempting to connect rlm_sql_mysql #48 rlm_sql_mysql: Starting connect to MySQL server for #48 rlm_sql (sql): Connected new DB handle, #48 rlm_sql (sql): starting 49 rlm_sql (sql): Attempting to connect rlm_sql_mysql #49 rlm_sql_mysql: Starting connect to MySQL server for #49 rlm_sql (sql): Connected new DB handle, #49 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 49 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=secret rlm_sql (sql): Adding client 127.0.0.1 (localhost, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 49 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "reply_log" from file /etc/raddb/modules/detail.log detail reply_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 41620 ... adding new socket proxy address * port 46995 ... adding new socket proxy address * port 43755 ... adding new socket proxy address * port 35210 ... adding new socket proxy address * port 53936 ... adding new socket proxy address * port 60364 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 69.38.220.74 port 33457, id=25, length=227 User-Name = "myrealm/chris" Calling-Station-Id = "78-D6-F0-9B-62-97" NAS-IP-Address = 69.38.220.74 NAS-Port = 1 Called-Station-Id = "74-91-1A-63-49-58:My Wi-Fi" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "74-91-1A-63-49-58" Connect-Info = "CONNECT 802.11g/n" WISPr-Location-Name = "Lab" EAP-Message = 0x0200001101737072696e742f6368726973 Vendor-25053-Attr-3 = 0x537072696e742057692d4669 Message-Authenticator = 0x41f70f465513dc906b544110465b80ad # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/69.38.220.74/auth-detail-20120628 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/69.38.220.74/auth-detail-20120628 [auth_log] expand: %t -> Thu Jun 28 12:19:22 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [IPASS] Looking up realm "myrealm" for User-Name = "myrealm/chris" [IPASS] Found realm "myrealm" [IPASS] Adding Stripped-User-Name = "chris" [IPASS] Adding Realm = "myrealm" [IPASS] Proxying request from user chris to realm myrealm [IPASS] Preparing to proxy authentication request to realm "myrealm" ++[IPASS] returns updated [eap] Request is supposed to be proxied to Realm myrealm. Not doing EAP. ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> myrealm/chris [sql] sql_set_user escaped user --> 'myrealm/chris' rlm_sql (sql): Reserving sql socket id: 48 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'myrealm/chris' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'myrealm/chris' ORDER BY priority rlm_sql (sql): Released sql socket id: 48 [sql] User myrealm/chris not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 22 to 127.0.0.1 port 1812 User-Name = "chris" Calling-Station-Id = "78-D6-F0-9B-62-97" NAS-IP-Address = 1.1.1.1 NAS-Port = 1 Called-Station-Id = "74-91-1A-63-49-58:My Wi-Fi" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "74-91-1A-63-49-58" Connect-Info = "CONNECT 802.11g/n" WISPr-Location-Name = "Lab" EAP-Message = 0x0200001101737072696e742f6368726973 Vendor-25053-Attr-3 = 0x537072696e742057692d4669 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3235 Proxying request 0 to home server 127.0.0.1 port 1812 Sending Access-Request of id 22 to 127.0.0.1 port 1812 User-Name = "chris" Calling-Station-Id = "78-D6-F0-9B-62-97" NAS-IP-Address = 1.1.1.1 NAS-Port = 1 Called-Station-Id = "74-91-1A-63-49-58:My Wi-Fi" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "74-91-1A-63-49-58" Connect-Info = "CONNECT 802.11g/n" WISPr-Location-Name = "Lab" EAP-Message = 0x0200001101737072696e742f6368726973 Vendor-25053-Attr-3 = 0x537072696e742057692d4669 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3235 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=22, length=224 User-Name = "chris" Calling-Station-Id = "78-D6-F0-9B-62-97" NAS-IP-Address = 1.1.1.1 NAS-Port = 1 Called-Station-Id = "74-91-1A-63-49-58:My Wi-Fi" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "74-91-1A-63-49-58" Connect-Info = "CONNECT 802.11g/n" WISPr-Location-Name = "Lab" EAP-Message = 0x0200001101737072696e742f6368726973 Vendor-25053-Attr-3 = 0x537072696e742057692d4669 Message-Authenticator = 0x89165f7b9f6f2901f98df17bc6ad51b1 Proxy-State = 0x3235 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20120628 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20120628 [auth_log] expand: %t -> Thu Jun 28 12:19:22 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [IPASS] No '/' in User-Name = "chris", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> chris [sql] sql_set_user escaped user --> 'chris' rlm_sql (sql): Reserving sql socket id: 47 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'chris' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'chris' ORDER BY priority rlm_sql (sql): Released sql socket id: 47 [sql] User chris not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> chris [sql] sql_set_user escaped user --> 'chris' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'chris', '', 'Access-Reject', '2012-06-28 12:19:22') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'chris', '', 'Access-Reject', '2012-06-28 12:19:22') rlm_sql (sql): Reserving sql socket id: 46 rlm_sql (sql): Released sql socket id: 46 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> chris attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 22 to 127.0.0.1 port 1814 Proxy-State = 0x3235 Waking up in 4.9 seconds. rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=22, length=24 Proxy-State = 0x3235 # Executing section post-proxy from file /etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> myrealm/chris [sql] sql_set_user escaped user --> 'myrealm/chris' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'myrealm/chris', '', 'Access-Reject', '2012-06-28 12:19:22') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'myrealm/chris', '', 'Access-Reject', '2012-06-28 12:19:22') rlm_sql (sql): Reserving sql socket id: 45 rlm_sql (sql): Released sql socket id: 45 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> myrealm/chris attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 25 to 69.38.220.74 port 33457 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 22 with timestamp +7 Cleaning up request 0 ID 25 with timestamp +7 Ready to process requests. Thanks, Chris

3 3

Update control with redundant sql query
by lscrlstld 28 Jun '12

28 Jun '12

Hi, I use the policy configs to provide redundant and load-balance to update the pool-name. It´s work fine! But I have same questions... - Is it the correct way to do it? Is it the better way, considering a performance in high usage? - Why the virtual module created in the policy and control update always return "notfound" ? +- entering group authorize {...} ++- entering policy update_ctlr_PN {...} +++- entering redundant-load-balance group redundant-load-balance {...} ++++- entering policy update01_Pool-Name {...} ... expand: select poolname from radpoolname where nasipaddress="%{NAS-IP-Address}" -select poolname from radpoolname where nasipaddress="X.X.X.X" rlm_sql (sql01): Reserving sql socket id: 4 sql_xlat finished rlm_sql (sql01): Released sql socket id: 4 expand: %{sql01:select poolname from radpoolname where nasipaddress="%{NAS-IP-Address}"} -pool01 +++++[control] returns notfound ++++- policy update_ctlr_PN1 returns notfound +++- redundant-load-balance group redundant-load-balance returns notfound ++- policy update_ctlr_PN returns notfound The policy.conf policy { update_ctlr_PN1 { update control { Pool-Name := "%{sql01:select poolname from radpoolname where nasipaddress=\"%{NAS-IP-Address}\"}" } } update_ctlr_PN2 { update control { Pool-Name := "%{sql02:select poolname from radpoolname where nasipaddress=\"%{NAS-IP-Address}\"}" } } update_ctlr_PN { redundant-load-balance { update_ctlr_PN1 update_ctlr_PN2 } } } Server conf: ... authorize { update_ctlr_PN pap chap sql01 } ... Thank you.

2 1

Re: Cisco WLC - Freeradius Vlan assigment problem
by Martin Silvero 28 Jun '12

28 Jun '12

> ++- if (!Huntgroup-Name) returns ok ++? if (Huntgroup-Name == "list") > (Attribute Huntgroup-Name was not found) > >the problem seems to be your huntgroup.. Can you post your huntgroup >definitions? >-- >Jens Weibler >IT-Services Hi, In huntgroup I just have: ........... # Usuario = xxx xxx list Calling-Station-Id == 0221.6ae0.cef8 ............ Them in sites-available/inner-tunnel I have a script: if(!Huntgroup-Name) { # reject update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 249 } } if(Huntgroup-Name == "list") { if( Ldap-Group == "WIFI-Direccion") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 200 } seems ok. What do you think? Thanks a lot.

1 0

Help needed to configure FreeRADIUS for eduroam
by Olivier Nicole 28 Jun '12

28 Jun '12

Hi, I am struggling to configure my FreeRADIUS server for eduroam (www.eduroam.org) as I understood that some subscribers have done the configuration successfully, I come here to get help. I have been running my FreeRADIUS server with out problem for several years, identifying to an openLdap backend. I managed to configure a test WiFi access point to identify with 802.1x against that same radius/ldap server. But I have a problem to configure eduroam, so I would be glad if I could see a working example. TIA, Olivier

4 5

Max Daily Session key
by jim bolger 28 Jun '12

28 Jun '12

Hi all, I am running Freeradius 1.1.7, mysql and coovachilli. I need a access plan of a maximum 2 hours per day per mac address. We want users to click an enter button rather than using vouchers/usernames, etc, How do I tie the mac address and not a username to max daily session? Do I change the sqlcounter dailycounter key from user-name to callingstatinID Can the dailycounter query be rewritten with callingstationID rather than UserName? query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" Am I on the right track here?

1 0

Questions on the finer points of CUI
by Scott Armitage 28 Jun '12

28 Jun '12

All, I was after some clarification about the implementation of CUI in freeRADIUS. My first point is the use of Client IP Address. I notice that client IP Address makes a regular appearance but I'm wondering whether it should. Looking at the cui.conf the post-auth insert adds the Client IP Address. postauth_query = "INSERT IGNORE INTO ${cui_table} \ (clientipaddress, callingstationid, username, cui, lastaccounting) \ VALUES \ ('%{Client-IP-Address}', '%{Calling-Station-Id}', '%{User-Name}', '%{reply:Chargeable-User-Identity}', NULL) ON DUPLICATE KEY UPDATE lastaccounting='0000-00-00 00:00:00', cui='%{reply:Chargeable-User-Identity}'"; likewise the schema (in cui.sql) even has the Client IP Address as a primary key which to me seems wrong. In the world of eduroam my RADIUS server can proxy off to one of 3 National Proxies each will have a different Client IP Address, therefore a single client could have 3 entries in the cui table depending upon which National proxy dealt with the request. I don't see the point of the Client IP Address being in there. If each home server is using a salt (together with the operator name) then even the same username and calling station id will return a different CUI for different home servers. Maybe some could explain what I'm missing and why the Client IP Address is there? Staying with the Client IP Address, my next point surrounds the Accounting. The cui.conf shows that accounting updates the table using Client IP Address in the search: accounting_start_query = "UPDATE ${cui_table} \ SET \ lastaccounting = CURRENT_TIMESTAMP \ WHERE clientipaddress = '%{Client-IP-Address}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND username = '%{User-Name}' \ AND cui = '%{Chargeable-User-Identity}'"; How would this work? The NAS doesn't know what the Client IP Address is and doesn't send it in Accounting packets. Finally, why does the Accounting stop for cui remove the cui from the database: accounting_stop_query = "DELETE FROM ${cui_table} WHERE \ clientipaddress = '%{Client-IP-Address}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND username = '%{User-Name}' \ AND cui = '%{Chargeable-User-Identity}'"; Surely I'd want to keep this? If 2 weeks later I get a copyright infringement notice for a client, I'd want the CUI when contacting the home site of the user. Thanks Scott Armitage

2 1

CUI accounting in policy.conf
by Scott Armitage 27 Jun '12

27 Jun '12

All, I'm using FR3.0 trying to use CUI and am having a few problems with the accounting. In policy.conf I have: # # If we had stored a CUI for the User, add it to the request. # cui.accounting { # # If the CUI isn't in the packet, see if we can find it # in the DB. # if (!Chargeable-User-Identity) { update control { Chargeable-User-Identity := "%{cui: SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'}" } } # # If it exists now, then write out when we last saw # this CUI. # if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) { cui } } Which is slightly different to the standard policy.conf in that I don't care about the Client-IP-Address in my select. However, that change should not have an effect on the issue I am seeing. Basically the update control should set the Chargeable-User-Identity but it appears not to, as the following if evaluates to false: Wed Jun 27 19:40:59 2012 : Info: (13) policy cui.accounting { Wed Jun 27 19:40:59 2012 : Info: (13) - entering policy cui.accounting {...} Wed Jun 27 19:40:59 2012 : Info: (13) ? if (!Chargeable-User-Identity) Wed Jun 27 19:40:59 2012 : Info: (13) ? Evaluating !(Chargeable-User-Identity) -> TRUE Wed Jun 27 19:40:59 2012 : Info: (13) ? if (!Chargeable-User-Identity) -> TRUE Wed Jun 27 19:40:59 2012 : Info: (13) if (!Chargeable-User-Identity) { Wed Jun 27 19:40:59 2012 : Info: (13) - entering if (!Chargeable-User-Identity) {...} Wed Jun 27 19:40:59 2012 : Info: (13) update control { Wed Jun 27 19:40:59 2012 : Info: (13) sql_xlat Wed Jun 27 19:40:59 2012 : Info: (13) expand: %{User-Name} -> anonymous(a)eduroam.ac.uk Wed Jun 27 19:40:59 2012 : Info: (13) sql_set_user escaped user --> 'anonymous(a)eduroam.ac.uk' Wed Jun 27 19:40:59 2012 : Info: (13) expand: SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}' -> SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '02-00-00-00-00-01' AND username = 'anonymous(a)eduroam.ac.uk' Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Opening additional connection (1) Wed Jun 27 19:40:59 2012 : Debug: No trigger subsection: ignoring trigger modules.sql.open Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Reserved connection (1) Wed Jun 27 19:40:59 2012 : Debug: rlm_sql_postgresql: Status: PGRES_TUPLES_OK Wed Jun 27 19:40:59 2012 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 1 Wed Jun 27 19:40:59 2012 : Info: (13) sql_xlat finished Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Released connection (1) Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Closing idle connection (1): Too many free connections (1 > 0) Wed Jun 27 19:40:59 2012 : Debug: rlm_sql (cui): Closing connection (1) Wed Jun 27 19:40:59 2012 : Debug: No trigger subsection: ignoring trigger modules.sql.close Wed Jun 27 19:40:59 2012 : Info: (13) expand: %{cui: SELECT cui FROM staffbaseschema.cui WHERE callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'} -> 51311af182a072427aec46c8d4f14844 Wed Jun 27 19:40:59 2012 : Info: (13) } # update control = ok Wed Jun 27 19:40:59 2012 : Info: (13) - if (!Chargeable-User-Identity) returns ok Wed Jun 27 19:40:59 2012 : Info: (13) ? if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) Wed Jun 27 19:40:59 2012 : Info: (13) ? Evaluating (Chargeable-User-Identity ) -> FALSE Wed Jun 27 19:40:59 2012 : Info: (13) ?? Skipping (Chargeable-User-Identity != "") Wed Jun 27 19:40:59 2012 : Info: (13) ? if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) -> FALSE Wed Jun 27 19:40:59 2012 : Info: (13) - policy cui.accounting returns ok I'm I being stupid or is this policy broken. thanks Scott Armitage

2 2

Can't figure out Group Authentication
by Julson, Jim 27 Jun '12

27 Jun '12

First, I'd like to thank Alan for his beyond countless hours of dedication to all the blogs, forum posting, and general support within the community. Your write-ups are thorough and well thought out. I wish more people were like you. I'm pretty new to RADIUS and as consequently, Linux in general. So I might ask questions that seem noobish or lame, but it doesn't mean I'm not willing to learn, research etc. Just bare with me. Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. I've added the following entry into "/etc/raddb/clients.conf" to allow AAA on one of my cisco routers. ************************************* client 10.10.0.5 { secret = REALSECRETOMMITTED shortname = Cisco-2911-VPCRTR nastype = cisco } ************************************* Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. However, so did every other "Domain User" account in the environment. This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together. I'm getting there, but just not fast enough. So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well. NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up. Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication. BEGIN RADIUSD -X DEBUG OUTPUT ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.16.1.1 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-1" nastype = "cisco" } client 172.16.1.3 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-2" nastype = "cisco" } client 172.16.1.2 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5520-01" nastype = "cisco" } client 10.10.0.5 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-2911-VPCRTR" nastype = "cisco" } client 172.16.1.10 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5510-GDM" nastype = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYREALDOMAIN-OMMITTED --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** END RADIUSD -X DEBUG OUTPUT Jim C. Julson Sr. Network & Systems Administrator C 208.908.1476 jjulson(a)marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com> [Learn more about Network Connect]<http://www.marketron.com/network-connect.php?email> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.

5 13

FW: SQLm_counter and 64 bit values
by Jonathan Bastin 26 Jun '12

26 Jun '12

I am using Freeradius 2 on Ubuntu 64 bit machine. I am trying to add up the months' worth of data the user has used and make sure they don't go over capacity. So far I have counter.conf: sqlcounter monthlydata { counter-name = Total-Octets-Monthly check-name = CS-Total-Octets-Monthly reply-name = menu sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM( AcctInputOctets + AcctOutputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > (DATE_SUB(CURDATE(),INTERVAL DAYOFMONTH(CURDATE())DAY))" } And in the users I have a check value of CS-Total-Octets-Monthly := 107375000000 The issue I am having is that I get Debug: rlm_sqlcounter: (Check item - counter) is less than zero which I believe is because the sql query returns a value bigger than 32bit and the sql counter module isn't 64 bit counter. Is anybody able to offer me advise on where to go with this one. I did read this thread but no real fix came out of it http://freeradius.1045715.n5.nabble.com/Problem-with-rml-sqlcounter-with-Gi… -------------------------------------------------------------------------------------------------------------------------- This email (including any attachments) is intended only for the recipient(s) named above. It may contain confidential or privileged information and should not be read, copied or otherwise used by any other person. If you are not the named recipient please contact the sender and delete the email from your system. The author's incumbent expressions, views and thoughts are their own and not necessarily representative of those of the Peer Point Internet Ltd or associated companies.

1 1