I am running FreeRadius ver 1.1.3, and have LDAP setup for authentication and MySQL for logging.

I have a few realms setup as we have two NAS devices one sends stripped usernames (Nortel Shasta), the other sends non-stripped usernames(Cisco ASR). Anything that comes in with a stripped username will end up in the NULL realm and be both authenticated via LDAP and logged into MySQL. Anything that comes in with a username of username@domain.net just gets authenticated, not logged.

I am sure that it’s just a configuration issue but I can figure out where, and have searched the archive without any luck.

Any help would be appreciated.

Below are my startup debug proxy.conf, and two examples of what is happening.

Proxy.conf

###########################################

proxy server {

synchronous = no

retry_delay = 5

retry_count = 3

dead_time = 120

default_fallback = yes

post_proxy_authorize = no

}

realm LOCAL {

type = radius

authhost = LOCAL

accthost = LOCAL

}

realm NULL {

type = radius

authhost = LOCAL

accthost = LOCAL

}

realm domain.net {

type = radius

authhost = LOCAL

accthost = LOCAL

strip

}

###########################################

Startup Debug

Radius.conf

###########################################

realm suffix {

format = suffix

delimiter = "@"

ignore_default = no

ignore_null = no

accounting {

acct_unique

#detail

sql

}

###########################################

[root@ns1 ~]# radiusd -X

Starting - reading configuration files ...

reread_config: reading radiusd.conf

Config: including file: /usr/local/etc/raddb/proxy.conf

Config: including file: /usr/local/etc/raddb/clients.conf

Config: including file: /usr/local/etc/raddb/snmp.conf

Config: including file: /usr/local/etc/raddb/sql.conf

Module: Loaded preprocess

preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"

preprocess: hints = "/usr/local/etc/raddb/hints"

preprocess: with_ascend_hack = no

preprocess: ascend_channels_per_line = 23

preprocess: with_ntdomain_hack = no

preprocess: with_specialix_jetstream_hack = no

preprocess: with_cisco_vsa_hack = no

preprocess: with_alvarion_vsa_hack = no

Module: Instantiated preprocess (preprocess)

Module: Loaded files

files: usersfile = "/usr/local/etc/raddb/users"

files: acctusersfile = "/usr/local/etc/raddb/acct_users"

files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"

files: compat = "no"

Module: Instantiated files (files)

Module: Loaded realm

realm: format = "suffix"

realm: delimiter = "@"

realm: ignore_default = no

realm: ignore_null = no

Module: Instantiated realm (suffix)

Module: Loaded Acct-Unique-Session-Id

acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"

Module: Instantiated acct_unique (acct_unique)

Module: Loaded SQL

sql: driver = "rlm_sql_mysql"

sql: server = "mysql-db.domain.net"

sql: port = ""

sql: login = "XXXX"

sql: password = "XXXX"

sql: radius_db = "radius"

sql: nas_table = "nas"

sql: sqltrace = no

sql: sqltracefile = "/var/log/radius/sqltrace.sql"

sql: readclients = no

sql: deletestalesessions = yes

sql: num_sql_socks = 10

sql: sql_user_name = "%{Stripped-User-Name}"

sql: default_user_profile = ""

sql: query_on_not_found = no

sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id"

sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id"

sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id"

sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id"

sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time} WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'"

sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime = 0"

sql: accounting_update_query_alt = ""

sql: accounting_start_query = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')"

sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0"

sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0"

sql: accounting_stop_query_alt = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '0', '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')"

sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'"

sql: connect_failure_retry_delay = 2

sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0"

sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0"

sql: postauth_query = ""

sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"

rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked

rlm_sql (sql): Attempting to connect to XXX@mysql-db.domain.net:/radius

rlm_sql (sql): starting 0

rlm_sql (sql): Attempting to connect rlm_sql_mysql #0

rlm_sql_mysql: Starting connect to MySQL server for #0

rlm_sql (sql): Connected new DB handle, #0

rlm_sql (sql): starting 1

rlm_sql (sql): Attempting to connect rlm_sql_mysql #1

rlm_sql_mysql: Starting connect to MySQL server for #1

rlm_sql (sql): Connected new DB handle, #1

rlm_sql (sql): starting 2

rlm_sql (sql): Attempting to connect rlm_sql_mysql #2

rlm_sql_mysql: Starting connect to MySQL server for #2

rlm_sql (sql): Connected new DB handle, #2

rlm_sql (sql): starting 3

rlm_sql (sql): Attempting to connect rlm_sql_mysql #3

rlm_sql_mysql: Starting connect to MySQL server for #3

rlm_sql (sql): Connected new DB handle, #3

rlm_sql (sql): starting 4

rlm_sql (sql): Attempting to connect rlm_sql_mysql #4

rlm_sql_mysql: Starting connect to MySQL server for #4

rlm_sql (sql): Connected new DB handle, #4

rlm_sql (sql): starting 5

rlm_sql (sql): Attempting to connect rlm_sql_mysql #5

rlm_sql_mysql: Starting connect to MySQL server for #5

rlm_sql (sql): Connected new DB handle, #5

rlm_sql (sql): starting 6

rlm_sql (sql): Attempting to connect rlm_sql_mysql #6

rlm_sql_mysql: Starting connect to MySQL server for #6

rlm_sql (sql): Connected new DB handle, #6

rlm_sql (sql): starting 7

rlm_sql (sql): Attempting to connect rlm_sql_mysql #7

rlm_sql_mysql: Starting connect to MySQL server for #7

rlm_sql (sql): Connected new DB handle, #7

rlm_sql (sql): starting 8

rlm_sql (sql): Attempting to connect rlm_sql_mysql #8

rlm_sql_mysql: Starting connect to MySQL server for #8

rlm_sql (sql): Connected new DB handle, #8

rlm_sql (sql): starting 9

rlm_sql (sql): Attempting to connect rlm_sql_mysql #9

rlm_sql_mysql: Starting connect to MySQL server for #9

rlm_sql (sql): Connected new DB handle, #9

Module: Instantiated sql (sql)

Module: Loaded radutmp

radutmp: filename = "/var/log/radius/radutmp"

radutmp: username = "%{User-Name}"

radutmp: case_sensitive = no

radutmp: check_with_nas = yes

radutmp: perm = 384

radutmp: callerid = yes

Module: Instantiated radutmp (radutmp)

Listening on authentication *:1812

Listening on accounting *:1813

Listening on proxy *:1814

Ready to process requests.

##################################################################

Connection from CISCO with full username

##########################################################################################

rad_recv: Access-Request packet from host X.X.X.X:1645, id=218, length=105

Framed-Protocol = PPP

User-Name = "username1@domain.net"

User-Password = "userpasswd"

NAS-Port-Type = Virtual

NAS-Port = 0

NAS-Port-Id = "1/0/5/241"

Service-Type = Framed-User

NAS-IP-Address = X.X.X.X

rad_lowerpair: User-Name now 'username@domain.net'

rad_rmspace_pair: User-Name now 'username1@domain.net'

Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 58

modcall[authorize]: module "preprocess" returns ok for request 58

users: Matched entry DEFAULT at line 152

users: Matched entry DEFAULT at line 172

users: Matched entry DEFAULT at line 183

modcall[authorize]: module "files" returns ok for request 58

rlm_realm: Looking up realm "domain.net" for User-Name = "username1@domain.net"

rlm_realm: Found realm "domain.net"

rlm_realm: Adding Stripped-User-Name = "username1"

rlm_realm: Proxying request from user username1 to realm domain.net

rlm_realm: Adding Realm = "domain.net"

rlm_realm: Authentication realm is LOCAL.

modcall[authorize]: module "suffix" returns noop for request 58

modcall: entering group redundant for request 58

rlm_ldap: - authorize

rlm_ldap: performing user authorization for username1

radius_xlat: '(&(objectClass=posixAccount)(uid=username1))'

radius_xlat: 'dc=domain, dc=net'

rlm_ldap: ldap_get_conn: Checking Id: 0

rlm_ldap: ldap_get_conn: Got Id: 0

rlm_ldap: performing search in dc=domain, dc=net, with filter (&(objectClass=posixAccount)(uid=username1))

rlm_ldap: checking if remote access for username1 is allowed by cn

rlm_ldap: Added password 1975 in check items

rlm_ldap: looking for check items in directory...

rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 99 & op=21

rlm_ldap: Adding radiusAuthType as Auth-Type, value local & op=21

rlm_ldap: looking for reply items in directory...

rlm_ldap: user usename1 authorized to use remote access

rlm_ldap: ldap_release_conn: Release Id: 0

modcall[authorize]: module "ldap1" returns ok for request 58

modcall: leaving group redundant (returns ok) for request 58

modcall: leaving group authorize (returns ok) for request 58

rad_check_password: Found Auth-Type local

auth: type Local

auth: user supplied User-Password matches local User-Password

Processing the session section of radiusd.conf

modcall: entering group session for request 58

radius_xlat: '/var/log/radius/radutmp'

modcall[session]: module "radutmp" returns ok for request 58

modcall: leaving group session (returns ok) for request 58

Sending Access-Accept of id 218 to 24.139.16.70 port 1645

Framed-IP-Address = 255.255.255.254

Service-Type = Framed-User

Framed-Protocol = PPP

Framed-Compression = Van-Jacobson-TCP-IP

Finished request 58

##############################################################################################

Connection from Shasta with stripped username

###############################################################################################

Going to the next request

ad_recv: Accounting-Request packet from host X.X.X.X.:49157, id=108, length=178

Acct-Status-Type = Start

User-Name = "username2"

Event-Timestamp = "Dec 30 2009 09:09:14 EST"

Service-Type = Framed-User

NAS-IP-Address = X.X.X.X

Shasta-Attr-4 = 0x53686173746120353030303a2069534f532028746d292c20352e342e3000

NAS-Port = 721420288

Shasta-Attr-9 = 0x30303a31383a66333a32383a63643a3731

Shasta-Attr-10 = 0x0000a572

Acct-Session-Id = "1d069021"

Acct-Authentic = RADIUS

Framed-IP-Address = 67.58.205.173

Framed-IP-Netmask = 255.255.255.255

Calling-Station-Id = "aylm05300000000"

rad_lowerpair: User-Name now 'username2'

rad_rmspace_pair: User-Name now 'username2'

Processing the preacct section of radiusd.conf

modcall: entering group preacct for request 63

modcall[preacct]: module "preprocess" returns noop for request 63

rlm_realm: No '@' in User-Name = "username2", looking up realm NULL

rlm_realm: Found realm "NULL"

rlm_realm: Adding Stripped-User-Name = "username2"

rlm_realm: Proxying request from user username2 to realm NULL

rlm_realm: Adding Realm = "NULL"

rlm_realm: Accounting realm is LOCAL.

modcall[preacct]: module "suffix" returns noop for request 63

modcall[preacct]: module "files" returns noop for request 63

modcall: leaving group preacct (returns noop) for request 63

Processing the accounting section of radiusd.conf

modcall: entering group accounting for request 63

rlm_acct_unique: Hashing 'NAS-Port = 721420288,Client-IP-Address = X.X.X.X,NAS-IP-Address = 67.58.194.98,Acct-Session-Id = "1d069021",User-Name = "username2"'

rlm_acct_unique: Acct-Unique-Session-ID = "e781a2ca4624e026".

modcall[accounting]: module "acct_unique" returns ok for request 63

radius_xlat: 'username2'

rlm_sql (sql): sql_set_user escaped user --> 'username2'

radius_xlat: 'INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '1d069021', 'e781a2ca4624e026', 'username2', 'NULL', 'X.X.X.X', '721420288', '', '2009-12-30 09:08:55', '0', '0', 'RADIUS', '', '', '0', '0', '', 'aylm05300000000', '', 'Framed-User', '', '67.58.205.173', '', '0')'

rlm_sql (sql): Reserving sql socket id: 5

rlm_sql (sql): Released sql socket id: 5

modcall[accounting]: module "sql" returns ok for request 63

modcall: leaving group accounting (returns ok) for request 63

Sending Accounting-Response of id 108 to X.X.X.X port 49157

Finished request 63

####################################################################################################

Thanks,

Chris