I have searched the archive and came close to figuring this out, but I have not been able to get a user to exist in 2 groups and have each authenticate. I have one set of systems that need Login-User and then reply with one set of responses and another set that need Framed-User and reply with a different set of responses.
I have both groups working if I have the user in just one group. If the user is in 2 groups, one group works and the other Rejects. What is wrong with my configuration?
There is an accounting request packet in the trace below that show that sreed is logged into one of the Framed-User devices. Then there is the packet from treed trying to log into a Login-User device.
Configuration tables:
1 USERGROUP
2 80 sreed MS1-AP1
3 76 treed MS1-AP1
4 78 sreed Router-Admin
5 79 treed Router-Admin
6 81 dreed Router-Admin
7
8 RADCHECK
9 331 dreed User-Password == password
10 269 treed User-Password == password
11 267 sreed User-Password == password
12
13 RADGROUPCHECK
14 31 Router-Admin Service-Type == Login-User
15 28 MS1-AP1 Service-Type == Framed-User
16
17 RADREPLY
18 33 sreed Fall-Through = yes
19 43 treed Fall-Through = yes
20
21 RADGROUPREPLY
22 33 MS1-AP1 Port-Limit = 128k 15
23 34 Router-Admin Mikrotik-Group = full 10
24 39 Router-Admin Fall-Through = Yes 10
25 37 MS1-AP1 Fall-Through = Yes 15
Debug trace:
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
rlm_sql (sql): - generate_sql_clients
rlm_sql (sql): Query: SELECT * FROM nas
rlm_sql (sql): Reserving sql socket id: 4
rlm_sql_mysql: query: SELECT * FROM nas
rlm_sql (sql): Read entry nasname=nwnr0004.nwadmin.net,shortname=nwnr0004,secret=sbr28tsr
rlm_sql (sql): Adding client 10.2.49.5 (nwnr0004) to clients list
rlm_sql (sql): Read entry nasname=nwnr0003.nwadmin.net,shortname=nwnr0003,secret=sbr28tsr
rlm_sql (sql): Adding client 10.2.49.4 (nwnr0003) to clients list
rlm_sql (sql): Read entry nasname=nwnr0002.nwadmin.net,shortname=nwnr0002,secret=sbr28tsr
rlm_sql (sql): Adding client 10.0.1.4 (nwnr0002) to clients list
rlm_sql (sql): Read entry nasname=hotspot.nwwhome.net,shortname=hotspot,secret=testing123
rlm_sql (sql): Adding client 192.168.100.13 (hotspot) to clients list
rlm_sql (sql): Read entry nasname=nwnr0001.nwadmin.net,shortname=nwnr0001,secret=sbr28tsr
rlm_sql (sql): Adding client 10.0.0.1 (nwnr0001) to clients list
rlm_sql (sql): Released sql socket id: 4
Module: Instantiated sql (sql)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "/etc/shadow"
unix: group = "(null)"
unix: radwtmp = "/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded radutmp
radutmp: filename = "/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Module: Loaded eap
eap: default_eap_type = "md5"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Listening on authentication *:1812
Listening on accounting *:1813
Listening on proxy *:1814
Ready to process requests.
rad_recv: Accounting-Request packet from host 192.168.100.13:1201, id=165, length=177
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 17564
NAS-Port-Type = Ethernet
User-Name = "sreed"
Calling-Station-Id = "00:05:9E:81:8B:DD"
Called-Station-Id = "TestAP"
NAS-Port-Id = "TestAP"
Acct-Session-Id = "81700264"
Framed-IP-Address = 172.17.1.100
Acct-Authentic = RADIUS
Acct-Session-Time = 54602
Acct-Input-Octets = 80
Acct-Input-Gigawords = 0
Acct-Input-Packets = 8
Acct-Output-Octets = 130
Acct-Output-Gigawords = 0
Acct-Output-Packets = 8
Acct-Status-Type = Alive
NAS-Identifier = "HotSpot"
NAS-IP-Address = 192.168.100.13
Acct-Delay-Time = 0
Processing the preacct section of radiusd.conf
modcall: entering group preacct for request 0
modcall[preacct]: module "preprocess" returns noop for request 0
rlm_acct_unique: Hashing 'NAS-Port = 17564,Client-IP-Address = 192.168.100.13,NAS-IP-Address = 192.168.100.13,Acct-Session-Id = "81700264",User-Name = "sreed"'
rlm_acct_unique: Acct-Unique-Session-ID = "4553128d21acc6cf".
modcall[preacct]: module "acct_unique" returns ok for request 0
rlm_realm: No '@' in User-Name = "sreed", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[preacct]: module "suffix" returns noop for request 0
modcall: group preacct returns ok for request 0
Processing the accounting section of radiusd.conf
modcall: entering group accounting for request 0
radius_xlat: '/var/log/radius/radacct/192.168.100.13/detail-20060405'
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.100.13/detail-20060405
modcall[accounting]: module "detail" returns ok for request 0
modcall[accounting]: module "unix" returns noop for request 0
radius_xlat: '/var/log/radius/radutmp'
radius_xlat: 'sreed'
modcall[accounting]: module "radutmp" returns ok for request 0
radius_xlat: 'sreed'
rlm_sql (sql): sql_set_user escaped user --> 'sreed'
radius_xlat: 'UPDATE radacct ? SET FramedIPAddress = '172.17.1.100', ? AcctSessionTime = '54602', ? AcctInputOctets = '80', ? AcctOutputOctets = '130' ? WHERE AcctSessionId = '81700264' ? AND UserName = 'sreed' ? AND NASIPAddress= '192.168.100.13''
radius_xlat: '/var/log/radius/sqltrace.sql'
rlm_sql (sql): Reserving sql socket id: 3
rlm_sql_mysql: query: UPDATE radacct ? SET FramedIPAddress = '172.17.1.100', ? AcctSessionTime = '54602', ? AcctInputOctets = '80', ? AcctOutputOctets = '130' ? WHERE AcctSessionId = '81700264' ? AND UserName = 'sreed' ? AND NASIPAddress= '192.168.100.13'
rlm_sql (sql): Released sql socket id: 3
modcall[accounting]: module "sql" returns ok for request 0
modcall: group accounting returns ok for request 0
Sending Accounting-Response of id 165 to 192.168.100.13:1201
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.100.13:1201, id=166, length=83
Service-Type = Login-User
User-Name = "treed"
User-Password = "password"
Calling-Station-Id = "192.168.100.240"
NAS-Identifier = "HotSpot"
NAS-IP-Address = 192.168.100.13
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
rlm_realm: No '@' in User-Name = "treed", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 1
radius_xlat: 'treed'
rlm_sql (sql): sql_set_user escaped user --> 'treed'
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'treed' ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'treed' ORDER BY id
radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'treed' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'treed' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'treed' ORDER BY id'
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'treed' ORDER BY id
radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'treed' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.prio'
rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'treed' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.prio
rlm_sql (sql): No matching entry in the database for request from user [treed]
rlm_sql (sql): Released sql socket id: 2
modcall[authorize]: module "sql" returns notfound for request 1
modcall: group authorize returns ok for request 1
auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
auth: Failed to validate the user.
Login incorrect: [treed/password] (from client hotspot port 0 cli 192.168.100.240)
Processing the post-auth section of radiusd.conf
modcall: entering group Post-Auth-Type for request 1
rlm_sql (sql): Processing sql_postauth
radius_xlat: 'treed'
rlm_sql (sql): sql_set_user escaped user --> 'treed'
radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'treed', 'password', 'Access-Reject', NOW())'
radius_xlat: '/var/log/radius/sqltrace.sql'
rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'treed', 'password', 'Access-Reject', NOW())
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'treed', 'password', 'Access-Reject', NOW())
rlm_sql (sql): Released sql socket id: 1
modcall[post-auth]: module "sql" returns ok for request 1
modcall: group Post-Auth-Type returns ok for request 1
Delaying request 1 for 1 seconds
Finished request 1
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Request packet from host 192.168.100.13:1201, id=166, length=83
Sending Access-Reject of id 166 to 192.168.100.13:1201
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 3 seconds...
Scott Reed
Owner
NewWays
Wireless Networking
Network Design, Installation and Administration
www.nwwnet.net
---------- Original Message
-----------
From: "debik" <debik@vp.pl>
To: "FreeRadius users mailing list"
<freeradius-users@lists.freeradius.org>
Sent: Wed, 5 Apr 2006 20:26:14 +0200
Subject: Re: Couldn't stop freeradius server!!
> Try "killall radiusd" or "killall
freeradius".
>
I have debian and that commands are allwright.
>
>
----- Original Message -----
>
From: "lmyho" <lm_yho@yahoo.com>
>
To: "FreeRadius users mailing list"
<freeradius-users@lists.freeradius.org>
>
Sent: Tuesday, April 04, 2006 6:19 PM
>
Subject: Re: Couldn't stop freeradius server!!
>
>
>
>
> --- monish ar <monish.ar@gmail.com> wrote:
>
>> Instead of using the command to stop the radius daemon, herez
another
>
>> simple way.....
>
>> At the console type " ps -ax | grep radiusd" , this
will give u the list
>
>> of
>
>> radius servers currently
>
>> along with its process IDs. The next thing u do is type "
kill pid# " ,
>
>> PID# refers to the process
>
>> id number of ur currently running radius daemon. Hope it helps...
>
>> Dunno bout the NAS list though...
>
>
>
> Hi Monish,
>
>
>
> Thank you for the idea! I checked, and found the process. but
on this
>
> debian
>
> system, the process is actually named "freeradius", instead of
the
>
> traditional
>
> "radiusd".:( So there are indeed some changes on how the
freeradius is
>
> run on
>
> debian. Do you have more idea about it?
>
> Can anyone tell me more on how the debian is running the freeradius and
>
> how I can
>
> stop the server from command line in debian system? (pls see problem
>
> detail below)
>
>
>
> Thanks a lot!!
>
> leo
>
>
>
>> On 4/4/06, lmyho <lm_yho@yahoo.com> wrote:
>
>> >
>
>> > Hi All,
>
>> >
>
>> > Installed freeradius 1.1.0-1 on debian system (2.6.15-1-686).
The
>
>> > radius
>
>> > server started automatically well each time when the system
booting.
>
>> > But I
>
> wanted to stop it to do some testing using my modified configuration
>
> files. I tried
>
> to stop the server using command: 'freeradius stop' ('radiusd' doesn't
>
> work on this
>
> debian - anyone knows why??)
>
>> >
>
>> > But so werid, no matter what command I gave, with parameter
>
>> > stop|start|restart, the server ALWAYS goes to START again!! even
from
>
>> > the
>
> /etc/init.d/freeradius I can read that the 'stop' param should stop the
>
> server! Can
>
> anyone tell me why the command couldn't stop the server?? and how should I
>
> stop it??
>
>> >
>
>> > The log file shows entries like this for each of my trying, even
the
>
>> > command given was to "stop":
>
>> >
>
>> > Tue Apr 4 01:14:13 2006 : Info: Using deprecated naslist
file.
>
>> > Support
>
>> > for this will go away soon.
>
>> > Tue Apr 4 01:14:13 2006 : Error: There appears to be another
RADIUS
>
>> > server running on the authenticat
>
>> >
>
>> > What is happenning here? (I couldn't top the running deamon,
so is the
>
>> > 2nd line above)
>
>> >
>
>> > Also, from the log file I noticed: even when the system
automatically
>
>> > started the freeradius server deamon, it was "Using
deprecated naslist
>
>> > file".
>
> Log entries show like this:
>
>> >
>
>> > Fri Mar 31 13:51:54 2006 : Info: Using deprecated naslist file.
>
>> > Support
>
>> > for this will go away soon.
>
>> > Fri Mar 31 13:51:54 2006 : Info: rlm_exec: Wait=yes but no output
>
>> > defined.
>
>> > Did you mean output=none?
>
>> > Fri Mar 31 13:51:55 2006 : Info: Ready to process requests.
>
>> >
>
>> > Can anyone tell me what is happenning here?? Why it's using the
>
>> > deprecating naslist file? The installed radiusd.conf file doesn't
show
>
>> > the
>
> server will use the naslist
>
>> > file at all! from where I can stop the server to use this
deprecating
>
>> > file? Also what does the 2nd line of the above log entries
mean?
>
>> >
>
>> > Any help would be greatly appreciated! Thank you so much for
help in
>
>> > advance!!
>
>> >
>
>> > Best regrads,
>
>> > leo
>
>>
>
>>
>
>>
>
>
>
>
>
> __________________________________________________
>
> Do You Yahoo!?
>
> Tired of spam? Yahoo! Mail has the best spam protection around
>
> http://mail.yahoo.com
>
> -
>
> List info/subscribe/unsubscribe? See
>
> http://www.freeradius.org/list/users.html
>
>
-
>
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------- End
of Original Message
-------