echo "Acct-Session-Id={ACTSESSION}\nUser-Name={MYUSERNAME}\nX-Ascend-Session-Svr-Key={SESSIONKEY}" | radclient -x 10.0.5.1:3799 disconnect 123

session removed successfully but I receive Disconnect-NAK (unsuccessfully)

Again this error :(((

Reply-Message = "Session Not Removed"

Error-Cause = Session-Context-Not-Removable

Cisco:

…

aaa server radius dynamic-author

server-key 7 00554155

port 3799

auth-type any

…

-----Original Message-----
From: freeradius-users-bounces+nadir=ultel.net@lists.freeradius.org [mailto:freeradius-users-bounces+nadir=ultel.net@lists.freeradius.org] On Behalf Of freeradius-users-request@lists.freeradius.org
Sent: Monday, August 10, 2009 2:51 PM
To: freeradius-users@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 52, Issue 48

Send Freeradius-Users mailing list submissions to

freeradius-users@lists.freeradius.org

To subscribe or unsubscribe via the World Wide Web, visit

http://lists.freeradius.org/mailman/listinfo/freeradius-users

or, via email, send a message with subject or body 'help' to

freeradius-users-request@lists.freeradius.org

You can reach the person managing the list at

freeradius-users-owner@lists.freeradius.org

When replying, please edit your Subject line so it is more specific

than "Re: Contents of Freeradius-Users digest..."

Today's Topics:

1. Re: Freeradius-Users Digest, Vol 52, Issue 47 (Gilbert Lo)

2. Do not query LDAP if authenticated via proxy (Steven Carr)

3. Mac based authentication (Sanhenra Sinaga)

4. Re: radius server 2.1.6 not storing data in radacct

table..help (Alan Buxey)

5. (Nadir M. Aliyev)

6. Re: your mail (Alan Buxey)

----------------------------------------------------------------------

Message: 1

Date: Mon, 10 Aug 2009 01:36:58 -0700

From: "Gilbert Lo" <gilbertlo@stgeorges.bc.ca>

Subject: Re: Freeradius-Users Digest, Vol 52, Issue 47

To: freeradius-users@lists.freeradius.org

Message-ID:

<fc.00802d7e01bfda553b9aca0027e19de6.1bfda56@stgeorges.bc.ca>

Content-Type: text/plain; charset=UTF-8

Thank you for your message. I am away until August 7th. I will respond

to your message on my return . For urgent matters, please contact

helpdesk@stgeorges.bc.ca .

Cheers,

Gilbert Lo

------------------------------

Message: 2

Date: Mon, 10 Aug 2009 09:39:22 +0100

From: Steven Carr <steven.carr@sunderland.ac.uk>

Subject: Do not query LDAP if authenticated via proxy

To: FreeRadius users mailing list

<freeradius-users@lists.freeradius.org>

Message-ID: <4A7FDCBA.907@sunderland.ac.uk>

Content-Type: text/plain; charset="utf-8"

Hi list,

I have the following question, not entirely sure how to stop FreeRADIUS

(Debian recompile 2.0.4) from doing this so any ideas would be grateful.

We are joining Eduroam and we have our FreeRADIUS set to proxy on the

DEFAULT realm and have a separate realm for our local domain.

If we pass a request to the proxy to be authenticated both before and

after the request has been proxied it queries our LDAP server to check

if the user exists.

> rad_recv: Access-Request packet from host 127.0.0.1 port 43386, id=216, length=82

> User-Name = "user@domain.com"

> User-Password = "******"

> NAS-IP-Address = 157.228.68.190

> NAS-Port = 1

> +- entering group authorize

> ++[preprocess] returns ok

> ++[chap] returns noop

> ++[mschap] returns noop

> rlm_realm: Looking up realm "domain.com" for User-Name = "user@domain.com"

> rlm_realm: Found realm "DEFAULT"

> rlm_realm: Adding Realm = "DEFAULT"

> rlm_realm: Proxying request from user user to realm DEFAULT

> rlm_realm: Preparing to proxy authentication request to realm "DEFAULT"

> ++[suffix] returns updated

> rlm_eap: No EAP-Message, not doing EAP

> ++[eap] returns noop

> ++[unix] returns notfound

> ++[files] returns noop

> rlm_ldap: - authorize

> rlm_ldap: performing user authorization for user@domain.com

> WARNING: Deprecated conditional expansion ":-". See "man unlang" for details

> expand: (&(objectclass=uosperson)(!(mailuserstatus=inactive))(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectclass=uosperson)(!(mailuserstatus=inactive))(uid=user@domain.com))

> expand: dc=domain,dc=com -> dc=domain,dc=com

> rlm_ldap: ldap_get_conn: Checking Id: 0

> rlm_ldap: ldap_get_conn: Got Id: 0

> rlm_ldap: performing search in dc=domain,dc=com, with filter (&(objectclass=uosperson)(!(mailuserstatus=inactive))(uid=user@domain.com))

> rlm_ldap: object not found or got ambiguous search result

> rlm_ldap: search failed

> rlm_ldap: ldap_release_conn: Release Id: 0

> ++[ldap] returns notfound

> ++[expiration] returns noop

> ++[logintime] returns noop

> ++[pap] returns noop

> Sending Access-Request of id 112 to 194.83.56.233 port 1812

> User-Name = "user@domain.com"

> User-Password = "******"

> NAS-IP-Address = 157.228.68.190

> NAS-Port = 1

> Proxy-State = 0x323136

> Proxying request 1 to home server 194.83.56.233 port 1812

> Sending Access-Request of id 112 to 194.83.56.233 port 1812

> User-Name = "user@domain.com"

> User-Password = "******"

> NAS-IP-Address = 157.228.68.190

> NAS-Port = 1

> Proxy-State = 0x323136

> Going to the next request

> Waking up in 0.9 seconds.

> rad_recv: Access-Accept packet from host 194.83.56.233 port 1812, id=112, length=25

> Proxy-State = 0x323136

> +- entering group post-proxy

> rlm_eap: No pre-existing handler found

> ++[eap] returns noop

> +- entering group authorize

> ++[preprocess] returns ok

> ++[chap] returns noop

> ++[mschap] returns noop

> rlm_realm: Proxy reply, or no User-Name. Ignoring.

> ++[suffix] returns noop

> ++[eap] returns noop

> ++[unix] returns notfound

> ++[files] returns noop

> rlm_ldap: - authorize

> rlm_ldap: performing user authorization for user@domain.com

> WARNING: Deprecated conditional expansion ":-". See "man unlang" for details

> expand: (&(objectclass=uosperson)(!(mailuserstatus=inactive))(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectclass=uosperson)(!(mailuserstatus=inactive))(uid=user@domain.com))

> expand: dc=domain,dc=com -> dc=domain,dc=com

> rlm_ldap: ldap_get_conn: Checking Id: 0

> rlm_ldap: ldap_get_conn: Got Id: 0

> rlm_ldap: performing search in dc=domain,dc=com, with filter (&(objectclass=uosperson)(!(mailuserstatus=inactive))(uid=user@domain.com))

> rlm_ldap: object not found or got ambiguous search result

> rlm_ldap: search failed

> rlm_ldap: ldap_release_conn: Release Id: 0

> ++[ldap] returns notfound

> ++[expiration] returns noop

> ++[logintime] returns noop

> ++[pap] returns noop

> rad_check_password: Found Auth-Type

> rad_check_password: Auth-Type = Accept, accepting the user

> Login OK: [user@domain.com/******] (from client localhost port 1)

> +- entering group post-auth

> ++[exec] returns noop

> Sending Access-Accept of id 216 to 127.0.0.1 port 43386

> Finished request 1.

> Going to the next request

> Waking up in 4.9 seconds.

> Cleaning up request 1 ID 216 with timestamp +10

> Ready to process requests.

How can I stop it from doing this? it is a waste of time and an

unnecessary connection/query to our LDAP server as it is never going to

be authenticated by our LDAP server.

Thanks

Steve

Steven Carr

Systems Development Officer

SLS/ITS/Systems - (0191) 515 3953

-------------- next part --------------

A non-text attachment was scrubbed...

Name: signature.asc

Type: application/pgp-signature

Size: 258 bytes

Desc: OpenPGP digital signature

Url : <https://lists.freeradius.org/pipermail/freeradius-users/attachments/20090810/c3747637/attachment.bin>

------------------------------

Message: 3

Date: Mon, 10 Aug 2009 05:03:07 -0400 (EDT)

From: Sanhenra Sinaga <if06071@students.del.ac.id>

Subject: Mac based authentication

To: freeradius-users@lists.freeradius.org

Message-ID: <1766013.28391249894987160.JavaMail.root@students>

Content-Type: text/plain; charset=utf-8

Dear all,

I'm a new network administrator in one school. I've just installed hotspot using mikrotik and freeradius as radius server. I want to make mac address (client) as username and password for authentication. In this case, i want filtering mac address (calling-station-id) as username and password, so that client can authenticate directly.

Please help me to configure freeradius so that i can implement that i explain before.

Thanks's all

Sanhenra

------------------------------

Message: 4

Date: Mon, 10 Aug 2009 10:34:35 +0100

From: Alan Buxey <A.L.M.Buxey@lboro.ac.uk>

Subject: Re: radius server 2.1.6 not storing data in radacct

table..help

To: FreeRadius users mailing list

<freeradius-users@lists.freeradius.org>

Message-ID: <20090810093435.GA13680@lboro.ac.uk>

Content-Type: text/plain; charset=us-ascii

hi,

fromt he debug looks like its not doing any SQL thing at all -

ie you either havent configured the SQL stuff (uncomment

an 'include' statement in the cofngi to pull in sql.conf

or, because you arent using SQL for authentication/authorization

and only for logging you have to add 'sql' to the instantiate

section so the module gets fired up

alan

------------------------------

Message: 5

Date: Mon, 10 Aug 2009 15:40:12 +0500

From: "Nadir M. Aliyev" <nadir@ultel.net>

To: <freeradius-users@lists.freeradius.org>

Message-ID:

<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAANJZwrxjEZEaUwy61645wl8KAAAAQAAAA623CuuOKtESprsBks9KekQEAAAAA@ultel.net>

Content-Type: text/plain; charset="koi8-r"

Dear All!

Have small problem with radclient.

I use radclient for disconnect users:

"Acct-Session-Id={ACTSESSION}\nUser-Name={MYUSERNAME}\nX-Ascend-Session-Svr-

Key={SESSIONKEY}\nNAS-IP-Address=10.0.5.1" | radclient -x 10.0.5.1:3799

disconnect 123";

Users disconnects well.

But instead of successfull i receive this message:

ad_recv: Disconnect-NAK packet from host 10.0.5.1:3799, id=236, length=47

Reply-Message = "No Matching Session"

Error-Cause = Session-Context-Not-Found

Logs from cisco:

Aug 10 14:29:34 10.0.5.1 360982: 421932: Aug 10 14:26:00.414 AZST: POD:

Received Acct-Session-Id of 0002A89C

Aug 10 14:29:34 10.0.5.1 360983: 421933: Aug 10 14:26:00.414 AZST: POD:

Converted to internal Session-Id of 0002A89C

Aug 10 14:29:34 10.0.5.1 360984: 421934: Aug 10 14:26:00.414 AZST: POD:

10.0.5.2 user nadiritus 0.0.0.0 sessid 0x2A89C key 0x9F282A8D

Aug 10 14:29:34 10.0.5.1 360985: 421935: Aug 10 14:26:00.414 AZST: POD:

Line User IDB Session Id Key

Aug 10 14:29:34 10.0.5.1 360986: 421936: Aug 10 14:26:00.414 AZST: POD: KILL

Virtual- nadiritus 10.0.5.25 0x2A89C 0x9F282A8D

Aug 10 14:29:34 10.0.5.1 360987: 421937: Aug 10 14:26:00.418 AZST: POD:

Added Reply Message: Session Not Removed

Aug 10 14:29:34 10.0.5.1 360988: 421938: Aug 10 14:26:00.418 AZST: POD:

Added NACK Error Cause: Session Context Not Removable

Aug 10 14:29:34 10.0.5.1 360989: 421939: Aug 10 14:26:00.418 AZST: POD:

Sending NAK from port 3799 to 10.0.5.2/54033

Anybody can help me? Why I reveice that session not removed? (but session

removed)

-------------- next part --------------

An HTML attachment was scrubbed...

URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/20090810/025a9e8e/attachment.html>

------------------------------

Message: 6

Date: Mon, 10 Aug 2009 10:51:07 +0100

From: Alan Buxey <A.L.M.Buxey@lboro.ac.uk>

Subject: Re: your mail

To: FreeRadius users mailing list

<freeradius-users@lists.freeradius.org>

Message-ID: <20090810095107.GA13695@lboro.ac.uk>

Content-Type: text/plain; charset=us-ascii

Hi,

> I use radclient for disconnect users:

> "Acct-Session-Id={ACTSESSION}\nUser-Name={MYUSERNAME}\nX-Ascend-Session-Svr-

> Key={SESSIONKEY}\nNAS-IP-Address=10.0.5.1" | radclient -x 10.0.5.1:3799

> disconnect 123";

you're telling the NAS about itself (NAS-IP-Address) - perhaps it doesnt like

that bit and the message you are getting is just its way of saying

that something wasnt quite right. ie try

"Acct-Session-Id={ACTSESSION}\nUser-Name={MYUSERNAME}\nX-Ascend-Session-Svr-Key={SESSIONKEY}" | radclient -x 10.0.5.1:3799

disconnect 123";

alan

------------------------------

List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

End of Freeradius-Users Digest, Vol 52, Issue 48

************************************************