I was wondering if you could help use with our eduroam setup at the University of Huddersfield? We have set up Freeradius on Ubuntu 14.04 LTS but having trouble to get it to generating authorization logs for our 'eduroam' virtual server. It is generating logs ok for the default and inner-tunnel but not eduroam. I have checked and re-checked the configuration with no result. /etc/freeradius/radius.conf log section looks like this: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct log { destination = files file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log ... } And in our eduroam file in sites-available (with link file in sites-enabled) has 'auth_log' enabled to in the authorize section. It should create logs called radiusd-eduroam-20151217.log but nothing is being created. Logs are a requirement for a valid eduroam setup and this is the last thing needed before we can switch over to the new servers. Any ideas why the log isn't being generated when users connect to it? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.
Hi, On Mon, Jan 04, 2016 at 03:45:25PM +0000, Peter Hutchison wrote:
We have set up Freeradius on Ubuntu 14.04 LTS but having trouble to get it to generating authorization logs for our 'eduroam' virtual server.
What does this virtual server do / when is it called? Do you call the linelog or detail modules in any of its sections?
It is generating logs ok for the default and inner-tunnel but not eduroam. I have checked and re-checked the configuration with no result.
You need to look at the debug output. On ubuntu run it as "freeradius -X" and examine the output then authenticate something you expect to get logs for.
/etc/freeradius/radius.conf log section looks like this:
Mostly not useful - you really want linelog or detail, not the main server logging.
And in our eduroam file in sites-available (with link file in sites-enabled) has 'auth_log' enabled to in the authorize section.
Any ideas why the log isn't being generated when users connect to it?
Check -X debug output. Send the debug here if it doesn't make sense, though it's fairly straightforward to read (if verbose). Right from the FreeRADIUS banner at the top and including an authentication packet. A small suspicion is that you might need to put logging in pre/post-proxy sections if you're trying to log non-local auths. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi, TBH, iu cant recall if expansions work for that secion in radiusd.conf - if theres a quirky bug it wont get fixed in 2.1.12 but for logging there are 2 ways that do work....and should work fine 1) use the 'detail' module 2) use linelog for the details module - i think you are using this(!) ? you should be looking at modules/detail.log file - as thats the file that is actuslly used for auth_log et al and if %{Virtual-Server} expansion doesnt work there - easy, just create a new detail entry eg eduroam_auth_log and call that instead of auth_log in relevant section of the virtual server - and do the same for the other calls to log functions eg detail eduroam_auth_log { detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d detailperm = 0600 suppress { User-Password EAP-MSK EAP-EMSK EAP-Message MS-MPPE-Recv-Key MS-MPPE-Send-Key MS-MPPE-Encryption-Policy MS-MPPE-Encryption-Types } } ..for linelog, simply look at the modules/linelog file and configure as required....or make a new one eg linelog eduroam-linelog { <put config here!> } and then call linelog in relevant place to capture required bits - linelog is generally better as the output can be nicely customised to contain exactly the stuff needed in format needed... obviously there are many other methods - eg using the buffered-sql virtual server and copying detail output asynchronously to an SQL server so you have logs in database format (great for searching) some of this may only be applicable to 2.2.x - but thats what you should be running as a minimum these days (and even that is around end of support time) alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Matthew Newton -
Peter Hutchison