Accounting Packet not sent

[Alan DeKok]

On Feb 16, 2021, at 8:38 AM, Michael Fischer <michael at webfischer.at> wrote:
> My goal is to authenticate WiFi-Users via FreeRadius with an eDirectory
> backend. FreeRadius should then send an accounting packet to a
> FortiGate firewall where a SSO agent is running.

  The server doesn't really originate accounting packets.

> The authentication part is working find, a user can connect to the
> WiFi.
> 
> As far as I understood it, I should configure FreeRadius to write a
> detail file which is then parsed an an accounting package sent to the
> Fortigate firewall.

  Well... maybe.  But you can't write an Access-Accept packet, and have it magically turn into an Accounting-Request packet.

> Reading the detail file seems to work fine, but no accounting package
> is sent to the FortiGate firewall (I even checked using Wireshark). See
> a part of the debug-log here:
> ...
> detail (/var/log/radius/radacct/detail-*): Read packet from
> /var/log/radius/radacct/detail.work
> 	Packet-Type = Access-Accept

  That's not an Accounting packet, is it?

   Further, that packet doesn't contain any normal accounting attributes.

> 	Class = 0x54657374
> 	User-Name = "fimi"
> 	MS-MPPE-Recv-Key =
> 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea
> 	MS-MPPE-Send-Key =
> 0x1120b9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224
> 	EAP-MSK =
> 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea1120b
> 9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224
> 	EAP-EMSK =
> 0xd3a64e1f290603568302a9f6c13c3ae00eaea0f45caeff1503b5609e2faf9b06be114
> 12f1243564b0a08b8df5d58cc33235989699b860f0171b9b73a29bb0e36

  You really don't want to send EAP-MSK and EAP-EMSK over the wire to another system.

  TBH, just run "radclient" for now.  Or, use the Perl / Python modules to send RADIUS packets.  The server isn't really designed to change packet types like this.

  We've fixed all of this in v4, where this goal is pretty much trivial to do.  But we're still a long way from releasing v4.

  Alan DeKok.