Thanks for the response Alan.
I am using DHCP and RADIUS. I was initially using FreeRADIUS for captive portal
user authentication and accounting for a pfsense router (using the DHCP server
built into the pfsense box). The DHCP server on pfsense limits us to only
serving IPs on a singe subnet.
We are now trying to use FreeRADIUS as a DHCP server as well by associating
user accounts with ippools through Pool-Name.
When I run the server in debug mode the Acct-Unique-Session-ID remains the same
across the interim accounting updates. However, re-authentications don't seem
to have a unique key associated with them.
Each time the user is reauthenticated, dhcp_sqlippool.post-auth is triggered
and the script I added is executed. I plan to create a table radippoolinfo that
will store ip pool specific info such as router address, net mask, dns servers,
etc…
In my post-auth policy, I am updating control with the proper pool-name (with
an unlang), changing some other reply attributes, then calling dhcp_sqlippool.
What I am doing doesn't feel right. I am very new to this, does this sound like
the proper way of handling the serving of ip's on multiple subnets.
DHCP-Domain-Name-Server and DHCP-Router-Address will change between pools.
I guess I'm asking if I am approaching this correctly: Using unlang in
policy.conf to handle these rules.
Sorry to put such a long debug message in here. I pulled out one authorization
request, but they all look the same. It looks like
This is what my authorization looks like:
The request comes in with a framed ip of 192.168.0.43, but it tries to serve it
192.168.0.50. It reallocates a new IP for each auth every minute.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
rad_recv: Access-Request packet from host 192.168.1.1 port 7053, id=32,
length=142
NAS-IP-Address = [redacted]
NAS-Identifier = "pfsense.localdomain"
User-Name = "b8:8d:12:10:8d:f6"
User-Password = "[redacted]"
Service-Type = Login-User
NAS-Port-Type = Ethernet
NAS-Port = 30
Framed-IP-Address = 192.168.0.43
Called-Station-Id = "[redacted]"
Calling-Station-Id = "b8:8d:12:10:8d:f6"
Thu Jan 10 23:53:34 2013 : Info: # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
Thu Jan 10 23:53:34 2013 : Info: +- entering group authorize {...}
Thu Jan 10 23:53:34 2013 : Info: ++[preprocess] returns ok
Thu Jan 10 23:53:34 2013 : Info: ++[chap] returns noop
Thu Jan 10 23:53:34 2013 : Info: ++[mschap] returns noop
Thu Jan 10 23:53:34 2013 : Info: ++[digest] returns noop
Thu Jan 10 23:53:34 2013 : Info: [suffix] No '@' in User-Name =
"b8:8d:12:10:8d:f6", looking up realm NULL
Thu Jan 10 23:53:34 2013 : Info: [suffix] No such realm "NULL"
Thu Jan 10 23:53:34 2013 : Info: ++[suffix] returns noop
Thu Jan 10 23:53:34 2013 : Info: [eap] No EAP-Message, not doing EAP
Thu Jan 10 23:53:34 2013 : Info: ++[eap] returns noop
Thu Jan 10 23:53:34 2013 : Info: [files] users: Matched entry DEFAULT at line 93
Thu Jan 10 23:53:34 2013 : Info: ++[files] returns ok
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: %{User-Name} ->
b8:8d:12:10:8d:f6
Thu Jan 10 23:53:34 2013 : Info: [sql] sql_set_user escaped user -->
'b8:8d:12:10:8d:f6'
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 0
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: SELECT id, username, attribute,
value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id -> SELECT id, username, attribute, value, op
FROM radcheck WHERE username = 'b8:8d:12:10:8d:f6' ORDER BY
id
Thu Jan 10 23:53:34 2013 : Info: [sql] User found in radcheck table
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: SELECT id, username, attribute,
value, op FROM radreply WHERE username = '%{SQL-User-Name}'
ORDER BY id -> SELECT id, username, attribute, value, op
FROM radreply WHERE username = 'b8:8d:12:10:8d:f6' ORDER BY
id
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY
priority -> SELECT groupname FROM radusergroup WHERE
username = 'b8:8d:12:10:8d:f6' ORDER BY priority
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Released sql socket id: 0
Thu Jan 10 23:53:34 2013 : Info: ++[sql] returns ok
Thu Jan 10 23:53:34 2013 : Info: ++[expiration] returns noop
Thu Jan 10 23:53:34 2013 : Info: ++[logintime] returns noop
Thu Jan 10 23:53:34 2013 : Info: [pap] WARNING: Auth-Type already set. Not
setting to PAP
Thu Jan 10 23:53:34 2013 : Info: ++[pap] returns noop
Thu Jan 10 23:53:34 2013 : Info: Found Auth-Type = Accept
Thu Jan 10 23:53:34 2013 : Info: Auth-Type = Accept, accepting the user
Thu Jan 10 23:53:34 2013 : Info: # Executing section post-auth from file
/usr/local/etc/raddb/sites-enabled/default
Thu Jan 10 23:53:34 2013 : Info: +- entering group post-auth {...}
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: %{User-Name} ->
b8:8d:12:10:8d:f6
Thu Jan 10 23:53:34 2013 : Info: [sql] sql_set_user escaped user -->
'b8:8d:12:10:8d:f6'
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: %{User-Password} -> [redacted]
Thu Jan 10 23:53:34 2013 : Info: [sql] expand: INSERT INTO radpostauth
(username, pass, reply, authdate)
VALUES ( '%{User-Name}',
'%{%{User-Password}:-%{Chap-Password}}',
'%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES (
'b8:8d:12:10:8d:f6', '[redacted]',
'Access-Accept', '2013-01-10 23:53:34')
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql) in sql_postauth: query is
INSERT INTO radpostauth (username, pass, reply,
authdate) VALUES (
'b8:8d:12:10:8d:f6', '[redacted]',
'Access-Accept', '2013-01-10 23:53:34')
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 4
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Released sql socket id: 4
Thu Jan 10 23:53:34 2013 : Info: ++[sql] returns ok
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 3
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: %{User-Name} ->
b8:8d:12:10:8d:f6
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] sql_set_user escaped user -->
'b8:8d:12:10:8d:f6'
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: START TRANSACTION ->
START TRANSACTION
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: UPDATE radippool SET
nasipaddress = '', pool_key = 0, callingstationid = '', username = '',
expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND
nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '',
pool_key = 0, callingstationid = '', username = '', expiry_time = NULL
WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '[redacted]'
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: SELECT framedipaddress
FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time <
NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'),
(callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR
UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'pfpriv' AND
(expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <>
'b8:8d:12:10:8d:f6'), (callingstationid <> 'b8:8d:12:10:8d:f6'), expiry_time
LIMIT 1 FOR UPDATE
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: UPDATE radippool SET
nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}',
callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}',
expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress =
'192.168.0.50' AND expiry_time IS NULL -> UPDATE radippool SET nasipaddress =
'[redacted]', pool_key = 'b8:8d:12:10:8d:f6', callingstationid =
'b8:8d:12:10:8d:f6', username = 'b8:8d:12:10:8d:f6', expiry_time = NOW() +
INTERVAL 3600 SECOND WHERE framedipaddress = '192.168.0.50' AND expiry_time IS
NULL
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] Allocated IP 192.168.0.50
[3200a8c0]
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: COMMIT -> COMMIT
Thu Jan 10 23:53:34 2013 : Debug: rlm_sql (sql): Released sql socket id: 3
Thu Jan 10 23:53:34 2013 : Info: [sqlippool] expand: Allocated IP:
%{reply:Framed-IP-Address} from %{control:Pool-Name} (did
%{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user
%{User-Name}) -> Allocated IP: 192.168.0.50 from pfpriv (did [redacted] cli
b8:8d:12:10:8d:f6 port 30 user b8:8d:12:10:8d:f6)
Thu Jan 10 23:53:34 2013 : Info: Allocated IP: 192.168.0.50 from pfpriv (did
[redacted] cli b8:8d:12:10:8d:f6 port 30 user b8:8d:12:10:8d:f6)
Thu Jan 10 23:53:34 2013 : Info: ++[sqlippool] returns ok
Thu Jan 10 23:53:34 2013 : Info: ++[exec] returns noop
Sending Access-Accept of id 32 to 192.168.1.1 port 7053
WISPr-Bandwidth-Max-Up := 5000000
WISPr-Bandwidth-Max-Down := 12000000
Framed-IP-Address = 192.168.0.50
Thu Jan 10 23:53:34 2013 : Info: Finished request 10.
Thu Jan 10 23:53:34 2013 : Debug: Going to the next request
Thu Jan 10 23:53:34 2013 : Debug: Waking up in 4.9 seconds.
Thu Jan 10 23:53:39 2013 : Info: Cleaning up request 10 ID 32 with timestamp
+268
Thu Jan 10 23:53:39 2013 : Info: Ready to process requests.
On Jan 11, 2013, at 4:34 PM, Alan DeKok <[email protected]> wrote:
> Ethan Hayon wrote:
>> Hi, I'm trying to set up FreeRADIUS 2.2 to act as an authentication and
>> accounting system as well as a DHCP server. (I'm relaying DHCP requests from
>> a pfSense box).
>
> Are you doing DHCP *and* RADIUS?
>
>> I am trying to use sqlippools on FreeRADIUS, but I have noticed that my
>> ippools are filling up quickly (I am only testing with two devices). I have
>> pfSense configured to reauthenticate user every minute, so I believe that
>> FreeRADIUS is running post-auth dhcp leasing each time the user is
>> reauthenticated. FreeRADIUS is serving the same client a new IP address each
>> minute.
>
> There's no need to "believe" anything. Run the server in debugging
> mode to see exactly what it's doing.
>
> Any IP allocation MUST be done on a key which is unique to each
> device. That key should remain the same across multiple re-authentications.
>
> So... is it? Please check.
>
>> I want to have multiple pools on different subnets. When a new client
>> connects to the network (they don't yet have a radius account) they are sent
>> to a default (pending) pool. This may be on the 192.168.1/24 subnet. After
>> they have set up their account and have been added to the RADIUS database,
>> they will be given a pool-name, maybe `pool2`. `pool2` will be on a
>> different subnet, for example, 192168.2/24. The pfsense box knows how to
>> route these subnets, so that is not a problem. I only want clients to
>> receive a different IP address if their pool-name changes for whatever
>> reason, if there are no changes to their account, they shouldn't be leased a
>> new IP every time they reauthenticate (every minute).
>
> This is what databases are for. If you want to map each client to a
> pool, you'll need a table with a "client identifier" column, and a
> "pool-name" column. Then, assign IPs based on the pool name, as looked
> up in the table.
>
>> Am I approaching this problem correctly? I have written some un-lang in the
>> policy.conf file for handling some of this. I am getting hung up on this
>> problem. The pool is getting exhausted in minutes since each client is
>> leased a new ip every minute.
>
> Solve that problem first. Run the server in debugging mode to see
> *why* it's assigning a new IP.
>
> Alan DeKok.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
