by  LMS8000 / LMS4000WaveRider LMS RADIUS Integration:      FreeRADIUS and MySQL*                               tn068F    ...
RELEASE 1.6.2, September 2008Proprietary to Vecima Networks Inc.© by Vecima Networks Inc., 2008Permission to ReproduceExce...
Preface         Conventions         The following conventions are used throughout this document:                   Replac...
ContentsPreface .............................................................................................................
1                Introduction         This technical note presents step-by-step configuration and examples for installing ...
2                 Installation          Following the steps below to install the latest version of FreeRADIUS.         i. ...
3                Configuration3.1 CCU3000 / CCU3100 / CCU8000         The following example configures the CCU RADIUS clie...
v. Enable RADIUS accounting†*:                  64:08:05*CCU> auth rad acc stopstart         vi. Change the RADIUS client ...
…                                          }          }          accounting {                               users         ...
…                                       #[tab]… WaveRider-Grade-of-Service = gold,          #files                        ...
admin@ubuntu-server:~# mysql –uadmin –padmin123 radius <                        /home/admin/freeradius-[version]/[path]/my...
xii. Populate the ‘radgroupreply’ table with the applicable WaveRider VSAs, grouping by package type (note              se...
4               Implementation          Follow the steps below to initiate RADIUS operation (examples shown for FreeRADIUS...
rlm_sql (sql): Connected new DB handle, #4             Module: Instantiated sql (sql)             Module: Loaded Acct-Uniq...
Accounting stop/start or update messages will also appear (if accounting is configured on the CCU):             rad_recv: ...
5                Administration         How the network or systems administrator chooses to monitor and operate his or her...
Edit existing attribute values in a particular group (ie. ‘home_standard’ group, max custs):                 mysql> update...
In Nano, type the following cron instructions (one line entry):         @daily mysql radius –e “delete from radacct where ...
6        ResourcesWaveRider by Vecima Support:        http://www.wr.vecimasupport.comFreeRADIUS web site:              htt...
7        Appendix          Attribute Name                                Tag      Accepted Value(s)          WaveRider-Gra...
byhttp://www.wr.vecimasupport.com
Upcoming SlideShare
Loading in …5
×

Tn068 f -_freeradius_and_mysql_linux_configuration_v1.6.2

584 views

Published on

  • Be the first to comment

  • Be the first to like this

Tn068 f -_freeradius_and_mysql_linux_configuration_v1.6.2

  1. 1. by LMS8000 / LMS4000WaveRider LMS RADIUS Integration: FreeRADIUS and MySQL* tn068F *Part of the “WaveRider Free Solutions” series of articles
  2. 2. RELEASE 1.6.2, September 2008Proprietary to Vecima Networks Inc.© by Vecima Networks Inc., 2008Permission to ReproduceExcept as otherwise specifically noted, the information in thispublication may be reproduced, in part or in whole and by anymeans, without charge or further permission from VecimaNetworks Inc., provided that due diligence is exercised inensuring the accuracy of the information reproduced; thatVecima Networks Inc. is identified as the source; and that thereproduction is not represented as an official version of theinformation reproduced.This publication is also available electronically on the WorldWide Web at the following address:www.wr.vecimasupport.comVecima Networks Inc. reserves the right to revise thispublication and to make changes in content from time to timewithout obligation on the part of Vecima Networks Inc. toprovide notification of such revision or change.Vecima Networks Inc. provides this guide without warranty ofany kind, either implied or expressed, including, but notlimited to, the implied warranties of merchantability andfitness for a particular purpose. Vecima Networks Inc. maymake improvements or changes in the product(s) describedin this manual at any time.Specifications subject to change without notice.
  3. 3. Preface Conventions The following conventions are used throughout this document:  Replace existing text or enter exact text that is highlighted in bold  System prompts and/or pre-existing configuration file text are non-stylized, normal font  Special characters/instructions are italic  Emphatic terms and words are red  Continuation of configuration file text or special characters is indicated with “…”  Values surrounded by square brackets ( [ ] ) are variable (ie. EUM ID) CAUTION: Whenever you see this icon and heading, the associated text discusses an issue, which, if not followed, could result in damage to, or improper use of, the equipment or software. TIP: Whenever you see this icon and heading, the associated text provides a tip for facilitating the installation, testing, or operation of the equipment or software. Getting Support An extensive knowledge base is available at http://www.wr.vecimasupport.com. Visit the web page to:  Get the latest announcements from Vecima Networks.  Download product related software, manuals, application notes, or other information about the WaveRider product line.  Consult the KnowledgeBase for troubleshooting information.  Register and contact technical support to help you with unexpected problems. Training Vecima offers a complete training program. Please contact you sales representative for training information. Priority support Vecima also offers priority telephone and email support. Please contact your sales representative for details.tn068F i
  4. 4. ContentsPreface ..................................................................................................................................................................................... i1 Introduction .................................................................................................................................................................... 1 1.1 Detailed Tasks ........................................................................................................................................................... 1 1.2 Network Diagram ....................................................................................................................................................... 12 Installation ....................................................................................................................................................................... 23 Configuration................................................................................................................................................................... 3 3.1 CCU3000 / CCU3100 / CCU8000.............................................................................................................................. 3 3.2 FreeRADIUS .............................................................................................................................................................. 4 3.2.1 Static File Authentication................................................................................................................................... 4 3.2.2 MySQL............................................................................................................................................................... 54 Implementation ............................................................................................................................................................... 95 Administration ............................................................................................................................................................... 12 5.1 MySQL ..................................................................................................................................................................... 12 5.2 Monitoring................................................................................................................................................................. 13 5.2.1 FreeRADIUS log files (static files method)...................................................................................................... 13 5.2.2 MySQL............................................................................................................................................................. 136 Resources ...................................................................................................................................................................... 157 Appendix ........................................................................................................................................................................ 16TablesTable 1: FreeRADIUS Default File Locations ......................................................................................................................... 4Table 2: Static files method FreeRADIUS configuration......................................................................................................... 5Table 3: MySQL method FreeRADIUS configuration ............................................................................................................. 6Table 4: WaveRider Vendor-Specific Attributes.................................................................................................................... 16FiguresFigure 1: System Topology Example ...................................................................................................................................... 1tn068F
  5. 5. 1 Introduction This technical note presents step-by-step configuration and examples for installing and configuring a Linux (Ubuntu Edgy Eft v6.10) installation of FreeRADIUS (v1.1.3) using either the static configuration files included with the software, or a MySQL (v5.0.41) database. Implementation, administration and monitoring of FreeRADIUS and MySQL is also addressed. Once successfully installed and configured, the system will allow FreeRADIUS to update the CCU3000, CCU3100 or CCU8000 authorization tables, thus allowing auto-configuration of the EUMs, as well as accumulate RADIUS accounting statistics. The configuration examples detailed in this document were not designed or intended to work in every WaveRider® LMS deployment. It is understood that systems and/or network administrators customize the configurations to best suit the topology and needs of their own deployment requirements. It is highly recommended that the administrator following these examples possesses a solid understanding of Linux fundamentals in order to take the necessary precautions towards securing the configured system. Vecima’s WaveRider AES does not support or troubleshoot the Linux operating system.1.1 Detailed Tasks 1. Configure WaveRider® CCU3000, CCU3100 or CCU8000 RADIUS client 2. Download and install FreeRADIUS and MySQL 3. Configure FreeRADIUS a) static file authentication method b) MySQL authentication method 4. Create, log in to, and populate MySQL database 5. Start the FreeRADIUS server daemon 6. Administrate and monitor FreeRADIUS implementation1.2 Network Diagram Figure 1: System Topology Exampletn068F 1
  6. 6. 2 Installation Following the steps below to install the latest version of FreeRADIUS. i. Download and install FreeRADIUS using either the Synaptics Package Manager (GUI) or manually via ftp://ftp.freeradius.org/pub/radius or by simply typing “sudo apt-get install freeradius” and “sudo apt-get install freeradius-mysql” (if the SQL authorization method is to be used) in a terminal window. Manual download/install  tar xvf freeradius.tar.gz  cd freeradius  ./configure  make  make install Package Manager download/install  freeradius (‘A high performance and highly configurable RADIUS server’)  freeradius-mysql (‘MySQL module for FreeRADIUS server’) The FreeRADIUS tarball must be downloaded and extracted to retrieve the MySQL database schema for later use: http://freeradius.org/getting.html. Check the release notes or search the extracted files for the mysql.sql schema template file. ii. Download and install MySQL and its associated modules by using either the Synaptics Package Manager (GUI) or manually by simply typing the following commands in a terminal window: sudo apt-get install mysql-server sudo apt-get install mysql-server-5.0 sudo apt-get install mysql-client-5.0 sudo apt-get install mysql-client sudo apt-get install mysql-common Manual download/install  tar xvf mysql.tar.gz  cd mysql  ./configure  make  make install Package Manager download/install Required:  mysql-server-5.0 (mysql database server binaries)  mysql-server (mysql database server current version)  mysql-client-5.0 (mysql database client binaries)  mysql-client (mysql database client current version)  mysql-common (mysql database common files (e.g. /etc/mysql/my.cnf) Optional:  mysql-query-browser-common (Architecture independent files for MySQL Query Browser)  mysql-query-browser (Official GUI tool to query MySQL database)  mysql-navigator (GUI client program for MySQL database server)  mysql-admin-common (Architecture independent files for MySQL Administrator)  mysql-admin (GUI tool for intuitive MySQL administration)tn068F 2
  7. 7. 3 Configuration3.1 CCU3000 / CCU3100 / CCU8000 The following example configures the CCU RADIUS client with a primary and secondary RADIUS server with a shared secret, enables and sets the accounting method to stop/start, sets the client request period to 5 minutes, and enables the RADIUS client. All configuration commands are required unless otherwise indicated (†). i. Access the CLI using telnet via the local link or operator-configured static IP. ii. Verify CCU can ping the RADIUS servers: 64:08:05*CCU> ping 192.168.1.254 Press any key to stop...PING 192.168.1.154: 56 data bytes, 490 ms interval (accurate to +- 5 ms) 64 bytes from 192.168.1.254: icmp_seq=0. time=15 ms 64 bytes from 192.168.1.254: icmp_seq=1. time=5 ms 64 bytes from 192.168.1.254: icmp_seq=2. time=5 ms 64 bytes from 192.168.1.254: icmp_seq=3. time=5 ms 64 bytes from 192.168.1.254: icmp_seq=4. time=5 ms ----192.168.1.254 PING Statistics---- 5 packets transmitted, 5 packets received, 0% packet loss round-trip (ms) min/avg/max = 5/7/15 64:08:05*CCU> ping 192.168.1.253 Press any key to stop...PING 192.168.1.253: 56 data bytes, 490 ms interval (accurate to +- 5 ms) 64 bytes from 192.168.1.253: icmp_seq=0. time=15 ms 64 bytes from 192.168.1.253: icmp_seq=1. time=5 ms 64 bytes from 192.168.1.253: icmp_seq=2. time=5 ms 64 bytes from 192.168.1.253: icmp_seq=3. time=5 ms 64 bytes from 192.168.1.253: icmp_seq=4. time=5 ms ----192.168.1.253 PING Statistics---- 5 packets transmitted, 5 packets received, 0% packet loss round-trip (ms) min/avg/max = 5/7/15 iii. Configure the primary RADIUS server IP and shared secret: 64:08:05*CCU> auth rad pri 192.168.1.254 Enter password (up to 16 chars): waverider123 The shared secret (‘password’ shown above) can be any 1-16 alpha-numeric value. The secret configured on the CCU RADIUS client and on the RADIUS server must match. See the ‘clients.conf’ file configuration in section 3.2.1 and 3.2.2. iv. Configure the secondary RADIUS server IP†: 64:08:05*CCU> auth rad sec 192.168.1.253 Enter password (up to 16 chars): waverider123tn068F 3
  8. 8. v. Enable RADIUS accounting†*: 64:08:05*CCU> auth rad acc stopstart vi. Change the RADIUS client request period† (default = 60 minutes): 64:08:05*CCU> auth rad per 5 vii. Enable the RADIUS client: 64:08:05*CCU> auth rad enable * Refer to section 5.4 of the WaveRider ‘Managing the Network’ guide (lms052_ap_01) for more detail on the start/stop and update RADIUS accounting modes. † Optional configuration.3.2 FreeRADIUS FreeRADIUS may be configured to use either a static file (the ‘users’ file) OR an SQL database with which to authorize EUMs. The database configuration example below uses the popular MySQL platform. 3.2.1 Static File Authentication Using the static ‘users’ file, the network administrator can control RADIUS authentication directly. EUMs (users) are added by their EUM IDs in the ‘users’ configuration file in paragraph form. Each subsequent paragraph entry can be copied and pasted at the end of the file, editing only each EUM ID and its applicable attribute values. Configuration files may be edited using Vi (command line – Linux server installation) or a Linux text editor (via KDE or GNOME GUI). Using the ‘users’ file for authorization is most efficient on the server system’s resources. However, it has more administrative overhead as changes need to be tracked and performed manually and is therefore not well suited for front-office business reference functions such as customer billing, location, etc. Also, the operator is limited to using only the RADIUS-related fields defined in the dictionary file. Configuration File or Folder Default Path radiusd.conf /etc/freeradius logdir /var/log/freeradius raddbdir /etc/freeradius radacctdir /var/log/freeradius/radacct log_file /var/log/radius.log libdir /usr/lib/freeradius pidfile ${run_dir}/freeradius.pid clients.conf /etc/freeradius users.conf /etc/freeradius Table 1: FreeRADIUS Default File Locations The following example instructs FreeRADIUS to use the static file authorization and accounting method (radiusd.conf), adds the primary and secondary CCU RADIUS clients to the clients.conf file with IP address, shared secret and short name, adds two (2) EUMs to the users file that defines the GOS (grade of service) to be used for each, and sets the maximum number of customers (hosts) that can access the radio link through each EUM. radiusd.conf clients.conf log_stripped_names = yes client 192.168.1.254 { log_auth = yes [tab]… secret [tab]… = waverider123 log_auth_badpass = yes [tab]… shortname [tab]… = CCU1 log_auth_goodpass = yes } authorize { client 192.168.1.253 { … [tab]… secret [tab]…… = waverider123 files [tab]… shortname [tab]… = CCU2tn068F 4
  9. 9. … } } accounting { users … detail 61:1e:1c[tab]… Auth-Type := Local, User-Password == sql_log buywavc [tab]… WaveRider-Grade-of-Service = bronze, … [tab]… WaveRider-Max-Customers = 1 } 61:1a:87[tab]… Auth-Type := Local, User-Password == buywavc [tab]… WaveRider-Grade-of-Service = gold, [tab]… WaveRider-Max-Customers = 3 Table 2: Static files method FreeRADIUS configuration The ‘User-password’ is not to be confused with the shared secret as configured on the CCU RADIUS client in section 3.1 and in the ‘clients.conf’ file in sections 3.2.1 and 3.2.2. The ‘User-Password’’ value for each user entry must be ‘buywavc’ (all lowercase). This value is hard-coded for every RADIUS request and has nothing to do with the EUM password. Download the WaveRider dictionary file from http://www.wr.vecimasupport.com and install it in the /usr/share/freeradius/ directory on the Linux system. Be sure to periodically check back for new releases of this file. 3.2.2 MySQL To use a database, comment out entries in the users file and update radiusd.conf as shown below. The ‘sql.conf’ file (/etc/freeradius/sql.conf) is edited to include the server name (remote or local; DNS may be used) and database login credentials. The ‘radiusd.conf’ file is edited to indicate that an SQL database will provide the authorization data. This method of operation, although slightly more taxing on the server system’s resources, is a much more robust way to add, edit, delete and query user records, as well as monitor RADIUS activity. As well, the SQL table schema can be modified to suit the operator’s purposes. For example, in addition to the three required authorization fields (username, password, grade of service), the operator may also choose to include an unlimited number of front-office business function fields such as CAP site name, customer name, address, area, etc. This allows for quick and efficient querying of data to extract useful information or make changes to a specific user record. The scalability of this method is limited only by operator’s understanding of SQL, business model and/or imagination. For instance, the database may be integrated with a front-office financial accounting system (e.g. .NET, ASP or other web-based application) to allow a single point of entry for customer data, thus avoiding data entry duplication errors. The following example changes the radiusd.conf file from the static authorization and accounting method (configured in section 3.2.1) to the SQL method. The EUMs will no longer be authenticated and configured using the instructions in the users file. A ‘#’ character is placed at the beginning of each of the entry’s lines to instruct FreeRADIUS to ignore them. The sql.conf file is configured to specify the server location (‘localhost’ = this server) database to connect to, and the Linux user account and password used to connect. radiusd.conf users log_stripped_names = #61:1e:1c[tab]… Auth-Type := Local, User-Password == yes buywavc log_auth = yes #[tab]… WaveRider-Grade-of-Service = bronze, log_auth_badpass = yes #[tab]… WaveRider-Max-Customers = 1 log_auth_goodpass = yes #61:1a:87[tab]… Auth-Type := Local, User-Password == authorize { buywavctn068F 5
  10. 10. … #[tab]… WaveRider-Grade-of-Service = gold, #files #[tab]… WaveRider-Max-Customers = 3 sql … } sql.conf accounting { sql { … … detail server = “localhost” #sql_log login = “admin” sql password = “admin123” … … } radius_db = “radius” … } Table 3: MySQL method FreeRADIUS configuration ‘Server’, ‘login’, ‘password’ values in sql.conf may vary. To ensure functionality, verify the Linux user account used to access the MySQL DB has the appropriate permissions to access and write to the associated tables. The ‘radius_db’ value can be any name, as defined during the creation of the MySQL DB (see below). The table structure in the following example groups EUMs by the GOS attribute value. The method the network or systems administrator will use to group the RADIUS profiles, attributes and users in the SQL tables will depend entirely on the topology of the LMS and management systems in use as well as business and customer service requirements. Refer to section 5.4 of the ‘Managing the Network’ user guide (lms052_ap_01) for available WaveRider attributes and their definitions. The following commands create the ‘radius’ SQL database, assigns all privileges to the ‘admin’ Linux user account, imports the FreeRADIUS schema, and populates the tables with appropriate data. i. Extract the freeradius.tar.gz installation package to the admin user’s home directory: admin@ubuntu-server:~# tar –zxvf freeradius_[version].tar.gz –C /home/admin ii. Login to the MySQL client: admin@ubuntu-server:~# mysql iii. Create the database: mysql> create database radius; iv. Switch focus to the new ‘radius’ database: mysql> use radius v. Grant all permissions to the database for the ‘admin’ Linux user account and exit the MySQL client: mysql> grant all on radius to admin@ubuntu-server; mysql> quit vi. Import the table structure (from the schema template file extracted in step i.) that FreeRADIUS will use to authenticate and authorize WaveRider EUMs:tn068F 6
  11. 11. admin@ubuntu-server:~# mysql –uadmin –padmin123 radius < /home/admin/freeradius-[version]/[path]/mysql.sql vii. Log into the MySQL client and the ‘radius’ database as the admin Linux user: admin@ubuntu-server:~# mysql –uadmin –padmin123 radius viii. Verify the tables have been successfully created in the database: mysql> show tables; +------------------+ | Tables_in_radius | +------------------+ | nas | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | usergroup | +------------------+ 8 rows in set (0.00 sec) ix. Due to a number of the WaveRider vendor-specific attributes (VSA) being longer than the ‘radreply’ and ‘radgroupreply’ tables’ attribute fields’ default 32 characters in length, modify each to allow 50 characters: mysql> alter table radreply modify attribute varchar(50); Query OK, 0 rows affected (0.05 sec) Records: 0 Duplicates: 0 Warnings: 0 mysql> alter table radgroupreply modify attribute varchar(50); Query OK, 0 rows affected (0.05 sec) Records: 0 Duplicates: 0 Warnings: 0 x. Create the valid package type (ie. GOS) groups: mysql> insert into radgroupcheck values (‘’,’home_lite’,’Auth- Type’,’:=’,’Local’); Query OK, 1 row affected mysql> insert into radgroupcheck values (‘’,’home_lite’,’Password’,’==’,’buywavc’); Query OK, 1 row affected mysql> insert into radgroupcheck values (‘’,’home_standard’,’Auth- Type’,’:=’,’Local’); Query OK, 1 row affected mysql> insert into radgroupcheck values (‘’,’home_standard’,’Password’,’:=’,’buywavc’); Query OK, 1 row affected xi. Create the ‘denied’ group: mysql> insert into radgroupcheck values (‘’,’denied’,’Auth- Type’,’:=’,’denied’); Query OK, 1 row affectedtn068F 7
  12. 12. xii. Populate the ‘radgroupreply’ table with the applicable WaveRider VSAs, grouping by package type (note second column is the ‘groupname’ field – value is operator’s choice and should be descriptive): mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Grade-of- Service’,’:=’,’silver’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Current- Password’,’:=’,’[EUM_password]’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Max- Customers’,’:=’,’5’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Priority- Enabled’,’:=’,’enabled’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_standard’,’WaveRider-Grade- of-Service’,’:=’,’gold’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Current- Password’,’:=’,’[EUM_password]’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_standard’,’WaveRider-Max- Customers’,’:=’,’5’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_standard’,’WaveRider- Priority-Enabled’,’:=’,’enabled’); Query OK, 1 row affected The ‘WaveRider-Current-Password’ and correct value must be included when changing WaveRider VSA values such as ‘WaveRider-SNMP-Contact’. It is therefore recommended that all EUMs in each group share the same password. xiii. Assign users (EUM IDs) to the groups created in step x and xi by populating the ‘usergroup’ table: mysql> insert into usergroup values (’61:1c:1e’,’home_lite’); Query OK, 1 row affected mysql> insert into usergroup values (’61:1a:87’,’home_standard’); Query OK, 1 row affected mysql> insert into usergroup values (’64:be:66’,’denied’); Query OK, 1 row affected ...tn068F 8
  13. 13. 4 Implementation Follow the steps below to initiate RADIUS operation (examples shown for FreeRADIUS configured with MySQL). i. Start the FreeRADIUS server daemon in “single server” (-s), foreground process (-f) and debug mode (-x) (visible transactions): admin@ubuntu-server:~# freeradius –sfx The FreeRadius daemon program will execute and configure itself using the values configured within the files edited in Table 1 or Table 2. If no errors occur, the CLI output should end with ‘Ready to process requests’, similar to the following: admin@ubuntu-testlab:~# freeradius -sfx Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to admin@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4tn068F 9
  14. 14. rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ii. Power on the EUM corresponding to the username (ie. EUM ID) entered into the usergroup table of the radius database, or force a deregistration of the EUM using the CCU command ‘air fdereg [eum_id]’ if it is already registered with the CCU. Check the CCU’s authorization table to verify the EUM’s authentication type (‘radius’). If ‘static’ is displayed, a static entry exists on the CCU. If desired, use the CCU command <auth del [eumid]> to delete the static entry and allow the EUM to register via RADIUS. iii. The CCU will immediately send an access-request to the RADIUS server on behalf of the EUM, which in turn will display the authorization request details in the Linux terminal window or CLI process. For example: rad_recv: Access-Request packet from host 192.168.1.254:1025, id=23, length=60 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 User-Password = "buywavc" rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): User 61:1c:1e not found in radcheck rlm_sql (sql): Released sql socket id: 0 Login OK: [61:1c:1e/buywavc] (from client CCU1 port 1) Sending Access-Accept of id 23 to 192.168.1.254 port 1025 WaveRider-Grade-of-Service := silver WaveRider-Max-Customers := 30 WaveRider-Priority-Enabled := disabled WaveRider-SNMP-Location := "Toronto" WaveRider-Downlink-Min-Modulation := CCK2 WaveRider-Downlink-Max-Modulation := 64Q2 WaveRider-Uplink-Min-Modulation := CCK2 WaveRider-Uplink-Max-Modulation := 64Q2 Pay particular attention to the ‘Access-Accept’ and/or ‘Access-Reject’ messages in the Linux CLI. If an EUM is incorrectly rejected, the EUM ID may have been erroneously entered into the ‘usergroup’ table of the ‘radius’ database.tn068F 10
  15. 15. Accounting stop/start or update messages will also appear (if accounting is configured on the CCU): rad_recv: Accounting-Request packet from host 192.168.1.254:1025, id=180, length=82 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 Acct-Status-Type = Stop Acct-Session-Id = "f4f40004" Acct-Input-Octets = 1653 Acct-Input-Packets = 24 Acct-Output-Octets = 1722 Acct-Output-Packets = 26 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 Sending Accounting-Response of id 180 to 192.168.1.254 port 1025 rad_recv: Accounting-Request packet from host 192.168.1.254:1025, id=179, length=58 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 Acct-Status-Type = Start Acct-Session-Id = "f4f40004" rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 Sending Accounting-Response of id 179 to 192.168.1.254 port 1025 rad_recv: Accounting-Request packet from host 192.168.1.254:1025, id=174, length=82 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 Acct-Status-Type = Interim-Update Acct-Session-Id = "f4f40001" Acct-Input-Octets = 352176697 Acct-Input-Packets = 6658474 Acct-Output-Octets = 1827342061 Acct-Output-Packets = 2615193 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 Sending Accounting-Response of id 174 to 192.168.1.254 port 1025 iv. Verify that accounting messages are being stored in the MySQL database. A number of records should appear containing the username (EUM ID), RADIUS client IP address and date/time stamps for both accounting stop and start messages: admin@ubuntu-server:~# mysql –uadmin –padmin123 radius mysql> select username, nasipaddress, acctstarttime, acctstoptime from radacct; +----------+---------------+---------------------+---------------------+ | username | nasipaddress | acctstarttime | acctstoptime | +----------+---------------+---------------------+---------------------+ | 61:1c:1e | 192.168.1.254 | 2008-05-16 11:13:10 | 2008-05-16 11:19:48 | | 61:1c:1e | 192.168.1.254 | 2008-05-16 11:19:48 | 2008-05-16 11:26:25 | | 61:1a:87 | 192.168.1.254 | 2008-05-16 11:26:25 | 2008-05-16 11:33:02 | +----------+---------------+---------------------+---------------------+ 3 rows in set (0.00 sec)tn068F 11
  16. 16. 5 Administration How the network or systems administrator chooses to monitor and operate his or her RADIUS is a matter of preference of the available tools and whether or not the Linux server was installed with a graphical user interface (GUI). Both FreeRADIUS and MySQL applications may be administrated using CLI commands or with the graphic client tools (ie. MySQL Query Browser) provided by the FreeRADIUS and MySQL software. The following examples use the CLI method of administration. The following are examples of SQL queries used to perform various administrative tasks such as adding new subscriber units to the RADIUS system, changing a user’s group membership, removing a user, troubleshooting, etc. The examples serve as a starting point; it is beneficial that the administrator possess a fundamental understanding of database structure and SQL syntax to be able extract detailed information using more complex queries. Attribute value changes, or additions or deletions of EUM records in RADIUS will not take effect until the CCU’s RADIUS client’s update period has cycled OR the <air flush>, <air fdereg [EUM_ID]> is performed on the CCU, OR the EUM is reset or power cycled.5.1 MySQLUse the following commands to perform routine administration including adding a new user, editing an existing user,changing a customer’s service level (ie. bronze to gold), etc. Add a new EUM (ie. 61:1c:1e) by assigning it to a group (ie. ‘home_standard): mysql> insert into usergroup values (’61:1c:1e’,’home_standard’); Disable EUM communication by assigning it to the ‘denied’ group: mysql> insert into usergroup values (’61:1c:1e’,’denied’); Change an EUM’s group membership (ie. to ‘home_standard’): mysql> update usergroup set groupname=’home_standard’ where username=’61:1c:1e’; Remove an existing EUM: mysql> delete from usergroup where username=’61:1c:1e’; View all EUMs by name or group: mysql> select * from usergroup order by [username|groupname]; Add attributes to a particular group. This example adds the SNMP location ‘Toronto’ to the ‘home_standard’ group: mysql> insert into radgroupreply set values (‘’,’home_standard’,’WaveRider-SNMP-Contact]’,’:=’,‘Toronto’);tn068F 12
  17. 17. Edit existing attribute values in a particular group (ie. ‘home_standard’ group, max custs): mysql> update radgroupreply set value=‘10’ where groupname=’home_standard’ and attribute=’WaveRider-Max-Customers’; Remove entire group (ie. ‘home_standard’): mysql> delete from radgroupreply where groupname=’home_standard’;5.2 Monitoring 5.2.1 FreeRADIUS log files (static files method) Authorization: FreeRADIUS will log authorization attempts as long as the ‘log_auth = yes’ entry is included in the ‘radiusd.conf’ file. The operator will become accustomed to checking the ‘radius.log’ log file on a regular basis to ensure RADIUS authorization is occurring as expected. The default location of this file upon installation is ‘/var/log/freeradius’. The file contents are plain-text searchable. Accounting: The accounting logs are located by default in the ‘/var/log/freeradius/radacct’ directory. FreeRADIUS automatically creates subdirectories grouped by RADIUS client IP address and date. Update (interim-update), stop and start RADIUS accounting messages are appended to each file, rolling over to a new file in tandem with the system clock. Each paragraph-formatted entry is time-stamped (e.g. weekday month day hh:mm:ss yyyy) with useful tracking and troubleshooting information. The file contents are plain-text searchable. 5.2.2 MySQL View accounting stop or start records by EUM (ie. 61:1c:1e): mysql> select acctstarttime|acctstoptime from radacct where username=’61:1c:1e’; View accounting stop or start records by RADIUS client (CCU IP, ie. 192.168.1.254): mysql> select acctstarttime|acctstoptime, username from radacct where nasipaddress=’192.168.1.254’; View accounting stop or start records by time period (ie. May 26 to May 28, 2007): mysql> select acctstarttime|acctstoptime, username from radacct where acctstarttime|acctstoptime >= ’2007-05-26’ and acctstarttime|acctstoptime <= ‘2007-05-28’; To prevent the ‘radacct’ table from becoming unmanageably large, and thus having an adverse effect on system performance, a cron job should be scheduled to automatically delete old records. The following example creates and schedules a crontab file that deletes all records with an accounting stop time (‘acctstoptime’) older than one month from the ‘radius’ SQL database. The process is executed daily (‘@daily’) at midnight. Also, the default cron job’s user email notification is disabled (‘>/dev/null 2>&1’): Open the crontab editor (Nano): admin@ubuntu-server:~# crontab –etn068F 13
  18. 18. In Nano, type the following cron instructions (one line entry): @daily mysql radius –e “delete from radacct where acctstoptime < date_sub(curdate(), interval 30 day)” >/dev/null 2>&1 Exit and save the crontab file: Ctrl-x Save modified buffer (ANSWERING “No” WILL DESTROY CHANGES) ? y File Name to Write: /tmp/crontab.~/crontab [enter] crontab: installing new crontabtn068F 14
  19. 19. 6 ResourcesWaveRider by Vecima Support: http://www.wr.vecimasupport.comFreeRADIUS web site: http://www.freeradius.org/FreeRADIUS man pages: http://www.penguin-soft.com/penguin/man/8/freeradius.htmlFreeRADIUS Configuration example: http://www.frontios.com/freeradius.htmlMySQL web site: http://www.mysql.com/MySQL tutorial: http://dev.mysql.com/doc/refman/5.0/en/tutorial.htmlMySQL statement syntax: http://dev.mysql.com/doc/refman/5.0/en/sql-syntax.htmlUbuntu cron help: https://help.ubuntu.com/community/CronHowtoCrontab how-to: http://crunchbang.org/archives/2007/10/26/howto-setup-a-crontab-file/tn068F 15
  20. 20. 7 Appendix Attribute Name Tag Accepted Value(s) WaveRider-Grade-of-Service 1 ‘be’, ‘bronze’, ‘silver’, ‘gold’ WaveRider-Priority-Enabled 2 ‘disabled’, ‘enabled’ WaveRider-Authentication-Key 3 [User-defined] (reserved) 4 N/A WaveRider-Current-Password 5 [User-defined] WaveRider-New-Password 6 [User-defined] WaveRider-Radio-Frequency 7 ‘auto’, ‘nomadic’, [9052 – 9248] (even values) WaveRider-SNMP-Read-Community 8 [User-defined] WaveRider-SNMP-Write-Community 9 [User-defined] WaveRider-SNMP-Trap-Server 10 [IP_addr]:[name] WaveRider-SNMP-Contact 11 [User-defined] WaveRider-SNMP-Location 12 [User-defined] WaveRider-SNMP-Name 13 [User-defined] WaveRider-Max-Customers 14 [0-50] WaveRider-Rf-Power 15 [15-26] WaveRider-Downlink-Min-Modulation 16 [3-11] WaveRider-Downlink-Max-Modulation 17 “ WaveRider-Uplink-Min-Modulation 18 “ WaveRider-Uplink-Max-Modulation 19 “ WaveRider-Uplink-VLAN-ID 20 [0-4094] WaveRider-Uplink-VLAN-Priority 21 [0-7] WaveRider-Downlink-VLAN-Strip 22 ‘enable’, ‘disable’ Table 4: WaveRider Vendor-Specific Attributestn068F 16
  21. 21. byhttp://www.wr.vecimasupport.com

×