I have question about session stop packet from chillispot to freeradius.

It's possible? (If Yes how I cen do it?)

I'm dealing with strange issue for longer time, so I decided describe it here. Maybe you had similiar problem and will help me ..

Scenario:

Chillispot + Freeradius + MySQL on same machine...

All works fine, but sometimes, when user supplied valid password, it's proclaimed as wrong by Freeradius (there is no limit reached). When user repeat login with same password is correctly validated (sometimes after the third try). Passwords are stored in plain text. I completely reinstalled server to new Freeradius (1.x -> 2.x) but still same behaviour. This happens time to time and there is no rule for this. I also changed attribute from User-Password to the Cleartext-Password as suggested dialog within Freeradius debug (freeradius -X), but still same...

I'm sure, that users types valid passwords without any spaces and non printable characters....

Do you have any ideas why this happens ?

Thank you..

#MySQL

select * from radcheck where username like 'testuser';
+--------+-----------------+--------------------+----+------------+
| id     | UserName        | Attribute          | op | Value      |
+--------+-----------------+--------------------+----+------------+
| 634393 | testuser | Cleartext-Password | := | testpass |
+--------+-----------------+--------------------+----+------------+
3 rows in set (0.00 sec)

#Failed login:

rad_recv: Access-Request packet from host 127.0.0.1 port 42455, id=0, length=221
    User-Name = "testuser"
    CHAP-Challenge = 0xeccf148d53f051667a9823e5de873733
    CHAP-Password = 0x00d3f4797e4f3259203648b663cf70e1ec
    NAS-IP-Address = 0.0.0.0
    Service-Type = Login-User
    Framed-IP-Address = 172.25.156.18
    Calling-Station-Id = "00-1C-B3-C2-8A-F5"
    Called-Station-Id = "00-0C-29-58-63-5B"
    NAS-Identifier = "nas01"
    Acct-Session-Id = "4c93741900000011"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 17
    Message-Authenticator = 0xe0b1d438223cc799308111bd8151a15b
    WISPr-Logoff-URL = "http://172.25.156.1:3990/logoff"
+- entering group authorize
    expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100917
rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100917
    expand: %t -> Fri Sep 17 16:00:31 2010
++[auth_log] returns ok
  rlm_chap: Setting 'Auth-Type := CHAP'
++[chap] returns ok
++[mschap] returns noop
    rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
    expand: %{User-Name} -> testuser
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
rlm_sql (sql): Reserving sql socket id: 1
    expand: SELECT id, UserName, Attribute, Value, op           FROM radcheck           WHERE Username = '%{SQL-User-Name}' and Attribute != 'Qos-Rate'          ORDER BY id  -> SELECT id, UserName, Attribute, Value, op           FROM radcheck           WHERE Username = 'testuser' and Attribute != 'Qos-Rate'          ORDER BY id
rlm_sql (sql): User found in radcheck table
    expand: SELECT id, UserName, Attribute, Value, op           FROM radreply           WHERE Username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, UserName, Attribute, Value, op           FROM radreply           WHERE Username = 'testuser'           ORDER BY id
    expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='testuser'
    expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
rlm_sql (sql): User found in group pacienti
    expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[noresetcounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[dailycounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[weeklycounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[monthlycounter] returns noop
  rad_check_password:  Found Auth-Type CHAP
auth: type "CHAP"
+- entering group CHAP
  rlm_chap: login attempt by "testuser" with CHAP password
  rlm_chap: Using clear text password "testpass" for user testuser authentication.
  rlm_chap: Password check failed
++[chap] returns reject
auth: Failed to validate the user.
Login incorrect (rlm_chap: Wrong user password): [testuser/<CHAP-Password>] (from client localhost port 17 cli 00-1C-B3-C2-8A-F5)
Delaying reject of request 50 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed rejec
Sending Access-Reject of id 0 to 127.0.0.1 port 42455
    Idle-Timeout := 600
    Acct-Interim-Interval := 600
Waking up in 4.9 secondsrad_recv: Access-Request packet from host 127.0.0.1 port 42455, id=0, length=221
    User-Name = "testuser"
    CHAP-Challenge = 0xeccf148d53f051667a9823e5de873733
    CHAP-Password = 0x00d3f4797e4f3259203648b663cf70e1ec
    NAS-IP-Address = 0.0.0.0
    Service-Type = Login-User
    Framed-IP-Address = 172.25.156.18
    Calling-Station-Id = "00-1C-B3-C2-8A-F5"
    Called-Station-Id = "00-0C-29-58-63-5B"
    NAS-Identifier = "nas01"
    Acct-Session-Id = "4c93741900000011"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 17
    Message-Authenticator = 0xe0b1d438223cc799308111bd8151a15b
    WISPr-Logoff-URL = "http://172.25.156.1:3990/logoff"
+- entering group authorize
    expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100917
rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100917
    expand: %t -> Fri Sep 17 16:00:31 2010
++[auth_log] returns ok
  rlm_chap: Setting 'Auth-Type := CHAP'
++[chap] returns ok
++[mschap] returns noop
    rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
    expand: %{User-Name} -> testuser
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
rlm_sql (sql): Reserving sql socket id: 1
    expand: SELECT id, UserName, Attribute, Value, op           FROM radcheck           WHERE Username = '%{SQL-User-Name}' and Attribute != 'Qos-Rate'          ORDER BY id  -> SELECT id, UserName, Attribute, Value, op           FROM radcheck           WHERE Username = 'testuser' and Attribute != 'Qos-Rate'          ORDER BY id
rlm_sql (sql): User found in radcheck table
    expand: SELECT id, UserName, Attribute, Value, op           FROM radreply           WHERE Username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, UserName, Attribute, Value, op           FROM radreply           WHERE Username = 'testuser'           ORDER BY id
    expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='testuser'
    expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
rlm_sql (sql): User found in group pacienti
    expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[noresetcounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[dailycounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[weeklycounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[monthlycounter] returns noop
  rad_check_password:  Found Auth-Type CHAP
auth: type "CHAP"
+- entering group CHAP
  rlm_chap: login attempt by "testuser" with CHAP password
  rlm_chap: Using clear text password "testpass" for user testuser authentication.
  rlm_chap: Password check failed
++[chap] returns reject
auth: Failed to validate the user.
Login incorrect (rlm_chap: Wrong user password): [testuser/<CHAP-Password>] (from client localhost port 17 cli 00-1C-B3-C2-8A-F5)
Delaying reject of request 50 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 50
Sending Access-Reject of id 0 to 127.0.0.1 port 42455
    Idle-Timeout := 600
    Acct-Interim-Interval := 600
Waking up in 4.9 seconds..

#Success login:

rad_recv: Access-Request packet from host 127.0.0.1 port 37286, id=0, length=221
    User-Name = "testuser"
    CHAP-Challenge = 0x3bbd1bb8af26015543db853c2ed4bf57
    CHAP-Password = 0x004184904f618b872506a5ff847d774796
    NAS-IP-Address = 0.0.0.0
    Service-Type = Login-User
    Framed-IP-Address = 172.25.156.18
    Calling-Station-Id = "00-1C-B3-C2-8A-F5"
    Called-Station-Id = "00-0C-29-58-63-5B"
    NAS-Identifier = "nas01"
    Acct-Session-Id = "4c93741900000011"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 17
    Message-Authenticator = 0xa77fc5e84182b49504d2574eaf4dd1f4
    WISPr-Logoff-URL = "http://172.25.156.1:3990/logoff"
+- entering group authorize
    expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100917
rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100917
    expand: %t -> Fri Sep 17 16:00:57 2010
++[auth_log] returns ok
  rlm_chap: Setting 'Auth-Type := CHAP'
++[chap] returns ok
++[mschap] returns noop
    rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
    expand: %{User-Name} -> testuser
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
rlm_sql (sql): Reserving sql socket id: 1
    expand: SELECT id, UserName, Attribute, Value, op           FROM radcheck           WHERE Username = '%{SQL-User-Name}' and Attribute != 'Qos-Rate'          ORDER BY id  -> SELECT id, UserName, Attribute, Value, op           FROM radcheck           WHERE Username = 'testuser' and Attribute != 'Qos-Rate'          ORDER BY id
rlm_sql (sql): User found in radcheck table
    expand: SELECT id, UserName, Attribute, Value, op           FROM radreply           WHERE Username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, UserName, Attribute, Value, op           FROM radreply           WHERE Username = 'testuser'           ORDER BY id
    expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='testuser'
    expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id -> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
rlm_sql (sql): User found in group pacienti
    expand: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id -> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[noresetcounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[dailycounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[weeklycounter] returns noop
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
++[monthlycounter] returns noop
  rad_check_password:  Found Auth-Type CHAP
auth: type "CHAP"
+- entering group CHAP
  rlm_chap: login attempt by "testuser" with CHAP password
  rlm_chap: Using clear text password "testpass" for user testuser authentication.
  rlm_chap: chap user testuser authenticated succesfully
++[chap] returns ok
Login OK: [testuser/<CHAP-Password>] (from client localhost port 17 cli 00-1C-B3-C2-8A-F5)
+- entering group post-auth
    expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/reply-detail-20100917
rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/reply-detail-20100917
    expand: %t -> Fri Sep 17 16:00:57 2010
++[reply_log] returns ok
rlm_sql (sql): Processing sql_postauth
    expand: %{User-Name} -> testuser
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details
    expand: INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW()) -> INSERT into radpostauth (id, user, pass, reply, date) values ('', 'testuser', 'Chap-Password', 'Access-Accept', NOW())
rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'testuser', 'Chap-Password', 'Access-Accept', NOW())
rlm_sql (sql): Reserving sql socket id: 0
rlm_sql (sql): Released sql socket id: 0
++[sql] returns ok
Sending Access-Accept of id 0 to 127.0.0.1 port 37286
    Idle-Timeout := 600
    Acct-Interim-Interval := 600
Finished request 53.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Accounting-Request packet from host 127.0.0.1 port 51236, id=43, length=137
    Acct-Status-Type = Start
    User-Name = "testuser"
    Calling-Station-Id = "00-1C-B3-C2-8A-F5"
    Called-Station-Id = "00-0C-29-58-63-5B"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 17
    NAS-Port-Id = "00000017"
    NAS-IP-Address = 0.0.0.0
    NAS-Identifier = "nas01"
    Framed-IP-Address = 172.25.156.18
    Acct-Session-Id = "4c93741900000011"
+- entering group preacct
rlm_acct_unique: Hashing 'NAS-Port = 17,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c93741900000011",User-Name = "testuser"'
rlm_acct_unique: Acct-Unique-Session-ID = "7b48c9ff641f78a5".
++[acct_unique] returns ok
    rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
+- entering group accounting
    expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/detail-20100917
rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20100917
    expand: %t -> Fri Sep 17 16:00:57 2010
++[detail] returns ok
    expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp
    expand: %{User-Name} -> testuser
++[radutmp] returns ok
++[acct_unique] returns noop
    expand: %{User-Name} -> testuser
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
    expand: INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0') -> INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('4c93741900000011', '7b48c9ff641f78a5', 'testuser', '', '0.0.0.0', '17', 'Wireless-802.11', '2010-09-17 16:00:57', '0', '0', '', '', '', '0', '0', '00-0C-29-58-63-5B', '00-1C-B3-C2-8A-F5', '', '', '', '172.25.156.18', '', '0')
rlm_sql (sql): Reserving sql socket id: 4
rlm_sql (sql): Released sql socket id: 4
++[sql] returns ok
Sending Accounting-Response of id 43 to 127.0.0.1 port 51236
Finished request 54.
Cleaning up request 54 ID 43 with timestamp +1249
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 53 ID 0 with timestamp +1249
Ready to process requests.

#radiusd.conf

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct

confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius

log_file = ${logdir}/radius.log

libdir = /usr/lib/freeradius

pidfile = ${run_dir}/freeradius.pid

user = freerad
group = freerad

max_request_time = 30

delete_blocked_requests = no

cleanup_delay = 5

max_requests = 1024

bind_address = *

port = 0

hostname_lookups = no

allow_core_dumps = no

regular_expressions    = yes
extended_expressions    = yes

log_stripped_names = yes

log_auth = yes

log_auth_badpass = yes
log_auth_goodpass = yes

usercollide = no

lower_user = no
lower_pass = no

nospace_user = no
nospace_pass = no

checkrad = ${sbindir}/checkrad

security {
    max_attributes = 200
    reject_delay = 1
    status_server = no
}

proxy_requests  = yes
$INCLUDE  ${confdir}/proxy.conf

$INCLUDE  ${confdir}/clients.conf
snmp    = no
$INCLUDE  ${confdir}/snmp.conf
thread pool {
    start_servers = 5
    max_servers = 32
    min_spare_servers = 3
    max_spare_servers = 10
    max_requests_per_server = 0
}

modules {
    pap {
        encryption_scheme = clear
    }
    chap {
        authtype = CHAP
    }
    pam {
        pam_auth = radiusd
    }

    unix {
        cache = no
        cache_reload = 600
        shadow = /etc/shadow
        radwtmp = ${logdir}/radwtmp
    }

$INCLUDE ${confdir}/eap.conf

    mschap {
    }

    ldap {
        server = "ldap.your.domain"
        basedn = "o=My Org,c=UA"
        filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"

        start_tls = no
        access_attr = "dialupAccess"
        dictionary_mapping = ${raddbdir}/ldap.attrmap
        ldap_connections_number = 5
        timeout = 4
        timelimit = 3
        net_timeout = 1
    }

    realm IPASS {
        format = prefix
        delimiter = "/"
        ignore_default = no
        ignore_null = no
    }

    realm suffix {
        format = suffix
        delimiter = "@"
        ignore_default = no
        ignore_null = no
    }

    realm realmpercent {
        format = suffix
        delimiter = "%"
        ignore_default = no
        ignore_null = no
    }

    realm ntdomain {
        format = prefix
        delimiter = "\\"
        ignore_default = no
        ignore_null = no
    }   

    checkval {
        item-name = Calling-Station-Id
        check-name = Calling-Station-Id
        data-type = string
    }

    detail {
        detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
        detailperm = 0600
    }

     detail auth_log {
         detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d
     }

     detail reply_log {
         detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d
     }

    acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
    }
    $INCLUDE  ${confdir}/sql.conf

    radutmp {
        filename = ${logdir}/radutmp
        username = %{User-Name}
        case_sensitive = yes
        check_with_nas = yes       
        perm = 0600
        callerid = "yes"
    }

    radutmp sradutmp {
        filename = ${logdir}/sradutmp
        perm = 0644
        callerid = "no"
    }

    attr_filter {
        attrsfile = ${confdir}/attrs
    }

    counter daily {
        filename = ${raddbdir}/db.daily
        key = User-Name
        count-attribute = Acct-Session-Time
        reset = daily
        counter-name = Daily-Session-Time
        check-name = Max-Daily-Session
        allowed-servicetype = Framed-User
        cache-size = 5000
    }

    sqlcounter noresetcounter {
        counter-name = Max-All-Session-Time
        check-name = Max-All-Session
        sqlmod-inst = sql
        key = User-Name
        reset = never
        query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'"
    }

    sqlcounter weeklycounter {
        driver = "rlm_sqlcounter"
        counter-name = Weekly-Session-Time
        check-name = Max-Weekly-Session
        sqlmod-inst = sqlcca3
        key = User-Name
        reset = weekly
        query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND \
        UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > %b"
    }

    sqlcounter dailycounter {
        counter-name = Daily-Session-Time
        check-name = Max-Daily-Session
        sqlmod-inst = sql
        key = User-Name
        reset = daily

        query = "SELECT IFNULL(SUM(AcctSessionTime - \
                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)),0) \
                 FROM radacct WHERE UserName='%{%k}' AND \
                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > %b"
    }

    sqlcounter monthlycounter {
        counter-name = Monthly-Session-Time
        check-name = Max-Monthly-Session
        sqlmod-inst = sql
        key = User-Name
        reset = monthly

        query = "SELECT SUM(AcctSessionTime - \
                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
                 FROM radacct WHERE UserName='%{%k}' AND \
                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > %b"
    }

    always fail {
        rcode = fail
    }
    always reject {
        rcode = reject
    }
    always ok {
        rcode = ok
        simulcount = 0
        mpp = no
    }

    expr {
    }

    digest {
    }

    exec {
        wait = yes
        input_pairs = request
    }

    exec echo {
        wait = yes

        program = "/bin/echo %{User-Name}"

        input_pairs = request

        output_pairs = reply

    }

    ippool main_pool {

        range-start = 192.168.1.1
        range-stop = 192.168.3.254
        netmask = 255.255.255.0
        cache-size = 800
        session-db = ${raddbdir}/db.ippool
        ip-index = ${raddbdir}/db.ipindex
        override = no
        maximum-timeout = 0
    }
}

instantiate {
    exec
    expr
}

authorize {
    auth_log
    chap
    mschap
    suffix
    eap
    sql
    noresetcounter
    dailycounter
    weeklycounter
    monthlycounter
}

authenticate {
    Auth-Type PAP {
        pap
    }

    Auth-Type CHAP {
        chap
    }

    Auth-Type MS-CHAP {
        mschap
    }
    unix
    eap
}

preacct {
    acct_unique
    suffix
}

accounting {
    detail
    radutmp
    acct_unique
    sql
}

session {
    sql
}

post-auth {
    reply_log
    sql
}

pre-proxy {

}

post-proxy {
    eap
}

log {
    syslog_facility = daemon
}

I have several tens of chillispots deployed in both uam + wpa configuration. the idea is that peer conects via UAM, registers account and makes online payment via his bank (bank's hostnames in uamallowed). One of the banks has silently removed one of it's hostnames from DNS and chillispot refused to start ......

Here are some of the sites that will not load. I am getting "Page cannot be displayed". Note that the authentication works and most sites work fine.

www.expedia.com
www.continental.com
www.fedex.com

The settings works perfect, and bandwidthmaxdown too, but bandwidthmaxup do not work well, or don't work, I did try differents way to compile to be sure leaky_bucket functions is called, and have the proper bucketupsize, I did debug it and the function look like work, do every step that would do, but do not stop the ulpoad trafic.

I don't have a lot experience with tun/tap staff, but look like leaky_bucket is called after tun send outgoing data.

Anyone have some Idea to help me to fix this issue.

Note: bandwithmaxup do not work too in standart chillispot and I did try it over linksys WRT54GL with openwrt and PC with debian.

nkm

I`ve previously installed and used chillispot on many 32-bit systems.

I`ve installed a fresh copy of BlueWhite 64 12.2 ,using stock kernel (and all other software is distro clean)

uname -a
Linux eoefwA01 2.6.27.7 #1 SMP Fri Dec 5 01:27:18 EET 2008 x86_64 Intel(R) Core(TM)2 Quad  CPU   Q8200  @ 2.33GHz GenuineIntel GNU/Linux

root@eoefwA01:~# gcc -v
Reading specs from /usr/lib/gcc/x86_64-pc-linux/4.2.4/specs
Target: x86_64-pc-linux
Configured with: ../gcc-4.2.4/configure --prefix=/usr --enable-shared --enable-languages=ada,c,c++,fortran,java,objc --disable-multilib --enable-threads=posix --enable-__cxa_atexit --disable-checking --with-gnu-ld --verbose --build=x86_64-pc-linux --target=x86_64-pc-linux --host=x86_64-pc-linux
Thread model: posix
gcc version 4.2.4

I`ve installed remote radius servers (also on same distro) (freeradius 2.1.6) and chillispot 1.1.0 .

I`ve spent hours trying to access to radius servers from machine running chilli but couldn`t. Error was

(Shared secret is incorrect.) Dropping packet without response

Checked secrets manytimes but noway.

downgraded both to 2.1.0 and 1.0.0 , nothing changed.

Keeping my SAME configuration on radius servers, (and running) I`ve installed a native 32-bit Slackware 12.2 on another machine (same hardware).

Everything worked fine, even with old configuration files, without touching to freeradius machines.

Can it be a problem about calculating MD5 or other cryptographic functions on 64-bit systems during first connection with radius ?

Any ideas ?

Thanks ,

Kivanc

We have been pulling our hair out for days trying to make the accounting interval work in this setup to no avail, it seems chilli just does nothing with it which seems like a bug.

16:36:58.972685 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 54) 127.0.0.1.1812 > 127.0.0.1.32775: RADIUS, length: 26
        Access Accept (2), id: 0x00, Authenticator: a6b4d2e103f2d40913e183248d231c6d
          Accounting Interim Interval Attribute (85), length: 6, Value: 30 secs

You can see above it clearly get sent with Access Accept but nothing happens until the user logs off when accounting is updated for the session.

tcpdump shows nothing over the period, no failure logs in freeradius.

Regards
Nick

I tried every version of DDWRT available for the WRT54GL and finally found a strange issue with chillispot not properly configuring the DNS server.

The symptoms were:
Re-direction would intermittently work. Sometimes it would work for a few hours. Sometimes it would only resolve the first uamallowed (ie. paypal.com but not paypalobjects.com). And sometimes redirection wouldnt work at all unless the original address specified was numeric (ie. 207.34.23.43 instead of google.com). Rebooting the router / enabling and disabling chillispot would randomly, temporarily, fix this issue.

The fix:
telnet into the router and manually edit the /etc/resolv.conf file to use the required DNS server. Mine was set to the default 192.168.1.1 which isnt even the same subnet as the chilli DHCP, so it could not use the static WAN addresses as one would hope. Changing this value to the ISP's external DNS resolved all issues with the server not starting, improper forwarding, and slow/intermittent uamallowed resolve.

Very strange issue. Hope this helps someone.

When I run tcpdump on WRT I can clearly see the dups:

23:27:15.723230 IP 10.69.2.1 > 10.69.2.2: ICMP echo reply, id 512, seq 1536, length 40
23:27:15.820406 IP 10.69.2.2 > 10.69.2.1: ICMP echo request, id 512, seq 1536, length 40
23:27:15.821217 IP 10.69.2.1 > 10.69.2.2: ICMP echo reply, id 512, seq 1536, length 40

Perhaps Windows is forgiving of these duplicates & Mac is not?
How can I separate where these dups are introduced?
My prime suspects would be kmod-tun or chilli, others?

When server hangs it is totally dead.
What can I do or what I have to change to make it stable? Is it a chilli problem? Has any similar problem to this?

There is no logs or other things (even on screen which is black when it hangs) to help diagnose problem.

Thanks for any help.

E.

If you use a redirect URL that contains a GET variable, Chillispot will incorrectly append its own GET variables with a leading '?'.  This leads to the loss of the first GET variable, which appears to always be the 'res' variable.

Example:

If you supply a the redirect URL 'https://www.foozle.com?foo=bar', hotspotlogin.php (or the moral equivalent) will use the URL 'https://www.foozle.com?foo=bar?res=notyet&uamip=...' (incorrect) instead of 'https://www.foozle.com?foo=bar&res=notyet&uamip=...' and so on.

The result is that GET variables cannot be used in the redirect URL, because the hotspotlogin.php (or whatever) will be unable to obtain the value of the 'res' GET variable.

I has been instaled chillispot in two machines, both with debian 4.0 and freeradius with ldap.
In linux, MAC OS, WinXP i can login whit any user in the ldap, so when i try with win vista i cannot login.

When I login with linux, MAC OS an d win xp i can see the password, but with win vista the password change to strange characters.

then i just remove "-ansi" from src/Marefile
--- src/Makefile.old    2008-07-22 17:33:17.000000000 +0300
+++ src/Makefile        2008-07-22 17:33:39.000000000 +0300
@@ -171,7 +171,7 @@
target_alias =

# add -pg to enable gprof
-AM_CFLAGS = -D_GNU_SOURCE -fno-builtin -ansi -DSBINDIR='"$(sbindir)"'
+AM_CFLAGS = -D_GNU_SOURCE -fno-builtin -DSBINDIR='"$(sbindir)"'
chilli_SOURCES = chilli.c defs.h tun.c tun.h cmdline.c cmdline.h ippool.c ippool.h radius.h radius.c md5.c md5.h redir.h redir.c dhcp.c dhcp.h syserr.c syserr.h iphash.c iphash.h lookup.c lookup.h
chilli_LDFLAGS = -lcrypt
all: all-am