LMS8000 / LMS4000

WaveRider LMS RADIUS Integration: FreeRADIUS and MySQL*

tn068F

*Part of the “WaveRider Free Solutions” series of articles

by

RELEASE 1.6.2, September 2008 Proprietary to Vecima Networks Inc. © by Vecima Networks Inc., 2008 Permission to Reproduce Except as otherwise specifically noted, the information in this publication may be reproduced, in part or in whole and by any means, without charge or further permission from Vecima Networks Inc., provided that due diligence is exercised in ensuring the accuracy of the information reproduced; that Vecima Networks Inc. is identified as the source; and that the reproduction is not represented as an official version of the information reproduced. This publication is also available electronically on the World Wide Web at the following address: www.wr.vecimasupport.com Vecima Networks Inc. reserves the right to revise this publication and to make changes in content from time to time without obligation on the part of Vecima Networks Inc. to provide notification of such revision or change. Vecima Networks Inc. provides this guide without warranty of any kind, either implied or expressed, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Vecima Networks Inc. may make improvements or changes in the product(s) described in this manual at any time. Specifications subject to change without notice.

tn068F i

Preface

Conventions The following conventions are used throughout this document:

Replace existing text or enter exact text that is highlighted in bold System prompts and/or pre-existing configuration file text are non-stylized, normal font Special characters/instructions are italic Emphatic terms and words are red Continuation of configuration file text or special characters is indicated with “…” Values surrounded by square brackets ( [ ] ) are variable (ie. EUM ID)

CAUTION: Whenever you see this icon and heading, the associated text discusses an issue, which, if not followed, could result in damage to, or improper use of, the equipment or software.

TIP: Whenever you see this icon and heading, the associated text provides a tip for facilitating the installation, testing, or operation of the equipment or software.

Getting Support

An extensive knowledge base is available at http://www.wr.vecimasupport.com. Visit the web page to:

Get the latest announcements from Vecima Networks. Download product related software, manuals, application notes, or other information about

the WaveRider product line. Consult the KnowledgeBase for troubleshooting information. Register and contact technical support to help you with unexpected problems.

Training

Vecima offers a complete training program. Please contact you sales representative for training information.

Priority support

Vecima also offers priority telephone and email support. Please contact your sales representative for details.

tn068F

Contents Preface ..................................................................................................................................................................................... i 1 Introduction .................................................................................................................................................................... 1

1.1 Detailed Tasks ........................................................................................................................................................... 1 1.2 Network Diagram ....................................................................................................................................................... 1

2 Installation....................................................................................................................................................................... 2 3 Configuration................................................................................................................................................................... 3

3.1 CCU3000 / CCU3100 / CCU8000.............................................................................................................................. 3 3.2 FreeRADIUS .............................................................................................................................................................. 4

3.2.1 Static File Authentication................................................................................................................................... 4 3.2.2 MySQL............................................................................................................................................................... 5

4 Implementation ............................................................................................................................................................... 9 5 Administration ...............................................................................................................................................................12

5.1 MySQL .....................................................................................................................................................................12 5.2 Monitoring.................................................................................................................................................................13

5.2.1 FreeRADIUS log files (static files method)...................................................................................................... 13 5.2.2 MySQL............................................................................................................................................................. 13

6 Resources......................................................................................................................................................................15 7 Appendix ........................................................................................................................................................................16

Tables Table 1: FreeRADIUS Default File Locations ......................................................................................................................... 4 Table 2: Static files method FreeRADIUS configuration......................................................................................................... 5 Table 3: MySQL method FreeRADIUS configuration ............................................................................................................. 6 Table 4: WaveRider Vendor-Specific Attributes....................................................................................................................16

Figures Figure 1: System Topology Example ...................................................................................................................................... 1

tn068F 1

1 Introduction

This technical note presents step-by-step configuration and examples for installing and configuring a Linux (Ubuntu Edgy Eft v6.10) installation of FreeRADIUS (v1.1.3) using either the static configuration files included with the software, or a MySQL (v5.0.41) database. Implementation, administration and monitoring of FreeRADIUS and MySQL is also addressed. Once successfully installed and configured, the system will allow FreeRADIUS to update the CCU3000, CCU3100 or CCU8000 authorization tables, thus allowing auto-configuration of the EUMs, as well as accumulate RADIUS accounting statistics.

The configuration examples detailed in this document were not designed or intended to work in every WaveRider® LMS deployment. It is understood that systems and/or network administrators customize the configurations to best suit the topology and needs of their own deployment requirements. It is highly recommended that the administrator following these examples possesses a solid understanding of Linux fundamentals in order to take the necessary precautions towards securing the configured system. Vecima’s WaveRider AES does not support or troubleshoot the Linux operating system.

1.1 Detailed Tasks

1. Configure WaveRider® CCU3000, CCU3100 or CCU8000 RADIUS client 2. Download and install FreeRADIUS and MySQL 3. Configure FreeRADIUS

a) static file authentication method b) MySQL authentication method

4. Create, log in to, and populate MySQL database 5. Start the FreeRADIUS server daemon 6. Administrate and monitor FreeRADIUS implementation

1.2 Network Diagram

Figure 1: System Topology Example

tn068F 2

2 Installation

Following the steps below to install the latest version of FreeRADIUS.

i. Download and install FreeRADIUS using either the Synaptics Package Manager (GUI) or manually via

ftp://ftp.freeradius.org/pub/radius or by simply typing “sudo apt-get install freeradius” and “sudo apt-get install freeradius-mysql” (if the SQL authorization method is to be used) in a terminal window.

Manual download/install tar xvf freeradius.tar.gz cd freeradius ./configure make make install

Package Manager download/install freeradius (‘A high performance and highly configurable RADIUS server’) freeradius-mysql (‘MySQL module for FreeRADIUS server’)

The FreeRADIUS tarball must be downloaded and extracted to retrieve the MySQL database schema for later use: http://freeradius.org/getting.html. Check the release notes or search the extracted files for the mysql.sql schema template file.

ii. Download and install MySQL and its associated modules by using either the Synaptics Package Manager (GUI)

or manually by simply typing the following commands in a terminal window: sudo apt-get install mysql-server sudo apt-get install mysql-server-5.0 sudo apt-get install mysql-client-5.0 sudo apt-get install mysql-client sudo apt-get install mysql-common

Manual download/install tar xvf mysql.tar.gz cd mysql ./configure make make install

Package Manager download/install Required: mysql-server-5.0 (mysql database server binaries) mysql-server (mysql database server current version) mysql-client-5.0 (mysql database client binaries) mysql-client (mysql database client current version) mysql-common (mysql database common files (e.g. /etc/mysql/my.cnf)

Optional: mysql-query-browser-common (Architecture independent files for MySQL Query Browser) mysql-query-browser (Official GUI tool to query MySQL database) mysql-navigator (GUI client program for MySQL database server) mysql-admin-common (Architecture independent files for MySQL Administrator) mysql-admin (GUI tool for intuitive MySQL administration)

tn068F 3

3 Configuration

3.1 CCU3000 / CCU3100 / CCU8000

The following example configures the CCU RADIUS client with a primary and secondary RADIUS server with a shared secret, enables and sets the accounting method to stop/start, sets the client request period to 5 minutes, and enables the RADIUS client. All configuration commands are required unless otherwise indicated (†).

i. Access the CLI using telnet via the local link or operator-configured static IP.

ii. Verify CCU can ping the RADIUS servers:

64:08:05*CCU> ping 192.168.1.254 Press any key to stop...PING 192.168.1.154: 56 data bytes, 490 ms interval (accurate to +- 5 ms) 64 bytes from 192.168.1.254: icmp_seq=0. time=15 ms 64 bytes from 192.168.1.254: icmp_seq=1. time=5 ms 64 bytes from 192.168.1.254: icmp_seq=2. time=5 ms 64 bytes from 192.168.1.254: icmp_seq=3. time=5 ms 64 bytes from 192.168.1.254: icmp_seq=4. time=5 ms ----192.168.1.254 PING Statistics---- 5 packets transmitted, 5 packets received, 0% packet loss round-trip (ms) min/avg/max = 5/7/15

64:08:05*CCU> ping 192.168.1.253 Press any key to stop...PING 192.168.1.253: 56 data bytes, 490 ms interval (accurate to +- 5 ms) 64 bytes from 192.168.1.253: icmp_seq=0. time=15 ms 64 bytes from 192.168.1.253: icmp_seq=1. time=5 ms 64 bytes from 192.168.1.253: icmp_seq=2. time=5 ms 64 bytes from 192.168.1.253: icmp_seq=3. time=5 ms 64 bytes from 192.168.1.253: icmp_seq=4. time=5 ms ----192.168.1.253 PING Statistics---- 5 packets transmitted, 5 packets received, 0% packet loss round-trip (ms) min/avg/max = 5/7/15

iii. Configure the primary RADIUS server IP and shared secret:

64:08:05*CCU> auth rad pri 192.168.1.254 Enter password (up to 16 chars): waverider123

The shared secret (‘password’ shown above) can be any 1-16 alpha-numeric value. The secret configured on the CCU RADIUS client and on the RADIUS server must match. See the ‘clients.conf’ file configuration in section 3.2.1 and 3.2.2.

iv. Configure the secondary RADIUS server IP†:

64:08:05*CCU> auth rad sec 192.168.1.253 Enter password (up to 16 chars): waverider123

tn068F 4

v. Enable RADIUS accounting†*:

64:08:05*CCU> auth rad acc stopstart vi. Change the RADIUS client request period† (default = 60 minutes):

64:08:05*CCU> auth rad per 5

vii. Enable the RADIUS client:

64:08:05*CCU> auth rad enable * Refer to section 5.4 of the WaveRider ‘Managing the Network’ guide (lms052_ap_01) for more detail on the start/stop and update RADIUS accounting modes. † Optional configuration.

3.2 FreeRADIUS

FreeRADIUS may be configured to use either a static file (the ‘users’ file) OR an SQL database with which to authorize EUMs. The database configuration example below uses the popular MySQL platform.

3.2.1 Static File Authentication Using the static ‘users’ file, the network administrator can control RADIUS authentication directly. EUMs (users) are added by their EUM IDs in the ‘users’ configuration file in paragraph form. Each subsequent paragraph entry can be copied and pasted at the end of the file, editing only each EUM ID and its applicable attribute values. Configuration files may be edited using Vi (command line – Linux server installation) or a Linux text editor (via KDE or GNOME GUI). Using the ‘users’ file for authorization is most efficient on the server system’s resources. However, it has more administrative overhead as changes need to be tracked and performed manually and is therefore not well suited for front-office business reference functions such as customer billing, location, etc. Also, the operator is limited to using only the RADIUS-related fields defined in the dictionary file.

Configuration File or Folder Default Path radiusd.conf /etc/freeradius logdir /var/log/freeradius raddbdir /etc/freeradius radacctdir /var/log/freeradius/radacct log_file /var/log/radius.log libdir /usr/lib/freeradius pidfile ${run_dir}/freeradius.pid clients.conf /etc/freeradius users.conf /etc/freeradius

Table 1: FreeRADIUS Default File Locations The following example instructs FreeRADIUS to use the static file authorization and accounting method (radiusd.conf), adds the primary and secondary CCU RADIUS clients to the clients.conf file with IP address, shared secret and short name, adds two (2) EUMs to the users file that defines the GOS (grade of service) to be used for each, and sets the maximum number of customers (hosts) that can access the radio link through each EUM.

radiusd.conf log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes authorize { … files

clients.conf client 192.168.1.254 { [tab]… secret [tab]… = waverider123 [tab]… shortname [tab]… = CCU1 } client 192.168.1.253 { [tab]… secret [tab]…… = waverider123 [tab]… shortname [tab]… = CCU2

tn068F 5

}

… } accounting { … detail sql_log … }

users 61:1e:1c[tab]… Auth-Type := Local, User-Password == buywavc [tab]… WaveRider-Grade-of-Service = bronze, [tab]… WaveRider-Max-Customers = 1 61:1a:87[tab]… Auth-Type := Local, User-Password == buywavc [tab]… WaveRider-Grade-of-Service = gold, [tab]… WaveRider-Max-Customers = 3

Table 2: Static files method FreeRADIUS configuration

The ‘User-password’ is not to be confused with the shared secret as configured on the CCU RADIUS client in section 3.1 and in the ‘clients.conf’ file in sections 3.2.1 and 3.2.2. The ‘User-Password’’ value for each user entry must be ‘buywavc’ (all lowercase). This value is hard-coded for every RADIUS request and has nothing to do with the EUM password.

Download the WaveRider dictionary file from http://www.wr.vecimasupport.com and install it in the /usr/share/freeradius/ directory on the Linux system. Be sure to periodically check back for new releases of this file.

3.2.2 MySQL To use a database, comment out entries in the users file and update radiusd.conf as shown below. The ‘sql.conf’ file (/etc/freeradius/sql.conf) is edited to include the server name (remote or local; DNS may be used) and database login credentials. The ‘radiusd.conf’ file is edited to indicate that an SQL database will provide the authorization data. This method of operation, although slightly more taxing on the server system’s resources, is a much more robust way to add, edit, delete and query user records, as well as monitor RADIUS activity. As well, the SQL table schema can be modified to suit the operator’s purposes. For example, in addition to the three required authorization fields (username, password, grade of service), the operator may also choose to include an unlimited number of front-office business function fields such as CAP site name, customer name, address, area, etc. This allows for quick and efficient querying of data to extract useful information or make changes to a specific user record. The scalability of this method is limited only by operator’s understanding of SQL, business model and/or imagination. For instance, the database may be integrated with a front-office financial accounting system (e.g. .NET, ASP or other web-based application) to allow a single point of entry for customer data, thus avoiding data entry duplication errors.

The following example changes the radiusd.conf file from the static authorization and accounting method (configured in section 3.2.1) to the SQL method. The EUMs will no longer be authenticated and configured using the instructions in the users file. A ‘#’ character is placed at the beginning of each of the entry’s lines to instruct FreeRADIUS to ignore them. The sql.conf file is configured to specify the server location (‘localhost’ = this server) database to connect to, and the Linux user account and password used to connect.

radiusd.conf log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes authorize {

users #61:1e:1c[tab]… Auth-Type := Local, User-Password == buywavc #[tab]… WaveRider-Grade-of-Service = bronze, #[tab]… WaveRider-Max-Customers = 1 #61:1a:87[tab]… Auth-Type := Local, User-Password == buywavc

tn068F 6

#[tab]… WaveRider-Grade-of-Service = gold, #[tab]… WaveRider-Max-Customers = 3

… #files sql … } accounting { … detail #sql_log sql … }

sql.conf sql { … server = “localhost” login = “admin” password = “admin123” … radius_db = “radius” … }

Table 3: MySQL method FreeRADIUS configuration

‘Server’, ‘login’, ‘password’ values in sql.conf may vary. To ensure functionality, verify the Linux user account used to access the MySQL DB has the appropriate permissions to access and write to the associated tables. The ‘radius_db’ value can be any name, as defined during the creation of the MySQL DB (see below).

The table structure in the following example groups EUMs by the GOS attribute value. The method the network or systems administrator will use to group the RADIUS profiles, attributes and users in the SQL tables will depend entirely on the topology of the LMS and management systems in use as well as business and customer service requirements. Refer to section 5.4 of the ‘Managing the Network’ user guide (lms052_ap_01) for available WaveRider attributes and their definitions. The following commands create the ‘radius’ SQL database, assigns all privileges to the ‘admin’ Linux user account, imports the FreeRADIUS schema, and populates the tables with appropriate data.

i. Extract the freeradius.tar.gz installation package to the admin user’s home directory: admin@ubuntu-server:~# tar –zxvf freeradius_[version].tar.gz –C /home/admin

ii. Login to the MySQL client:

admin@ubuntu-server:~# mysql

iii. Create the database: mysql> create database radius;

iv. Switch focus to the new ‘radius’ database: mysql> use radius

v. Grant all permissions to the database for the ‘admin’ Linux user account and exit the MySQL client: mysql> grant all on radius to admin@ubuntu-server;

mysql> quit

vi. Import the table structure (from the schema template file extracted in step i.) that FreeRADIUS will use to authenticate and authorize WaveRider EUMs:

tn068F 7

admin@ubuntu-server:~# mysql –uadmin –padmin123 radius < /home/admin/freeradius-[version]/[path]/mysql.sql

vii. Log into the MySQL client and the ‘radius’ database as the admin Linux user:

admin@ubuntu-server:~# mysql –uadmin –padmin123 radius

viii. Verify the tables have been successfully created in the database:

mysql> show tables; +------------------+ | Tables_in_radius | +------------------+ | nas | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | usergroup | +------------------+ 8 rows in set (0.00 sec)

ix. Due to a number of the WaveRider vendor-specific attributes (VSA) being longer than the ‘radreply’ and

‘radgroupreply’ tables’ attribute fields’ default 32 characters in length, modify each to allow 50 characters:

mysql> alter table radreply modify attribute varchar(50); Query OK, 0 rows affected (0.05 sec) Records: 0 Duplicates: 0 Warnings: 0 mysql> alter table radgroupreply modify attribute varchar(50); Query OK, 0 rows affected (0.05 sec) Records: 0 Duplicates: 0 Warnings: 0

x. Create the valid package type (ie. GOS) groups:

mysql> insert into radgroupcheck values (‘’,’home_lite’,’Auth- Type’,’:=’,’Local’);

Query OK, 1 row affected mysql> insert into radgroupcheck values (‘’,’home_lite’,’Password’,’==’,’buywavc’);

Query OK, 1 row affected mysql> insert into radgroupcheck values (‘’,’home_standard’,’Auth- Type’,’:=’,’Local’);

Query OK, 1 row affected mysql> insert into radgroupcheck values (‘’,’home_standard’,’Password’,’:=’,’buywavc’);

Query OK, 1 row affected

xi. Create the ‘denied’ group: mysql> insert into radgroupcheck values (‘’,’denied’,’Auth-Type’,’:=’,’denied’);

Query OK, 1 row affected

tn068F 8

xii. Populate the ‘radgroupreply’ table with the applicable WaveRider VSAs, grouping by package type (note second column is the ‘groupname’ field – value is operator’s choice and should be descriptive):

mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Grade-of- Service’,’:=’,’silver’); Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Current- Password’,’:=’,’[EUM_password]’);

Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Max- Customers’,’:=’,’5’);

Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Priority- Enabled’,’:=’,’enabled’);

Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_standard’,’WaveRider-Grade- of-Service’,’:=’,’gold’);

Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_lite’,’WaveRider-Current- Password’,’:=’,’[EUM_password]’);

Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_standard’,’WaveRider-Max- Customers’,’:=’,’5’);

Query OK, 1 row affected mysql> insert into radgroupreply values (‘’,’home_standard’,’WaveRider- Priority-Enabled’,’:=’,’enabled’);

Query OK, 1 row affected

The ‘WaveRider-Current-Password’ and correct value must be included when changing WaveRider VSA values such as ‘WaveRider-SNMP-Contact’. It is therefore recommended that all EUMs in each group share the same password.

xiii. Assign users (EUM IDs) to the groups created in step x and xi by populating the ‘usergroup’ table:

mysql> insert into usergroup values (’61:1c:1e’,’home_lite’); Query OK, 1 row affected mysql> insert into usergroup values (’61:1a:87’,’home_standard’); Query OK, 1 row affected mysql> insert into usergroup values (’64:be:66’,’denied’); Query OK, 1 row affected ...

tn068F 9

4 Implementation

Follow the steps below to initiate RADIUS operation (examples shown for FreeRADIUS configured with MySQL).

i. Start the FreeRADIUS server daemon in “single server” (-s), foreground process (-f) and debug mode (-x)

(visible transactions): admin@ubuntu-server:~# freeradius –sfx The FreeRadius daemon program will execute and configure itself using the values configured within the files

edited in Table 1 or Table 2. If no errors occur, the CLI output should end with ‘Ready to process requests’, similar to the following:

admin@ubuntu-testlab:~# freeradius -sfx Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to admin@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4

tn068F 10

rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.

ii. Power on the EUM corresponding to the username (ie. EUM ID) entered into the usergroup table of the radius

database, or force a deregistration of the EUM using the CCU command ‘air fdereg [eum_id]’ if it is already registered with the CCU.

Check the CCU’s authorization table to verify the EUM’s authentication type (‘radius’). If ‘static’ is displayed, a static entry exists on the CCU. If desired, use the CCU command <auth del [eumid]> to delete the static entry and allow the EUM to register via RADIUS.

iii. The CCU will immediately send an access-request to the RADIUS server on behalf of the EUM, which in turn

will display the authorization request details in the Linux terminal window or CLI process. For example: rad_recv: Access-Request packet from host 192.168.1.254:1025, id=23, length=60 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 User-Password = "buywavc" rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): User 61:1c:1e not found in radcheck rlm_sql (sql): Released sql socket id: 0 Login OK: [61:1c:1e/buywavc] (from client CCU1 port 1) Sending Access-Accept of id 23 to 192.168.1.254 port 1025 WaveRider-Grade-of-Service := silver WaveRider-Max-Customers := 30 WaveRider-Priority-Enabled := disabled WaveRider-SNMP-Location := "Toronto" WaveRider-Downlink-Min-Modulation := CCK2 WaveRider-Downlink-Max-Modulation := 64Q2 WaveRider-Uplink-Min-Modulation := CCK2 WaveRider-Uplink-Max-Modulation := 64Q2

Pay particular attention to the ‘Access-Accept’ and/or ‘Access-Reject’ messages in the Linux CLI. If an EUM is incorrectly rejected, the EUM ID may have been erroneously entered into the ‘usergroup’ table of the ‘radius’ database.

tn068F 11

Accounting stop/start or update messages will also appear (if accounting is configured on the CCU): rad_recv: Accounting-Request packet from host 192.168.1.254:1025, id=180, length=82 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 Acct-Status-Type = Stop Acct-Session-Id = "f4f40004" Acct-Input-Octets = 1653 Acct-Input-Packets = 24 Acct-Output-Octets = 1722 Acct-Output-Packets = 26 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 Sending Accounting-Response of id 180 to 192.168.1.254 port 1025 rad_recv: Accounting-Request packet from host 192.168.1.254:1025, id=179, length=58 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 Acct-Status-Type = Start Acct-Session-Id = "f4f40004" rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 Sending Accounting-Response of id 179 to 192.168.1.254 port 1025

rad_recv: Accounting-Request packet from host 192.168.1.254:1025, id=174, length=82 User-Name = "61:1c:1e" NAS-IP-Address = 192.168.1.254 NAS-Port = 1 Acct-Status-Type = Interim-Update Acct-Session-Id = "f4f40001" Acct-Input-Octets = 352176697 Acct-Input-Packets = 6658474 Acct-Output-Octets = 1827342061 Acct-Output-Packets = 2615193 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 Sending Accounting-Response of id 174 to 192.168.1.254 port 1025

iv. Verify that accounting messages are being stored in the MySQL database. A number of records should

appear containing the username (EUM ID), RADIUS client IP address and date/time stamps for both accounting stop and start messages:

admin@ubuntu-server:~# mysql –uadmin –padmin123 radius mysql> select username, nasipaddress, acctstarttime, acctstoptime from radacct; +----------+---------------+---------------------+---------------------+ | username | nasipaddress | acctstarttime | acctstoptime | +----------+---------------+---------------------+---------------------+ | 61:1c:1e | 192.168.1.254 | 2008-05-16 11:13:10 | 2008-05-16 11:19:48 | | 61:1c:1e | 192.168.1.254 | 2008-05-16 11:19:48 | 2008-05-16 11:26:25 | | 61:1a:87 | 192.168.1.254 | 2008-05-16 11:26:25 | 2008-05-16 11:33:02 | +----------+---------------+---------------------+---------------------+

3 rows in set (0.00 sec)

tn068F 12

5 Administration How the network or systems administrator chooses to monitor and operate his or her RADIUS is a matter of preference of the available tools and whether or not the Linux server was installed with a graphical user interface (GUI). Both FreeRADIUS and MySQL applications may be administrated using CLI commands or with the graphic client tools (ie. MySQL Query Browser) provided by the FreeRADIUS and MySQL software. The following examples use the CLI method of administration. The following are examples of SQL queries used to perform various administrative tasks such as adding new subscriber units to the RADIUS system, changing a user’s group membership, removing a user, troubleshooting, etc. The examples serve as a starting point; it is beneficial that the administrator possess a fundamental understanding of database structure and SQL syntax to be able extract detailed information using more complex queries.

Attribute value changes, or additions or deletions of EUM records in RADIUS will not take effect until the CCU’s RADIUS client’s update period has cycled OR the <air flush>, <air fdereg [EUM_ID]> is performed on the CCU, OR the EUM is reset or power cycled.

5.1 MySQL Use the following commands to perform routine administration including adding a new user, editing an existing user, changing a customer’s service level (ie. bronze to gold), etc.

Add a new EUM (ie. 61:1c:1e) by assigning it to a group (ie. ‘home_standard):

mysql> insert into usergroup values (’61:1c:1e’,’home_standard’);

Disable EUM communication by assigning it to the ‘denied’ group:

mysql> insert into usergroup values (’61:1c:1e’,’denied’); Change an EUM’s group membership (ie. to ‘home_standard’):

mysql> update usergroup set groupname=’home_standard’ where username=’61:1c:1e’; Remove an existing EUM: mysql> delete from usergroup where username=’61:1c:1e’; View all EUMs by name or group: mysql> select * from usergroup order by [username|groupname]; Add attributes to a particular group. This example adds the SNMP location ‘Toronto’ to the ‘home_standard’ group: mysql> insert into radgroupreply set values

(‘’,’home_standard’,’WaveRider-SNMP-Contact]’,’:=’,‘Toronto’);

tn068F 13

Edit existing attribute values in a particular group (ie. ‘home_standard’ group, max custs): mysql> update radgroupreply set value=‘10’ where groupname=’home_standard’

and attribute=’WaveRider-Max-Customers’; Remove entire group (ie. ‘home_standard’): mysql> delete from radgroupreply where groupname=’home_standard’;

5.2 Monitoring

5.2.1 FreeRADIUS log files (static files method)

Authorization: FreeRADIUS will log authorization attempts as long as the ‘log_auth = yes’ entry is included in the ‘radiusd.conf’ file. The operator will become accustomed to checking the ‘radius.log’ log file on a regular basis to ensure RADIUS authorization is occurring as expected. The default location of this file upon installation is ‘/var/log/freeradius’. The file contents are plain-text searchable. Accounting: The accounting logs are located by default in the ‘/var/log/freeradius/radacct’ directory. FreeRADIUS automatically creates subdirectories grouped by RADIUS client IP address and date. Update (interim-update), stop and start RADIUS accounting messages are appended to each file, rolling over to a new file in tandem with the system clock. Each paragraph-formatted entry is time-stamped (e.g. weekday month day hh:mm:ss yyyy) with useful tracking and troubleshooting information. The file contents are plain-text searchable.

5.2.2 MySQL

View accounting stop or start records by EUM (ie. 61:1c:1e):

mysql> select acctstarttime|acctstoptime from radacct where username=’61:1c:1e’;

View accounting stop or start records by RADIUS client (CCU IP, ie. 192.168.1.254):

mysql> select acctstarttime|acctstoptime, username from radacct where nasipaddress=’192.168.1.254’;

View accounting stop or start records by time period (ie. May 26 to May 28, 2007):

mysql> select acctstarttime|acctstoptime, username from radacct where acctstarttime|acctstoptime >= ’2007-05-26’ and acctstarttime|acctstoptime <= ‘2007-05-28’;

To prevent the ‘radacct’ table from becoming unmanageably large, and thus having an adverse effect on system performance, a cron job should be scheduled to automatically delete old records. The following example creates and schedules a crontab file that deletes all records with an accounting stop time (‘acctstoptime’) older than one month from the ‘radius’ SQL database. The process is executed daily (‘@daily’) at midnight. Also, the default cron job’s user email notification is disabled (‘>/dev/null 2>&1’): Open the crontab editor (Nano): admin@ubuntu-server:~# crontab –e

tn068F 14

In Nano, type the following cron instructions (one line entry): @daily mysql radius –e “delete from radacct where acctstoptime < date_sub(curdate(), interval 30 day)” >/dev/null 2>&1 Exit and save the crontab file: Ctrl-x Save modified buffer (ANSWERING “No” WILL DESTROY CHANGES) ? y File Name to Write: /tmp/crontab.~/crontab [enter] crontab: installing new crontab

tn068F 15

6 Resources WaveRider by Vecima Support: http://www.wr.vecimasupport.com FreeRADIUS web site: http://www.freeradius.org/ FreeRADIUS man pages: http://www.penguin-soft.com/penguin/man/8/freeradius.html FreeRADIUS Configuration example: http://www.frontios.com/freeradius.html MySQL web site: http://www.mysql.com/ MySQL tutorial: http://dev.mysql.com/doc/refman/5.0/en/tutorial.html MySQL statement syntax: http://dev.mysql.com/doc/refman/5.0/en/sql-syntax.html Ubuntu cron help: https://help.ubuntu.com/community/CronHowto Crontab how-to: http://crunchbang.org/archives/2007/10/26/howto-setup-a-crontab-file/

tn068F 16

7 Appendix

Attribute Name Tag Accepted Value(s) WaveRider-Grade-of-Service 1 ‘be’, ‘bronze’, ‘silver’, ‘gold’

WaveRider-Priority-Enabled 2 ‘disabled’, ‘enabled’

WaveRider-Authentication-Key 3 [User-defined]

(reserved) 4 N/A

WaveRider-Current-Password 5 [User-defined]

WaveRider-New-Password 6 [User-defined]

WaveRider-Radio-Frequency 7 ‘auto’, ‘nomadic’, [9052 – 9248] (even values)

WaveRider-SNMP-Read-Community 8 [User-defined]

WaveRider-SNMP-Write-Community 9 [User-defined]

WaveRider-SNMP-Trap-Server 10 [IP_addr]:[name]

WaveRider-SNMP-Contact 11 [User-defined]

WaveRider-SNMP-Location 12 [User-defined]

WaveRider-SNMP-Name 13 [User-defined]

WaveRider-Max-Customers 14 [0-50]

WaveRider-Rf-Power 15 [15-26]

WaveRider-Downlink-Min-Modulation 16 [3-11]

WaveRider-Downlink-Max-Modulation 17 “

WaveRider-Uplink-Min-Modulation 18 “

WaveRider-Uplink-Max-Modulation 19 “

WaveRider-Uplink-VLAN-ID 20 [0-4094]

WaveRider-Uplink-VLAN-Priority 21 [0-7]

WaveRider-Downlink-VLAN-Strip 22 ‘enable’, ‘disable’

Table 4: WaveRider Vendor-Specific Attributes

http://www.wr.vecimasupport.com

by