<DIV>Arran,</DIV>
<DIV> </DIV>
<DIV>Yes. You're right. It works. Great!</DIV>
<DIV> </DIV>
<DIV>Thanks!</DIV>
<DIV> </DIV>
<DIV>Tom</DIV>
<DIV><includetail>
<DIV> </DIV>
<DIV> </DIV>
<DIV style="COLOR: #000">
<DIV style="PADDING-BOTTOM: 2px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; FONT-FAMILY: Arial Narrow; FONT-SIZE: 12px; PADDING-TOP: 2px">------------------ Original ------------------</DIV>
<DIV style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV id=menu_sender><B>From: </B> "a.cudbardb"<a.cudbardb@freeradius.org>;</DIV>
<DIV><B>Date: </B> Tue, Sep 13, 2011 03:56 PM</DIV>
<DIV><B>To: </B> "2394263740"<2394263740@qq.com>; <WBR></DIV>
<DIV></DIV>
<DIV><B>Subject: </B> Re: NAS IP Address</DIV></DIV>
<DIV> </DIV>Ah you want the attribute Packet-Src-IP-Address
<DIV><BR></DIV>
<DIV>-Arran<BR>
<DIV>
<DIV>On 13 Sep 2011, at 03:55, 2394263740 wrote:</DIV><BR class=Apple-interchange-newline>
<BLOCKQUOTE type="cite">
<DIV>Arran,</DIV>
<DIV> </DIV>
<DIV>Looks like the email didn't go through sometime.</DIV>
<DIV> </DIV>
<DIV>Please see below email for my question.</DIV>
<DIV> </DIV>
<DIV>Thanks!</DIV>
<DIV> </DIV>
<DIV>Tom</DIV>
<DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV style="COLOR: #000">
<DIV style="PADDING-BOTTOM: 2px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; FONT-FAMILY: Arial Narrow; FONT-SIZE: 12px; PADDING-TOP: 2px">------------------ Original ------------------</DIV>
<DIV style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV id=menu_sender><B>From: </B> "2394263740"<<A href="mailto:2394263740@qq.com">2394263740@qq.com</A>>;</DIV>
<DIV><B>Date: </B> Tue, Sep 13, 2011 09:28 AM</DIV>
<DIV><B>To: </B> "freeradius-users"<<A href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</A>>; <WBR></DIV>
<DIV></DIV>
<DIV><B>Subject: </B> Re:NAS IP Address</DIV></DIV>
<DIV> </DIV>
<DIV>Arran,</DIV>
<DIV> </DIV>
<DIV>Thanks for your help and reply.</DIV>
<DIV> </DIV>
<DIV>%{NAS-IP-Address} doesn't work for this case.</DIV>
<DIV> </DIV>
<DIV>The connection like below.</DIV>
<DIV> </DIV>
<DIV>Mobile --- WiFi Router --- Internet Gateway (NAT) ---Internet --- FreeRadius Server.</DIV>
<DIV> </DIV>
<DIV>The %{NAS-IP-Address} will be the LAN interfact IP, such as 192.168.1.1. This is not I need.</DIV>
<DIV> </DIV>
<DIV>I need the IP address, with such IP address, FreeRadius Server is communicating. This means, when FreeRadius receive the access request, the request IP packet was sourced from the Internet Gateway IP address, and this is the IP address I need. Inside the access request, there is %{NAS-IP-Address}, it's the LAN IP address of the WIFI router, %{NAS-IP-Address} is not the information I need in such case.</DIV>
<DIV> </DIV>
<DIV>Thanks!</DIV>
<DIV> </DIV>
<DIV>Tom</DIV>
<DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV style="COLOR: #000">
<DIV style="PADDING-BOTTOM: 2px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px; FONT-FAMILY: Arial Narrow; FONT-SIZE: 12px; PADDING-TOP: 2px">------------------ Original ------------------</DIV>
<DIV style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV id=menu_sender><B>From: </B> "freeradius-users"<<A href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</A>>;</DIV>
<DIV><B>Date: </B> Mon, Sep 12, 2011 10:44 PM</DIV>
<DIV><B>To: </B> "freeradius-users"<<A href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</A>>; <WBR></DIV>
<DIV></DIV>
<DIV><B>Subject: </B> Freeradius-Users Digest, Vol 77, Issue 42</DIV></DIV>
<DIV> </DIV>Send Freeradius-Users mailing list submissions to<BR><A href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</A><BR><BR>To subscribe or unsubscribe via the World Wide Web, visit<BR>http://lists.freeradius.org/mailman/listinfo/freeradius-users<BR>or, via email, send a message with subject or body 'help' to<BR>freeradius-users-request@lists.freeradius.org<BR><BR>You can reach the person managing the list at<BR>freeradius-users-owner@lists.freeradius.org<BR><BR>When replying, please edit your Subject line so it is more specific<BR>than "Re: Contents of Freeradius-Users digest..."<BR><BR><BR>Today's Topics:<BR><BR> 1. NAS IP Address ( 2394263740 )<BR> 2. Re: NAS IP Address (Arran Cudbard-Bell)<BR> 3. Best Practices - maximum NAS entries in clients.conf<BR> (Sallee, Stephen (Jake))<BR> 4. Re: Best Practices - maximum NAS entries in clients.conf<BR> (Alan DeKok)<BR> 5. Re: Best Practices - maximum NAS entries in clients.conf<BR> (Arran Cudbard-Bell)<BR> 6. Re: Best Practices - maximum NAS entries in clients.conf<BR> (Arran Cudbard-Bell)<BR> 7. Re: Best Practices - maximum NAS entries in clients.conf<BR> (Bruce Nunn)<BR> 8. Unable to Authenticate with SHA Password (Rajkumar balaji)<BR><BR><BR>----------------------------------------------------------------------<BR><BR>Message: 1<BR>Date: Mon, 12 Sep 2011 19:58:18 +0800<BR>From: " 2394263740 " <2394263740@qq.com><BR>Subject: NAS IP Address<BR>To: " freeradius-users " <freeradius-users@lists.freeradius.org><BR>Message-ID: <tencent_5E7B240C4B421E587B96F796@qq.com><BR>Content-Type: text/plain; charset="iso-8859-1"<BR><BR>Hello,<BR> I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1.<BR>OS: Linux Enterprise Server 6.1<BR>Radius: free radius server 2.1.11<BR>Database: Mysql<BR> <BR> The WIFI routers we're using are in diffirent private networks, behind the internet gateways. The WIFI router has private IP address, such as 192.168.1.1.<BR> <BR> For some reason, we need know which Internet IP address, the WIFI router is using to do the authention with the FreeRadius server. The FreeRadius server is on internet.<BR> <BR> As the business needs, we need save the IP addres(Internet gateway IP address) to MySql database.<BR> <BR> Can anyone advise how to do so?<BR> <BR> Thanks!<BR> <BR> Tom<BR>-------------- next part --------------<BR>An HTML attachment was scrubbed...<BR>URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/20110912/9e460040/attachment.html><BR><BR>------------------------------<BR><BR>Message: 2<BR>Date: Mon, 12 Sep 2011 14:10:48 +0200<BR>From: Arran Cudbard-Bell <a.cudbardb@freeradius.org><BR>Subject: Re: NAS IP Address<BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Message-ID: <8B265A64-D969-4949-A8C8-A0BD016C62E8@freeradius.org><BR>Content-Type: text/plain; charset="iso-8859-1"<BR><BR><BR>On 12 Sep 2011, at 13:58, 2394263740 wrote:<BR><BR>> Hello,<BR>> I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1.<BR>> OS: Linux Enterprise Server 6.1<BR>> Radius: free radius server 2.1.11<BR>> Database: Mysql<BR>> <BR>> The WIFI routers we're using are in diffirent private networks, behind the internet gateways. The WIFI router has private IP address, such as 192.168.1.1.<BR>> <BR>> For some reason, we need know which Internet IP address, the WIFI router is using to do the authention with the FreeRadius server. The FreeRadius server is on internet.<BR>> <BR>> As the business needs, we need save the IP addres(Internet gateway IP address) to MySql database.<BR><BR>edit the queries in<BR><BR>raddb/sql/mysql/dialup.conf<BR><BR>and add the additional columns to the SQL database.<BR><BR>The original IP address of the NAS may be sent in the NAS-IP-Address attribute, in which case use the expansion %{NAS-IP-Address} for the value of the new column.<BR><BR>Arran Cudbard-Bell<BR>a.cudbardb@freeradius.org<BR><BR>RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time.<BR><BR>-------------- next part --------------<BR>An HTML attachment was scrubbed...<BR>URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/20110912/0e06bff5/attachment.html><BR><BR>------------------------------<BR><BR>Message: 3<BR>Date: Mon, 12 Sep 2011 14:04:53 +0000<BR>From: "Sallee, Stephen (Jake)" <Jake.Sallee@umhb.edu><BR>Subject: Best Practices - maximum NAS entries in clients.conf<BR>To: freeradius-users <freeradius-users@lists.freeradius.org><BR>Message-ID: <3A9815D880FBAF41A523B3A35AF3C3DF170E6FD1@AVATAR.umhb.edu><BR>Content-Type: text/plain; charset="iso-8859-1"<BR><BR>@ everyone<BR><BR>We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use?<BR><BR>Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR?<BR><BR>Jake Sallee<BR>Godfather of Bandwidth<BR>Network Engineer<BR>University of Mary Hardin-Baylor<BR><BR>900 College St.<BR>Belton, Texas<BR>76513<BR><BR>Fone: 254-295-4658<BR>Phax: 254-295-4221<BR><BR><BR><BR>------------------------------<BR><BR>Message: 4<BR>Date: Mon, 12 Sep 2011 16:17:40 +0200<BR>From: Alan DeKok <aland@deployingradius.com><BR>Subject: Re: Best Practices - maximum NAS entries in clients.conf<BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Message-ID: <4E6E1484.70200@deployingradius.com><BR>Content-Type: text/plain; charset=ISO-8859-1<BR><BR>Sallee, Stephen (Jake) wrote:<BR>> We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use?<BR><BR> Whenever you get tired of managing them in clients.conf.<BR><BR> The server has been tested with 500K clients in clients.conf. It<BR>takes a few seconds to start, and a gig or so of RAM, but it works.<BR><BR>> Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR?<BR><BR> Yes.<BR><BR> You can also do this with files. See raddb/dynamic_clients in<BR>2.1.12. (When it comes out)<BR><BR> Alan DeKok.<BR><BR><BR>------------------------------<BR><BR>Message: 5<BR>Date: Mon, 12 Sep 2011 16:21:45 +0200<BR>From: Arran Cudbard-Bell <a.cudbardb@freeradius.org><BR>Subject: Re: Best Practices - maximum NAS entries in clients.conf<BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Message-ID: <D41AD9A3-B5A6-4690-B053-58361E3D7D71@freeradius.org><BR>Content-Type: text/plain; charset=us-ascii<BR><BR><BR>On 12 Sep 2011, at 16:04, Sallee, Stephen (Jake) wrote:<BR><BR>> @ everyone<BR>> <BR>> We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use?<BR><BR>When it becomes a bear to deal with the clients.conf file :) - I guess memory might be a concern? But i'm sure there are sites out there with client.conf files holding thousands of entries... It's a hash table in C, it's going to be fast.<BR><BR>> <BR>> Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR?<BR><BR>Indeed. You can also set them to expire as well, to clean up old unused entries.<BR><BR>-Arran<BR><BR>Arran Cudbard-Bell<BR>a.cudbardb@freeradius.org<BR><BR>RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time.<BR><BR><BR><BR><BR>------------------------------<BR><BR>Message: 6<BR>Date: Mon, 12 Sep 2011 16:25:14 +0200<BR>From: Arran Cudbard-Bell <a.cudbardb@freeradius.org><BR>Subject: Re: Best Practices - maximum NAS entries in clients.conf<BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Message-ID: <CA2EA7A1-A06B-428C-9259-DEE20CFAC278@freeradius.org><BR>Content-Type: text/plain; charset=us-ascii<BR><BR>> Fone: 254-295-4658<BR>> Phax: 254-295-4221<BR><BR><BR>Nice :)<BR><BR>Arran Cudbard-Bell<BR>a.cudbardb@freeradius.org<BR><BR>RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time.<BR><BR><BR><BR>------------------------------<BR><BR>Message: 7<BR>Date: Mon, 12 Sep 2011 07:41:16 -0700 (PDT)<BR>From: Bruce Nunn <ironrake@yahoo.com><BR>Subject: Re: Best Practices - maximum NAS entries in clients.conf<BR>To: FreeRadius users mailing list<BR><freeradius-users@lists.freeradius.org><BR>Message-ID:<BR><1315838476.43108.YahooMailNeo@web110413.mail.gq1.yahoo.com><BR>Content-Type: text/plain; charset=iso-8859-1<BR><BR>If the network your APs are on is physically secure, and you don't need accounting for individual APs, you can use netmasks to define clients in the clients.conf file.<BR><BR><BR><BR>----- Original Message -----<BR>From: "Sallee, Stephen (Jake)" <Jake.Sallee@umhb.edu><BR>To: freeradius-users <freeradius-users@lists.freeradius.org><BR>Cc: <BR>Sent: Monday, September 12, 2011 9:04 AM<BR>Subject: Best Practices - maximum NAS entries in clients.conf<BR><BR>@ everyone<BR><BR>We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine.? We will be expanding our infrastructure soon and the number of NAS entries will increase significantly.? At what point should we think about putting them into a database for FR to use?<BR><BR>Also, I have seen some chatter on the list about dynamic NASs.? Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR?<BR><BR><BR><BR>------------------------------<BR><BR>Message: 8<BR>Date: Mon, 12 Sep 2011 07:44:25 -0700 (PDT)<BR>From: Rajkumar balaji <rajkumar.balaji.s@gmail.com><BR>Subject: Unable to Authenticate with SHA Password<BR>To: freeradius-users@lists.freeradius.org<BR>Message-ID: <1315838665841-4794449.post@n5.nabble.com><BR>Content-Type: text/plain; charset=us-ascii<BR><BR>Hi All,<BR><BR>I am unable to authenticate the When I send SHA password to the FreeRADIUS.<BR><BR>I have configured SHA-Password := "admin123" in the users file.<BR>My Password is admin123 and after SHA messagedigest its<BR>-50-2710713-59-76-1105593-48-89-126-957495-4-108-29-81-48<BR><BR>RADIUS is getting the request but its rejecting it.<BR><BR>Please find the following radius logs,<BR><BR>rad_recv: Access-Request packet from host 172.17.148.152 port 50459, id=0,<BR>length=111<BR> User-Name = "emsadmin"<BR> User-Password =<BR>"-50-2710713-59-76-1105593-48-89-126-957495-4-108-29-81-48"<BR> NAS-Identifier = "sunems8-zone2"<BR># Executing section authorize from file<BR>/usr/local/etc/raddb/sites-enabled/default<BR>+- entering group authorize {...}<BR>++[preprocess] returns ok<BR>++[chap] returns noop<BR>++[mschap] returns noop<BR>++[digest] returns noop<BR>[suffix] No '@' in User-Name = "emsadmin", looking up realm NULL<BR>[suffix] No such realm "NULL"<BR>++[suffix] returns noop<BR>[eap] No EAP-Message, not doing EAP<BR>++[eap] returns noop<BR>[files] users: Matched entry emsadmin at line 204<BR>++[files] returns ok<BR>++[expiration] returns noop<BR>++[logintime] returns noop<BR>++[pap] returns updated<BR>Found Auth-Type = PAP<BR># Executing group from file /usr/local/etc/raddb/sites-enabled/default<BR>+- entering group PAP {...}<BR>[pap] login attempt with password<BR>"-50-2710713-59-76-1105593-48-89-126-957495-4-108-29-81-48"<BR>[pap] Using SHA1 encryption.<BR>[pap] Configured SHA1 password has incorrect length<BR>[pap] Passwords don't match<BR>++[pap] returns reject<BR>Failed to authenticate the user.<BR>Using Post-Auth-Type Reject<BR># Executing group from file /usr/local/etc/raddb/sites-enabled/default<BR>+- entering group REJECT {...}<BR>[attr_filter.access_reject] expand: %{User-Name} -> emsadmin<BR> attr_filter: Matched entry DEFAULT at line 11<BR>++[attr_filter.access_reject] returns updated<BR>Delaying reject of request 1 for 1 seconds<BR>Going to the next request<BR>Waking up in 0.9 seconds.<BR>Sending delayed reject for request 1<BR>Sending Access-Reject of id 0 to 172.17.148.152 port 50459<BR>Waking up in 4.9 seconds.<BR>Cleaning up request 1 ID 0 with timestamp +6002<BR>Ready to process requests.<BR><BR><BR><BR><BR>--<BR>View this message in context: http://freeradius.1045715.n5.nabble.com/Unable-to-Authenticate-with-SHA-Password-tp4794449p4794449.html<BR>Sent from the FreeRadius - User mailing list archive at Nabble.com.<BR><BR><BR>------------------------------<BR><BR>-<BR>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<BR><BR><BR>End of Freeradius-Users Digest, Vol 77, Issue 42<BR>************************************************<BR></DIV></DIV></DIV></DIV></BLOCKQUOTE></DIV><BR>
<DIV><SPAN style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium Helvetica; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px" class=Apple-style-span>Arran Cudbard-Bell<BR><A href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</A><BR><BR>RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time.</SPAN> </DIV><BR></DIV></DIV></includetail></DIV>