October 2005 - Freeradius-Users - lists.freeradius.org

Online Status & SQL
by Gunther 06 Oct '05

06 Oct '05

Hi, What is the second easiest way to know who is online beside radwho when using FR & MySQL. The radacct table seems to be the only place. Will it be sufficient just testing if AcctStopTime is 0? I saw some 'old' sessions in the table, which have AcctStopTime = 0 and no terminate cause. These 'zombies' would have to be cleaned by a watchdog ... (Note: Zombies were left under FR 1.0.4, now I'm on 1.0.5 and no zombies so far). Am I on the right track here? Thanks!

2 1

RE: Call-Check
by Jonathan De Graeve 05 Oct '05

05 Oct '05

>From the site: RADIUS Debugging File FreeRADIUS server does not support preauthentication. There is no example for this case. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens King, Michael Verzonden: woensdag 5 oktober 2005 20:08 Aan: FreeRadius users mailing list Onderwerp: RE: Call-Check I wonder if it's this one? http://www.cisco.com/univercd/cc/td/doc/product/voice/sipproxy/radiusps/ radpreau.htm > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, October 05, 2005 2:01 PM > To: FreeRadius users mailing list > Subject: Re: Call-Check > > Ivo <ml.radius(a)ultra.hr> wrote: > > Can someone tell me is it possible to get freeradius respond to > > Service-Type==Call-Check requests? > > I don't see why niot. > > > I have read on cisco's web pages that it is not possible. > > Please post the URL. > > > Namely, I would like to check for valid caller-id before > answering the > > call and going on with username/password check. > > Sure. It's just data in RADIUS packets. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 4

Accounting and Cisco devices
by Ryan Klinkhammer 05 Oct '05

05 Oct '05

Is it possible receive accounting information for cisco devices. When I go to my log files I can see the start and stop of my session but don't see the commands I entered on the device. Or does freeradius not log accounting information. I am using version 1.0.5 Thanks, Ryan

4 3

RE: Call-Check
by King, Michael 05 Oct '05

05 Oct '05

I wonder if it's this one? http://www.cisco.com/univercd/cc/td/doc/product/voice/sipproxy/radiusps/ radpreau.htm > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, October 05, 2005 2:01 PM > To: FreeRadius users mailing list > Subject: Re: Call-Check > > Ivo <ml.radius(a)ultra.hr> wrote: > > Can someone tell me is it possible to get freeradius respond to > > Service-Type==Call-Check requests? > > I don't see why niot. > > > I have read on cisco's web pages that it is not possible. > > Please post the URL. > > > Namely, I would like to check for valid caller-id before > answering the > > call and going on with username/password check. > > Sure. It's just data in RADIUS packets. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Multiple Connections for One UserID
by Samson Martinez 05 Oct '05

05 Oct '05

Let me preface this with the required "I'm pretty much a newbie to freeRADIUS"... Can someone point me to the place where I can modify the number of simultaneous connections that are allowed per user? I've just now noticed that I am currently only allowed a single connection and I'd like to increase that value. Even better, can someone recommend a good resource (book, website, etc.) to supplement the freeRADIUS website? My configuration is being used to authenticate DSL connections - I have modems that terminate on an Alcatel DSLAM which are aggregated at at Juniper ERX router. The router uses the freeRADIUS configuration for auth. Thanks! -Samson

2 1

TLS Question
by Juan Daniel Moreno 05 Oct '05

05 Oct '05

Hi, I'm using freeRadius 1.0.4 and I would like to know something about tls config. When I launch radius en debug mode I get this messages: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/juan/key.key" tls: certificate_file = "/etc/raddb/certs/juan/cert.cert" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" but I would like to know how to change some parameters (like rsa_key_exchange = yes) and, even more important, if the rsa_key_length is given in Bytes or bits. Does it mean that the certificate length changes in function of this rsa_key_length? Thank you, Juan Daniel MORENO

2 1

Call-Check
by Ivo 05 Oct '05

05 Oct '05

Hi, Can someone tell me is it possible to get freeradius respond to Service-Type==Call-Check requests? I have read on cisco's web pages that it is not possible. I am using PM3 RAS with "set call-check on" option set. Namely, I would like to check for valid caller-id before answering the call and going on with username/password check. If it is possible, some pointers would be very appreciated... TIA Ivo.

2 1

Success Story (A tribute to the FreeRADIUS project)
by Lefteris St 05 Oct '05

05 Oct '05

Hello everyone, I am writing this -long overdue- letter to express my gratitude to all FR developers and other people who help through this mailing list. I may not be an active poster, but this list's archive has been a tremendous help during my involvement with FreeRADIUS. Thanks to the intense support (and of course great open source software), my project was a success and I managed to learn a couple of things too :-). To whom it may concern, I have deployed the following setup for my Univercity wifi hotspot: WiFi users connect to APs in the Univercity premises. Authentication follows two scenarios (depending on the particular AP site): Scenario A or NoCat Scenario (low security): -A NoCat captive gateway runs on a PC connected directly to the AP (or the AP itself, for embedded devices). This PC is also responsible for DHCP, firewall rules etc... -The user's web browser is redirected to the login page hosted at the AAA server for this building. There runs the NoCat Auth Server and (of course) a FreeRADIUS server. the NCA server gives the user credentials to FR, who in turns authorizes them against the local Windows AD (where Univercity users reside) and a mysql database (for temporary wifi accounts -can be duration-restricted). -After the NoCat gateway lets the user in, it periodically sends accounting information to the FR server (to be stored in the mysql DB). Scenario B or EAP scenario (high security): -A FreeRADIUS proxy runs on a PC connected directly to the AP (or the AP itself, for embedded devices). This PC is also responsible for DHCP, firewall rules etc... -The AP has WPA-Enterprise enabled and connects to the proxy FR for authentication. -Users IEEE.1X clients for EAP authentication (mainly PEAP). -The FR proxy forwards authentication packets to the central FR server (the same one as scenario A) who authenticates ands authorizes against the Windows AD and mysql DB. -Accounting packets are sent either by the AP (through the proxy) or a NoCat gateway (set in "Open" mode) which runs at the same PC with the proxy. Accounting information is monitored through the dialup_admin front-end, which is also used for temporary wifi accounts (that go in the mysql db). (The above may imply a large scale deployment but there are only two APs for now :-) [both running scenario A].) That's about it in a nutshell. I named the whole system the WAL (Wireless Aueb -my Univercity- Lan). As you can see, I have also made heavy use of the NoCat project (thanks to everyone in that mailing list/developer team too!!) but it saddens me to see that it got stuck in version 0.82 :-(. Anyway, thanks again and keep up the good work. I am not done with FR just yet, so I'll ne seeing you all :-). Stefanis Eleftherios MsC Student in Computer Science AUEB PS: Sorry for the long post, I just thought it would be nice for people to see what FR (combined with other great open source software) can do in a complete WiFi deployment. PS2: The total software cost for the WAL was 0$ and took one person (me) a total of about 2 months to architecture and setup. __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Re: No updates with radiusd log
by john＠jetcityorange.com 05 Oct '05

05 Oct '05

Thanks Alan. I was trying to debug but not in full debugging mode. I'll give that a shot. Thanks again, John > -----Original Message----- > From: Alan DeKok [mailto:aland@ox.org] > Sent: Wednesday, October 5, 2005 01:07 AM > To: 'FreeRadius users mailing list' > Subject: Re: No updates with radiusd log > > john(a)jetcityorange.com wrote: > > When we attempt to access the FreeRadius server via a remote AP, the > > radiusd log shows nothing. > > Run the server in debugging mode to see what it's doing, and why. > > This is mentioned in the FAQ, README, INSTALL, and daily on this list. > > > No attempt, nothing. Yet the XP client shows a 'validating > > identity' message. However, I see nothing in the logs to debug. > > Accounts are set to local authentication via EAP-TLS. > > EAP-TLS doesn't use local authentication. It uses certificates. > Perhaps that's the problem. And debug mode *will* explain this. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

RE: PID variable
by Jonathan De Graeve 05 Oct '05

05 Oct '05

Pidof freeradius will also do -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Josh Howlett Verzonden: woensdag 5 oktober 2005 11:21 Aan: FreeRadius users mailing list Onderwerp: Re: PID variable [root@lichen ~]# cat /var/run/radiusd.pid 10163 josh. Abdul Lateef wrote: > Hi all, > > How i can retrive the current pid value of freeradius > in Shell script. > > I wanted to create one shell script to run in linux > corn commond. because our database is very slow and > always radius is going to crashed when it receives > more than 1000 request. so my script will check if the > radius is crashed it will start automatically using > cron. > > Is anyone have good logic to auto restart radius when > it will be crashed? > > > > -------- > Yours, > Abdul Lateef > Computer Programmer > HATIF COM > Mob: +974 - 5405022 > Tel: +974 - 4883068 > ICQ: 276994704 > YM!: abdul_zu > Fax: +974 - 4883063 > Doha Qatar > http://www.hatif.com > > > > __________________________________ > Yahoo! Mail - PC Magazine Editors' Choice 2005 > http://mail.yahoo.com > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0