June 2006 - Freeradius-Users - lists.freeradius.org

Accounting problem
by Antonio Matera 13 Jun '06

13 Jun '06

Hi, I tried to configure my freeradius with EAP-PEAP auth with accounting. My aim is to have unique account, in other words only one user can access with the same user and password. I read that there are two method for accounting the first is using the radutmp file and the second is using the sql accounting. I configured my radius.conf file in this way: preacct { preprocess acct_uninque suffix } accounting { acct_unique detail unix radutmp } seassion { radutmp sql (??) } In my sql.conf file I had uncomment the simul_count_query. In this way I suppose that I have enabled both account types. When I try to connect 2 laptop with the same user and password, both are authenticated and if I see the radacct table or I write in console radwho I can find the accounting of the same user two times. What is wrong in my configuration? It is possible to do accounting without the sql database? Does Anyone know a guide for configure accountig? Thanks a lot. Bye Antonio

2 2

radiusd crashing on FreeBSD 6.0
by Paul Khavkine 12 Jun '06

12 Jun '06

Hi Guys. I have radiusd 1.1.2 from the latest FreeBSD port crashing strangly during a stress test. I'm not sure where exactly it occurs because no core dump is produced. Even when ran inside gdb, i can't get any backtrace info at all: srv03# gdb /usr/local/sbin/radiusd GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... (gdb) run -f Starting program: /usr/local/sbin/radiusd -f warning: Unable to get location for thread creation breakpoint: generic error [New LWP 100255] Mon Jun 12 16:39:46 2006 : Info: Starting - reading configuration files ... [New Thread 0x8077000 (LWP 100255)] Program terminated with signal SIGABRT, Aborted. The program no longer exists. (gdb) bt No stack. (gdb) My system is FreeBSD 6.0-RELEASE-p2. Core dumps are turned on in radiusd.conf, the system core file limit is set to unlimited and i'm running the server as root. It does crash when run with -x with a free() error: in free(): error: chunk is already free Program terminated with signal SIGABRT, Aborted. The program no longer exists. (gdb) bt No stack. (gdb) It does NOT crash when ran with -X Does anyone have an idea how i can debug it further ? Thanx Paul

1 0

Logging
by Cliff Hayes 12 Jun '06

12 Jun '06

Hello all, Making good progress learning Freeradius. With your help, my new server is running and authenticating now. However, we are used to being able to see logs of all activity (tail -f logfile). With Freeradius, nothing is being written to the logs unless there is a problem. How can I get the logs to show the same stuff that scrolls when Freeradius is in debug mode? That's the level of detail we're used to seeing in the logs. Thanks, Cliff

3 9

RE: Cisco 1130AG w/Radius
by Patrick Daley 12 Jun '06

12 Jun '06

Thank you so much, it helped. Thank you, Patrick Daley AgniTEK 979-260-8324 x304 pdaley(a)agnitek.com www.agnitek.com -----Original Message----- From: freeradius-users-bounces+pdaley=agnitek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+pdaley=agnitek.com@lists.freeradius.org ] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Monday, June 12, 2006 12:56 PM To: FreeRadius users mailing list Subject: Re: Cisco 1130AG w/Radius Hi, > I am having a little trouble getting freeRADIUS to work on my Cisco > 1130AG's. If someone has experience using these with their radius > server, please respond with all the steps you have taken to have it > work, e.g., where and what you put in IOS and on what pages. I for the > life of me can not get it to work. I have tried for weeks. I appreciate > ANY feedback and welcome all suggestions. The cisco documentation is very clear on how to configure for RADIUS on an 1130AG. http://cisco.com/en/US/products/hw/wireless/ps430/products_configuration _guide_chapter09186a0080606d3b.html I dont use the webGUI or management tools either, the command line is a fast and accurate way of configuring the devices. If you use the 1130AG in LWAPP mode, then you'll need to be looking at your WCS device settings for configuring RADIUS alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Cisco 1130AG w/Radius
by Patrick Daley 12 Jun '06

12 Jun '06

I am having a little trouble getting freeRADIUS to work on my Cisco 1130AG's. If someone has experience using these with their radius server, please respond with all the steps you have taken to have it work, e.g., where and what you put in IOS and on what pages. I for the life of me can not get it to work. I have tried for weeks. I appreciate ANY feedback and welcome all suggestions.

3 2

Freeradius 1.1.1: 'radclient' incorrect Authenticator value
by Robles Rodriguez,Alejandro 12 Jun '06

12 Jun '06

Hi, I'm using freeradius 1.1.1 and trying to performance test it using as client the 'radclient' utility program. I have been experiencing some problems when load testing it since freeradius was responding in some cases responding to the client with old (already sent) responses when in fact the request was different (Attribute-wise at least). ... rad_recv: Access-Request packet from host 10.66.20.20:36426, id=235, length=110 Sending duplicate reply to client localtest:36426 - ID: 235 Re-sending Access-Accept of id 235 to 10.66.20.20 port 36426 ... After struggling a bit I noticed that the Access-Requests sent by 'radclient' where all having the same Authenticator value for the same request ID (0-255). In some cases the cached reply was gone before the next request with the same Authenticator value came hence a brand new reply was generated however it became a problem otherwise (reply still in the cache). Have any of you guys noticed this problem and do you have a solution to it (besides changing the code)? My test files contain at least 1000 Access-Requests each therefore the IDs will be reused. I might be mistaken but one odd thing is that I see a comment in the code saying that if a request has already been used then it needs to make sure that the Authenticator value is unique. However I don't see that happening in the code actually ('radclient.c', function 'request_free'): /* * If we've already sent a packet, free up the old one, * and ensure that the next packet has a unique * authentication vector. */ if (radclient->request->data) { free(radclient->request->data); radclient->request->data = NULL; } Thank you! Regards, Alex.

2 1

Multiple LDAP authentication
by fvt3 12 Jun '06

12 Jun '06

Hi, Is it possible to authenticate off of one ldap server and/or off another ldap server. I have multiple ldap servers that freeradius server needs to authenticate off. If it is possible, how can I accomplish this? thanks... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

NAS Server Type
by Cliff Hayes 12 Jun '06

12 Jun '06

I am a new FreeRadius user and am attempting to switch to FreeRadius. I am trying to switch from clients.conf to the MySQL NAS table. There is a field named "type" which, per http://www.freeradius.org/radiusd/doc/README has one of the values below. However, when I call our primary carrier, they don't have that information and have never been asked that question. Is "type" a required field? 3Com/USR Hiper Arc Total Control usrhiper 3Com/USR NetServer netserver 3Com/USR TotalControl tc Ascend Max 4000 family max40xx Cisco Access Server family cisco Cistron PortSlave portslave Computone PowerRack computone Cyclades PathRAS pathras Livingston PortMaster livingston Multitech CommPlete Server multitech Patton 2800 family patton Thanks, Cliff

3 2

Stale sessions
by Stelio Gouveia 12 Jun '06

12 Jun '06

Im using the following configuration to handle sessions # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } My problem is that im getting Access-Reject packet every now and then (My users are logging in and out correctly... and my NASes are all up and functioning) According to this thread http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-March/04233… - radutmp must be enabled I have noticed that you cant rely on the sql method, even thou there is a simul_count_query! In my case when i encounter a stale session i set the AcctStopTime = AcctStartTime + AcctSessionTime. Although this seems to work most of the time, its not fool proof as can be seen in this case study: http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-June/054073… My question is why cant you rely on only the sql method? And what is the correct method to clean stale session when using the sql session handling?

2 1

Issues with sessions
by Stelio Gouveia 12 Jun '06

12 Jun '06

Using freeradius 1.0.2 with rlm_sql_postgres, all my users are defined in my DB and all my accounting is stored in this manner too. I have simultaneous-use set to 1. Only 1 user can login at a time! Let me present my case and then i will detail what i think is happening on my radius server. Firstly, my users have a problem when trying to login to my radius. Sometimes it lets then in first time, othertimes they need to try multiple times. So i tested the authentication by using the radtest tool locally with valid users on my system. Radius would respond with the following pattern: Access-Accept, Access-Accept, Access-Reject. (There has been some variations, but generally this pattern occured) When i do get a reject, radius spits out the "You are already logged in message". But i do notice that the reject radius reply from a radtest gives me a strange looking password [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 202 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=202, length=20 [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 206 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=206, length=20 [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 210 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 Re-sending Access-Request of id 210 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "\205t\2673VxL\214\264\255\212Lmu\214\337" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=210, length=20 Heres my # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } *My system works for a bit if i uncomment radutmp. about 30 mins if i have 20+- users active* Alan if you out there please give me some pointers! Regards, the aspiring radman.

2 1