October 2007 - Freeradius-Users - lists.freeradius.org

Load Balancing user requests to multiple LNS's
by Adrian 22 Oct '07

22 Oct '07

Hello Everyone, I am trying to configure our free-radius server to send multiple LNS L2TP parameters to a customer's radius server for establishing an L2TP tunnel prior to the user authenticating. Apparently these responses will have to exist in every request however the Customer will only establish an L2TP session if one doesn't exist already. As per their documentation, I would have to do something like below, where the :1: would be L2TP tunnel 1 and :2: would be Tunnel 2: Service-Type=framed Tunnel-Medium-Type=:1:IP Tunnel-Medium-Type=:2:IP Tunnel-Password=:1:password Tunnel-Password=:2:password Tunnel-Type=:1:L2TP Tunnel-Type=:2:L2TP Tunnel-Server-Endpoint=:1:X.X.X.X Tunnel-Server-Endpoint=:2:Y.Y.Y.Y Tunnel-Preference=:1:1 Tunnel-Preference=:2:1 The tunnel-preference would tell them to load balance between Tunnel Server Endpoint 1 and 2. I have loaded all this in a group in the radgroupreply and assigned the group to the user table however when I query the radius I only get the first tunnel info back to me. Can anyone point me in the right direction? In the radius logs there are no errors logged and it just shows the replies it sent to the customer which excludes the :2: tunnel information. I'm using Freeradius 1.0.4 with a mysql config. Thanks Adrian Boros

4 3

allowing multiple values through the attribute filter
by A.L.M.Buxey＠lboro.ac.uk 22 Oct '07

22 Oct '07

hi, i've got a remote site that we want to trust a few return attributes from.... no problem. configured. however, there are 2 different attribute values for one of the attributes and i'm not quite sure of the syntax available for use....eg realm.com Session-Timeout <= 28800, Idle-Timeout <= 600, Tunnel-Medium-Type == IEEE-802, Tunnel-Type == VLAN, Tunnel-Private-Group-Id == testvlan this works...and allows ONLY 'testvlan' attribute to be returned but I also need to accept 'othervlan' and a structure of Tunnel-Private-Group-Id =~ ( /^testvlan$/ || /^othervlan$/ ) doesnt do what i need. is this do-able in attribute filter or can I construct something in unlang (this is a 2.0.0pre2 server) thanks alan PS I've tried setting 2 values...as per the Framed-Protocol == PPP, Framed-Protocol == SLIP, part.....eg Tunnel-Private-Group-Id == testvlan, Tunnel-Private-Group-Id == othervlan, but that just stops EITHER of the return attributes from working. bug?

3 2

concurrency query
by Punith Raj 22 Oct '07

22 Oct '07

Hi all I have a doubt regarding concurrency in freeradius. If freeradius recives an eap-sim packets while it is authenticating one currently, will the new packet ll' wait for the prior to complete or both ll be authenticated simultaniously. I could see thread implementation in eapsim directory but just wanted to make sure once. Thanks in advance -- Regards Punith

2 2

Setting a conditional variable
by mozart＠pisem.net 21 Oct '07

21 Oct '07

Hi everyone! I'm trying to set a conditional variable in my sql.conf. According to value of %{NAS-Port-Type} my variable (i.e. MYVAR) should be assigned to value returned by different programs through 'exec' module. I couldn't find any examples how to do it. So I will appreciate if someone helped me. ps. I'm using version 1.1.2 from FreeBSD ports collection.

2 1

rlm_ippool: Could not find Pool-Name attribute
by hyunok 19 Oct '07

19 Oct '07

Hello, I have a freeradius 1.1.7 server setup with ppp and pptp using a mysql DB for user authentication. radiusd -xx ............. rlm_ippool: Could not find Pool-Name attribute ........... ........... modcall[accounting]: module "radutmp" returns ok for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "dialup" returns noop for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "sp_pool" returns noop for request 1 ----------------------------------------------------------------- radiusd.conf ippool dialup { range-start = 172.16.0.1 range-stop = 172.16.0.125 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } ippool sp_pool { range-start = 172.16.1.1 range-stop = 172.16.1.125 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippoolsp ip-index = ${raddbdir}/db.ipindexsp override = no maximum-timeout = 0 } ------------------------------------------------ post-auth { # main_pool dialup sp_pool # sqlippool # sql # ldap } --------------------------------------------------- accounting { detail # daily radutmp # sradutmp # main_pool dialup sp_pool # sqlippool sql } users file ----------------------------------- DEFAULT Pool-Name := dialup Fall-Through = Yes DEFAULT Pool-Name := sp_pool Fall-Through = Yes DEFAULT Group == dialup, Pool-Name := "dialup" DEFAULT Group == sp_pool, Pool-Name := "sp_pool"

2 1

clients linux to freeradius
by lvizcardof＠unsa.edu.pe 18 Oct '07

18 Oct '07

Hello. How do I do for that my clients linux (fedora core 4) soliciten autenticarse ante el servidor freeradius antes de conectarse a la red. Should I install an additional program for my client lunix asking for authentication?. Or is only necessary in some file modoficacion sde linux, as I did in Windows. Liset Vizcardo ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

issue with mysql accounting
by Jan Satko 18 Oct '07

18 Oct '07

Hi. I have WIFI network based on Cisco Aironet 1130 with WPA/TKIP - EAP-PEAP. Radius server is freeradius (just upgraded to 1.1.7) with mysql backend (users,accounting). Everything worked fine for maybe 2 years. Just atm i have a new problem. Some APs got new IOS and i noticed that now is not sending User-Name like name@real but is sending MAC address as Username. This "MAC address" username i got also as system enviroment variables. On other APs with old IOS i got also problem. Some users got some new software for connecting to the network(suplicant) where they can set some "fake" outer username. Ofc users can authenticate against radius without problems. I think its because inner authentication variables (MS-CHAPv2 login name?) which freeradus use for authentication. So it looks like (for me) that AP is sending "outer" information for accounting. Maybe there is some option howto force AP to show inner username ? Back to MYSQL. Mysql atm is logging "fake usernames" or MAC addresses as UserName into radacc table. BUT mysql is logging correct username (inner) into radpostauth. Any chance howto solve this problem ? I want to log username like for radpostauth. Also want this username as system enviroment variable so i can make some start/stop scripts where i can use it. I noticed that TTLS has some options in eap.conf about tunneled-reply or variables. But i have dozen of users(usually students) which have only XP/Vista with PEAP plugin. Cannot force them to install TTLS (if TTLS will works). Tyvm for help. S pozdravom -- Bc. Jan 'EIS' Satko Slovak University of Agriculture network & system manager Tr. A. Hlinku 2 Tel: +421 37 7412 616 949 76 Nitra Slovakia

2 2

Freeradius logging w/syslog
by ballgyer＠mac.com 18 Oct '07

18 Oct '07

Hi Alan, Ok, seems the default install is dated that comes with CentOS 4.4... I've upgraded to FreeRADIUS Version 1.1.7 now and logging seems to be working but I'd like to be able to get more usable data. I nthe /etc/syslog.conf file I have this entry: # .* will log all messages in the same log file local1.* /var/log/radius/radius.log From the syslog server I see this data: Oct 17 19:11:16 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:12:06 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:12:26 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:13:52 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= But I'd like to see the User_Name and Client_Name similar to what you in localhost:/var/log/radius/radius.log file. Thanks again,

2 1

accounting update
by Daann 18 Oct '07

18 Oct '07

I'm trying to do something like http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html this tutorial so that traffic is collected at a regular intervals. The only thing is that they use a cisco router, which has some shell command configuration (I suppose?), anyway, I don't think my router supports the aaa accounting update commands, neither it has many configuration options. Is there any way to work around this. Freeradius server and client run on a linux computer, with apache, and chillispot(for web based login). Greetz Daan EDIT: Could someone post me some more info about the Acct-Interim-Interval command, how this works and if this could be a workaround for traffic collection on a regular base. I saw on this site how someone did this. >I use freeradius & MySQL. I am able to set frequency of acct update by setting attribute Acct-Interim-Interval in rad[group]reply table to number of seconds between updates. > but I'd like to have some more detailed instructions on what to do. Thanks in advance -- View this message in context: http://www.nabble.com/accounting-update-tf4635760.html#a13238963 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

radcheck & NAS-identifier
by YvesDM 18 Oct '07

18 Oct '07

Hi, FR + mysql auth&acct. Sometimes I need to restrict users or groups to acces a certain NAS. I use the nas-identifier attribute to recognize the nas To accomplish this I just add an entry to radcheck or radgroupcheck like this NAS-identifier != nas-name This works fine but, sometimes I use radtest directly on the server to test accounts if someone claims he/she is unable to login. Now for every user/group I've set the above entry in the database, radcheck on the server always returns an acces-reject for some reason. Though, users can login the nas's they are allowed to and get rejected on the certain nas I've specified, so the setup itself is working. But I've kind of lost my "account testing utitlity" :-) I don't understand why radcheck fails on these accounts. I understand radcheck doesn't send any nas-identifier, but I used operator ' ! = ' and not ' ==' so shouldn't the radius accept radtest requests on localhost? I 'm sure there is a good explanation why radtest returns an Acces-reject, but I'd like to know why and, if possible, if there is a solution/work-around for this. Many tnx, Y.

1 0