November 2007 - Freeradius-Users - lists.freeradius.org

log radius users
by stefek143 20 Nov '07

20 Nov '07

Hi Everybody. Is possible to log which pupil were used my radius system if i using eap-tls method to auth and ldap to autz if is possible, could you help me show what i have to change in confings Thank You.

2 1

licensing issue
by jerry jose 20 Nov '07

20 Nov '07

respected, i would like to implement the services of Freeradius server for one of our upcoming projects(Voip based application).i would like some information regarding : 1)i would like the server to interact with one of our clients programs and perform some some data retrieval tasks,ie the server recieves a request and will call an external program to perform the remaining tasks.i would like to know whether such an external program would come under GPLV2 or 3.The server performs the redirection the rest processing is performed by our application, the result will be notified by the server to the client. 2)can freeradius be used in windows (with cygwin) awaiting your reply. regards

2 1

Re:FreeRadius for wireless authentication
by cdemel 19 Nov '07

19 Nov '07

Hi I am new to radius and the list. I need to configure a free radius server to authenticate wireless users using the Organisations CA certificate which is on Netscape. wireless users will use individual certificates which are generated from the CA of the organisation. any help or documentation mostly appriciated. regs Cdem

1 0

DEFAULT entry in users file (1.0.5-->1.1.7)
by Martin Pauly 19 Nov '07

19 Nov '07

Hi everybody, sorry to ask, but I don' get it. I'm still trying to upgrade from 1.0.5 to 1.1.7. Previously, my users fiel looked like this: [some static entries for special users] [some entries with Auth-Type=Reject for special conditions] DEFAULT Auth-Type = LDAP, Called-Station-Id == "our-dialup-number" Service-Type = Framed-User, Framed-Protocol = PPP, [more reply-items for dialup users] # All other requests: simply match against LDAP # Replace 'outer' attribute User-Name with value from variable # ==> This yields the true username from inside the tunnel in case of # anonymous outer identification with 802.1x DEFAULT Auth-Type = LDAP User-Name = `%{User-Name}`, Reply-Message = "Matched DEFAULT user entry in staff-RADIUS" So all my normal users' passwords are checked against LDAP, using LDAP bind-as-user. There's a properly configured LDAP section in radiusd.conf, of course. With 1.1.7 (and perhaps with any version >=1.1.4), Auth-Type = LDAP seems to be gone, but what on earth do put there instead? The static entries (with cleartext-password for 1.1.7) work fine, With a users file like DEFAULT User-Name = `%{User-Name}` the server complains loudly about the missing Auth-Type when asking with radtest: rad_recv: Access-Request packet from host 127.0.0.1:41995, id=59, length=58 User-Name = "martin" User-Password = "testpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "pauly0", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pauly0" rlm_realm: Proxying request from user pauly0 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 69 radius_xlat: 'pauly0' modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. So how do I direct the server to use LDAP without setting Auth-Type? Or is radtest somehow the wrong test tool in the new scenario?? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 2

Rlm_sqlcounter - how to configure weekly reset on every Sunday?
by Lee Sing Chyun 19 Nov '07

19 Nov '07

Hi, I'm trying to configure a sqlcounter that is reset every Sunday 0:00AM: sqlcounter weeklycounter { counter-name = Weekly-Session-Time check-name = Max-Weekly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = weekly # For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } After that, I did a radtest. From the resulting SQL trace, I notice "%b" is expanded as 7 days earlier than today. For instance, when running radtest on 20 Nov 2007 1:16AM (a Tuesday), "%b" gets expanded to 13 Nov 2007 0:00AM (a Tuesday too), which is not my desired outcome. Hence, how do I configure a sqlcounter that is reset every Sunday 0:00AM? Thanks in advance, and sorry if there're any obvious mistakes that I have overlooked. -- sc

1 0

AAA Services with multiple SQL
by Paolo Serafino Via 19 Nov '07

19 Nov '07

I've configured my freeradius conf files to accept Authorization and Accounting Request using two different sql instances and driving them with Realms, looking at various posts about this argument. It works with accounting, but not with authorization. I've run freeradius in debug mode (freeradius -x) and i saw that it loads the right sql instance depending the right realm, but it EVER gives "wrong username and password" despite i copy the sql query that i see in the debug and i get my username!!!!!! ### radiusd.conf authorize { Autz-Type wic { wic } Autz-Type no { no } } ### users DEFAULT Mikrotik-Realm == "wic", Autz-Type := "wic" DEFAULT Mikrotik-Realm == "novara", Autz-Type := "no" and in my NAS i put that realms.... -- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a138332… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

force reject user without password
by Marc delavaud 19 Nov '07

19 Nov '07

I have users who try to authenticate without password, this cause load on my ldap server Mon Nov 19 15:05:59 2007 : Auth: Login incorrect: [mike/<no User- Password attribute>] (from client localhost port 0) Mon Nov 19 15:05:59 2007 : Auth: Login incorrect: [mike/<no User- Password attribute>] (from client How can force reject users without password provided ? ----------------------------------- Marc Boisis-Delavaud tel: 05 46 45 82 14 Centre de Ressources Informatiques Université de La Rochelle -----------------------------------

1 0

Re: in vs. out
by wlan＠mac.com 19 Nov '07

19 Nov '07

Hi Alan, > No. The standard is the RFC. The portmaster text is just > additional > text from the people building RADIUS systems. > > It is NOT vendor specific. Do NOT say it is vendor specific. > Ok... I deserve a good slap for that one ;) I will start thinking of it as vendor specific brokenness. But, my reality remains the same.. the meaning depends on the NAS being broken or not. >>> Follow the standards. Do not follow broken vendors. >> >> It actually isn't just that one vendor... in fact, if not >> mistaken, much >> of the commercial wlan gear I've worked with used the above >> meaning. It >> would be curious to see a list of vendors and how they implemented >> their >> accounting... if we all checked the manuals of the devices we >> use, we >> could all help build that list in the freeradius wiki! > > Feel free to start this effort. > I will ... maybe at: http://wiki.freeradius.org/NAS_Accounting_Differences > There are many other vendor products that are very broken with > respect > to RADIUS. Do NOT follow any individual vendor, or even groups of > vendors. Follow the standards. If the standards aren't clear, ask on > the IETF RADEXT mailing list. The people there should be able to give > conclusive answers. > Unfortunately, from a back-end perspective, if having to support a variety of 'broken' commercial vendors, one doesn't have much choice (apart from not supporting these vendors). I guess we have to live with it as it would probably be difficult for these vendors to change their ways now... David

9 15

Benchmark test score about the performance of this server
by Liangliang Guo 19 Nov '07

19 Nov '07

Hi everyone: -Does any one have some measurement counters or benchmark test score about the performance of this server when using mysql database backend? For example 3000 requests/s for 5 millions users with 98% latency within 0.0X second on Netra 240 ......? -In my understanding this kind of figures may vary on the authentication method and backend type? Am I right? Br /Liangliang Guo

2 1

Authorization and account methods that the free radius supports?
by Liangliang Guo 18 Nov '07

18 Nov '07

Hi everyone: Does anybody know what kinds of authorization and account methods that the free radius supports. At the official wiki, authentication methods are documented in details. However for authorization methods only some supported database backbends are described, and for accounting only some conceptual introduction to accounting are available? Can anyone throw some lights on them. Best Regards /Liangliang Guo

1 0