June 2007 - Freeradius-Users - lists.freeradius.org

FreeRadius 2.0 Debian Packages available yet ?
by George Embrey 14 Jun '07

14 Jun '07

Has anybody published any FreeRadius 2.0 Debian (.deb) Packages yet ? George.

2 2

RE:2.0.0 documentation for radiusd.conf
by Hugh Messenger 14 Jun '07

14 Jun '07

> From: Alan Dekok <aland(a)deployingradius.com> > Oh, and "-=" works. With the "users" file, it didn't. And there are > other corner-case bugs fixed, too. Any luck fixing this stuff: DEFAULT Called-Station-Id =~ "^([A-z0-9]+_[0-9]+)$", Pool-Name := `%{0}` Framed-IP-Netmask = 255.255.0.0, Fall-Through = 1 ... in either users or hints? If you recall, I'm trying to find a way of having just one DEFAULT for setting my sqlippool Pool-Name, rather than having to have 50+ individual entries. So far no luck with the above mechanism in either users or hints files. > > Alan DeKok. -- hugh

2 1

Modifying authorization replies by a proxy
by Martin Horcicka 14 Jun '07

14 Jun '07

Hi, when the FreeRADIUS is configured as a proxy is there any way to modify the authorization replies (Access-Accept packets) before sending them to the NAS? I need to add there a few attributes (purchased connection speed etc.). Reply attributes in the 'users' file of the proxy seem to be ignored. For example, with the following record in the 'users' file proxying works well but the Framed-IP-Address attribute seems to be ignored: username Proxy-To-Realm := xxx Framed-IP-Address := "2.2.2.2" rlm_attr_rewrite does not seem to be useful in this case as I need to define the rules on a per-user basis. (FreeRADIUS 1.1.6) Martin

2 4

sql_log and sql.conf
by Stefan Winter 14 Jun '07

14 Jun '07

Hi, the accounting queries in sql.conf and the sample sql_log module in radiusd.conf are not identical. For consistency, I'd expect to find the same things there. Any specific reason, or can I just copy over the usual queries from sql.conf into that module and expect them to work? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

PEAP fatal bad_certificate
by Ruslan N. Marchenko 14 Jun '07

14 Jun '07

It seems to be not a particular question, but... client - winxp wireless, ap - AIR-AP1131AG-E-K9, server 1.1.6. fresh install. certificates generated according to CA.all (with xp-extension and conversion to pkcs12) eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = xxxxx private_key_file = ${raddbdir}/certs/merlin-crt.pem certificate_file = ${raddbdir}/certs/merlin-crt.pem CA_file = ${raddbdir}/certs/cacert.pem dh_key_length = 1024 dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 224 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 224 modcall: leaving group authenticate (returns reject) for request 224 auth: Failed to validate the user. -- Olimp, System Administrator IT Dept. Fax. +380(62)381-3428 Tel. +380(62)381-3978-5 ---- Looking forward to reading yours. RUFF-RIPE DI76-GANDI RUFF-6BONE Ruslan N. Marchenko

2 5

radius + ldap + wireless
by Martin Budi 14 Jun '07

14 Jun '07

sorry for the stupid question any body could help me how to configure freeradius with ldap and using it as wireless authentification i'm using centos 4.3 regards martin

2 1

Re: Server dies
by Hugh Messenger 14 Jun '07

14 Jun '07

> From: Alan Dekok <aland(a)deployingradius.com> > Run it under valgrind, and re-direct all of the valgrind output to a > file. What radiusd switches should I use? I've never used valgrind before, not sure if it handles daemonized and/pr threaded services, so I'm not sure if I'd need to run radiusd with -s or -X. My inclination is to use 'valgrind radiusd -xx' ... -- hugh

2 1

performace on chainging clients.conf and huntgroup
by Kevin J 14 Jun '07

14 Jun '07

Alan, I noticed that more IPs I add to clients.conf and huntgroups, more steep performance declines FreeRadius got. Guessing the linked-list. Have we considered other data structures like hashing or btree? -Kevin ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/

10 25

DB handles and radius.log errors
by Ivan Kalik 13 Jun '07

13 Jun '07

PS. Example: http://puck.nether.net/pipermail/cisco-nas/2004-January/000474.html checkrad works with one Cisco router but not with another with same configuration and same IOS version. Ivan Kalik Kalik Informatika ISP

2 2

DB handles and radius.log errors
by Irina 13 Jun '07

13 Jun '07

First, thanks to Ivan for help with Simultaneous and to Dennis with indexing. I am new to radius, please bear with me. I will try to describe the problem as much as I can. I need to ask if anybody has experienced a problem with DB handles. Here is what we have experienced a couple of times. Both NASes Cisco talk to 1 radius (there is another radius, but it was set up on NASes as a secondary radius). Many connections drop at the same time on 1 or both NASes and try to reconnect. Radius did not get a proper disconnection, therefore sees many users connected with Stop = 0. All Simultaneous Logins are set to 1, so radius checks if users are connected on NAS. Below is what I find in radius.log. Mon Jun 11 14:48:28 2007 : Error: Discarding duplicate request from client aleph:1645 - ID: 95 due to unfinished request 28856 Mon Jun 11 14:48:33 2007 : Error: Discarding duplicate request from client aleph:1645 - ID: 95 due to unfinished request 28856 Mon Jun 11 14:48:33 2007 : Error: Check-TS: timeout waiting for checkrad Mon Jun 11 14:48:48 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Jun 11 14:48:48 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Also see logouts with no Login record Mon Jun 11 14:48:52 2007 : Error: rlm_radutmp: Logout for NAS aleph port 1401, but no Login record Mon Jun 11 14:48:52 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Jun 11 14:48:52 2007 : Error: rlm_radutmp: Logout for NAS aleph port 854, but no Login record I also see few of the following for different usernames Mon Jun 11 14:50:11 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'user(a)nas.net', nas '216.145.96.1'] Then Mon Jun 11 14:50:16 2007 : Error: rlm_sql_getvpdata: database query error Mon Jun 11 14:50:16 2007 : Error: rlm_sql (sql): SQL query error; rejecting user Also, radius.log has quite few lines (could be not related to only the problem I described above, because I see the following lines in radius.log constantly, with empty string instead of a username) Wed Jun 13 09:39:26 2007 : Error: rlm_radutmp: Logout for NAS heh port 1099, but no Login record Wed Jun 13 09:39:26 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas '216.145.96.1'] I have increased num_sql_socks to 10. Is it a reasonable number? Or this does not help with this problem and I need to look more into finding and fixing it. And/or NASes problem? Any suggestion is welcome. Thank you for your help in advance. Irina ====================

2 1