July 2007 - Freeradius-Users - lists.freeradius.org

Freeradius & Juniper
by J-P Raymond 27 Jul '07

27 Jul '07

Hi, small question I know my version is old but I didn't had any problem until recently ! I'm using freeradius 0.9.3 (mandrake 10) to authenticate pppoe users ! When a juniper equipment try to authenticate it fails! (most other brand succed) They told me the field order are not send in the good order... Here is the detail reason juniper gave me : Root cause found, it is caused by that peer side modifies the options order in REJ packet. RFC1661 requires we keep the order so we think the REJ packet is invalid and drop it. So PPP can not be brought UP. Could we contact the ISP to check how they software work? sending order : [DNS_S]-->[NBNS_P]-->[NBNS_S] : SEND DECODE:(ethernet0/0) ***[IPCP ConfReq ID=0x1 <ADDR 0.0.0.0> <DNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_P 0.0.0.0> <NBNS_S 0.0.0.0>]*** --------------------------------------------------------------- Receiving order, [NBNS_P]-->[DNS_S]-->[NBNS_S] RECV DECODE:(ethernet0/0) ***[IPCP ConfRej ID=0x1 <NBNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_S 0.0.0.0>]*** Can I do something about this rapidely Thanks for your help _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

3 2

radiusd startup problem
by ram 26 Jul '07

26 Jul '07

Hi all I have installed freeradius-1.1.6 with mysql when i run radiusd -X i get the following error rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" rlm_acct_unique: Cannot find attribute 'NAS-IP-Address' in dictionary radiusd.conf[1159]: acct_unique: Module instantiation failed. radiusd.conf[1753] Unknown module "acct_unique". radiusd.conf[1747] Failed to parse preacct section. any suggestions ram

3 10

SQLIPPool performance issue
by Roy Walker 26 Jul '07

26 Jul '07

I am having a problem with the SQLIPPOOL performance. This is migration of an existing radius server using flat user files (old server is running radius 1.1.0). Running freeradius-server-snapshot-20070705 on a P4 2.8GHZ machine Database is Postgres 8.1.9 running on a monstrous Sun Opteron machine. When radius starts taking requests (it's a lot of requests, about 500/sec), the load on the radius server spikes to 100 and it eventually stops taking requests completely. The database is never above 0.05 load. I see messages like these in the radius logs: Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696841693 port 0 user 14696841693) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19723023688 port 0 user 19723023688) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696845996 port 0 user 14696845996) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696846177 port 0 user 14696846177) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696825390 port 0 user 14696825390) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14694415538 port 0 user 14694415538) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696883664 port 0 user 14696883664) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 12149915071 port 0 user 12149915071) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19728908614 port 0 user 19728908614) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19723023948 port 0 user 19723023948) Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 102 due to unfinished request 3988 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 62 due to unfinished request 3987 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 116 due to unfinished request 3989 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 121 due to unfinished request 3990 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 26 due to unfinished request 3991 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 105 due to unfinished request 3992 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 74 due to unfinished request 3993 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 29 due to unfinished request 3994 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Auth: Login OK: [12146063348] (from client nas01 port 0 cli 12146063348) I have tried playing with the numbers of threads (I used the current radius servers setting to start) and the results are the same. Anyone have any ideas? Thanks, Roy

4 15

Freeradius Multiple VLAN assigment
by George Beitis 26 Jul '07

26 Jul '07

Hi everyone, does freeradius support multiple vlan assigment?

3 2

Fwd: final rlm_perl question, hopefully...
by FreeRadius-ML 26 Jul '07

26 Jul '07

Hi All, Ok, after reviewing all the information that was received, I've setup my FreeRadius as following: 1. The authorize and authenticate sections are setup to activate digest and perl. 2. My rlm_perl script utilizes the following lines in order to return the unencrypted user password back to FreeRadius for digest authentication: $RAD_CHECK{'Cleartext-Password'} = "xxxxxx"; # Remove this line for production $RAD_CHECK{'User-Password'}="xxxxxx"; # Remove this line for production I just put these inside my script for checking, later on this information will be retrieved from an external source. Now, FreeRadius activates my rlm_perl module, no problem, as I can see the various reply fields being setup, however, I'm still getting the following error: rlm_perl: RAD_REQUEST: Client-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: Digest-Response = 632905a2325f672f049800eda7df9ee4 rlm_perl: RAD_REQUEST: User-Name = z2l(a)192.168.2.80 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Sip-Uri-User = z2l rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0xbbc93f0) rlm_perl: RAD_REPLY: Reply-Message = User accepted by z2l WSDL rlm_perl: RAD_REPLY: z2l-Duration = 60 rlm_perl: RAD_REPLY: z2l-Status = 2 rlm_perl: RAD_REPLY: z2l-Session = 833abb3d-d047-4d0d-a40e-2e147049f96d rlm_perl: Added pair Reply-Message = User accepted by z2l rlm_perl: Added pair z2l-Duration = 60 rlm_perl: Added pair z2l-Status = 2 rlm_perl: Added pair z2l-Session = 833abb3d-d047-4d0d-a40e-2e147049f96d rlm_perl: Added pair Cleartext-Password = z2l rlm_perl: Added pair User-Password = z2l rlm_perl: Added pair Auth-Type = digest perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xb933260 modcall[authorize]: module "perl" returns ok for request 5 rlm_realm: Looking up realm "192.168.2.80" for User-Name = "z2l(a)192.168.2.80" rlm_realm: No such realm "192.168.2.80" modcall[authorize]: module "suffix" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [z2l(a)192.168.2.80/<no User-Password attribute>] (from client 192.168.2.80 port 5060) Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 3 seconds... Now, my configuration is very very simple. In the authorize I have digest and perl enabled, in authenticate I have only digest enabled. If I read the debug correctly, the authorization is going ok: modcall[authorize]: module "perl" returns ok for request 5 rlm_realm: Looking up realm "192.168.2.80" for User-Name = "z2l(a)192.168.2.80" rlm_realm: No such realm "192.168.2.80" modcall[authorize]: module "suffix" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 However, the authentication section fails: rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [z2l(a)192.168.2.80/<no User-Password attribute>] (from client 192.168.2.80 port 5060) So, I'm either returning something in the wrong way, or I've broken something again. Any pointers on the issue would be highly appreciated. Regards, Z2L

2 2

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 26/7/2007, "Nicolas Velazquez" <nicolas.velazquez at >uam.es> pie: > >>Hi, >> >>We are using freeradius 1.1.6, now, to provide >>access for our wireless network only. >>The accounting is very detailed and >>comprehensive: IP addresses, usernames, packets, roles, >APs, SSIDs, etc. >> >>Now, we are starting to use the same radius to >>give 802.1x access to our wired network. >> >>The key is that the accounting records for a wired switch >are VERY different. >>Now, AP and SSID, are nonsense items, for example. >>But we need another records. >> >>Can freeradius use different accounting sql inserts >depending on NAS? >> >>Is there any document showing something like this? >>I have read many documents but I can not find a clear >answer. >> >>This was the main question. >> >>A related tiny question is as follows. >>The most comfortable configuration will be to use >>different accounting inserts depending on huntgroups. >>Then we could select sql inserts for one >>huntgroup (all our wired NASes) and different sql >>insert for another huntgroup (all our wireless NASes). >>The addition, remove or change of the different >>NASes could be made modifying only the lists contained in >the huntgroups file. >>It could be very clean and useful. >>But, when I read the huntgroups documentation I >>have the strong suspect I can´t do this. >> >>Thank you very much in advance, >> >> Nicolas Velazquez >> > >

2 1

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

>Date: Thu, 26 Jul 2007 13:31:37 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: SQL and different accounting records by NAS >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <qI6MczRx.1185453097.0743660.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas

1 0

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

>Date: Thu, 26 Jul 2007 13:31:37 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: SQL and different accounting records by NAS >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <qI6MczRx.1185453097.0743660.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas

1 0

debug_level
by VM 26 Jul '07

26 Jul '07

Hi everyone, I can't find anything the various documentation sources related to the debug_level parameter. Made a grep on the doc folder, searched Google and FreeRadius Wiki... It seems to be usually put to a value of 0. Can you explain what are the relevant values for this parameter and what it is supposed to control ? My need is to get debug information on ldap communication but could not start FreeRadius in debug mode because the resulting logs must be stored in a file for further analysis (I can't stay in front of my display waiting for a random crash to happen). Does this paramter allow this ? If not, is there another way ? Thanks in advance, Vincent ****** ATTENTION : Nouvelle adresse et nouveaux numéros de telephone ****** Vous pouvez dorénavant nous joindre ou nous écrire aux coordonnées suivantes : Tél : 01 70 56 51 51 Fax : 01 70 56 51 52 Nouvelle Adresse: 7 place Marcel Rebuffat Parc d'activités de Villejust 91971 Courtaboeuf 7 cedex

2 1

Freeradius + DHCP +vlans ???
by George Beitis 26 Jul '07

26 Jul '07

Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info? Is this the right or wrong way of going about this? regards George

3 10