December 2008 - Freeradius-Users - lists.freeradius.org

PAM to authenticate - ldap to authorize?
by Zahid Mehmood 03 Dec '08

03 Dec '08

Hi, I have freeradius 2.0.5 configured to use pam (using kerb) for user authentication. I am trying to find out if it is possible to limit access based on ldap groups. I've checked the list archive as well as the web and am not able to find a solution. I'd appreciate it very much if someone can provide some guidance/tips in this regard. Thanks. -- Zahid

2 1

Problem with CPU load
by Angel L. Mateo 03 Dec '08

03 Dec '08

Hello, We have a debian server (debian 4.0 etch) running freeradius 1.1.7. We have compile it from debian source package, but including eap_tls and eap_ttls support. Our user repository is an LDAP server (openldap 2.3.30) running in another host. This radius server is a Xen virtual machine with 512MB of RAM. The problem we have is that sometimes it loads the CPU too much. An uptime of the host reports loads over 100 points and a 99% of CPU utilization. These loads last least than a minute, but during this minute, you can't authorize anybody. Any idea of what could be happening? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 1

Re[4]:
by NiTr0 03 Dec '08

03 Dec '08

> I will do probably do it. The network have more than 100 computer, and > i have seen that the ldap can be used by Freeradius. That way, the > second method of authentification come by itself. For MAC-only auth security it doesn't matter how many PCs in network. The only thing that is matter - # of PCs in subnet. Because subnets are physically splitted by router.

1 0

(no subject)
by Sebastien Serre 03 Dec '08

03 Dec '08

Hi all, I have to implement my first freeradius, and after a search in the faq and the net, an interrogation still remain. I need to authenticate machines, to grant them normal access to the lan, and if they are not known , put them on a special VLAN. I was think to do that with MAC address, but i know they can be easily spoofed. I m reading the book of FreeRadius (Oreilly), and there is a doubt for the usage of Radius in this case of figure. Could someone give me keyword or suggestions that can help me in my search? At least, may i persist in the way of using radius in this case? Thanks

3 3

Time based billing
by Saeed Akhtar 03 Dec '08

03 Dec '08

Hi all, I want to ask that if there is some kind of flexibility in freeradius to have time based billing. I want a customer to be charged at different rate at different time. Like I want to introduce a package which has different rate at morning eg. $1/hr from 0800 to 1200 then 0.5/hr from 1200 to 1800 then 0.25/hr from 1800 to 0800hrs. Now what should I do. I know that there are sqlcounters but these are for flat rates. Now is there any flexibility to do so. And if not then is there any plugable module available by which i could achieve this. I'll be thankful for your help Regards, Saeed Akhtar

6 6

Rlm sqlcounter -- Data Based Counter
by Marcel Grandemange 02 Dec '08

02 Dec '08

Good Day. Im wondering is someone could assist me here. I currently have freeradius setup and working somewhat. However I have following setup: sqlcounter monthlytraffic { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Mikrotik-Xmit-Limit-Gigawords sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT (sum(AcctInputOctets)+sum(AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND Month(AcctStopTime) =(Month(NOW() #query = "SELECT SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - UNIX_T #query = "SELECT SUM(AcctInputOctets + AcctOutputOctets) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'" #query = "SELECT SUM(OctetTotal) FROM thismonthsusage WHERE UsernameView='%{%k}'" } As you can see I have tried numerous queries to get this working correctly and decided finally to do my own query against a view that does my work for me. (Currently commented out because having issues with it) The view is called thismonthsusage And it's definition as follows.... select `radacct`.`UserName` AS `UsernameView`,`usergroup`.`GroupName` AS `GroupNameView`,`radacct`.`AcctStartTime` AS `AcctStartTimeView`,`radacct`.`AcctStopTime` AS `AcctStopTimeView`,`radacct`.`AcctInputOctets` AS `AcctInputOctetsView`,`radacct`.`AcctOutputOctets` AS `AcctOutputOctetsView`,(sum(`radacct`.`AcctInputOctets`) + sum(`radacct`.`AcctOutputOctets`)) AS `OctetTotal` from (`radacct` join `usergroup`) where ((month(`radacct`.`AcctStartTime`) >= month(curdate())) and (month(`radacct`.`AcctStopTime`) <= month(curdate())) and (`radacct`.`UserName` = `usergroup`.`UserName`) and (`usergroup`.`GroupName` <> _latin1'Mac')) group by `radacct`.`UserName`,`usergroup`.`GroupName`,`radacct`.`AcctStartTime`,`rada cct`.`AcctStopTime`,`radacct`.`AcctOutputOctets` order by `radacct`.`AcctStopTime` As you can see quite simply and efficient however there is one battle I am facing.. As soon as a new month rolls over there are NO accounting entries for that user for that month, hence no record and freeradius denies user as he hasn't got any entries, any body know how I should modify the view to display all users even if they don't have an entry for current month, but rather display them with value 0 as apposed to not at all?

2 1

Check on bytes used
by Saeed Akhtar 02 Dec '08

02 Dec '08

Hi all, I want to create a check on user monthly usage in (MB/GB etc.). Is there any module available to do so. yes or not what attribute will be sent to client, like session-timeout attribute gives the time in second. waiting for reply. thanks Regards, Saeed Akhtar

5 5

OT - Question about Switches
by Craig White 02 Dec '08

02 Dec '08

Sorry for the noise but this is actually related to my struggles with FreeRadius I am using FreeRadius and authenticating Windows RAS users (PPTP) Macintosh users via the same Windows RAS server using PPTP or L2TP, Macintosh WAP clients and iPhone clients without a problem. I am struggling with Windows clients both WAP and L2TP to the same Windows RAS server and I'm beginning to wonder if the problem is the switch I am using because endless google searching turned up a problem somewhere (I've forgotten which I read). I'm using a Dell PowerConnect 6248 switch which is a managed switch. Is it possible that it is interfering with some of the connections? My Windows WAP clients endlessly try to authenticate as 'anonymous' and my Windows L2TP connections don't seem to ever get to the Windows RAS server though a Macintosh using L2TP sailed right on through. I'm grasping at straws. Craig

1 0

WPA: Failed to get master session key from EAPOL state machines
by Alexandre Thieme Reis 02 Dec '08

02 Dec '08

After i upgrade my fedora core 9 (freeradius 2.02) to fedora core 10 (freeradius 2.1.1) i receive this message when i attempt to connect to freeradius server. EAPOL: EAP key not available WPA: Failed to get master session key from EAPOL state machines My configuration: Server: fedora core 10 with freeradius 2.1.1 AP: linksys wrt54g (configured to wpa2/enterprise authentication) Client: kubuntu 8.10 with wpasupplicant 0.6.4) With fedora core 9 and freeradis 2.0.2 all work fine (the configuration is the same - before upgrade fedora i make backup and after upgrade, restore) attached radiusd.tgz with the files: clients.conf eap.conf eapol_test.conf eapol_test.log radiusd.conf radiusd.log users wpa_supplicant.conf wpa_supplicant.log If configure the acces point and client to wpa2-psk and i run eapol_test with eapol_test.conf althentication succed! What is wrong? (the server configuration, the access point, the client or I)? Thanks for help! PS: Excuse my poor english.

1 0

Is FreeRADIUS 2.1.1 capable of handling NAI decorations
by Luca Adamo 02 Dec '08

02 Dec '08

Hi, I've been working and (also a little bit deploying) with FreeRADIUS 2.1.1 for a while and everything has been smooth enough. Today for the first time I step into a problem with the handling of NAI sent by the client through the NAS. The problem consists in the prensence of a WiMAX decoration inside the NAI. As stated by WiMAX Forum 1.2 Stage 3 a NAI can be composed by a Username, a realm and an optional part known as WiMAX decoration. To be more precise a valid NAI, according to WF is the following: {attribute=11}username@realm FreeRADIUS 2.1.1 seems to be unable to process the NAI decoration so the username is passed unaltered to the modules and of course there're a lot of problems arising for the presence of the curly braces and the equal sing inside the User-Name. If I hack the safe character list of Oracle (the database I chose to store user credentials and profiles) adding both the curly braces and the equal sign everything work fine but IMHO is not the solution. I tried also to use the attr_rewrite module trying to remove the unwanted prefix from the User-Name attrribute but this obviously breaks EAP (as Alan also has stated in a mail discussion I red on the Internet). Sorry if I've been too prolix, at the end my question is the one of the subject..."Is FreeRADIUS 2.1.1 capable of handling NAI decorations according to WiMaX Forum 1.2 St. 3?" And if not, can I have some suggestion on which one can be the starting point for the development of such functionality? Thank you for the cooperation, Luca Adamo LaRT - University of Florence

2 1