November 2009 - Freeradius-Users - lists.freeradius.org

authorize_check_query - authorize_reply_query - synchronous or asynchronous?
by freeradius＠duxtel.com 23 Nov '09

23 Nov '09

Hi Folks! I have a working freeRadius with Postgresql database behind it, and looking at developing some additional functionality for a public access wireless service requested by one of our customers. The deal is that they want to allow limited access (by time/download etc) to first-time visitors for free, and then direct them to a purchase page once they have used up that limit. What I'm thinking is to point the authorize_check_query to a pgSQL function that looks for the MAC address in a special table, and if it doesn't exist, to create a new user linked to the client MAC (Our Access Points all support MAC-Auth when the wireless client connects to the network). I'm expecting that if I can create a new user in the authorize_check_query and have it return auth-success, then the authorize_reply_query will return the relevant data from what is created by the former.... I hope that makes some kind of sense! :-} So my basic question is: Does "authorize_check_query" complete fully before starting the call to "authorize_reply_query"? If they happen at the same time, then I expect that 'authorize_reply_query' may execute before I get a chance to create the relevant records for the 'guest' user... I know I can just go ahead and find out my answer by 'empirical method', but I figure that just because it seems to work every time, there is no definite guarantee that it will work *every* time unless I can be certain that these functions execute in sequence :-} Any comments are gratefully received! :-) Thanks, regards, Mike Everest.

3 7

question about scalability
by Divya Shah 23 Nov '09

23 Nov '09

How many radius accounting requests per second can free radius support? I am using openser-1.1.1-1.1 . I have tested up to around 400. But need it to support more than 600 requests per sec. Please let me know the max rate it can support or if it has any dependency on the hardware. Thanks, Regards, Divya Shah QA | GlobalLogic India. B-34/1, Sector-59, Noida Office Phone: +91.120.406.2000 - 3145 www.globallogic.com <http://www.globallogic.com>

2 1

max accounting requests per second
by Divya Shah 23 Nov '09

23 Nov '09

How many radius accounting requests per second can free radius support? I am using freeradius-1.0.4-4.2 I have tested up to around 400. But need it to support more than 600 requests per sec. Please let me know the max rate it can support or if it has any dependency on the hardware. Thanks, Regards, Divya Shah QA | GlobalLogic India. B-34/1, Sector-59, Noida Office Phone: +91.120.406.2000 - 3145 www.globallogic.com <http://www.globallogic.com>

2 1

Re: Authentication
by kachin Agarwal 22 Nov '09

22 Nov '09

Hi, What is the approx authentication rate u get on a good standard hardware using freeradius-server 2.1.7...? Thanx & Regards, Kachin --- On Fri, 20/11/09, kachin Agarwal <kach_gr8(a)yahoo.co.in> wrote: From: kachin Agarwal <kach_gr8(a)yahoo.co.in> Subject: Authentication To: freeradius-users(a)lists.freeradius.org Date: Friday, 20 November, 2009, 4:32 PM Hi, I m currently using freeradius-server 2.1.7. when i try to authenticate it takes abt 400 millisec to authenticate. i use peap-mschapv2 for authentication. So in 1 sec the number of devices i can authenticate is jus 4 to 5. so wat to do? should i modify anything in the freeradius code to increase the authentication rate. Thanx & Regards, kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

1 0

Dictionary for Acme Packet
by Hadriel Kaplan 22 Nov '09

22 Nov '09

Howdy, Attached is the latest dictionary for Acme Packet, for inclusion in the Freeradius releases. If this is not the right list to send such requests to, please let me know. (I tried to RTFM, and this list seemed to be it) Thanks! -hadriel

2 1

solution---Re: Re: help--- IPsec VPN on radius
by Yagnesh Dave 22 Nov '09

22 Nov '09

Hi All, Found the solution from one of the previous posts. http://lists.cistron.nl/pipermail/freeradius-users/2005-July/msg00273.html I just the did the same, added the below line in the dictionary file at /usr/local/share/freeradius/dictionary VALUE Service-Type outbound 5 Please let me know if this is correct to do. Regards, Dave. On Wed, 18 Nov 2009 16:47:05 +0530 wrote >Hi, > > Found the problem, it is with the service type attribute. > > I am getting this error on the freeradius > > /usr/local/etc/raddb/users[24719]: Parse error (reply) for entry tatablue-vpn.vsnl.net: Unknown value outbound for attribute Service-Type > > How to rectify this problem of "outbound" service type. > > Regards, > Dave > On Wed, 18 Nov 2009 16:22:30 +0530 wrote > >Hi, > > > > > > I am trying to configure this on Free Radius; > > > > > > # setup for IPSec VPDN, > > > ezvpn Password := "cisco" > > > Service-Type = outbound, > > > Cisco-Avpair = "ipsec:tunnel-password=cisco123", > > > Cisco-Avpair="ipsec:tunnel-type*esp", > > > Cisco-Avpair="ipsec:group-lock=1", > > > Cisco-Avpair="ipsec:key-exchange=ike", > > > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > > > > > > > > test@ezvpn Password := "test123" > > > Cisco-Avpair="ipsec:tunnel-type*esp", > > > Cisco-Avpair="ipsec:group-lock=1", > > > Cisco-Avpair="ipsec:key-exchange=ike", > > > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > > > > > Now, When I run the freeRadius, I get this error in the log file > > > > > > /usr/local/etc/raddb/users[24374]: Parse error (reply) for entry ezvpn: Unknown value outbound for attribute Service-Type > > > Errors reading /usr/local/etc/raddb/users > > > > > > > > > Please tell what is the correct config to get it working. > > > > > > Regards, > > > Dave. > > > > > > >

3 3

Creating an NT-Password value with python
by jon michaels 21 Nov '09

21 Nov '09

Hi list, I am trying to figure out how to create an NT-Password hash for the authentication database using python. I found the package python_ntlm which seems to be able to do the job. http://code.google.com/p/python-ntlm/source/browse/trunk/python26/ntlm/ntlm… I think it needs a modification however, because currently the hash returned looks like this: >>> from ntlm.ntlm import create_NT_hashed_password_v1 >>> create_NT_hashed_password_v1('test') '\xdb4mi\x1dz\xccM\xc2b]\xb1\x9f\x9e?R' I then proceed to add the user in mysql: insert into radcheck (username,attribute,value,op) values ('testuser','NT-Password','\xdb4mi\x1dz\xccM\xc2b]\xb1\x9f\x9e?R',':='); Next, when i tried to authenticate using the OSX pptp client, radius debug tells me: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Invalid NT-Password [mschap] Told to do MS-CHAPv2 for passman with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect I suppose the hash i get from the create_NT_hashed_password_v1 function isn't correctly formatted. Can anyone point me in the right direction? Thanks, Jon.

3 5

Freeradius load balancing.
by nick 20 Nov '09

20 Nov '09

At the moment we have a freeradius 1.1.3 server on CentOS which is functioning fine, but due to circumstances, and the devices we are using as NASes, the ip pools are located on the NAS instead of being centralized on the RADIUS server as we'd like it. We'd now like to make things a bit more robust, including a clustered MySQL backend for AAA, and, if possible, load balanced freeradius servers on the front end. We'd also like to use SQL ip pools. I am only unsure about one thing though. If we have a shared pool available via DB, what prevents the two load balanced radius instances from giving out the same ip address? I've been doing a fair bit of googling, but without a whole lot of luck in this respect. Thanks for any info, Nick Warr.

6 6

Failed default PAP in CentOS
by freeradius＠corwyn.net 20 Nov '09

20 Nov '09

CentOS 5.2 installing freeradius from the default base repository freeradius-1.1.3-1.5.el5_4 If I add, to the top of /etc/raddb/users: bob Cleartext-Password := "hello" Then when I attempt to start freeradius I get: /etc/raddb/users[1]: Parse error (check) for entry bob: Unknown attribute "Cleartext-Password" I haven't made any other changes to freeradius other than the rpm install. (full dbug output) [root@ns4 ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" /etc/raddb/users[1]: Parse error (check) for entry bob: Unknown attribute "Cleartext-Password" Errors reading /etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1837] Unknown module "files". radiusd.conf[1773] Failed to parse authorize section. If I remove that line, freeradius appears ok: [root@ns4 ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 3

MySql on Freeradius
by Peter Carlstedt 20 Nov '09

20 Nov '09

Hello everyone! I have succeeded in most what i want to accomplice but stupid me forgot that I would also want to be able to administrate the users through a GUI instead of jump into the users.conf file everytime i need to add a new user. Since I want OpenSSL support i need to make my own build which Ubuntu´s own Freeradius release in Synaptic does not seem to have support for. I have tried to find information on the net about how to make a build of Freeradius that works together with MySql. The guides I have read is all about installing with the help of synaptic package manager in ubuntu 9.04 and install freeradius-mysql. A question I have is if that module comes with the build I make when im downloading from Freeradius site? If not do I need it to be able to get mysql work together with freeradius and if I do need it, how can I do a separate installation of it? Or can I use the one I find in Ubuntu´s Synaptic Package Manager? Lots of questions I know, hope you can find the time to answer them. Best regards/ Peter _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1