May 2009 - Freeradius-Users - lists.freeradius.org

Re: Re :checking authorization in the duration of connection
by Eric 06 May '09

06 May '09

Hi Arran I have trouble.would you please send me codes? I don't know how those support adsl do ? when users are online during all the days and there is limitation on the traffic amount? It's possible even if the NAS doesn't support PoD, so long as the NAS supports the 802.1X mib, you should be able to fire off an SNMP-SET with the exec module and force re-authentication. All the required information is available in the Accounting Request the server just received. If you're really having trouble and ask nicely i'll write some example code. Arran

2 1

ldap filter depending on NAS
by Matthieu Lazaro 05 May '09

05 May '09

Hello, My freeRadius setup works very well using PEAP/TLS binding on the ldap using only one filter. Now I have two very different types of NAS and I need to filter users that may have access to one NAS or the other or both. My idea was to use the unlang in the ldap module to write my policy, but it's not working. in /etc/freeradius/modules/ldap we have: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "127.0.0.1" identity = "__snipped__" password = "__snipped__" basedn = "dc=__snipped__,dc=com" #WORKING : #filter = "(&(|(accessTo=WIFI_FR)(accessTo=WIFI_ALL))(uid=%{Stripped-User-Name:-%{User-Name}}))" #NOT working: if (NAS-IP-Address == 10.1.1.2) { filter = "(&(|(accessTo=WIFI_XX)(accessTo=WIFI_YY))(uid=%{Stripped-User-Name:-%{User-Name}}))" } else { filter = "(&(accessTo=VPN)(uid=%{Stripped-User-Name:-%{User-Name}}))" } base_filter = "(objectclass=radiusprofile)" ___snipped-the rest of this section is OK___ } It all happens as if the "if () { ... } else { ... } " is completely ignored (and thus it defaults to check if the uid exists) (ie: neither filter1 nor filter2 appears when debugging. But when we only put filter, it appears when debugging) I think I'm missing a lot of details in the configuration and I have not figured out how to do this with hints|huntgroups|clients files. Any help on why this is not working or an other simple solution is welcome. Best Regards, Matt

4 27

High CPU usage after SQL failure when using buffered-sql
by Stephen Fulton 05 May '09

05 May '09

Hi all, First, I've used FreeRADIUS for a number of years in a number of installations, and I'm fairly comfortable with it. I have looked through the archives, as well as read the documentation, FAQ, wiki and the notes within each of the configuration files that make up FR, such as the virtual servers and modules that would be used. Now onto the issue: During testing of a new RADIUS cluster, I implemented the buffered-sql virtual server, which works fine, with the detail file poll interval set to 10 seconds. However, when I simulate a failure of the accounting MySQL server to which it normally writes, CPU usage spikes significantly, from an average of ~ 1-2% to 30+ over time. If the accounting MySQL server is unavailable for longer than 2-3 minutes, the spikes occur much more frequently. Once the SQL server returns to service, accounting records stored in the detail file are properly read and inserted into the DB, then the files are cleared, as I expected. However, the RADIUS process still maintains a higher than normal CPU load (according to top) of around 10%, which spikes to 30-40% when it is handling a new request (note the singular). The server is a dual Xeon 3.something, with 2GB RAM and SCSI disks. The server is running Debian Linux 2.6.26-2-686. FreeRADIUS is running version 2.1.4, compiled manually. During previous debugging, while running FR in debugging mode, I noted that it was attempting to read the detail file every second, sometimes less. This matches a comment made by Alan in a similar sounding issues discussed on the list in April 2008. (http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg44137.…) Is there any way to mitigate these CPU issues in version 2.1.4? -- Stephen

2 5

Re :checking authorization in the duration of connection
by Eric 05 May '09

05 May '09

I found this reply in freeradius mailing list in 2005: " It's impossible to enforce *traffic* limiting *during* a users session. So if a user is a tiny bit below their limit and logs in again, they can go over their limit. The server will only catch & enforce their limit on the next login. This has been discussed multiple times on the list over the past 5 years." Is this possible now in new versions ?

5 6

Configuring Freeradius
by jon jon 05 May '09

05 May '09

Hi, I am new to freeradius. I am trying to get my freeradius server setup but I find I am having trouble. I am running slackware 12.1 as my OS and running freeradius version 2.1.5. All I want to do is get started on the right track. My question is the three main config files I need to edit are clients.conf, users.conf, and radiusd.conf, right? I did the radtest from the command line and get a accept reject message. Can anyone just tell me what I have to change to get me started off in the right direction? Thanks, jon

4 3

Please help me ...thanks in advance
by praveen saxena 05 May '09

05 May '09

Hi , I am a newbie in Radius field. I have a Linux machine which has RHEL WS 4 Update 5 OS loaded. I have installed freeRadius server version 2.1.5. in another machine. I want to authenticate the linux machine login through Radius server. I have tried several ways to configure the linux machine as published in several groups but did not work.Tried through PAM module. If some body can help me out in this matter or point to some good links,will be helpful to me. Best Regards Praveen

2 1

buffered-sql doesn't make sense to me
by Kanwar Ranbir Sandhu 04 May '09

04 May '09

Hi All, I'm trying to set up buffered-sql on my test freeradius server. I've been reading the example config files, but I'm confused because the buffered-sql example seems to be incomplete. The example "buffered-sql" file says to use one virtual server to log to the detail file, and another virtual server to read from it. But, there is no example config file supplied for logging to the detail file. The only example given is the one for reading from it (i.e. the buffered-sql file) How do I configure buffered-sql? Also, decoupled-accounting appears to me to be very similar to buffered-sql. If it's not, how is it different? Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 15:25:10 up 20 days, 15:21, 4 users, load average: 1.09, 1.13, 0.83

2 3

how to change "comp_name\\uid" to JUST uid?
by Burak Sarrafi 04 May '09

04 May '09

Hello, I've a question for completing my job.. I hope any one can help me... I'm using radius auth. at our wireless connections and wanna using windows logon name and password autımatically. But It doesn't work when checked "automatically use my windows logon name and password" section when configuring client pc. Also, when i uncheck and manually typing the my user/pass when connecting same SSID, it's working fine. Here is log for all sentence: *When "automatically use my windows logon name and password" checked:* modcall: entering group authenticate for request 36 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 36 modcall: group authenticate returns invalid for request 36 auth: Failed to validate the user. *Login incorrect *(rlm_ldap: User not found): [*BURAK_S3\\sarrafi*/<no User-Password attribute>] (from client it_netsysnew/10.250.1.3 port 7017 cli 00:1B:9E:2A:A4:13) *When "automatically use my windows logon name and password" unchecked:* modcall: group authorize returns updated for request 46 rad_check_password: Found Auth-Type eap auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 46 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 46 modcall: group authenticate returns ok for request 46 *Login OK*: [*sarrafi*/<no User-Password attribute>] (from client it_netsysnew/10.250.1.3 port 7018 cli 00:1B:9E:2A:A4:13) ---- My computer name is *BURAK_S3 *My user name at ldap: *sarrafi *I wanna to know why my computer name has been sent when clicked *"automatically use my windows logon name and password" ??* Because there is no uid found at ldap like BURAK_S3\\sarrafi and i wanna remove it when search string... Any help?? Thanks from now.... -- Burak Sarrafi <sarrafi(a)sabanciuniv.edu> Network Specialist Sabanci University / IT Dept. Tel:+90-216-4839180 Fax:+90-216-4839186

2 1

Re :checking authorization in the duration of connection
by Eric 03 May '09

03 May '09

NAS sends accounting update packets in periodic times. I want freeradius use this updates and check my online users periodically and send Disconnect packet if user's traffic is above my limit. How can it do this? any document about config ? Eric wrote: Hi, My radius server use ldap server for authorize and authentication.I set an attribute in ldap server that is the check-name in sqlcounter to limit users Input traffic. I want when user traffic reaches to this amount the user become stop but radius checks ldap attributes only at the first of connection not in the middle. How can I set radius server check users traffic with the amount of this attribute in ldap server in the duration of connection? The radius server steps out of the way once authentication and authorization is complete, nor does it have the ability to disconnect a user from a NAS. You need to have the NAS disconnect the user itself when a threshold is reached. This is accomplished by returning a vendor specific attribute specifying the limit for the session which the NAS then maintains. Once the limit on the NAS is reached the NAS terminates the session. You'll have to check your NAS documentation for a traffic limiting parameter. In the other common case of disconnect after a time duration it's handled by computing the session length during authorization and returning attribute 194 with the maximum number of seconds for the connection. This attribute is understood by comon NAS devices and is known variously as Ascend-Maximum-Time, Cisco-Maximum-Time or Lucent-Maximum-Time. You'll need to apply the same logic for data volume.

4 3

RE: rlm_perl DBI problems
by Alexander Kosykh 02 May '09

02 May '09

Hi. Back to my problem with perl Then I comment my own module rejectlog in sites-enable/mysite FR begin to work fine at least 18 hours. Some ideas why it can bring an error in DBI if it's sub function in perl don't use DBI at all? Any other offers how to log reject users in special format? I don't want log rejected user in radius.log file. In my case it for radius system log - not for users. I've try to turn on log only badpassword users but it log all good and bad password users L bug in FR? Thers part of my config log { destination = files file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } radiusd: FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd6.2, built on Apr 10 2009 at 12:18:46

3 3