November 2010 - Freeradius-Users - lists.freeradius.org

(no subject)
by Zoet Omar Zepeda 22 Nov '10

22 Nov '10

i am new to this I really need the help of how to configure freeradius in ubuntu?

1 0

Re: How to avoid to be disconnected as Lost-Carrier?
by Gary Gatten 22 Nov '10

22 Nov '10

PS: and you'll likely have to tune some parms on your modems as well. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Sent: Mon Nov 22 08:42:53 2010 Subject: Re: How to avoid to be disconnected as Lost-Carrier? If I understand correctly, unless the users are idle when the carrier is dropped, they'll know regardless of how you try to mask it. No carrier = no connection, no "wire". If the loss is very brief and modem reconnect quickly, maybe you can mask it, but, you must do so on your ppp server. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Nov 22 07:55:58 2010 Subject: How to avoid to be disconnected as Lost-Carrier? Hi, I have 200 users in a small area network (PPPoE, LAN network). I use Mikrotik RouterOS as PPPoE server & use Freeradius as Radius server. I find that some “Lost-Carrier” issue due to lost connection (around 8%-10% users). I judged that cable had been interfered intermittently. But I would like to keep connection instead of disconnection when the issue happened. What do I set Freeradius that increase intervals or times of checking communication? Because it were, users will avoid to disconnect and not be ware of cable interfering when it happen really. Thanks. Robin Lu "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: How to avoid to be disconnected as Lost-Carrier?
by Gary Gatten 22 Nov '10

22 Nov '10

If I understand correctly, unless the users are idle when the carrier is dropped, they'll know regardless of how you try to mask it. No carrier = no connection, no "wire". If the loss is very brief and modem reconnect quickly, maybe you can mask it, but, you must do so on your ppp server. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Nov 22 07:55:58 2010 Subject: How to avoid to be disconnected as Lost-Carrier? Hi, I have 200 users in a small area network (PPPoE, LAN network). I use Mikrotik RouterOS as PPPoE server & use Freeradius as Radius server. I find that some “Lost-Carrier” issue due to lost connection (around 8%-10% users). I judged that cable had been interfered intermittently. But I would like to keep connection instead of disconnection when the issue happened. What do I set Freeradius that increase intervals or times of checking communication? Because it were, users will avoid to disconnect and not be ware of cable interfering when it happen really. Thanks. Robin Lu <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

How to avoid to be disconnected as Lost-Carrier?
by Robin 22 Nov '10

22 Nov '10

Hi, I have 200 users in a small area network (PPPoE, LAN network). I use Mikrotik RouterOS as PPPoE server & use Freeradius as Radius server. I find that some “Lost-Carrier” issue due to lost connection (around 8%-10% users). I judged that cable had been interfered intermittently. But I would like to keep connection instead of disconnection when the issue happened. What do I set Freeradius that increase intervals or times of checking communication? Because it were, users will avoid to disconnect and not be ware of cable interfering when it happen really. Thanks. Robin Lu

1 0

Lost package after use FreeRadius
by Robin 21 Nov '10

21 Nov '10

Dear Freeradius, At first, I use RouterOS(Mikrotik) as pppoe server and radius server. Now I use RouterOS as pppoe server and user FreeRadius as radius server. After changing as above, we find some pppoe users can dial up successfully via freeradius, but their internet transportation will lost package even can’t visit any website. I would like to know, how to explain the situation? What am I supposed to solve this problem? P.S When I change RouterOS to pppoe and radius server again (disable freeradius), it will all be ok. Thank you very much. Robin Lu

4 5

Case-insensitive regexps in rlm_files
by Brian Candler 21 Nov '10

21 Nov '10

In rlm_files, I can't see how to make a case-insensitive regular expression. ----------------------------------------------------------------- DEFAULT User-Name =~ "(?i:foo)" # nope, not supported by POSIX ERE. Logs: # "Invalid regular expression (?i:foo)" DEFAULT User-Name =~ /foo/i # actually matches the character sequence "/foo/i" ----------------------------------------------------------------- Am I missing a trick here? If I make a patch for this, would you prefer the first or second to be implemented? The second is nicer to use, but is probably harder to implement. The first could be done as a frig by stripping off an outer (?i: ... ) and setting the REG_ICASE flag if seen. Regards, Brian.

2 7

Changing radgroup with a sqlcounter ?
by Arrgghh 21 Nov '10

21 Nov '10

Hello, I am working on a radius config for a hotspot. I already configured a script that kick the user when the quota exceed thanks to some very useful posts in the coova forum. I used this counter : sqlcounter noresetBytecounter { counter-name = Total-Max-Octets check-name = Max-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}'" } My goal is that a user belongs to a standard group with a 512kbps bandwith and a quota of 100mo. Then when he exceeds his quota, he is switched to a 128 kbps group. I know how to setup groups that limits bandwidth and volume. What I don't know is how to set up a counter that instead of kicking the user out of the network when he exceeds his quota switch him to another radgroup. Any clue how i can do it ? Thank you very much, -- View this message in context: http://freeradius.1045715.n5.nabble.com/Changing-radgroup-with-a-sqlcounter… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

http://wiki.freeradius.org/Mac-Auth is wrong
by Tóth István 21 Nov '10

21 Nov '10

Hello! I tried to set up MAC authorization for testing purposes according to the instructions at http://wiki.freeradius.org/Mac-Auth. The solution there almost worked, except for the raddb/sites-available/default post-auth{} section. The wiki contains the code: if(control:Auth-Type == 'CSID'){ # Authorization happens here authorized_macs.authorize if(notfound){ reject } } However, when the rlm_files module can't find the user, it returns noop, not notfound. As a result, EVERY mac authentication attempt is successful. When I changed the section to if(control:Auth-Type == 'CSID'){ # Authorization happens here authorized_macs.authorize if(!ok){ reject } } I got correct rejects in reply to the MACs not listed in the file. The funny thing is that I actually think that the snippet on wiki page should work, and the rlm_files module is returning the wrong result code. As far as I understand the result codes, noop should be returned when the module ignores the request, because it thinks it should not handle it, and notfound should be returned when the module accepted and tried to handle the requests, but cannot find the user in its "database". Either way, the documentation and the code do not match, and one of them should be fixed. Currently if somene just blindly copies the sample config, and does not test for correct rejects, he'll have wide-open network. I have tested on fedora 13, with the latest freeradius-2.1.10-1.fc13.x86_64 rpm. best regards István Tóth

2 1

Authenticating MACs and users
by Rudolph Bott 20 Nov '10

20 Nov '10

Hey List, I was just wondering - I have setup a freeradius server (stock packages on SLES 11, I don't have the exact version athand since I don't have access to the server right now) which is used for mac-based authentication with cisco switches - including vlan assignment. This works as intended. But I would also like to centralize my user accounts for switches and routers - am I able to do this with the same radius setup? Or do I have to setup another radius server? I am currently using flatfiles for the mac authentication. I already checked the list archive and the wiki but couldn't find anything helpful - maybe I looked for the wrong keywords ;) Any help would be appreciated! -- Mit freundlichen Grüßen/With Kind Regards Rudolph Bott

2 6

[Segmentation Fault while proxing Request to home server]
by Thomas Fagart 19 Nov '10

19 Nov '10

Hello, We're having the following authentication scenario for Wimax User Authentication : ASN -- EAP/TTLS ---> 2 freeradius used as proxy --> 2 freeradius home server. AAA is fine when both home servers are up,but when one of them or both of them are dead, we're having the following logs on the proxy : rad_recv: Access-Request packet from host a.b.c.D port 10008, id=117, length=406 Sending duplicate proxied request to home server a.b.c.d port 1812 - ID: 36 Sending Access-Request of id 36 to a.b.c.d port 1812 User-Name = "xx(a)domain.com" MS-CHAP-Challenge = 0xdcd70de41d9783aa76aa573d3d07f84d MS-CHAP2-Response = 0x4700db77a532a5ec9b28c3805d18cc35ed170000000000000000d00f9d99d46d688436477daf0cdd734b813f11e4bd115e16 NAS-IP-Address = x.y.z.w Calling-Station-Id = "002104bec153" NAS-Identifier = "WASN" Event-Timestamp = "Nov 18 2010 01:43:06 CET" WiMAX-Release = "1.1" WiMAX-Capability = 0x0105312e31020302030301040301 WiMAX-Accounting-Capabilities = Flow-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-BS-Id = 0x303030303261323930633030 WiMAX-GMT-Timezone-offset = 3600 NAS-Port-Type = Wireless-802.16 WiMAX-Available-In-Client = 99 WiMAX-PPAC = 0x010600000063 Service-Type = Framed-User Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x313137 Waking up in 21.0 seconds. WARNING: Internal sanity check failed in event handler for request 6: Discarding the request! Segmentation fault And then the proxy radius dies. This happens each time at the fifth try while trying to send the request to a dead home server. Regular logs gives that Nov 18 01:37:46 vma-prdaut-08 radiusd[11028]: Marking home server a.b.c.d port 1812 as zombie (it looks like it is dead). I know I should give a gdb trace to help, but since this is production server, it might take some times to give the trace. Do you have any idea to what it could be related ? Environment is the following : FreeBSD 8.0/ Freeradius 2.1.10 compiled on threaded perl for snmp script use. Thanks Thomas

3 6