March 2010 - Freeradius-Users - lists.freeradius.org

Rlm_sql: dynamic queries
by Dan-Cristian Bogos 02 Mar '10

02 Mar '10

Hey Guys, I came to need of doing dynamic queries with rlm_sql. However after digging the docs and my way of understanding the architecture of rlm_sql I am not sure I can do it in the way I want it. Here is my scenaro: I receive accounting records with more attributes with the same name (resulting into freeradius in attribute lists). I would like to run mysql multiple inserts in one query (possible with mysql by enumerating values between brackets, eg: insert into table (a, b) values (user-name[0], destination), (username[1], destination), (username[2], destination). ). My problem comes with the fact that the number of attributes in the attribute list is variable, so I do not know how many attributes I will get. The solution I found is not very nice from my point of view: I have defined one rlm_sql instance for each fixed number of attributes in the list with a static query and filtered the request in sites-enabled based on the number of elements in the list, using something like: switch "%{User-Name[#]}" { case 2 { sql_inst2 } case 3 { sql_inst3 } case { sql_inst1 } } Can anyone recommend me any better way of doing it (so I do not need to define a query for a number of attributes, but have the query generated in some automatic way, so I will only need one sql instance)? Ta, DanB

2 1

Stop Packet in Radius
by Kris 02 Mar '10

02 Mar '10

hi all, i am using mikrotik hotspot + freeradius , i have weird issue that radius send Stop Packet but the user still logged in in mikrotik. it happened in random time. is there any idea what config or issue for this problem ? regards, kris

2 1

WPA supplicant
by R C 02 Mar '10

02 Mar '10

hi, is there any wpa supplicant out there that can generate multiple seperate sessions at the same time? i have wpa_supplicant, but it will generate only 1 session per interface. I need to generate 1000's of such wpa client requests going to the free radius server. Any help is appreciated. thanks, rc.

2 1

simultaneous-use doc
by J Brandon Polley 01 Mar '10

01 Mar '10

I am trying to understand the simultaneous-use docI am having trouble with a part that says:Note that you need to add the Simultaneous-Use parameter to the check item (first line), not the reply item, using the ':=' operator.I am not sure where to add the Simultaneous-Use parameter. Does it go in ldap.attrmap.config ?

2 1

duplicate sessions
by Nadir Aliyev 01 Mar '10

01 Mar '10

Hello All! I have great problems with duplicate sessions! ~2500 online users, accounting per minute, 25 db socket limit for radius daemon. Nas port id, accstoptime, session id, inputoctets, outputoctets is same in duplicate sessions. But most duplicate sessions only have difference with acctstarttime (1 second difference) Any ideas? Thanks!

3 2

Conflicting packets
by rihad 01 Mar '10

01 Mar '10

Hi, We have FreeRADIUS 2.1.3 servicing four Cisco NASses, which in turn service hundreds of PPPoE clients. rlm_perl with a custom written script is used for authorization/accounting, performing at about 10 auth requests/sec on a Dell PowerEdge 2950 box. At times, when a NAS is rebooted, triggering reauthentication of hundreds of PPPoE users, the server log is swamped with many lines of this kind: Error: Received conflicting packet from client 10.10.70.3 port 1645 - ID: 86 due to unfinished request 273963. Giving up on old request. Suddenly, it turns out the server isn't making any progress, besides giving up on old requests and chewing CPU time. Only turning off radius authorization on the Ciscos stops the duplicate packet flooding, and then turning it back on part by part brings everything together. I don't think the NAS is to blame, it's the hundreds of ADSL modems doing the frequent reauthentication every few seconds. Some current settings: max_request_time = 6 cleanup_delay = 10 max_requests = 1024 max_servers = 5 #threads are used I've tried all sorts of combinations for the above, with max_requests as low as 50, to no avail. Can freeradius be configured to reply with a (temporary) REJECT to an auth request when max_requests is reached, instead of just ignoring the request? I think that would allow the server to make steady progress. What else should I do in terms of radius configuration? Please do not suggest that I fix the code to make it faster, it's more of a misconfiguration issue (radius or Cisco). The server should be making some progress no matter how slow it ran, unlike what we're having at the times of trouble. Thanks for any tips.

3 4

May I only use rlm_ldap to authenticate against Active Directory? (without samba + winbind + ntlm_auth)
by Tong Anh Quan 01 Mar '10

01 Mar '10

Hi all, Can someone give me a confirmation? Details below: - In modules/ldap, I configures: server = "10.128.28.3" identity = "cn=anonbinduser,dc=domain,dc=com" password = xx basedn = "dc=domain,dc=com" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" - In site-enables/inner-tunnel, I uncommented the ldap module - In modules/pap, I changed the auto_header option to "yes". - In eap.conf, + Set the default_eap_type = mschapv2 in peap section + Commented the "virtual server = "inner-tunnel"" line - Create a wpa_supplicant.conf file as follow: network={ scan_ssid=1 ssid="xx" key_mgmt=WPA-EAP pairwise=TKIP group=TKIP eap=PEAP identity="xx" password="xx" ca_cert="/etc/radiusclient/certs/ca.pem" phase1="peaplabel=0" phase2="auth=MSCHAPV2" } - Start radiusd in debug mode and try to connect with wpa_supplicant: wpa_supplicant -c /etc/wpa_supplicant.conf -i wlan0 -D wext -d, I got the following errors: Mon Mar 1 16:08:16 2010 : Info: ++[pap] returns noop Mon Mar 1 16:08:16 2010 : Info: Found Auth-Type = EAP Mon Mar 1 16:08:16 2010 : Info: +- entering group authenticate {...} Mon Mar 1 16:08:16 2010 : Info: [eap] Request found, released from the list Mon Mar 1 16:08:16 2010 : Info: [eap] EAP/mschapv2 Mon Mar 1 16:08:16 2010 : Info: [eap] processing type mschapv2 Mon Mar 1 16:08:16 2010 : Info: [mschapv2] +- entering group MS-CHAP {...} Mon Mar 1 16:08:16 2010 : Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Mon Mar 1 16:08:16 2010 : Info: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Mon Mar 1 16:08:16 2010 : Info: [mschap] Told to do MS-CHAPv2 for quan.ta with NT-Password Mon Mar 1 16:08:16 2010 : Info: [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. Mon Mar 1 16:08:16 2010 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Mon Mar 1 16:08:16 2010 : Info: ++[mschap] returns reject Mon Mar 1 16:08:16 2010 : Info: [eap] Freeing handler Mon Mar 1 16:08:16 2010 : Info: ++[eap] returns reject Mon Mar 1 16:08:16 2010 : Info: Failed to authenticate the user. Mon Mar 1 16:08:16 2010 : Auth: Login incorrect: [quan.ta/<via Auth-Type = EAP>] (from client aironet port 0 via TLS tunnel) } # server >From my understanding, I cannot make freeradius authenticate with AD only with rlm_ldap module. PS: samba + winbind + ntlm_auth works fine. -- --- Hạnh phúc là một ly Cafe và nhạc Trịnh ---

2 1