June 2010 - Freeradius-Users - lists.freeradius.org

howto start one connection and start another one?
by Spacelee 28 Jun '10

28 Jun '10

it seems in dialup.conf, I can't change the settings to automatically stop user's one connection and start another when he dialup on his another system, the simu was set equal to 1 -- Spacelee

2 3

PEAP - AD Disabled
by Nathan McDavit-Van Fleet 27 Jun '10

27 Jun '10

Okay, I've had a working config with the following for the past month. TTLS->LDAP PEAP->AD PEAP->Local Users File After a month running everything perfectly, 3 days ago the "PEAP-AD" portion of the AAA failed. This is for wireless auth. Strangely, I can still auth from the CLI using ntlm_auth and wbinfo. So it appears as if the Samba connection to the AD is fine. Nothing has changed config wise between then and now, and I haven't found any interesting log information. You just get a "Login incorrect" when you try to login via PEAP->AD. Everything else is verified as working. Aside from Freeradius itself, what are the differences between using ntlm_auth via CLI and via Freeradius? Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434

4 4

about simultaneous when using mysql and freeradius
by Spacelee 27 Jun '10

27 Jun '10

i want to limit user's behavior, such as a username can login only once at the same time... 1、modifiy default and inner-tunnel in # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # See "Simultaneous Use Checking Querie" in sql.conf sql } 2、modify dialup.conf in etc/raddb/sql/mysql # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" 3、add a entry to the table radgorucheck INSERT INTO `radgroupcheck` ( `id` , `GroupName` , `Attribute` , `op` , `Value` ) VALUES ( NULL , ’user’, ’Simultaneous-Use’, ’:=’, ’1’ ); 4. update the user "test" to the group "user" i finally tried successfully, but if , i say if the radius server was down suddenly or the user logout improperly(such as he poweroff the computer directly). then the record will still be record in the table as he was still online ...so we need to modify the record, but how to ? can freeradius judge it by itself, or how to judge the user if offline ? -- Spacelee -- Spacelee

4 7

chroot
by Mike Hammett 26 Jun '10

26 Jun '10

I read the appropriate section in radiusd.conf, but I don't know what needs to be in whatever folder I'm pointing the config to. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com

2 1

Help connecting to remote ldap server
by Raymond Norton 25 Jun '10

25 Jun '10

I successfully configured freeradius (version 1.x Ubuntu) to use ldap on a localhost via WPA. I am trying to setup version 2.1 (Ubuntu) to use a remote ldap server now. The module loads fine and I made what I believed were the correct changes to connect to the remote server, but I have missed something. Is there a good doc for ldap authentication on a remote host? Raymond

7 31

EAP issue
by David Peterson 25 Jun '10

25 Jun '10

I am having EAP issues with MSCHAPv2 packets. Does this output point to misconfiguration of FR or a NAS issue or both? Fri Jun 25 10:42:30 2010 : Info: ++[pap] returns noop Fri Jun 25 10:42:30 2010 : Info: Found Auth-Type = MSCHAP Fri Jun 25 10:42:30 2010 : Info: +- entering group MS-CHAP {...} Fri Jun 25 10:42:30 2010 : Info: [mschap] Told to do MS-CHAPv2 for 0010E741540D(a)WiMax.com with NT-Password Fri Jun 25 10:42:30 2010 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Fri Jun 25 10:42:30 2010 : Info: ++[mschap] returns reject Fri Jun 25 10:42:30 2010 : Info: Failed to authenticate the user. } # server inner-tunnel Fri Jun 25 10:42:30 2010 : Info: [ttls] Got tunneled reply code 3 Framed-Filter-Id = "SP=sp1:MSF=msf1;" Session-Timeout = 4200 MS-CHAP-Error = "LE=691 R=1" Fri Jun 25 10:42:30 2010 : Info: [ttls] Got tunneled Access-Reject Fri Jun 25 10:42:30 2010 : Info: [eap] Handler failed in EAP/ttls Fri Jun 25 10:42:30 2010 : Info: [eap] Failed in EAP select Fri Jun 25 10:42:30 2010 : Info: ++[eap] returns invalid David

2 1

EAP-TTLS,SecureW2 issue
by Philippe Schwarz 24 Jun '10

24 Jun '10

Hi, I've built a FR-2.1.3 (with rlm ldap) on OpenBSD, with credentials on a OpenLDAP (2.3.30-5+etch3), using EAP-TTLS. Everything, 's working fine with Iphone,Linux &MacOS. But with Windows (XP, Vista & 7), i'm unable to get the SecureW2 (v3.3.3.) client connecting. 1. Downloaded locally both the CA & Radius .der certificates 2. Installed both of them of local computer. 3. Add both (and also tried only radius cert, or no cert at all) certs to SecureW2. But Always got : "Received an invalid server certificate, please verify your certificate configuration" response from the software. All the steps (in french) : http://www.openbsd-edu.net/index.php/FreeRadius Found almost nothing usable either on the Securew2 website or on the goggled links... If anyone had an idea.. Thanks. -- Lycée Alfred Nobel, Clichy sous Bois http://www.lyceenobel.org

2 1

Am I going to cause a problem with this config setup?
by Tom Leach 24 Jun '10

24 Jun '10

I'm trying to configure Freeradius to use LDAP (which is working), but I need to mix PAP and CHAP. I have a wireless web-auth that uses PAP and is sending the cleartext password (tunneled via TLS) to the LDAP database that contains the encrypted (SSHA) user passwords. I also have switches that only do CHAP but for those, I'm only going to do MAC-auth so I've set up a separate database (same LDAP server, different basedn) that contains cleartext passwords (the MAC address) for each MAC that is authorized for the switch. I know it's not the best access control, but better then none. I've set up 4 ldap modules, two different basedn's on two redundant servers. This appears to work so far, but am I missing something here that's going to cause problems down the line??? Here are the authorize and authenticate sections of default, I haven't removed mschap, suffix, eap, unix or files, but none of them _should_ be used.: authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files redundant-load-balance { ldap-server1-radius ldap-server2-radius } redundant-load-balance { ldap-server1 ldap-server2 } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant-load-balance { ldap-server1 ldap-server2 } } eap }

2 1

Re: speed of detail reader server
by Alexandru Oprisan 24 Jun '10

24 Jun '10

On 23.06.2010 10:07, freeradius-users-request(a)lists.freeradius.org wrote: > On Mon, Jun 21, 2010 at 07:48:19PM +0300, Alexandru Oprisan wrote: >> > I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. >> > I have everything set up, the only problem seems to be the speed of >> > the 'detail reader server'. I do quite a lot off accounting packets on >> > the box ( no auth ), the detail writer has already written 1.9G of >> > details ( in about 5 hours ) to hourly files, but the detail reader is >> > lagging far behind (still working on the first file). I only see about 1 >> > row inserted per second, but I know the server can do far more. >> > I have set load-factor to 100, doesn't seem to help. > The detail reader is serial in nature, meaning it will read a packet, > transmit it, and wait for a response. Upon receipt of an ack it will > repeat for the next packet. If you have any sort of latency on your > link you can easily get heavily backlogged. > > We ended up implementing a proxy in between the detail file reader and > the remote end; the proxy (a custom Perl script) transmits across > several sockets, which the remote end seems to be able to deal with > properly. This has alleviated any backlog. > > I have grand plans to modify the reader to transmit non-serially, but so > far have not had the tuits to apply to the problem. I'm not sure I would > recommend the proxy solution, but if you can manage it, it may be a > reasonable stop-gap. > I have worked around the problem by compiling freeradius 2.1.7. I noticed in the release notes for 2.1.7 the following bug fix: Allow detail file reader to be faster when "load_factor = 100" It seems to work perfectly, the detail reader caught up with the detail writer in just a few hours. The reason I had not compiled 2.1.7 previously is that it does not compile in gentoo ( using emerge ) unless you add the "threads" USE flag ( which I didn't know ) Thanks for your answer. Alex

1 0

Re: Freeradius-Users Digest, Vol 62, Issue 96
by Alexandru Oprisan 24 Jun '10

24 Jun '10

On 23.06.2010 10:07, freeradius-users-request(a)lists.freeradius.org wrote: > On Mon, Jun 21, 2010 at 07:48:19PM +0300, Alexandru Oprisan wrote: >> > I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. >> > I have everything set up, the only problem seems to be the speed of >> > the 'detail reader server'. I do quite a lot off accounting packets on >> > the box ( no auth ), the detail writer has already written 1.9G of >> > details ( in about 5 hours ) to hourly files, but the detail reader is >> > lagging far behind (still working on the first file). I only see about 1 >> > row inserted per second, but I know the server can do far more. >> > I have set load-factor to 100, doesn't seem to help. > The detail reader is serial in nature, meaning it will read a packet, > transmit it, and wait for a response. Upon receipt of an ack it will > repeat for the next packet. If you have any sort of latency on your > link you can easily get heavily backlogged. > > We ended up implementing a proxy in between the detail file reader and > the remote end; the proxy (a custom Perl script) transmits across > several sockets, which the remote end seems to be able to deal with > properly. This has alleviated any backlog. > > I have grand plans to modify the reader to transmit non-serially, but so > far have not had the tuits to apply to the problem. I'm not sure I would > recommend the proxy solution, but if you can manage it, it may be a > reasonable stop-gap. > I have worked around the problem by compiling freeradius 2.1.7. I noticed in the release notes for 2.1.7 the following bug fix: Allow detail file reader to be faster when "load_factor = 100" It seems to work perfectly, the detail reader caught up with the detail writer in just a few hours. The reason I had not compiled 2.1.7 previously is that it does not compile in gentoo ( using emerge ) unless you add the "threads" USE flag ( which I didn't know ) Thanks for your answer. Alex

1 0