July 2011 - Freeradius-Users - lists.freeradius.org

How to log "TLS name" instead of username
by Johannes Koepcke 10 Aug '11

10 Aug '11

Hey, I'm running a freeradius2 server with mysql. Some users are authenticating via mschapv2 and some through eap-tls. My problem is that for eap-tls, the actual username field doesn't matter, user's could specify anything as the username, as long as their certificates are valid. So I would like to log the name of the certificate owner instead of the radius username to my radpostauth table. How would I do that? Or do you recommend another way to accomplish what I'm trying to do? Thanks in advance, Johannes.

4 6

Freeradius closes
by john 08 Aug '11

08 Aug '11

The radiusd keeps closing and i have to restart it. I am running 2.1.11 on this server but i have recently upgraded to this and it was happening before. The program uses up all the memory on the computer which is 4GB and I have enclosed a picture of this. I can send what ever config files you need to help me discover this problem. We are using a MySql database to keep track of customer accounts and usage. free -m total used free shared buffers cached Mem: 3291 1462 1829 0 123 331 -/+ buffers/cache: 1006 2284 Swap: 6427 0 6427 -- John Babineaux Network Admin Radio Communications Service Crowley, Louisiana

4 11

Cleanup Stale Sessions - needed?
by Paolo Di Francesco 08 Aug '11

08 Aug '11

Hi Radius Gurus I have a problem with one not-so-typical situation. First of all, I am running daloradius on top of Freeradius: [root@radman ~]# radiusd -v radiusd: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. I have just update my network topology and therefore I moved some NASes from one server to another. When I did this change, obviously I did it without worrying what could happen to the radiusd. So I simply moved the NASes on new IPs/servers and restarted the radiusd. Now I have the users trying to get into the network but they look "online" to radiusd on the old NASes. In few words the connection is refused because radiusd thinks that the user is ALREADY online on the "old NAS" (not true) and it does not permit the user to get into the network. So I have this teasing menu option in daloradius which is called "Cleanup Stale Sessions". I think it does exactly what I need but: 1) I do not want to break the radiusd 2) I do not want to loose my radius logs ("who had that IP that day..") 3) I do not know if this is the right "button" to click So I am asking you if you have any idea of how to solve this issue and if I should click that button Thank you in advance (radiusd log follows) ----------------------------------------------------------------------- Auth: Multiple logins (max 1) [MPP attempt]: [myuser(a)mynet.org] (from client xyz port 45118 cli 00:15:6D:5E:0A:82) ----------------------------------------------------------------------- -- Ing. Paolo Di Francesco Level7 s.r.l. unipersonale Sede operativa: Largo Montalto, 5 - 90144 Palermo C.F. e P.IVA 05940050825 Fax : +39-091-8772072 assistenza: (+39) 091-8776432 web: http://www.level7.it

6 11

segmentation fault freeradius 2.1.7 using rlm_sql
by Amir Tal 03 Aug '11

03 Aug '11

Hi all, freeRADIUS version 2.1.7 (package freeradius2 on centos 5.6) Radius is configured to store user info (auth) in ldap - running on same machine as freeradius, and use rlm_sql for accounting info (and simultaneous use checks) - running on remote machine. For some unknown reason radiusd keeps getting segmentation faults, every few days and even after several hours of work. Jul 27 04:01:03 RADIUS4 kernel: radiusd[29903]: segfault at 00000000000000c8 rip 00002aef39fb9cfb rsp 00000000456d6170 error 4 Last lines in the radius.log : [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2011-07-27 04:01:03', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Trying to (re)connect unconnected handle 12.. rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 since configuration files are quite large, I didn't attach complete dump or radius -X , let me know what other info is needed. Regards, Amir Tal.

7 13

Disable mysql dbm during freeradius installation
by Vasanth Ragavendran 03 Aug '11

03 Aug '11

Hi I am installing Freeradius and for my scenario i just need to authenticate from local files and there is no need for DBM or mysql or anything. how do i disable them during installation of freeradius. I tried using --disable-rlm-dbm and similar but it din't work out. How do i disable them from installing? Awaiting any help! Many thanks. Thanks and regards R.Vasanth Ragavendran.

4 4

WiFI
by michel＠casa.co.cu 01 Aug '11

01 Aug '11

Hello I have three Linksys Wireless Routers: WRT160N WRT110 WRT360 - "Now I'm not sure of the model" With them, users connect to my network using WIFI using a password exchange. I would like to change this pattern, I wondered if configuration is possible to perform Authentication, Authorization and Accounting with Freeradius and if I can provide any documentation that details the way as it can get. Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

3 2

session resumption for WPA2-TLS
by Dhinesh gunasekaran 31 Jul '11

31 Jul '11

hi, am using Freeradius 2.1.10 along with wpa_supplicant 0.7.3 and hostapd 0.7.3 on ubuntu lucid 10.04 machines with openssl 1.0.0a in wpa_supplicant and 0.9.8k in freeradius server. i enabled session resumption in the free radius and it works fine for EAP methods -PEAP and TTLS when i hand when i configured for TLS, it seems in the cache it didnt get any values to store and it stops

1 1

selective disabling password logging for proxied users?
by Meike Stone 31 Jul '11

31 Jul '11

Hello, I'm sorry, that I ask again .. We are using the freeradius server with authentication against ldap as "local database" and proxy the realms (IPASS) to authenticate users are not in our database. So is is possible, to disable the password logging only for the proxied request? The local requests are only users who got a temporary voucher. In case of failure, the help desk should use the log to check if the user did use the correct password. But the password for IPASS users password should not be logged. If I disable the password logging in the detail section (suppress {User-Password}), the complete password logging will be disabled. Is it possible, to disable this selective only for proxied users? Thanks for help - Meike

1 0

How to create a new dictionary.brocade
by Wagner Pereira 29 Jul '11

29 Jul '11

Hello, guys. I have new Brocade TurboIron switches and I intend to configure aaa using one external FreeRADIUS server. I noticed that in my FreeRADIUS 2.0.4 there is no dictionary.brocade (see below). My question: is there a specific tool to create a new dictionary OR it is just to vi the file correctly and save it at the right directory? ------------------------ # # dictionary.brocade # VENDOR Brocade 1588 # # attributes # ATTRIBUTE Brocade-Auth-Role 1 string Brocade ATTRIBUTE Brocade-AVPairs1 2 string Brocade ATTRIBUTE Brocade-AVPairs2 3 string Brocade ATTRIBUTE Brocade-AVPairs3 4 string Brocade ATTRIBUTE Brocade-AVPairs4 5 string Brocade ATTRIBUTE Brocade-Passwd-ExpiryDate 6 string Brocade ATTRIBUTE Brocade-Passwd-WarnPeriod 7 string Brocade ------------------------ Regards, -- ### At PoP-SP/RNP, every day is an IPv6 day ### Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fixo. +55 11 3091-8901 Móvel. +55 11 9923-9554 fone@RNP: 10158902

3 2

RE: Unlang issue
by Garber, Neal 29 Jul '11

29 Jul '11

> Try: > > if ((Client-IP-Address == x) || (Client-IP-Address == y)) { > } No joy :-(. For now, I ended up doing: if (Called-Station-Id) { if (Client-IP-Address == "x") { update request { Huntgroup-Name := "zzzz" } } elsif (Client-IP-Address == "y") { update request { Huntgroup-Name := "zzzz" } } } Not as efficient, but it works. I'll retest the old unlang code after I upgrade later this year.

1 0