September 2011 - Freeradius-Users - lists.freeradius.org

Grant Access
by 2394263740 14 Sep '11

14 Sep '11

Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql When the system goes wrong, I would like temporary grant all access request. Which means during the service is down, any username/password will be grant access. Can you please advise the solution? Thanks! Tom

3 2

Re: Grant Access
by Alan Buxey 14 Sep '11

14 Sep '11

You can't, which is why the reply said it'd only work with basic requests. For wired authentication, you can set the fail port to something useful on the switch, for wireless you can't change the method...the auth process is used to derive the encryption key...and the client expects a challenge response. alan

1 0

distributed database
by Ryan Williams 14 Sep '11

14 Sep '11

I'm looking at implementing freeradius w/MySQL for auth & accounting with a single master database and multiple (initially two) radius servers (slaves). The idea is that the slaves will run freeradius and the master will be integrated with the billing system. The slaves can download an exact copy of the masters radcheck & radreply tables at frequent intervals. - That bit is easy. The difficulty arises when trying to run a distributed session table and also trying to implement some sort of replication so the slaves can push their radacct table back up to the master while avoiding PK conflicts. I'm considering one of the two solutions 1) Make the ID column in both the session table and radacct a NEWID / GUID / statistical key or 2) Add a SlaveID int column to both tables and use a joint ID,SlaveID Primary Key. Does anyone have any experience with either or does anyone have any thoughts on the matter? Regards, Ryan Williams

2 1

Re:Grant Access
by 2394263740 14 Sep '11

14 Sep '11

Arran, I'm using PEAP. Do you have any suggestion to grant access? Thanks! ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Tue, Sep 13, 2011 11:59 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 50 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Grant Access ( 2394263740 ) 2. Re: Grant Access (Arran Cudbard-Bell) 3. Quick enable/disable user account. ( 2394263740 ) 4. Re: Quick enable/disable user account. (Alan DeKok) 5. Re: Quick enable/disable user account. (Arran Cudbard-Bell) 6. RE: Quick enable/disable user account. (Tim Sylvester) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 23:07:31 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Grant Access To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_1ABBB04B470455063AD97831(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql When the system goes wrong, I would like temporary grant all access request. Which means during the service is down, any username/password will be grant access. Can you please advise the solution? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 17:16:02 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Grant Access To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <9285C1EC-7439-4652-8AEC-22FBAD42A485(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" On 13 Sep 2011, at 17:07, 2394263740 wrote: > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > When the system goes wrong, I would like temporary grant all access request. > > Which means during the service is down, any username/password will be grant access. > > Can you please advise the solution? sql if(fail){ update control { Auth-Type := 'Accept' } } This will not work for protocols like PEAP. But should work for PAP, and CHAP. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Tue, 13 Sep 2011 23:32:43 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Quick enable/disable user account. To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_604FCE075B879FA320DD1DCF(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 4 Date: Tue, 13 Sep 2011 17:39:48 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6F7944.5050204(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 2394263740 wrote: > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? See the MySQL documentation for how to write to rows in MySQL. > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. Try harder. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 13 Sep 2011 17:42:54 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <AF7E673D-1735-467E-B0C8-06C49AC33E87(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" No. You're treating this like paid support. Go and find out the answer for yourself, this is not a FeeRADIUS question. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 6 Date: Tue, 13 Sep 2011 08:59:15 -0700 From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> Subject: RE: Quick enable/disable user account. To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <041301cc722e$1745e360$45d1aa20$(a)networkradius.com> Content-Type: text/plain; charset="us-ascii" Set Auth-Type := Reject in radcheck. http://deployingradius.com/documents/configuration/auth_type.html Tim From: freeradius-users-bounces+tim.sylvester=networkradius.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freer adius.org] On Behalf Of 2394263740 Sent: Tuesday, September 13, 2011 8:33 AM To: freeradius-users Subject: Quick enable/disable user account. Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 50 ************************************************

2 1

Re:Quick enable/disable user account.
by 2394263740 14 Sep '11

14 Sep '11

Christ, Thanks for your help. Can you please advise how to configurre a group reject access? Thanks! Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Wed, Sep 14, 2011 02:01 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 51 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Problem with rml_sqlcounter with GigaByte datavolume (Nicolas FOUREL) 2. Re: Problem with rml_sqlcounter with GigaByte datavolume (Suman Dash) 3. Re: Best Practices - maximum NAS entries in clients.conf (Christ Schlacta) 4. Re: Quick enable/disable user account. (Christ Schlacta) 5. Re: Best Practices - maximum NAS entries in clients.conf (Arran Cudbard-Bell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 18:30:55 +0200 From: "Nicolas FOUREL" <nicolas.fourel(a)adipsys.com> Subject: RE: Problem with rml_sqlcounter with GigaByte datavolume To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <4e6f8544.8dc5e30a.148c.558f(a)mx.google.com> Content-Type: text/plain; charset="iso-8859-1" Hi Arran, I have get version 3.0.0 with 64 bit counters support from Git and installed it. Unfortunatly, I still have the same problem with my sql counter which has always "check_item=0" when I put a value bigger than 2^32. On Access-Request in debug mode, I have the following lines : Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: Rejected user foo(a)bar.com, check_item=0, counter=68882 Here is my counter definition : sqlcounter totalinputoctets { counter-name = Total-Max-Input-Octets check-name = Max-Input-Octets reply-name = ChilliSpot-Max-Input-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctInputOctets) FROM radacct WHERE UserName='%{%k}'" } I have added "Max-Input-Octets" in the dictionary file like that : ATTRIBUTE Max-Input-Octets 3001 integer64 In radcheck table: foo(a)bar.com Max-Input-Octets := 107374182400 Did I miss a thing ? Many thanks Nicolas -----Message d'origine----- De?: freeradius-users-bounces+nicolas.fourel=adipsys.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+nicolas.fourel=adipsys.com@lists.freeradius .org] De la part de Arran Cudbard-Bell Envoy??: lundi 12 septembre 2011 11:46 ??: FreeRadius users mailing list Objet?: Re: Problem with rml_sqlcounter with GigaByte datavolume On 12 Sep 2011, at 10:20, nfourel wrote: > Thanks for your reply but I can't find any version 3.x.x of freeRADIUS. Where > can I find it ? > http://git.freeradius.org/ 3.x.x is currently in development on the master branch. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 23:09:39 +0530 From: Suman Dash <sumandash(a)gmail.com> Subject: Re: Problem with rml_sqlcounter with GigaByte datavolume To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CAOywgS8G==MvAZPs=s18pYsN36mA+xzGScb9e0KvcPELOHFsng(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" SELECT SUM(AcctInputOctets) FROM radacct WHERE UserName='username' Run the above query in mysql and post the result then post the freeradius log specific to this section. On Tue, Sep 13, 2011 at 10:00 PM, Nicolas FOUREL <nicolas.fourel(a)adipsys.com > wrote: > Hi Arran, > > I have get version 3.0.0 with 64 bit counters support from Git and > installed > it. Unfortunatly, I still have the same problem with my sql counter which > has always "check_item=0" when I put a value bigger than 2^32. On > Access-Request in debug mode, I have the following lines : > > Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: (Check item - counter) is > less than zero > Tue Sep 13 18:20:47 2011 : Debug: rlm_sqlcounter: Rejected user > foo(a)bar.com, > check_item=0, counter=68882 > > Here is my counter definition : > sqlcounter totalinputoctets { > counter-name = Total-Max-Input-Octets > check-name = Max-Input-Octets > reply-name = ChilliSpot-Max-Input-Octets > sqlmod-inst = sql > key = User-Name > reset = never > query = "SELECT SUM(AcctInputOctets) FROM radacct WHERE > UserName='%{%k}'" > } > > I have added "Max-Input-Octets" in the dictionary file like that : > ATTRIBUTE Max-Input-Octets 3001 integer64 > > In radcheck table: > foo(a)bar.com Max-Input-Octets := > 107374182400 > > > Did I miss a thing ? > > Many thanks > > Nicolas > > -----Message d'origine----- > De : > freeradius-users-bounces+nicolas.fourel=adipsys.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+nicolas.fourel > =adipsys.com(a)lists.freeradius > .org] De la part de Arran Cudbard-Bell > Envoy? : lundi 12 septembre 2011 11:46 > ? : FreeRadius users mailing list > Objet : Re: Problem with rml_sqlcounter with GigaByte datavolume > > > On 12 Sep 2011, at 10:20, nfourel wrote: > > > Thanks for your reply but I can't find any version 3.x.x of freeRADIUS. > Where > > can I find it ? > > > > http://git.freeradius.org/ > > 3.x.x is currently in development on the master branch. > > -Arran > > Arran Cudbard-Bell > a.cudbardb(a)freeradius.org > > RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Tue, 13 Sep 2011 10:39:48 -0700 From: Christ Schlacta <lists(a)aarcane.org> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: freeradius-users(a)lists.freeradius.org Message-ID: <4E6F9564.1070103(a)aarcane.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 9/13/2011 00:59, Fajar A. Nugraha wrote: > On Tue, Sep 13, 2011 at 2:43 PM, Phil Mayers<p.mayers(a)imperial.ac.uk> wrote: >> On 09/12/2011 10:42 PM, Fajar A. Nugraha wrote: >>> If I understand raddb/sites-available/dynamic-clients correctly, the >>> only way to store (well, to retrieve actualy) dynamic clients >>> definition in SQL is to use "%{sql:" expansion. Is there a way to make >>> it have some level of redundancy? Last time I check, "%{sql:" can't be >>> used on "virtual" modules (from instantiate or policy section) which >>> groups multiple sql instance together using "redundant". >>> >> You could also use "exec", rlm_perl/python or whatever, all of which can >> themselves call SQL. > possible, though not ideal. > >> Or, perform an SQL query that MUST return some output, parse the results and >> call the individual SQL modules directly - like so: >> >> update control { >> Tmp-String-0 := "%{sql1:select name||','||secret ...}" >> } >> if (control:Tmp-String-0 == "") { >> update control { >> Tmp-String-0 := "%{sql2:...}" >> } >> } > That's what we currently do (for another purpose, not for dynamic > client). However: > - I lost load-balancing feature that comes with redundant-load-balance > - imagine having to create 8 if-elsif block to properly catch error > when working with 8 sql nodes, and write the same sql query 8 times in > the configuration file. Works, but kinda messy. > > With current sql module (that only reads nas list from sql during > startup/HUP) I can use one sql/mysql/*.conf to specify the query, and > have each sql instance $INCLUDE it. If we can do similar thing with > "%{sql:" expansion (e.g. store the query in some temporary internal > variable/attribute) it'd be reduce the measiness greatly, but I > haven't found out how to do it yet. > why not make an arbitrary program that takes the SQL statement as an argument, and returns from the first successful connection. it can take a random number between 0 and n-1 on the number of SQL servers you have, and start connecting from there. you get failover and round-robin load balancing with the convenience of only having to write your query and your series of if-else-if statements once. ------------------------------ Message: 4 Date: Tue, 13 Sep 2011 10:46:21 -0700 From: Christ Schlacta <lists(a)aarcane.org> Subject: Re: Quick enable/disable user account. To: freeradius-users(a)lists.freeradius.org Message-ID: <4E6F96ED.6080307(a)aarcane.org> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" On 9/13/2011 08:32, 2394263740 wrote: > > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? > > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. > > Thanks! > > Tom > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html read up on mysql groups, then use a group that's configured to reject access. add and delete members from that group as needed to disable and re-enable their account. that's what groups are there for. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 5 Date: Tue, 13 Sep 2011 20:01:14 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <97DF6DE5-5FDB-416C-A528-FDC68A1D4274(a)freeradius.org> Content-Type: text/plain; charset=us-ascii On 13 Sep 2011, at 19:39, Christ Schlacta wrote: > On 9/13/2011 00:59, Fajar A. Nugraha wrote: >> On Tue, Sep 13, 2011 at 2:43 PM, Phil Mayers<p.mayers(a)imperial.ac.uk> wrote: >>> On 09/12/2011 10:42 PM, Fajar A. Nugraha wrote: >>>> If I understand raddb/sites-available/dynamic-clients correctly, the >>>> only way to store (well, to retrieve actualy) dynamic clients >>>> definition in SQL is to use "%{sql:" expansion. Is there a way to make >>>> it have some level of redundancy? Last time I check, "%{sql:" can't be >>>> used on "virtual" modules (from instantiate or policy section) which >>>> groups multiple sql instance together using "redundant". >>>> >>> You could also use "exec", rlm_perl/python or whatever, all of which can >>> themselves call SQL. >> possible, though not ideal. >> >>> Or, perform an SQL query that MUST return some output, parse the results and >>> call the individual SQL modules directly - like so: >>> >>> update control { >>> Tmp-String-0 := "%{sql1:select name||','||secret ...}" >>> } >>> if (control:Tmp-String-0 == "") { >>> update control { >>> Tmp-String-0 := "%{sql2:...}" >>> } >>> } >> That's what we currently do (for another purpose, not for dynamic >> client). However: >> - I lost load-balancing feature that comes with redundant-load-balance >> - imagine having to create 8 if-elsif block to properly catch error >> when working with 8 sql nodes, and write the same sql query 8 times in >> the configuration file. Works, but kinda messy. >> >> With current sql module (that only reads nas list from sql during >> startup/HUP) I can use one sql/mysql/*.conf to specify the query, and >> have each sql instance $INCLUDE it. If we can do similar thing with >> "%{sql:" expansion (e.g. store the query in some temporary internal >> variable/attribute) it'd be reduce the measiness greatly, but I >> haven't found out how to do it yet. >> > why not make an arbitrary program that takes the SQL statement as an argument, and returns from the first successful connection. it can take a random number between 0 and n-1 on the number of SQL servers you have, and start connecting from there. you get failover and round-robin load balancing with the convenience of only having to write your query and your series of if-else-if statements once. Calling out to anything outside of FreeRADIUS comes with a big performance penalty. I do sometimes wonder whether 'update config' would be useful as an interim hack for some of this stuff. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 51 ************************************************

3 2

Re:Quick enable/disable user account.
by 2394263740 13 Sep '11

13 Sep '11

Arran, Thanks for your help as always. You have helped me to fix about 5 of my major issues. The support from you is very helpful. Thanks! Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Wed, Sep 14, 2011 09:27 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 53 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Quick enable/disable user account. (Arran Cudbard-Bell) 2. Re: Quick enable/disable user account. (Marinko Tarlac) 3. Re:Grant Access ( 2394263740 ) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 22:32:06 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <99359D5B-34B0-4277-BCE7-379EF2FC48F4(a)freeradius.org> Content-Type: text/plain; charset=us-ascii > So what are the most proper ways to mark a user in an sql database as either active or inactive, enabled or disabled? It's implementation specific! FreeRADIUS gives you the tools to defined the policies, but its up to the individual administrators to decide what they should be. Like Skinning Cats and Perl, there are many ways to achieve the same result. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 23:01:03 +0200 From: Marinko Tarlac <mangia81(a)gmail.com> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6FC48F.7060201(a)gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Imagine that you have 5 000 disabled accounts and that you constantly rejecting them over and over again... Better option is to create specific group (for example disabled_accounts with specific IP Pool) and assign users to this group when you want to block them. Then you can redirect them to specific web page with "welcome" message :) On 9/13/2011 5:59 PM, Tim Sylvester wrote: > > Set Auth-Type := Reject in radcheck. > > http://deployingradius.com/documents/configuration/auth_type.html > > Tim > > *From:*freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org > [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freeradius.org] > *On Behalf Of *2394263740 > *Sent:* Tuesday, September 13, 2011 8:33 AM > *To:* freeradius-users > *Subject:* Quick enable/disable user account. > > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? > > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. > > Thanks! > > Tom > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Wed, 14 Sep 2011 09:27:00 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Re:Grant Access To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_7839F3D17E696E8063A56BF4(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Arran, I'm using PEAP. Do you have any suggestion to grant access? Thanks! ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Tue, Sep 13, 2011 11:59 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 50 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Grant Access ( 2394263740 ) 2. Re: Grant Access (Arran Cudbard-Bell) 3. Quick enable/disable user account. ( 2394263740 ) 4. Re: Quick enable/disable user account. (Alan DeKok) 5. Re: Quick enable/disable user account. (Arran Cudbard-Bell) 6. RE: Quick enable/disable user account. (Tim Sylvester) ---------------------------------------------------------------------- Message: 1 Date: Tue, 13 Sep 2011 23:07:31 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Grant Access To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_1ABBB04B470455063AD97831(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql When the system goes wrong, I would like temporary grant all access request. Which means during the service is down, any username/password will be grant access. Can you please advise the solution? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 2 Date: Tue, 13 Sep 2011 17:16:02 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Grant Access To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <9285C1EC-7439-4652-8AEC-22FBAD42A485(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" On 13 Sep 2011, at 17:07, 2394263740 wrote: > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > When the system goes wrong, I would like temporary grant all access request. > > Which means during the service is down, any username/password will be grant access. > > Can you please advise the solution? sql if(fail){ update control { Auth-Type := 'Accept' } } This will not work for protocols like PEAP. But should work for PAP, and CHAP. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Tue, 13 Sep 2011 23:32:43 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: Quick enable/disable user account. To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_604FCE075B879FA320DD1DCF(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 4 Date: Tue, 13 Sep 2011 17:39:48 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6F7944.5050204(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 2394263740 wrote: > Sometime, I need disable a user account in mysql database. And then > enable it later on after some check complete. > > Can you please advise how to toggle such status? See the MySQL documentation for how to write to rows in MySQL. > There're may be multiple solutions, please advise them all, so I can > choose a one most fit the needs. Try harder. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 13 Sep 2011 17:42:54 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Quick enable/disable user account. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <AF7E673D-1735-467E-B0C8-06C49AC33E87(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" No. You're treating this like paid support. Go and find out the answer for yourself, this is not a FeeRADIUS question. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 6 Date: Tue, 13 Sep 2011 08:59:15 -0700 From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> Subject: RE: Quick enable/disable user account. To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <041301cc722e$1745e360$45d1aa20$(a)networkradius.com> Content-Type: text/plain; charset="us-ascii" Set Auth-Type := Reject in radcheck. http://deployingradius.com/documents/configuration/auth_type.html Tim From: freeradius-users-bounces+tim.sylvester=networkradius.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+tim.sylvester=networkradius.com@lists.freer adius.org] On Behalf Of 2394263740 Sent: Tuesday, September 13, 2011 8:33 AM To: freeradius-users Subject: Quick enable/disable user account. Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 50 ************************************************ -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 53 ************************************************

1 0

Best Practices - maximum NAS entries in clients.conf
by Sallee, Stephen (Jake) 13 Sep '11

13 Sep '11

@ everyone We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use? Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR? Jake Sallee Godfather of Bandwidth Network Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221

8 20

Failure to activate mysql
by Majid Dadashi 13 Sep '11

13 Sep '11

Hi, I have the following platform: FreeRadius Version: freeradius-server-2.1.11 OS: Ubuntu 11.04 I did all the instructions in "http://wiki.freeradius.org/SQL-HOWTO" to activate mysql in free radius, but I get the following error: Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[166]: Failed to load module "sql". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. I just have a file named "rlm_sql_mysql.so" in the following address: "./src/modules/rlm_sql/drivers/rlm_sql_mysql" what do you think is the problem? Cheers

3 4

Re: First Run Problem
by Alan Buxey 13 Sep '11

13 Sep '11

Hi, Good to know, no problem alan

1 0

Re: NAS IP Address
by 2394263740 13 Sep '11

13 Sep '11

Arran, Yes. You're right. It works. Great! Thanks! Tom ------------------ Original ------------------ From: "a.cudbardb"<a.cudbardb(a)freeradius.org>; Date: Tue, Sep 13, 2011 03:56 PM To: "2394263740"<2394263740(a)qq.com>; Subject: Re: NAS IP Address Ah you want the attribute Packet-Src-IP-Address -Arran On 13 Sep 2011, at 03:55, 2394263740 wrote: Arran, Looks like the email didn't go through sometime. Please see below email for my question. Thanks! Tom ------------------ Original ------------------ From: "2394263740"<2394263740(a)qq.com>; Date: Tue, Sep 13, 2011 09:28 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Re:NAS IP Address Arran, Thanks for your help and reply. %{NAS-IP-Address} doesn't work for this case. The connection like below. Mobile --- WiFi Router --- Internet Gateway (NAT) ---Internet --- FreeRadius Server. The %{NAS-IP-Address} will be the LAN interfact IP, such as 192.168.1.1. This is not I need. I need the IP address, with such IP address, FreeRadius Server is communicating. This means, when FreeRadius receive the access request, the request IP packet was sourced from the Internet Gateway IP address, and this is the IP address I need. Inside the access request, there is %{NAS-IP-Address}, it's the LAN IP address of the WIFI router, %{NAS-IP-Address} is not the information I need in such case. Thanks! Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Mon, Sep 12, 2011 10:44 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 42 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. NAS IP Address ( 2394263740 ) 2. Re: NAS IP Address (Arran Cudbard-Bell) 3. Best Practices - maximum NAS entries in clients.conf (Sallee, Stephen (Jake)) 4. Re: Best Practices - maximum NAS entries in clients.conf (Alan DeKok) 5. Re: Best Practices - maximum NAS entries in clients.conf (Arran Cudbard-Bell) 6. Re: Best Practices - maximum NAS entries in clients.conf (Arran Cudbard-Bell) 7. Re: Best Practices - maximum NAS entries in clients.conf (Bruce Nunn) 8. Unable to Authenticate with SHA Password (Rajkumar balaji) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 Sep 2011 19:58:18 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: NAS IP Address To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_5E7B240C4B421E587B96F796(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql The WIFI routers we're using are in diffirent private networks, behind the internet gateways. The WIFI router has private IP address, such as 192.168.1.1. For some reason, we need know which Internet IP address, the WIFI router is using to do the authention with the FreeRadius server. The FreeRadius server is on internet. As the business needs, we need save the IP addres(Internet gateway IP address) to MySql database. Can anyone advise how to do so? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 2 Date: Mon, 12 Sep 2011 14:10:48 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: NAS IP Address To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <8B265A64-D969-4949-A8C8-A0BD016C62E8(a)freeradius.org> Content-Type: text/plain; charset="iso-8859-1" On 12 Sep 2011, at 13:58, 2394263740 wrote: > Hello, > I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > > The WIFI routers we're using are in diffirent private networks, behind the internet gateways. The WIFI router has private IP address, such as 192.168.1.1. > > For some reason, we need know which Internet IP address, the WIFI router is using to do the authention with the FreeRadius server. The FreeRadius server is on internet. > > As the business needs, we need save the IP addres(Internet gateway IP address) to MySql database. edit the queries in raddb/sql/mysql/dialup.conf and add the additional columns to the SQL database. The original IP address of the NAS may be sent in the NAS-IP-Address attribute, in which case use the expansion %{NAS-IP-Address} for the value of the new column. Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011091…> ------------------------------ Message: 3 Date: Mon, 12 Sep 2011 14:04:53 +0000 From: "Sallee, Stephen (Jake)" <Jake.Sallee(a)umhb.edu> Subject: Best Practices - maximum NAS entries in clients.conf To: freeradius-users <freeradius-users(a)lists.freeradius.org> Message-ID: <3A9815D880FBAF41A523B3A35AF3C3DF170E6FD1(a)AVATAR.umhb.edu> Content-Type: text/plain; charset="iso-8859-1" @ everyone We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use? Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR? Jake Sallee Godfather of Bandwidth Network Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221 ------------------------------ Message: 4 Date: Mon, 12 Sep 2011 16:17:40 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4E6E1484.70200(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Sallee, Stephen (Jake) wrote: > We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use? Whenever you get tired of managing them in clients.conf. The server has been tested with 500K clients in clients.conf. It takes a few seconds to start, and a gig or so of RAM, but it works. > Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR? Yes. You can also do this with files. See raddb/dynamic_clients in 2.1.12. (When it comes out) Alan DeKok. ------------------------------ Message: 5 Date: Mon, 12 Sep 2011 16:21:45 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <D41AD9A3-B5A6-4690-B053-58361E3D7D71(a)freeradius.org> Content-Type: text/plain; charset=us-ascii On 12 Sep 2011, at 16:04, Sallee, Stephen (Jake) wrote: > @ everyone > > We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine. We will be expanding our infrastructure soon and the number of NAS entries will increase significantly. At what point should we think about putting them into a database for FR to use? When it becomes a bear to deal with the clients.conf file :) - I guess memory might be a concern? But i'm sure there are sites out there with client.conf files holding thousands of entries... It's a hash table in C, it's going to be fast. > > Also, I have seen some chatter on the list about dynamic NASs. Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR? Indeed. You can also set them to expire as well, to clean up old unused entries. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. ------------------------------ Message: 6 Date: Mon, 12 Sep 2011 16:25:14 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CA2EA7A1-A06B-428C-9259-DEE20CFAC278(a)freeradius.org> Content-Type: text/plain; charset=us-ascii > Fone: 254-295-4658 > Phax: 254-295-4221 Nice :) Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time. ------------------------------ Message: 7 Date: Mon, 12 Sep 2011 07:41:16 -0700 (PDT) From: Bruce Nunn <ironrake(a)yahoo.com> Subject: Re: Best Practices - maximum NAS entries in clients.conf To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1315838476.43108.YahooMailNeo(a)web110413.mail.gq1.yahoo.com> Content-Type: text/plain; charset=iso-8859-1 If the network your APs are on is physically secure, and you don't need accounting for individual APs, you can use netmasks to define clients in the clients.conf file. ----- Original Message ----- From: "Sallee, Stephen (Jake)" <Jake.Sallee(a)umhb.edu> To: freeradius-users <freeradius-users(a)lists.freeradius.org> Cc: Sent: Monday, September 12, 2011 9:04 AM Subject: Best Practices - maximum NAS entries in clients.conf @ everyone We have about 100 NAS entries in our clients.conf file, it makes the file a bear to deal with but the server seems to handle it fine.? We will be expanding our infrastructure soon and the number of NAS entries will increase significantly.? At what point should we think about putting them into a database for FR to use? Also, I have seen some chatter on the list about dynamic NASs.? Am I correct in assuming that if we are using a DB instead of the clients.conf file we can add or remove clients simply by making changes to the correct table, all without having to restart FR? ------------------------------ Message: 8 Date: Mon, 12 Sep 2011 07:44:25 -0700 (PDT) From: Rajkumar balaji <rajkumar.balaji.s(a)gmail.com> Subject: Unable to Authenticate with SHA Password To: freeradius-users(a)lists.freeradius.org Message-ID: <1315838665841-4794449.post(a)n5.nabble.com> Content-Type: text/plain; charset=us-ascii Hi All, I am unable to authenticate the When I send SHA password to the FreeRADIUS. I have configured SHA-Password := "admin123" in the users file. My Password is admin123 and after SHA messagedigest its -50-2710713-59-76-1105593-48-89-126-957495-4-108-29-81-48 RADIUS is getting the request but its rejecting it. Please find the following radius logs, rad_recv: Access-Request packet from host 172.17.148.152 port 50459, id=0, length=111 User-Name = "emsadmin" User-Password = "-50-2710713-59-76-1105593-48-89-126-957495-4-108-29-81-48" NAS-Identifier = "sunems8-zone2" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "emsadmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry emsadmin at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "-50-2710713-59-76-1105593-48-89-126-957495-4-108-29-81-48" [pap] Using SHA1 encryption. [pap] Configured SHA1 password has incorrect length [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> emsadmin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 0 to 172.17.148.152 port 50459 Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +6002 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Unable-to-Authenticate-with-SHA-Pas… Sent from the FreeRadius - User mailing list archive at Nabble.com. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 42 ************************************************ Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time.

1 0