September 2011 - Freeradius-Users - lists.freeradius.org

Freeradius & CISCO ISG
by Student University 26 Sep '11

26 Sep '11

Hi , Can any one please point me of how i can configure freeradius to support CISCO ISG . Best Regards ,,, Lily

1 0

same pool_key
by sekchel lee 23 Sep '11

23 Sep '11

freeradius 1.7 nas1 - localhost nas2 - 222.x21.xxx.2 sqlippool nas1-user-1 pool_key 1 nas1-user-2 pool_key 2 .. .. nas2-user-1 pool_key 7 nas2-user-2 pool_key 9 .. .. sometimes and randomly nas1-user-5 login .... Be assigning ==> pool_key 9 (nas2-user the same pool_key) nas2-user-6 login .... Be assigning ==> pool_key 2 (nas1-user the same pool_key)

2 1

anyone tried SSH tunneling for user auth?
by Andreas Rudat 23 Sep '11

23 Sep '11

Hello, I want to use a ssh tunnel between radius and my user database on another machine, anyone tried that? I think it should work port forwarding on port 139 of samba or sql port? Thanks Andreas

2 1

Re: Authention Failure when putting NAS in private network.
by 2394263740 22 Sep '11

22 Sep '11

Then this is not really FR problem, is it? Figure out how to configure your gateway properly, or ask/hire competent people to do it. -- Fajar Hello, Fajar, The internet gateway drop the packet, so it's not a FR problem. We tested the NAT/PAT, Packet Forwarding and Application rules on gateway router. So far, only one WIFI router in private network is supported. When the WIFI router send the authentication request, the request port is dynamic, so we have to set up the packet forwarding to a single WIFI router. We're looking for some soluton like proxy etc. Thanks! Tom

1 0

MySQL performance
by Lorenzo Milesi 22 Sep '11

22 Sep '11

Hi. I have a Freeradius server with MySQL backend, which has worked great so far. Right now we're increasing the users accounting here, and we're facing some login issues. Freeradius is used as an accounting service for Chillispot. I tried increasing num_sql_socks to 14, and raised thread_concurrency to 8 in my.cnf, but yet on the client I get radius errors. Could it be related to database performance? Server load is normally below 0.10, cpu mostly unused. In radius.log I see no errors. But on the client: radius.c: 235: No such id in radius queue: 76! radius.c: 1473: Matching request was not found in queue: 76! chilli.c: 3696: radius_ind() failed! which can mean slow response times from the server. Sadly I have no way to increase radius request timeout on the client. I believe it's not an issue with connection because I'm seeing this problem also on clients which always ran fine before the user increase. How can I check FreeRadius is not suffering too many requests? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/ Via Carlo Torri Tarelli 19 - 23900 Lecco - ITALY - Tel 0341 220 205 - Fax 178 6070 222 GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it -------- D.Lgs. 196/2003 -------- Si avverte che tutte le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario. Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo, a non inoltrarlo a terzi e ad avvertirci non appena possibile. Grazie.

4 17

Re: Authention Failure when putting NAS in private network.
by 2394263740 22 Sep '11

22 Sep '11

Am 22.09.2011 03:23, schrieb 2394263740: > Hello, > Here is my freeradius enviroment. > The freeradius is used for WIFI users access authentication. > OS: Linux Enterprise Server 6.1 > Radius: free radius server 2.1.11 > Database: Mysql > The freeradius server was put on internet. > Sometime, the WIFI router need be put on the private network, which > connect to Internet through a gateway. > When we put the WIFI router on the private network, the WIFI user > authentication always fail. > Checked both the server and client side, we found the server is > sending packet to WIFI router(NAS), but the packet didn't reach the > WIFI router. The packet was dropped by the gateway. > Can anyone advise a solution for this? > Thanks! > Tom > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hi, if needed, have u changed or added the new client to radius? Andreas Andreas, Thanks for your reply. Client of of the radius was set to 0.0.0.0, which means any NAS. The freeradius server received the request and the reply was sent to the WIFI router as well. The problem is packet was drop by private network gateway. Since the authentication request is in UDP. The private network gateway doesn't have a session opened for the NAS. Thanks! Tom

2 1

Authention Failure when putting NAS in private network.
by 2394263740 22 Sep '11

22 Sep '11

Hello, Here is my freeradius enviroment. The freeradius is used for WIFI users access authentication. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql The freeradius server was put on internet. Sometime, the WIFI router need be put on the private network, which connect to Internet through a gateway. When we put the WIFI router on the private network, the WIFI user authentication always fail. Checked both the server and client side, we found the server is sending packet to WIFI router(NAS), but the packet didn't reach the WIFI router. The packet was dropped by the gateway. Can anyone advise a solution for this? Thanks! Tom

2 1

CHAP WITH MD5 SQL PASSWORD
by Ivaylo Petkov 21 Sep '11

21 Sep '11

Hi There, I have a FREE RADIUS Ubuntu installation and i am trying to get a CHAP authentication working with password that is stored in MD5 hash format in MySQL database. If i put a cleat text password the authentication works perfect with CHAP and PAP but the moment i use a md5 hashed password i get Reject packets. I have tried putting the password as Password, Clear-Text-password, MD5-Password, CHAP-Passoword, User-Password with no success. Please if someone have any hints for me please respond to this post. Regards, Ivo

2 1

Confusion between Freeradius + MSCHAPv2 + Samba
by Andreas Rudat 21 Sep '11

21 Sep '11

Hello, I have two machines. Freeradius + Samba as PDC. I auth. wlan clients against Radius and I want to store any user data on my Samba. The client auth, will be realized with PEAP+MSCHAPv2. So the problem is the bad thing with MSCHAPv2 and NTLMv1. So an other way could be kerberos and I read this howto http://deployingradius.com/documents/configuration/active_directory.html but is it usefull to use kerberos with two machines? I think it would be a contradiction of kerberos and would it work without AD/ldap? And could I use a sql database to save the encrypted passwords by using ntlm and the rlm_mschap module? Thanks! Andreas

2 2

WARNING about auth-type = Local
by Johan Meiring 21 Sep '11

21 Sep '11

Hi, I use a completely custom setup. Not using the "default" server at all. All is working fine, except for a warning. In the authorise section, I have rlm_sql that selects the cleartext password from a database. The query looks like this. authorize_check_query = "SELECT AccountID, Login, 'Cleartext-Password', Password, ':=' \ from Account WHERE Login = '%{SQL-User-Name}'" } This is the rlm_sql query defined. My authorise and authenticate section looks like this. authorize { authorisation_log chap mschap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } When a PAP request comes in, just after the sql selects the password and somewhere before authenticate, I get a warning. (Unsure if the warning will appear for CHAP/MSCHAP) --------------------------------------------- [sql] expand: SELECT AccountID, Login, 'Cleartext-Password', Password, ':=' from Account WHERE Login = '%{SQL-User-Name}' -> SELECT AccountID, Login, 'Cleartext-Password', Password, ':=' from Account WHERE Login = 'test(a)domain.co.za' [sql] User found in radcheck table rlm_sql (sql): Released sql socket id: 1 +++[sql] returns ok ++- else else returns ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. # Executing section post-auth from file /etc/freeradius/sites-enabled/custom +- entering group post-auth {...} ------------------------------------------------------- Do I need to concern myself with the warning? All is working fine, I was just enquisitive as to why this happens. Thanks! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 -------------------- Before acting on this email or opening any attachments you should read Cape PC Service's email disclaimer at: http://www.pcservices.co.za/disclaimer.html

3 4