September 2011 - Freeradius-Users - lists.freeradius.org

Re: Freeradius + Fedora-DS + EAP-MSCHAPv2 for WIFI/AP authentication
by Alan Buxey 20 Sep '11

20 Sep '11

You can use LDAP without needing AD or some 3rd party supplicant on the OS , but as already said, you will need to have the password as nthash or cleartext. Read the compatibility matrix alan -- Message may be brief as it has been sent from my mobile

1 0

Telkom DSL confiruration
by Hilton Boyce 20 Sep '11

20 Sep '11

Hi I ma looking for an example to compare of a rad accept request for telkom adsl as All of a sudden I have routers that do not auth and have throuput issues. regards Hilton

1 0

2.1.12 potential problem...
by James J J Hooper 20 Sep '11

20 Sep '11

>> Don't do that. >> >> Instead, don't reject the in the first place. For example: >> >> authorize { >> >> ... >> >> sql >> if (notfound) { >> update control { >> Auth-Type := Accept >> } >> } >> >> } > > Above won't work since: > https://github.com/alandekok/freeradius-server/commit/1a00da32c13fb979e1174… > > -James https://github.com/alandekok/freeradius-server/commit/1a00da In fact this dictionary change breaks other stuff too, e.g. below: [vpieap] Request found, released from the list [vpieap] EAP/mschapv2 [vpieap] processing type mschapv2 [mschapv2] WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/vpi-inner [vpieap] Freeing handler ++[vpieap] returns reject Failed to authenticate the user. and e.g: grep -R 'pairmake("Auth-Type", "' freeradius-server/src/* freeradius-server/src/modules/rlm_chap/rlm_chap.c: pairmake("Auth-Type", "CHAP", T_OP_EQ)); freeradius-server/src/modules/rlm_digest/rlm_digest.c: pairmake("Auth-Type", "DIGEST", T_OP_EQ)); -James

4 10

Freeradius performance problem
by Giuseppe Marocchio 20 Sep '11

20 Sep '11

Hello Guys i have inherited the administration of a radius server, that authenticate 900 PPPoE user on mikrotik box. i've noticed that there is some performance problem, mikrotik box show that "last request RTT" in some cases is up to 1000ms, there is some "resend" request and also some "timeouts", In order to mitigate the problem i've disabled the interim update, and the timeouts are drastically reduced. But exists. i' use mysql back-end, i've checked if there are slow queries but file is empty. ( of course is enabled... ) the server is a dual core Xeon 3.0Ghz with 1 Gb of ram. The SO is debian Linux stable, freeradius is 2.1.10 installed by debian package. Configuration of Thread/server: max_request_time = 30 cleanup_delay = 2 max_requests = 10240 thread pool { start_servers = 20 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } Any ideas? Best Regards, -- Giuseppe Marocchio Tel: (+39) 045.5116192 Fax: (+39) 045.5111197 skype: giuseppe.marocchio

2 1

Authorization help
by Rajkumar balaji 20 Sep '11

20 Sep '11

Hi All, Thanks for helped me to Authenticate with FreeRADIUS. Now I am able to authenticate successfully. Please help me to resole with the following issue, How to get authorize with FreeRADIUS? Where to store the user group details and his permissions? (which file i have to store it) Thanks Regards Rajkumar -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authorization-help-tp4821733p482173… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: redundant FreeRadius Servers
by Alan Buxey 20 Sep '11

20 Sep '11

Just ensure that they have the same config. If you want to use mysql then master/slave replication would be a way of achieving that alan

1 0

redundant FreeRadius Servers
by Simon Langen 20 Sep '11

20 Sep '11

Hello, I need two FreeRadius Servers which have the same data consisted. I'm testing on two Ubuntu 10.4 with freeradius 2.1.8. My Cisco# asks the first and if the first is not available it asks the second. Is there any Information on this topic? I use freeradius with mysql. is mysql-replication a good idea? Best Regards, Simon

1 0

Freeradius Performance
by sekchel lee 19 Sep '11

19 Sep '11

Freeradius Performance My computer Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz RAM 2GB CentOS 5.5 NAS Client pptp and openvpn each NAS user 100 ~ 300 How many NAS Client ? The ? NAS How much bandwidth?

2 1

Need a little regex help
by Commonn Systems 19 Sep '11

19 Sep '11

Hello list! After reading the list pretty much everyday for a month now, going through the docs, manuals and a lot of googling (which always brought me back to the list anyway), I have finally decided which way to go to filter access to two SSIDs, for 2 groups. I am using FR 2.1.11 on Debian squeeze, against an AD domain with LDAP membership lookup. I have 5 AP registered with FR, they each have 2 SSIDs that show in the request as MACADDRESS:SSID_ABC. Based on Phil Mayers on this post, http://freeradius.1045715.n5.nabble.com/How-do-I-have-one-Freeradius-server… , I would like to match the last 8 characters of the Called-Station-Id, "SSID_ABC" authorize { if (Called-Sation-Id == SOMEREGEX:SSID_ABC) { update request { Tmp-String-0 = "Staff" } } elsif (Called-Sation-Id == SOMEREGEX:SSID_DEF) { update request { Tmp-String-0 = "Students" } } } Everything is working great, this is the last piece of the puzzle to finalize the project. I understand, this does not have anything to do with the wonderful software that freeradius is, but from what I have read, lots of people on this list are very skilled with regex. Thank you so much for all the work and help you put in here. Tossi

3 3

sqlippool problem 2 NAS
by sekchel lee 19 Sep '11

19 Sep '11

--no Problem-- nas1 (localhost) Only one NAS login and logout No problem --Problem-- nas1 (localhost) nas2(remote) Username NASIPAddress CalledStationId CallingStationID expiry_time pool_key user1 127.0.0.1 1xx.2xx.3xx.1 2011-09-19 20:00:00 0 user2 127.0.0.1 1xx.3xx.3xx.2 2011-09-29 20:21:13 10 user3 127.0.0.1 1xx.4xx.3xx.3 2011-09-29 20:21:13 9 user4 127.0.0.1 1xx.5xx.3xx.4 2011-09-29 20:21:13 4 Now time is 2011-09-19 20:00:00 user5 login....... Username NASIPAddress CalledStationId CallingStationID expiry_time pool_key user1 2011-09-19 20:00:00 0 user2 127.0.0.1 1xx.3xx.3xx.2 2011-09-29 20:21:13 10 user3 127.0.0.1 1xx.4xx.3xx.3 2011-09-29 20:21:13 9 user4 127.0.0.1 1xx.5xx.3xx.4 2011-09-29 20:21:13 4 user5 127.0.0.1 1xx.6xx.3xx.5 2011-09-29 20:21:13 0 NASIPAddress,CallingStationID,pool_key is random over time nas1 10 user connect nas2 8 user connect but sqlippool is Username NASIPAddress CalledStationId CallingStationID expiry_time pool_key user1 2011-09-19 20:00:00 0 user2 127.0.0.1 1xx.3xx.3xx.2 2011-09-29 20:21:13 10 user3 127.0.0.1 1xx.4xx.3xx.3 2011-09-29 20:21:13 9 user4 127.0.0.1 1xx.5xx.3xx.4 2011-09-29 20:21:13 4 user5 127.0.0.1 1xx.6xx.3xx.5 2011-09-29 20:21:13 0 user6 2011-09-19 20:00:00 0 user7 2011-09-19 20:00:00 0 user8 2011-09-19 20:00:00 0 user5 127.0.0.1 1xx.9xx.3xx.9 2011-09-29 20:21:13 20 .. .. nas1(localhost) no problem nas1(localhost) + nas2(remote) ==> This problem Help me.

1 0