October 2012 - Freeradius-Users - lists.freeradius.org

Please ignore - unable to get common name from peer certificate
by Wegener, Norbert 28 Oct '12

28 Oct '12

Please ignore. There was a typo in my config. With best regards, ________________________________ Norbert Wegener

1 0

TLS: unable to get common name from peer certificate
by Wegener, Norbert 28 Oct '12

28 Oct '12

I can authenticate against a ldap server. That server also offers ldaps, which I would like to use. When trying ldaps connection I get: [ldap] expand: dc=dom,dc=MYCOMPANY,dc=NET -> dc=dom,dc=MYCOMPANY,dc=NET [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.0.2.13:636, authentication 0 [ldap] setting TLS mode to 1 [ldap] bind as acct(a)dom.mycompany.net/secret to 10.0.2.13:636 TLS: unable to get common name from peer certificate. [ldap] acct(a)dom.mycompany.net bind to 10.0.2.13:636 failed: Can't contact LDAP server [ldap] (re)connection attempt failed Is this a problem of freeradius (I am using 2.1.12) or something with the ldap server? With best regards, ________________________________ Norbert Wegener

1 0

rewrite User-Name in received Access-Request - tough question :)
by Bojan Pogacar 28 Oct '12

28 Oct '12

Hello! This is my first post on this mailing list. I hope someone can give me an advice over my problem that I am solving over a month. I even bought a book about freeradius and after reading it twice there is not an answer to my problem. I run a captive portal for wireless users with radius and all data stored in MySQL database. Majority of users type username and password in captive portal to get access and a few others are automatically authenticated by their MAC address (as username ) and predefined password (macauth feature in CoovaChilli) and those never see a captive portal, they immediately get access as they connect to the network. Those users don't have any bandwidth limits, all other useres do have. So far so good. Then they wanted me to change login procedure. All users would get free access for 30 minutes per day and they don't have to login through captive portal. After 30 minutes, captive portal would open and user would have to login with some coupone to connect to the internet. I've solved this by writing these two lines in file "hints" DEFAULT User-Name =~ "^[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9AF]{2}-[0-9A-F]{2}-[0-9A-F]{2}$" User-Name := "freeinternetfor30minutes" It worked very well except all users previously authenticated by MAC address didn't get theis own profiles, but they got logged in as "freeinternetfor30minutes" with bandwidth limitations. OK, that was logical, I deleted those two lines and wrote some unlung logic to the "sites-available/default" if(notfound){ #if user not in database update reply { Reply-Message := "Wrong username or password" } # if username was MAC address, try to login as "freeinternetfor30minutes" if (User-Name =~/^([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})-([0-9a-f]{2})$/i){ update reply { Reply-Message := "Hello Guest, I'will try to give you 30 minutes for free, if you didn't allready used it." } update request{ User-Name := "freeinternetfor30minutes" } update control { Auth-Type := "Accept" } } else { ok = reject } #rewrite_user } That is working fine, users can connect to the network, BUT accounting section logges their username in database as original MAC address, not rewritted username freeinternetfor30minutes . Also no bandwidth limitations arn't sent with Access-Accept, but I think that could be solved easyly. I've also tries to use module "attr_rewrite". I wrote those lines of code to "modules/attr_rewrite" attr_rewrite rewrite_user { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "%{User-Name}" replacewith = "freeinternetfor30minutes" ignore_case = no new_attribute = no max_matches = 10 append = no } and unhashed rewrite_user in "sites-available/default". I see that rewriting does happen, BUT then update control { Auth-Type := "Accept" } seems to stop working even if I put rewrite_user before "update control" AND also in accounting section User-Name is still MAC address, not rewritten username. I am stuck now, without any idea. Can anyone tell me, is this even possible what I am trying to do and if so, what path should I take. Would it be possible to create new virtual server and pass rewritten username to that virtual server, which would try to login as "freeinternetfor30minutes" THANK YOU for your help! Best Regards, Bojan

3 6

Re: ChilliSpot-UAM-Allowed on witch mysql table ?
by Alan Buxey 27 Oct '12

27 Oct '12

If its to set something on the NAS, then its the reply table, if its to enforce a policy/verify then it's in the check table alan

1 0

explicit mode service creation with 4m
by larry tembu 27 Oct '12

27 Oct '12

________________________________ hi users, could you kindly guide me on how to make freeradius work with the explicit mode of service config on wimax 4m? explicit mode means that all the attributes and service configurations for a cpe are configured on the AAA and only downloaded to the ASN when the client makes a request. basically a L2 service using a vlan. for more clarity, the 4motion system isnthe modular version. thanks, regards, Larry.

2 1

Ignoring too-frequent accounting packets from buggy NAS
by Phil Mayers 26 Oct '12

26 Oct '12

All, We are having a problem with our Cisco lightweight wireless since a recent firmware upgrade. I am delving into it, and will probably open a TAC case, but in the meantime I need a solution. The specific issue is that the NAS is sending interim accounting very, very frequently, in violation of the spec, its own config, and the Acct-Interim-Interval. My suspicion is that the device is sending an accounting update whenever some internal "update" occurs (e.g. migrate to a new AP) and that this is an unintended side effect of some internal changes. This is killing our SQL database :o( Until I can get this fixed, can anyone think of an easy way to throw away interim accounting requests for a given "key" and time window? I'm wondering if rlm_cache can be made to do it? Cheers, Phil

3 5

Optimal setup to handle large tps
by Marius Booysen 26 Oct '12

26 Oct '12

Hi All, I was hoping for some advice from some of you: I have a requirement to deploy Freeradius to handle about 2M customers and of course I need to set up my environment optimally. I am aiming for about 1500 auths or accounting requests per second. 1.) Can Freeradius achieve that? Reading the performance blurb suggests it can? 2.) In order to achieve that, I guess it would be best to split auth and accounting to different servers? Agree? 3.) What is the optimal way to use the users file? As a gdbm/dbm data file or plain text file or something else? 4.) Any other advice would be appreciated! Thanks a lot! Kosie

3 2

eap-peap gtc configuration
by Nandkumar Palkar 26 Oct '12

26 Oct '12

Hi, What is the attribute used in eap-peap gtc "login attempt with password attribute" (i.e. Challenge = "Password: ")? Thanks, Nand.

2 2

Optimal setup to handle large tps
by Marius Booysen 26 Oct '12

26 Oct '12

Thanks Alan. 3.) I was thinking of going mysql, but in my mind accessing a DB *had* to be slower that accessing a dbm file ;) Anyway, thanks for the advice, I will test MySQL for sure. Kosie

2 1

Triggering an action on AuthZ failure
by Adam Bishop 25 Oct '12

25 Oct '12

Hello, What is the correct way to run a module if authorisation is going to fail? Specifically, I'm trying to use the line log to record when a user is refused access for reasons other than bad credentials. My initial thought was to try and check rcode, but that didn't seem to work (I'm not 100% sure I had the test correct though): authorize { // ... // Policy checks and things // ... if (rcode == reject) { refusal_log } } Adam Bishop Systems Development Specialist gpg: 0x6609D460 t: +44 (0) 1235 822 245 xmpp: adamb(a)jabber.dev.ja.net Janet, the UK’s research and education network. Janet is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

2 2