October 2012 - Freeradius-Users - lists.freeradius.org

RE: Volume limit/data limit with Mikrotik NAS on FreeRADIUS
by Angel Elena 17 Oct '12

17 Oct '12

Hello Antonio, good night. are you solved this question ? I'm trying the same with freeradius and accounting -----Mensaje original----- De: Antonio Fernández Pérez <antoniofernandez(a)fabergames.com> Enviado: Vie 05-10-2012 13:44 Asunto: Volume limit/data limit with Mikrotik NAS on FreeRADIUS Para: freeradius-users(a)lists.freeradius.org; > Hi everybody, > > I'm interested in configuring data limit/volume limit with RADIUS users using > Mikrotik NAS. I have read that maybe configuring some attributes like > Mikrotik-Rate-Limit is possible, but I could not to get it after done some > tests. I have gotten to configure data limit by session with > Mikrotik-Xmit-Limit and Mikrotik-Recv-Limit. Anybody can help me? Anybody has > the same problem? > > Thank you very much. > > Best regards, > > Antonio. > > -- > > Antonio Manuel Fernández Pérez > > Ingeniero Técnico en Informática > Dpto. Programación y Sistemas Fabergames S.L. > TLF:966261111 / FAX:966551801 > www.fabergames.com <http://www.fabergames.com/> > > > <http://www.facebook.com/fabergames> > > * * * ADVERTENCIA LEGAL * * * > > Le informamos, como destinatario de este mensaje, que el correo electrónico y > las comunicaciones por medio de Internet no permiten asegurar ni garantizar la > confidencialidad de los mensajes transmitidos, así como tampoco su integridad o > su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad > alguna por tales circunstancias. Si no consintiese en la utilización del correo > electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y > ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de > manera exclusiva, a su destinatario y contiene información confidencial y > sujeta al secreto profesional, cuya divulgación no está permitida por la ley. > En caso de haber recibido este mensaje por error, le rogamos que, de forma > inmediata, nos lo comunique mediante correo electrónico remitido a nuestra > atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su > eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, > le comunicamos que la distribución, copia o utilización de este mensaje, o de > cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están > prohibidas por la ley. > > > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

errores
by Fernando Castillo 17 Oct '12

17 Oct '12

Estoy utilizando freeradius para instalar un servidor pero presento un problema. Soy nuevo utlizandolo freeradius, asi que me ayudarian muchisimo como solucionar este problema: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file /etc/freeradius/certs/server.pem rlm_eap: Failed to initialize type tls /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/inner-tunnel[236]: Failed to load module "eap". /etc/freeradius/sites-enabled/inner-tunnel[189]: Errors parsing authenticate section. De antemano. muchas gracias!!.

3 2

DHCP
by David Peterson 17 Oct '12

17 Oct '12

Does anyone have a basic tutorial on how to set up the DHCP server? I see a way to define the scope but does it just assign the IPs from the ippool or do I need to send reply attributes in radius? David

5 5

Re: Compliance testing of Free Radius Client
by Tarun Dixit 17 Oct '12

17 Oct '12

Hey Arpit, You wont be able to interact with the user using radclient. Please have a proper understanding first. Freeradius clearly mentions that radclient and radeapclient are just for testing the freeradius server.

2 1

different vlan ssid
by Matteo Cazzador 17 Oct '12

17 Oct '12

Hello i've question, i'm a novice. I've installed freeradius version 2.1.11 to permit wireless navigation to register users (trouw router cisco appliance). I've two different place with 2 wifi with 2 ssid relative to one cisco appliance, I realize a web interface (captive portal) to register user and permit him to navigate. I've a problem, if a user is register correctly with ssid1 wifi how i can disable him to navigate with ssid2 wifi? is it possibile? I want a user , once registered navigate only with registration ssid. Thank's a lot -- Rispetta l'ambiente: se non ti è necessario, non stampare questa mail. ****************************************** Ing. Matteo Cazzador Email: mcazzador(a)gmail.com ******************************************

2 1

Compliance testing of Free Radius Client
by Arpit Jain 17 Oct '12

17 Oct '12

Hi All, Please help!!! Query #1: *I want to perform RFC compliance testing of FreeRadius client (not server) available with "freeradius" package.* In other words, i want to perform compliance testing on "radclient" and "radeapclient" binaries available with freeradius package. On investigation, i found that the manpage of "radclient" states: radclient is a radius client program. It can send arbitrary radius packets to a radius server, then shows the reply. It can be used to test changes you made in the configuration of the radius server, or it can be used to monitor if a radius server is up. Does it mean that freeradius client is just a dummy client and there is no point in performing compliance testing on it? I tried to run the “radclient” binary. I executed the following command for this *./radclient <server-ip> auth <secret-key>* Once the above command is executed, the control waits for the attributes entry. After the attributes are written, radclient sends radius request packet and receives response from the server and then it exits. To again send any authentication or authorization request, radclient binary needs to be executed again. As per my understanding, the binary should not have exited. As radius client sends the Access-request itself once it receives a request for any service from the user. Also, if the server does not respond, radius client shall send the request to an alternate server. This means that the radius client can handle the user requests at runtime also. So it should not exit. *Please let me know if I need some extra configuration to achieve the above functionality.* Query #2: In RFC 2131, it is mentioned that there are three entities in any freeradius setup: USER, RADIUS CLIENT, RADIUS SERVER. Does freeradius package provide a separate binary/module for USER application? If not, can we consider RADIUS CLIENT as our USER as well? Thanks, Arpit

2 1

Radius Perfomance Issure
by QASIM RAO 17 Oct '12

17 Oct '12

hi,i am testing performance of my Freeradius using java multi threading and i am facing an issue normaaly acounting start procedure taking less then 1000 miliseconds. and this is my requirment but after some requests free radius takes more then 5000 miliseconds continusly then returns normally... return code in all requests is 0 Accounting Start process times of some requests...Process time IS = 87 Process time IS = 62 Process time IS = 92 Process time IS = 90 Process time IS = 98 Process time IS = 19 Process time IS = 107 Process time IS = 114 Process time IS = 120 Process time IS = 120 Process time IS = 123 Process time IS = 121 Process time IS = 127 Process time IS = 130 Process time IS = 128 Process time IS = 152 Process time IS = 133 Process time IS = 138 Process time IS = 138 Process time IS = 137 Process time IS = 143 Process time IS = 146 Process time IS = 147 Process time IS = 5155 Process time IS = 5156 Process time IS = 5167 Process time IS = 5167 Process time IS = 5176 Process time IS = 5194 Process time IS = 5201 Process time IS = 5207 Process time IS = 5214 Process time IS = 5211 Process time IS = 5213 Process time IS = 5224 Process time IS = 5263 Process time IS = 5233 Process time IS = 5274 Process time IS = 5159 Process time IS = 5015 Process time IS = 5022 Process time IS = 5022 Process time IS = 5025 Process time IS = 5030 Process time IS = 5035 Process time IS = 5041 Process time IS = 5042 Process time IS = 5049 Process time IS = 5050 Process time IS = 5051 Process time IS = 5059 Process time IS = 5060 Process time IS = 5069 Process time IS = 5070 Process time IS = 5079 Process time IS = 5087 Process time IS = 4973 Process time IS = 4878 Process time IS = 4876 Process time IS = 4883 Process time IS = 5086 Process time IS = 4885 Process time IS = 4886 Process time IS = 4890 Process time IS = 4869 Process time IS = 4847 Process time IS = 4848 Process time IS = 4790 Process time IS = 4858 Process time IS = 4802 Process time IS = 4794 Process time IS = 4800 Process time IS = 4642 Process time IS = 4657 Process time IS = 4659 Process time IS = 4661 Process time IS = 4661 Process time IS = 4663 Process time IS = 5508 Process time IS = 5221 Process time IS = 5228 Process time IS = 4978 Process time IS = 4980 Process time IS = 4867 Process time IS = 4766 Process time IS = 6 Process time IS = 6 Process time IS = 9 Process time IS = 10 Process time IS = 16 Process time IS = 7 Process time IS = 16 Process time IS = 10 Process time IS = 11 Process time IS = 25 Process time IS = 49 Process time IS = 49 Process time IS = 48 Process time IS = 45 Process time IS = 46 Process time IS = 47 Process time IS = 56 Process time IS = 52 please help me in this what is wrong in this why it take so long time

2 3

migration from ACS 4.2 NAR
by Menard, Yannick 16 Oct '12

16 Oct '12

Hi, I'm checking the possibility to migrate from our cisco ACS 4.2 to freeradius for our radius server wich is use for our wireless (cisco WLC) and VPN (Cisco ASA). I want to know if it's possible to do NAR (network access restriction) in freeradius like in ACS; Example: I am able to permit only certain user based on their active directory group to connect to my certain wireless SSID. Also I use ACS to configure Downloadable IP ACLs for the VPN access Does freeradius have similar option? Thank you, Yannick Menard ---------------------------------------------------------------------------------------------------------- Ce courriel a �t� filtr� par ModusGate et Webshield afin de le certifier comme l�gitime et exempt de virus.

3 2

Freeradius as dhcp; parsing option82
by Ilya A. Masandilov 16 Oct '12

16 Oct '12

Hello! We are using freeradius as dhcp server about two years. Its working wery well, but. We have all the DHCP logic written in rlm_perl script. Now we have load ~900-1200 dhcp queries per sec, but 70% of them are ignored (dependents of a vlan in option 82 (part of DHCP-Relay-Circuit-Id)). I would like to parse circuit-id by unlang, to not to transfer most of the queries in Perl script. In Perl, I do it like this: my $hex = substr, $RAD_REQUEST{'DHCP-Relay-Circuit-Id'}, 6, 8; my $vlan = hex(hex); $hex = substr, $RAD_REQUEST{'DHCP-Relay-Circuit-Id'}, 10, 12; my $port = hex($hex); But i can't find suggestion in unlang... Is there a way to do this by unlang without using sql:unhex or any external modules? Thank you!

3 4

authorize after proxy.
by Thomas Raabo - Zitcom A/S 16 Oct '12

16 Oct '12

Is it possible to do authentication and then authorization on the SQL db? Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 [Beskrivelse: Beskrivelse: cid:image001.jpg@01CB9163.2FCD3AC0] _____________________________________________ tr(a)zitcom.dk<mailto:tr@zitcom.dk> | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66

2 2