March 2012 - Freeradius-Users - lists.freeradius.org

access level on cisco routers
by Elad Shy 23 Mar '12

23 Mar '12

Hi I am looking for a way to give different access level to cisco router based on unix group membership. I went through the documentation but could not find a simple (or other) way to do this. Got a bit confused when it came to which (if at all) modules I need to include. I tries using the hungroup file but that did not work. Here is my users config file which will explain what I am trying to achieve So if a user is a member of "sysops" the access level they would get is 3 and if they are a member "netops" they will get access level 15. DEFAULT Auth-Type := System Fall-Through = Yes, Group == "sysops", Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=3", # # Huntgroup-Name == "SysOps" # # DEFAULT Auth-Type := System Group == "netops", Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" I also tried to define those two hungroups and use the Hungroup but is did not do what I expect it to do. NetOps NAS-IP-Address == xx.xx.xx.0, Group = netops SysOps NAS-IP-Address == xx.xx.xx.0, Group = sysops When a netops user or a sysops user login to the router they always get the first level in the users file. Will appreciate any help. I can also add the debug output if you think it will help. Thanks Elad ---------------------------------------------------- This communication may contain CONFIDENTIAL or copyright information of M2 Telecommunications Group Ltd and its related body corporates ('M2'). If you are not an intended recipient, you MUST NOT read, print, keep, forward, copy, use, save, retransmit or relay this communication or any attachments, and any such action is unauthorised and prohibited. If you have received this communication in error, please reply to this email to notify the sender of its incorrect delivery, and then delete both it and your reply. M2 does not guarantee the integrity of any emails or any attached files. The views or opinions expressed are the author's own and may not reflect the views or opinions of M2. ----------------------------------------------------

2 1

802.1x/EAP-TLS and MAC authentication via SQL with dynamic VLANs
by PENZ Robert 23 Mar '12

23 Mar '12

Hi! We've currently a MAC authentication running with dynamic VLANs via SQL for wired clients. We return the wished VLAN for the client by using the SQL function authorize_reply_query. We now want to add 802.1x EAP-TLS as supported authentication method. I got the setup sofar that I'm able to authenticated a client which supports it via 802.1x and the others as fallback with MAC. With MAC auth everything works but with 802.1x I'm not able to return the VLAN the switch should use. How can I tell freeradius to make a sql lookup for the reply values? And how can I use the CN of the certificate in the SQL query? I believe I need one query for MAC and one for EAP-TLS, as for one I search for the MAC address and in the other the CN ... correct? The last question is more general. How do I get the mac address for a client that is authenticating with EAP-TLS, would like to add this to the sqllog? Thx for your help! I'm using freeradius2-2.1.7-7.el5 on rhel5 with following config authorize { eap { ok = return } redundant { sql do_not_respond #send nothing to the switch if sql fails, another server will take over } if (ok) { update control { Auth-Type := Accept } # 'handled' does not work here ok = return } } Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

6 9

Freeradius for several services
by David Seira 23 Mar '12

23 Mar '12

Hi, I want to use the same freeradius server for authenticate several services like L2TP VPN, PPPoE server, captive portal, etc... For example: NAS->PPPoE Server (11-11-11-11-11-11) > NAS->Captive portal (22-22-22-22-22-22) > In the MySQL radcheck table: > user1 Cleartext-Password := 1234 > user1 Called-Station-Id := 11-11-11-11-11-11 > user2 Cleartext-Password := 5678 > user2 Called-Station-Id := 22-22-22-22-22-22 I would like to know what is the best way to achieve it. I don't know if it is best using several virtual servers, one per service, or through the called-station-id with the same virtual server. Is it possible to evaluate a request based on the NAS' called station id (regardless the user/pass)? In the above example, when the user1 try to login into the captive portal the freeradius should send an access-reject. Which is the best way? Thanks, David

2 2

EAP challenge/response support in the client library
by Ronaldo Afonso 22 Mar '12

22 Mar '12

Hi all, Does Free Radius client library support the challenge/response used in EAP authentication? Thank you in advance ... -- Ronaldo Afonso www.vexcorp.com +55 11 4932-5971 ronaldo.afonso(a)vexcorp.com

2 1

sqltrace happens in non-debug mode, too
by Brian Julin 22 Mar '12

22 Mar '12

Good morning, A minor item (at least until your disk fills up): The inline help in sql.conf says the sqltrace option should not log to the SQL trace file unless the server is in debug mode. The rlm_sql manpage uses somewhat less specific language. I don't know what the current intent is, but either the code or docs need to be fixed, as the server is logging SQL queries while not being run in debug mode. This is hapenning in canned RHEL 2.1.10 and glossing over the 3.0 git code I don't see any checks for debug mode there either, and the documentation is the same in both. -- Brian

1 0

Reauthenticate Every minute
by Mutheu 22 Mar '12

22 Mar '12

My Setup: --> FreeRADIUS: Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct3 2011 at 21:39:42 --> Mysql: Server version: 5.1.51 Source distribution --> NAS: pfSense 2.0.1 release My Query: I am a bit new to freeradius and I am trying to create a setup where an active session is re-authenticated everyminute and a user is kicked if no enough credit. More Details: Using 'norestcounter' with mysql works very well without the above. Now I would like to implement this idea : http://computing-tips.net/M0n0wall_Captive_Portal_Logout_URL/#onlinestore) NAS supports a feature for "reauthentication every minute". The problem is that, if I turn it on, freeradius responds: Sending delayed reject for request 2 Sending Access-Reject of id 234 to 10.250.78.200 port 64881 Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" Activated the option for ensuring no 'simoultenious use' via mysql. What am I missing in the freeradius config? Mutheu

2 3

On FreeBSd: syslog-ng: I/O error occurred while writing; fd='xx', error='No buffer space available (yy)'
by Traiano Welcome 22 Mar '12

22 Mar '12

Hi List I've been seeing the following in the messages log of my freebsd syslog server for quite some time now: --- Mar 20 12:19:12 syslog2 syslog-ng[35313]: I/O error occurred while writing; fd='12', error='No buffer space available (55)' Mar 20 12:19:12 syslog2 syslog-ng[35313]: Connection broken; time_reopen='60' Mar 20 12:19:12 syslog2 syslog-ng[35313]: I/O error occurred while writing; fd='13', error='No buffer space available (55)' Mar 20 12:19:12 syslog2 syslog-ng[35313]: Connection broken; time_reopen='60' --- These happen at a frequency of about 7 per minute on average. See attached trend graphs for an idea of the volume of traffic we're doing, as well as the memory and cpu utilisation trends on this server during this period. As can be seen from the graphs, load does not seem to be the issue. Occasionally during the week, the system freezes and requires a reboot, I think it's related to the above message, though I'm not sure. My question is: What does this error mean, and how can I resolve it? I have tried to frame this as an operating system kernel resource issue, and experimented with increasing the freebsd kernel sysctls for UDP performance: --- [root@syslog2 <mailto:root@syslog2.ops.mtnbusiness.co.za> /var/log]# sysctl kern.ipc.nmbclusters=102400 kern.ipc.nmbclusters: 25600 -> 102400 [root@syslog2 <mailto:root@syslog2.ops.mtnbusiness.co.za> /var/log]# sysctl kern.ipc.maxsockbuf=201326592 kern.ipc.maxsockbuf: 100663296 -> 201326592 [root@syslog2 <mailto:root@syslog2.ops.mtnbusiness.co.za> /var/log]# sysctl net.inet.udp.recvspace=33554432 net.inet.udp.recvspace: 16777216 -> 33554432 --- This has reduced the frequency of the errors a little, but in general the problem still remains. Syslog version: -- [root@syslog2]# syslog-ng -V syslog-ng 2.0.10 -- FreeBSD version: -- FreeBSD 7.2-STABLE #0 -- Any help would be much appreciated! Traiano

1 1

Freeradius Server Performance & Provisioning
by Tiago Ratto 22 Mar '12

22 Mar '12

Hello there, We are using Freeradius for about four years now, and it has proven a robust and reliable AAA solution. In our actual setup, we don't use Interim updates. As our needs changed over time, it's now imminent for us to use the Interim feature, so we've done some tests and statistics. We have an average of 7K simultaneously connected users, of 15K in total. Our growth is something about 150 users per month. In our first test, we'd set our NASses to send updates with 1 minute frequency, what resulted in about 100 update queries per second. Our server didn't managed to handle that volume of activity, and when using vmstat to measure the performance, we've noticed that our problem was relative with interrupts per second and context switches, with both parameters with levels in about 3000. Since each query take about 0,016 seconds to execute, we need 1,6 seconds to handle 1 second of activity. Our current server configuration is a Quad core Xeon 3400, with 2GB RAM, and a RAID 0 array of 2 disks running MySQL as database backend. Later we had set our Interim update to 5 minutes, so we ended with an average of 20 update queries per second, and interrupts per second and context switches in about 800 with 1200 peaks. I'm no DBA, so I've done as much tuning as I could learn from MySQL documentations and users forums. But I feel that our database could be tuned a little more. In addition, we're planning to upgrade the server. So I ask you guys some advice on MySQL tuning and Server provisioning to do the AAA of about 25000 users with the 5 minutes Interim. Much Thanks Tiago Ratto ti(a)friistelecom.com.br IT - Friis Telecom http://www.friistelecom.com.br

3 2

using different filter for ldap modul by NAS
by Richard Kuchar 21 Mar '12

21 Mar '12

Hi, i need tu use different query to ldap (filter) by NAS from witch query come. I add this to site-enabled/default under authorize section : ... switch "%{NAS-IP-Address}" { case 10.0.16.3 { # test update control { CU-LDAP-Filter = (uid=%u@%u) } } case { # default update control { CU-LDAP-Filter = "\(\&\(cn=%u\)\(radiusCallingStationId=%i\)\)" } } } ldap ... and this to modules/ldap: ... filter = "%{control:CU-LDAP-Filter}" ... So far so good. filter query is changed by NAS. By in debug it di this: [ldap] expand: %{control:CU-LDAP-Filter} -> \28uid\3d%u@%u\29 So it change some characters. I try escape it, by it doesn't work. What I do wrong. Best Regards! Richard Kuchar

1 0

VPN
by danegirl 21 Mar '12

21 Mar '12

Hi all I'm having a VPN solution which I'm using Mikrotik+FreeRadius+Freeside. Other than authenticating squid all the other services are working fine. At the moment all the customers are able to use all the VPN services (L2TP, PPTP,....) I want to know how can I define user A can only use PPTP and user B can use L2TP and user C can use all the services? I wonder how should it define in FreeRadius.... Any help would be appreciated DaneGirl -- View this message in context: http://freeradius.1045715.n5.nabble.com/VPN-tp5583065p5583065.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1