April 2012 - Freeradius-Users - lists.freeradius.org

lifetime and idle_timeout in clients.conf
by Jason Rohm 15 Apr '12

15 Apr '12

I've been having some issues with proxy authentications failing in a federated TCP/TLS configuration. Investigation shows that the connections are failing with an error on the server end of "Info: Ignoring new connection due to client max_connections". A little more digging seems to show that the connections are not being gracefully closed. I suspect this is due to a firewall cleaning up idle TCP translation slots since there are currently few authentication attempts. I've seen the lifetime keyword in a number of sample configurations here and the configuration parser seems to take it when I run the service in debug mode. However, the idle_timeout keyword is silently ignored and the server doesn't seem to be cleaning up old connections based on either the idle_timeout or the max lifetime. I can't find references to either lifetime or idle_timeout in the sample configurations or a quick review of the documentation as it relates to clients.conf. So my questions are 1.) Are the keywords lifetime and idle_timeout supported in clients.conf? 2.) If they are, is there a known bug that would cause them to not work? 3.) If they aren't, would there be value to someone other than me to add this feature? (Yes, I know this means I volunteer, lol).) 4.) In addition to lifetime and idle_timeout, would something like a keep alive be reasonable? Thanks. Any and all feedback is welcome. Jason Rohm Communication Architect jason.rohm(a)srctechnologies.com

3 5

FreeRADIUS time based authentication with MySQL
by jomajo 15 Apr '12

15 Apr '12

Hello ! Maybe somebody knows, how to configure FreeRADIUS server with my SQL for authentication at the specific time? For example: There is a reservation page. Users can reserve specific time slot, for 1-3hours. Random username and password would be generated for that user to log in at that time. How to configure freeradius server for this type of authentication? That user can log in just at that specific time? Thank you very much for your time and answers! -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-time-based-authenticatio… Sent from the FreeRadius - User mailing list archive at Nabble.com.

8 19

Acct-Session-Time inside interim-updates, its ok?
by Luis Diaz 15 Apr '12

15 Apr '12

Hello, im debugging a problem in a Freeradius/Mikrotik setup with 3 NAS and 1 Freeradius setup, ~ 3K users online....and getting Stale Sessions, after a lot of googling and digging i found something curious... Accounting requests Packets do include the Acct-Session-Time attribute, which the RFC says should only go only if Acct-Status-Type is a STOP one.... Am I missing something here? How does freeradius act on this case? Also, Timestamp is UTC, while mysql shows local time....is this ok? Example packet: Accounting-Request Id 209 10.0.0.11:34077 -> 10.0.0.1:1813 +1199.991 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 671504 NAS-Port-Type = Ethernet User-Name = "1234566" Calling-Station-Id = "00:12:22:A0:bb:5C" Called-Station-Id = "Remota ffgdfg ffffff" NAS-Port-Id = "Vlan dfg rerererer" Acct-Session-Id = "8105f258" Framed-IP-Address = 123.111.222.333 Acct-Authentic = RADIUS Event-Timestamp = "Apr 14 2012 21:23:42 UTC" Acct-Session-Time = 1500 Acct-Input-Octets = 2852 Acct-Input-Gigawords = 0 Acct-Input-Packets = 74 Acct-Output-Octets = 5721 Acct-Output-Gigawords = 0 Acct-Output-Packets = 95 Acct-Status-Type = Interim-Update NAS-Identifier = "XXX_PPPoE_1" Acct-Delay-Time = 0 NAS-IP-Address = 10.0.0.11 Accounting-Response Id 209 10.0.0.1:1813 -> 10.0.0.11:34077 +1200.000 thanks!

2 1

auth_log problem
by Ali Majdzadeh 15 Apr '12

15 Apr '12

Hi I’m using FreeRadius 1.2.12 for about 50.000 concurrent users coming from about 50 NAS. I found that More than 40% of radius packets (1812/1813) was seen by tcpdump but not seen in auth_log or acct detail log files. What’s wrong? Does freeradius have limitation for such case? radiusd.conf is as follows: start_servers = 5 max_servers = 128 min_spare_servers = 3 max_spare_servers = 128 max_requests_per_server = 0 max_request_time = 60 cleanup_delay = 5 max_requests = 256000

2 1

Building with 32-bit Module on 64-bit Machine
by Eric Geier 15 Apr '12

15 Apr '12

I can't find a 64-bit version of the experimental module I want to include when manually building FR, but I want to run on a 64-bit machine. Is this possible? Maybe I could force it to configure and make FR in 32-bit mode? But would it then be a pain to install the 32-bit versions of all the FR dependencies? Thanks for your help, Eric

2 1

kill -HUP sometimes causes "rlm_pap: mschap xlat failed"
by Jan Weiher 13 Apr '12

13 Apr '12

Hi, I've got a strange problem with FR 2.1.12, sometimes (not always) when logrotate ran, freeradius goes bonkers and responds to every pap request with "mschap xlat failed". Restarting FR fixes this magically and all works fine again. I created a small and hackish script, which restarts FR when this happens. The output showed that about every second week (logrotate runs weekly) this happens. Because FR works fine again after a restart, restarting FR in debug mode is not an option to get more information. But here is a snipped from my radiusd.log showing the symptom: Sun Apr 8 06:49:50 2012 : Info: HUP - loading modules Sun Apr 8 06:49:50 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Apr 8 06:49:50 2012 : Info: Module: Reloaded module "mschap" Sun Apr 8 06:49:50 2012 : Info: Module: Reloaded module "radutmp" Sun Apr 8 06:49:50 2012 : Info: Module: Reloaded module "macs" Sun Apr 8 06:49:50 2012 : Info: Module: Reloaded module "pap" Sun Apr 8 06:49:50 2012 : Info: Loaded virtual server <default> Sun Apr 8 06:49:50 2012 : Info: Loaded virtual server inner-tunnel-ldap Sun Apr 8 06:50:01 2012 : Auth: Login incorrect (rlm_pap: mschap xlat failed): [someuser] (from client watchdog port 0) Sun Apr 8 06:50:02 2012 : Info: Signalled to terminate Sun Apr 8 06:50:02 2012 : Info: Exiting normally. Sun Apr 8 06:50:02 2012 : Info: Loaded virtual server <default> Sun Apr 8 06:50:02 2012 : Info: Loaded virtual server inner-tunnel-ldap Sun Apr 8 06:50:02 2012 : Info: Ready to process requests. Sun Apr 8 06:55:01 2012 : Auth: Login OK: [someuser] (from client watchdog port 0) So my script ran radtest with the "someuser" credentials (which should always work), which failed, it then restarted FR and all worked fine again... Is there any more information I can provide? all the best, Jan

4 11

Re: Some question about Athorization of FreeRadius.
by Alan Buxey 13 Apr '12

13 Apr '12

Authorization , is someone actually allowed to use the resource they are logging into. Eg time of day, belong to right group, coming from right place, still have data allowance etc Authentication, is their password correct alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

We still lack IBM DB2 connection
by Timmy 13 Apr '12

13 Apr '12

Dear All FreeRadius 2.1 users, I have browsed the source code of Freeradius 2.1 and also the freeradius.org main site, there is still no IBM DB2 connection available. Perhaps, we can invite IBM to write this for Freeradius 2.1. I know they have provided DB2 connection for php 5. Don't forget IBM DB2 v9.7 has a Express-C free version. It is free to use, distribute and install even for business case. :) How do you think the French guy Alan Denon??? :) Your Faithfully, Timmy

2 2

adding mschap to an existing ttls/pap setup
by Brian Gold 13 Apr '12

13 Apr '12

We currently have an existing freeradius setup using eap-ttls/pap with an openldap backend. Up until now, our userPassword has always been SHA encoded. I've been working to add sambaNTPassword hashes so that we can use either eap-ttls/mschap or peap/mschap. I've got the nt hashes set, but I'm having some difficulty getting freeradius to successfully authenticate. Output from "radtest -t mschap username password localhost 0 secret": http://pastebin.com/FeiwwhzE output from "radtest -t pap username password localhost 0 secret": http://pastebin.com/tvZXqJCm

3 5

Authentication with radiusclient 1.4
by ikram 12 Apr '12

12 Apr '12

Hi every one , I have 2 major problems : 1.I can't found documentation on radiusclient 1.4 to use it for authenticate an asterisk server 2. Capturing with wireshark can't show radius accounting requestes even if I specify the filter, and thgis requests are shown on the server with console mode please help -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-with-radiusclient-1-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0