April 2012 - Freeradius-Users - lists.freeradius.org

How fast can IP Pool SQL be? :) *a Shocker*
by Christiaan Rademan 23 Apr '12

23 Apr '12

Greetings everyone, I previously had a post concerning authenticate over 2 million+ mobile subscriber users on FreeRadius. We did performance testing yet, failed but due to pressure from client we went a head with the migration. The migration failed at this point, since the Radius Server could not hand out more than 25 IP addresses per second. Obviously this was due to slow database server / resources. FreeRadius was happy to hand out logins once the pool assignment was done on the GGSN. So I am wondering, I found a solution to the problem and we are now handing out IP addresses easily.. 5000+ accept-accept responses per second with framedipaddress included from a pool within SQL. Quad Zeon, 4 core, 8 threads, 16gig ram runnning Ubuntu Linux. Is it possible to hand out that many ip addresses per second? :) The box is also running both the radiusd and mysql process using a standard storage engine. Not using NDB or anything special. Is this really an impossible task? Maybe I can find out from our company if I may release the code we using to make this work. I would really like to help improve the SQLIPPool module. Since the version we were using could only do 25/s now we are over 5000/s. -- Christiaan Rademan - JNCIE #661 Mobile: +27 83 419 2078 E-mail: christiaan.rademan(a)gmail.com

5 5

Building 2.1.12 on Debian Squeeze: Clean Error
by Eric Geier 22 Apr '12

22 Apr '12

Trying to build FR 2.1.12 on Debian Squeeze 64-bit. I'm building instead of using Debian FR packages as I want to include the rlm_raw module (which I slightly modified and is supposed to work in FR 2.x...got from another post here). I enter "fakeroot dpkg-buildpackage -b -uc" and get the following clean error: *************************** Making clean in rlm_sql_mysql. make[11]: Entering directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules/rlm_sql/drivers/r lm_sql_mysql' make[11]: *** No rule to make target `clean'. Stop. make[11]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules/rlm_sql/drivers/r lm_sql_mysql' make[10]: *** [rlm_sql_mysql] Error 2 make[10]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules/rlm_sql/drivers' make[9]: *** [clean] Error 2 make[9]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules/rlm_sql/drivers' make[8]: *** [drivers] Error 2 make[8]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules/rlm_sql' make[7]: *** [clean] Error 2 make[7]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules/rlm_sql' make[6]: *** [rlm_sql] Error 2 make[6]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules' make[5]: *** [clean] Error 2 make[5]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src/modules' make[4]: *** [modules] Error 2 make[4]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src' make[3]: *** [clean] Error 2 make[3]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12/src' make[2]: *** [src] Error 2 make[2]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12' make[1]: *** [clean] Error 2 make[1]: Leaving directory `/home/egeier/Desktop/freeradius-server-2.1.12' make: *** [clean] Error 2 dpkg-buildpackage: error: fakeroot debian/rules clean gave error exit status 2 *************************** I've looked through the output and dependencies but no help. Then I thought to try ./configure, make, and make install, but when I run ./configure it errors too with a different error: *************************** top_builddir=/home/egeier/Desktop/freeradius-server-2.1.12 configure: creating ./config.status ./config.status: line 601: ]([ABCDGIRSTW][ABCDGIRSTW]*)[: command not found ./config.status: line 602: syntax error near unexpected token `(' ./config.status: line 602: `lt_cv_sys_global_symbol_to_cdecl='sed -n -e 's/^T .* $.*$$/extern int \1();/p' -e 's/^[ABCDGIRSTW]* .* $.*$$/extern char \1;/p''' *************************** Didn't find any help Googleing or in the output. Thanks for your help! Eric

3 3

RE: DHCP on FreeBSD 8.2
by newuse＠qip.ru 22 Apr '12

22 Apr '12

>Those definitions are in the system header files. The server should >depend on the header files. It's better than having hard-coded values >in the source. I am new to programming :( Thanks. So this patch also seems working fine on my FreeBSD: [code] *** ./src/lib/dhcp.c Tue Apr 17 16:11:05 2012 --- ./src/lib/dhcp.c Sun Apr 22 01:45:08 2012 *************** *** 22,27 **** --- 22,29 ---- */ #include <sys/ioctl.h> + #include <sys/types.h> + #include <sys/socket.h> #include <net/if_arp.h> #include <freeradius-devel/ident.h> [/code]

1 0

RE: DHCP on FreeBSD 8.2
by newuse＠qip.ru 22 Apr '12

22 Apr '12

Hi, thanks! I have get it working, here is my patch, but I have not tested if it will correctly compile on non-FreeBSD PCs :( [code] *** ./src/lib/dhcp.c Tue Apr 17 16:11:05 2012 --- ./src/lib/dhcp.c Sun Apr 22 01:45:08 2012 *************** *** 20,27 **** --- 20,35 ---- * Copyright 2008 The FreeRADIUS server project * Copyright 2008 Alan DeKok <aland(a)deployingradius.com> */ + + + typedef unsigned short u_short; + typedef unsigned long u_long; + typedef unsigned char u_char; + typedef unsigned int u_int; + #include <sys/ioctl.h> + #include <sys/socket.h> #include <net/if_arp.h> #include <freeradius-devel/ident.h> [/code] >Garber, Neal wrote: >> Try adding the following includes before those that are already in the file >> freeradius-server/src/lib/dhcp.c: >> >> #include <sys/socket.h> >> #include <sys/types.h> > I'll add a patch. > Alan DeKok.

2 1

DHCP on FreeBSD 8.2
by newuse＠qip.ru 22 Apr '12

22 Apr '12

Hi all, I am getting the following errors during compilation on my FreeBSD 8.2 OS: /usr/include/net/if_arp.h:47: error: expected specifier-qualifier-list before 'u_short' /usr/include/net/if_arp.h:88: error: field 'arp_pa' has incomplete type /usr/include/net/if_arp.h:89: error: field 'arp_ha' has incomplete type /usr/include/net/if_arp.h:115: error: expected specifier-qualifier-list before 'u_long' gmake[4]: *** [dhcp.lo] Error 1 gmake[4]: Leaving directory `/tmp/freeradius-server/src/lib' gmake[3]: *** [lib] Error 2 gmake[3]: Leaving directory `/tmp/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/tmp/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/tmp/freeradius-server' gmake: *** [all] Error 2 It seems, that there are difference between FreeBSD and Linux arp header files :( Do anyone have a pach? Could you help me? -- Sorry for my English Best regards, NewUse.

3 2

Re:Freeradius Access Requet ID
by 全球无线联盟 21 Apr '12

21 Apr '12

Matthew, Great! Thanks for your reply. It helps. We will use this solution. Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Fri, Apr 20, 2012 05:30 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 84, Issue 65 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re:Freeradius Access Requet ID (Matthew Newton) 2. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 3. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha) 4. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Alan DeKok) 5. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (alan buxey) 6. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 7. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 8. How to grant access to a network regardless of the username/password? (Henrik Karlsson) ---------------------------------------------------------------------- Message: 1 Date: Fri, 20 Apr 2012 08:52:15 +0100 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re:Freeradius Access Requet ID Message-ID: <20120420075215.GA7240(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=utf-8 On Fri, Apr 20, 2012 at 03:42:09PM +0800, ?????? wrote: > We know the post-authentication query can do something which we know who is pass. > > We don't have a method to log the rejected request. Put something in the Post-Auth-Type REJECT section of post-auth to log whatever you want. post-auth { Post-Auth-Type REJECT { # here } } Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 2 Date: Fri, 20 Apr 2012 10:53:32 +0300 From: Wassim Zaarour <wassim.zaarour(a)navlink.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6EF8C.ED0C%wassim.zaarour(a)navlink.com> Content-Type: text/plain; CHARSET=US-ASCII Hi Farja, I just checked with the ldap admin and he told me passwords are stored with SHA encryption and not cleartext. ( can't change them to clear text) Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it?? If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with the windows laptops as they have PEAP/MSCHAPv2 only. Any workaround? Thanks Wassim. On 4/20/12 10:30 AM, "Fajar A. Nugraha" <list(a)fajar.net> wrote: >On Fri, Apr 20, 2012 at 2:22 PM, Wassim Zaarour ><wassim.zaarour(a)navlink.com> wrote: > >> On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list(a)fajar.net> wrote: > >>>Long version: >>>MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: >>>- Cleartext-Password or NT-Hash available (in LDAP, sql, users file >>>whatever), OR >>>- an active directory >>> >>>If you don't have either, then it won't work. >> >> Hi Farja, >> >> Passwords are stored as clear text in my LDAP, that should make MSCHAPv2 >> work right? > >Yes, if FR can find them. This part of the log says it can't: > >[ldap] performing search in o=navbey.com, dc=navbey,dc=com, with filter >(uid=pk) >[ldap] looking for check items in directory... >[ldap] looking for reply items in directory... >WARNING: No "known good" password was found in LDAP. Are you sure that >the user is configured correctly? > >You might need to play around with the user used to login to LDAP, as >some systems only give out passwords to admin accounts. Testing manual >LDAP lookup using command line tool (e.g. ldapsearch) helps. If you >CAN get your ldap server to return cleartext password with ldapsearch, >then you should be able to configure FR to get that as well. > >-- >Fajar >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Fri, 20 Apr 2012 15:01:13 +0700 From: "Fajar A. Nugraha" <list(a)fajar.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CAG1y0segiKtFkiE2M5xu+7kAwYtjvNc0+0PCxZTT51AuKYjJWw(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Fri, Apr 20, 2012 at 2:53 PM, Wassim Zaarour <wassim.zaarour(a)navlink.com> wrote: > I just checked with the ldap admin and he told me passwords are stored > with SHA encryption and not cleartext. ( can't change them to clear text) Figured as much :) > Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it?? Yes > If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with > the windows laptops as they have PEAP/MSCHAPv2 only. > > Any workaround? No. Not unless you're willing to install 3rd-party supplicant on every windows client. -- Fajar ------------------------------ Message: 4 Date: Fri, 20 Apr 2012 10:15:03 +0200 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <4F911B07.50509(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Wassim Zaarour wrote: > Hi Farja, > > I just checked with the ldap admin and he told me passwords are stored > with SHA encryption and not cleartext. ( can't change them to clear text) > > Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it?? > > If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with > the windows laptops as they have PEAP/MSCHAPv2 only. > > Any workaround? http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok. ------------------------------ Message: 5 Date: Fri, 20 Apr 2012 09:18:59 +0100 From: alan buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <20120420081859.GA11042(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > I just checked with the ldap admin and he told me passwords are stored > with SHA encryption and not cleartext. ( can't change them to clear text) is this LDAP or AD? if its AD then you can bind your FreeRADIUS box to the AD as per docs on deployingradius.com - then it can use ntlm_auth to do PEAP very happily for windows clients - its what we do for our 20k users for 802.1X alan ------------------------------ Message: 6 Date: Fri, 20 Apr 2012 11:19:43 +0300 From: Wassim Zaarour <wassim.zaarour(a)navlink.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6F671.ED1B%wassim.zaarour(a)navlink.com> Content-Type: text/plain; CHARSET=US-ASCII Thanks Alan for the link, I just ran to it few minutes back and its clear :) Guess I'm gonna have to settle for a third party supplicant since I can't change in the LDAP password storage config. Thanks also for the other Alan and Farja. On 4/20/12 11:15 AM, "Alan DeKok" <aland(a)deployingradius.com> wrote: >Wassim Zaarour wrote: >> Hi Farja, >> >> I just checked with the ldap admin and he told me passwords are stored >> with SHA encryption and not cleartext. ( can't change them to clear >>text) >> >> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with >>it?? >> >> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck >>with >> the windows laptops as they have PEAP/MSCHAPv2 only. >> >> Any workaround? > >http://deployingradius.com/documents/protocols/compatibility.html > > Alan DeKok. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html ------------------------------ Message: 7 Date: Fri, 20 Apr 2012 11:28:54 +0300 From: Wassim Zaarour <wassim.zaarour(a)navlink.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6F8CA.ED21%wassim.zaarour(a)navlink.com> Content-Type: text/plain; CHARSET=US-ASCII It's Sun Directory Server, hence LDAP not AD. Thanks anyways :) On 4/20/12 11:18 AM, "alan buxey" <A.L.M.Buxey(a)lboro.ac.uk> wrote: >Hi, > >> I just checked with the ldap admin and he told me passwords are stored >> with SHA encryption and not cleartext. ( can't change them to clear >>text) > >is this LDAP or AD? if its AD then you can bind your FreeRADIUS box to >the AD >as per docs on deployingradius.com - then it can use ntlm_auth to do PEAP >very happily for windows clients - its what we do for our 20k users for >802.1X > >alan >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html ------------------------------ Message: 8 Date: Fri, 20 Apr 2012 11:30:13 +0200 From: Henrik Karlsson <Henrik.Karlsson(a)Generic.se> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: How to grant access to a network regardless of the username/password? Message-ID: <5D4FE383D0CD43418076B92AA238BA8B0100EBB56656(a)nova.intra.generic.se> Content-Type: text/plain; charset="us-ascii" Hi, I have a dial-in system that use freeRADIUS as radius server. I have figured out how to log username and password from access requests in a SQL database. My next goal is to be able to keep on logging Username and password but accept all users regardless of username/password. The user shall not need to be listed as a user in the RADIUS server. I want to grant access for all users that dial in for access to the network, hut I need to log the username and password that they send to the RADIUS server. Username and password are stored in a Mysql database and we use PAP. Is it possible to make this configuration and if it is possible how do I do it. /Henrik -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 84, Issue 65 ************************************************

1 0

Authenticate user by NAS-IP & NAS-Port-ID instead of User-Name & Password
by Louis Arsenault 21 Apr '12

21 Apr '12

Hello, I have a managed network switch that support MAC authentication and will send requests to Radius. The issue is I do not wish to keep a list of customer device MAC addresses for authentication. I would like to enforce activation by port. My first attempt was changing the username & password to something standardized like "<NAS-IP>-<NAS-Port-ID>" & "somesecurepassword" When I did this though I think EAP failed with the user-name did not match what was on the original request. What I am looking for is what the best way to approach this scenario is. The 2 options I can think of is try writing a custom sql module that way I do not need to play with the User-Name Password or proxy the request and then authenticate it that way the names don't get fudged on the original request. Any other easier ways? Am I on the right track? Also, anyone know of managed switches (Other than Cisco) that support setting the Ingress/Egress speeds of the port via Radius? -- -Louis NTInet O: 803-533-1660 X 207 C: 803-997-0004

2 1

Newbie question: Multiple cliets and multiple LDAP groups
by HeinKonijn 21 Apr '12

21 Apr '12

I am new to freeradius (2). I have set it up and a number of clients are authenticating to it. I have setup LDAP and only members of a certain group are allowed to connect. The next thing I want and am unable to get working is is. Client 10.1.1.1 only accepts members in LDAP group "group1" Client 10.1.1.2 only accepts members in LDAP group "group2" I have been googling it and I thing I need huntgroups for this. I set these up, but if I run freeradius in debugging mode it doesn't seem to check them. And all the examples seem to only be using MySQL. How do I achieve this? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Newbie-question-Multiple-cliets-and… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: regular expression grouping issue on attrs filter
by Alan Buxey 20 Apr '12

20 Apr '12

Hi, Personally I would be looking at calling a PERL script for this kind of checking and calling it in pre-proxy and post-proxy stages alan

1 0

regular expression grouping issue on attrs filter
by Ivo Vastert 20 Apr '12

20 Apr '12

Hi, I'm currently having a issue implementing a regular expression within the attrs configuration file. When i try to group entry's within a regular expression the configuration is rejected: For example: This entry works: Framed-IP-Address =~ /^172\.1[6-9]|2[0-9]|3[0-1]\.[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]\.[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]$/ This entry doesn't work: Framed-IP-Address =~ /^172\.(1[6-9]|2[0-9]|3[0-1])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])$/ Does anyone know the correct syntax for grouping a entry within a regular expression? It looks like grouping by () is not supported by freeradius? We are using the following version: freeradius: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 Best regards, Ivo Vastert

2 5