April 2013 - Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 96, Issue 88
by Okis Chuang 27 Apr '13

27 Apr '13

> Okis Chuang wrote: > > From the originate-coa documentation, it seems I can?t originate > > coa-request at the section of pre-proxy or post-proxy. > > > > It?s documented, pretty clear. > > It's nice to hear that the documentation helps. :) I thought docs are very helpful at most of time. :p > > I?m not sure whether it is the cause of my following questions. > > It is. > > > But what if I need two steps below finished continually both in the > > same > > move: > > > > 1. **proxy** auth request to other AAA dispatcher(also FreeRADIUS) > > to decide where to authenticate. > > That's easy. > > > 2. Getting Access-Accept in post-auth, then originate coa request > > at once in order to change redirect profile to forward profile for > > subscriber. > > That's hard. At least with "originate-coa". So.. the core concept of *originate-coa* is just "proxy-the-coa" instead of initiating a coa request? > > The short answer is that you can run "radclient" as an external program > from the post-proxy section. It's ugly, but it will work. > Hmm..that is indeed an alternative, but like you said, it's kind of not a neat way to achieve my goal. And I'm worrying that might have some performance issue if supposed I will have high traffic. > > But I got the warning that **cannot proxy and originate CoA packets at > > the same time**. > > Yes. We're looking into fixing that for 3.0. No offense, I'm curious that why can't view these two request: "Proxy-Auth Request" and "CoA Request" as two independent request? Or this is about some kind of concern on designation? I thought that was intuitive until I saw the result and got your kind but hopeless response : ( > > Actually I move the coa origination to my AAA dispatcher, it also > > can?t works and occurs the same warning.(It makes sense because both > > are doing coa request after proxying auth request I guess. > > Originating a CoA packet is really proxying it. And the server can't proxy > to two different destinations. Ok. I got your point. > > So here are my questions: > > > > 1. Does this flow works possibly in my scenario? I mean can I > > originate coa at once after getting Access-Accept? > > Not today. Does this would be a difficult demand? > > > 2. What if I set a **virtual coa server** for receiving coa request > > from itself, then send to gateway at the section of > > That won't change anything. > > It may be easy to originate CoA packets *after* proxying. Just so long as it > doesn't do both at the same time. What do you mean *after*? The next any-kind-of request? But I really need they do it in the same sequence. It a bit upset me. > I'll see if I have time to look into it. Thanks Alan! Thanks your contribution and devotion to FreeRADIUS. It's really impressive. Not a compliment at all. lol > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 96, Issue 88 > ************************************************

2 1

Re: Originate CoA Request After Receiving Access-Accept
by Okis Chuang 27 Apr '13

27 Apr '13

> Okis Chuang wrote: > > From the originate-coa documentation, it seems I can?t originate > > coa-request at the section of pre-proxy or post-proxy. > > > > It?s documented, pretty clear. > > It's nice to hear that the documentation helps. :) I thought docs are very helpful at most of time. :p > > I?m not sure whether it is the cause of my following questions. > > It is. > > > But what if I need two steps below finished continually both in the > > same > > move: > > > > 1. **proxy** auth request to other AAA dispatcher(also FreeRADIUS) > > to decide where to authenticate. > > That's easy. > > > 2. Getting Access-Accept in post-auth, then originate coa request > > at once in order to change redirect profile to forward profile for > > subscriber. > > That's hard. At least with "originate-coa". So.. the core concept of *originate-coa* is just "proxy-the-coa" instead of initiating a coa request? > > The short answer is that you can run "radclient" as an external > program from the post-proxy section. It's ugly, but it will work. > Hmm..that is indeed an alternative, but like you said, it's kind of not a neat way to achieve my goal. And I'm worrying that might have some performance issue if supposed I will have high traffic. > > But I got the warning that **cannot proxy and originate CoA packets > > at the same time**. > > Yes. We're looking into fixing that for 3.0. No offense, I'm curious that why can't view these two request: "Proxy-Auth Request" and "CoA Request" as two independent request? Or this is about some kind of concern on designation? I thought that was intuitive until I saw the result and got your kind but hopeless response : ( > > Actually I move the coa origination to my AAA dispatcher, it also > > can?t works and occurs the same warning.(It makes sense because both > > are doing coa request after proxying auth request I guess. > > Originating a CoA packet is really proxying it. And the server > can't proxy to two different destinations. Ok. I got your point. > > So here are my questions: > > > > 1. Does this flow works possibly in my scenario? I mean can I > > originate coa at once after getting Access-Accept? > > Not today. Does this would be a difficult demand? > > > 2. What if I set a **virtual coa server** for receiving coa request > > from itself, then send to gateway at the section of > > That won't change anything. > > It may be easy to originate CoA packets *after* proxying. Just so > long as it doesn't do both at the same time. What do you mean *after*? The next any-kind-of request? But I really need they do it in the same sequence. It a bit upset me. > I'll see if I have time to look into it. Thanks Alan! Thanks your contribution and devotion to FreeRADIUS. It's really impressive. Not a compliment at all. lol > Alan DeKok. > > > ------------------------------

1 0

FW: Freeradius-UsRe: Originate CoA Request After Receiving Access-Accepters Digest, Vol 96, Issue 88
by Okis Chuang 27 Apr '13

27 Apr '13

> Okis Chuang wrote: > > From the originate-coa documentation, it seems I can?t originate > > coa-request at the section of pre-proxy or post-proxy. > > > > It?s documented, pretty clear. > > It's nice to hear that the documentation helps. :) I thought docs are very helpful at most of time. :p > > I?m not sure whether it is the cause of my following questions. > > It is. > > > But what if I need two steps below finished continually both in the > > same > > move: > > > > 1. **proxy** auth request to other AAA dispatcher(also FreeRADIUS) > > to decide where to authenticate. > > That's easy. > > > 2. Getting Access-Accept in post-auth, then originate coa request > > at once in order to change redirect profile to forward profile for > > subscriber. > > That's hard. At least with "originate-coa". So.. the core concept of *originate-coa* is just "proxy-the-coa" instead of initiating a coa request? > > The short answer is that you can run "radclient" as an external > program from the post-proxy section. It's ugly, but it will work. > Hmm..that is indeed an alternative, but like you said, it's kind of not a neat way to achieve my goal. And I'm worrying that might have some performance issue if supposed I will have high traffic. > > But I got the warning that **cannot proxy and originate CoA packets > > at the same time**. > > Yes. We're looking into fixing that for 3.0. No offense, I'm curious that why can't view these two request: "Proxy-Auth Request" and "CoA Request" as two independent request? Or this is about some kind of concern on designation? I thought that was intuitive until I saw the result and got your kind but hopeless response : ( > > Actually I move the coa origination to my AAA dispatcher, it also > > can?t works and occurs the same warning.(It makes sense because both > > are doing coa request after proxying auth request I guess. > > Originating a CoA packet is really proxying it. And the server > can't proxy to two different destinations. Ok. I got your point. > > So here are my questions: > > > > 1. Does this flow works possibly in my scenario? I mean can I > > originate coa at once after getting Access-Accept? > > Not today. Does this would be a difficult demand? > > > 2. What if I set a **virtual coa server** for receiving coa request > > from itself, then send to gateway at the section of > > That won't change anything. > > It may be easy to originate CoA packets *after* proxying. Just so > long as it doesn't do both at the same time. What do you mean *after*? The next any-kind-of request? But I really need they do it in the same sequence. It a bit upset me. > I'll see if I have time to look into it. Thanks Alan! Thanks your contribution and devotion to FreeRADIUS. It's really impressive. Not a compliment at all. lol > Alan DeKok. > > > ------------------------------

1 0

unlang and optimization
by Jason 'XenoPhage' Frisvold 26 Apr '13

26 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, I'm looking for some information on optimizing some of the configuration I've made in my freeradius 2.2.0 installation. Specifically, I need to set a variable based on the LDAP Group membership of a user. I'm doing this in the post-auth section at the moment, which I think is correct. The syntax I'm using is as follows : if (LDAP-Group == "cn=violations,ou=groups,o=mycorp") { update request { Tmp-String-0 := "VIOLATORS" } } elsif (LDAP-Group == "cn=guests,ou=groups,o=mycorp") { update request { Tmp-String-0 := "GUEST" } } This seems to work fine, but I'm not sure if this is the right way to go about it. LDAP is getting a query for each if statement which seems a little much? Is there a way to have the full memberOf list sent back to RADIUS in one shot and then have it processed internally without having to beat up LDAP? I had tried to use a switch/case statement to do this as well, but that doesn't seem to work. Two questions here. First, is switch/case better to use for this or is it functionally equivalent to the if/elsif statement? And second, the syntax I used is below.. Did I do something wrong, or is this not supported? switch LDAP-Group { case "cn=violations,ou=groups,o=mycorp" { update request { Tmp-String-0 := "VIOLATORS" } } case "cn=guests,ou=groups,o=mycorp" { update request { Tmp-String-0 := "GUEST" } } } Thanks, - -- - --------------------------- Jason 'XenoPhage' Frisvold xenophage(a)godshell.com - --------------------------- "Any sufficiently advanced magic is indistinguishable from technology.\" - - Niven's Inverse of Clarke's Third Law -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlF5drEACgkQO80o6DJ8Uvnx4gCdEOriy/lBK5P/AbV1CsiS3YbO zlQAn02AmVmfUbKlz0LmfWTu0Hi8tKq0 =F8oD -----END PGP SIGNATURE-----

4 4

Retrieve 'Aruba-Location-Id' from RAD_REQUEST
by Wang, Yu 26 Apr '13

26 Apr '13

Hello, I am trying to retrieve 'Aruba-Location-Id' from RAD_REQUEST forwarded from Aruba wireless controllers. From radiusd -X output, I can see 'Aruba-Location-Id' contains wireless AP id value. But when I call it from rlm_perl using $RAD_REQUEST{'Aruba-Location-Id'}, I got blank result. The 'Aruba-Location-Id' is in share/dictionary.aruba: ATTRIBUTE Aruba-Location-Id 6 string I would appreciate it if someone can point me what I did wrong and how to correct it. Here is a copy from radiusd -X: rad_recv: Access-Request packet from host 128.186.xxx.xxx port 32795, id=184, length=214 User-Name = "xxxxxxx" NAS-IP-Address = 128.186.xxx.xxx NAS-Port = 0 NAS-Identifier = "128.186.xxx.xxx" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "8C5557290002" Called-Station-Id = "000B860D1980" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201000f016d65678456c65747469 Aruba-Essid-Name = "FSUSecure" Aruba-Location-Id = "wg-a105-HRM.acf.fsu.edu" Aruba-Attr-10 = 0x416c753e544233453656e746572 Message-Authenticator = 0x1509982900acc34524353fc32fa Thanks, Yu Wang Network Architect, FSU

3 7

Originate CoA Request After Receiving Access-Accept
by Okis Chuang 26 Apr '13

26 Apr '13

Dear all, >From the originate-coa documentation, it seems I can't originate coa-request at the section of pre-proxy or post-proxy. It's documented, pretty clear. I'm not sure whether it is the cause of my following questions. But what if I need two steps below finished continually both in the same move: 1. *proxy* auth request to other AAA dispatcher(also FreeRADIUS) to decide where to authenticate. 2. Getting Access-Accept in post-auth, then originate coa request at once in order to change redirect profile to forward profile for subscriber. But I got the warning that *cannot proxy and originate CoA packets at the same time*. Actually I move the coa origination to my AAA dispatcher, it also can't works and occurs the same warning.(It makes sense because both are doing coa request after proxying auth request I guess. So here are my questions: 1. Does this flow works possibly in my scenario? I mean can I originate coa at once after getting Access-Accept? 2. What if I set a *virtual coa server* for receiving coa request from itself, then send to gateway at the section of recv-coa { update coa { ... } } Does it make sense? Thanks in advance! Okis

2 1

implementing 3gpp2 attributes
by Juan Pablo L. 25 Apr '13

25 Apr '13

Hi, i m in the early stages of implementing a prepaid service for a CDMA network, i have to exchange radius package using the 3gpp2 standard which is an extension to the basic radius protocol. i m facing an issue and that is that the attributes in the 3gpp2 standard included attributes that contain subtypes, in the form of: type:26Length: variable, greated than 8Vendor-ID: 5535Vendor-Type: 91Vendor-Length: variable, greater than 2Sub-Type (=1): Sub-Type for AvailableInClient attributeSub-Type (=2): Sub-Type for SelectedForSession attribute.......Sub-Type (=N): XXXX i have done several tests to confirm that freeradius only supports simple attributes in the form of attribute = value, i need to implement the above, is there any way i can implement it ? i dont mind doing all the work my self but i do not see available or easy ways to access the actual data of the structures directly ... can someone please advise how to implement attributes such as the above ? thanks!

3 3

Best way to select multiple NAS-Port-Ids
by Franks Andy (RLZ) IT Systems Engineer 25 Apr '13

25 Apr '13

Hi All, I have a hopefully fairly straightforward question. We have a network switch, a procurve 5406 that we're doing mac based port authentication on. The switch sends radius attributes including the NAS-Port-ID. I want to be able to reply with tagged and untagged vlans for the ports once authenticated, but the combination depends on the port. Lots of ports will likely have the same setup though, so I'd like to do something (I guess in the users file) like DEFAULT NAS-Port-ID == 1-12, ... This would work ok, but the ports are named modularly, i.e. A1, A2 etc, up to usually F24 max, not just numerically. What's the most elegant way of doing this? I could do a wildcard match, but I think I've seen incompatibilities mentioned with possibly chap, which is what I'm using. Could have that wrong though. Is there a better way? Thanks Andy

3 3

Problem with Discarding packets. It is the Radius, MySQL or PostgreSQL?
by Michell 25 Apr '13

25 Apr '13

Hello guys, I would like an opinion concerning a situation that is happening with us. I'm sure you have faced a similar situation. Currently I have about 3000 clients connected simultaneously in 8 concentrators Mikrotik. These concentrators authenticate to 3 servers freeradius doing consulting and accounting users in a mysql db. The time we have the message "Discarding duplicate request ..." and " Discarding conflicting ..." and in recent days began using ippool in postgresql where we started having problems duplicating IPs. We believed that such duplication was due to these messages which were caused by our server mysql which was ancient and did not allow more make the necessary adjustments as the number of clients and memory. So we did the installation of new server Mysql and changed the parameters possible and even indicated by mysqltunner and mysqlprimer, but the message continued Discarding occurs. So we started using two tables for the radacct, but the message remains. Finally, we migrated the radacct for postgresql, where the number (two tables) where the incidence of this message decreased, but remains on average 50 per hour to about 1300 sections with pppoe interim-update 5 minutes. What are the parameters that could be changed to make the tuning of freeradius? The question that remains ... MySQL or PostgreSQL? We've done several settings in radius and mysql and still can not stop these messages. Attached my freeradius settings. I appreciate the attention and the help of everyone, Att

4 3

FreeRadius connection pooling
by Bruce Bauman 25 Apr '13

25 Apr '13

I'm updating an environment from freeradius 2.1.x to freeradius 2.2.x, and I'm trying to figure out connection pooling. Our current configuration has 5 sql {} stanzas in the sql.conf file, each specifying num_sql_socks and several other SQL related variables. WIth connection pooling, can I share these connections between all of the stanzas? Is there a good place to look for documentation? Also, can anyone give some examples of a how a moderately large radius configuration should be configured? Thanks for any insight. -- Bruce Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

2 1