April 2013 - Freeradius-Users - lists.freeradius.org

Setting exceptions to Quota calculations
by Khalid Shaka 25 Apr '13

25 Apr '13

Hello all, We are just starting a DSL business so we are getting ourselves familiar with FreeRadius. We are introducing packages that include unlimited traffic to certain domains such as youtube. Is there a way to set up our quota system to exclude traffic to youtube? If so, can we do it on specific users that sign up to the package and not everyone else? I realize that this might require some configuration on the router side, we are running a Cisco 7206/NPE-G1 if that helps. Appreciate your help Khalid

2 1

case insensitive password
by Mehdi Ravanbakhsh 24 Apr '13

24 Apr '13

how i could check case insensitive password for user.. many of users use wring password based on Caps Lock , so i need to check password insensitive and it is better if i could limit this kind of password check for some nas-ip-adress. which part of config file should be modified for this problem? Best regards.

2 2

RE: Have anyone test the performance about FreeRADIUS+jRadius on authentication?
by Okis Chuang 24 Apr '13

24 Apr '13

Thanks for Alan's quick and kindly reply! Yes, I'm under this slow performance trouble now.... Actually I tried let it not going into jradius and completing my easy job only in FreeRADIUS yesterday. And it did it well. It can finish 10000 auth request in 13 sec. However, our goal is more than that ... the brief situation is that user will be redirected to our captive portal during pre-auth if they got IP address, then doing UAM authentication by web portal to our policy manager server(built in FreeRADIUS+JRadius). We'll do some policy based control with our WiFi gateway like CoA request. Then would do subscribers' accounting processing(identify some attributes in accounting packet then modify its value then send to backend acct server). So supposed I stop using jradius, what kinds of module would you recommend me to fulfill these jobs such as that? Or actually FreeRADIUS can satisfy it by itself? Can it send CoA request to WiFi gateway after receiving some predefined attribute value with web portal while it sending access request to FreeRADIUS? I plan to make it become a policy manager. Cheers, Okis ------------------------------------------------------- Chuang Okis wrote: > Have anyone test the performance about FreeRADIUS+jRadius on authentication? Not me. > The test was just for authentication load test from gateway to radius > server. My jradius handler would just do some easy string splitng for > one VSA. Use Perl. It's integrated into the server, and should be much faster. Or, use a regex. See "man unlang". Or, write a C module to do it. > Does this be the most probable factor causing the slow processing? > Even through I doubt it... Yes. It's jradius. > Then I did some interesting test later... > I left my handler empty but still let traffic get into jradius handler > through rlm_jradius by TCP socket. > The result has improved a bit even though not at our level of acceptance.. > Its TPS (Transaction Per Seconds) improved from 30 to 300 approximately. 300 is still MUCH slower than 10,000. > Hence, I'm guessing the bottleneck may be the process of rlm_jradius > communication. > Does anyone get any help or recommendation?? > Or any other performance tuning tips I can do? Don't use jradius. It's very slow. Use pretty much anything else. Alan DeKok. ------------------------------

3 2

How to fix the proxy source port
by Okis Chuang 24 Apr '13

24 Apr '13

Hi all, Can I FIX the source port rather than random src port when proxy request to other RADIUS server? I know it is able to fix src IP address in proxy.conf, but seems no config about fixed src port. What if I set " src_ipaddr = 127.0.0.1:3100 " in proxy.conf, could this work? Thanks in advance! Okis

2 1

How to change request attribute based on NAS IP address
by Mehdi Ravanbakhsh 24 Apr '13

24 Apr '13

Hi All i use Cisco and mikrotik as Access server in my network and i need to limit user access by MAC address. in this case i can use Calling-Station-Id , it works for mikrotik : AUTH Detail Packet-Type = Access-Request Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 11062419 NAS-Port-Type = Ethernet User-Name = "7622240489" Calling-Station-Id = "90:F6:52:D5:74:96" Called-Station-Id = "EHO-L" NAS-Port-Id = "902- ADSL-EMAM-HOSIEN" NAS-Identifier = "2800gs-langha" NAS-IP-Address = 10.185.3.5 SQL-User-Name = "7622240489" But not work for Cisco : Packet-Type = Access-Request Cisco-AVPair = "client-mac-address=9094.e483.390b" Framed-Protocol = PPP User-Name = "5858222251" NAS-Port-Type = Ethernet NAS-Port = 13145502 NAS-Port-Id = "0/0/2/352" Service-Type = Framed-User NAS-IP-Address = 85.185.83.242 Acct-Session-Id = "00C8959E" NAS-Identifier = "BOJNOORD_7204_1" SQL-User-Name = "5858222251" So how i can Set calling station ID to MAC addreess for cisco NAS ? Best regards.

2 2

Have anyone test the performance about FreeRADIUS+jRadius on authentication?
by Okis Chuang 23 Apr '13

23 Apr '13

Thanks Fajar your speedy response and really helpful for me. Yeah..I'm pretty grateful about all contributions here for sure! And I'm definitely not insist on desiring the best solution here. I just want to listen some opinions or advice from all those experienced. Anyway, I'll keep learning and contributing here in one day. About your kind advice, I will take a serious consideration absolutely. Thanks for you helpful recommendations again! -- Okis --------------------------------- Since you seem to have some specific requirement, I'd recommend you engage with someone with experience in freeradius implementation and integration in your area. Most people here won't have the time to go thru your detailed request one-by-one and designing a best solution for you. Remember, those who contribute on this list do so on their free time, out of their good will. Some comments though > Then would do subscribers' accounting processing(identify some attributes in > accounting packet then modify its value then send to backend acct server). FR has all sorts of module that can modify radius packets on proxy scenarios. Unlang is perfect for simple and static rules (e.g. "add attribute X with value Y to every packet") while for complex rules (e.g. get value of attribute X, lookup value in db, then create attribute Y based on that value) mod_perl is probably more suitable. > Can it send CoA request to > WiFi gateway after receiving some predefined attribute value with web portal > while it sending access request to FreeRADIUS? Try reading raddb/sites-available/originate-coa -- Fajar

1 0

Have anyone test the performance about FreeRADIUS+jRadius on authentication?
by Chuang Okis 23 Apr '13

23 Apr '13

Hi all,Have anyone test the performance about FreeRADIUS+jRadius on authentication?I recently did several numbers of load test with radclient in FreeRADIUS.I used radclient -c 10000 to attack my radius server(with jradius), and found that the results are pretty bad...The call per second was approximately under 50...however I tried without jradius, just files in FreeRADIUS for auth, then result is 10000 request with 13 seconds. Honestly, the gap shocks me..my environment is:FreeRADIUS 2.2.0JRadius 1.1.4jdk 1.7rlm_jradius TCP Socket: 128jradius threads: 100The test was just for authentication load test from gateway to radius server. My jradius handler would just do some easy string splitng for one VSA.Does this be the most probable factor causing the slow processing? Even through I doubt it...Then I did some interesting test later... I left my handler empty but still let traffic get into jradius handler through rlm_jradius by TCP socket. The result has improved a bit even though not at our level of acceptance.. Its TPS (Transaction Per Seconds) improved from 30 to 300 approximately. Hence, I'm guessing the bottleneck may be the process of rlm_jradius communication. Does anyone get any help or recommendation??Or any other performance tuning tips I can do? Thanks in advance! Okis

2 1

Re: [Help] How to control the authentication session timeout
by Alan Buxey 23 Apr '13

23 Apr '13

Controlled by the NAS and/or the RADIUS server depending on NAS settings. ie you should be able to set session-timeout on the NAS and then override/update the value on the RADIUS server depending on your chosen policies...eg for particular users/clients etc...and if proxying you may have agreements or filtering in place to set/agree the value alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

4 10

Procautions on upgrading FR from 2.1.10 to 2.2.0
by Wang, Yu 23 Apr '13

23 Apr '13

Hello, I am planning to upgrade our FR from 2.1.10 to 2.2.0 to address increasing NTLM authentication failures using EAP-MSCHAPv2 in our wireless systems. I would welcome and appreciate advice on precautions I should take before, during, and after upgrade. Any issue did you run into in your upgrade, what impacts it had, and how did you resolve it? Thank you for your time. Yu Wang Network Architect Core Networking, FSU

4 7

Re: Procautions on upgrading FR from 2.1.10 to 2.2.0
by Alan Buxey 23 Apr '13

23 Apr '13

...have a little test/dev server. Copy your current config onto it and run the new version in full debug mode, see what it might complain about Alternatively, compare your config against vanilla config and then just start from vanilla making required changes...this can really help to clean up old legacy configs and also helps you learn the server and how it works..I note this method as its going to be crucial for 2.x to 3.x upgrades alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0