July 2013 - Freeradius-Users - lists.freeradius.org

How to limit the number of active uers
by Thura Hlaing 05 Jul '13

05 Jul '13

Hello guys, I am wondering if there is anyway for freeradius to reject auth requests based on the number of active (connected) users. For example, I would like to limit the number of active (authorized) users to 50 in my radius+CoovaChilli deployment, so that connection speed doesn't become very poor. I am very new freeradius user. So, any hints/suggestions will be highly appreciated. Yours, Thura Hlaing

2 1

Access-challenge timeout on IOS
by Franks Andy (RLZ) IT Systems Engineer 04 Jul '13

04 Jul '13

Hi, I'm experimenting with a system involving an access-challenge to a NAS. It works fine with FR so far on, say, the cisco ipsec vpn client, which waits a long time until timing out waiting for user input. I'd like to also discover how other NAS's behave using this and have found the timeout on a particular cisco 1131 access point to be quite short. Does anyone know if there's a radius attribute I can send that will extend this timeout, or an internal setting that will change the default on the ap? Session-timeout and Idle-timeout are attributes mentioned by the cisco docs but neither of these seem to be what I'm after. Thanks Andy

5 6

RE: Access-challenge timeout on IOS
by Franks Andy (RLZ) IT Systems Engineer 04 Jul '13

04 Jul '13

I'll give it a go. Thanks for the information guys. The cisco attribute list says Session-Timeout : Sets the maximum number of seconds of service to be provided to the user before the session terminates. This attribute value becomes the per-user "absolute timeout." Not that helpful, and why I discarded it as an option which might be useful. Let's see.. Thanks andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 04 July 2013 15:28 To: freeradius-users(a)lists.freeradius.org Subject: Re: Access-challenge timeout on IOS On 04/07/13 14:34, David Mitton wrote: > Quoting Phil Mayers <p.mayers(a)imperial.ac.uk>: > >> On 04/07/13 11:00, Franks Andy (RLZ) IT Systems Engineer wrote: >>> Hi, > .... >> >>> >>> Session-timeout and Idle-timeout are attributes mentioned by the >>> cisco docs but neither of these seem to be what I'm after. >> >> Neither are relevant; they're for established sessions, not timeouts >> in >> *establishing* one. >> - > Actually, that is incorrect Session-Timeout _is_ used to control the > authentication timeout, when in the initial AccReq. I'd quote the > RFC, but I'm not at home. The *-Timeouts in the Acc-Accept control the session. > Hmm, so it does; 5.27 of 2865 and 2.3.2 of 2869. However - does any equipment actually *honour* this? Also, I note the wording is very loose indeed - no MUST. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Problem with CISCO WIRELESS CONTROLLER and RADIUS Authentication
by Alan Buxey 04 Jul '13

04 Jul '13

Those are VSA that you are getting from the NAS. You're WiFi kit is centrally managed so config is pushed from the controller alan

1 0

Problem with CISCO WIRELESS CONTROLLER and RADIUS Authentication
by Gustavo Vieira Oliveira 04 Jul '13

04 Jul '13

Hello! We have a Cisco Wireless Controller 5508 with Aironet 1041 APs. To make the AP authenticate with RADIUS we need to set the following command manually in the AP: - radius-server vsa send Which as explained by cisco does the following: Command Purpose Router(config)# *radius-server vsa send* [*accounting* | *authentication*] Enables the network access server to recognize and use VSAs as defined by RADIUS IETF attribute 26. The thing is, the APs can only authenticate if this command is issued in the AP by cli and we need that the Wireless Controller can pass this configuration to the APs, which it doesn't support. So, anyone know why is it necessary and if there is another alternative or workaround to make it work without it? Nowadays we schedule a script to log in the AP and run the command. Thanks in advance.

4 4

Setting Class attribute by LDAP Groups
by Patrick Gawthorne 04 Jul '13

04 Jul '13

Hello Currently trying to implement a way to get the Ldap-Group used for checking (within acct_users) into the Accounting-Request packet as the Class attribute.. I can get it to send a static variable just fine using; (I'm proxying the account messages) update request { Class = "Some Variable" } However I was looking at doing something on the lines of; update request { Class = "%{Ldap-Group}" } Also tried defining a custom variable within the dictionary file and setting it within acct_users however it expands to nothing in preacct section.. I must be doing something wrong. I did read somewhere if you included the Class variable within the reply in the Access-Accept packet that it would be sent back and used within the accounting messages as well but this hasn't been the case for me. Even if it's just some static variable that I set within the 'acct_users' to get it to send the class attribute; this will achieve my goal. Assuming that the 'users' file and the 'acct_users' file have the same behaviour then why can't I set Class within the 'acct_users' file like I can with 'users' file? Any assistance on this will be greatly appreciated. :) Cheers, Pat This email, together with any attachments, is intended for the named recipient(s) only and may contain privileged and confidential information. If received in error, please inform the sender as quickly as possible and delete this email and any copies from your computer network. If not an intended recipient of this email, you must not copy, distribute or rely on it, and any form of disclosure, modification, distribution and/or publication of this email is prohibited. Unless stated otherwise, this email represents only the views of the sender and not the views of Pacific Lutheran College.

3 2

Using freeradius as proxy for EAP-SIM/EAP-AKA
by Ming-Ching Tiew 03 Jul '13

03 Jul '13

Hi I am wondering if it is possible to proxy EAP-SIM/EAP-AKA authentication using FreeRadius ? Assuming brand X radius server has support for EAP-SIM/EAP-AKA, but it's located at the final end of the food chain, and in-between the brand X radius server and the Access point, there are 2 (or more) radius servers which are doing proxying ( and some other non-EAP SIM/EAP AKA work ). Will it work ?

6 7

Stripped-User-Name not set when using nostrip?
by Júlíus Þór Bess Ríkharðsson 03 Jul '13

03 Jul '13

3 8

Rejected proxy requests not making it to the client
by Ti Leggett 03 Jul '13

03 Jul '13

I have a setup where we have three distinct OTP services, one by the organization and 2 specific to our group. Users can choose which service they want to use and this is done by membership in a netgroup (an rlm_perl script looks up the user to see what netgroup they belong to). We have proxy servers that all the clients talk to and their purpose is to determine which upstream OTP service to authenticate a user against and proxy the requests there. I'm seeing strange behavior when a user types their password incorrectly in that the reject never makes it all the way to the client and on the server I see the following on the server: Tue Jul 2 10:39:04 2013 : Error: WARNING: Unresponsive child for request 0, in component <core> module <thread> Tue Jul 2 10:39:05 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. Tue Jul 2 10:39:06 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. Tue Jul 2 10:39:09 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. Tue Jul 2 10:39:12 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. Tue Jul 2 10:39:17 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. Tue Jul 2 10:39:25 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. Tue Jul 2 10:39:36 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>. ... The upstream server does get the request, send the reject back to the proxy and the proxy receives the reject but doesn't seem to send the reject back to the client. When the user types the password successfully everything works fine - the client gets an OK and none of the hung request errors show up. A debug log of one of these failed sessions is at http://pastebin.com/8n7snaBV. Any ideas what might be going on?

3 11

EAP and non-EAP on same port?
by Bruce Bauman 03 Jul '13

03 Jul '13

Right now we have freeradius configured so that EAP and non-EAP are handled by separate virtual servers which are listening on separate virtual ports. We'd like to simplify our configuration and use the same port for both. I've looked through the documentation without much success. Does anyone have an example configuration of this? Thanks. -- Bruce Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

4 3