October 2014 - Freeradius-Users - lists.freeradius.org

Reject delay fractional value
by Eugene Grosbein 30 Oct '14

30 Oct '14

Hi! Small feature request: please make it possible to specify fractional values of seconds for Reject delay values. I need this for dhcp module, 1 second is too small for me but 2 is too large :-) I'd like to specify 1.5 or 1.8 seconds. 1/100th second precision ought be enough :-) Eugene Grosbein

3 10

Timestamps
by Mike Gadoury 29 Oct '14

29 Oct '14

Is there any way to get timestamps to printed in the debug log file? I'm having issues with clients periodically failing to authenticate properly and I'm wondering if a slow directory may be the cause of the issues. The version I'm running is: radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Jan 9 2013 at 05:03:12 Thanks for your help. Mike

2 1

A new CRL processing
by vincent viard 29 Oct '14

29 Oct '14

Hi, I just want to know if the following statement is always true: "You will still need to restart FreeRADIUS after downloading a new CRL" Thanks Vince

4 3

802.1X Radius with Yubikey
by Philip Wege 29 Oct '14

29 Oct '14

Hi All Has anyone managed to get yubikeys to work with wireless network access using yubikeys ? I'm trying to get 802.1x to work with yubikeys using freeraduis 3, local user in the users file and the yubikey module. I'm constantly running into the same error which is shown below: yubikey : No cleartext password in the request. Can't do Yubikey authentication Default eap type is peap and default eap type under peap is gtc and gtc auth type is pap I'm testing with a user defined in the users file and I'm trying authorize and authenticate as shown below in the inner tunnel: Authorize : eap if (ok || updated) { yubikey files } else { reject ( This is so that if no yubikey is submitted along with password radius should reject the auth * this works in default when authing vpn access under the yubikey authorize * ) } Authenticate : Auth-Type PAP { yubikey pap } I have tried defining a separate auth type like suggested in a previous mailing list post but startup kept on failing with error unknown auth type for eap_gtc yubikey when trying to do this: Auth-Type yubikey { yubikey pap }

2 2

server.thread.start not triggered on startup
by Nikolai Kondrashov 29 Oct '14

29 Oct '14

Hi everyone, I see that the v3.0.x code doesn't fire the server.thread.start trigger on startup (in thread_pool_init), but only during runtime (in thread_pool_manage). Is this done to avoid a burst of triggers on startup for installations with large thread number? Something else? Thank you. Nick

2 1

Fwd: FR 3.0.x Head + coova chilli + mysql Volume Limit
by Abdullah 29 Oct '14

29 Oct '14

Remaining 2 logs

1 0

reaped processes still timing out in rad_waitpid
by Louis Munro 28 Oct '14

28 Oct '14

Hello, I have hit upon a case where some ntlm_auth processes would return (and write the NT_KEY to the connecting pipe) but FR still complains that it failed and denies authentication (this is on 2.2.5). This manifests in the logs like the following: Tue Oct 28 11:10:15 2014 : Auth: Login incorrect (mschap: External script says NT_KEY: 4BCE6CA72058BA7EE500D1A68A8771C0): [tstRad9] (from client 155.98.204.47 port 0 cli 02-00-00-00-00-01 via TLS tunnel) Since this is actually the output for a valid and successful authentication, it appears that the exit code is the real issue. That exit code is either that of the process itself or 2 if rad_waitpid times out while waiting for the child. After adding some debugging statements and recompiling I found that there were cases where reap_children would reap a child process but the pid would not be found in thread_pool.waiters. This only happened when there were a significant number of auths per seconds and still not consistently. Some head scratching ensued and a colleague then suggested there may be a race condition between rad_fork (where it calls fr_hash_table_insert) and reap_children (where it calls fr_hash_table_finddata). So I wrote a quick patch which I submit to your consideration. It adds the pid to the hash table if not found. In our (admittedly limited) tests this has fixed the issue. No more ntlm_auth waiting ten seconds before timing out. I don't claim for this patch to be perfect. For one thing it causes an error to be logged by rad_fork (" Failed to store PID, creating what will be a zombie process") when the pid is added to the hash table in reap_children. There may be better ways to do this, perhaps simply with better locking in rad_fork. This is only meant as a fix while the issue is discussed and improved upon. Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

Radius management tool (RadiusClock)
by Shawn Wiley 28 Oct '14

28 Oct '14

Has anyone played with this or know of anything better? http://www.ane-solutions.com/getting-started RADIUSClock is a web based interface to configure, monitor and report on freeRADIUS server. It is available as a virtual appliance packaged with * CENTOS 5.5 * MySQL server 5.5.8 * freeradius server 2.1.10 * jdk1.6.0_23 * apache tomcat 7.0.6 * A web application "rclock" to configure RADIUS and generate reports. Features * Easy setup & configuration, No installation is required. * Simple user interface to configure clients, users, groups, radreply, radgroupcheck, radgroupreply * RADIUS Reports - Auth, Acct, Sessions, Summary, Auth Trend, Unique Users/Endpoints/IP Addr/NADs and Usage Summary * Dashboard - Provides Summary, Auth Trend chart, Top 10 Users/NADs * Automatic Data Management for reports. * Highly customizable UI based on user roles ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

2 1

FreeBSD+FreeRadius 10k subscribers
by Antonio Nunnes 28 Oct '14

28 Oct '14

I have on average 5k a day online subscribers. My freeradius and mysql-server: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz 2*4GB DDR3 1333MHz 3*1TB SAMSUNG BLUE in RAID 0 Mysql: mysql Ver 14.14 Distrib 5.5.40, for FreeBSD10.1 (amd64) using 5.2 My problem : My radacct now has 17 million lines, while the freeradius starts closing sessions begins to lock the table radacct and processing mysql rises too. I thought I'd share the radacct in radacct __% Y_% M has any better solutions? Sorry my bad english, Antonio Nunness

2 1

remove blank space in realm
by Rando Nakarmi 28 Oct '14

28 Oct '14

how to I remove blanks from the realm ? like, 'fiscal.edu ' after the edu Login incorrect (Home Server says so): [fiscal(a)fiscal.edu /<no User-Password attribute> After adding this I get : if ("%{request:User-Name}" =~ /^(.+)(a)(.+)\\s$/) { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } } Login incorrect (mschap: External script says Logon failure (0xc000006d)): fiscal/<via Auth-Type = EAP>] (from client TLS tunnel) i get / after username still no luck!!!

2 1