July 2014 - Freeradius-Users - lists.freeradius.org

RE: radiusd.conf max request ?
by Arnaud . 21 Jul '14

21 Jul '14

I rebooted the freeradius service. Num_sql_socks about what is the right number for SQL happens to manage well? And where we see the maximum number that can be set? If "num_sql_socks" is too low, what are the error messages normally? > Date: Mon, 21 Jul 2014 13:43:34 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: arn0(a)live.fr > Subject: Re: radiusd.conf max request ? > > Hi, > > > Documentation in radiusd.conf does not specify whether to restart the > > service or not. And as it works, I do not know if there needs to restart > > the freeradius service. > > you know there is more documentation than JUST the config files? > > http://freeradius.org/doc/ > > what services/systems do you use that automatically take new options as the configuration files > are changed? such systems are few and far between - for a reason! > > > About SQL connections as I have no error message, I will not change this > > setting. > > > > Currently I have: > > > > num_sql_socks = 5 > > connect_failure_retry_delay = 60 > > for a lot of calls, '5' is a low number.... but since your SQL cant seem to handle the > current number of queries I wouldnt change it....one change at a time and all that.. > > alan

2 1

SQL error
by David Peterson 21 Jul '14

21 Jul '14

OK I am seeing some strangeness from the sql query for the group user lookup. The table exists and the entry for this user exists, I ran the query manually. mysql> select groupname from radusergroup where username = BINARY'test(a)WiMax.com'; +-----------+ | groupname | +-----------+ | Test | +-----------+ 1 row in set (0.00 sec) But here is what FreeRadius shows: rlm_sql (sql): Reserved connection (4) (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test(a)WiMax.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test(a)WiMax.com' ORDER BY id' (6) sql : User found in radcheck table (6) sql : Check items matched (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test(a)WiMax.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test(a)WiMax.com' ORDER BY id' (6) sql : EXPAND # SELECT groupname # FROM radusergroup # WHERE username = BINARY '%{SQL-User-Name}' # ORDER BY priority (6) sql : --> # SELECT groupname # FROM radusergroup # WHERE username = BINARY 'test(a)WiMax.com' # ORDER BY priority rlm_sql (sql): Executing query: '# SELECT groupname # FROM radusergroup # WHERE username = BINARY 'test(a)WiMax.com' # ORDER BY priority' rlm_sql_mysql: MYSQL Error: No Fields rlm_sql_mysql: MYSQL error: (6) sql : User not found in any groups

2 1

RE: radiusd.conf max request ?
by Arnaud . 21 Jul '14

21 Jul '14

Hello, I will contact you again because I would like confirmation that the increase in the value "max_request" to a very large value can improve without risk? I have a server with 6x 8192Mo RAM and Intel (R) Xeon (R) CPU E5630(a)2.53GH and 16 ccores. In addition, for messages: Tue Jul 15 2014 8:46:41 p.m.: Error: Discarding duplicate request from client localhost: 2054 - ID: 0 due to unfinished request 442908 I did some research and I compend it's because of my DB too slow but I did not find what he needed to do to solve this? Thank you and sorry for all these questions: s best regards Subject: RE: radiusd.conf max request ? From: A.L.M.Buxey(a)lboro.ac.uk Date: Fri, 18 Jul 2014 15:46:19 +0100 To: arn0(a)live.fr What you put will depend on the maximum number of requests you receive and the number of requests that you can handle. Making tge number bigger wont magically make the server faster alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 5

FreeRadius EAP-GTC mode
by Levavi, Yariv 19 Jul '14

19 Jul '14

Hello, We are trying to configure our FreeRadius environment to work with EAP-GTC (2 factor authentication): 1) When configuring working in proxy mode - the client (Netmotion 10.11) does not pop second authentication login screen ("password:"). Can you tell why or what should we configure differently in order to make it work? 2) The pratical configuration we are trying to get is - first authentication will be against AD and the second one (response to Access_Challenge) against forwarded Radius Authentication server. How can this be configured? Regards, Yariv Levavi SafeNet's Integration Team The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

2 1

Can dhcpclient handle broadcasting ?
by Chaigneau, Nicolas 19 Jul '14

19 Jul '14

Hello, I'm trying to use dhcpclient to test broadcasting of a DHCP Discover. I am root so I can use source port 68. I'm sending the packet to the broadcast address. I get the following error (returned by sendmsg, called from "sendfromto"): "Permission denied". Is it possible to use dhcpclient from FreeRADIUS in broadcast mode ? Regards, Nicolas. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 4

How to set User-Profile for roaming (proxied) users
by Jonathan 19 Jul '14

19 Jul '14

Hi all, First an overview: - I'm running Freeradius 2.2.5 with local users in SQL database - We have roaming users utilizing our network infrastructure, but these users do not exist in our own local database and need to be proxied for authentication/accounting - normal proxying and authentication/accounting is going well. Setup: Roaming user <-> OUR_INFRA+RADIUS <-> ROAMING_RADIUS Since it's an international roaming agreement, I have configured a catch-all REALM which do not match our owns to be send their: realm "~.+$" { pool = ROAMING nostrip } I now want to assign a user-profile for these users so that I can pre-authorize them using our own policies. For example: 1) roaming is only allowed on weekends and weektime during evenings 2) per user, only 1 roaming session is allowed 3) per user volume limiting based on a user-profile for this roaming agreement (User-Profile := "roaming") I've tried both methods below to set this in the authorize section as follows: authorize{ ... sql if (notfound} update control { User-Profile := "roaming" } } realm "~.+$" { pool = ROAMING nostrip update control { User-Profile := "roaming" } } but none are working, i've also tried proxy-request and request as update statements. How can I assign profiles to roaming users who do not exist in our local database for authentication, but are accounted for locally. Thx, Jonathan

3 4

Single sign on using freeRadius and Apache?
by Mark jensen 19 Jul '14

19 Jul '14

Hello freeradius version is 1.0.4 I have read that I could authenticate a user In Apache using freeRADIUS using this tutorial: http://uk-corp.org/Books/OReilly%20Books/radius/html/radius-chp-7-sect-1.ht… 1- my question is this will work if RADIUS use openLDAP as a back-end DB? I authenticate users in the wired network(clients connected to a nortel switch) using ieee802.1x and freeradius,it worked will, but when a user ask for an authorized web page it will ask him for the credentials for the second time: 2- Is there a way to configure freeRADIUS and Apache to let the authorized users using 802.1x to get the authorized web pages without asking them to type it for a second time (something like single sign on)? In short words can we pass the credentials from freeradius to Apache? Is there any tutorials that will help me in freeRADIUS website?

2 1

How can we make freeradius logs logout actions?
by Mark jensen 19 Jul '14

19 Jul '14

freeRADIUS version is 1.0.4, and we use IEEE802.1X to authenticate users This is a part of my radius.log file: Wed Jun 11 11:14:36 2014 : Auth: Login OK: [Mark/<via Auth-Type = EAP>] (from client private-network-1 port 0 via TLS tunnel) Wed Jun 11 11:14:36 2014 : Auth: Login OK: [Mark/<via Auth-Type = EAP>] (from client private-network-1 port 5 cli F0-4D-A2-B2-34-16) Wed Jun 11 11:20:57 2014 : Auth: Login OK: [Mike/<via Auth-Type = EAP>] (from client private-network-1 port 0 via TLS tunnel) Wed Jun 11 11:20:57 2014 : Auth: Login OK: [Mike/<via Auth-Type = EAP>] (from client private-network-1 port 11 cli 00-26-38-C0-BA-37) as we see above radius logs the login actions, but when a user logout, radius doesn't log anything Can we make radius logs the logout actions too,what the configurations should I change to do this?

3 2

FreeRADIUS using OpenLDAP Security
by John McCarthy 18 Jul '14

18 Jul '14

Hey Guys, I am running FreeRADIUS 3.0.3, OpenLDAP version 2.4.39. Both my openldap and freeradius servers are using start_tls. I have configured the freeradius server to use ldap and have verified that everything is working using `radiusd -XXX` and then `radtest username password localhost 18120 testing123`. So here is my setup. I have a Ubiquiti Unifi Access Point that I am using WPA-Enterprise on. I have the Unifi AP pointing to the FreeRADIUS server and using the correct secret. And on my FreeRADIUS server, I have the Unifi AP setup as a client with the same secret. When I connect to my Unifi AP from a wireless device, I select EAP-TTLS and PAP. So here is my question: is this setup the norm? Is this secure enough? would you use a setup like this in a production environment, I just want to make sure im not forgetting some loophole or something. I am also wanting to make sure traffic from the Freeradius server to the LDAP server cannot be "sniffed" and traffic from the freeradius server to the unifi AP cant be "sniffed". I've checked places like this post: http://freeradius.1045715.n5.nabble.com/How-secure-is-the-radius-encryption… And it looks to me like my setup is setup correctly for what I am looking for.

2 2

SQL error
by David Peterson 18 Jul '14

18 Jul '14

OK I am seeing some strangeness from the sql query for the group user lookup. The table exists and the entry for this user exists, I ran the query manually. mysql> select groupname from radusergroup where username = BINARY'test(a)WiMax.com'; +-----------+ | groupname | +-----------+ | Test | +-----------+ 1 row in set (0.00 sec) But here is what FreeRadius shows: rlm_sql (sql): Reserved connection (4) (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test(a)WiMax.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test(a)WiMax.com' ORDER BY id' (6) sql : User found in radcheck table (6) sql : Check items matched (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test(a)WiMax.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test(a)WiMax.com' ORDER BY id' (6) sql : EXPAND # SELECT groupname # FROM radusergroup # WHERE username = BINARY '%{SQL-User-Name}' # ORDER BY priority (6) sql : --> # SELECT groupname # FROM radusergroup # WHERE username = BINARY 'test(a)WiMax.com' # ORDER BY priority rlm_sql (sql): Executing query: '# SELECT groupname # FROM radusergroup # WHERE username = BINARY 'test(a)WiMax.com' # ORDER BY priority' rlm_sql_mysql: MYSQL Error: No Fields rlm_sql_mysql: MYSQL error: (6) sql : User not found in any groups

1 0