September 2014 - Freeradius-Users - lists.freeradius.org

Re: Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Hi, Adding more to it: Basically count the number of auth request received and the number of responses returned with error code . Basically count the number of accounting request received and the number of responses returned with error code. Somebody please help me with this. Regards, Himanshu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Thu, 25 Sep 2014 15:00:53 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: Module Statistics in freeradius Hi, Adding something more to it. Like How many auth or accounting request received? How many of them failed? How many of them were OK,noop,reject etc. Regards, Sonu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Thu, 25 Sep 2014 11:34:58 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org>, "a.cudbardb(a)freeradius.org" <a.cudbardb(a)freeradius.org>, "aland(a)deployingradius.com" <aland(a)deployingradius.com> Subject: Module Statistics in freeradius Dear Friends, I have a requirement that I want "Module statistics". Meaning, say a module is hit 100 times in a session then the module statistics should consist of the count of say "reject" return code if any, count of say "OK" return code if any,count of say "fail" return code if any, count of say "noop" return code if any and so on and so forth. I have gone through radmin but it supports module status only. Is there anything in freeradius that supports Module statistics. If "No" then what piece of code to be included or modified and where exactly in freeradius. Basically how to achieve this. Regards, Sonu     Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Hi, Adding something more to it. Like How many auth or accounting request received? How many of them failed? How many of them were OK,noop,reject etc. Regards, Sonu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Thu, 25 Sep 2014 11:34:58 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org>, "a.cudbardb(a)freeradius.org" <a.cudbardb(a)freeradius.org>, "aland(a)deployingradius.com" <aland(a)deployingradius.com> Subject: Module Statistics in freeradius Dear Friends, I have a requirement that I want "Module statistics". Meaning, say a module is hit 100 times in a session then the module statistics should consist of the count of say "reject" return code if any, count of say "OK" return code if any,count of say "fail" return code if any, count of say "noop" return code if any and so on and so forth. I have gone through radmin but it supports module status only. Is there anything in freeradius that supports Module statistics. If "No" then what piece of code to be included or modified and where exactly in freeradius. Basically how to achieve this. Regards, Sonu     Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Dear Friends, I have a requirement that I want "Module statistics". Meaning, say a module is hit 100 times in a session then the module statistics should consist of the count of say "reject" return code if any, count of say "OK" return code if any,count of say "fail" return code if any, count of say "noop" return code if any and so on and so forth. I have gone through radmin but it supports module status only. Is there anything in freeradius that supports Module statistics. If "No" then what piece of code to be included or modified and where exactly in freeradius. Basically how to achieve this. Regards, Sonu    

1 0

recommendations for max_servers
by Louis Munro 24 Sep '14

24 Sep '14

Hello, While troubleshooting a system I came upon a case of 'hung children' and duplicate requests. I would usually ascribe this to a database issue but in this case the database is mostly unused and properly indexed. Accounting is not used, so that's one less thing to consider. On the other hand the max_servers setting had been set as high as 192 by someone with good intentions. Tuning it down to 64 seemed to significantly reduce the load on the system and the number of hung children was reduced by a factor of about 100. While there remains an issue with some (intermittent) slow ntlm_auth to take care of, I wondered how others tune the value of max_servers other than by trial and error. Most of the time the default of 32 has been enough for me. Higher is not necessarily better in my experience since at least in this case it seems to have led to the main thread working harder when under load (with most of the work done in the "system" space). This is a system running 2.2.5 on RHEL 6.4 in VmWare. It's got 24Gb of RAM and 16 cores so it should still be pretty capable. Does anyone have an algorithm, rule of thumb or other ballpark way of estimating the "ideal" maximum number of threads? Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

6 13

RE: Freeradius - EAP-TLS cert issue?
by Tucker, Benjamin H. 24 Sep '14

24 Sep '14

Anyone seen this before? From: Tucker, Benjamin H. Sent: Tuesday, September 23, 2014 8:51 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius - EAP-TLS cert issue? Hello all, I am a new user of Freeradius and am trying to get it up and running using EAP-TLS. I have the below error when I attempt to run. Is this a cert issue or a config issue with Freeradius? Thanks C:\FreeRADIUS.net\bin>radiusd -d c:/freeradius.net/etc/raddb -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-pri v-key.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-pri v-cert.pem" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls C:\FreeRADIUS.net\bin> C:\FreeRADIUS.net\bin> Ben Tucker | Leidos Network Architect III Cell: 501-400-5272 benjamin.h.tucker(a)leidos.com<mailto:benjamin.h.tucker@leidos.com> | Leidos.com<http://www.saic.com/>| Engineering [cid:image002.jpg@01CE5D30.354DD630] Portions of SAIC to be renamed Leidos, Inc. subject to stockholder approval and consummation of a separation

2 5

move freeradius on mysql
by Lovasoa Razaka 24 Sep '14

24 Sep '14

Hello all. I need helps with my setup. Currently, i set up a freeradius server. I only use the next files: eap.conf hints clients.conf users radiusd.conf sites-available/default My solution allow a host with a signed certificate to switch in a specific VLAN (802.1X). In my the users file. I added a DEFAULT entry DEFAULT Hint == "host/" Auth-Type := "EAP", Tunnel-type = "13", Tunnel-Medium-Type = "6", Fall-Through = Yes DEFAULT Hint == "host/" Tunnel-Private-Group-ID = "100" Fall-Through = Yes #DEFAULT Hint =="host/" # Tunnel-Private-Group-ID = "200" # Fall-Through = Yes DEFAULT Hint == "host/" Auth-Type = "reject" I would like to migrate this solution on a mysql database, but i didn't understood, how i can use a default profil with Mysql. is it the best way to do ? Or mysql is not useful for my solution. thank a lot for your help

2 1

SQL xlat and multivalued attributes
by Franks Andy (RLZ) IT Systems Engineer 24 Sep '14

24 Sep '14

Hi all, It would be immensely useful for me to be able to use multivalued attributes from SQL xlats. Is this something that is possible? I'm guessing from previous posts that the advice should be "use a programming language" but it seems a shame if we need to do that for multiple row returns from SQL and not for single row returns. Foreach is there for iterating over these, and we already have multivalued attributes supported in request / reply lists... Thanks! Andy

4 6

Re: Beginner's help
by KAVYA PRABHAKAR 23 Sep '14

23 Sep '14

Hi, I have installed Freeradius on ubuntu PC(10.253.6.235). Whenever I execute radtest command from that PC, request will go on 127.0.0.1 Now instead of that I will send RADIUS request from a gateway bearing IP 10.253.6.11. For this command to work, I should be editing clients.conf as: client 10.253.6.11 { secret = testing123 shortname = 10.253.6.11 } Request reaches RADIUS server and I get reject response back. Where can I find the log details in ubuntu. Let me also know if I will have to do more changes in my configuration file. Thanks in advance, Kavya

2 1

Freeradius - EAP-TLS cert issue?
by Tucker, Benjamin H. 23 Sep '14

23 Sep '14

Hello all, I am a new user of Freeradius and am trying to get it up and running using EAP-TLS. I have the below error when I attempt to run. Is this a cert issue or a config issue with Freeradius? Thanks C:\FreeRADIUS.net\bin>radiusd -d c:/freeradius.net/etc/raddb -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-pri v-key.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-pri v-cert.pem" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls C:\FreeRADIUS.net\bin> C:\FreeRADIUS.net\bin> Ben Tucker | Leidos Network Architect III Cell: 501-400-5272 benjamin.h.tucker(a)leidos.com<mailto:benjamin.h.tucker@leidos.com> | Leidos.com<http://www.saic.com/>| Engineering [cid:image002.jpg@01CE5D30.354DD630] Portions of SAIC to be renamed Leidos, Inc. subject to stockholder approval and consummation of a separation

2 1

dynamically defining name of radacct and radpostauth table names
by Alex Sharaz 23 Sep '14

23 Sep '14

Hi, For quite some time now i've been using the sql_log module to write SQL statements into a file on each of my RADIUS servers which are processed by rad-sqlrelay. It works well but due to the number of records produced I do need to do some form of mysql table management. Rather than have 2 huge tables (radacct and radpostauth) I'd like to start using monthly tables. Would it be possible to dynamically generate a table name of the form radacct + "_" + "mth" + "yr" e.g. radacct_sep14 or radacct_1014 from within the sql_logs so that when I generate my sql statements they'll be inserted into the appropriate "month" table? Rgds Alex

3 5