- Freeradius-Users - lists.freeradius.org

self-signed root CA
by McNutt, Justin M. 30 Jan '12

30 Jan '12

So I'm getting some pushback in my organization against using a self-signed CA for signing my RADIUS server certs. To make a long story short, I was asked to find out what other people were doing. For my own reasons, I'd like to know slightly more than that. If you AREN'T using a self-signed CA for your RADIUS server, what made you use another CA, and what CA did you use? And just to be clear, is the concensus still that a self-signed CA is the way to go, assuming that you have a decent way to distribute the CA cert (which we do) to the clients who need to trust it? I've read /etc/raddb/certs/README and I've done some Googling and everything I find pretty much assumes that you're using a self-signed CA. The README explains briefly why, but my management wants more assurance than that, so here I am. Looking forward to your responses, and thanks in advance. --J

7 11

Access-Accept if user exists in database
by Mika 30 Jan '12

30 Jan '12

Hello. Running 2.1.10 with virtual-servers configured with many port configurations, sql modules loaded and working. The idea for this new port is: Users authenticating with smartcards that get checked outside the FreeRadius and we want to permit/deny access if the user-name does or does not exist in a SQL database. This means no User-Password checking. We have the NAS configured so it will send user-name and an empty or a bogus password in the Access-Request for each User-Name I would like to add a port configuration that checks the above. My unlang skill are limited so i am hoping for some good pointers here. Something like: authorize { update request { TmpString := "%{sql:select User FROM table where.... }" if User-Name == %{TmpString} send Access-Accept else send Access-Reject There are probably easier ways of doing this? Is this possible or is the User-Password required for every authentication? Any help appreciated. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/Access-Accept-if-user-exists-in-dat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Cannot control attribute ordering via "rlm_perl"
by Claude Brown 30 Jan '12

30 Jan '12

Hi, First, the version I'm using: # freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, [...] I'm trying to control the attribute-ordering when using "rlm_perl". Thus far my experience is that this is not possible. My theory is that this is due to the hash-tables used as the interface between the C and Perl worlds. Here is a small example that demonstrates the problem. I've turned on the "users" and "perl" modules in the authorize section (in that order). These are the important bits from the "users" file and the "example.pl" file. (from the "users" file) steve Cleartext-Password := "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, WiMAX-Packet-Data-Flow-Id = 1, WiMAX-Service-Data-Flow-Id = 1, WiMAX-Service-Profile-Id = 2 (from the "example.pl") sub authorize { return RLM_MODULE_NOOP; } The debug log of the server is below. The interesting bits are (a) the "rlm_perl: Added pair" and (b) the attribute-order in the packet that the server sends in reply - the order is changed. The ordering is important to for me as I want those three WiMAX attributes packed inside a parent attribute "WiMAX-Packet-Flow-Descriptor". If I turn off the "perl" module (or place it before the "files" module) the packing works as expected. I put all this down to the attribute-list being rebuilt (by rlm_perl) from the %RAD_REPLY table. The hash-table has no concept of ordering, so it ends up randomised. The above is a contrived example - what I really want to do is add those three WiMAX attributes in my perl script. But due to the ordering problems I think I am wasting my time and need to come up with another solution. Can anyone see how I can control the ordering of attributes coming out of the perl script? Thanks, Claude Brown. Vividwireless. rad_recv: Access-Request packet from host 127.0.0.1 port 50265, id=2, length=63 User-Name = "steve" User-Password = "testing" Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry steve at line 76 ++[files] returns ok GOT CLONE -1588651264 0x1a0e160 rlm_perl: Added pair User-Name = steve rlm_perl: Added pair User-Password = testing rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 rlm_perl: Added pair WiMAX-Service-Data-Flow-Id = 1 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair WiMAX-Packet-Data-Flow-Id = 1 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair WiMAX-Service-Profile-Id = 2 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Cleartext-Password = testing ++[perl] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok Login OK: [steve] (from client localhost port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 2 to 127.0.0.1 port 50265 WiMAX-Service-Data-Flow-Id = 1 Service-Type = Framed-User Framed-Routing = Broadcast-Listen WiMAX-Packet-Data-Flow-Id = 1 Framed-Protocol = PPP Framed-Filter-Id = "std.ppp" Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Compression = Van-Jacobson-TCP-IP WiMAX-Service-Profile-Id = 2 Framed-MTU = 1500 Finished request 0.

6 13

default attribute/group for res_mysql
by Oğuzhan Kayhan 29 Jan '12

29 Jan '12

Hi all, Is there any way to set a default group to all users that doesnt have any group , or any way of assigning an attribute to all users by default. As i read on previous mails DEFAULT parameter does not work for mysql users. Thanks

2 2

Re: Freeradius Mysql Performance
by Alan Buxey 29 Jan '12

29 Jan '12

What?? You dont need that kind of hardware for job, sure. Throwing that kind of horsepower might fix the speed but this is a DBA question. Look at your mysql configuration and see how it can be adjusted (my.cnf) look at the engine in use and see if you can use better..(eg innodb instead of myisam), look at an alternative SQL eg postgres. Look at your usage of sql with freeradius, eg the radius tables. What indexes are present what do you need , what do you not need? Can you divide the work? Use one server for one table or task and the other another...eg simple queries can be done against a passive slave server... alan

3 4

Unable to get freeradius server and client to communicate
by Haroon Abraham 29 Jan '12

29 Jan '12

Server is run in debug mode (radiusd -X) The following is entered in the clients.conf file: client erx.radius-src-ipaddr { secret = juniper nastype = other shorname = ERX1 } -------------------------------- Using netstat the server appears to be listenting on correct UDP port 1812 [root@freerad raddb]# netstat -a | grep radius udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* -------------------------------- Start Radius with : radiusd -X (debug mode) shows server listening on 1812 client erx.radius-src-ipaddr { require_message_authenticator = no secret = "juniper" nastype = "other" } ... adding new socket proxy address * port 38660 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Testing local to server works correctly but when I test from NAS (ERX) there is no output observed in the debug window (radiusd -X). I used tcpdump to confirm that packets are reaching the server. Any help would be greatly appreciated...

2 3

Re: Freeradius Mysql Performance
by Alan Buxey 28 Jan '12

28 Jan '12

It's do-able. Though I would be worried about failover and resiliancy. alan

1 0

Freeradius Mysql Performance
by Morteza Milani 28 Jan '12

28 Jan '12

Hi, Our company is using freeradius as a VPN authentication & authorization system. In worse-case say we would have 1 Million users. Beside scaling our market, we are going to develop an application to analyze users with data mining algorithms. Currently we use a server with the following features: * RAM: 4 GB * Processor: 1x E8400 3.0 GHz For some queries it takes 15 seconds or more to get answer from mysql specially when queries work with radacct table. Any suggestion to improve performance? Regards, Morteza Milani

5 4

Autentication Problem with Freeradius on FREEBSD
by Rodrigo Yoshioka 28 Jan '12

28 Jan '12

Hi, I´m having some problems with a new radius server. I have an CentoOS with freeradius already working. But it was getting slow and let clients delay to connect. So I installed a new freeradius server on Freebsd, and I compare both configurations files. But when PPPoE server try to autenticate a client, radius.log says that its OK. but PPPoE server says RADIUS TIMEOUT. Do anyone knows where in the configuration should be that problem??? Thanks

3 2

Re: Unable to get freeradius server and client to communicate
by Alan Buxey 28 Jan '12

28 Jan '12

No packets seen coming in on the server when in debug mode? Check your server for a host based firewall, check with your network guys for eg inter VLAN ACLs, or other protection on the network alan

1 0