- Freeradius-Users - lists.freeradius.org

Cannot control attribute ordering via "rlm_perl"
by Claude Brown 30 Jan '12

30 Jan '12

Hi, First, the version I'm using: # freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, [...] I'm trying to control the attribute-ordering when using "rlm_perl". Thus far my experience is that this is not possible. My theory is that this is due to the hash-tables used as the interface between the C and Perl worlds. Here is a small example that demonstrates the problem. I've turned on the "users" and "perl" modules in the authorize section (in that order). These are the important bits from the "users" file and the "example.pl" file. (from the "users" file) steve Cleartext-Password := "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, WiMAX-Packet-Data-Flow-Id = 1, WiMAX-Service-Data-Flow-Id = 1, WiMAX-Service-Profile-Id = 2 (from the "example.pl") sub authorize { return RLM_MODULE_NOOP; } The debug log of the server is below. The interesting bits are (a) the "rlm_perl: Added pair" and (b) the attribute-order in the packet that the server sends in reply - the order is changed. The ordering is important to for me as I want those three WiMAX attributes packed inside a parent attribute "WiMAX-Packet-Flow-Descriptor". If I turn off the "perl" module (or place it before the "files" module) the packing works as expected. I put all this down to the attribute-list being rebuilt (by rlm_perl) from the %RAD_REPLY table. The hash-table has no concept of ordering, so it ends up randomised. The above is a contrived example - what I really want to do is add those three WiMAX attributes in my perl script. But due to the ordering problems I think I am wasting my time and need to come up with another solution. Can anyone see how I can control the ordering of attributes coming out of the perl script? Thanks, Claude Brown. Vividwireless. rad_recv: Access-Request packet from host 127.0.0.1 port 50265, id=2, length=63 User-Name = "steve" User-Password = "testing" Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry steve at line 76 ++[files] returns ok GOT CLONE -1588651264 0x1a0e160 rlm_perl: Added pair User-Name = steve rlm_perl: Added pair User-Password = testing rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Message-Authenticator = 0xc8b10e777a7ea53a261c855029fd0b58 rlm_perl: Added pair WiMAX-Service-Data-Flow-Id = 1 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair WiMAX-Packet-Data-Flow-Id = 1 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair WiMAX-Service-Profile-Id = 2 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Cleartext-Password = testing ++[perl] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok Login OK: [steve] (from client localhost port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 2 to 127.0.0.1 port 50265 WiMAX-Service-Data-Flow-Id = 1 Service-Type = Framed-User Framed-Routing = Broadcast-Listen WiMAX-Packet-Data-Flow-Id = 1 Framed-Protocol = PPP Framed-Filter-Id = "std.ppp" Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Compression = Van-Jacobson-TCP-IP WiMAX-Service-Profile-Id = 2 Framed-MTU = 1500 Finished request 0.

6 13

default attribute/group for res_mysql
by Oğuzhan Kayhan 29 Jan '12

29 Jan '12

Hi all, Is there any way to set a default group to all users that doesnt have any group , or any way of assigning an attribute to all users by default. As i read on previous mails DEFAULT parameter does not work for mysql users. Thanks

2 2

Re: Freeradius Mysql Performance
by Alan Buxey 29 Jan '12

29 Jan '12

What?? You dont need that kind of hardware for job, sure. Throwing that kind of horsepower might fix the speed but this is a DBA question. Look at your mysql configuration and see how it can be adjusted (my.cnf) look at the engine in use and see if you can use better..(eg innodb instead of myisam), look at an alternative SQL eg postgres. Look at your usage of sql with freeradius, eg the radius tables. What indexes are present what do you need , what do you not need? Can you divide the work? Use one server for one table or task and the other another...eg simple queries can be done against a passive slave server... alan

3 4

Unable to get freeradius server and client to communicate
by Haroon Abraham 29 Jan '12

29 Jan '12

Server is run in debug mode (radiusd -X) The following is entered in the clients.conf file: client erx.radius-src-ipaddr { secret = juniper nastype = other shorname = ERX1 } -------------------------------- Using netstat the server appears to be listenting on correct UDP port 1812 [root@freerad raddb]# netstat -a | grep radius udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* -------------------------------- Start Radius with : radiusd -X (debug mode) shows server listening on 1812 client erx.radius-src-ipaddr { require_message_authenticator = no secret = "juniper" nastype = "other" } ... adding new socket proxy address * port 38660 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Testing local to server works correctly but when I test from NAS (ERX) there is no output observed in the debug window (radiusd -X). I used tcpdump to confirm that packets are reaching the server. Any help would be greatly appreciated...

2 3

Re: Freeradius Mysql Performance
by Alan Buxey 28 Jan '12

28 Jan '12

It's do-able. Though I would be worried about failover and resiliancy. alan

1 0

Freeradius Mysql Performance
by Morteza Milani 28 Jan '12

28 Jan '12

Hi, Our company is using freeradius as a VPN authentication & authorization system. In worse-case say we would have 1 Million users. Beside scaling our market, we are going to develop an application to analyze users with data mining algorithms. Currently we use a server with the following features: * RAM: 4 GB * Processor: 1x E8400 3.0 GHz For some queries it takes 15 seconds or more to get answer from mysql specially when queries work with radacct table. Any suggestion to improve performance? Regards, Morteza Milani

5 4

Autentication Problem with Freeradius on FREEBSD
by Rodrigo Yoshioka 28 Jan '12

28 Jan '12

Hi, I´m having some problems with a new radius server. I have an CentoOS with freeradius already working. But it was getting slow and let clients delay to connect. So I installed a new freeradius server on Freebsd, and I compare both configurations files. But when PPPoE server try to autenticate a client, radius.log says that its OK. but PPPoE server says RADIUS TIMEOUT. Do anyone knows where in the configuration should be that problem??? Thanks

3 2

Re: Unable to get freeradius server and client to communicate
by Alan Buxey 28 Jan '12

28 Jan '12

No packets seen coming in on the server when in debug mode? Check your server for a host based firewall, check with your network guys for eg inter VLAN ACLs, or other protection on the network alan

1 0

different NAS_ip_address
by sekchel lee 27 Jan '12

27 Jan '12

freeradius 2.1.9 mysql select nasipaddress from radacct; NAS_1 ==> 111.111.111.1 NAS 2 ==> 222.222.222.2 I want unification NAS_1 ==> 127.0.0.1 NAS_2 ==> 127.0.0.1 Thank you Everybody

2 1

Authorization with Active Directory
by suggestme 27 Jan '12

27 Jan '12

Hi, I have configured freeradius server to authenticate & authorize user with the supplied username and password against active directory. Till this stage; The user can be authenticated and authorized successfully with credentials provided. For this purpose; user is just authenticated and authorized depending upon the filter of LDAP module which I have set. My LDAP module filter configuration is as: filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" But Now, I want to go deep on authenticating and authorizing user to allow or reject VPN or Wifi access, etc. For this purpose I have created extension attribute in Active directory and has assigned the value as "VPN" , "Wifi", etc..... Now my question is: How can I set the filter in Ldap module of FreeRadius to just allow the user belonging to VPN or wifi ? Should I need to add the extension attribute filter to the above mentioned filter? OR should I need to define 2 filters: the above one and another for extension attribute? I tried defining 2 filters separately; it didn't work. I know some people use the concept of "Group" for this purpose. In my case, I can't use Group. I just have to authenticate and authorize user just using Active Directory attribute. I don't know whether this is way to do or not. Any idea would be really helpful. This forum has really helped a lot to the beginner like me to reach till this stage. Thanks everyone............ -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authorization-with-Active-Directory… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 9