- Freeradius-Users - lists.freeradius.org

RV: certificate compatibility
by Erick Rojas Bastidas 21 Dec '11

21 Dec '11

I did certificates with xpextensions and install the CA cert in the client.. But the debug output of freeradius displays a warning of compatibility certificate.. This may be the problem?? Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Wed, 21 Dec 2011 14:24:28 To: <freeradius-users(a)lists.freeradius.org> Reply-To: erickj_rojasb(a)hotmail.com Subject: Acces-Accept, but connectivity is almost zero Hi all, thanks for your help! I have the CA certificate installed on the client, and freeradius -X responded with an 'Acces-Accept', but connectivity is almost zero, received packets are very few.. This could be due to problems of the certificate?? Enviado desde mi dispositivo movil BlackBerry® de Digitel.

2 1

Acces-Accept, but connectivity is almost zero
by Erick Rojas Bastidas 21 Dec '11

21 Dec '11

Hi all, thanks for your help! I have the CA certificate installed on the client, and freeradius -X responded with an 'Acces-Accept', but connectivity is almost zero, received packets are very few.. This could be due to problems of the certificate?? Enviado desde mi dispositivo movil BlackBerry® de Digitel.

2 1

Free Radius Nak List Issue
by Aman Arneja 21 Dec '11

21 Dec '11

Hi FreeRadius Users We seem to be facing a problem while using EAP with free radius. If the client is proposing a list of methods in the NAK message being sent in response to server method proposal, it seems free radius is just looking at the first entry rather than parsing the list. Is this a known issue? Any workarounds or patches? Thanx Aman Arneja

2 2

Simultaneous-use check but don't reject
by Alexander Kosykh 21 Dec '11

21 Dec '11

Hi I'm using Simultaneous-use := 1 and sql for check on my Freeradius server. When the radius found that customer connected already it reject customer with Reply-Message := "\r\nYou are already logged in - access denied\r\n\n". Is the way do not reject customer to be able connect customer and redirect them to Error page? Regards, Alexander.

4 12

Problems with radzap: radclient:: failed to get value
by Sean Reifschneider 21 Dec '11

21 Dec '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm trying to run a radzap and having no luck. For example, if I try: radzap -d /etc/raddb -N $NAS_IP -P 1 -u las $NAS_IP $NAS_PW radclient:: failed to get value radclient: Nothing to send. I've also tried it with the NAS name ("52a2", from /etc/raddb/naslist) rather than IP: radzap -d /etc/raddb -N $NAS_IP -P 1 -u las 52a2 $NAS_PW radclient: Failed to find IP address for host 52a2: Success If I run radwho: radwho -ZR -N 216.138.63.130 -P 1 -u las I get a reasonable-looking: User-Name = "las" Acct-Session-Id = "000001C1" Acct-Status-Type = Stop NAS-IP-Address = $NAS_IP NAS-Port = 1 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = Acct-Session-Time = 239370 However, if I pipe that through radclient: radclient -x -d /etc/raddb -f - $NAS_IP acct $NAS_PW I get the error above: radclient:: failed to get value radclient: Nothing to send. I've been trying various combinations of both the output of radwho, and commands for radclient to log a user out, based on searches on the Internet including things like sending the "packet of disconnect" (PoD), including things on this page: http://wiki.freeradius.org/Disconnect_Messages including trying sending to ports 1700 and 3799, using commands like "disconnect" and "40", using packets like: Acct-Session-Id = "000001C1" User-Name = "las" NAS-IP-Address = $NAS_IP Using the above packet looks most promising, in that I don't get an error, it just hangs a few seconds and then fails with "no response from server for ID 141 socket 3" or similar. Any pointers on this? The version of FreeRADIUS is 2.1.10 from CentOS. There are a couple of micro version updates I could do, but I didn't see any mention in the changelog of anything related to this issue being resolved. Thanks, Sean -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFO774BxUhyMYEjVX0RAu4aAJ0R/vUb8XSKO2J0lCW9UKsq0jUgVwCeJF7a 8wxcDliE2oHyfqtDzJrgA00= =II6m -----END PGP SIGNATURE-----

2 2

Upstream NAS flooding my radius
by Nathan M 20 Dec '11

20 Dec '11

I have a setup such as: NAS > Freeradius Proxy > Freeradius Auth Periodically the NAS (different company and outside of my control) gets rebooted and when it starts up it sends thousands of simultaneous requests to the radius proxy, which in turn forwards them all to the appropriate freeradius auth server. The challenge is, the auth server can get overwhelmed and starts throwing some of these errors: Error: rlm_sql (sql): There are no DB handles to use! I'm curious if there's an elegant way on the freeradius proxy to rate limit the # of connections per second being thrown at the auth server. Ideally if the threshold is reached, requests above the threshold would be dropped (and not rejected). I've searched all the docs, the mailing list, and config files and haven't turned up a solution yet. Any help or advice is appreciated. - N

4 8

Re: VLAN attribution in an eduroam setting - proxied users
by Rui Ribeiro 20 Dec '11

20 Dec '11

> > Message: 2 > Date: Tue, 20 Dec 2011 13:22:48 +0100 > From: Stefan Winter <stefan.winter(a)restena.lu> > Subject: Re: VLAN attribution in an eduroam setting - proxied users > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4EF07E18.30809(a)restena.lu> > Content-Type: text/plain; charset="iso-8859-1" > > Hello Rui, > >> As for the VLAN attribution wether the user is a roaming user (i.e. goes >> to a proxy to be authenticated), I have done several tries, without >> sucess. Haven't managed to do it through the users file above;my last >> attemp was trying to setting them up in the /etc/freeradius/attrs file >> with attr_filter.post-proxy, however it seems to interfere with the >> AEP/password negotiation. The setup is as follows, and I would like to ask >> for an alternative of where to insert the roaming VLAN. >> >> post-proxy { >> post_proxy_log >> attr_filter.post-proxy # here <--------------------------- >> Post-Proxy-Type Fail { >> detail >> } >> } > > The attr_filter module only controls what to strip out of the incoming > reply, it can not be used to add new attributes. What you specified in > the file: > >> Tunnel-Type := "VLAN", >> Tunnel-Medium-Type := "IEEE-802", >> Tunnel-Private-Group-Id := "216", > > means: "Only leave these attributes in the reply packet if they have > exactly these values, otherwise strip them out". That is obviously not > what you want. > > The solution is rather simple with unlang: > > post-proxy { > post_proxy_log > update reply { > Tunnel-Type := "VLAN" > Tunnel-Medium-Type := "IEEE-802" > Tunnel-Private-Group-Id := "216" > } > Post-Proxy-Type Fail { > detail > } > } > > (syntax is "free-handed", you should try this on a testing server first) > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > Ingenieur de Recherche > Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et > de la Recherche > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > > Tel: +352 424409 1 > Fax: +352 422473 > Stephan, The point is not being capable of changing them, and in fact I have both trying ulang and the attrs file -- and the debug information shows they are indeed changed -- the point is that changing them at that particular point seems to interfere with EAP/password negotiation, and I haven't been able to find a specific point to insert the VLAN quietly with roaming users. Best regards, Rui Ribeiro

2 1

RV: Reading winbind reply failed!
by Erick Rojas Bastidas 20 Dec '11

20 Dec '11

Help please!! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Tue, 20 Dec 2011 13:20:50 To: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> Reply-To: erickj_rojasb(a)hotmail.com Subject: Re: Reading winbind reply failed! Hi Alan, Yes, I do 'net ads join' and responds with Using short domain name -- Worgroup Joined 'machine' to realm 'domain' No DNS domain configured for freeradius. Unable to perform DNS update. DNS update failed! You know why this problem with winbind? Appreciate your help.. Thank you! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Mon, 19 Dec 2011 21:39:12 To: <erickj_rojasb(a)hotmail.com> Subject: Re: Reading winbind reply failed! Hi, > If run the command ntlm_auth responds with: > Could not obtain winbind separator! sounds to me linke winbindd isnt running - the winbindd and smbd processes must both be running...and you did 'net ads join' process as per the docs, yes? alan

2 1

RV: Reading winbind reply failed!
by Erick Rojas Bastidas 20 Dec '11

20 Dec '11

If run the command winbindd -i receive 'invalid permissions on socket directory /var/run/samba/winbindd_privileged' Winbindd_setup_listeners() failed.. Why is this? What are the correct permissions? I have: dwrx-x--- 2 freerad winbindd_priv 4096 dic 16 09:09 winbindd_privileged. Help me please!! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Tue, 20 Dec 2011 13:22:21 To: <freeradius-users(a)lists.freeradius.org> Reply-To: erickj_rojasb(a)hotmail.com Subject: RV: Reading winbind reply failed! Help please!! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Tue, 20 Dec 2011 13:20:50 To: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> Reply-To: erickj_rojasb(a)hotmail.com Subject: Re: Reading winbind reply failed! Hi Alan, Yes, I do 'net ads join' and responds with Using short domain name -- Worgroup Joined 'machine' to realm 'domain' No DNS domain configured for freeradius. Unable to perform DNS update. DNS update failed! You know why this problem with winbind? Appreciate your help.. Thank you! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Mon, 19 Dec 2011 21:39:12 To: <erickj_rojasb(a)hotmail.com> Subject: Re: Reading winbind reply failed! Hi, > If run the command ntlm_auth responds with: > Could not obtain winbind separator! sounds to me linke winbindd isnt running - the winbindd and smbd processes must both be running...and you did 'net ads join' process as per the docs, yes? alan

3 2

logging accounting
by vazoumana fofana 20 Dec '11

20 Dec '11

Hello , I enable accounting on freeradius server. I see logs are stored under repository wich contains the ip of controller. Is it possible to change this and specify an other name ? Cheers

2 1