- Freeradius-Users - lists.freeradius.org

Re: FreeRadius Losing packets in Multi-Threads mode
by Pierre Rondou 26 Oct '11

26 Oct '11

Hello, On Tue, 25 Oct 2011 21:09:31 +0100, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > > however, as Alan said. in single thread mode, you only have one process > dealing with > requests.....so one single open connection to SQL, one single sesion to > LDAP etc etc > (whatever you use) - eg even a local file with PERL. > > with multithread mode, you have many threads - all of which can be hitting > your SQL or LDAP > at same time...or trying to write to the same file in a PERL module....so > you have to look > at the speed/ability of your backend....the jump from a single query ata > time to concurrent > queries may have tipped your balance > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html Here is what I had thought about: FreeRadius correctly treats the requests (answer are always received), but there is a locking problem with the log files, meaning that basically, only one thread can write inside. Is there any solution about that? As stated before, there is no overloading problem on the server. Running in single thread could be a solution, but it's really slow compared to multi-thread ... Regards, Pierre

3 3

Re: Freeradius rlm_sql: Failed to create the pair: Invalid TLV specification (WiMAX MS)
by James T. Mugauri 26 Oct '11

26 Oct '11

Apologies for my incorrectly headed last response: On 10/26/2011 12:11 AM, freeradius-users-request(a)lists.freeradius.org wrote: > You just add the attributes, and the server will take care of > encapsulating them in TLVs. Is there any thing i must pay attention to with regard to either (or both of): 1. The order in which i define the attributes, especially when i am defining 2 QoS-Descriptors (for downlink and uplink e.g.) and 2 or more Packet-Flow-Descriptors (for controlling different types of traffic) 2. The operator I should use. When should I use '+=', or is ':=' alright in every instance? Regards, JamesTM

1 0

Re: Freeradius-Users Digest, Vol 78, Issue 111
by James T. Mugauri 26 Oct '11

26 Oct '11

On 10/26/2011 12:11 AM, freeradius-users-request(a)lists.freeradius.org wrote: > You just add the attributes, and the server will take care of > encapsulating them in TLVs. Is there any thing i must pay attention to with regard to either (or both of): 1. The order in which i define the attributes, especially when i am defining 2 QoS-Descriptors (for downlink and uplink e.g.) and 2 or more Packet-Flow-Descriptors (for controlling different types of traffic) 2. The operator I should use. When should I use '+=', or is ':=' alright in every instance? Regards, JamesTM

2 1

Fwd: Need help on "ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user"
by Stephen Kwok 25 Oct '11

25 Oct '11

Hi, I am a newbie to FreeRADIUS and I have run into a problem during the setup. I have spent some time on researching for an answer online, but I got no luck. I have described the problem as below. Could anyone please let me know what went wrong? Thank you so much in advance. Stephen OS: Mac OSX 10.6.8 FreeRADIUS version: 2.1.12 Steps taken: 1. Downloaded freeradius from http://freeradius.org/download.html 2. Decompressed it 3. Copied the decompressed folder to /sw/freeradius-server-2.1.12 4. Added "testing Cleartext-Password := "password"" to the top of /sw/freeradius-server-2.1.12/raddb/users and saved the file 5. Opened a terminal console 6. Executed sudo - root 7. Cd to /sw/freeradius-server-2.1.12 8. Followed Building on MAC OSX on http://wiki.freeradius.org/Build: ./configure --enable-developer make sudo make install 9. Cd to /sw/freeradius-server-2.1.12/src/main 10. Executed radiusd -X 11. Open another terminal console 12. Executed sudo - root 13. Cd to /sw/freeradius-server-2.1.12/src/main 14. Executed radtest testing password 127.0.0.1 0 testing123 *Client Output* machine:~ root# radtest testing password 127.0.0.1 0 testing123 Sending Access-Request of id 209 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 172.16.142.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=209, length=20 FreeRADIUS Debugging Output This colorized output was produced by an automated tool<http://networkradius.com/freeradius.html> from Network RADIUS <http://networkradius.com/> ------------------------------ FreeRADIUS Version 2.1.12, for host i386-apple-darwin10.8.0, built on Oct 25 2011 at 14:21:07 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes use_open_directory = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 63625 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. *Packet 0* ------------------------------ rad_recv: Access-Request packet from host 127.0.0.1 port 64417, id=253, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 172.16.142.1 NAS-Port = 0 Message-Authenticator = 0xac50d12cd56157895ad148d9eae1fab3 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 253 to 127.0.0.1 port 64417 Waking up in 4.9 seconds. Cleaning up request 0 ID 253 with timestamp +52 Ready to process requests.

3 2

Free Radius 2.1.10 ubuntu 10.10 Multiple RootCA
by Kris Armstrong 25 Oct '11

25 Oct '11

I am trying to configure free radius with multiple ROOT CA's. This is not a products environment it is purely a test environment. We need the ability to test out products against freeradius and other radius servers. using multiple different certificate sizes and ROOT CA's. I currently have the following in my EAP.conf file. Based on the way I read the eap.conf file this would be the correct way of doing it. Here is what happens. I can authenticate against the first ROOT CA no matter which one it is as long as its the first in the list. its like all other CA's are ignored. In the below as you can see I have commented out the first few ROOT CAs and the 1024ca.pem is the current first in the list. I am able to authenticate against this one but none past. if I comment out 1024 then I can authenticate against the next. Any help would be greatly appreciated. I had read on another forum that in order to support multiple ROOT CAs you just put them all in the same file. I tried this as well with just the certs as well as with the certs and the private keys neither seemed to work. I believe that was on a Radius 1.x server though so maybe Freeradius 2.1.10 Ubuntu 10.04 Thanks, #certdir = ${confdir}/certs #cadir = ${confdir}/certs #certdir = /etc/freeradius/certs20080204 #cadir = /etc/freeradius/certs20080204 certdir = /etc/freeradius/Certs11-20-2011/client/pem cadir = /etc/freeradius/Certs11-20-2011/CA/pem #private_key_password = whatever #private_key_file = ${certdir}/server.pem private_key_password = passphrase #private_key_file = ${certdir}/1010Client.pem private_key_file = ${certdir}/1024_1024client.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. #certificate_file = ${certdir}/server.pem #certificate_file = ${certdir}/1010Client.pem certificate_file = ${certdir}/1024_1024client.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. #CA_file = ${cadir}/ca.pem #CA_file = ${cadir}/PV_10_CA.pem #CA_file = ${cadir}/CA/pem/1024ca.pem #CA_file = ${cadir}/512ca.pem #CA_file = ${cadir}/768ca.pem CA_file = ${cadir}/1024ca.pem CA_file = ${cadir}/1280ca.pem CA_file = ${cadir}/1536ca.pem CA_file = ${cadir}/1792ca.pem CA_file = ${cadir}/2048ca.pem CA_file = ${cadir}/4096ca.pem Thanks, Kris Armstrong CCNP, CCDP, MCSE, Security+, A+ Cell Ph:719.440.30.79 Google Voice: 719.357.5821 Fax Ph: 866.390.8416 E-Mail: kris.armstrong(a)me.com Skype: kris.armstrong(a)gmail.com FaceTime: kris.armstrong(a)me.com

2 1

FreeRadius Losing packets in Multi-Threads mode
by Pierre Rondou 25 Oct '11

25 Oct '11

Hello everybody, I'm currently running freeradius on a debian (squeeze) server # uname -a Linux test 2.6.32-5-amd64 #1 SMP Mon Oct 3 03:59:20 UTC 2011 x86_64 GNU/Linux # freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 The problem is that the server seems to lose accounting packets in Multithread mode Logging with module "detail" or "linelog" logs only a very little amount (0.5%) of the transmitted packets. The client receive all the answer, but my problem is that I rely on those logs for an other program. Example: # echo "Message-Authenticator = 0x00" | radclient 127.0.0.1 acct testing123 -c 2500000 > temp && wc -l temp && wc -l /var/log/freeradius/radacct/127.0.0.1/detail-20111025 2500000 temp 84224 /var/log/freeradius/radacct/127.0.0.1/detail-20111025 This only happen when using FreeRadius in Multithread mode, while using it in single-thread (freeradius -s), all the packets are logged correctly. Anyone has a hint on this problem? Regards, Pierre Rondou

5 8

Freeradius rlm_sql: Failed to create the pair: Invalid TLV specification (WiMAX MS)
by James T. Mugauri 25 Oct '11

25 Oct '11

Hi, I am running 2.1.12 in an attempt to auth Wimax users. However I am having difficulty defining TLVs for WiMAX-QoS-Descriptor and associated WiMAX-Packet-Flow-Descriptor I used a post on the matter in the freeradius mailing list which suggested something to the effect of: INSERT INTO radgroupreply (groupname, attribute, op, value) VALUES ('WiMAX_Test3', 'WiMAX-QoS-Id', ':=', '101'), ('WiMAX_Test3', 'WiMAX-Service-Class-Name', ':=', 'DATA'), ('WiMAX_Test3', 'WiMAX-Schedule-Type', ':=', 'Best-Effort'), ('WiMAX_Test3', 'WiMAX-Traffic-Priority', ':=', '1'), ('WiMAX_Test3', 'WiMAX-Maximum-Sustained-Traffic-Rate', ':=','512000'), ('WiMAX_Test3', 'WiMAX-Reduced-Resources-Code', ':=', '1'), ('WiMAX_Test3', 'WiMAX-Packet-Data-Flow-Id', ':=', '21'), ('WiMAX_Test3', 'WiMAX-Service-Data-Flow-Id', ':=', '21'), ('WiMAX_Test3', 'WiMAX-Direction', ':=', '1'), ('WiMAX_Test3', 'WiMAX-Activation-Trigger', ':=', '15'), ('WiMAX_Test3', 'WiMAX-Transport-Type', ':=', 'IPv4-CS'), ('WiMAX_Test3', 'WiMAX-Uplink-QOS-Id', ':=', '101'), ('WiMAX_Test3', 'WiMAX-Uplink-Classifier', ':=', 'permit in any src any dst any priority 1'), ...etc This did not work, as the greenpacket SM keeps on trying to connect as if it is not authenticated, despite the following attributes being returned in the Access-Accept packet: Sending Access-Accept of id 84 to 10.11.12.13 port 1812 Framed-IP-Address := XXX.XX.12.12 Framed-IP-Netmask := 255.255.255.224 WiMAX-DNS-Server := XXX.XX.12.65 Framed-Route := "XXX.XX.12.30" WiMAX-QoS-Id := 101 WiMAX-Service-Class-Name := "DATA" WiMAX-Schedule-Type := Best-Effort WiMAX-Traffic-Priority := 1 WiMAX-Maximum-Sustained-Traffic-Rate := 512000 WiMAX-Reduced-Resources-Code := 1 WiMAX-Packet-Data-Flow-Id := 22 WiMAX-Service-Data-Flow-Id := 22 WiMAX-Direction := Downlink WiMAX-Activation-Trigger := 15 WiMAX-Transport-Type := IPv4-CS WiMAX-Uplink-QOS-Id := 101 WiMAX-Uplink-Classifier := "permit in any src any dst any priority 1" WiMAX-QoS-Id += 102 WiMAX-Service-Class-Name += "DATA" WiMAX-Schedule-Type += Best-Effort WiMAX-Traffic-Priority += 1 WiMAX-Maximum-Sustained-Traffic-Rate += 400000 WiMAX-Reduced-Resources-Code += 1 WiMAX-Downlink-QOS-Id := 102 WiMAX-Downlink-Classifier := "permit in any src any dst any priority 1" MS-MPPE-Recv-Key = 0xdd5af25dadbfeba854cc0c6a5694abe0636104f1551530a9537855ecb6629d7e MS-MPPE-Send-Key = 0x93064994b3908d600cdab33f17742a4de175db703101a8cd5019b0384a885d98 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}00E6D4F0ED7C281D867BE1534026CDA8IC3513" Finished request 4. I thought i would add an attribute pair to be explicit that I am defining TLVs, by inserting the following rows in the database (at the appropriate rows by id): ('WiMAX_Test3', 'WiMAX-QoS-Descriptor', '=', '...'), ('WiMAX_Test3', 'WiMAX-Packet-Flow-Descriptor', '=', '...'), ...etc but i then get the error specified in the subject above. Can anyone shed light on how to correctly populate radgroupreply to ensure proper definition of WiMAX TLVs? Or perhaps I am doing something else wrong? Hopefully, JamesTM -- Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley

2 1

Free Radius 2.1.10 ubuntu 10.10 Multiple RootCA
by Kris Armstrong 25 Oct '11

25 Oct '11

I am trying to configure free radius with multiple ROOT CA's. This is not a products environment it is purely a test environment. We need the ability to test out products against freeradius and other radius servers. using multiple different certificate sizes and ROOT CA's. I currently have the following in my EAP.conf file. Based on the way I read the eap.conf file this would be the correct way of doing it. Here is what happens. I can authenticate against the first ROOT CA no matter which one it is as long as its the first in the list. its like all other CA's are ignored. In the below as you can see I have commented out the first few ROOT CAs and the 1024ca.pem is the current first in the list. I am able to authenticate against this one but none past. if I comment out 1024 then I can authenticate against the next. Any help would be greatly appreciated. I had read on another forum that in order to support multiple ROOT CAs you just put them all in the same file. I tried this as well with just the certs as well as with the certs and the private keys neither seemed to work. I believe that was on a Radius 1.x server though so maybe there is a change in the 2.x? Any thoughts or ideas that I might be missing would be greatly appreciated thanks in advance. Freeradius 2.1.10 Ubuntu 10.04 Thanks, #certdir = ${confdir}/certs #cadir = ${confdir}/certs #certdir = /etc/freeradius/certs20080204 #cadir = /etc/freeradius/certs20080204 certdir = /etc/freeradius/Certs11-20-2011/client/pem cadir = /etc/freeradius/Certs11-20-2011/CA/pem #private_key_password = whatever #private_key_file = ${certdir}/server.pem private_key_password = passphrase #private_key_file = ${certdir}/1010Client.pem private_key_file = ${certdir}/1024_1024client.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. #certificate_file = ${certdir}/server.pem #certificate_file = ${certdir}/1010Client.pem certificate_file = ${certdir}/1024_1024client.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. #CA_file = ${cadir}/ca.pem #CA_file = ${cadir}/PV_10_CA.pem #CA_file = ${cadir}/CA/pem/1024ca.pem #CA_file = ${cadir}/512ca.pem #CA_file = ${cadir}/768ca.pem CA_file = ${cadir}/1024ca.pem CA_file = ${cadir}/1280ca.pem CA_file = ${cadir}/1536ca.pem CA_file = ${cadir}/1792ca.pem CA_file = ${cadir}/2048ca.pem CA_file = ${cadir}/4096ca.pem Thanks, Kris Armstrong

2 1

update RAD_REPLY with += in rlm_perl
by Energ 25 Oct '11

25 Oct '11

hi all! how do i update RAD_REPLY correctly with perl if i want to add addtiotional Cisco-AVPair in reply? lets say user profile has Cisco-AVPair="something1". I can have multiple of those by adding to user profile another pair like this Cisco-AVPair+="something1". But how to do the same while processing with rlm_perl? How to hablde hash update in this situation? thx! -- View this message in context: http://freeradius.1045715.n5.nabble.com/update-RAD-REPLY-with-in-rlm-perl-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Stop Logging in radpostauth table
by Det Det 25 Oct '11

25 Oct '11

Hi, How do I stop logging in radpostauth table? Is commenting out the query that inserts to radpostauth a correct way of doing that? thanks! det

2 2