- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 73, Issue 8
by Daniel Davidson 11 May '11

11 May '11

I finally got this figured out. It did not have anything do do with freeradius, but since others using the program might run into it, I figured I should post it here. The arp cache of the server was limited by default to 128 addresses, which was running out pretty quickly. So I inserted and applied the values below in sysctl.conf and everything works great now. net.ipv4.neigh.default.gc_thresh3 = 4096 net.ipv4.neigh.default.gc_thresh2 = 2048 net.ipv4.neigh.default.gc_thresh1 = 1024 Dan On 05/04/2011 01:51 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Message: 3 > Date: Tue, 3 May 2011 20:56:12 +0100 > From: Alexander Clouter<alex(a)digriz.org.uk> > Subject: Re: ldap server connection timeout > To:freeradius-users@lists.freeradius.org > Message-ID:<s73698-k73.ln1(a)chipmunk.wormnet.eu> > > Daniel Davidson<danield(a)igb.uiuc.edu> wrote: >> > >> > My new wireless network tested great, but now that I have rolled it out >> > to the entire building, I get error messages like: >> > >> > Mon May 2 15:15:06 2011 : Error: rlm_ldap: ldap_search() failed: Timed >> > out while waiting for server to respond. Please increase the timeout. >> > >> > And when these trigger, nearly everyone gets disconnected for about 5 >> > seconds. Possible relevant code from ldap module: >> > >> > ldap { >> > #private stuff<-- BUT CRUCIAL! >> > ldap_connections_number = 15 >> > timeout = 10 >> > timelimit = 10 >> > net_timeout = 5 >> > } >> > >> > The only existing firewalls are on the machines themselves and the ip >> > range of the servers are open with each other. Any ideas? >> > > I am guessing your LDAP server is*way* too slow when processing the > queries are making it munch through. Typical 'first-timer' mistakes are > that you are not indexing the important attribtues. For example our > filter looks like: > > filter = "(&(objectClass=Person)(|(businessCategory=staff)(businessCategory=student)(cn=avg*))(|(!(loginDisabled=*))(loginDisabled=FALSE))(cn=%{Stripped-User-Name}))" > > This takes ~0.02s to respond for us, how long does it take to process > the query at your end (test with the following and remember to test > the server when it is under load, which is probably why it worked > before you widely deployed it): > ---- > time ldapsearch -h ldap-server.example.com -x -LLL '<query>' > ---- > > Where<query> is what you see FreeRADIUS make in the output of 'radiusd > -X'. > > Cheers >

1 0

Multiple FR Server and NAS
by googerdi 11 May '11

11 May '11

Hi How can i configure FR if i have multiple FR Server and NAS. How can i tell for example a specific user is for specific NAS. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Multiple-FR-Server-and-NAS-tp438457… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Problem to start the daemon
by Meyer Jerome 11 May '11

11 May '11

Hello, I've installed the latest freeradius version (freeradius-server-2.1.10) from source! SO, I configured it and tested it with the command [radiusd -X] and it is ok! Now, I would to start the daemon in a normal way (/etc/rc.d). I copy the rc.radiusd into /etc/rc.d but nothing is started. Try to start like : /usr/sbin/radiusd nothing is started... Have someone an Idea? Regards, Jérôme

3 2

Free Radius 2.1.8 + Mikrotik
by Ahmed Syed 10 May '11

10 May '11

Can someone give me a hint how to solve following: We are using PPPoE server with FreeRadius autentification and we are using Simultaneous Use Checking. We are limiting number of simultaneous connections to 1. The problem is in nonstandard situation when PPPoE server is nonstandardly restarted and there will stay open sessions on the radius. New connections are unauthorized because of simultaneous checking. We must manually delete open sessions. All users are Reject/authetication failed that time...

3 2

De-autentication
by Rodrigo Yoshioka 10 May '11

10 May '11

Hi, I have just experienced some weird problem. I'm used to watch the mikrotik log of my pppoe.. and at some point more than 100 clients disconnected from it.. i was looking at the radius log, and I realize this information. Tue May 10 11:50:49 2011 : Error: Discarding duplicate request from client XXX.XXX.XXX.XXX/24:49942 - ID: 217 due to unfinished request 627656 Tue May 10 11:50:49 2011 : Error: Dropping conflicting packet from client XXX.XXX.XXX.XXX/24:54930 - ID: 202 due to unfinished request 627641 It repeated a dozens of times... do you know what could be happend. Thanks Rodrigo Yoshioka Suporte Tecnico Rede Telecom

3 2

Re: Restrict user only to a NAS
by Marcos TP 10 May '11

10 May '11

I forgot to mention that I use MySQL to manage my users and NAS. In the table that records the users exists a field 'radnas_id' where I can tell the NAS that he is entitled to connect, but can not enable this restriction

4 4

about access denied and Reject
by Tanjil Ahmed 10 May '11

10 May '11

Dear All im using version ffreeradius-server-2.1.8.. and also radius manager is installed here.. when my Mikrotik PPPOE users got Disconnect and trying to relogin they cant.. Access Denied,you are already logged in and Reject authentication failed msg like that which i got from My Radius Server.. at once too many connection Cannot login here .. how do i Resolve it thanks

1 1

Custom Accounting Fields
by Tim Donahue 10 May '11

10 May '11

Hi all, We are using Freeradius for accounting from our voip system. Is there documentation somewhere, that you can point me to, on how I can add a couple of custom vendor fields to the radacct database schema and the INSERT query? I have no problem reading the documentation, but I can't seem to find which documentation I need to review, especially to find what the default SQL query is, so I can make sure that the data stays consistent. Tim

2 1

PAP password check
by mic night 10 May '11

10 May '11

Hello, I have a freeradius server that i use to authenticate users before they access network switches. user passwords reside in an ldap directory with the following attributes and formats: userPassword: (CRYPT password) sambaNTPassword: (NT Hash) sambaLMPassword: (LM hash) PAP is choosing automaticaly the NT encryption to validate the password. Is there a way to force PAP to use the userPassword with the CRYPT encryption? PS: i have to keep sambaNTPassword and sambaLMPassword along with userPassword as check items for other use scenarii. i'll post the relevant part of my radius log file in case it helps, thank you. [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$$xkbzS/dF4YU/JKyjA5.36." [ldap] sambaNtPassword -> NT-Password == 0x4539463933393235373938463136464345394639333932353739384631364642 [ldap] sambaLmPassword -> LM-Password == 0x4243333041323738464338383546424538393735438383546424538393735456 [ldap] userPassword -> User-Password == "{CRYPT}$1$$xkbzS/dF4YU/JKyjA5.36." [ldap] looking for reply items in directory... [ldap] user theUser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "thepassword" [pap] Using NT encryption. [pap] expand: %{User-Password} -> thepassword [pap] NT-Hash of thepassword = e9f93925798f16fc4c9f93925798f1 [pap] expand: %{mschap:NT-Hash %{User-Password}} -> e9f93925798f16fc4c9f93925798f1 [pap] User authenticated successfully

2 3

Error: User-Name is not the same as MS-CHAP name
by Robert Mc Cready 10 May '11

10 May '11

The "MS-CHAP-Use-NTLM-Auth := no" did the job but I still have one problem with Windows XP clients, I get a " [mschap] ERROR: User-Name (CAD08862\ldapuser) is not the same as MS-CHAP Name (ldapuser) from EAP-MSCHAPv2". Users log on locally, the host name is not a domain name. Windows 7 clients work fine because they send only the username. I do some rewrites so I can get the username for the LDAP authentication and the computers name for computer account authentication (I'm not familiar with unlang yet). We use FR 2.1.10. Any idea how to fix this ? Windows XP debug: http://www.cspi.qc.ca/sinfrmc/windowsxp.htm Windows 7 debug: http://www.cspi.qc.ca/sinfrmc/windows7.htm On 05/05/11 15:17, Robert Mc Cready wrote: > We use Novell eDirectory and DSFW (Directory Services for Windows) > which is kind of a Windows domain inside an OU in eDirectory. I want > to authenticate users using LDAP and Windows computers account using > ntlm_auth. There is only computers accounts in the Windows domain. > > The computer authentication is working fine but the users > authentication with LDAP fails if ntlm_auth is configured. If I don't > use ntlm_auth the users authentication works. Is there a way to have > both of them working together? Yes. Something like this: authorize { ... if (User-Name !~ /^host\//) { update control { MS-CHAP-Use-NTLM-Auth := no } } ... } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html We use Novell eDirectory and DSFW (Directory Services for Windows) which is kind of a Windows domain inside an OU in eDirectory. I want to authenticate users using LDAP and Windows computers account using ntlm_auth. There is only computers accounts in the Windows domain. The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together? We use PEAP. Working user authentication with LDAP debug (ntlm_auth not configured): http://www.cspi.qc.ca/sinfrmc/ldap_only.htm Working Windows computer account authentication: http://www.cspi.qc.ca/sinfrmc/mschap_only.htm User account getting rejected debug (with ntlm_auth configured): http://www.cspi.qc.ca/sinfrmc/mschap_and_ldap.htm Thanks, Robert.

4 10