- Freeradius-Users - lists.freeradius.org

Freeradius + Mysql + Enterasys management-access
by Yücel Türkistan 07 Feb '11

07 Feb '11

Hello, I use FreeRADIUS version 2.1.3 with backend MySQL. It's working very good except this issue: When i try to use auth by Enterasys switch for management-access, Enterasys switch fails with login but FreeRADIUS says "Auth: Login OK:..." I searched on net and found that i have to add a Filter-Id with value Enterasys:version=1:mgmt=su But i could not find how to add this Filter-Id to mysql table. Can anyone help me please to solve this problem? Thanks a lot. -- King Regards Yucel

4 5

free radius implementation for big ISP
by Mohamad A 07 Feb '11

07 Feb '11

Hello, I'm working for big ISP and we have over 150 NASes all over the country and over 200,000 Internet subscribers. currently we are using one of those proprietary Radius servers available in the market. But the problem is current software even with very up-to-date hardware can not support our increasing radius requests from all over the country although we have installed 5 separate server (as our current software does not support spiting database over multiple servers) completely independent from each other and it's is very weak point of our network. As I'm currently using FreeRadius for Login into servers and NAS via telnet and also another instance for backup (this radius server accepts every request from known clients), I decided to study the possibilities of other available radius servers those would be able to address our needs and as I think you already know ended-up to FreeRadius! So I decided to post this in the mailing list to see if any one already have such a big implementation and also ask for help in later states if we go for FreeRadius. Our need are (least) : 1. Handling about 100,000 acc requests and 10,000 auth requests hourly! 2. Accounting 3. Control and limit user traffic. 4. Control and limit user concurrent logins. 5. CoA for changing user speed over different times of day. 6. CoA to disconnect user when the account validation is over (eg. Traffic quota exceeds). 7. Calculate traffic usage differently depending on day-time (ie. our service in nights does not calculate any traffic or some times as half for users). 8. Tracking online users and disconnect user if Accounting packet is not received in prefixed amount of time (currently 10 mins). 9. Spliting database traffic over multiple servers. 10. Designing one interface to manage all users. Do you really suggest to switch to FreeRadius or stick to the current problematic solution ? (sorry for my poor English :) Regards, M

2 2

Re: radius authentication support for telnet server.
by vijay s sheelavantar 07 Feb '11

07 Feb '11

Hi Friends, I am trying to authenticate telnet users using free radius. on my system telnet is running as follows.ps -ef | grep xinetdroot 22737 1 0 10:52 ? 00:00:00 /usr/sbin/xinetd -reuseroot 22864 18178 0 10:57 pts/1 00:00:00 grep xinetd I have tried by creating "telnet", "xinetd" files in /etc/pam.d/ folder. I have included "auth sufficient pam_radius_auth.so debug" in these files. I have added this line to /etc/pam.d/other file also. I don't have /etc/pam.d/common-auth file i think "other" file is for the same. but i am not getting the request form pam_radius_auth.so client to my radius server running on different machine. when i checked the log files at client side it shows as below. Feb 7 10:53:35 (none) xinetd[22737]: START: telnet pid=22769 from=::ffff:10.1.1.101Feb 7 10:53:44 (none) login(pam_unix)[22770]: account user has password changed in futureFeb 7 10:53:44 (none) login(pam_unix)[22770]: session opened for user user by (uid=0)Feb 7 10:53:44 (none) login[22770]: ROOT LOGIN on `pts/4' from `10.1.1.101' please let me know how can i authenticate telnet users with radius server. Thanks & RegardsVijay S.

2 1

Re: Radius Client UDP port selection
by vijay s sheelavantar 07 Feb '11

07 Feb '11

Thank you very much Mr.Brian. :)

1 0

Re: Unable to authenticate in case of multilingual characters
by karnik jain 06 Feb '11

06 Feb '11

Hello Sir, But the issue is you have written the Chinese charter directly in place of user name rather than writing its equivalent UTF-8 into users file as said by you. users: "現年快樂" Auth-Type := Accept My doubt is How can I write UTF-8 encoded (may be HEX form) in users file. Because I have did the same in place of Chinese I have written the hex equivalent of ∞ infinity symbol which is also a multilingual character in place of username and sent the request containing hex equivalent of UTF-8 of ∞ infinity symbol. Kindly correct me If i am wrong. -Karnik jain On Fri, Feb 4, 2011 at 10:25 PM, James J J Hooper <jjj.hooper(a)bristol.ac.uk>wrote: > --On 04 February 2011 22:02 +0530 karnik jain <karnik.jain(a)gmail.com> > wrote: > > Hi Alan, >> >> I have written multilingual character *∞ *directly in RADIUS server's >> *users file.* >> without encoding it into UTF-8. >> * >> * >> Do I need to write Username in *user file of RADIUS server *after >> converting it >> into UTF-8 to make the *whole thing work*? >> >> If Yes then How can I write UTF-8 characters into *users file of RADIUS >> server.* >> >> Do I need to write directly the *HEX of encoded characters* or some other >> way >> into the *users file of RADIUS server as shown in attached users file of >> RADIUS server*? >> * >> * >> I have double check that the UTF-8 Encoder of mine is working fine. >> Multilingual character = ∞ (infinity symbol) is having equivalent >> form in HEX = *0xe2889e* >> and UTF-8 encoding of *0xe2889e* is = *0xf8 0xb8 0xa2 0x9e.* >> >> *Can any one please look into to above issue * >> *and guide me How can I configure the files of free RADIUS server * >> *to use USER-NAME field other than **US-ASCII like * >> *Chinese etc.?* >> * >> * >> *Regards,* >> *Karnik jain* >> > > Hi Karnik, > If you put UTF in the users file and UTF in the User-Name in the radius > request it will work. For example: > > users: > "現年快樂" Auth-Type := Accept > > ...and then testing it: > > echo 'User-Name = "現年快樂"' | radclient -x 137.222.253.91:16010 auth SECRET > Sending Access-Request of id 161 to 137.222.253.91 port 16010 > User-Name = "現年快樂" > rad_recv: Access-Accept packet from host 137.222.253.91 port 16010, id=161, > length=20 > > Regards, > James > > -- > James J J Hooper > Network Specialist > Information Services > University of Bristol > http://www.wireless.bristol.ac.uk > -- > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 5

Simultaneous-Use = 1 not working
by raisedtozero 06 Feb '11

06 Feb '11

Hello I do have a free radius. It uses system authentication (unix users) Heres my radiusd.conf excerpt <nabble_embed> unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # passwd = /etc/passwd shadow = /etc/shadow group = /etc/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # radwtmp = ${logdir}/radwtmp } </nabble_embed> and my users file is this: <nabble_embed> DEFAULT Auth-Type = System Simultaneous-Use = 1, Fall-Through = 1 </nabble_embed> Ive configured my clients files and has the proper NAS type. Problem is multiple user can login. How do i resolve that? Please help Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Simultaneous-Use-1-not-working-tp33… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

radius authentication support for telnet server.
by vijay s sheelavantar 06 Feb '11

06 Feb '11

Hello Friends,I want to authenticate telnet users using Free Radius server. I have pam_radius_auth.so and configured it for ssh which is working fine. For telnet also I have created a file "/etc/pam.d/telnet"  and trying to authenticate using freeRadius server. But it is not happening. Kindly let me know how can i authenticate telnet users using freeRadius? Thanks & Regards,Vijay S.

2 1

Re: Radius Client UDP port selection
by vijay s sheelavantar 06 Feb '11

06 Feb '11

I am talking about pam_radius_client. I want this pam_radius_auth.so client to select a particular UDP port to communicate with external radius server. so that server can send authentication responce on the same port back to client.

2 2

how to test authentication process using Access-Challenge response
by Gregor Bruhin 05 Feb '11

05 Feb '11

Hi, I'm currently playing around with freeradius to implement a two-way authentication using smsotp. Is there a way to test the whole authentication process, including access-challenge packets without using a real radius client device? Many thanks and best regards, Greg

3 3

Radius Groups / Profiles
by npayne 05 Feb '11

05 Feb '11

I have installed freeradius with daloRadius. I have then created a group / profile to cut off after using a certain amount of data. I have the following problem. It does not cut the user off when the limit was reached but it will reject the user when he/she tries to log in again. The DB only gets updated with the used octets once the users logs off. How do I get the session to be terminated when the max octets is reached? Thanks Neill -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-Groups-Profiles-tp3372247p33… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3