- Freeradius-Users - lists.freeradius.org

Alternate server certificate
by Garber, Neal 20 Jul '09

20 Jul '09

We have Access Points that contain multiple SSIDs. Some are for internal use and some are for guest access. All are secured using WPA w/PEAP. I would like FreeRadius to present a cert. from our internal CA for the SSIDs that are internal and present a cert. from one of the CA's that Windows trusts by default for guest access. I haven't found a way to control this on the AP (i.e., to select a different RADIUS server address or port based upon SSID). Is it possible to accomplish this in FreeRadius given that I can determine the SSID by looking at a request attribute? Some ideas I have are: - Have two instances of the EAP module (one for internal SSIDs and one for guest) and select which one to use with some unlang code (based upon the value of 1 request attribute) - Create a virtual server for guest access that uses an EAP module with the cert. from the well-known CA Will either or both of the above work? Is there a better way? We plan to convert our guest access to a captive portal, but it won't be ready for a while. Thank you for your assistance.

1 0

RE: Accounting redundancy problem
by Antoine.Jean-Toussaint＠bull.net 20 Jul '09

20 Jul '09

First of all, thank you for your quick answer. I just had a look at "buffered-sql virtual server" and it seems to be a solution. Anyway, I would really prefer to find out the way to tell the freeradius to stop waiting for the database and keeping my current configuration. Indeed, I have already configured the server and did some scripts in order to handle backup of accounting information. Right now my solution's philosophy is: log to database and alternatively to sql_log file with some automatic scripts which regularly check the sql_log file and database status to insert backup sql requests within. I would like to take advantage of the previous effort if possible. Antoine -----Message d'origine----- De : freeradius-users-bounces+antoine.jean-toussaint=bull.net(a)lists.freeradius. org [mailto:freeradius-users-bounces+antoine.jean-toussaint=bull.net@lists.fre eradius.org] De la part de Ivan Kalik Envoyé : lundi 20 juillet 2009 15:49 À : FreeRadius users mailing list Objet : Re: Accounting redundancy problem > I'm running Freeradius Version 2.0.4 with sql_postgres and sql_log > modules. > > Through the redundant module I can use a postgres database (on a remote > server) as a primary destination of my accounting messages and a sql_relay > file as an alternative in case of my database failure. > > > > Almost, everything works fine, meaning that if I stop the postgres process > on my remote server, freeradius try to send accounting messages to it and > as it receive messages from the server telling that the connection is > refused, freeradius logs accounting sql request into the sql_relay file. > > > > Now here's my problem: If I shutdown the server which host the postgres > database, freeradius try to send request to it and as there's no answer > from the server Freeradius doesn't pass through the SQL request through > the sql_log module. It keeps on waiting for an answer infinitely. > > > > When I launch freeradius whith the "freeradius -X" command, I can see the > following message: Error: rlm_sql (sql_TMS): Failed to connect DB handle > #0 > > > > It's very annoying because my backup solution doesn't handle the database > server unavailability! > > > > NB: I tried to use the "connect_failure_retry_delay" directive within the > rlm_sql_postgres module but this has no effect! Have a look at buffered-sql virtual server. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Accounting redundancy problem
by Antoine.Jean-Toussaint＠bull.net 20 Jul '09

20 Jul '09

Hi, I deal with a problem that I would need some help to solve. I'm running Freeradius Version 2.0.4 with sql_postgres and sql_log modules. Through the redundant module I can use a postgres database (on a remote server) as a primary destination of my accounting messages and a sql_relay file as an alternative in case of my database failure. Almost, everything works fine, meaning that if I stop the postgres process on my remote server, freeradius try to send accounting messages to it and as it receive messages from the server telling that the connection is refused, freeradius logs accounting sql request into the sql_relay file. Now here's my problem: If I shutdown the server which host the postgres database, freeradius try to send request to it and as there's no answer from the server Freeradius doesn't pass through the SQL request through the sql_log module. It keeps on waiting for an answer infinitely. When I launch freeradius whith the "freeradius -X" command, I can see the following message: Error: rlm_sql (sql_TMS): Failed to connect DB handle #0 It's very annoying because my backup solution doesn't handle the database server unavailability! NB: I tried to use the "connect_failure_retry_delay" directive within the rlm_sql_postgres module but this has no effect! I would really appreciate any help about this problem. Antoine JEAN-TOUSSAINT Network & Security Architect

2 1

White papers: Scaling FreeRADIUS & MySQL
by Alan DeKok 20 Jul '09

20 Jul '09

We have worked with MySQL to create two white papers on MySQL scalability and MySQL cluster. They are now available: 1) Delivering Scalable & Highly Available AAA Services This white paper discusses the concepts of current data storage solutions for Authentication, Authorization and Accounting (AAA) environments and their potential limitations as network use grows and services become more dynamic. The paper then presents an alternative deployment scenario based on the FreeRADIUS Server and MySQL Cluster serving as the back-end AAA database, providing an infrastructure for high growth and availability, with low complexity. A sizing study and user case study are presented to demonstrate how the solution performs in real-world FreeRADIUS environments Read the whitepaper, posted here: http://www.mysql.com/why-mysql/white-papers/mysql_wp_ha_auth_account.php 2) Deployment Guide: FreeRADIUS with the MySQL Cluster Database This Guide documents a best-practice approach to configuring and testing a FreeRADIUS server deployed with the MySQL Cluster database storage engine serving as the back-end data store for user and accounting data. Deployment topologies and configurations are presented, enabling users to quickly and simply replicate the solution in their own environment. Read the guide, posted here: http://www.mysql.com/why-mysql/white-papers/mysql_wp_deploying_FreeRADIUS.p…

3 2

huntgroup as an unlang check?
by A.L.M.Buxey＠lboro.ac.uk 20 Jul '09

20 Jul '09

hi, i've got a few virtual hosts that do checks on the NAS-IP-Address - all works fine - but those lists of NAS are now growing so in order to maintain sanity I thought 'heck, lets use a Huntgroup' however, I recall hu8ntgroups being very much tied to users and wasnt sure of their status in unlang. if i have raddb/hntgroups alphen NAS-IP-Address == 192.168.2.5 alphen NAS-IP-Address == 192.168.2.6 alphen NAS-IP-Address == 192.168.2.7 and, in the virtual host i have if("%{HuntGroup}" == "alphen"){ sql ok = return } would this work as expected with unlang and this variable? ie would the SQL only be hit if the NAS was 192.168.2.5, 192.168.2.6 or 192.168.2.7 - which in theory it looks like? alan

2 1

rlm_eap_md5: Cleartext-Password is required for EAP-MD5authentication
by youler 20 Jul '09

20 Jul '09

My running environment is freeraius-2.1.3，The authentication type is EAP/MD5. It's running not well with individual 'user' file.I can't find the problem. My mainly configuration file as follow: IN sites-enabled/default ---------------------- authorize { eap { ok = return } files #sql expiration logintime } authenticate { eap } IN eap.conf ---------------------- eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no max_sessions = 2048 md5 { } } IN users ------------------------ chenyongle Cleartext-Password := "123456" ------------------------------------------ debug information as following: rad_recv: Access-Request packet from host 127.0.0.1 port 43289, id=134, length=260 EAP-Message = 0x0285002004108010475cd7f849537fae81777bc3287f6368656e796f6e676c65 User-Name = "chenyongle@localhost" Prompt = 0x313233343536 Service-Type = Framed-User Framed-MTU = 1400 State = 0xa554770ea5d17374eb266130b8a3c5d8 Message-Authenticator = 0xd3f3ddc1a6813a6862213b0e5bc2fc02 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "localhost" for User-Name = "chenyongle@localhost" [suffix] No such realm "localhost" ++[suffix] returns noop ++[files] returns noop [eap] EAP packet type response id 133 length 32 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chenyongle@localhost attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 43289, id=134, length=260 Waiting to send Access-Reject to client localhost port 43289 - ID: 134 Sending delayed reject for request 1 Sending Access-Reject of id 134 to 127.0.0.1 port 43289 EAP-Message = 0x04850004 Message-Authenticator = 0x00000000000000000000000000000000 -- View this message in context: http://www.nabble.com/rlm_eap_md5%3A-Cleartext-Password-is-required-for-EAP… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Accounting of Radius server for NMS applications
by Parashar Singh 20 Jul '09

20 Jul '09

I am using Free Radius in linux, and LDAP as directory server. I am able to perform Authorization, Authentication & Accounting for Cisco Swithches, Routes an APs. In that cases all accounting data are stored in /var/log/radius/radacct folder. In addition I have configure many NMS & EMS applications for radius authentication. For example CiscoWorks LMS, IPS Tipping Point etc. They are performing authentication and the logs are visible in /var/log/radius/radius.log file. But there is no accounting data for all these. Can anyone please suggest me how to reconfigure Radius or Applications so that all accounting data may be available for these applications as well. The type of log generated agaist these are given below: Sat Jul 18 12:59:06 2009 : Auth: Login OK: [admin] (from client private-network- 1 port 0) Sat Jul 18 13:12:37 2009 : Auth: Login OK: [kmcsms] (from client private-network -1 port 0)

3 2

how to add new modules(like java) to freeradius
by shivashankar 20 Jul '09

20 Jul '09

hi all, how to add new modules(like java) to freeradius2.1.6 with simple java module . plz help me out. thax for advace -- View this message in context: http://www.nabble.com/how-to-add-new-modules%28like-java%29-to-freeradius-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

A small gift for you.
by Sunkara Ravi Prakash 19 Jul '09

19 Jul '09

1 0

mysql.sql
by Eric 19 Jul '09

19 Jul '09

I want to create radius tables but mysql.sql file isn't in my system. How should I find it?

3 2