- Freeradius-Users - lists.freeradius.org

Re: Assigning IP address from RADIUS to Cisco PPTP users
by Neville 26 May '09

26 May '09

> Message: 1 > Date: Tue, 26 May 2009 18:56:42 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: Assigning IP address from RADIUS to Cisco PPTP users > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <52973.87.194.16.13.1243360602.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > >> I've used Livingston and Cistron radiusd's in the past with dialup ppp >> users and Cisco/Lucent NASes and have been able to do this with no >> problems. >> >> Users are currently authenticating fine and getting assigned IPs from the >> IP pool as defined in the Cisco NAS. However, I'd like to have a few, >> select users assigned static IPs from outside that pool, but the Cisco >> (2811) is simply ignoring the raddb/users file entry for that user and >> assigning an IP from the pool on the NAS. >> >> Here is my Cisco config:: >> -------------------- >> aaa new-model >> aaa authentication login default local group radius >> aaa authentication ppp default group radius local >> aaa authorization exec default local >> aaa authorization network default if-authenticated >> aaa session-id common >> >> vpdn-group 1 >> accept-dialin >> protocol pptp >> virtual-template 1 >> >> interface Loopback0 >> ip address 99.99.99.99 255.255.255.255 >> ip nat inside >> ip virtual-reassembly >> >> interface Virtual-Template1 >> ip unnumbered FastEthernet0/0 >> ip policy route-map VPN-Client >> peer match aaa-pools >> peer default ip address pool vpnpool >> no keepalive >> ppp encrypt mppe auto >> ppp authentication pap chap ms-chap ms-chap-v2 >> ! >> ip local pool vpnpool 172.16.30.2 172.16.30.254 >> --------- >> Here is the raddb/users file entry: >> --------- >> testuser Service-Type == Framed-User >> Framed-Protocol == PPP, >> Framed-IP-Address = 172.16.1.2, >> Framed-IP-Netmask = 255.255.255.255, >> Framed-Compression = Van-Jacobson-TCP-IP >> >> DEFAULT Framed-Protocol == PPP >> Framed-Protocol = PPP, >> Framed-Compression = Van-Jacobson-TCP-IP >> -------------- >> The DEFAULT entry allows users in /etc/passwd to authenticate fine, but >> "testuser" still gets an IP from the NAS pool instead of the one above.. >> Any pointers appreciated! > > http://wiki.freeradius.org/index.php/FAQ#It_still_doesn.27t_work.21 > > Post the debug of the authentication attempt. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 2 > Date: Tue, 26 May 2009 14:15:44 -0500 > From: jon jon <free9360(a)gmail.com> > Subject: Re: next > To: tim.sylvester(a)networkradius.com, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <c1efadb10905261215n4c0a4cdbw143227509a69c594(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > ok so after reading the admin.sql it looks like it is telling me what to > type into my mysql, to create a default admin for radius,and so freeradius > can read any table in sql, does it matter what I change localhost to or > can > it be anyname I want. guess I am seeing what I have to do but not fully > understanding it. I am using a mysql book also but think that might be > getting me more confused. > jon > > On Tue, May 26, 2009 at 12:02 PM, Tim Sylvester < > tim.sylvester(a)networkradius.com> wrote: > >> Read the SQL HOWTO at: http://wiki.freeradius.org/SQL_HOWTO. Also, look >> at the sql.conf file in the raddb directory and the mysql files in >> raddb/sql/mysql. You will want to read the information in admin.sql and >> schema.sql. >> >> >> >> Tim >> >> >> >> *From:* freeradius-users-bounces+tim.sylvester=networkradius.com@ >> lists.freeradius.org >> [mailto:freeradius-users-bounces+tim.sylvester<freeradius-users-bounces%2Btim.sylvester> >> =networkradius.com(a)lists.freeradius.org] *On Behalf Of *jon jon >> *Sent:* Tuesday, May 26, 2009 9:51 AM >> *To:* FreeRadius users mailing list >> *Subject:* next >> >> >> >> I have my freeradius working, I running slackware 12.1 with freeradius >> version 2.1.5. I used NTRAping utility to send packets to my freeradius >> server. I also used radtest and that was successful. So now I want to set >> freeradius with backend mysql database. I am looking for the script >> db_mysql.sql and cannot find this file. I installed mysql as a package, >> when >> I installed slackware. So, does that file even exist anymore? I have the >> radius book and the directory it shows doesn't contain any file with that >> name. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

3 2

Preventing outer EAP id from going through auth
by John Doppke 26 May '09

26 May '09

I have a fairly standard config, using EAP/TTLS and an LDAP back end. Both EAP and non-EAP requests need to do LDAP lookups. It's working well (I did very little customizing), except I see a lot of the anonymous outer id's getting sent to the LDAP servers. I moved EAP above LDAP in the config, and it seems to have eliminated those when EAP returns 'ok', but I'm still seeing some. It looks like when EAP returns 'updated' it still runs anonymous through LDAP. I noticed the eap def has ok = return, should I add updated = return to avoid the anonymous LDAP lookups? -John

2 1

Re: Fail-over. Send the request directly to Server2
by Ivan Kalik 26 May '09

26 May '09

> My scenario is: > > > > --> Radius Server > 1 > > Radius Client --> Radius Proxy --- > > --> Radius Server > 2 > > > > Radius Proxy sends the request to the first live home server in the list > (fail-over method). > > Can RadiusProxy send the request directly towards Server2, if Server1 is > down? > Yes. Read instructions in proxy.conf. Ivan Kalik Kalik Informatika ISP

1 0

Fail-over. Send the request directly to Server2
by Marco De Magistris 26 May '09

26 May '09

Hi guys, My scenario is: --> Radius Server 1 Radius Client --> Radius Proxy --- --> Radius Server 2 Radius Proxy sends the request to the first live home server in the list (fail-over method). Radius Proxy sends the request towards Server1. Server 1 is down. Now the Radius Proxy rejects the Request. Radius Client Radius Proxy Radius Server1 | Request --> | Request--> | | <-- Reject | | Can RadiusProxy send the request directly towards Server2, if Server1 is down? Radius Client Radius Proxy Radius Server1 | Request --> | Request --> | (Server1 is down, Radius Proxy sends packet towards Server2) Radius Server2 | | Request --> | | | <-- Accept | Thanks in advance Marco

1 0

RE: Freeradius-Users Digest, Vol 49, Issue 117
by Marco De Magistris 26 May '09

26 May '09

Hi Alan Thanks for your help. Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: martedì 26 maggio 2009 17.58 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 49, Issue 117 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Statistic Counter (Alan DeKok) 2. problem with rlm_counter module when reset option is set to never (Ahmed Nifaz Faizabadi) 3. Re: problem with rlm_counter module when reset option is set to never (Ivan Kalik) 4. Re: problem with rlm_counter module when reset option is set to never (Ahmed Nifaz Faizabadi) 5. Re: problem with rlm_counter module when reset option is set to never (Alan DeKok) 6. Assigning IP address from RADIUS to Cisco PPTP users (up(a)3.am) 7. wired 802.1x for desktops (offtopic) (Mikael Kermorgant) 8. FW: freeradius2.1.4--Simultaneous (??) ---------------------------------------------------------------------- Message: 1 Date: Tue, 26 May 2009 13:29:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Statistic Counter To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1BD2AF.5050101(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Marco De Magistris wrote: > Can I enable other counters for AuthRadiusClientAccessRetransmissions, > AuthRadiusClientTimeouts, AuthRadiusClientCounterDiscontinuity)? The server does not currently track those statistics. As always, patches are welcome. > Or I should use ?counter? module of FreeRadius? No. It won't do what you want. Alan DeKok. ------------------------------ Message: 2 Date: Tue, 26 May 2009 18:13:59 +0530 From: Ahmed Nifaz Faizabadi <ahmednifaz(a)gmail.com> Subject: problem with rlm_counter module when reset option is set to never To: freeradius-users(a)lists.freeradius.org Message-ID: <d49df1900905260543k4228999ai4aeb7ff46b595237(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Hi all, Here is the issue I am facing with rlm_counter module. I am using freeradius-server-2.1.4 and configuring Max session time for each user. for example: user1 Max-Session-Time := 1800, Auth-Type := Reject Reply-Message = "Your time limit is used" user2 Max-Session-Time := 3600, Auth-Type := Reject Reply-Message = "Your time limit is used" and rlm_counter options are : counter daily { counter-name = Max-All-Session-Time check-name = Max-All-Session key = User-Name reset = never } I am observing that the user accounting record is not deleted from rlm_counter module once the user has used his allocated time. For example when user1 has used 1800 seconds allocated to him then I will be deleting the user from users config and then add the same user back. I am getting the "Your time limit is used" message :(. Does somebody has information about how to delete the records from rlm_counter module once they are expired with reset-option set to never. Regards Ahmed Nifaz ------------------------------ Message: 3 Date: Tue, 26 May 2009 14:15:35 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: problem with rlm_counter module when reset option is set to never To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <30874.194.176.105.44.1243343735.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Here is the issue I am facing with rlm_counter module. > I am using freeradius-server-2.1.4 and configuring Max session time > for each user. > > for example: > user1 Max-Session-Time := 1800, Auth-Type := Reject > Reply-Message = "Your time limit is used" > > user2 Max-Session-Time := 3600, Auth-Type := Reject > Reply-Message = "Your time limit is used" > > and rlm_counter options are : > > counter daily { > counter-name = Max-All-Session-Time > check-name = Max-All-Session > key = User-Name > reset = never > } > > > I am observing that the user accounting record is not deleted from > rlm_counter module once the user has used his allocated time. And what makes you think it would be. > For > example when user1 has used 1800 seconds allocated to him then I will > be deleting the user from users config and then add the same user > back. I am getting the "Your time limit is used" message :(. > > Does somebody has information about how to delete the records from > rlm_counter module once they are expired with reset-option set to > never. Yes. Delete accounting records as well when you delete user details. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Tue, 26 May 2009 19:03:34 +0530 From: Ahmed Nifaz Faizabadi <ahmednifaz(a)gmail.com> Subject: Re: problem with rlm_counter module when reset option is set to never To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <d49df1900905260633k59bc4b28peeeeb6f6f36d9223(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 >> Here is the issue I am facing with rlm_counter module. >> I am using freeradius-server-2.1.4 and configuring Max session time >> for each user. >> >> for example: >> user1 ? ? ? ? ?Max-Session-Time := 1800, Auth-Type := Reject >> ? ? ? ? ? ? ? ? Reply-Message = "Your time limit is used" >> >> user2 ? ? ? ? ?Max-Session-Time := 3600, Auth-Type := Reject >> ? ? ? ? ? ? ? ? Reply-Message = "Your time limit is used" >> >> and rlm_counter options are : >> >> counter daily { >> ? ? ? ?counter-name = Max-All-Session-Time >> ? ? ? ?check-name = Max-All-Session >> ? ? ? ?key = User-Name >> ? ? ? ?reset = never >> ? ?} >> >> >> I am observing that the user accounting record is not deleted from >> rlm_counter module once the user has used his allocated time. > > And what makes you think it would be. > This would increase the accounting file size indefenitely and cause some other problems as the user records are not at all being deleted. >> For >> example when user1 has used 1800 seconds allocated to him then I will >> be deleting the user from users config and then add the same user >> back. I am getting the "Your time limit is used" message :(. >> >> Does somebody has information about how to delete the records from >> rlm_counter module once they are expired with reset-option set to >> never. > > Yes. Delete accounting records as well when you delete user details. > I tried that but that accounting file is in binary or some other encrypted format. Will you please let me know about how to delete that accounting record or how to convert that to simple text file ( which would make easy deleting expired records) . Ahmed Nifaz ------------------------------ Message: 5 Date: Tue, 26 May 2009 15:49:26 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: problem with rlm_counter module when reset option is set to never To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1BF366.5020409(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ahmed Nifaz Faizabadi wrote: .... >>> counter daily { >>> counter-name = Max-All-Session-Time >>> check-name = Max-All-Session >>> key = User-Name >>> reset = never ... >>> I am observing that the user accounting record is not deleted from >>> rlm_counter module once the user has used his allocated time. ... > This would increase the accounting file size indefenitely and cause > some other problems as the user records are not at all being deleted. See the configuration: "reset = never" means "never reset". Which means "don't reset". > I tried that but that accounting file is in binary or some other > encrypted format. Will you please let me know about how to delete that > accounting record or how to convert that to simple text file ( which > would make easy deleting expired records) . It's just a DBM file. See the "rad_counter.pl" file in the source tree. It shows how to edit the file. Alan DeKok. ------------------------------ Message: 6 Date: Tue, 26 May 2009 11:34:41 -0400 (EDT) From: up(a)3.am Subject: Assigning IP address from RADIUS to Cisco PPTP users To: freeradius-users(a)lists.freeradius.org Message-ID: <Pine.BSF.4.64.0905261122570.14312(a)richard2.pil.net> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Hi: I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems. Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common vpdn-group 1 accept-dialin protocol pptp virtual-template 1 interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am ========================================================================= ------------------------------ Message: 7 Date: Tue, 26 May 2009 17:49:03 +0200 From: Mikael Kermorgant <mikael.kermorgant(a)gmail.com> Subject: wired 802.1x for desktops (offtopic) To: freeradius-users(a)lists.freeradius.org Message-ID: <9711147e0905260849o189c2601w5c1e378769668760(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, Sorry for this off-topic message, I have a question about 802.1x deployment and don't know where to ask. As freeradius is one of the element I think of, maybe someone here can help me find the solution ? My Goals : 1) authenticate access to the network from Open Public Access Catalog (OPAC) desktop machines available to every user of a biblioteque. 2) have a guest account with limited LAN access (no access to internet, or just a very short whitelist) 3) Keep the machines reachable from some servers (ghost server, monitoring, etc). (this criteria eliminates the solution of a captive portal) I thought 802.1x with dynamic vlans would be a nice solution as it should permit to put the guest account in a specific vlan. But how would it be possible to reach the machine from the management servers before someone authenticates ? Is it possible to have a default vlan activated on startup of the machine ? Or do you know where I should ask this question ? Regards, -- Mikael Kermorgant

1 0

FW: freeradius2.1.4--Simultaneous
by 蒋曙 26 May '09

26 May '09

HI: I use freebsd7.0+mysql+freeradius2.1.4 Can use the raidus data base to be hit by a consumer at the same time, by verifying with a consumer. But, I am put into use coming to control a consumer "Simultaneous" in raidus. When condition now is that second consumers log on,before acctstoptime in billing form renew with classics. But, nas does not initiate consumer time line information kit. (The consumer continues using a network). Feel that the radius does not send out acc-reject or acc-stop Bao Lai stops using a family. Thank you! System localhost# whereis perl perl: /usr/bin/perl /usr/local/man/man1/perl.1 localhost# whereis snmpget snmpget: /usr/local/bin/snmpget /usr/local/man/man1/snmpget.1 Cisco config aaa authentication enable default none aaa authentication dot1x default group radius aaa authorization network default group radius aaa accounting send stop-record authentication failure aaa accounting suppress null-username aaa accounting session-duration ntp-adjusted aaa accounting update newinfo periodic 5 aaa accounting dot1x default start-stop group radius aaa accounting network default start-stop group radius aaa accounting connection default start-stop group radius aaa accounting resource default start-stop-failure group radius interface FastEthernet0/1 switchport mode access dot1x pae authenticator dot1x port-control auto dot1x violation-mode protect dot1x timeout quiet-period 2 dot1x guest-vlan 3 dot1x auth-fail vlan 4 dot1x auth-fail max-attempts 2 spanning-tree portfast redius.conf # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" INSERT INTO `radius`.`radgroupcheck` (`groupname` ,`attribute` ,`op` ,`value` )VALUES ( 'user', 'Simultaneous-Use', ':=', '1'); 使用同一账号登录的时候，在mysql的radacct表中发现如下情况！不知道是否正常？（我觉得这个不正常）。 mysql> select username,acctstarttime,acctstoptime from radacct where username="jsh"; +----------+---------------------+---------------------+ | username | acctstarttime | acctstoptime | +----------+---------------------+---------------------+ | jsh | 2009-05-19 07:34:57 | 2009-05-19 07:35:49 | | jsh | 2009-05-19 07:35:49 | NULL | +----------+---------------------+---------------------+ 2 rows in set (0.00 sec) mysql> sites-available/default accounting { radutmp ... sql .... } session { #radutmp sql } … ….. Mysql query is radacct,radpostauth radacct username acctstarttime acctstoptime count(*) jsh 2009-05-26 07:45:09 NULL 1 radpostauth <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radpostauth&toke n=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radpostauth%60.%60id%60+% 3D+14&sql_query=SELECT+%2A+FROM+%60radpostauth%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radpostauth&token=9954b 30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radpostauth%60+WHERE+%6 0radpostauth%60.%60id%60+%3D+14+LIMIT+1&zero_rows=The+row+has+been+deleted&g oto=sql.php%3Fdb%3Dradius%26table%3Dradpostauth%26token%3D9954b30f278d52fb0a 59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radpostauth%2560%2 6zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structure.php> Delete 14 jsh Access-Accept 2009-05-26 07:30:04 <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radpostauth&toke n=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radpostauth%60.%60id%60+% 3D+15&sql_query=SELECT+%2A+FROM+%60radpostauth%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radpostauth&token=9954b 30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radpostauth%60+WHERE+%6 0radpostauth%60.%60id%60+%3D+15+LIMIT+1&zero_rows=The+row+has+been+deleted&g oto=sql.php%3Fdb%3Dradius%26table%3Dradpostauth%26token%3D9954b30f278d52fb0a 59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radpostauth%2560%2 6zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structure.php> Delete 15 jsh Access-Accept 2009-05-26 07:45:08 <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radpostauth&toke n=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radpostauth%60.%60id%60+% 3D+16&sql_query=SELECT+%2A+FROM+%60radpostauth%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radpostauth&token=9954b 30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radpostauth%60+WHERE+%6 0radpostauth%60.%60id%60+%3D+16+LIMIT+1&zero_rows=The+row+has+been+deleted&g oto=sql.php%3Fdb%3Dradius%26table%3Dradpostauth%26token%3D9954b30f278d52fb0a 59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radpostauth%2560%2 6zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structure.php> Delete 16 jsh Access-Accept 2009-05-26 07:45:08 　Radgroupcheck <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radgroupcheck&sql_query =SELECT+%2A+FROM+%60radgroupcheck%60&goto=tbl_structure.php&dontlimitchars=1 &token=9954b30f278d52fb0a59651606dd9117> Full Texts id groupname attribute op value <http://192.168.0.1/phpadmin/tbl_change.php?db=radius&table=radgroupcheck&to ken=9954b30f278d52fb0a59651606dd9117&primary_key=+%60radgroupcheck%60.%60id% 60+%3D+1&sql_query=SELECT+%2A+FROM+%60radgroupcheck%60&goto=sql.php> Edit <http://192.168.0.1/phpadmin/sql.php?db=radius&table=radgroupcheck&token=995 4b30f278d52fb0a59651606dd9117&sql_query=DELETE+FROM+%60radgroupcheck%60+WHER E+%60radgroupcheck%60.%60id%60+%3D+1+LIMIT+1&zero_rows=The+row+has+been+dele ted&goto=sql.php%3Fdb%3Dradius%26table%3Dradgroupcheck%26token%3D9954b30f278 d52fb0a59651606dd9117%26sql_query%3DSELECT%2B%252A%2BFROM%2B%2560radgroupche ck%2560%26zero_rows%3DThe%2Brow%2Bhas%2Bbeen%2Bdeleted%26goto%3Dtbl_structur e.php> Delete 1 user Simultaneous-Use := 1 Nas nasname shortname type ports secret community description 192.168.0.100 cisco3560 cisco 1812 cisco cisco3560 RADIUS Client 蒋　　曙财讯传媒集团__信息技术部地址：北京市朝阳门外大街22号泛利大厦10层 100020 Tel：010-85650282 Mobi:13810174932 Fax：010-65880126 MSN：mousejsh(a)hotmail.com

1 0

Statistic Counter
by Marco De Magistris 26 May '09

26 May '09

Hi all, Thanks in advance for your help. My scenario is shown below: ________________________________________________________________________ ____ Radius Client --> Radius Proxy Radius Server 192.168.1.2 192.168.1.3 --> IPS1(192.168.1.4) ________________________________________________________________________ ____ I need the following Authentication Statistic of the RADIUS Server (192.168.1.4) AuthRadiusClientAccessRequests Counter32, AuthRadiusClientAccessRetransmissions Counter32, AuthRadiusClientAccessAccepts Counter32, AuthRadiusClientAccessRejects Counter32, AuthRadiusClientAccessChallenges Counter32, AuthRadiusClientMalformedAccessResponses Counter32, AuthRadiusClientBadAuthenticators Counter32, AuthRadiusClientPendingRequests Gauge32, AuthRadiusClientTimeouts Counter32, AuthRadiusClientUnknownTypes Counter32, AuthRadiusClientPacketsDropped Counter32, AuthRadiusClientCounterDiscontinuity TimeTicks Launch the command: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1 , FreeRADIUS-Stats-Server-IP-Address = 192.168.1.4 , FreeRADIUS-Stats-Server-Port = 1812" | ./radclient -s 192.168.1.3:1812 status <SHAREDSECRET> Received response ID 59, code 2, length = 140 FreeRADIUS-Total-Access-Requests = 56 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 1 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 3 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 5 FreeRADIUS-Total-Auth-Unknown-Types = 0 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Can I enable other counters for AuthRadiusClientAccessRetransmissions, AuthRadiusClientTimeouts, AuthRadiusClientCounterDiscontinuity)? Or I should use "counter" module of FreeRadius? RadiusClientAccessRetransmissions "The number of RADIUS Access-Request packets retransmitted to this RADIUS authentication server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of edaRadiusServerCounterDiscontinuity." RadiusClientTimeouts "The number of authentication timeouts to this server. After a timeout, the client may retry to the same server, send to a different server, or give up. A retry to the same server is counted as a retransmit as well as a timeout. A send to a different server is counted as a Request as well as a timeout. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of edaRadiusServerCounterDiscontinuity." RadiusClientCounterDiscontinuity "The number of centiseconds since the last discontinuity in the RADIUS Client counters. A discontinuity may be the result of a reinitialization of the RADIUS Client module within the managed entity." Thanks Regards Marco

2 1

filter anonymous identity
by Riccardo Veraldi 26 May '09

26 May '09

Hello, on radius 1.1.x I have some users autenticating using an outer identity. This is annoying to me because in the radius.log file I cannot identify easily who is the real user autenticating, since outer identity can be anything. How can I forbid in freeradius configuration to use an outer identity or anonymous ? I wish to forbid autentications which uses an outer identity. howto have control over it ? thank you Rick

4 6

MySQL 5.1 Partitions & FreeRADIUS
by Tim O'Donovan 26 May '09

26 May '09

Hi, Has anyone had any success in implementing MySQL 5.1's partitions to increase backend performance for FreeRADIUS? Thanks, Tim

2 1

modules in authorize{} and authenticate{} sections
by bastardinho69 26 May '09

26 May '09

Hi, guys, I have successfully set up FreeRADIUS server to use Active Directory to authenticate LAN users. My authorize{} and authenticate{} section configuration in radiusd.conf file looks like this: authorize { preprocess eap mschap } authenticate { Auth-Type MS-CHAP { mschap } eap } As u see, in both sections there is modules eap and mschap mentioned. Can anybody tell me why it is so? Or where to look for the answer? I have been checking the logs from running radius in debug mode but i cannot find the definite answer, for example, in conversation between radius server and supplicant, mschap in authorize section always returns noop, so my question is- why it is needed there if it always returns noop? Thank you.

2 1