- Freeradius-Users - lists.freeradius.org

Problem with FreeRADIUS Active Directory Integration
by Davies, Mike 06 May '09

06 May '09

In our test lab we are working on using FreeRADIUS to authenticate users against their AD credentials. We loaded FreeRADIUS on a Fedora 10. We loaded SAMBA and it works. We loaded freeradius-2.1.3-1.fc10.i386. We followed the http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO. We booted an XP workstation and logged in. It never got a DHCP address and failed authentication. I noticed a message, [suffix] No '@' in User-Name = "DOM002\DW68406A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop In the smb.conf file we configured the workgroup to be the netbios name of the domain DOM002. Should that have been the IP name, fm.testdomain.com? Below is the output from the radius -X. FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 15:31:31 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 172.18.134.248 { require_message_authenticator = no secret = "testing123" shortname = "172.18.134.248" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "peap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.18.134.248 port 1812, id=83, length=333 Framed-MTU = 1480 NAS-IP-Address = 172.18.134.248 NAS-Identifier = "IDM test 5406" User-Name = "DOM002\\DW68406A" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 6 NAS-Port-Type = Ethernet NAS-Port-Id = "A6" Called-Station-Id = "00-21-f7-6e-02-00" Calling-Station-Id = "00-1e-4f-b0-27-10" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" EAP-Message = 0x0204001401444f4d3030325c4457363834303641 Message-Authenticator = 0xb42d28522d0b20c06178f6ca7e7a45aa MS-RAS-Vendor = 11 HP-Attr-255 = 0x011a0000000b28 HP-Attr-255 = 0x011a0000000b2e HP-Attr-255 = 0x011a0000000b3d HP-Attr-255 = 0x0138 HP-Attr-255 = 0x013a HP-Attr-255 = 0x0140 HP-Attr-255 = 0x0141 HP-Attr-255 = 0x0151 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOM002\DW68406A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 83 to 172.18.134.248 port 1812 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc651d6b8c654cf27ba01eec66aff3857 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.18.134.248 port 1812, id=84, length=411 Framed-MTU = 1480 NAS-IP-Address = 172.18.134.248 NAS-Identifier = "IDM test 5406" User-Name = "DOM002\\DW68406A" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 6 NAS-Port-Type = Ethernet NAS-Port-Id = "A6" Called-Station-Id = "00-21-f7-6e-02-00" Calling-Station-Id = "00-1e-4f-b0-27-10" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "999" State = 0xc651d6b8c654cf27ba01eec66aff3857 EAP-Message = 0x0205005019800000004616030100410100003d03014a00a4e6275cb2018565ad9e287d82f60ac726ef17efadae0c24cb245b56bef200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x63a1081298f73e7c4143818242a8e5e8 MS-RAS-Vendor = 11 HP-Attr-255 = 0x011a0000000b28 HP-Attr-255 = 0x011a0000000b2e HP-Attr-255 = 0x011a0000000b3d HP-Attr-255 = 0x0138 HP-Attr-255 = 0x013a HP-Attr-255 = 0x0140 HP-Attr-255 = 0x0141 HP-Attr-255 = 0x0151 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DOM002\DW68406A", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 84 to 172.18.134.248 port 1812 EAP-Message = 0x0106040019c00000089b160301002a0200002603014a00a4ed4a3e2ac1489de523e4a75a46e342f93f08ce07266c3706baacc75b0c00000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303530343232323232355a170d3130303530343232323232355a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ba09d960ea3260af04d8e598747c45e986dd96a5610168a17aa1ba2199a9e310798230b2dcaf50afc0595f55e73e3e3a16d97a37aea0691b33be6441224e EAP-Message = 0xaa3e7ae28ec352d3742165a53e86eb01206a2c6d981e4e6661390980a8daca354de1f6f53d8da2f70dbf2db7a74ed5bf8f9cb40e9a1c305ea5ee832fbe947dd74253a174a477555a3963ec96c366153d35643f5915691e07178b78008614d49ebbeb77cd51d80cf522a6cbfe42c7df2e251a888d09d410e8204e25387be968b997511e3fc554e0ac6376f51c8ef421015b8adc9203ecd801c7177992620ad8594b91e3fc06345fb33768c95c5484e7b581edf539554d855032505f682befca5fcfa70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100540f0cbea4618045f3 EAP-Message = 0xe10753d45f4fedd23906f32490b1fc7b1ac0ef87e6e7690fc0c1d5d5f1ca10a985ee95c3a5eba0639baf2ef068c25c0bceae385b261488a0b973c8094a7dc72b55923387eae276cbb2b44e662cb12e27026bf9f906fa55f73771d21d5bfbc18157295030934a02bd175784ab036acb5679cbe232060028ac93e910551a3006dcc84c89905f2e549fdbe29730816b8edf06020ab951fe62b03ce46428488e54243793ac5c375142b79f439a77f5b8bd521633683884d72e5374e66181b73d1b221f80cb9db794221945c56bf7d34d2d0bbb5296e4e995a15175baed922bc922ea17ded14cee86a358782aeab2354f107fba4f4d6bea609b0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc651d6b8c757cf27ba01eec66aff3857 Finished request 1. Going to the next request Waking up in 4.9 seconds. Thanks, Mike Davies ________________________________ This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is confidential and protected by law from unauthorized disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

SQL Counters and Realms
by liran tal 06 May '09

06 May '09

Hey, In my FR1.1.7 setup, I have different realms for the same machine using different databases for each. The login part is ok, as well as the accounting, which has entries in the radacct table for "account". I enabled one of the sql counters modules which, as it seems, isn't returning any results, because I am suspecting that it's running the query on another realm's database. I have several of the sql.conf config files for each realm, so what I'm basically doing is having in accounting {} section something like this: Acct-Type SQL_EXAMPLE { sql_example } What do you think is happening? Here is the relevant debug snippet from freeradius: Wed May 6 22:47:28 2009 : Debug: modsingle[authorize]: calling accessperiod (rlm_sqlcounter) for request 0 Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: Entering module authorize code Wed May 6 22:47:28 2009 : Debug: sqlcounter_expand: 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = '%{Stripped-User-Name:-%{User-Name}}' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: radius_xlat: 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: sqlcounter_expand: '%{sql:SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1}' Wed May 6 22:47:28 2009 : Debug: radius_xlat: Running registered xlat function of module sql for string 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): - sql_xlat Wed May 6 22:47:28 2009 : Debug: radius_xlat: 'access1' Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'access1' Wed May 6 22:47:28 2009 : Debug: radius_xlat: 'SELECT UNIX_TIMESTAMP() - UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = 'access1' ORDER BY AcctStartTime LIMIT 1' Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): SQL query did not return any results Wed May 6 22:47:28 2009 : Debug: rlm_sql (sql): Released sql socket id: 2 Wed May 6 22:47:28 2009 : Debug: radius_xlat: '' Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: (Check item - counter) is greater than zero Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: Authorized user access1, check_item=300, counter=0 Wed May 6 22:47:28 2009 : Debug: rlm_sqlcounter: Sent Reply-Item for user access1, Type=Session-Timeout, value=300 Wed May 6 22:47:28 2009 : Debug: modsingle[authorize]: returned from accessperiod (rlm_sqlcounter) for request 0 Wed May 6 22:47:28 2009 : Debug: modcall[authorize]: module "accessperiod" returns ok for request 0 Regards, Liran.

2 2

user login once???
by Nizar Zulmi 06 May '09

06 May '09

how to setup freeradius server to perform user log in to server once in a day or few login in a month.. help please..

2 1

authcheck vs. groupcheck with FreeRadius 2.1.1
by Michael Schramm 06 May '09

06 May '09

Hello, we're migrated from Freeradius 0.9 to 2.1. We are using the freeradius with a failover MySQL Configuration. Since the migration we have customers which get in trouble, because we configured "Simultaneuos Use" Check Items on the user (e.g. Value 4) and on the corresponding group (e.g. Value 2). At the old Radius version the value was taken from the User and the Group attribute was ignored. Now the user can't authenticate 4 times, because the server checks the group value. How can I change this behaviour? If you need configuration fragments, please tell and I will supply them. Thanks a lot and best regards Michael Schramm

2 1

Freeradius for WiMAX Authentication
by Kiran Kumar 06 May '09

06 May '09

Hi All, I was interested in knowing if we can use the Freeradius server for WiMAX Authentication. Some of the additional features that would be required are: 1. Vendor Specific Attributes inclusion in the Radius Messages(I think some amount of this can be done now - but can you tell me how) 2. Generation of WiMAX Session keys 3. Support for MSCHAPv2 inner authentication ?? 4. Support for HA ?? Where does the Freeradius server store the accounting records. Is it stored as a raw file or is there some processing done by the server on these records. Has anyone used Free radius for WiMAX testing before, if so can you give me some pointers on how and what 'more' modifications are needed. Thanks and Regards, Kiran Kumar.B WiMAX Test Engineer

2 1

Re: Re :checking authorization in the duration of connection
by Eric 06 May '09

06 May '09

Hi Arran I have trouble.would you please send me codes? I don't know how those support adsl do ? when users are online during all the days and there is limitation on the traffic amount? It's possible even if the NAS doesn't support PoD, so long as the NAS supports the 802.1X mib, you should be able to fire off an SNMP-SET with the exec module and force re-authentication. All the required information is available in the Accounting Request the server just received. If you're really having trouble and ask nicely i'll write some example code. Arran

2 1

ldap filter depending on NAS
by Matthieu Lazaro 05 May '09

05 May '09

Hello, My freeRadius setup works very well using PEAP/TLS binding on the ldap using only one filter. Now I have two very different types of NAS and I need to filter users that may have access to one NAS or the other or both. My idea was to use the unlang in the ldap module to write my policy, but it's not working. in /etc/freeradius/modules/ldap we have: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "127.0.0.1" identity = "__snipped__" password = "__snipped__" basedn = "dc=__snipped__,dc=com" #WORKING : #filter = "(&(|(accessTo=WIFI_FR)(accessTo=WIFI_ALL))(uid=%{Stripped-User-Name:-%{User-Name}}))" #NOT working: if (NAS-IP-Address == 10.1.1.2) { filter = "(&(|(accessTo=WIFI_XX)(accessTo=WIFI_YY))(uid=%{Stripped-User-Name:-%{User-Name}}))" } else { filter = "(&(accessTo=VPN)(uid=%{Stripped-User-Name:-%{User-Name}}))" } base_filter = "(objectclass=radiusprofile)" ___snipped-the rest of this section is OK___ } It all happens as if the "if () { ... } else { ... } " is completely ignored (and thus it defaults to check if the uid exists) (ie: neither filter1 nor filter2 appears when debugging. But when we only put filter, it appears when debugging) I think I'm missing a lot of details in the configuration and I have not figured out how to do this with hints|huntgroups|clients files. Any help on why this is not working or an other simple solution is welcome. Best Regards, Matt

4 27

High CPU usage after SQL failure when using buffered-sql
by Stephen Fulton 05 May '09

05 May '09

Hi all, First, I've used FreeRADIUS for a number of years in a number of installations, and I'm fairly comfortable with it. I have looked through the archives, as well as read the documentation, FAQ, wiki and the notes within each of the configuration files that make up FR, such as the virtual servers and modules that would be used. Now onto the issue: During testing of a new RADIUS cluster, I implemented the buffered-sql virtual server, which works fine, with the detail file poll interval set to 10 seconds. However, when I simulate a failure of the accounting MySQL server to which it normally writes, CPU usage spikes significantly, from an average of ~ 1-2% to 30+ over time. If the accounting MySQL server is unavailable for longer than 2-3 minutes, the spikes occur much more frequently. Once the SQL server returns to service, accounting records stored in the detail file are properly read and inserted into the DB, then the files are cleared, as I expected. However, the RADIUS process still maintains a higher than normal CPU load (according to top) of around 10%, which spikes to 30-40% when it is handling a new request (note the singular). The server is a dual Xeon 3.something, with 2GB RAM and SCSI disks. The server is running Debian Linux 2.6.26-2-686. FreeRADIUS is running version 2.1.4, compiled manually. During previous debugging, while running FR in debugging mode, I noted that it was attempting to read the detail file every second, sometimes less. This matches a comment made by Alan in a similar sounding issues discussed on the list in April 2008. (http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg44137.…) Is there any way to mitigate these CPU issues in version 2.1.4? -- Stephen

2 5

Re :checking authorization in the duration of connection
by Eric 05 May '09

05 May '09

I found this reply in freeradius mailing list in 2005: " It's impossible to enforce *traffic* limiting *during* a users session. So if a user is a tiny bit below their limit and logs in again, they can go over their limit. The server will only catch & enforce their limit on the next login. This has been discussed multiple times on the list over the past 5 years." Is this possible now in new versions ?

5 6

Configuring Freeradius
by jon jon 05 May '09

05 May '09

Hi, I am new to freeradius. I am trying to get my freeradius server setup but I find I am having trouble. I am running slackware 12.1 as my OS and running freeradius version 2.1.5. All I want to do is get started on the right track. My question is the three main config files I need to edit are clients.conf, users.conf, and radiusd.conf, right? I did the radtest from the command line and get a accept reject message. Can anyone just tell me what I have to change to get me started off in the right direction? Thanks, jon

4 3