- Freeradius-Users - lists.freeradius.org

user login once???
by Nizar Zulmi 06 May '09

06 May '09

how to setup freeradius server to perform user log in to server once in a day or few login in a month.. help please..

2 1

authcheck vs. groupcheck with FreeRadius 2.1.1
by Michael Schramm 06 May '09

06 May '09

Hello, we're migrated from Freeradius 0.9 to 2.1. We are using the freeradius with a failover MySQL Configuration. Since the migration we have customers which get in trouble, because we configured "Simultaneuos Use" Check Items on the user (e.g. Value 4) and on the corresponding group (e.g. Value 2). At the old Radius version the value was taken from the User and the Group attribute was ignored. Now the user can't authenticate 4 times, because the server checks the group value. How can I change this behaviour? If you need configuration fragments, please tell and I will supply them. Thanks a lot and best regards Michael Schramm

2 1

Freeradius for WiMAX Authentication
by Kiran Kumar 06 May '09

06 May '09

Hi All, I was interested in knowing if we can use the Freeradius server for WiMAX Authentication. Some of the additional features that would be required are: 1. Vendor Specific Attributes inclusion in the Radius Messages(I think some amount of this can be done now - but can you tell me how) 2. Generation of WiMAX Session keys 3. Support for MSCHAPv2 inner authentication ?? 4. Support for HA ?? Where does the Freeradius server store the accounting records. Is it stored as a raw file or is there some processing done by the server on these records. Has anyone used Free radius for WiMAX testing before, if so can you give me some pointers on how and what 'more' modifications are needed. Thanks and Regards, Kiran Kumar.B WiMAX Test Engineer

2 1

Re: Re :checking authorization in the duration of connection
by Eric 06 May '09

06 May '09

Hi Arran I have trouble.would you please send me codes? I don't know how those support adsl do ? when users are online during all the days and there is limitation on the traffic amount? It's possible even if the NAS doesn't support PoD, so long as the NAS supports the 802.1X mib, you should be able to fire off an SNMP-SET with the exec module and force re-authentication. All the required information is available in the Accounting Request the server just received. If you're really having trouble and ask nicely i'll write some example code. Arran

2 1

ldap filter depending on NAS
by Matthieu Lazaro 05 May '09

05 May '09

Hello, My freeRadius setup works very well using PEAP/TLS binding on the ldap using only one filter. Now I have two very different types of NAS and I need to filter users that may have access to one NAS or the other or both. My idea was to use the unlang in the ldap module to write my policy, but it's not working. in /etc/freeradius/modules/ldap we have: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "127.0.0.1" identity = "__snipped__" password = "__snipped__" basedn = "dc=__snipped__,dc=com" #WORKING : #filter = "(&(|(accessTo=WIFI_FR)(accessTo=WIFI_ALL))(uid=%{Stripped-User-Name:-%{User-Name}}))" #NOT working: if (NAS-IP-Address == 10.1.1.2) { filter = "(&(|(accessTo=WIFI_XX)(accessTo=WIFI_YY))(uid=%{Stripped-User-Name:-%{User-Name}}))" } else { filter = "(&(accessTo=VPN)(uid=%{Stripped-User-Name:-%{User-Name}}))" } base_filter = "(objectclass=radiusprofile)" ___snipped-the rest of this section is OK___ } It all happens as if the "if () { ... } else { ... } " is completely ignored (and thus it defaults to check if the uid exists) (ie: neither filter1 nor filter2 appears when debugging. But when we only put filter, it appears when debugging) I think I'm missing a lot of details in the configuration and I have not figured out how to do this with hints|huntgroups|clients files. Any help on why this is not working or an other simple solution is welcome. Best Regards, Matt

4 27

High CPU usage after SQL failure when using buffered-sql
by Stephen Fulton 05 May '09

05 May '09

Hi all, First, I've used FreeRADIUS for a number of years in a number of installations, and I'm fairly comfortable with it. I have looked through the archives, as well as read the documentation, FAQ, wiki and the notes within each of the configuration files that make up FR, such as the virtual servers and modules that would be used. Now onto the issue: During testing of a new RADIUS cluster, I implemented the buffered-sql virtual server, which works fine, with the detail file poll interval set to 10 seconds. However, when I simulate a failure of the accounting MySQL server to which it normally writes, CPU usage spikes significantly, from an average of ~ 1-2% to 30+ over time. If the accounting MySQL server is unavailable for longer than 2-3 minutes, the spikes occur much more frequently. Once the SQL server returns to service, accounting records stored in the detail file are properly read and inserted into the DB, then the files are cleared, as I expected. However, the RADIUS process still maintains a higher than normal CPU load (according to top) of around 10%, which spikes to 30-40% when it is handling a new request (note the singular). The server is a dual Xeon 3.something, with 2GB RAM and SCSI disks. The server is running Debian Linux 2.6.26-2-686. FreeRADIUS is running version 2.1.4, compiled manually. During previous debugging, while running FR in debugging mode, I noted that it was attempting to read the detail file every second, sometimes less. This matches a comment made by Alan in a similar sounding issues discussed on the list in April 2008. (http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg44137.…) Is there any way to mitigate these CPU issues in version 2.1.4? -- Stephen

2 5

Re :checking authorization in the duration of connection
by Eric 05 May '09

05 May '09

I found this reply in freeradius mailing list in 2005: " It's impossible to enforce *traffic* limiting *during* a users session. So if a user is a tiny bit below their limit and logs in again, they can go over their limit. The server will only catch & enforce their limit on the next login. This has been discussed multiple times on the list over the past 5 years." Is this possible now in new versions ?

5 6

Configuring Freeradius
by jon jon 05 May '09

05 May '09

Hi, I am new to freeradius. I am trying to get my freeradius server setup but I find I am having trouble. I am running slackware 12.1 as my OS and running freeradius version 2.1.5. All I want to do is get started on the right track. My question is the three main config files I need to edit are clients.conf, users.conf, and radiusd.conf, right? I did the radtest from the command line and get a accept reject message. Can anyone just tell me what I have to change to get me started off in the right direction? Thanks, jon

4 3

Please help me ...thanks in advance
by praveen saxena 05 May '09

05 May '09

Hi , I am a newbie in Radius field. I have a Linux machine which has RHEL WS 4 Update 5 OS loaded. I have installed freeRadius server version 2.1.5. in another machine. I want to authenticate the linux machine login through Radius server. I have tried several ways to configure the linux machine as published in several groups but did not work.Tried through PAM module. If some body can help me out in this matter or point to some good links,will be helpful to me. Best Regards Praveen

2 1

buffered-sql doesn't make sense to me
by Kanwar Ranbir Sandhu 04 May '09

04 May '09

Hi All, I'm trying to set up buffered-sql on my test freeradius server. I've been reading the example config files, but I'm confused because the buffered-sql example seems to be incomplete. The example "buffered-sql" file says to use one virtual server to log to the detail file, and another virtual server to read from it. But, there is no example config file supplied for logging to the detail file. The only example given is the one for reading from it (i.e. the buffered-sql file) How do I configure buffered-sql? Also, decoupled-accounting appears to me to be very similar to buffered-sql. If it's not, how is it different? Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 15:25:10 up 20 days, 15:21, 4 users, load average: 1.09, 1.13, 0.83

2 3