- Freeradius-Users - lists.freeradius.org

Help with initial setup Sita<-->Ext. Radius<-->Int.Radius<-->AD
by Podlazov, Lev 16 Apr '09

16 Apr '09

Good morning , Our organization is trying to set Wireless Users authentication via AD with Radius in between. The reason for Ext. and Int. Radius based on our security group recommendations. I've installed freeradius-1.1.3 from RedHat . It's up on both Ext and Int boxes. I was able to run radtest and radclient locally on both machines but when I am trying to run them from Ext to Int I am getting these errors radclient: no response from server for ID 174 . I've set access for all users in /etc/raddb/users and defined clients in /etc/raddb/clients.conf according to documentation. I am totally new to Radius and this point I am lost what to try next. Any help greatly appreciated Thanks Lev Podlazov IMF 202-623-4054

3 3

Re: Freeradius-Users Digest, Vol 48, Issue 56
by Guk Victor 16 Apr '09

16 Apr '09

1 0

Re: NAS table
by Nizar Zulmi 15 Apr '09

15 Apr '09

i comment out this on clients.conf #client 127.0.0.1 { # secret = passwordradius # shortname = localhost # nastype = other # localhost isn't usually a NAS... #} and i add this to NAS table on radius database. insert into nas (nasname, shortname, secret) values ("client 127.0.0.1","localhost","passwordradius"); i restart the mysql server and then i perform test using radtest and got this message: radtest Nizar 123456 localhost 1812 passwordradius Sending Access-Request of id 104 to 127.0.0.1 port 1812 User-Name = "Nizar" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 .... Re-sending Access-Request of id 104 to 127.0.0.1 port 1812 User-Name = "Nizar" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 radclient: no response from server for ID 104 why its still dosn't work..?? clue plase... --- On Tue, 4/14/09, JDL <JDL(a)imaginenet.net> wrote: From: JDL <JDL(a)imaginenet.net> Subject: Re: NAS table To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tuesday, April 14, 2009, 11:42 AM Nizar Zulmi wrote: > i enable this on sql.conf > readclients = yes > > do i have to remove this : > client 127.0.0.1 { Do you have a "127.0.0.1" client in your the nas table? If so, then yes, you will need to remove it or else you will end up with a duplicate. If this client is not in your nas table, then you can just leave the 127.0.0.1 client in the clients.conf file. BTW, I think the 127.0.0.1 client is just there for testing purposes. I do not believe it will break anything if it is completely removed (unless, of course, you are running also running some sort of radius client on the same server as FreeRADIUS). Jim L. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

Detail file polling issues
by Alan DeKok 15 Apr '09

15 Apr '09

Some people have seen the detail file listener go "crazy", and use lots of CPU. I've managed to reproduce the problem, and have committed a fix to the "stable" tree. Please see http://git.freeradius.org/pre/ for tar files && debian files containing the fix. Or, see http://git.freeradius.org/ for instructions on grabbing the latest "stable" code from git. Alan DeKok.

3 6

Dynamically set password_attribute
by James Devine 15 Apr '09

15 Apr '09

Is it possible to dynamically set the password_attribute ldap module option? I tried setting it to %{Ldap-Pass-Attr}, but it doesn't seem to expand this.

3 6

RE: (EAP) AES Key-wrap of MK issued to the authenticator
by William Rettig 15 Apr '09

15 Apr '09

I'm trying to set up AES Key-wrap of MK issued to the authenticator. Is this possible? If it is, will someone please explain how to do it? Thank you, Bill

1 0

(EAP) AES Key-wrap of MK issued to the authenticator
by William Rettig 15 Apr '09

15 Apr '09

Please point me to documentation that shows how to set up "AES Key-wrap of the MK issued to the authenticator". I am trying to support FIPS140-2. Is this possible? Thank you, Bill

1 0

problem with samba and kerberos 5 to integrate freeradius with AD
by bastardinho69 15 Apr '09

15 Apr '09

Hi, i have been following this great guide http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO on how to integrate freeradius with AD. I am getting confused about kerberos5. Do i have to additionally install krb5 from ports? Or maybe it should be on my system already after samba server installation? In any way (install krb5 or no, i tried both ways) i dont have the krb5.conf file on my system at all. Judging from the guide, it should be there without any krb5 installation procedure. I am running FreeBSD 7.1. I hope u guys can help me, becoz it feels like "no way out" at the moment. Thanks for ur time ;)

1 0

Determining which module caused a reject
by Jack Smith 15 Apr '09

15 Apr '09

Hi I am running freeradius 2.1.4. Alan has mentioned that unlang logic should be restricted to Post-Auth (afterall, that is what it is there for). In order for me to do this, I need to know in the Post-Auth-Type REJECT which module caused the reject. Currently, I can do this in the authentication section quite easily: authenticate { Auth-Type PAP { pap { ok = return reject = 1 } if (reject) { update reply { Reply-Message := "Incorrect password for %{User-Name}" } } } Auth-Type CHAP { chap { ok = return reject = 1 } if (reject) { update reply { Reply-Message := "Incorrect password for %{User-Name}" } } } } But as I said, I would like to move this logic to the Post-Auth-Type Reject. It is not only Auth-Type PAP or CHAP which can cause a reject, my SQL module can also cause a reject. Hence I cannot use the following logic (lets assume we used PAP authentication) in the Post-Auth-Type REJECT: Post-Auth-Type REJECT { if (pap) { } } The reason why I cannot use the above is because in the scenario when a user is successfully authenticated using PAP, but the SQL module rejects him (lets say due to lack of credit), the above if statement will evaluate to true. To summarise once again: How can I obtain which module caused the reject in the Post-Auth-Type REJECT? Thanks in advance

1 0

Re: Re: rlm_perl behavior
by Borislav Dimitrov 15 Apr '09

15 Apr '09

Hello, I just subscribed so I won't be able to quote properly but I hope at least the message is associated with the right thread (I found it on the web archive of the mailing list). I've been using FreeRADIUS for about 4 year now and it is a wonderful product - there's no question why you're No 1! For the past years of using and developing rlm_perl modules for FreeRADIUS, I've only been astonished and happy because of the new functionalities etc that the development team have been adding to the new releases. This all ended with this crippling of the rlm_perl module in the new 2.1.4 release (btw I downloaded and compiled from source the 2.1.4 release under CentOS 5.2, but radiusd - v says that the version is 2.1.5...). Here are my thoughts on the matter and quotes of the discussion for clarity: > Apostolos Pantsiopoulos wrote: >> I noticed that the following directives : > ... >> for perl were not present in the file after the compiling. >> >> Are these directives obsolete? > > Yes. The server already has a thread management system. Adding > another one for Perl is unnecessary. Removing something which has been working fine (the rlm_perl thread management system) is not a good thing IMHO. It helped me achieve more flexibility and was really powerful. > Apostolos Pantsiopoulos wrote: > > Does this mean that in the new behavior I have one perl instance > > (thread) shared by all the radius threads? And if so, are all the > radius > > requests being processed sequentially by it? Doesn't this degrade > > the performance? > > Possibly, yes. > > > Or, the module could be updated to have one > >> perl interpreter per child thread. > > > > This requires that I alter the rlm_perl module code, right? > > Yes. Having only one perl instance will have very bad influence on performance in large integrations. I've experienced what happens in this case - the CPU usage of radiusd is very low (<1%) but requests are waiting each other to finish. This causes huge delays (I've seen 2-3 minutes!) and flooding the NAS's logs with RADIUS Server DEAD... RADIUS Server Alive messages. I've been happily using multiple perl instances to achieve the functionality that I need (like Apostolos Pantsiopoulos) for years now. In my case, I created several rlm_perl instances, each loading different perl applications to take care of different cases depending on the NAS-IP like this: perl instance1 { # This is a large branch => I put higher values for max_clones, start_clones etc but keeping the pool static to avoid reloading the settings from the DB on module instantiation } perl instance2 { # This is another (slightly modified) script which takes care of special circumstances } # ... and now using the wonderful ulang functionality I do the following in ... say accounting switch "%{NAS-IP-Address}" { case '10.250.15.1' { instance1 } case '10.250.17.192' { instance2 } } As far as I could understand from my brief research with google and reading the mailing list, achieving this is now impossible. And I discover this amidst integration. Correct me if I'm wrong, but I'm left with the impression that doing such configurations now requires modifying the rlm_perl's code etc which is not an option. This leaves me with the options to downgrade the FreeRADIUS version or shoot myself in the head ;-). Anyways IMHO this 2.1.4 release is a huge step back. I certainly don't want to insult anyone but why remove functionality which has been working fine for years forcing people rewrite their code (amidst started integrations and projects) to support the new versions limitations! P.S.: Sorry for sending the previous unfinished message, I pressed the wrong key combination

1 0