- Freeradius-Users - lists.freeradius.org

proxy acct records best practices
by TR Missner 10 Mar '09

10 Mar '09

Hello, I am a new user of freeradius ( no experience with the 1.x version at all ). I am in the process of setting up radius for accounting of voip records. Due to the nature of my system blocking must be avoided at all costs. With this in mind I have configure FR to write accounting records locally to a file then I have the records proxied to a remote freeradius instance where the records are written to a database. My question revolves around best practices and speed. Reading and shipping the records off box is very slow ( somewhere around 5 - 10 records per second ). I believe this may be caused by the latency between the proxy and the master which is around 150ms. Of course I could just insert the records in the DB across the WAN but am not sure whether this would be any faster. I'm convinced latency is the issue because even when I turn off the databasing of records on the master and only write to flat files the speed remains in the same range. Keeping in mind my newness to freeradius I thought it might be a good idea to ask the community for suggestions. Thanks T

3 5

Assistance with FreeRADIUS and Windows Authentication via LDAP
by Edwin Isada 10 Mar '09

10 Mar '09

Hello, I am running FreeRADIUS version 1.1.3. I'm trying to setup LDAP authentication for Windows users accessing our networking devices especially with Cisco switches and routers. Windows authentication is working properly on my FreeRADIUS server, but I'm trying to figure out how to give different users special privilege access without providing them the enable password. I'd like to specify another Security group with providing them a read-only or special privilege mode with their Windows account. Is this possible? I'm new with using FreeRADIUS, please help. Thanks, Edwin

3 2

Problem compiling on OSX 10.5
by Paul Bartell 10 Mar '09

10 Mar '09

I have two problems: One is with compiling in mysql support. Despite using the following ./configure line ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include/ --with-mysql-lib-dir=/usr/local/mysql-5.1.30-osx10.5-x86/lib/ it still says checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for SQLConnect in -liodbc... yes checking for isql.h... yes configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_mysql (/Users/admin/radiusd/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local/freeradius' '--with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include/' '--with-mysql-lib-dir=/usr/local/mysql-5.1.30-osx10.5-x86/lib/' '--enable-ltdl-install=no' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... Im am using the version from cvs. Am I not fetching the mysql module or something (which doesnt seem likely as the latest stable gives the same error)? It appears that freeradius is trying to compile a universal binary. On a PPC machine I don't have this problem. The intel machine im installing on appears to have some ppc libraries missing. Is there any way to prevent this cross compiling or does anyone know a fast fix. Ive seen numerous posts on this issue with the same errors, and all of them seem unanswered. Im using the following to configure: ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include when running make I get build errors. I cant get to the machine at the moment, or else i would give the exact errors, but it has something to do with rlm_perl. -- Random quote of the week/month/whenever i get to updating it: "Opportunity knocked. My doorman threw him out." - Adrienne Gusoff "At school you don't get parole, good behavior only brings a longer sentence." - The History Boys

2 1

Conversion to Version 2
by Doug Hardie 10 Mar '09

10 Mar '09

I have been using FreeRadius 1.x for a number of years. It has worked just fine. All I am using it for is to authenticate and authorize dial-in users (its about as simple as you can get). The only unusual item is I have a couple of fairly complex modules for authorization and accounting. The question is should I bother to upgrade to 2.x. I don't have a need for any of the new features it provides. I don't even use most of the features in 1.x. My largest concern is the modules. I don't recall seeing anything here about what changes would be required for them other than I believe they have to be compiled with the server. Currently the modules are compiled separately and placed in /usr/local/lib and everything just works.

4 20

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 09 Mar '09

09 Mar '09

>Is your NAS sending them? If it is, there is a firewall stopping them. >Ivan Kalik >Kalik Informatika ISP Thanks Ivan for fast reply, So, I'm very newer with linux also freeradius. If you permit, how can I see if the NAS send the account package? I'm using a ZINWELL G220 Plus and TP LInk WA501G. At zinwell I received an Authentication Failed, but is passed. NONREPLAY or something else.. Tanks again. _________________________________________________________________ News, entertainment and everything you care about at Live.com. Get it now! http://www.live.com/getstarted.aspx

2 1

No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 09 Mar '09

09 Mar '09

Hi there, I get a little problem with Ubuntu 8.04 + freeradius + EAP/TLS/PEAP + mysql, 'couse I don't receive an Accounting package even response. In Ubuntu is installed freeradius, mysql and open ssl. Could someone help me with this? Thanks _________________________________________________________________ More than messages–check out the rest of the Windows Live™. http://www.microsoft.com/windows/windowslive/

2 1

What does 'radius -C' do? (2.1.3)
by Mike Diggins 09 Mar '09

09 Mar '09

According to the documentation, radiusd -C is supposed to "Check configuration and exit." I was assuming that would catch errors in the configuration that might prevent it from restarting. However, if I intentionally mangle the configuration to the point it won't start, the -C check still returns nothing. What am I missing? -Mike

3 9

Re: failed to receive Accounting Response
by "Николай Г. Петров" 09 Mar '09

09 Mar '09

Ok! Where can I find information about howto make freeradius undarstand a TACACS+ ?

2 1

Re: failed to receive Accounting Response
by "Николай Г. Петров" 09 Mar '09

09 Mar '09

No. in my company we use a freeradius, not a TACACS, and we want to get a control under some users which work on cisco console and for this we would be like take a 'log command'. If you know how we make do that and freeradius implemet this, please tell us or give a some howto, patch, url etc. Still we implement unsuccessful.

2 1

Can we do sql just once during eap-tls handshake
by Johan F2 09 Mar '09

09 Mar '09

We are using eap-tls for authetication assisted with a database for filling in some attributes. FreeRADIUS Version 2.1.3 with minimal configuration will do a sql lookup for each round. (Four selects: radcheck, radusergroup, radgroupcheck and radgroupreply). There are 6-9 rounds depending on certificate chain sizes. Obviously performance would be better with only one database lookup. Part of the (attempted) configuration: authorize { preprocess eap if (I have tried some conditions here) { sql if (notfound) { fail } } } authenticate { eap } Is there som nice condition that will result in only one lookup in the database? A thing that complicates thing is that TLS (that declares Success I beleive) is run during authenticate which is later the the attempted database lookup. The TLS outcome is pretty well known in the second last round: There are logs saying [tls] (other): SSL negotiation finished successfully SSL Connection Established but there is still one Access-Challange. So if this fact could be tested in the last round that test would be a nice candidate for doing the sql update. As an aside: Is there a way to really inspect the client certificate (preferrably the entire chain) and let it affect some logic (in perl as an example)? -- View this message in context: http://www.nabble.com/Can-we-do-sql-just-once-during-eap-tls-handshake-tp22… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 20