- Freeradius-Users - lists.freeradius.org

Load testing tool recommendation
by Anders Holm 09 May '08

09 May '08

So, I'm building a complete solution, from scratch. As such, the business owners have some requirements on how many requests it should be handle today per second and "some point in the future" as well. Would there be any good load testing tools, or some handy way to figure out how many tps my current setup can handle? I've got a dirt simple Perl script that forks out x radtest processes and I'm just right now seeing how many a second I can ship. Problem being, the RADIUS server is happily letting me melt down to "client" systems, without breaking a sweat. I'd like to load the server, not the clients .. :) I want to see where it eventually breaks down, which seems a task in its own right. Any pointers would be much appreciated. I'd rather have something I can fire off from command line then a GUI solution, for obvious reasons. Cheers! //anders

2 1

hello
by Misael Vasquez Sosa 09 May '08

09 May '08

which free radius version I should used for Solaris 10?? thanks

3 2

rlm_sql_oracle compilation woes
by Anders Holm 09 May '08

09 May '08

Hi Folks. This is a potential newbie question, though I seem unable to find any answers in the FAQ or in the archives, so ... I'm trying to compile the rlm_sql_oracle module for FreeRadius 2.0.3 using Oracle 10.2 client. Now, I've tried every suggestion the configure scripts has thrown at me, and none seem to find my header files. ORACLE_HOME is set to where the client resides. I have the headers in a different location though, so I've used the --with-oracle-home-dir and friends to try and point to where those reside. Always getting the same answer back from configure, which is it can't find oci.h, which is in the specified locations... Would anyone have any examples or pointers I can poke a stick at and see if I am just doing things backwards? Any pointers would be highly appreciated. //anders

3 3

Redundant LDAP Servers
by Jason Traeden 08 May '08

08 May '08

I am running freeradius version 2.0.4 and using LDAP against Active Directory. When I have a single LDAP server setup my authentication works great. I am having trouble using the redundant ldap settings. Here is some config data ldap ad01 { server = ocdc01.overstock.com port = 389 identity = "CN=LDAP Bind,OU=Special,OU=OSTK_Accounts,DC=overstock,DC=com" password = xxxxxx basedn = OU=OSTK_Accounts,DC=overstock,DC=com filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) " ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter ="(|(&(objectClass=group)(member=%{control:Ldap-UserDn}))(&(objec tClass=top)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf #ldap_debug = 0xFFFF } ldap ad02 { server = ocdc01.overstock.com port = 389 identity = "CN=LDAP Bind,OU=Special,OU=OSTK_Accounts,DC=overstock,DC=com" password = xxxxxx basedn = OU=OSTK_Accounts,DC=overstock,DC=com filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) " ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter ="(|(&(objectClass=group)(member=%{control:Ldap-UserDn}))(&(objec tClass=top)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf #ldap_debug = 0xFFFF } instantiate { exec expr expiration logintime ldap ad01 ad02 } authorize { preprocess redundant { ad01 { fail = 1 ok = return } ad02 { fail = 1 ok = return } } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { redundant { ad01 { fail = 1 ok = return } ad02 { fail = 1 ok = return } } } } DEFAULT Ldap-Group == "CN=g.acl.neteng,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com" Auth-Type := Accept, Foundry-Privilege-Level = 0, Foundry-Command-String = *, Foundry-Command-Exception-Flag = 0, Foundry-INM-Privilege = 15, Fall-Through = No DEFAULT ad01-Ldap-Group == "CN=g.acl.neteng,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com" Auth-Type := Accept, Foundry-Privilege-Level = 0, Foundry-Command-String = *, Foundry-Command-Exception-Flag = 0, Foundry-INM-Privilege = 15, Fall-Through = No DEFAULT ad02-Ldap-Group == "CN=g.acl.neteng,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com" Auth-Type := Accept, Foundry-Privilege-Level = 0, Foundry-Command-String = *, Foundry-Command-Exception-Flag = 0, Foundry-INM-Privilege = 15, Fall-Through = No Here is some debug info rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ad02-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ad02-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ad02 rlm_ldap: Over-riding set_auth_type, as there is no module ad02 listed in the "authenticate" section. rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ad01-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ad01-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ad01 rlm_ldap: Over-riding set_auth_type, as there is no module ad01 listed in the "authenticate" section. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Thanks Jason -- Jason Traeden Network Engineer Overstock.com 6350 South 3000 East Salt Lake City, UT 84121 jtraeden(a)overstock.com Desk 801-947-3889 Cell 801-699-1379

2 8

Freeradius proxy: rewriting response messages
by Simone Vendemia 08 May '08

08 May '08

Hello to all We're currently implementing a nice setup with Freeradius, using it as a proxy for a proprietary radius solution. Our goal is to use freeradius plus freeradius-openvpn-plugin as a great way to authenticate vpn users; unfortunately we can't dismiss the proprietary solution (which would be probably the smartest move), however it's only function is to verify the proxied password. For the proxy management we've installed dialupadmin on the same machine, in order to be able to add some accounting information wich can't be directly done on the proprietary solution. Till here, no problem at all, the setup works perfectly. Unfortunately we need to rewrite the response returned to freeradius by the other server, in order to change the framed-ip-address and framed-route given by the proprietary radius with the data inserted previously in our freeradius sql database (mysql) through dialupadmin. Both the proxy and the proprietary server have the same usernames in their local db. Is that a possible setup? We've already searched online without much luck. Thank you in advance.

3 5

Converting User-Name to lower letters
by Khaiti, Issam (ext) 08 May '08

08 May '08

Hallo to all, I need a procedure to convert usernames from upper to lower letters. The entries in the fastuser files are all in lower letters. When an access-request comes where the username is in uppercase it has to be converted to lowercase otherwise the authentication will fail. In the FR version 1.x there was a config option "lower_user = before". This isn't existent in the 2.x version anymore. I tried to achieve this with unlang but wasn't successful. With the attribute rewrite option I can't find a way to do this either. Therefore my question: how can I convert the User-Name attribute from uppercase to lowercase? I did the following : Radiusd.conf: ---------------------------------------------- authorize { preprocess eap if ("%{User-Name}" !~ /(%{User-Name}\L)/ ) { update request { User-Name = `%{1}` } } fastusers_voip_printer { ok = return } fastusers_mac { ok = return } fastusers_assigned { ok = return } fastusers_all { notfound = reject } } fastusers_all: ------------------------------------------------------------------------ - radiustest3 Auth-Type := EAP Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 230, Reply-Message = "auth.... von fastuser_all" Radiusd -X : ------------------------------------------------------------------------ ------------------ rad_recv: Access-Request packet from host 146.254.173.225 port 48125, id=0, length=130 User-Name = "RAdiustest2" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000010015241646975737465737432 Message-Authenticator = 0x5093767d601db7bf8a1ba95e9200fc77 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 0 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++? if ("%{User-Name}" !~ /(%{User-Name})\L)/ ) expand: %{User-Name} -> RAdiustest2 expand: (%{User-Name})L) -> (RAdiustest2)L) ? Evaluating ("%{User-Name}" !~ /(%{User-Name})\L)/) -> TRUE ++? if ("%{User-Name}" !~ /(%{User-Name})\L)/ ) -> TRUE ++- entering if ("%{User-Name}" !~ /(%{User-Name})\L)/ ) expand: %{1} -> Exec-Program output: Exec-Program: FAILED to execute : No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute : No such file or directory Exec-Program: returned: 1 +++[request] returns invalid ++- if ("%{User-Name}" !~ /(%{User-Name})\L)/ ) returns invalid Invalid user: [RAdiustest2/<via Auth-Type = EAP>] (from client radtest2 port 0 cli 02-00-00-00-00-01) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 146.254.173.225 port 48125 Waking up in 0.9 seconds. Cleaning up request 0 ID 0 with timestamp +5 Ready to process requests. ------------------------------------------------------------------------ ------------------------------- I'm sure I have missed something in the docs. Is there a possible setup? I've already searched in the config examples, docs, manpages and the mailing list archive but without luck. Thank you in advance.

4 4

can't get "SQL Based IP Pool" running
by Leander S. 08 May '08

08 May '08

3 11

deployingradius.com down?
by Matt Ashfield 08 May '08

08 May '08

I can't seem to get to deployingradius.com website. Anyone know if this is down? Matt mda(a)unb.ca

3 2

Re : Re : howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 07 May '08

07 May '08

Ok, i think i really missed something! that config should take less than 15 minutes but i can't solve my problem for more than a week. Alan or Ivan, could you give me a half our to help me to fix my RADIUS EAP-TLS config please. i would like to give you a full access to my network and my terminal too, so the diagnostic should be very very easy for you! is it possible? MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 5 Mai 2008, 17h18mn 10s Objet : Re: Re : howto EAP-TLS on freeradius 2.0.2-3 ?? Joel MBA OYONE wrote: ... > The VLAN attributes defined in RFC3580 are as follows: > • Tunnel-Type=VLAN (13) > • Tunnel-Medium-Type=802 > • Tunnel-Private-Group-ID=VLANID > > NOTE: The FreeRADIUS dictionary maps the 802 string value to the integer 6, which > is why client entries use 6 for the Tunnel-Medium-Type value. No. For Tunnel-Medium-Type, "802" is a *name*, not a *number*. See Section 3.2 of RFC 2868: ... Value The Value field is three octets and contains one of the values listed under "Address Family Numbers" in [14]. For the sake of convenience, a relevant excerpt of this list is reproduced below. 1 IPv4 (IP version 4) 2 IPv6 (IP version 6) 3 NSAP 4 HDLC (8-bit multidrop) 5 BBN 1822 6 802 (includes all 802 media plus Ethernet "canonical format") ... FreeRADIUS gets it *right*. Many NAS vendors get it *wrong*. > To create a user and assign the user to a particular VLAN by using FreeRADIUS, open the > etc/raddb/users file, which contains the user account information, and add for the new user. > The following example shows the entry for a user in the users file. The username is > “johndoe,” the password is “test1234.” The user is assigned to VLAN 77. > > johndoe Auth-Type: = EAP, User-Password == “test1234" > Tunnel-Type = 13, > Tunnel-Medium-Type = 6, Or: Tunnel-Medium-Type = IEEE-802 .... > > in both cases, it stays on "IDENTITY VALIDATION" in xp wireless management and sometime i receive the right ip adresss in the right IP Pool. ut lost it immediately, maybe cause of the repeating cycle of athentication sequence. > AND, the client certificate, signed by the Server (not the CA root) is still with the same message. > > > hope it would be helpfull !! Arg. Microsoft keeps putting magic nonsense into their OS's to make it difficult to use non-Microsoft RADIUS servers. And yes, this *is* a problem even inside of Microsoft! So if you're finding it a PITA to get it working, rest assured that Microsoft does, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

Re : Re : Re : howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 07 May '08

07 May '08

up! (never says die) ================== Ok, i think i really missed something! that config should take less than 15 minutes but i can't solve my problem for more than a week. Alan or Ivan, could you give me a half our to help me to fix my RADIUS EAP-TLS config please. i would like to give you a full access to my network and my terminal too, so the diagnostic should be very very easy for you! is it possible? MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 5 Mai 2008, 17h18mn 10s Objet : Re: Re : howto EAP-TLS on freeradius 2.0.2-3 ?? Joel MBA OYONE wrote: ... > The VLAN attributes defined in RFC3580 are as follows: > • Tunnel-Type=VLAN (13) > • Tunnel-Medium-Type=802 > • Tunnel-Private-Group-ID=VLANID > > NOTE: The FreeRADIUS dictionary maps the 802 string value to the integer 6, which > is why client entries use 6 for the Tunnel-Medium-Type value. No. For Tunnel-Medium-Type, "802" is a *name*, not a *number*. See Section 3.2 of RFC 2868: ... Value The Value field is three octets and contains one of the values listed under "Address Family Numbers" in [14]. For the sake of convenience, a relevant excerpt of this list is reproduced below. 1 IPv4 (IP version 4) 2 IPv6 (IP version 6) 3 NSAP 4 HDLC (8-bit multidrop) 5 BBN 1822 6 802 (includes all 802 media plus Ethernet "canonical format") ... FreeRADIUS gets it *right*. Many NAS vendors get it *wrong*. > To create a user and assign the user to a particular VLAN by using FreeRADIUS, open the > etc/raddb/users file, which contains the user account information, and add for the new user. > The following example shows the entry for a user in the users file. The username is > “johndoe,” the password is “test1234.” The user is assigned to VLAN 77. > > johndoe Auth-Type: = EAP, User-Password == “test1234" > Tunnel-Type = 13, > Tunnel-Medium-Type = 6, Or: Tunnel-Medium-Type = IEEE-802 .... > > in both cases, it stays on "IDENTITY VALIDATION" in xp wireless management and sometime i receive the right ip adresss in the right IP Pool. ut lost it immediately, maybe cause of the repeating cycle of athentication sequence. > AND, the client certificate, signed by the Server (not the CA root) is still with the same message. > > > hope it would be helpfull !! Arg. Microsoft keeps putting magic nonsense into their OS's to make it difficult to use non-Microsoft RADIUS servers. And yes, this *is* a problem even inside of Microsoft! So if you're finding it a PITA to get it working, rest assured that Microsoft does, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0