- Freeradius-Users - lists.freeradius.org

Include Vendor Dictionary ?
by David Toms 12 Mar '08

12 Mar '08

Hello all, I'm using freeradius 2.0.1 with mysql to authorize users for a wireless hotspot. I have a wireless router running CoovaAP firmware. I'm using Arch Linux, and everything is now working great, with ONLY ONE niggling problem remaining I have not modified the freeradius configs much. I added "VENDOR ChilliSpot 14559" to the dictionary file, which I hoped would make freeradius read the "dictionary.chillispot" dictionary. The file says "see man dictionary for the format of the dictionary files", but this man page is not installed. There is no indication in the radius log that it has read a vendor specific dictionary. When freeradius attempts to authorise a user in the appropriate group, a message: rlm_sql: Failed to create the pair: Invalid octet string "1024" for attribute name "ChilliSpot-Max-Total-Octets" is logged and the user is rejected. I am assuming that the attribute name is invalid, because the vendor specific attributes are not known to radius. I added it to the default realm in the "attrs" configuration file, but no good. So, what is wrong? How do I allow vendor specific attributes to be sent in a radius reply? Many thanks in anticipation. David

2 4

Performance and hardware
by Mikhail Novikov 12 Mar '08

12 Mar '08

Hello. I have a question about FreeRadius: RADIUS proxy server (FreeRadius) should perform 150 - 250 requests per second. Some attributes in requests have to be modified (rules is specified in hints file). OS is Debian Linux. How much memory should have the server? What the processor (in GHz) do you recommend? Best regards, Michael

2 1

Rule for don't log specific user session.
by Rafael Medici 12 Mar '08

12 Mar '08

Hello, Is there a way to don't log nothing for a specific user, creating a rule in sql_log? You will probably ask me why! Because i have a plugin running on nagios, that checks for authentication with a specific user ex: "testuser" every 5 minutes, and at the end of the day my database grows with useless information. We are a global hotspot provider, so this check running on nagios is performed in 10.000 hotspots, to test for authentication, so you could imagine that this "testuser" generates infinite registers. I think put some kind of trigger to do that, will probably slow down my server performance, because we have a huge users database. I'm running freeradius(1.1.7) + postgre. Regards, Rafael Medici

4 6

Group Membership Checking.
by David Bell 12 Mar '08

12 Mar '08

My radius.conf file has the following for Group Membership Checking # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member= uid=%{User-Name},ou=people,dc=dxi,dc=net))" groupmembership_attribute = radiusGroupName The problem with this configuration is that if a user is a member of the group it will allow them access, even if they input the wrong password. Can someone help me with this please. Thanks David

1 0

Unsubscribe
by David W Bell 12 Mar '08

12 Mar '08

1 0

I will be giving a talk at Networkshop36 in April
by Alan DeKok 11 Mar '08

11 Mar '08

I will be giving a talk in Glasgow in April. http://www.ja.net/services/events/2008/networkshop-36.html On Wednesday: 15.00 The evolution of Free RADIUS and future developments Alan DeKok, FreeRADIUS If anyone on this list is planning on attending, look for me, or send me email. I'll also be showing up early (likely Monday), so I may have some time in advance to meet people. Alan DeKok.

2 1

Can freeRadius do that?
by Guillaume Chartrand 11 Mar '08

11 Mar '08

Hi, I just want to know if freeradius server can do what I want to deploy in my environnement. I want to deploy freeradius to taking care of security and authorization for my wireless network. What I want to do is like many hotel in my country. The user open is laptop with wireless capability, is automaticly connected to the wireless network but if he want to use the internet connection, when he first run is browser, he's automaticly redirect to an authentification page that ask him a username and a password. So is it freeradius who's handle this or another software or combination of software. Like a freeradius server and a proxy or freeradius with third party software. Can someone help me with my interrogation. Thanks a lot ---------------------------- Guillaume Chartrand Technicien informatique Cégep régional de Lanaudière Centre administratif, Repentigny (450) 470-0911 poste 7218

4 4

Help with complex redundant LDAP setup
by Capelle, Mark (PCMC-GB) 11 Mar '08

11 Mar '08

I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU's (referred to as sites) to get around issues due to the large tree size present. This is currently working with the following setup radiusd.conf: modules { ldap srv1-sitea { .. set_auth_type = yes } ldap srv1-siteb { .. set_auth_type = yes } } sites-available/default: authorize { srv1-sitea srv1-siteb } authenticate { Auth-Type srv1-sitea { srv1-sitea } Auth-Type srv1-siteb { srv1-siteb } } Now my goal is to make this a redundant configuration. I have duplicated my modules config, changing "srv1" to "srv2" and changing the IP address of the LDAP server. The rest of the configuration is what is fuzzy for me. I assume that my authorize section would be: authorize { redundant { srv1-sitea srv2-sitea } redundant { srv1-siteb srv2-siteb } Now the authentication part is where is becomes complicated. I don't even know where to begin with this. I tried this based on some old configs I had used in the past, but this failed miserably: authenticate { Auth-Type ldap { group { srv1-sitea { reject = 1 ok = return } srv2-siteb { reject = return ok = return } } } I read the "configurable failover" docs, but it is still not clear to me what I would need to do in this situation. I am sure there is probably an easy way to accomplish this so that for each OU ("site") it uses both LDAP servers ("srv1","srv2") in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.

2 1

(no subject)
by Santiago Balaguer García 11 Mar '08

11 Mar '08

Hi, I have two radius server since three years ago. They are my two production AAA servers and can authenticate until 300.000 accounts. So my RADIUS database (PostgreSQL) grew up enough and I realize that my SQL queries slow down. I know that I have four table with almost 500.000 registers each one. Any suggestion for improving the throughput and accelerating the queries? Thanks, Santiago _________________________________________________________________ La vida de los famosos al desnudo en MSN Entretenimiento http://entretenimiento.es.msn.com/

3 4

Viewing all Radius acct attributes
by Rashmi Bajaj 11 Mar '08

11 Mar '08

Hi, I am using the freeradius to receive radius acct logs from another remote radius server. The purpose is to use the radwho output. How do I make the radwho output to show all the attributes that it receives? Currently the output shows: Login, Name, What, TTY, When, From (NAS IP address), location (Framed IP address). But my input radius account parameters include many more. What needs to be changed in the conf files, so I see all the attributes as a result of radwho? Thanks, Rashmi ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1