- Freeradius-Users - lists.freeradius.org

AAA Services with multiple SQL
by Paolo Serafino Via 19 Nov '07

19 Nov '07

I've configured my freeradius conf files to accept Authorization and Accounting Request using two different sql instances and driving them with Realms, looking at various posts about this argument. It works with accounting, but not with authorization. I've run freeradius in debug mode (freeradius -x) and i saw that it loads the right sql instance depending the right realm, but it EVER gives "wrong username and password" despite i copy the sql query that i see in the debug and i get my username!!!!!! ### radiusd.conf authorize { Autz-Type wic { wic } Autz-Type no { no } } ### users DEFAULT Mikrotik-Realm == "wic", Autz-Type := "wic" DEFAULT Mikrotik-Realm == "novara", Autz-Type := "no" and in my NAS i put that realms.... -- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a138332… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

force reject user without password
by Marc delavaud 19 Nov '07

19 Nov '07

I have users who try to authenticate without password, this cause load on my ldap server Mon Nov 19 15:05:59 2007 : Auth: Login incorrect: [mike/<no User- Password attribute>] (from client localhost port 0) Mon Nov 19 15:05:59 2007 : Auth: Login incorrect: [mike/<no User- Password attribute>] (from client How can force reject users without password provided ? ----------------------------------- Marc Boisis-Delavaud tel: 05 46 45 82 14 Centre de Ressources Informatiques Université de La Rochelle -----------------------------------

1 0

Re: in vs. out
by wlan＠mac.com 19 Nov '07

19 Nov '07

Hi Alan, > No. The standard is the RFC. The portmaster text is just > additional > text from the people building RADIUS systems. > > It is NOT vendor specific. Do NOT say it is vendor specific. > Ok... I deserve a good slap for that one ;) I will start thinking of it as vendor specific brokenness. But, my reality remains the same.. the meaning depends on the NAS being broken or not. >>> Follow the standards. Do not follow broken vendors. >> >> It actually isn't just that one vendor... in fact, if not >> mistaken, much >> of the commercial wlan gear I've worked with used the above >> meaning. It >> would be curious to see a list of vendors and how they implemented >> their >> accounting... if we all checked the manuals of the devices we >> use, we >> could all help build that list in the freeradius wiki! > > Feel free to start this effort. > I will ... maybe at: http://wiki.freeradius.org/NAS_Accounting_Differences > There are many other vendor products that are very broken with > respect > to RADIUS. Do NOT follow any individual vendor, or even groups of > vendors. Follow the standards. If the standards aren't clear, ask on > the IETF RADEXT mailing list. The people there should be able to give > conclusive answers. > Unfortunately, from a back-end perspective, if having to support a variety of 'broken' commercial vendors, one doesn't have much choice (apart from not supporting these vendors). I guess we have to live with it as it would probably be difficult for these vendors to change their ways now... David

9 15

Benchmark test score about the performance of this server
by Liangliang Guo 19 Nov '07

19 Nov '07

Hi everyone: -Does any one have some measurement counters or benchmark test score about the performance of this server when using mysql database backend? For example 3000 requests/s for 5 millions users with 98% latency within 0.0X second on Netra 240 ......? -In my understanding this kind of figures may vary on the authentication method and backend type? Am I right? Br /Liangliang Guo

2 1

Authorization and account methods that the free radius supports?
by Liangliang Guo 18 Nov '07

18 Nov '07

Hi everyone: Does anybody know what kinds of authorization and account methods that the free radius supports. At the official wiki, authentication methods are documented in details. However for authorization methods only some supported database backbends are described, and for accounting only some conceptual introduction to accounting are available? Can anyone throw some lights on them. Best Regards /Liangliang Guo

1 0

wpa_supplicant eap trouble
by Patrick Welche 18 Nov '07

18 Nov '07

I have set up radiusd-CVS of 15 Nov, and can't connect to it with wpa_supplicant 0.4.9/bsd/ath0. (I also tried vista but that's worse.) The authentication seems to succeed: Sun Nov 18 15:11:10 2007 : Debug: ++[sql] returns ok Sending Access-Accept of id 1 to 192.168.200.34 port 1027 Service-Type = Framed-User Framed-Protocol = PPP EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sun Nov 18 15:11:10 2007 : Debug: Finished request 1. Sun Nov 18 15:11:10 2007 : Debug: Going to the next request But, now on the client (whose clock is 2.180s slow): Nov 18 15:11:12.979857: EAPOL: SUPP_BE entering state RECEIVE Nov 18 15:11:13.025776: RX EAPOL from 00:19:5b:67:d2:1c Nov 18 15:11:13.026165: RX EAPOL - hexdump(len=8): 01 00 00 04 04 01 00 04 Nov 18 15:11:13.026210: EAPOL: Received EAP-Packet frame Nov 18 15:11:13.026235: EAPOL: SUPP_BE entering state REQUEST Nov 18 15:11:13.026259: EAPOL: getSuppRsp Nov 18 15:11:13.026282: EAP: EAP entering state RECEIVED Nov 18 15:11:13.026308: EAP: Received EAP-Failure Nov 18 15:11:13.026332: EAP: EAP entering state DISCARD Received EAP-Failure ?! Am I right in guessing that EAP-Message = 0x03010004 means 03 = EAP-Success, 01 = id, 0004 = 4 bytes long? Sending... gets printed before the packet is signed, so I assume that the correct Message-Authenticator gets computed. How can I break the configuration files such that all communication up to Access-Accept is OK, and yet the connection fails? Cheers, Patrick

2 1

Error: no DB handles to use
by sam 18 Nov '07

18 Nov '07

Hi, I met a strange problem seems related "rlm_sql". When freeradius running in debug mode(radiusd -X) everything works fine, but there's something wrong in normal mode. Below please find the error information in radius.log file. Need your help! Sun Nov 18 15:13:24 2007 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Sun Nov 18 15:13:24 2007 : Error: rlm_sql_unixodbc: SQL down 08S01 [unixODBC][FreeTDS][SQL Server]Server is unavailable or does not exist. Sun Nov 18 15:13:24 2007 : Error: rlm_sql_unixodbc: Connection failed Sun Nov 18 15:13:24 2007 : Error: rlm_sql (sql): Failed to connect DB handle #4 Sun Nov 18 15:13:24 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 1 My configuration: OS: Fedora Core 7 FreeRadius: 1.1.7-3 FreeTDS: 0.64-6 unixODBC: 2.2.12-2 Regards, Sam

1 0

automated response
by Nico Gazzano 18 Nov '07

18 Nov '07

I will be on vacation from 11/18/07 through 11/25/07, and will have limited or no access to voicemail and email. For support questions please contact Dmitriy Fortel at 847-690-1900 x 208 or send an email to support(a)mischoice.com. For issues regarding website projects please send all requests to webmaster(a)mischoice.com. This is an automatically generated message, do not reply. Thank you, Nico Gazzano

1 0

how to prepare directory file for 3Com VSA WX switch?
by Maciej Uhlig 18 Nov '07

18 Nov '07

this is a piece of information concerning VSA from 3Com's WX switch manual: Attribute Type Rcv in Access Resp? Sent in Access Reqst? Sent in Acct Reqst? Description VLAN-Name 26, 43, 2 Yes No Yes Name of the VLAN to which the client belongs. there are more (8) VSAs starting from 26, 43, 2 to 26, 43, 8 how to incorporate all this information in freeradius directory (configuration)? I don't understand what "26, 43, 2" mean. best regards, MU

3 3

What is the threading structure of Free Radius
by Liangliang Guo 17 Nov '07

17 Nov '07

Hi everyone: I am going to deploy free radius on Sun T2000 Platform which has a 8 cores processor that support 32 threads context(4 each core, just as there are 32 virtual CPUs).A single thread application underperforms on this kind of platform.On this platform the performance of an application can be increased linearly in line with the number of working threads running in parallel. The throughput of an application can benefit from scaling the worker thread. -Free radius is a single thread or mutil-thread application? -So what is the threading model of freeradius, one query/one thread or there are a fix amount of worker thread(e.g. as the same as the number of CPU, configurable number of worker thread). -Can I scale the worker threads from some configuration files? Best Regards Leon Guo Ericsson (China) Communications Company Ltd. SH Branch *: 10F Building E No.1068 Tian Shan Xi Rd Shanghai *: +86 21 22089695 Fax: +86 21 22088047

1 0