- Freeradius-Users - lists.freeradius.org

help for radius server in huge DS L service
by ann kok 07 Nov '07

07 Nov '07

Hi all I have question about radius servers for Huge D SL services 1/ how many clients the freeradius server can handle? ls there any limitation? 2/ how many radius servers in LNS servers? 3/ for Telco company, they provide hundred thousand DSL service. Do you know what their archecture in radius setting? ls it different radius servers per LNS? Thank you for your help __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

freeRADIUS with 2 Active-direcotory
by Hangjun He 07 Nov '07

07 Nov '07

Hi, I use freeRADIUS1.1.6 and samba3 to talk with Active-directory. It can work well. Followed by wiki: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO Now we want to set up 2 active-directory, One is primary, The other is backup. If primary AD down, freeRADIUS can switch to backup AD to do authenticate. Can freeRADIUS or samba support 2 ADs? And how to do? Any comment is appreciated. John --------------------------------- @yahoo.cn 新域名、无限量，快来抢注！

2 3

hi
by ANUJ 07 Nov '07

07 Nov '07

Anujgaur88(a)gmail.com

1 0

problem with EAP-TTLS logging passwords
by Riccardo Veraldi 07 Nov '07

07 Nov '07

Hello, I use EAP-TTLS with PAP in my radius proxy infrastructure. The problem is that with option log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes passwords are logged on the intermediate radius servers and also on the final hub radius server since I have a tree radius server infrastructure sparse into Italy. How to solve this problem ? I cannot use EAP-MD5 or MSCHAPv2 inside the TLS tunnel since users passwords are on an encrypted database (unix passwords or kerberos passwords). Anyone has a solution for this ? I would like to prevent the possibility of the password being logged on the intermediate radius servers. thanks Riccardo

2 1

how to do the dynamic VLAN rewrite according to the username or calling-station-id?
by schilling 07 Nov '07

07 Nov '07

We are trying to explore the 802.1x in university resnet. One thing we want to do is put the cisco switch port in a walled garden VLAN if the username or calling-station-id match a blocklist. If username/calling-station-id is not in the blocklist, they will just get to the static access VLAN configured on the cisco switch port. Is there any module available to do this already? Regards, Shiling

3 8

radiusd deadlock on recvfrom on port 1814
by Ryan Melendez 06 Nov '07

06 Nov '07

Hey, I've had FreeRADIUS Version 1.1.0 hang twice recently. The core dumps are very similar in that it appears that main is waiting on some stuff from port 1814. Honestly I don't know what 1814 is really for (proxy port?) but it seems as if fd_isset says so we should expect some data on that socket. Unless something _else_ had already received that data. I hadn't noticed this before I added radrelay and another radiusd process on the same box. Both radiusd processes are bound to different virtual interfaces and radrelay is duplicating acct packets from one to the other. It's not obvious why there would be a race condition on that socket, but my guess is something is going on there. It seems as though both radiusd processes are using the same descriptors for each of their three sockets. I've included some debug info from the core files. Is this a know bug or can it be fixed with a configuration change? Thanks, Ryan ---------------------------------------------------------------------- Process One: (gdb) print *(rad_listen_t *) mainconfig.listen $1 = {next = 0x458023e8, ipaddr = 486477016, type = RAD_LISTEN_AUTH, port = 1812, fd = 3} (gdb) print *(rad_listen_t *) mainconfig.listen->next $2 = {next = 0x4580eef8, ipaddr = 486477016, type = RAD_LISTEN_ACCT, port = 1813, fd = 4} (gdb) print *(rad_listen_t *) mainconfig.listen->next->next $3 = {next = 0x0, ipaddr = 486477016, type = RAD_LISTEN_PROXY, port = 1814, fd = 5} Process Two: gdb) print *(rad_listen_t *) mainconfig.listen $2 = {next = 0x8117fe0, ipaddr = 1459555544, type = RAD_LISTEN_AUTH, port = 1812, fd = 3} (gdb) print *(rad_listen_t *) mainconfig.listen->next $3 = {next = 0x8117ff8, ipaddr = 1459555544, type = RAD_LISTEN_ACCT, port = 1813, fd = 4} (gdb) print *(rad_listen_t *) mainconfig.listen->next->next $4 = {next = 0x0, ipaddr = 1459555544, type = RAD_LISTEN_PROXY, port = 1814, fd = 5} Process One: (gdb) info threads * 6 process 11191 0x0804d145 in main (argc=1166077688, argv=0xbfffd0c0) at radiusd.c:1323 5 process 19865 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 4 process 19864 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 3 process 19863 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 2 process 19862 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 1 process 19861 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 (gdb) bt #0 0x401c99fe in recvfrom () from /lib/tls/libpthread.so.0 #1 0x4004e6d1 in rad_recv (fd=5) at radius.c:1044 #2 0x0804d145 in main (argc=1166077688, argv=0xbfffd0c0) at radiusd.c:1323 (gdb) print *(rad_listen_t *) listener $22 = {next = 0x0, ipaddr = 486477016, type = RAD_LISTEN_PROXY, port = 1814, fd = 5} (gdb) frame 1 #1 0x4004e6d1 in rad_recv (fd=5) at radius.c:1044 1044 radius.c: No such file or directory. in radius.c (gdb) info locals packet = (RADIUS_PACKET *) 0x4780dc38 saremote = {sin_family = 0, sin_port = 0, sin_addr = {s_addr = 0}, sin_zero = "\000\000\000\000\000\000\000"} totallen = 263 salen = 16 attr = (uint8_t *) 0x0 count = -1073758352 host_ipaddr = "\000\000\000\000��۾\005\b" seen_eap = 0 data = "stuff"... --

2 9

EAP failed to remember handler...
by A.L.M.Buxey＠lboro.ac.uk 06 Nov '07

06 Nov '07

hi, Tue Nov 6 10:39:41 2007 : Error: rlm_eap: Failed to remember handler! Tue Nov 6 10:39:41 2007 : Error: rlm_eap: Failed to remember handler! Tue Nov 6 10:39:41 2007 : Error: rlm_eap: Failed to remember handler! then radiusd dead radiusd: FreeRADIUS Version 2.0.0-pre2, for host i686-pc-linux-gnu, built on Sep 17 2007 at 12:02:09 will be updating this CVS version to beta code later - but is this a known bug issue that has recently been fixed or should I look into turning on the debugging? It would be very nice if debugging could be increased for just one clients activity..... alan

2 1

FreeRadius support for subattributes
by Cristian Novac 06 Nov '07

06 Nov '07

Hello all, Do you know whether freeradius has some support for subattributes? Thank you! BR, Cristian NOVAC.

2 1

wpa_supplicant
by lvizcardof＠unsa.edu.pe 06 Nov '07

06 Nov '07

Hi. I have been worked with radius. I authenticated users on windows. Now, I have to authenticate users linux with the switch DELL. I have installed "wpa_supplicant-0.4.7-1.fc4.i386.rpm" in my user linux, for that the User requests to authenticate with the server radius. I configured the file wpa_supplicant.conf: ==================== ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 ap_scan=0 network={ key_mgmt=IEEE8021X eap=MD5 identity="root" password="123456" eapol_flags=0 } ==================== I run radiusd -X in the server ============================================= [root@desarrollo certs]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. =================================================================== after I run in my client [root@desarrollo wpa_supplicant]# wpa_supplicant -D wired -i eth0 -c /etc/wpa_supplicant.conf the network is up but the server doesn't authenticate to my user supplicant. If any know how I can solution this problem. Tell me. Lis ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Security of sql md5 vs unix auth
by Ben Wiechman 06 Nov '07

06 Nov '07

Background: we use freeradius to provide AAA for our wireless hotspots. We would also like to use radius authentication for our layer 3 switches. This brings up the question of security. Which is going to be more secure, md5 hashed passwords in MySQL, or storing the passwords for the switch accounts in the /etc/shadow file (I had to set the file to world readable to allow the radiusd process to read the file.). Or is there another, better alternative that I just don't know about? Ben Wiechman Wisper High Speed Internet Office: 866.394.7737 Direct: 320.256.0184 Cell: 320.247.3224 ben(a)wisper-wireless.com

3 4