- Freeradius-Users - lists.freeradius.org

radcheck & NAS-identifier
by YvesDM 18 Oct '07

18 Oct '07

Hi, FR + mysql auth&acct. Sometimes I need to restrict users or groups to acces a certain NAS. I use the nas-identifier attribute to recognize the nas To accomplish this I just add an entry to radcheck or radgroupcheck like this NAS-identifier != nas-name This works fine but, sometimes I use radtest directly on the server to test accounts if someone claims he/she is unable to login. Now for every user/group I've set the above entry in the database, radcheck on the server always returns an acces-reject for some reason. Though, users can login the nas's they are allowed to and get rejected on the certain nas I've specified, so the setup itself is working. But I've kind of lost my "account testing utitlity" :-) I don't understand why radcheck fails on these accounts. I understand radcheck doesn't send any nas-identifier, but I used operator ' ! = ' and not ' ==' so shouldn't the radius accept radtest requests on localhost? I 'm sure there is a good explanation why radtest returns an Acces-reject, but I'd like to know why and, if possible, if there is a solution/work-around for this. Many tnx, Y.

1 0

ssh, pam, radius not playing nicely
by meo＠intrinsity.com 17 Oct '07

17 Oct '07

We are trying to set up and ssh server and a VPN server to both use the same radius server. We are currently using freeradius-1.0.1-3 with EL4.4 . It works fine with our Cisco 3015 VOPN concentrator. It's not working so well with our EL4.4-based ssh server. I doanloaded the pam_radius_auth source and built and installed per http://www.hoei.com/2007/09/linux-sshd-authentication-to-external-radius/ and the INSTALL file that came with the software. I can get radtest to work just fine from the ssh system, but when I try to authenticate via ssh onto that system, it fails. Running debug on the server, I was seeing this: User-Password = "\010\n\rINCORRECT" I found something on the list saying this could happen if the user wasn't in the passwd file on the ssh box. I added the user there: meo:x:9999:100::/home/meo:/bin/tcsh and now the radius server is happy. It claims to be authenticating OK (we use shadow passwd on the radius server, but I did not make shadow entries on the ssh box), but the ssh login fails. Any ideas? Thanks, Miles

1 1

Segment Fault after reload
by Joe Mom 17 Oct '07

17 Oct '07

Hey, I'm using freeradius 1.1.6 on gentoo and I've noticed that if I attempt to do a /etc/init.d/radiusd reload that freeradius stops responding. When i run the server with Radiusd -X and do a reload I get: <snip> reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Wed Oct 17 18:26:20 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Oct 17 18:26:20 2007 : Error: radiusd.conf[1910] Auth-Type PAP already configured - skipping Wed Oct 17 18:26:20 2007 : Error: radiusd.conf[1919] Auth-Type CHAP already configured - skipping Wed Oct 17 18:26:20 2007 : Error: radiusd.conf[1925] Auth-Type MS-CHAP already configured - skipping Wed Oct 17 18:26:20 2007 : Info: radiusd.conf Auth-Type eap already configured - skipping Wed Oct 17 18:26:20 2007 : Info: rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Wed Oct 17 18:26:20 2007 : Info: Ready to process requests. </snip> Then once I attempt to do a radtest i get a "Segmentation fault" and the server quits. Any thoughts? -- Regards Joe

2 1

stuck with no errors
by Joe Mom 17 Oct '07

17 Oct '07

K, i'm stuck. Running freeradius 1.1.6 I've got the passwd module working and i can see in the startup.log that its loading the file and settings. the file is in the format username:password the password is an md5 generated password I keep getting a rejected message from my radtests, but I dont see any message in the radius.log as to why. i need to know either, how to get a more verbose log so i can tell what it is i'm doing wrong or simply what is wrong with the statement: passwd pull_export { filename = /home/ftpuser/export.txt format = "*User-Name:Crypt-Password" } -- Regards Joe

3 4

Help(1.1.3): Access-Reject is sent by server for EAP-MD5 challenge response
by Govardhana K N 17 Oct '07

17 Oct '07

Hi, I am trying to send an Access-Request with EAP-Identity response. The Request was successful and Server sent an Access-Challenge in response (MD5 challenge), the response to this challenge is failing (receiving Access-Reject from Server), the Error message was "rlm_eap_md5: User-Password is required for EAP-MD5 authentication". I have the User-Password attribute in Access-Request. Below is the Access-Request packet attributes, -------------------------------------------------------------------------------- User-Name = jrc User-Password = jrc Nas-identifier = jrcnas Nas-Ip-Address = 10.10.10.10 Nas-Port = 20 Nas-Port-Type = 15 CUI = 0 Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = 1:1:1:1:1:1 NSP-Id = nap BS-ID = TestBS EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "jrc" EAP-MD5-Password = jrc Message-Authenticator = 0x00 -------------------------------------------------------------------------------- am I doing any wrong here? Can Anybody help me how to solve this problem? ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:32825, id=177, length=150 User-Name = "jrc" User-Password = "jrc" NAS-Identifier = "jrcnas" NAS-IP-Address = 10.10.10.10 NAS-Port = 20 NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" NSP-ID = "nap" BS-ID = "TestBS" Message-Authenticator = 0x4cc4b9e9f807f7648ddb267ec1365cc6 EAP-Message = 0x02d20008016a7263 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jrc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 210 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry jrc at line 231 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 177 to 127.0.0.1 port 32825 CUI = "TestCUI2" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.31.128.112 Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1400 AAA-Session-Id = "MultiSessionId2" MSK = "TestMSK2" HA-IP-MIP4 = 1.2.3.5 DHCPv4-Server = 5.6.7.9 MN-HA-MIP4-KEY = "TestMIPKey2" MN-HA-MIP4-SPI = "TestMIPSPI2" DHCP-RK = "TestDHCPRK2" DHCP-RK-KEY-ID = "TestDHCPRKID2" DHCP-RK_LIFETIME = 30 EAP-Message = 0x01d300160410f492fb48923219d8c9760b271cf4e031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x467be2cc5938e30e368d1633e8ebd4fd Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32825, id=178, length=182 User-Name = "jrc" User-Password = "jrc" NAS-Identifier = "jrcnas" NAS-IP-Address = 10.10.10.10 NAS-Port = 20 NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" NSP-ID = "nap" BS-ID = "TestBS" Message-Authenticator = 0x7c3e1b2a25d10ce176811099e6ea64a3 State = 0x467be2cc5938e30e368d1633e8ebd4fd EAP-Message = 0x02d300160410d879a36a071bbf8d1111a598184dbe22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "jrc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 211 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry jrc at line 231 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect: [jrc] (from client localhost port 20 cli 1:1:1:1:1:1) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32825, id=178, length=182 Sending Access-Reject of id 178 to 127.0.0.1 port 32825 EAP-Message = 0x04d30004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -- With Regards, Govardhana K N

6 8

problem in integeration with poptop
by hadi golestani 17 Oct '07

17 Oct '07

I've add that line and comment ntlm line but still some error( tnx god it's not the same error) my radtest syntax: radtest root rootpassword localhost.localdomain 1645 testing123 modcall[authorize]: module "files" returns ok for request 4 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_unix: [root]: invalid password i've attached radius.conf and users and output of debug mode for both radtest and vpn client. On 10/16/07, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu> wrote: > > You have obviously done some work on breaking the server configuration. > Put mschap{} section back the way it was (with ntlm_auth line commented > out). You don't need *any* changes to the default configuration if you > are using users file. Put this in users file: > > root Clertext-Password := "rootpassword" > > Radtest will work and so will mschap (VPN). > > Ivan Kalik > Kalik Informatika ISP > > > Dana 16/10/2007, "hadi golestani" < hadi.golestani(a)gmail.com> piše: > > >I've change it to /usr/bin/ntlm_auth ( found from locate ntlm ) > >but still same error. > >What I must add to users file to test my radius from radtest or vpn > client? > > > >sorry for bothering I'm too newbie. > > > >On 10/16/07, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu> wrote: > >> > >> Well path to ntlm_auth obviously isn't /path/to/ntlm_auth. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> > >> Dana 16/10/2007, "hadi golestani" <hadi.golestani(a)gmail.com > > pi�e: > >> > >> >hi, > >> >I've installed poptop and freeradius well and both are working, > >> >but when I try to connect from a vpn connection or even radtest some > >> error > >> >occured. > >> >what I need to add to users.conf for a simple radtest connection or a > vpn > >> >client? > >> > > >> >it's the output of debug mode for vpn client, some thing like this has > > >> been > >> >printed for radtest also: > >> > > >> > > >> >rad_recv: Access-Request packet from host 127.0.0.1:32770, id=30, > >> length=132 > >> > > >> > Service-Type = Framed-User > >> > Framed-Protocol = PPP > >> > User-Name = "root" > >> > MS-CHAP-Challenge = 0x4d1a9b1028ef83957754c83ce0f55e01 > >> > MS-CHAP2-Response = > >> > >> > >0x9e000d1394f73d58cc731cd6cf58de7cb74f00000000000000008c6daec89825fb28b90bb60b737fb683a4a80f6252935547 > >> > > >> > NAS-IP-Address = 127.0.0.1 > >> > NAS-Port = 0 > >> > Processing the authorize section of radiusd.conf > >> >modcall: entering group authorize for request 11 > >> > modcall[authorize]: module "preprocess" returns ok for request 11 > >> > modcall[authorize]: module "chap" returns noop for request 11 > >> > rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > >> > modcall[authorize]: module "mschap" returns ok for request 11 > >> > rlm_realm: No '@' in User-Name = "root", looking up realm NULL > >> > rlm_realm: No such realm "NULL" > >> > modcall[authorize]: module "suffix" returns noop for request 11 > >> > rlm_eap: No EAP-Message, not doing EAP > >> > modcall[authorize]: module "eap" returns noop for request 11 > >> > users: Matched entry DEFAULT at line 152 > >> > users: Matched entry DEFAULT at line 171 > >> > users: Matched entry DEFAULT at line 183 > >> > modcall[authorize]: module "files" returns ok for request 11 > >> >modcall: leaving group authorize (returns ok) for request 11 > >> > rad_check_password: Found Auth-Type MS-CHAP > >> >auth: type "MS-CHAP" > >> > Processing the authenticate section of radiusd.conf > >> >modcall: entering group MS-CHAP for request 11 > >> > rlm_mschap: No User-Password configured. Cannot create LM-Password. > >> > rlm_mschap: No User-Password configured. Cannot create NT-Password. > >> > rlm_mschap: Told to do MS-CHAPv2 for root with NT-Password > >> >radius_xlat: Running registered xlat function of module mschap for > string > >> >'Challenge' > >> > mschap2: 4d > >> >radius_xlat: Running registered xlat function of module mschap for > string > >> >'NT-Response' > >> >radius_xlat: '/path/to/ntlm_auth --request-nt-key --username=root > >> >--challenge=f1090a99b916ef69 > >> >--nt-response=8c6daec89825fb28b90bb60b737fb683a4a80f6252935547' > >> >Exec-Program: /path/to/ntlm_auth --request-nt-key --username=root > >> >--challenge=f1090a99b916ef69 > >> >--nt-response=8c6daec89825fb28b90bb60b737fb683a4a80f6252935547 > >> >Exec-Program output: Exec-Program: FAILED to execute > /path/to/ntlm_auth: > >> No > >> >such file or directory > >> >Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute > >> >/path/to/ntlm_auth: No such file or directory > >> >Exec-Program: returned: 1 > >> > rlm_mschap: External script failed. > >> > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > >> > modcall[authenticate]: module "mschap" returns reject for request 11 > >> >modcall: leaving group MS-CHAP (returns reject) for request 11 > >> >auth: Failed to validate the user. > >> >Delaying request 11 for 1 seconds > >> >Finished request 11 > >> >Going to the next request > >> >--- Walking the entire request list --- > >> >Waking up in 1 seconds... > >> >--- Walking the entire request list --- > >> >Waking up in 1 seconds... > >> >--- Walking the entire request list --- > >> >Sending Access-Reject of id 30 to 127.0.0.1 port 32770 > >> >Waking up in 4 seconds... > >> >--- Walking the entire request list --- > >> >Cleaning up request 11 ID 30 with timestamp 47152198 > >> >Nothing to do. Sleeping until we see a request. > >> > > >> > > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 4

Re: Problem with LDAP and Groups
by Bryan Evege 17 Oct '07

17 Oct '07

________________________________ Message: 3 Date: Thu, 11 Oct 2007 23:23:45 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Problem with LDAP and Groups To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <oQaIjLrO.1192141425.2493270.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 Read instructions in huntgroups file. Group devices in huntgroups: cisco NAS-IP-Address == a.b.c.d cisco NAS-IP-Address == a.b.c.e etc. linux NAS-IP-Address == z.y.x.w linux NAS-IP-Address == z.y.x.v etc. Add Huntgroup-Name to the DEFAULT entries: DEFAULT Huntgroup-Name == "cisco", Ldap-Group == "cisco_priv_15", User-Profile := "uid=cisco_priv_15,ou=profiles,ou=radius,dc=csctus,dc=net" You can leave out Auth-Type. These attributes will then be passed only when user logs in from a device in cisco huntgroup. For other entries Ldap group might match but huntgroup will not. Things get complicated if roles and devices overlap and you have two or more entries where both the group and hungroup will match. For instance, you wanted the same user in priv level 1 and 15 groups. You then have to add another level of distincion, like a realm/sufix/prefix. Ivan Kalik Kalik Informatika ISP Dana 11/10/2007, "Bryan Evege" <bryan(a)bevege.com> pi?e: >Message: 6 >> Date: Thu, 11 Oct 2007 21:13:21 +0100 >> From: <tnt(a)kalik.co.yu> >> Subject: Re: Problem with LDAP and Groups >> To: "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org> >> Message-ID: <bS0cz6Hw.1192133601.8730890.tnt(a)kalik.co.yu> >> Content-Type: text/plain; charset=ISO-8859-2 >> >> >>> If I change the fall through to yes it still matches as many groups as the user is in. How can I tell freeradius which attributes to send back? >>> >> >> If you want to send sets of attributes according to the NAS user is >> trying to log into use huntgroups. >> >> >>> For example, bevege is a member of the following groups, packetshapper, cisco_priv_15, cisco_priv_1, linux. >>> >> >> Your group allocation is wrong. You can't have the same user(name) on >> the same device having priv levels 1 and 15. Pick one. Or have him log >> in as username@1 and username@15 and use realms to allocate correct set >> of attributes. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> >Could you please explain a bit more. From what I understand you cannot >use Huntgroups to lookup what group a user is in. I only uses /etc/group >/etc/password. What I would like to do is this. User bevege logs in from >Cisco router. Have the users file somehow detect that the request has >come from a cisco router (by IP I would guess) then validate that the >user is in the correct group and then pass back the specific attributes >just for the cisco. Same thing for packetshapper etc. > >Thanks, > >Bryan > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > Ok, this is driving me insane. I tried the way you suggested but here's the problem. User A is in the packeteer group, user B is in the packeteer_read_only group. Using the Huntgroup and users file below only allows user A (packeteer) to logon. User B doesn't work at all. If I reverse the order of the huntgroup file (packeteer_read_only first) then only user B can logon. This makes sense because which ever one is first in the huntgroups file matches and freeradius doesn't look any further. Isn't there a more detailed way to search the huntgroup? Or maybe I need to do better matching of the ldap group? I really need to get this working ASAP. Just a little background. We have about 10-15 users and about 20 devices of varying types. Some users (network operations) need read only access and some departments (network engineering) need full access to just about everything. Using NAS based huntgroups doesn't seem to work because only one group type can login, ie the first to match. Using just group based lookups doesn't work either unless the user is only a member of only one group, again the first one to match, which defeats the whole purpose of groups. I need to figure out a way to have user A in the packeteer group and user B in packeteer_read_only group and be able to have them both login to multiple devices with the appropriate access defined in LDAP. How on earth are companies with lots of devices and lots of different user access levels doing this? It can't be that hard. Any help would be greatly appreciated, I'm getting pressure to get this going ASAP. Huntgroups file packeteer NAS-IP-Address == 10.17.69.12 packeteer_read_only NAS-IP-Address == 10.17.69.12 Users file 162 DEFAULT Huntgroup-Name == "packeteer",Ldap-Group == Packeteer,User-Profile := "uid=packeteer,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP 163 Fall-Through = no 165 DEFAULT Huntgroup-Name == "packeteer_read_only",Ldap-Group == packeteer_read_only,User-Profile := "uid=packeteer_read_only,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP 166 Fall-Through = no

2 1

[Fwd: Re: rlm_perl (threads) performance question]
by Apostolos Pantsiopoulos 17 Oct '07

17 Oct '07

Alan DeKok wrote: > Apostolos Pantsiopoulos wrote: > >> I am using the rlm_perl module for accounting purposes. >> > ... > >> The results I get (after 2-3 k requests) are these : >> >> Mean time for acct start : 0.005 secs >> Mean time for acct stop : 0.01 secs >> >> Since there is a 1:1 ratio of start/stop requests I guess that we can >> say that >> for each request (regardless of its type) I should get a mean of 0.0075 >> secs. >> > > I don't think so. The start/stop requests do different things, so > it's not surprising that they have different mean times. > Yes it is not surprising, indeed. I just used them to find an approximate value for a "request" mean time so that we wouldn't have to distinguish between start and stop. That is not the problem though. My stop script does a lot more then my start, so that's explainable... > >> And this in turn should be giving about 130 req/sec. >> >> But I am not getting this kind of performance. >> I know that there is a handling overhead for each request. I don't know >> the exact >> percentage of this overhead but for simplicity's sake lets be >> pessimistic and >> consider it to be about 30%. >> > > You can measure the performance of the server externally, via a > client. Send the server a request, and wait for a response. Take the > difference, and that's the time required to process a request. > I did that. Actually it was the first thing I did. I got the same result. > Also, the server does a LOT more than just running Perl. You are > measuring the time taken to run your Perl scripts. The time taken to > process a request can be VERY different. > I just benchmarked the "internal" script just to see if the DB is the bottleneck. It is not. EVERY query did not take more than 0.03 secs ( thrice the size of the mean time) > >> Now the performance should be something like 80 req/sec. >> But I am not getting this kind of performance either. >> In fact, as soon as my main radius reaches a number of 50 req/sec my NAS >> starts sending requests to my backup radius. >> > > Likely because the RADIUS server is getting blocked, and not > responding to requests. That's usually because of a slow database. > See above... > >> If every perl clone can complete each request in X secs shouldn't 32 clones >> complete 1/X*32 requests per second? Or something similar to that? >> > > No. They may be competing for resources. The request rate is > affected strongly by requests that take a long time. In contrast, the > mean time per request is strongly affected by a large number of requests > that take a small amount of time. > Yes, I agree that they are competing for resources (and in this case the DB is the only resource, really). But when my server gets choked up shouldn't we expect to see big response times during the benchmark of the perl module? (e.g. running the same queries from an outside program I can get about 200 queries/sec from the DB , when my radiusd reaches the 50 r/s limit the DB idles at 10-24 q/s, so the DB does not seem to be the problem) > i.e. the mean time per request and the request rate are two VERY > different metrics. > > >> The problem does not seem to be the database. I made a simple >> program that uses the exact same code as my radius perl script does and >> I can get >> this kind of performance easily. >> > > There may be other things going on... > > Alan DeKok. > > Is there a way to "monitor" how many threads are actually at work (busy) at a given time? That could be really helpful... -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

5 7

Set freeradius attribute value
by yangcuilin 17 Oct '07

17 Oct '07

Hi, all I want to store a value in freeradius, and change it sometimes by radius request. I think there must be some attributes in freeradius which client can change or get its value by request. How can I implement it? Please give me some solutions or advice. Or give me some key points. Thanks very much. Rock

1 0

Re: Using freeradius and 802.1x for dynamic VLAN
by lvizcardof＠unsa.edu.pe 17 Oct '07

17 Oct '07

> you certainly arent checking that the VLAN is 2 - and if it isnt then fail > the authentication. i can understand what you are trying to do...but > do do THAT sort of thing you will need to use checking attributes, > not setting attributes. > > you should find that the port which carlos is attached to is being put onto > VLAN 2 is the config is correct. How do I know if my certificate checking that the vlan is 2 and why the authentication don't fail? What certificate i shoud use, so that valid the: carlos User-Password == "carlos" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2 and if the user carlos access to the vlan 2, he can access, otherwise he doesn't access. But in my case the user carlos can access to any vlan. for example to vlan 3 or 4. Tell me what certificate I can to use that valid the Tunnel-Type and form it. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 3