- Freeradius-Users - lists.freeradius.org

Error running FreeRadius 1.1.7
by George Beitis 13 Aug '07

13 Aug '07

Hi everyone I get this error when trying to run FreeRadius 1.1.7 for the first time, does this sound familiar?: /usr/local/etc/raddb/hints[37]: Parse error (check) for entry DEFAULT: Unknown value Yes for attribute Strip-User-Name regards George

3 4

Re: error on start freeradius + jradius
by Kevin Bonner 13 Aug '07

13 Aug '07

* moved to -users list... On Friday 13 July 2007 10:25:15 Renan Tateoka wrote: > 2007/7/13, Alan DeKok <aland(a)deployingradius.com>: > > Renan Tateoka wrote: > > > hi everybody, > > > > > > I have installed freeradius 1.1.5 > > > > Why? Install 1.1.6. > > > > Alan DeKok. > > hi, > > i`m sorry, I think that the message went wrong... > > I have installed freeradius 1.1.5 and jradius patch 1.1.5... > ... > Module: Library search path is /usr/local/lib > *** glibc detected *** /usr/local/sbin/radiusd: double free or corruption > (fasttop): 0x800fae98 *** What part of Alan's message was unclear? 1.1.5 has a bug that has been beaten to death on the users list. 1.1.6 doesn't. Use 1.1.6 or later, then try your tests again. Kevin Bonner

2 3

EAP-Handshakes: every reply runs the full authorize-section
by Rainer Brinkmann 13 Aug '07

13 Aug '07

FreeRADIUS Version 1.1.0: Hello, we run EAP-TTLS and what we get in Debug-Mode is, that every received EAP-Packet within the TLS-Tunnel-establish runs the complete authorize-section and slows down the overall time to create a TTLS-Tunnel. Reason is, that the User-Name e.g. "NTB-BRINK-610", which is the EAP-Identity, comes with every received EAP-Packet and is always checked against the full authorize-section. Is it possible to skip this redundant checks in the following EAP-responses that build a specific EAP-Session? (the EAP-Idents cant be resolved in our LDAP, cause that machinenames are always unknown to us. What we have to check are the inner-Tunnel - credentials) kind regards Rainer Brinkmann Network-Management University-Clinicum Hamburg / Germany -- Pflichtangaben gemäß Gesetz über elektronische Handelsregister und Genossenschaftsregister sowie das Unternehmensregister (EHUG): Universitätsklinikum Hamburg-Eppendorf Körperschaft des öffentlichen Rechts Gerichtsstand: Hamburg Vorstandsmitglieder: Prof. Dr. Jörg F. Debatin (Vorsitzender) Dr. Alexander Kirstein Ricarda Klein Prof. Dr. Dr. Uwe Koch-Gromus

2 2

Patch for SQL and SQLIPPool performance
by Roy Walker 13 Aug '07

13 Aug '07

This patch has 2 things. Rewritten SQL queries for Postgres on the SQLIPPool. This actually makes using the SQLIPPool possible with a lot of clients (for Postgres at least, the FOR UPDATE was unnecessary since it is already in a transaction block, and actually dangerous as you could leave have dead lock scenarios). Query times dropped from 250+ ms to under 1 ms. For my needs I had removed CallingStationId from the query and index since it is always the same as username, but I left it in for the patch, is there really a situation where those 2 are different? There is now a configurable cache option for the 5 read-heavy tables involved in an auth request. You can of course as the config file sales, just leave it at 0 to disable the caching. Roy **** Some warnings for those that are trying use SQLIPPool. Even after optimizing the query, the performance still will not allow more than about 10 or 20 simultaneous requests. The biggest problem I see is that one connection is not used to finish one client request all the way through. Ie the client requests and is auth'd against the check and reply tables, then the SQLIPPool call is made, but all the DB connections are in use, so your client gets a reject because the SQLIPPool call is not able to complete. One potential fix is to setup another SQL DB for just the IPPool and so you ensure that any connection that is handled can get an IP. One thought is to make an IPPool module that calls to a DHCP server (or a pool of DHCP servers). Regardless, the IP allocation has to be able to scale to 500 or so simultaneous IP requests. ****

3 2

Trying to work out 24hour access cards
by Evert Meulie 13 Aug '07

13 Aug '07

Hi all! I have a system here that's based on freeradius-1.0.2-r5 (Gentoo distro) and we're having some problem with 24hour access cards. With these I mean logins that will give a user access for a period of max. 24 hours from first login. Should be able to be over a period of 2 days. For example first login: 3pm day 1 2nd login: 1pm day 2 should be allowed I've been looking at http://wiki.freeradius.org/Rlm_sqlcounter and see that Max-Daily-Session=86400 will NOT do the trick, since this will allow 24 hours of access PER day Max-All-Session=86400 will not work either, since this will allow a total of 24 hours of login time over an undefined period. How do I get the correct config for my situation? Do I set BOTH Max-Daily-Session & Max-All-Session to 86400 in my case to get the correct result? Regards, Evert

2 2

After signal HUP freeRADIUS Segmentation fault
by Hangjun He 13 Aug '07

13 Aug '07

freeRADIUS version is 1.1.6.. I saw same question in mail-list(freeRADIUS 0.8), Did this problem fix?? Thanks. Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/ldap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 45 main: cleanup_delay = 5 main: max_requests = 256 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no main: debug_level = 0 read_config_files: reading dictionary Mon Aug 13 06:55:25 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Aug 13 06:55:25 2007 : Error: radiusd.conf[84] Auth-Type MS-CHAP already configured - skipping Mon Aug 13 06:55:25 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Aug 13 06:55:25 2007 : Info: radiusd.conf Auth-Type eap already configured - skipping Mon Aug 13 06:55:25 2007 : Info: Ready to process requests. Segmentation fault --------------------------------- 雅虎免费邮箱3.5G容量，20M附件！

1 0

Help Using PEAP with Unix Password
by Duc Nguyen 12 Aug '07

12 Aug '07

Hi, I'm running FreeRadius 1.0.1-3 on CentOS4 and I'm trying to configure my wireless network to authenticate users with PEAP-MSCHAPv2 using their unix username/password. Here are some of the things that I did: - I set the deafult eap type in eap.conf to be peap and set peap to use mschapv2 - I also configured the ms-chap module in the modules section in radiusd.conf file and enabled mschap in the authorize section in radiusd.conf. Based on the debugging log when I ran /usr/sbin/radius -X, I could see that my username matched the DEFAULT that was the system user. However, it did not authenticate. In the mschap module of the radiusd.conf file, I also tried using a different authtype to override the default MS-CHAP, but that didn't work either. I even tried using the etc_smbpasswd module that they have(not in the mschap module but outside of it and enabled it in the authorize section) but that didn't work either. From what I understand and I maybe wrong on this, with PEAP, I don't have to use certificates with the clients so I didn't copy any certificate to the client laptop. I'm pretty much out of ideas to try. The one time that it did work was when I have the username and password in clear text in the radius users file. So my question is: Is PEAP with unix password is possible? Has anyone done this? If so, can you shed some light on this topic or point me to a tutorial somewhere? I haven't found any that pertains to this particular topic yet. Thanks in advance for any help -duc

3 2

Re: Patch to fix the 0x thing in *NTPassword LDAP attr... Comments?
by Stefan Adams 12 Aug '07

12 Aug '07

> Hmm... in 1.1.7, the "pap" module will take care of fixing > NT-Passwords. i.e. map sambaNTPassword to NT-Password in ldap.attrmap, > and list "pap" at the end of the "authorize" section. The pap module > will see the 32-character hex string NT-Password, and convert it to > 16-character binary format, which the rest of the server needs. Wonderful!! That's obviously better...! :) Which encryption_scheme do I use? Stefan

2 1

lan users data accounting
by satish patel 11 Aug '07

11 Aug '07

dear all is there any radius or freeradius feature with accouting my lan users data means user authentication by lan and freeradius accouting that data $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Get the freedom to save as many mails as you wish. Click here to know how.

5 7

Steps on adding users
by Digital 11 Aug '07

11 Aug '07

Greetings Everyone, I am new to this site and extraodinary software, pls i have been able to install freeradius on my FreeBSD 6.2 and the freeradius is up and running the challenge i am facing now is i want to use Free radius to authenticate my users but don't know how. Pls anybody who can help me with the procedure i will be glad. Thank you --------------------------------- Yahoo! oneSearch: Finally, mobile search that gives answers, not web links.

1 0