- Freeradius-Users - lists.freeradius.org

SQL read_group patch - please apply!
by Roy Walker 27 Jul '07

27 Jul '07

FOR THE SAKE OF MY SANITY!!! Please apply the patch from http://readlist.com/lists/lists.freeradius.org/freeradius-users/2/10462. html, which was posted 3 and a half months ago! PLEASE, pretty please, with sugar on top! Thanks, Roy

2 1

Authorize after checking an LDAP attribute value
by Kenneth Marshall 27 Jul '07

27 Jul '07

Dear Freeradius users: I am trying to set up my authentication to allow only users with a particular value of a particular LDAP attribute to login. I am using freeradius 1.1.7 and I have the authentication going against Kerberos but I do not know how to have the radius server check the value of the attribute before allow access. If they are not in the group, it should send back the reject packet. Does anyone know how to perform a check item check against a particular LDAP attribute? Here is how I can set an attribute to the value and it works correctly: DEFAULT Auth-Type = Kerberos, NAS-IP-Address == 1.2.3.4, NAS-Port == 10 Connect-Info = "%{ldap:ldap:///dc=test,dc=com?testValue?sub?uid=%u}" Any suggestions would be appreciated. Regards, Ken Marshall

1 0

Openldap - Freeradius - auto vlan
by Fabio Silva 27 Jul '07

27 Jul '07

Hi all, i need to configure a system that works with openldap + freeradius and that assign the vlan automatic to the users... does anybody has any howto to do it? I read this one: http://www.freeradius.org/radiusd/doc/ldap_howto.txt but, the versions of the softwares is very old, and in some parts of the howto some options does not work. Regards, Fabio

2 2

Freeradius & Juniper
by J-P Raymond 27 Jul '07

27 Jul '07

Hi, small question I know my version is old but I didn't had any problem until recently ! I'm using freeradius 0.9.3 (mandrake 10) to authenticate pppoe users ! When a juniper equipment try to authenticate it fails! (most other brand succed) They told me the field order are not send in the good order... Here is the detail reason juniper gave me : Root cause found, it is caused by that peer side modifies the options order in REJ packet. RFC1661 requires we keep the order so we think the REJ packet is invalid and drop it. So PPP can not be brought UP. Could we contact the ISP to check how they software work? sending order : [DNS_S]-->[NBNS_P]-->[NBNS_S] : SEND DECODE:(ethernet0/0) ***[IPCP ConfReq ID=0x1 <ADDR 0.0.0.0> <DNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_P 0.0.0.0> <NBNS_S 0.0.0.0>]*** --------------------------------------------------------------- Receiving order, [NBNS_P]-->[DNS_S]-->[NBNS_S] RECV DECODE:(ethernet0/0) ***[IPCP ConfRej ID=0x1 <NBNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_S 0.0.0.0>]*** Can I do something about this rapidely Thanks for your help _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

3 2

radiusd startup problem
by ram 27 Jul '07

27 Jul '07

Hi all I have installed freeradius-1.1.6 with mysql when i run radiusd -X i get the following error rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" rlm_acct_unique: Cannot find attribute 'NAS-IP-Address' in dictionary radiusd.conf[1159]: acct_unique: Module instantiation failed. radiusd.conf[1753] Unknown module "acct_unique". radiusd.conf[1747] Failed to parse preacct section. any suggestions ram

3 10

SQLIPPool performance issue
by Roy Walker 26 Jul '07

26 Jul '07

I am having a problem with the SQLIPPOOL performance. This is migration of an existing radius server using flat user files (old server is running radius 1.1.0). Running freeradius-server-snapshot-20070705 on a P4 2.8GHZ machine Database is Postgres 8.1.9 running on a monstrous Sun Opteron machine. When radius starts taking requests (it's a lot of requests, about 500/sec), the load on the radius server spikes to 100 and it eventually stops taking requests completely. The database is never above 0.05 load. I see messages like these in the radius logs: Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696841693 port 0 user 14696841693) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19723023688 port 0 user 19723023688) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696845996 port 0 user 14696845996) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696846177 port 0 user 14696846177) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696825390 port 0 user 14696825390) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14694415538 port 0 user 14694415538) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696883664 port 0 user 14696883664) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 12149915071 port 0 user 12149915071) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19728908614 port 0 user 19728908614) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19723023948 port 0 user 19723023948) Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 102 due to unfinished request 3988 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 62 due to unfinished request 3987 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 116 due to unfinished request 3989 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 121 due to unfinished request 3990 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 26 due to unfinished request 3991 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 105 due to unfinished request 3992 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 74 due to unfinished request 3993 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 29 due to unfinished request 3994 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Auth: Login OK: [12146063348] (from client nas01 port 0 cli 12146063348) I have tried playing with the numbers of threads (I used the current radius servers setting to start) and the results are the same. Anyone have any ideas? Thanks, Roy

4 15

Freeradius Multiple VLAN assigment
by George Beitis 26 Jul '07

26 Jul '07

Hi everyone, does freeradius support multiple vlan assigment?

3 2

Fwd: final rlm_perl question, hopefully...
by FreeRadius-ML 26 Jul '07

26 Jul '07

Hi All, Ok, after reviewing all the information that was received, I've setup my FreeRadius as following: 1. The authorize and authenticate sections are setup to activate digest and perl. 2. My rlm_perl script utilizes the following lines in order to return the unencrypted user password back to FreeRadius for digest authentication: $RAD_CHECK{'Cleartext-Password'} = "xxxxxx"; # Remove this line for production $RAD_CHECK{'User-Password'}="xxxxxx"; # Remove this line for production I just put these inside my script for checking, later on this information will be retrieved from an external source. Now, FreeRadius activates my rlm_perl module, no problem, as I can see the various reply fields being setup, however, I'm still getting the following error: rlm_perl: RAD_REQUEST: Client-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: Digest-Response = 632905a2325f672f049800eda7df9ee4 rlm_perl: RAD_REQUEST: User-Name = z2l(a)192.168.2.80 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Sip-Uri-User = z2l rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0xbbc93f0) rlm_perl: RAD_REPLY: Reply-Message = User accepted by z2l WSDL rlm_perl: RAD_REPLY: z2l-Duration = 60 rlm_perl: RAD_REPLY: z2l-Status = 2 rlm_perl: RAD_REPLY: z2l-Session = 833abb3d-d047-4d0d-a40e-2e147049f96d rlm_perl: Added pair Reply-Message = User accepted by z2l rlm_perl: Added pair z2l-Duration = 60 rlm_perl: Added pair z2l-Status = 2 rlm_perl: Added pair z2l-Session = 833abb3d-d047-4d0d-a40e-2e147049f96d rlm_perl: Added pair Cleartext-Password = z2l rlm_perl: Added pair User-Password = z2l rlm_perl: Added pair Auth-Type = digest perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xb933260 modcall[authorize]: module "perl" returns ok for request 5 rlm_realm: Looking up realm "192.168.2.80" for User-Name = "z2l(a)192.168.2.80" rlm_realm: No such realm "192.168.2.80" modcall[authorize]: module "suffix" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [z2l(a)192.168.2.80/<no User-Password attribute>] (from client 192.168.2.80 port 5060) Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 3 seconds... Now, my configuration is very very simple. In the authorize I have digest and perl enabled, in authenticate I have only digest enabled. If I read the debug correctly, the authorization is going ok: modcall[authorize]: module "perl" returns ok for request 5 rlm_realm: Looking up realm "192.168.2.80" for User-Name = "z2l(a)192.168.2.80" rlm_realm: No such realm "192.168.2.80" modcall[authorize]: module "suffix" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 However, the authentication section fails: rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [z2l(a)192.168.2.80/<no User-Password attribute>] (from client 192.168.2.80 port 5060) So, I'm either returning something in the wrong way, or I've broken something again. Any pointers on the issue would be highly appreciated. Regards, Z2L

2 2

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 26/7/2007, "Nicolas Velazquez" <nicolas.velazquez at >uam.es> pie: > >>Hi, >> >>We are using freeradius 1.1.6, now, to provide >>access for our wireless network only. >>The accounting is very detailed and >>comprehensive: IP addresses, usernames, packets, roles, >APs, SSIDs, etc. >> >>Now, we are starting to use the same radius to >>give 802.1x access to our wired network. >> >>The key is that the accounting records for a wired switch >are VERY different. >>Now, AP and SSID, are nonsense items, for example. >>But we need another records. >> >>Can freeradius use different accounting sql inserts >depending on NAS? >> >>Is there any document showing something like this? >>I have read many documents but I can not find a clear >answer. >> >>This was the main question. >> >>A related tiny question is as follows. >>The most comfortable configuration will be to use >>different accounting inserts depending on huntgroups. >>Then we could select sql inserts for one >>huntgroup (all our wired NASes) and different sql >>insert for another huntgroup (all our wireless NASes). >>The addition, remove or change of the different >>NASes could be made modifying only the lists contained in >the huntgroups file. >>It could be very clean and useful. >>But, when I read the huntgroups documentation I >>have the strong suspect I can´t do this. >> >>Thank you very much in advance, >> >> Nicolas Velazquez >> > >

2 1

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

>Date: Thu, 26 Jul 2007 13:31:37 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: SQL and different accounting records by NAS >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <qI6MczRx.1185453097.0743660.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas

1 0