- Freeradius-Users - lists.freeradius.org

conflict with other services?
by Hugh Messenger 20 Jul '07

20 Jul '07

This is a long shot, but if anyone has the time to read this, I'd appreciate any suggestions! I'm running FR 1.x on the same RHEL4 box that handles POP3/IMAP proxying (using 'perdition') and authenticated SMTP (using sendmail). I'm in the process of migrating from Funk/Juniper, so my other RADIUS servers are otherwise occupied. In the same general time frame I've been running FR on this box, we've started to notice random timeout problems when sending or reading mail. I've been trying to track this down for a month now, and I'm fresh out of ideas. The problem is so transient, only lasts a minute or so, so it's really hard to get a handle on whats happening. And its not as simple as it refuses all connections during that time . it's like (some) existing sessions get hung up, but new ones will work. And it doesn't effect all the people all the time. The machines has gobs of spare memory (only about 3GB of 8GB used) and cycles (I don't think I've ever seen the load average go over 2), even though it is fairly busy with mail. Maybe 40 or 50 concurrent POP3/IMAP proxy sessions and a dozen or so sendmails. The actual mailbox server the proxy talks to has similar amounts of headroom. The RADIUS load is negligible, just a dozen or so sectors of wireless users doing PPPOE. Call it a couple of dozen queries a minute or so. MySQL runs on another server, on the same gigabit switch, no network logjams anywhere. Local iostats show no disk bottlenecks anywhere. If it makes any difference, I run radiusd in -X mode, because it crashes when running as a service (valgrind showed Bad Things happening). About the only thing I can think of which the mail and RADIUS have in common is that they all use PAM/winbind to authenticate against a Windows AD. I have heard about issues with PAM, mostly reports of memory leaks, but it has always worked perfectly for me. This box has been running for about 18 months without a reboot. Until last week, when I tried the Big Stick approach, but the problem is still there after a reboot. My next step is to switch RADIUS over to using ntlm_auth instead of PAM/winbind. It already does ntlm_auth for MSCHAP requests, it's only the plain text that uses PAM. I initially configured it to use PAM because I couldn't get ntlm_auth to work outside of MSCHAP, using clear text, but I may have solved that one. Anyway . if nothing else, I'll let you know how it goes, in case someone with the same problem ever googles into this. -- hugh

3 3

Proxy - Stop Responding
by Keiko Higa 20 Jul '07

20 Jul '07

Good Afternoon, I have a Freeradius (1.1.5) running on a server (1G RAM, double processor) as a Proxy Radius, on a production enviroment to AAA VOIP calls. At peak hours, the Radius stop responding. I cannot see any message on the log, just stop working. I have to kill/load manually in order to work again. Then, it appeared a message: "Error: Error receiving packet: Interrupted system call" I disabled all the logs (detail, pre_proxy_log, post_proxy_log), authorize/authenticate (chap, pap, etc), tunning some parameters like max_requests, thread pool, cleanup_delay, etc. Not running exec, hostname_lookups = no, etc.. Nothing special. The only thing I configured is: preproxy_users (in order to change de NAS-IP-Address), suffix (to identify the realm). At peak hours, one of the radius (behind the proxy) takes up to 14 seconds to answer. When it happens, there's a message in the logs like "Dropping conflicting packet from....". But not always, I mean, sometimes Radius stops working but there's no delay. So, what's going on?...Can somebody help me? Just in case, these are the values for most of the parameters: max_request_time = 20 delete_blocked_requests = no cleanup_delay = 2 max_requests = 2560 thread pool { start_servers = 10 max_servers = 50 min_spare_servers = 10 max_spare_servers = 10 max_requests_per_server = 250 } instantiate { } authorize { preprocess suffix } authenticate { } preacct { preprocess acct_unique suffix } accounting { } session { } post-auth { } pre-proxy { files } post-proxy { } Thanks in advance, Keiko. _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

1 0

Accept authentication from a list of equipments
by nicolaskarp＠free.fr 20 Jul '07

20 Jul '07

Hello Everybody, We have several network equipments with radius athentication. We want to limit the access to several administrators. We use a radius-proxy and a radius server with a LDAP base. For example : We have two NAS : NAS1 and NAS2 Two groups of users USERS1 and USERS2 in the LDAP base. USERS1 can access to NAS1 and USER2 can access to NAS2. Proxy configuration : ** clients.conf ** NAS1 { hostname = NAS1 secret = NAS1_SECRET } NAS2 { hostname = NAS2 secret = NAS2_SECRET } ** proxy.conf ** realm null { type = radius authhost = radius_server accthost = radius_server secret = RADIUS_SECRET } Radius_configuration : ** HUNTGROUP ** cisco NAS-IP-ADDRESS = IP_PROXY ** USERS ** DEFAULT Huntgroup-Name == cisco, instance_openldap-Ldap-Group == ??? USERS1 or USER2 ??? # It's USERS1 for NAS1 and USER2 for NAS2, but the proxy rewrite the NAS_IP_Address by its address :( I can't differenciate the NAS_IP because it's the PROXY IP. How can I do differenciate these equipments ? For information, My equipments are Cisco equipment. Thanks for your assistance ! Nicolas.

2 1

Help(1.1.3): How to enable EAP-TTLS?
by Govardhana K N 20 Jul '07

20 Jul '07

Hi, I was able to enable EAP-TTLS in eap.conf file. After sending an Access-Request with EAP-Identity response, using "radeapaclient", an Access-Challenge (with EAP-Type = 21) was received from the server. Immediately after receivng the challenge the client is terminating. What configuration should be done so that client (radeapclient) responds to the challenge properly? -- With Regards, Govardhana K N

3 4

Second level authentication..
by ashish verma 20 Jul '07

20 Jul '07

Hi Ivan, What i meant is you type "enable" but the password you give should be authenticated by RADIUS server not the "enable password stored on the device". I am not sure whether it is possible or not. But just wanted to know from the experts. Thanks, Ashish On 7/19/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Second level authentication. (ashish verma) > 2. Re: Second level authentication. (tnt(a)kalik.co.yu) > 3. Re: TLS cant connect ldap+freeradius+novell (tnt(a)kalik.co.yu) > 4. Re: Quirky question about rewriting usernames (Cliff Cole) > 5. Re: Second level authentication. (Claudiu Filip) > 6. Re: TLS cant connect ldap+freeradius+novell (Martin G) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 19 Jul 2007 22:21:30 +0530 > From: "ashish verma" <ashish.scit(a)gmail.com> > Subject: Second level authentication. > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <11b554120707190951xff545a5j9cb83a1a9b31835d(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Stefan, > > I read the document and thanks for giving the link, that was helpful. > > Well I think i put my question in a wrong way. > Let me put it in a different way. > > I dont want the user to go directly in priv mode. > through priv level = 15 we direclty get into priv level right. > > what i am looking for is first the user get into user level and then with > another > password in level 2. (not with enable password)..it should be through > RADIUS > server. > > > Ashish >

4 3

Upgrading from 0.9.3 to 1.1.3 or 1.1.6
by Nico Schottelius 20 Jul '07

20 Jul '07

Hello! I tried to move our current freeradius 0.9.3 with mysql to a new machine running either 1.1.3 or 1.1.6 with postgresql. Converting the data was no big deal. But then I recognized that the sql.conf has wrong quoting for postgresql (was mysql specific). Corrected that. But now I've another problem: When testing, it showed that the queries from 1.1.3 do not fit for the tables I've imported from 0.9.3. Question: - Can I convert the db automatically? - Are the changes somewhere documentated, so I could convert the db manually? Sincerly Nico

4 8

Adding a ldap.attrb Dialuppassword to radius-ldap.schema
by "Jóhann B. Guðmundsson" 20 Jul '07

20 Jul '07

RHEL5/FreeRadius freeradius-1.1.3-1.2.el5/Fedora Directory server. Scenario... Currently trying to move all our dial up user entry's from users file to ldap ( FDS ) and need to add an attribute in radius ldap schema which would contain clear text password of the dial in password for the dial up users and match the dial in password to that password instead of users login password. What needs to be done to make this possible if it is possible? ( user are already authenticated through ldap except for their adsl dial in passwords which are in clear text and even if the passwords weren't in clear text and they could use there login password to login the user ain't smart enough and or technology challenge ( or at least majority of them ) to know if they change they're login password they needed to change it in the adsl router as well ) Schema changes? Dictionary changes ldap.attrmap changes ldap changes in radiusd.conf? ( password_attribute already mapped to userPassword in the ldap section ) Best regards Johann B. -- Johann B. Gudmundsson. RHCE,CCSA Unix System Engineer. IT Management. Reiknistofnun University of Iceland. Taeknigardi, Dunhaga 5. Email: johannbg(a)hi.is IS-107 Reykjavik. Phone: +354-525-4267 Iceland. Fax: +354-552-8801

2 1

Second level authentication.
by ashish verma 20 Jul '07

20 Jul '07

Hi Stefan, I read the document and thanks for giving the link, that was helpful. Well I think i put my question in a wrong way. Let me put it in a different way. I dont want the user to go directly in priv mode. through priv level = 15 we direclty get into priv level right. what i am looking for is first the user get into user level and then with another password in level 2. (not with enable password)..it should be through RADIUS server. Ashish

5 4

Quirky question about rewriting usernames
by Cliff Cole 19 Jul '07

19 Jul '07

Hello all. Here is my issue. This is very weird and would only affect one NAS. I'm not sure freeradius is capable of this. I want a username that comes in to check for an @domainname. If the domainname is there I want it to be stripped and added back later. If the domainname is not there I'd like it to continue and have to domainname added later in the authentication process. I hope this makes sense and any help is appreciated Cliff

3 5

RadiusClient
by Sofia Silva 19 Jul '07

19 Jul '07

I'm trying to authenticate a linux client against a radius server. I've implemented the radius server with freeradius and i've tested it with a cisco client and it worked, but, unfortunately, i'm having seriuos problems to authenticate the linux client using RadiusClient. I'm running the server in debug mode and when i run <radiusclient "User-Name = testuser Password = testuser"> the password the server shows it's not plain text, it's sth like "\211pe;\336....." so i thought it could be a problem with the secret word. However, i've checket it in the "servers" file (at the client) and in the "clients.conf" file (at the server) and it's the same. Sth i found is that i don't seem to have the file radius.seq in /var/run, i would like to create it but i don't know what the sequence number is and i don't know what the format of the file should be. I'd appreciate it a lot if sb could help me Sofia _________________________________________________________________ ¿Cuánto vale tu auto? Tips para mantener tu carro. ¡De todo en MSN Latino Autos! http://latino.msn.com/autos/

1 0