- Freeradius-Users - lists.freeradius.org

3Com-User-Access-Level Not Applied
by Alexandre Soares 20 Jan '07

20 Jan '07

Hi All, I using the freeradius version 1.1.4 + a switch 5500-EI from 3Com to apply a resource called switch login. But the attribute 3Com-User-Access-Level is not applied after Authorization processes to valid user, the dictionay used is correct and configuration too, see in attach file, please help me. thks

3 11

rate-limit entry in mysql
by satish patel 20 Jan '07

20 Jan '07

dear all I have tested rate-limit with user file but whn i was try it with mysql but i didnt get respond it is not working with mysql is any op code for it or any special configuartion for this URGENT my mysql entry is mysql> select * from radgroupcheck; +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ | 1 | 64KB | Simultaneous-Use | = | 1 | | 2 | 64KB | Cisco-Avpair | := | \"lcp:interface-config#1=rate-limit output 128000 10000 10000 conform-action continue exceed-action drop\" | +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ i have test it with diff , diff op code = := == += but it is not working :( Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: Best practices for redundant servers
by Aaron Paetznick 19 Jan '07

19 Jan '07

Thanks, this was helpful. I would rather not use LVS. I would prefer to use the built-in functionality of the NAS to fall back from a primary to secondary or tertiary auth/accounting servers. This whole setup would be far simpler and more robust if I could just do master-master replication with the MySQL servers. Oh well. I was not aware of radsqlrelay. I think this gets me closer to what I need than anything else. I can't guarantee which server the NAS will choose to log to at any given time. Therefore, I may need to use radsqlrelay on each server to keep the others in sync. Does this seem like a sensible plan? --Aaron Nicolas Baradakis wrote: > Aaron Paetznick wrote: > >> I've been struggling with this problem for a couple of weeks, and I >> thought I'd pass it along to the mailing list. Basically I'm trying to >> answer the following question. Given multiple identical dedicated >> servers each running Linux and MySQL, how can I configure FreeRADIUS for >> maximum stability, reliability, and performance? The question, it >> seems, is not as easy as is sounds. > > I've already setup FreeRADIUS on multiple redundant servers, but never > had the time to write a HOWTO. The main guideline is: > > 1. Use LVS in a "direct routing" setup to dispatch the RADIUS requests. > http://www.linuxvirtualserver.org/VS-DRouting.html > > 2. Use MySQL replication for the authorize database, so each FreeRADIUS > server connects to a local, read only database. > http://dev.mysql.com/doc/refman/5.1/en/replication.html > > 3. Use radsqlrelay for the accounting database, so the accounting data > is written to a central database without slowing down the RADIUS > servers. radsqlrelay is to be found in the FreeRADIUS source tarball, > you could read the "rlm_sql_log" and "radsqlrelay" manpages for more > details. >

8 10

CA Dir
by Jeffrey Sewell 19 Jan '07

19 Jan '07

In the eap.conf, tls section, the comments say to use the 'CA_path' variable in the radiusd.conf file to indicate where the trusted CA chain will reside. However, this variable isn't in the tls section of the radiusd.conf (it is in the LDAP section, but I'm pretty sure that won't help me) file or the eap.conf file (where I thought it might have moved). As an experiment, I added it to eap.conf and it loaded ok with the following output: tls: CA_path = "/usr/local/etc/raddb/certs/rootCA" ... tls: CA_file = "(null)" Unfortunately the CA_file is the imporant one as I discovered when I tested the link: Fri Jan 19 09:51:05 2007 : Error: TLS Alert write:fatal:unknown CA So where is the appropriate place for the root chain? --Jeffrey

1 0

Restrict Password from detail file , accounting
by Ellis, Scott 1 (N-Comptel Inc.) 19 Jan '07

19 Jan '07

Is there a way to eliminate the password from being written to the accounting log files? Either not in clear text or altogether? I know that read access is restricted to Root access only.

3 4

Freeradius - Chillispot - ??? for WLAN + terminal-access
by Jens Meyer 19 Jan '07

19 Jan '07

Hi! I am looking for a small hotspot-solution (and found Freeradius + Chillispot - great!). But I want to connect (authenticate) 2-3 LAN-Kiosk-terminals (wired) additional (small Internet-Cafe). I found your description of "NAS"/"RAS" in the WIKI but I can't find any solution for this on the net. Is it possible to do this with Chillispot, too? Have you any tipps for me for this kind of setup? Any hint would be great - thank you! Kind regards, Jens

1 0

One question about Access-Request packet
by Rafał Kamiński 19 Jan '07

19 Jan '07

Hi, i have one question: Why when i try auth. by laptop-wifi over linksys then it's send that request: rad_recv: Access-Request packet from host 192.168.1.245:3072, id=0, length=119 User-Name = "rka" NAS-IP-Address = 192.168.1.245 Called-Station-Id = "001217694588" Calling-Station-Id = "0014a41e7112" NAS-Identifier = "001217694588" NAS-Port = 61 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000801726b61 Message-Authenticator = 0x794e9d729e673a6c41b875855ae5a464 Request without User-Password -> and that is problem with auth. When i try auth. over lan my PC send request: rad_recv: Access-Request packet from host 10.44.3.15:62963, id=66, length=55 User-Name = "rka" User-Password = "qazwsxedc" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 And the auth. is correct. Where is the problem? Maybe with Linksys? This is WPA54G. Thanks a lot for help BR, -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

4 5

EAP-TLS certificate question
by kemas 19 Jan '07

19 Jan '07

Hi all, I've install freeradius-1.1.3,use it with AP Aironet 1100 doing EAP-TLS and works very well. I still confuse about certificate, is all client certificate created under 1 root ca, can be authenticated against freeradius that started with different server certificate? is it possible to set things like this root ca ------------ / | \ / | \ / | \ server1 server2 server3 ------- ------- ------- | | | | | | client1 client2 client3 I don't want client1 to be authenticated against server2 or server3. thanks

3 3

rlm_eap: Failed to link EAP-Type/peap: rlm_eap_peap.so:
by María Félix Rodríguez 19 Jan '07

19 Jan '07

Hi, At first, sorry for my english, (I'm spanish :). I've just installed freeradius, and I would like to use PEAP-MS-CHAP authentication, I've configured needed files, and when I try to start freeradius, with the debug option, y receive this messages: tls: private_key_file = "/ca/key_radius.pem" tls: certificate_file = "/ca/cert_radius.pem" tls: CA_file = "/ca/cacert.pem" tls: private_key_password = "radius" tls: dh_file = "/ca/dh" tls: random_file = "/ca/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: Failed to link EAP-Type/peap: rlm_eap_peap.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed. linux:/lib # I don't have too much experience in linux enviroments (this is a Suse Interprise Server 9), and I don't have idea about what is happening. I would need some kind of help, please. Thanks a lot !!! María.

3 2

Re: Freeradius-Users Digest, Vol 21, Issue 58
by Mike 19 Jan '07

19 Jan '07

> Mike wrote: > > All, > > When trying to use the "radauth" tool from nagios to monitor > > freeradius, I get the following in the freeradius log: > > > > Error: WARNING: Malformed RADIUS packet from host ... too long (length > > 18432 > maximum 4096) > > > > radtest seems to be ok. has anyone else experienced this or knows > > what is wrong? > > I haven't seen it. I note that 18432 is hex 0x7200. I suspect that > the NAGIOS people missed a 'htons()' somewhere, and the field should be > 0x0072. Alan, You are exactly correct. Good catch. For mailing list archives, the simplest patch I came up with: /* copy the first 20 bytes of the radius header. this size is static * per RFC. */ radhead->rad_length = htons(radhead->rad_length); memcpy(packet,(char *)radhead,20); radhead->rad_length = ntohs(radhead->rad_length); rad_length is used elsewhere, so this is done to avoid breaking anything else. Thanks for your help! (I wonder how this always worked for xtradius from the same machine?)

2 1