- Freeradius-Users - lists.freeradius.org

rlm_proxy problems
by Geoff Silver 15 Aug '06

15 Aug '06

I'm running FreeRadius 1.1.0 on Red Hat Linux, and appear to be running into an issue where heavy load causes rlm_proxy to stop responding. If I restart radiusd, authentication will be properly proxied for 15-30 seconds, at which point I see incoming Access-Request messages logged, but I don't see any Access-Request messages being send to the backend server, and I don't see any Access-Accept or Access-Reject messages (or I see a few Access-Reject messages which appear to come from my proxy server, as there is no Reply-Message attribute set in them). One of the most difficult problems I'm seeing is that while this is happening in production, it's NOT happening when I run radclient a half dozen times in parallel against radiusd, so it's *very* difficult to re-create outside of production. Restarting radiusd solves the problem for 15-30 seconds. Pointing lightly-loaded NASes at radiusd works fine - it's only the NASes which have hundreds of simultaneous logins that auth frequently enough to cause this issue. My proxy.conf looks like: proxy server { synchronous = no retry_delay = 5 retry_count = 1 dead_time = 300 default_fallback = yes post_proxy_authorize = yes } realm BackendAuth { type = radius authhost = radius.vip.domain.com:1812 secret = ThisIsNotMyRealSecret } I've attached some logs for review. What I see is a valid auth at 14:39:59-14:40:01, but then a failing one at 14:40:08. Note that the SI_radius_keepalive packets are from our VIPs which are doing health checks, so they are expected to fail, but any other usernames should work. Aug 15 14:39:59 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "junyi2000", User-Password = (hidden), NAS-Port = 26300, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "66.218.46.114", Tunnel-Client-Endpoint:0 = "66.218.46.114", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:01 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "junyi2000", User-Password = (hidden), NAS-Port = 26300, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "66.218.46.114", Tunnel-Client-Endpoint:0 = "66.218.46.114", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Realm = "UAS", Client-IP-Address = 10.180.203.7, Aug 15 14:40:01 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Accept, User-Name = "junyi2000", Class = 0x6c49755a5754477631786d45474d736c4d376b78475068396b43673d, Account-Flags = 553680896, Connect-Info = "AOLOFFICE", User-Name = junyi2000, Client-IP-Address = 10.180.203.7, NAS-IP-Address = 10.180.203.7, NAS-Port = 26300, Aug 15 14:40:07 205.188.188.212 radiusd-auth[6509]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), Service-Type = Dialout-Framed-User, NAS-IP-Address = 205.188.188.250, Client-IP-Address = 205.188.188.250, Hint = "Port-1812", Aug 15 14:40:07 205.188.188.212 radiusd-auth[6509]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 205.188.188.250, NAS-IP-Address = 205.188.188.250, NAS-Port = , Aug 15 14:40:08 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "nsitton", User-Password = (hidden), NAS-Port = 26302, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "69.228.216.95", Tunnel-Client-Endpoint:0 = "69.228.216.95", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "Port-1645", Huntgroup-Name = "Office", Aug 15 14:40:08 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Reject, User-Name = nsitton, Client-IP-Address = 10.180.203.7, NAS-IP-Address = 10.180.203.7, NAS-Port = 26302, Aug 15 14:40:08 152.163.209.142 radiusd-auth[23725]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), NAS-IP-Address = 152.163.209.154, Client-IP-Address = 152.163.209.154, Hint = "Port-1812", Aug 15 14:40:08 152.163.209.142 radiusd-auth[23725]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 152.163.209.154, NAS-IP-Address = 152.163.209.154, NAS-Port = , Aug 15 14:40:09 64.12.153.209 radiusd-auth[4826]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), NAS-IP-Address = 64.12.153.218, Client-IP-Address = 64.12.153.218, Hint = "Port-1812", Aug 15 14:40:09 64.12.153.209 radiusd-auth[4826]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 64.12.153.218, NAS-IP-Address = 64.12.153.218, NAS-Port = , Aug 15 14:40:16 64.12.186.46 radiusd-auth[26637]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), NAS-IP-Address = 64.12.186.58, Client-IP-Address = 64.12.186.58, Hint = "Port-1812", Aug 15 14:40:16 64.12.186.46 radiusd-auth[26637]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 64.12.186.58, NAS-IP-Address = 64.12.186.58, NAS-Port = , Aug 15 14:40:18 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "karenc876", User-Password = (hidden), NAS-Port = 26303, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "65.120.79.33", Tunnel-Client-Endpoint:0 = "65.120.79.33", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:19 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "donaldknight11", User-Password = (hidden), NAS-Port = 26305, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "66.208.64.157", Tunnel-Client-Endpoint:0 = "66.208.64.157", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:22 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "alemoyamx", User-Password = (hidden), NAS-Port = 8537, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.128.7", Calling-Station-Id = "207.248.229.111", Tunnel-Client-Endpoint:0 = "207.248.229.111", NAS-IP-Address = 10.178.197.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.178.197.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:23 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "swxdan", User-Password = (hidden), NAS-Port = 26306, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "208.255.178.130", Tunnel-Client-Endpoint:0 = "208.255.178.130", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "Port-1645", Huntgroup-Name = "Office", Aug 15 14:40:23 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Reject, User-Name = swxdan, Client-IP-Address = 10.180.203.7, NAS-IP-Address = 10.180.203.7, NAS-Port = 26306,

2 1

RE: authenticating based on Nas-Port-Id
by Colm Ennis 15 Aug '06

15 Aug '06

hiya, does anyone know if users/sql authentication based on the NAS-Port-Id field possible? and if so how? thanks for your help, colm > -----Original Message----- > From: Colm Ennis > Sent: 26 July 2006 15:00 > To: freeradius-users(a)lists.freeradius.org > Subject: authenticating based on Nas-Port-Id > > > hi, > > i been using freeradius fastuser based authentication for several > thousand adsl customers for the last year or so now and it has > proved extremely reliable. > > in order to simplify customer setup and minimise lost password > support etc id like to start authenticating users based on > NAS-Port-Id rather than User-Name. (the dslams/basen we use > support populating NAS-Port-Id with the dslam/frame/slot/port). > > i am also working on migrating to a mysql authentication backend. > > so, does anyone have any tips on setting up NAS-Port-Id based > authentication with users/fastusers/sql? i hope to permit the > user to use any username/password combination. > > thanks for your help and an excellent radius server, > > colm >

2 1

Limit Number of Authentication Attempt
by fvt3 15 Aug '06

15 Aug '06

Hi, I have clients constantly trying to authenticate off of freeradius after being rejected. How do I set freeradius to deny or timeout a user from authenticating after three attempts? This is authenticating off mysql database . I am not exactly sure if the change is in sql.conf or radiusd.conf. Thanks in advance... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Accounting Update packets
by Michael da Silva Pereira 15 Aug '06

15 Aug '06

Hi, I have a cisco PDSN sending me accouting update packets every 10minutes, This packet is also sent to the servers which I have realms with. I don't want these update accounting packets to be send to the realm server. Is there any way only to allow the start and start accounting packets to the realm servers? Thanks, Michael da Silva Pereira

2 1

Comments problem in huntgroups file
by Thomas BAUDELET 15 Aug '06

15 Aug '06

Hello, I have problems when I comment the file huntgroups like this: (comments on the third column) Switchs NAS-IP-Address == 10.195.132.7 # test Switchs NAS-IP-Address == 10.195.132.8 # testbps2000 Switchs NAS-IP-Address == 10.195.132.9 # test450 I get the following error: /home/radius/freeradius/etc/raddb/huntgroups[47]: Parse error (check) for entry Switchs: dict_init: /home/radius/freeradius/share/freeradius/dictionary.versanet[36]: Names for VALUEs cannot start with a digit. rlm_preprocess: Error reading /home/Rzoadm/radius/freeradius/etc/raddb/huntgroups radiusd.conf[1011]: preprocess: Module instantiation failed. radiusd.conf[1764] Unknown module "preprocess". radiusd.conf[1754] Failed to parse authorize section. There is no error anymore when I add a comma before the commentary like this: Switchs NAS-IP-Address == 10.195.132.7 ,# test Switchs NAS-IP-Address == 10.195.132.8 ,# testbps2000 Switchs NAS-IP-Address == 10.195.132.9 ,# test450 How to add comments at the end of a line ? I don't want to have a file like this: # test Switchs NAS-IP-Address == 10.195.132.7 # testbps2000 Switchs NAS-IP-Address == 10.195.132.8 # test450 Switchs NAS-IP-Address == 10.195.132.9 Thanks a lot for your answers, Thomas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. **********************************************************************

2 1

Passing Radius attribute to Cisco 7304
by John Williams 15 Aug '06

15 Aug '06

Hi all We’ve just upgraded to a Cisco 7304 from a Cisco 7204 and are seeing some problems -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.10.9/417 - Release Date: 11/08/2006

2 5

AAA Authentication in PIX using Freeradius
by ajay raut 15 Aug '06

15 Aug '06

Hi, I have implemented freeradius for PIX525 as a authentication server. Radius is running fine in authenticating users, who wants the console access of PIX. In AAA Authentication i have configured FALLTHROUGH for RADIUS as a LOCAL Database means whenever RADIUS service goes down authentication of PIX will taken care by Local database of PIX. That is also working fine except one problem, At the time of testing FALLTHROUGH , I stopped Radius service and try to authenticate PIX using Local Database that worked fine but when i again started the RADIUS service PIX is still taking authentication from LOCAL database. After 10 min. PIX succefully falling back on RADIUS for authentication that means there is atleast 10 min. of delay to again start the Authentciation from RADIUS in PIX. I have tried different IOS of PIX for this, still it is giving the same problem that means IOS of PIX is not the problem inthis case. Any input from the members of this list will be helpful for me as it is my last ray of hope now........ Thanks & Regards, Ajay --------------------------------- Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates starting at 1¢/min.

2 1

access reject replies
by Hasan Ovuc 15 Aug '06

15 Aug '06

Hello Members, I am using FR-1.0.1, unixODBC 2.2.11, Sybase ODBC-12_5 drivers on FC5. I have problem version of FR because of I couldn't upgrade it. New versions of FR does not send cisco attributes in access reject replies. I can only work with FR-1.0.1. I want to the attribute Cisco AVPair += -1 in access reject reply like below sample. Has anyone any thought ? Related setting in my sql.conf; authorize_reply_query = "EXEC ra_authentication_reply '%{SQL-User-Name}', '%{User-Password}', '%{Called-Station-Id}'" Return of Sample Query SQL> EXEC ra_authentication_reply 'A02165554149', '1', '' +------------+-------------------------------+-------------------------- ---------------+-----------------------------------------+---------+ | | | query_attribute | query_value | query_op| +------------+-------------------------------+-------------------------- ---------------+-----------------------------------------+---------+ | -1 | A02165554149 | Cisco-AVPair | h323-return-code=1 | += | +------------+-------------------------------+-------------------------- ---------------+-----------------------------------------+---------+ SQLRowCount returns 0 1 rows fetched SQL> Thank you, Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

4 3

Authorisation chaining
by Héctor Alberto Ortiz Barrón 15 Aug '06

15 Aug '06

(Hopefully this one will go through) Hi, I've been playing around with FreeRadius for a bit and was wondering if it is possible to have an authorisation chain, something like: My first Auth method is using certificates, if this method fails, try to auth using login/passwd with mysql, and if this second method fails, try using a script of my own, and if this very last method fails, then reject the client. By separate parts it works. I have one radiusd.conf file for certificates, another one for mysql and a last one for my script. The problem comes when I try to merge those methods. Right now I'm experimenting with MySQL + MySCRipt, then I provide random user/passwd in order to cause MySQL auth to fail and to grant access through my script. MySQL says "user not found", my script says "ok" and eap says "nope" and rejects. Is there a way to do this? Thanks in advance Cheers Hector

1 0

Limiting Bandwidth Usage !?!?
by Calode 15 Aug '06

15 Aug '06

1 0