- Freeradius-Users - lists.freeradius.org

Freeradius 1.1.1: 'radclient' incorrect Authenticator value
by Robles Rodriguez,Alejandro 12 Jun '06

12 Jun '06

Hi, I'm using freeradius 1.1.1 and trying to performance test it using as client the 'radclient' utility program. I have been experiencing some problems when load testing it since freeradius was responding in some cases responding to the client with old (already sent) responses when in fact the request was different (Attribute-wise at least). ... rad_recv: Access-Request packet from host 10.66.20.20:36426, id=235, length=110 Sending duplicate reply to client localtest:36426 - ID: 235 Re-sending Access-Accept of id 235 to 10.66.20.20 port 36426 ... After struggling a bit I noticed that the Access-Requests sent by 'radclient' where all having the same Authenticator value for the same request ID (0-255). In some cases the cached reply was gone before the next request with the same Authenticator value came hence a brand new reply was generated however it became a problem otherwise (reply still in the cache). Have any of you guys noticed this problem and do you have a solution to it (besides changing the code)? My test files contain at least 1000 Access-Requests each therefore the IDs will be reused. I might be mistaken but one odd thing is that I see a comment in the code saying that if a request has already been used then it needs to make sure that the Authenticator value is unique. However I don't see that happening in the code actually ('radclient.c', function 'request_free'): /* * If we've already sent a packet, free up the old one, * and ensure that the next packet has a unique * authentication vector. */ if (radclient->request->data) { free(radclient->request->data); radclient->request->data = NULL; } Thank you! Regards, Alex.

2 1

Multiple LDAP authentication
by fvt3 12 Jun '06

12 Jun '06

Hi, Is it possible to authenticate off of one ldap server and/or off another ldap server. I have multiple ldap servers that freeradius server needs to authenticate off. If it is possible, how can I accomplish this? thanks... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

NAS Server Type
by Cliff Hayes 12 Jun '06

12 Jun '06

I am a new FreeRadius user and am attempting to switch to FreeRadius. I am trying to switch from clients.conf to the MySQL NAS table. There is a field named "type" which, per http://www.freeradius.org/radiusd/doc/README has one of the values below. However, when I call our primary carrier, they don't have that information and have never been asked that question. Is "type" a required field? 3Com/USR Hiper Arc Total Control usrhiper 3Com/USR NetServer netserver 3Com/USR TotalControl tc Ascend Max 4000 family max40xx Cisco Access Server family cisco Cistron PortSlave portslave Computone PowerRack computone Cyclades PathRAS pathras Livingston PortMaster livingston Multitech CommPlete Server multitech Patton 2800 family patton Thanks, Cliff

3 2

Stale sessions
by Stelio Gouveia 12 Jun '06

12 Jun '06

Im using the following configuration to handle sessions # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } My problem is that im getting Access-Reject packet every now and then (My users are logging in and out correctly... and my NASes are all up and functioning) According to this thread http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-March/04233… - radutmp must be enabled I have noticed that you cant rely on the sql method, even thou there is a simul_count_query! In my case when i encounter a stale session i set the AcctStopTime = AcctStartTime + AcctSessionTime. Although this seems to work most of the time, its not fool proof as can be seen in this case study: http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-June/054073… My question is why cant you rely on only the sql method? And what is the correct method to clean stale session when using the sql session handling?

2 1

Issues with sessions
by Stelio Gouveia 12 Jun '06

12 Jun '06

Using freeradius 1.0.2 with rlm_sql_postgres, all my users are defined in my DB and all my accounting is stored in this manner too. I have simultaneous-use set to 1. Only 1 user can login at a time! Let me present my case and then i will detail what i think is happening on my radius server. Firstly, my users have a problem when trying to login to my radius. Sometimes it lets then in first time, othertimes they need to try multiple times. So i tested the authentication by using the radtest tool locally with valid users on my system. Radius would respond with the following pattern: Access-Accept, Access-Accept, Access-Reject. (There has been some variations, but generally this pattern occured) When i do get a reject, radius spits out the "You are already logged in message". But i do notice that the reject radius reply from a radtest gives me a strange looking password [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 202 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=202, length=20 [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 206 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=206, length=20 [admin@rad ~]$ radtest trala(a)trala.com test localhost 1812 secret Sending Access-Request of id 210 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "test" NAS-IP-Address = test.radman.com NAS-Port = 1812 Re-sending Access-Request of id 210 to 127.0.0.1:1812 User-Name = "trala(a)trala.com" User-Password = "\205t\2673VxL\214\264\255\212Lmu\214\337" NAS-IP-Address = test.radman.com NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=210, length=20 Heres my # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # # See "Simultaneous Use Checking Querie" in sql.conf sql } *My system works for a bit if i uncomment radutmp. about 30 mins if i have 20+- users active* Alan if you out there please give me some pointers! Regards, the aspiring radman.

2 1

MYSQL error 1312
by vignesh 12 Jun '06

12 Jun '06

Hello all I am trying to use MySQL 5.0.19 Stored Procedure with Free Radius 1.1. This is my Procedure DELIMITER $$ DROP PROCEDURE IF EXISTS `radius`.`auth`$$ CREATE PROCEDURE `auth`(user1 varchar(100)) BEGIN SELECT id, UserName, Attribute, Value, op FROM radius.radcheck WHERE Username =user1 ORDER BY id; END$$ DELIMITER ; When I run this procedure from Query Browser the procedure runs fine but wen I run this procedure using Free Radius I get this error radius_xlat: 'CALL auth('202.80.61.42')' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: MYSQL check_error: 1312 received rlm_sql_getvpdata: database query error rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 is it some problem with the driver. What do u think is the problem Vignesh Bhaskar Novanet Technologies

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 50
by Gilbert Lo 12 Jun '06

12 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

How to implement traffic limit
by Radhika 12 Jun '06

12 Jun '06

Hi, I am new to freeradius server.I want to use traffic limit in Freeradius How do i do that? Curretly we are using cisco edge routers for our ADSL server to authenticate free radius server,For Dialup we are using sendmax for to transfer request to free radius server.Now i want to do a traffic limit on each users download limit.How do i proceed this in Free radius server?.What attributes i need to configure?.What i need to do on cisco routers side. Thanks for your help __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3

Re: Freeradius-Users Digest, Vol 14, Issue 49
by Gilbert Lo 12 Jun '06

12 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Prepaid billing using freeradius and rlm_counter/rlm_sqlcounter
by liran tal 12 Jun '06

12 Jun '06

Hey guys, I'd like to try and implement a solution for pre-paid accounts. The idea is that I'd be providing pairs of username/passwords to customers and these accounts will be set to N hours, after those N hours are used by the customer (the user has ran out of his N-hour time) the account will be disabled, i.e: freeradius would return an access-reject. I'm currently using FreeRADIUS 1.1.0 with mysql as the back-end on debian and I've read the manpage about rlm_counter and rlm_sqlcounter though the manpage is a bit low of information and examples. Could someone please provide me with an example of how to get freeradius configured to this solution? Thanks, Sincerly, Liran Tal.

3 3