- Freeradius-Users - lists.freeradius.org

Lawrence Billson has left Transurban
by Lawrence Billson 02 Jun '06

02 Jun '06

I will be out of the office starting 02/06/2006 and will not return until 12/12/2008. Please send personal messages to lawrencebillson(a)yahoo.com.au. For all business related matters, please contact Jeremy Forrester at jforrester(a)transurban.com.au. Cheers, Lawrence Privileged/Confidential information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail or by telephone on (03) 9612-6999 or +61 3 9612-6999. Please advise immediately if you or your employer does not consent to Internet e-mail for messages of this kind. Opinions, conclusions and other information in this message that do not relate to the official business of Transurban Limited or any companies within the Transurban Group shall be understood as neither given nor endorsed by them.

1 0

suppressing outbound leg on ipipgw
by vignesh 02 Jun '06

02 Jun '06

hello all i am using cisco ipipgw and free radius. for a single call i get 2 records. one for each leg. now i want to supress one of the leg mostly outbound. i cant use gw-accounting suppress as both the legs are voip. i even tried voice class aaa accounting suppress outbound leg but still no luck any idea guys how can i do this. thanks in advance Vignesh

1 0

unresponsive / radiusd - X versus rc.radius start
by WI Cricket 01 Jun '06

01 Jun '06

Hello, I just joined the list. This is my first post. I tried to review the archives for something similar but I am not sure if I did find a way around it. First, is there a difference running FreeRadius using: rc.radiusd start versus radiusd -X Here is my set-up. I have two winXP supplicants using TLS for authentication and one W2K using TTLS-MS-CHAPv2. My FreeRadius is running on SuSE Linux 10 and my NAS is Linksys WRT54GS running 4.71 + HyperWRT + Thibor15c (this make not make any difference) Anyway, what is happening is that all the supplicants seem to work well using radiusd -X, however the freeRadius server seems unresponsive after a few hours of running it with rc.radiusd start. Please let me know if anyone sees an immediate issue with my setup or I can provide more information if need. I am running 1.1.2 of FreeRadius. Thank you all for your support and this great software.

1 0

RE: Server Specs
by King, Michael 01 Jun '06

01 Jun '06

> -----Original Message----- > > It's about 200-500 simultaneous authentications. > > What do you mean by that? Authentications per second? Yes. > > > I'm guessing 1ghz of cpu, 512MB of RAM, and 30gig of HD. > Suggestions, > > comments, criticisms? > > That should be lots. Cool.

1 0

Server Specs
by King, Michael 01 Jun '06

01 Jun '06

We're going to be setting up a few new FreeRADIUS servers on virtual hardware. The server admin is asking me what I need for specs. (Virtually, they can allocate whatever I need) It's about 200-500 simultaneous authentications. (This is my prediction for the next 4 years, we're about 10 right now). Using NTLM-auth to talk to Active Directory, and performing PEAP. I'm guessing 1ghz of cpu, 512MB of RAM, and 30gig of HD. Suggestions, comments, criticisms?

2 1

processes invoked goes <defunct>
by Fabio 01 Jun '06

01 Jun '06

Hi, I am using freeradius 1.0.5, configured so that when a user fails the password for X times, a mail is sent to a sysadmin. I have added the following to modules section: exec accept_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} accept %{FreeRADIUS-Proxied-To}" input_pairs = request } exec reject_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} reject %{FreeRADIUS-Proxied-To}" input_pairs = request } and this is my posth-auth section: post-auth { accept_notify Post-Auth-Type REJECT { reject_notify } } radius_reject_notify is the bash script attached. However, when a user log in and the script is executed, I see that the script remains in a <defunct> state. After some time I see hundreds of such processes: Output of ps -e: 13110 ? 00:00:00 radius_reject_n <defunct> 13232 ? 00:00:00 radius_reject_n <defunct> 13233 ? 00:00:00 radius_reject_n <defunct> .... Has someone idea why freeradius does not close correctly my script? Thanks, Fabio radius_reject_notify: #!/bin/bash # #Sintax: # #mail_notify user access type # user: user name # access: accept or reject # type: accepted only if ( == FreeRADIUS-Proxied-To ) == 127.0.0.1 # # TRY: number of retry TRY=10 FAILED_USERS_DIR=/tmp/radius_user_fail/ MAIL_ADMINS="admin(a)domain.com" USER_RETRY=0 CURRENT_USER=$1 ACCESS=$2 failed() { mkdir -p $FAILED_USERS_DIR if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then USER_RETRY=`cat $FAILED_USERS_DIR/$CURRENT_USER` fi USER_RETRY=$(( USER_RETRY + 1 )) echo $USER_RETRY > $FAILED_USERS_DIR/$CURRENT_USER if (( USER_RETRY == $TRY )) then #Limit exceded! send_mail fi ; } success() { if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then rm -f $FAILED_USERS_DIR/$CURRENT_USER fi } send_mail() { HOSTNAME=`hostname` env MAILRC=/dev/null from=radius.admin@$HOSTNAME smtp=smtp.domain.com nail -n -s "RADIUS - Autentication failed $TRY times" $MAIL_ADMINS <<-END $CURRENT_USER failed authentication for $TRY times. END } case $3 in '127.0.0.1') case $ACCESS in 'accept') success ;; 'reject') failed ;; esac ;; esac

2 1

Auth-Type = Reject not 'working'
by A.L.M.Buxey＠lboro.ac.uk 01 Jun '06

01 Jun '06

hi, the recent post mentioning Auth-Type = System reminded me.... if I've got a Auth-Type = Reject int he users file, then when making a request with a remote RADIUS client, then the request times out when freeradius is running as a normal process daemon... on Fedora, this is running as a service with the '-y' option... however, this timeout is variable..and sometimes...just sometimes it works. however, when running freeradius is debug mode, with -X, the Reject reply message is pretty fast...though still a lot slower than an Access-Accept message for a valid user - even though the valid user is in a database or a kerberos check. I assumed that a Auth-Type := Reject was an instant hit, with no further procedures... why then, when run in debug mode, does FreeRADIUS happily reject the client request but when run as a normal process, it throws the request towards other Auth mechanisms? alan

3 3

RE: Re: freeradius 1.1.1 and mysql issues
by simon＠434canada.com 01 Jun '06

01 Jun '06

Hi, I have tried reordering the elements in the radiusd.conf file so that the database is tried first, and then commented out the section to check the users file, and I am still having the same issues. Here is the output again: Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.1:1320, id=0, length=123 User-Name = "simon" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173696d6f6e Message-Authenticator = 0x68b3f01e605eb032281dd6c99dfd9e52 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "simon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'simon' rlm_sql (sql): sql_set_user escaped user --> 'simon' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [simon/<no User-Password attribute>] (from client linksys-434 port 56 cli 0013ce29c6d7) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.1.1 port 1320 Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 447ef7e2 Nothing to do. Sleeping until we see a request. As before, it still authenticates perfectly when I try it with either NTRadPing or radtest. Thanks again, Simon >hi, > >you say it works okay with NTRadPing and that when you use an entry in users >file it works...however >in the log you supplied its still matching an entry in the users file - and >the server is then >happy to use that matching entry rather than one in the DB. the log you posted >also shows that it >is attempting to use the files method...and that the match told it to use >Local authentication..the >database query is then superfluous. > >alan >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

4 3

EAP (PEAP) problems
by Drew Linsalata 01 Jun '06

01 Jun '06

This is freeradius 1.1.1 with a Proxim/Orinoco AP700. We're configured to use PEAP. We seem to be hung up on the EAP start from the AP. Here's some log output. Note the "No EAP Start" part, which I think tells us that the AP isn't relaying the EAP Start properly from the supplicant. Any feedback from the gurus? (-: rad_recv: Access-Request packet from host ***.***.***.***:6001, id=22, length=154 User-Name = "testtwo" NAS-IP-Address = ***.***.***.*** Called-Station-Id = "00-20-a6-5d-9c-d1:ourtestssid" Calling-Station-Id = "00-20-a6-4c-16-7f" NAS-Identifier = "ORiNOCO-AP-700-5d-9c-d1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000c017465737474776f Message-Authenticator = 0x62af36a7da3b8f655c8a9cda6dba34eb Wed May 31 13:50:59 2006 : Debug: Processing the authorize section of radiusd.conf Wed May 31 13:50:59 2006 : Debug: modcall: entering group authorize for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Wed May 31 13:50:59 2006 : Debug: rlm_realm: No '@' in User-Name = "testtwo", looking up realm NULL Wed May 31 13:50:59 2006 : Debug: rlm_realm: No such realm "NULL" Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Wed May 31 13:50:59 2006 : Debug: rlm_eap: EAP packet type response id 4 length 12 Wed May 31 13:50:59 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Wed May 31 13:50:59 2006 : Debug: users: Matched entry testtwo at line 2 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "files" returns ok for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Wed May 31 13:50:59 2006 : Debug: modcall: leaving group authorize (returns updated) for request 3 Wed May 31 13:50:59 2006 : Debug: rad_check_password: Found Auth-Type Accept Wed May 31 13:50:59 2006 : Debug: rad_check_password: Auth-Type = Accept, accepting the user Wed May 31 13:50:59 2006 : Auth: Login OK: [testtwo/<no User-Password attribute>] (from client testAP port 0 cli 00-20-a6-4c-16-7f) Sending Access-Accept of id 22 to ***.***.***.*** port 6001 Wed May 31 13:50:59 2006 : Debug: Finished request 3 Wed May 31 13:50:59 2006 : Debug: Going to the next request Wed May 31 13:50:59 2006 : Debug: --- Walking the entire request list --- Wed May 31 13:50:59 2006 : Debug: Waking up in 6 seconds... Wed May 31 13:51:05 2006 : Debug: --- Walking the entire request list --- Wed May 31 13:51:05 2006 : Debug: Cleaning up request 3 ID 22 with timestamp 447dd783 Wed May 31 13:51:05 2006 : Debug: Nothing to do. Sleeping until we see a request. -- Drew Linsalata The Gotham Bus Company, Inc. Dedicated Servers and Colocation Solutions Long Island, New York http://www.gothambus.com

3 4

RE: RE: Re: freeradius 1.1.1 and mysql issues
by simon＠434canada.com 01 Jun '06

01 Jun '06

There is a password in the database (in the radcheck table) associated with the username. I am also supplying both the username and password on my laptop as I am trying to connect. I currently have the Auth-Type being set (:=) to Local in the radgroupcheck table. I believe this should all be set up properly. Simon >>> modcall[authorize]: module "sql" returns ok for request 0 >>>modcall: leaving group authorize (returns updated) for request 0 >>> rad_check_password: Found Auth-Type Local >>>auth: type Local >>>auth: No User-Password or CHAP-Password attribute in the request >>>auth: Failed to validate the user. >>>Login incorrect: [simon/<no User-Password attribute>] (from client >>linksys->434 port 56 cli 0013ce29c6d7) >> >>There is no password ? Is that okay? >> >>You can set Auth-Type to Accept if the user is found in sql ! >>If that is what you actually want. >> >>Regards, >> >>Edvin >> >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html

1 0