- Freeradius-Users - lists.freeradius.org

RE: FreeRadius + MySQL & Encrypted passwords
by Tony Redstone 18 May '06

18 May '06

We had this problem so we did a dodgy but nonetheless functional small hack to make it work. YMMV but you may find it useful until the next proper release which hopefully will contain the new code which Alan refers to. Tony in radiusd.conf: pap { encryption_scheme = sha1 } in mysql continue to use "Password" in radcheck but set also set Auth-Type:=PAP for the SHA1 encrypted passwords. eg, say user abc1 has a SHA1 encrypted password and def2 has a plaintext password: radcheck: username attribute op value abc1 Password == 760e7dab2836853c63805033e514668301fa9c47 def2 Password == secretxyz radgroupcheck: groupname attribute op value papsha1 Auth-Type := PAP usergroup: username groupname abc1 papsha1 then apply this to main/valuepair.c (ie if Auth-Type==PAP, skip plaintext "Password" check): --- ../freeradius-1.0.4/src/main/valuepair.c 2005-02-07 20:04:47.000000000 +0000 +++ src/main/valuepair.c 2005-07-22 14:56:31.000000000 +0100 @@ -259,7 +259,20 @@ case PW_PASSWORD: if (pairfind(request, PW_PASSWORD) == NULL) { continue; + } else { + int auth_type; + VALUE_PAIR *auth_type_pair; + + if (auth_type_pair=pairfind(check, PW_AUTH_TYPE)) { + if(!strcmp(auth_type_pair->strvalue, "PAP")) { + continue; + } + } } + break; } Thanks Bogdan, I've tried with mysql and the crypt passwords and it works fine. Now I still wondering if there is any way with PAP to enable crypted passwords with MD5 or SHA1. I don't know if I understood ok, tell me if I'm wrong. I think that at the moment it's impossible to enable MD5 or SHA1 for encrypted passwords, but that they are working on it, so perhaps in future versions this will be possible. Thanks, Miguel Angel

1 0

anyone know what actually causes this? "FATAL! Server is too busy to process requests"
by Tony Redstone 18 May '06

18 May '06

we occasionally get these errors in our logs: Thu May 18 09:31:05 2006 : Error: FATAL! Server is too busy to process requests and the server dies. I've found the core in src/main/threads.c that spits out this message but it's not clear to me under what circumstances this would/should happen. It happens on several boxes ranging from redhat 8.0 to fc4, some processes are talking to backend SQL databases some aren't (in fact, it's our plain radius passthrough/routing proxy servers with file only based config that seem to experience this issue the most). does anyone know what really causes this and how to fix it? we're serving around 50k DSL users with a nominal authentication load of around 200-300 requests per minute (this is for authentication only, accounting is handled by separate processes which don't experience the same problem). peak load can run into several thousands per minute when recovering from planned maintenance on part of the DSL network. Tony

1 0

shared secret mismatch
by DilipSimha.N.M 18 May '06

18 May '06

hi, If the shared-secret mismatches bwtween NAS and RADIUS server, then still the access-accept message is sent from RADIUS server to NAS. why is access-reject message not sent??? --DilipSimha

2 1

rlm_perl:
by KES 18 May '06

18 May '06

I can check RAD_REQUEST for some values and set RAD_REPLY How must I use %RAD_CHECK? it reserving for? Can you give me an example how I must use it? -- KES mailto:kes-kes@yandex.ru

1 0

PB with Accent in nspmPassword in request LDAP between FREE-RADIUS 1.0.5 (suse) and edirectory novell 6.5
by freeradius＠rockwellcollins.com 18 May '06

18 May '06

Hello, I set up a solution implementing eap-PEAP user authentication and VLAN assignment with · : - FREE-RADIUS 1.0.5 on suse - ENTERASYS Switch - Edirectory Novell 6.5 This solution is operational. On the other hand, if the user uses a password using characters with accents, this solution does not work. I identified the problem in the LDAP request (ask nspmPassword) between FREE-RADIUS 1.0.5 and the edirectory of novell 6.5. The problem seems to come from FreeRadius server because edirectory answers correctly with my test tool " LDAPBrowser ". Do you have met this problem? Have you a solution to propose to me? thank you in advance. Best regards Stephan

2 6

max_requests
by Giuseppe Parlato 18 May '06

18 May '06

value max_requests now is 1024, as default value is I think, but 4 clients isn't it too low? if I want to change it then do I have to just change and restart freeradius to make it working? Giuseppe

1 0

freeradius with TTLS - MSCHAPV2 authentication
by sumi thra 18 May '06

18 May '06

Hey All, Im using the D-Link client card with the odyssey client manager. Im trying to connect to the wlan configured with 802.1x authetication & the radius server used for authetication is freeradius-1.1.1 . Eap-Type : TTLS Auth-Type : MS-CHAPV2 When the MU sends an access request, the radius server replies back with the Access-Reject code ( 3 ). Im not able to figure out what the problem is.. ?? Does the freeradius support this eap & auth types ?? Note : Im using the default eap.conf file with smaller changes. Like default eap type is changed to TTLS. And default auth type for TTLS is mschapv2. Please let me know if you have any idea. Thanks Sumi

1 0

How make the conference in softphones
by raviprakash sunkara 18 May '06

18 May '06

Hello EveryBody , I need help from U. please help me in How make a conference in softphones. On Which modules have work. I recently install tested the softphones . that a calls are made . And When I looked into Location table . in that table records are insert. immediately when the system restart or when softphone is discarded the " location table " records are disable. Please help me in that.. And please Excuse me, In my English . Bye -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

1 0

Cisco and RADIUS
by vignesh 18 May '06

18 May '06

Hello all I am new to RADIUS. I am using Cisco IP IP gw as NAS and RADIUS. I have few doubts regarding the interaction between CISCO and RADIUS Whenever the request for authentication comes, for all authenticated users I wish to send some extra details like Billing model, credit time etc. If I make changes in the authentication query to return these values, how will the nas understand that which one is billing model or which one is credit time. Do I have to make any changes in the Dictionary or RADIUS. I tried to search for the same in CISCO site but hard luck couldn't find it. Please guys help me out Thanks in advance Vignesh

3 2

How can I account with Freeradius using mysql DB for Asterisk?
by fangh 18 May '06

18 May '06

freeradius-users，您好！ I'm a beginner with freeradius.I've got a problem,please help me, thanks a lot! I'd seen the document <Call Detail Recording to RADIUS Server> and the document <cdrdrivers.txt>. In the cdrdrivers.txt said that :" > RADIUS: The Radius CDR driver built upon the radiusclient-ng library > available at > http://developer.berlios.de/projects/radiusclient-ng/ > > Installing this library will provide the RADIUS client > function to Asterisk, and thus make it able to talk to > a RADIUS server. > > The CDR driver produces only 'stop' records. > > Compile, configure, and install the latest > radiusclient-ng library: > tar -zxvf radiusclient-ng-0.5.2.tar.gz && > cd radiusclient-ng-0.5.2 && > ./configure && > make && > make install > > Compile, or recompile Asterisk so that it will now add support > for the module: > make clean && > make update && > make && > make install > > Configure the /usr/local/etc/radiusclient-ng/servers > file to set the RADIUS server's IP address and secret. > Include the dictionary.asterisk file in the main > dictionary: > cp -p asterisk.dictionary /usr/local/etc/radiusclient-ng/ > cd /usr/local/etc/radiusclient-ng/ > echo '$INCLUDE /usr/local/etc/radiusclient-ng/asterisk.dictionary' >> dictionary > > The dictionary.asterisk file must also be included in > the RADIUS server's main dictionary file in a similar > manner. " I did things like that above,but after I recompile Asterisk and restart Asterisk Server,when I made a call,the radius server couldn't receive request messages. I also can not find dictionary.asterisk file after I recompile asterisk,why?And how can I get the dictionary.asterisk,what should I do? I'd configure the radius configurations,the files radiusd.conf,clients.conf,sql.conf in raddb directory at Freeradius server side,the files servers,radiusclient.conf at the radiusclient side. the detail configurations just like in <Call Detail Recording to RADIUS Server> doc said. 　　　　　　　　致礼！　　　　　　　　fangh 　　　　　　　　fghai(a)126.com 　　　　　　　　　　2006-05-18

1 0