- Freeradius-Users - lists.freeradius.org

Restricting logins with Calling-Station-Id in MySQL
by Mike Jakubik 18 May '06

18 May '06

Hello, I need help restricting users based on the number they called. I am using Freeradius 1.1.1 and a MySQL backend. I tried adding Called-Station-Id == "number,number,..." in to radgroupcheck, but it does not seem to be functioning. Could someone shed some light on the problem? Thanks.

3 6

can't connect to radius server
by simon＠434canada.com 18 May '06

18 May '06

Hi, I think I have my radius server configured properly (I followed the configuration advice in http://tldp.org/HOWTO/html_single/8021X-HOWTO/) I can get it running (using radiusd -X) and see all the expected output. I have also configured my AP to point to the correct location, and it is pingable from the radius server. However, when I try to connect, user validation always fails. And the radius server (which is in debug mode) doesn't show me anything. It's like nothing is connecting to it at all. I also tried to test it using NTRadPing, and his won't connect either. Any help or suggestions here would be appreciated. I am running version 1.1.1 of freeRADIUS. Thanks, Simon

3 2

rlm_perl
by KES 18 May '06

18 May '06

I have try next program: example.pl my $user = "root"; my $password = ""; my $database = "mysql"; my $dbh; sub CLONE { $dbh = DBI->connect("dbi:mysql:database=KES;host=10.10.16.6",$user, $password); open(SESAME, ">/rlm_hello"); print SESAME "HELLO\n"; close(SESAME); &radiusd::radlog(0, $users_table ."asdfadf"); } # Function to handle authorize sub authorize { &log_request_attributes; # &radiusd::radlog(0, $users_table); # return RLM_MODULE_OK; my $query = $dbh->prepare(<<"QUERY"); #<<<< This is 58th line SELECT count(*) FROM $users_table WHERE name = $RAD_REQUEST{'User-Name'} QUERY $query->execute(); if (( @count = $query->fetchrow_array) == 1) { $RAD_CHECK{'Auth-Type'} = "RADKES"; return RLM_MODULE_OK; } return RLM_MODULE_REJECT; #&db_logAttributes("authorize"); } and get .... Module: Instantiated perl (kes) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.16.5:4877, id=12, length=46 User-Name = "kesddd" User-Password = "\224\275\241T\036;\235\205\271\022\364E\035\203\3317" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Using perl at 0x811b070 rlm_perl: RAD_REQUEST: User-Name = kesddd rlm_perl: RAD_REQUEST: User-Password = \224\275\241T\036;\235\205\271\022\364E\035\203\3317 rlm_perl: perl_embed:: module = /usr/local/etc/raddb/kes.pl , func = authorize exit status= Can't call method "prepare" on an undefined value at /usr/local/etc/raddb/kes.pl line 58. modcall[authorize]: module "kes" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 12 to 10.10.16.5 port 4877 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 12 with timestamp 446afece Nothing to do. Sleeping until we see a request. It seems CLONE function didnt called I use 5.8.7 perl newserv# perl -v This is perl, v5.8.7 built for i386-freebsd-64int (with 1 registered patch, see perl -V for more detail) I even try comment out next line in rlm_perl.c 268: //#if PERL_REVISION >= 5 && PERL_VERSION <8 call_pv("CLONE",0); //#endif and make && make install Can any one help? -- С уважением, KES mailto:kes-kes@yandex.ru

2 3

Re: max_requests
by Giuseppe Parlato 18 May '06

18 May '06

None can help me? Giuseppe ----- Original Message ----- From: Giuseppe Parlato To: freeradius-users(a)lists.freeradius.org Sent: Thursday, May 18, 2006 2:42 PM Subject: max_requests value max_requests now is 1024, as default value is I think, but 4 clients isn't it too low? if I want to change it then do I have to just change and restart freeradius to make it working? Giuseppe

2 2

Problem with authentication EAP/TLS !!!
by emerson 18 May '06

18 May '06

Hello, i'm a new user's list and new freeradius users's. I configuring freeradius ok, but it's not work... My Freeradius is, 1.1.1, with mysql, OpenSSL 0.97d,running in slackware 10.1. My AP is a Ovislink wl5460AP, it's authenticate better, but the client linked on AP cause this error below: ***************************** Info: rlm_eap_md5: Issuing Challenge Mon May 15 14:47:29 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon May 15 14:47:30 2006 : Error: rlm_eap: EAP-Message not found Mon May 15 14:47:30 2006 : Error: rlm_eap: Malformed EAP Message Mon May 15 14:47:30 2006 : Auth: Login incorrect: [mobile/<no User-Password attribute>] (from client localhost port 0) Mon May 15 14:47:30 2006 : Auth: Login incorrect: [mobile/<no User-Password attribute>] (from client private-network-1 port 0 cli 0014a46e0a25) ******************************* Please help me, i need freeradius working faster..... Anywhere questions mail-me..... Thanks.. Emerson M. Borsatti P.S. It forgives for my poor English.....

2 1

rate_limit , police_rate , fall_through ?
by teoh 18 May '06

18 May '06

Rate_Limit_Rate = 128, Rate_Limit_Burst = 20000, Police_Rate = 128, Police_Burst = 20000, what does the 128,20000 mean ? if i want to restrict download speed at 10.0k and upload of 5k for each user? what value should be for rate_limit and police_rate ? what is fall_through? i cant find wiki on this. does anyone has any reference url? --------------------------------- Love cheap thrills? Enjoy PC-to-Phone calls to 30+ countries for just 2¢/min with Yahoo! Messenger with Voice.

1 0

RE: FreeRadius + MySQL & Encrypted passwords
by Tony Redstone 18 May '06

18 May '06

We had this problem so we did a dodgy but nonetheless functional small hack to make it work. YMMV but you may find it useful until the next proper release which hopefully will contain the new code which Alan refers to. Tony in radiusd.conf: pap { encryption_scheme = sha1 } in mysql continue to use "Password" in radcheck but set also set Auth-Type:=PAP for the SHA1 encrypted passwords. eg, say user abc1 has a SHA1 encrypted password and def2 has a plaintext password: radcheck: username attribute op value abc1 Password == 760e7dab2836853c63805033e514668301fa9c47 def2 Password == secretxyz radgroupcheck: groupname attribute op value papsha1 Auth-Type := PAP usergroup: username groupname abc1 papsha1 then apply this to main/valuepair.c (ie if Auth-Type==PAP, skip plaintext "Password" check): --- ../freeradius-1.0.4/src/main/valuepair.c 2005-02-07 20:04:47.000000000 +0000 +++ src/main/valuepair.c 2005-07-22 14:56:31.000000000 +0100 @@ -259,7 +259,20 @@ case PW_PASSWORD: if (pairfind(request, PW_PASSWORD) == NULL) { continue; + } else { + int auth_type; + VALUE_PAIR *auth_type_pair; + + if (auth_type_pair=pairfind(check, PW_AUTH_TYPE)) { + if(!strcmp(auth_type_pair->strvalue, "PAP")) { + continue; + } + } } + break; } Thanks Bogdan, I've tried with mysql and the crypt passwords and it works fine. Now I still wondering if there is any way with PAP to enable crypted passwords with MD5 or SHA1. I don't know if I understood ok, tell me if I'm wrong. I think that at the moment it's impossible to enable MD5 or SHA1 for encrypted passwords, but that they are working on it, so perhaps in future versions this will be possible. Thanks, Miguel Angel

1 0

anyone know what actually causes this? "FATAL! Server is too busy to process requests"
by Tony Redstone 18 May '06

18 May '06

we occasionally get these errors in our logs: Thu May 18 09:31:05 2006 : Error: FATAL! Server is too busy to process requests and the server dies. I've found the core in src/main/threads.c that spits out this message but it's not clear to me under what circumstances this would/should happen. It happens on several boxes ranging from redhat 8.0 to fc4, some processes are talking to backend SQL databases some aren't (in fact, it's our plain radius passthrough/routing proxy servers with file only based config that seem to experience this issue the most). does anyone know what really causes this and how to fix it? we're serving around 50k DSL users with a nominal authentication load of around 200-300 requests per minute (this is for authentication only, accounting is handled by separate processes which don't experience the same problem). peak load can run into several thousands per minute when recovering from planned maintenance on part of the DSL network. Tony

1 0

shared secret mismatch
by DilipSimha.N.M 18 May '06

18 May '06

hi, If the shared-secret mismatches bwtween NAS and RADIUS server, then still the access-accept message is sent from RADIUS server to NAS. why is access-reject message not sent??? --DilipSimha

2 1

rlm_perl:
by KES 18 May '06

18 May '06

I can check RAD_REQUEST for some values and set RAD_REPLY How must I use %RAD_CHECK? it reserving for? Can you give me an example how I must use it? -- KES mailto:kes-kes@yandex.ru

1 0