- Freeradius-Users - lists.freeradius.org

some users not authenticating
by Tony Spencer 08 Mar '06

08 Mar '06

I've got, well think I have, radius to accept all logins no matter what password they send. However some users still cannot login, its around 10 users out of 200. I'll show details for one user that can login ok and one user that can't. I'm guessing it's something the end user is doing because they all come in via the same NAS and have exactly the same radius entry. If I can get around this by just accepting anything that would be ideal, since our realm is the only radius logins that are sent to us. Here is a user that can't login: ## Thu Mar 2 09:59:03 2006 : Auth: Login incorrect (rlm_chap: Clear text password not available): [user22(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 510) ## Here is someone that did authenticate ok: ## Thu Mar 2 09:55:26 2006 : Auth: Login OK: [user3(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 492) ## My users file has: ## DEFAULT Auth-Type = Accept ## And the entries for both users above are identical apart from the username and IP assignment: ## user3(a)dsl.realm.com Auth-Type := Accept Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.0.1, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP, user22(a)dsl.realm.com Auth-Type := Accept Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.0.2, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP, ## Here is some radius debug first for the user that can't login: ## rad_recv: Access-Request packet from host 10.0.0.2:1645, id=46, length=98 Framed-Protocol = PPP User-Name = " user22(a)dsl.realm.com" CHAP-Password = 0x01295999be562b2eab944deb9647c5a664 NAS-Port-Type = Virtual NAS-Port = 563 Service-Type = Framed-User NAS-IP-Address = 10.0.0.2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "dsl.realm.com" for User-Name = " user22(a)dsl.realm.com" rlm_realm: No such realm "dsl.realm.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_chap: login attempt by " user22(a)dsl.realm.com" with CHAP password rlm_chap: Could not find clear text password for user user22(a)dsl.realm.com modcall[authenticate]: module "chap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [ user22(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 563) ## And a user that can login: ## rad_recv: Access-Request packet from host 10.0.0.2:1645, id=200, length=97 Framed-Protocol = PPP User-Name = "user3(a)dsl.realm.com" CHAP-Password = 0x012d51dff5b1bda7f6a370e79ff84e0dcf NAS-Port-Type = Virtual NAS-Port = 717 Service-Type = Framed-User NAS-IP-Address = 10.0.0.2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: Looking up realm "dsl.realm.com" for User-Name = "user3(a)dsl.realm.com" rlm_realm: No such realm "dsl.realm.com" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched DEFAULT at 152 users: Matched user3(a)dsl.realm.com at 243 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [user3(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 717) Sending Access-Accept of id 200 to 10.0.0.2:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.0.2 Framed-IP-Netmask = 255.255.255.255 Framed-Compression = Van-Jacobson-TCP-IP Finished request 2 ## I can see that it seems user33 is sending a blank white space before his username, but I don't see that this would make a difference since I'm accepting everything anyway. And from the command line I can use "radtest" and send blank spaces and it works fine. Although I do see that the user would not get assigned his IP address. But first I'd like to ensure everyone can authenticate. Any idea? Thanks in advance Tony

3 3

7 instances of freeradius - radiusd daemon
by sumi thra 08 Mar '06

08 Mar '06

Subject: 7 instances of freeradius - radiusd daemon Hi All, I builded the freeradius-1.0.5 source. In the config option i specified --with-threads=no( tried with --disable-threads too) But, when i ran the daemon, im seeing 7 instances. How do i compile it to run in single thread mode ?? Any earliest reply will be very helpfull. Thanks in Advance. -- Sumi -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!" -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

2 1

eap don't work
by pelusa vali 08 Mar '06

08 Mar '06

hi everybody, i have problems using freeradius 1.0.5, i cann't get it works as i hope. well i installed freeradius in my server and tried to see if clients can authenticate, so first tried test over server, my ip is 192.168.10.1, i generate certificates to use TLS. this is my users file: "mec01" Auth-Type := EAP and clients.conf file: client 192.168.10.1 { secret = clue shortname = www.kill.com } i tried put in shortname localhost too, but nothing happen eap.conf file: tls { private_key_file = ${raddbdir}/certs/www.kill.com.pem certificate_file = ${raddbdir}/certs/www.kill.com.pem CA_file = ${raddbdir}/certs/demoCA/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 ... } so, i do this: www:~# radtest mec01 clue www.kill.com 0 clue Sending Access-Request of id 49 to 192.168.10.1 port 1812 User-Name = "mec01" User-Password = "clue" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 192.168.10.1:1812, id=49, length=20 in messages from radius i see this: rad_recv: Access-Request packet from host 192.168.10.1:32768, id=49, length=62 User-Name = "mec01" User-Password = "clue" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_rmspace_pair: User-Password now 'clue' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "mec01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry mec01 at line 97 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 1 modcall: leaving group authenticate (returns fail) for request 1 auth: Failed to validate the user. Login incorrect: [mec01/clue] (from client localhost port 0) rad_lowerpair: User-Name now 'mec01' rad_rmspace_pair: User-Name now 'mec01' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "mec01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry mec01 at line 97 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 1 modcall: leaving group authenticate (returns fail) for request 1 auth: Failed to validate the user. Login incorrect: [mec01/clue] (from client localhost port 0) Delaying request 1 for 1 seconds Finished request 1 so i reviewed keys and shared secret and they are correct in server, client and CA, i even generate them again. i see radius says: rlm_eap:Malformed EAP Message, so may be i install freeradius in a bad way? or what is happening? why server don't authenticate users? thanks in advance. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

2 1

[Freeradius-Users]modcall[authenticate]: module "unix" returns notfound for request
by Jedliu 08 Mar '06

08 Mar '06

Hi, All! When I wanna run freeradius with the support of MySQL, I found such mes * modcall[authenticate]: module "unix" returns notfound for request 12 modcall: group authenticate returns notfound for request 12 * in "radiusd -X" mode,but the user in USERS file can be authenticated successfully. I've googled,but not find the solution. And i've searched from the mailing list,though there're some troubleshooting too,no way to solove. So pls help! Thx in advance! Regards for everyone. jedliu Jedliureceiver(a)gmail.com 2006-03-06

2 3

Problem with rlm_perl.
by wazn＠sibmail.ru 08 Mar '06

08 Mar '06

Hi. I use freeradius 1.1.0 on Debian 3.1 stable. freeradius is compiled to deb-package by the command "dpkg-buildpackage -rfakeroot -uc -b" and installed by "dpkg -i". I tried to use test perl module 'example.pl'. Here is part of my radiusd.conf: ... modules { ... perl test_module { module = ${confdir}/example.pl } ... } accounting { detail sql test_module } ... And /usr/sbin/freeradius -X says: ... Module: Loaded perl perl: module = "/etc/freeradius/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" rlm_perl: perl_parse failed: /etc/freeradius/example.pl not found or has syntax errors. radiusd.conf[211]: test_module: Module instantiation failed. radiusd.conf[245] Unknown module "test_module". radiusd.conf[242] Failed to parse accounting section. The file exists: # ls -l /etc/freeradius/example.pl -rw-r----- 1 root freerad 4620 Jan 24 14:26 /etc/freeradius/example.pl Perl says that syntax is OK: # perl -c /etc/freeradius/example.pl /etc/freeradius/example.pl syntax OK Where may be the error? If the errors are in the perl module "example.pl", how do I see the extended output? -- Best regards Yevgeny

4 3

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 08 Mar '06

08 Mar '06

Hi, > -----Original Message----- > Date: Sat, 4 Mar 2006 15:19:32 -0600 > From: "Natalia Escalera" <nescalera(a)gmail.com> > > Hello, > > What is needed is that Freeradius accepts passwors even if special > charaters are part of them. This is what is happening: > > > pass$word -> FR -> LDAP -> FR (Answer: wrong password) > > Any ideas of how to solve it? This looks very much like the feature we have seen with FR 0.9.3. Passwords with a "special character" are truncated, resulting in password check failing. http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-July/045 560.html This may be related to this bug, which is still open (I don't agree with the severity=minor :) http://bugs.freeradius.org/show_bug.cgi?id=261 We have made a small fix to the ldap-module (as seen in the link to the mailing list archive). I don't know if this has been fixed in 1.1.0. I once had a quick look at the ldap-module of 1.1.0, it should be quite easy to test if it still fails. -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

4 3

mysql authentication doesn't work
by ???????, ?? ???????? 07 Mar '06

07 Mar '06

in radiusd.conf: authorize { auth_log sql } authenticate { } in sql.conf: sql_user_name = "%{Calling-Station-Id}" authorize_check_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authcheck_table} \ WHERE UserName = '%{SQL-User-Name}' AND User='%{User-Name}' \ ORDER BY id" /usr/local/sbin/radiusd -X show me: Listening on authentication XXX.XX.XX.XX:1812 Listening on accounting XXX.XX.XX.XX:1813 Ready to process requests. rad_recv: Access-Request packet from host XXX.XX.XX.XX:1812, id=190, length=117 NAS-Identifier = "mynas2" User-Name = "test" User-Password = "testpass" NAS-IP-Address = XXX.XX.XX.XX NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "3339999999" Acct-Session-Id = "d45d6126058adce5" Acct-Multi-Session-Id = "d45d612600010610" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail.log' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail.log expands to /usr/local/var/log/radius/radacct/auth-detail.log modcall[authorize]: module "auth_log" returns ok for request 0 radius_xlat: '3339999999' rlm_sql (sql): sql_set_user escaped user --> '3339999999' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = '3339999999' AND User='test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: '' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = 'secondtest' ORDER BY id' radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [3339999999] modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test/testpass] (from client mynas2 port 0 cli 3339999999) Sending Access-Reject of id 190 to XXX.XX.XX.XX port 1812 Finished request 0 So, select from database: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = '3339999999' AND User='test' ORDER BY id; +-----+------------+-------------------+--------+----+ | id | UserName | Attribute | Value | op | +-----+------------+-------------------+--------+----+ | 1 | 3339999999 | Auth-Type | Accept | := | | 37 | 3339999999 | User-Password | 378b243e220ca493 | == | | 73 | 3339999999 | User-Name | test | == | | 109 | 3339999999 | Called-Station-Id | 1000 | == | +-----+------------+-------------------+--------+----+ 4 rows in set (0.58 sec) ------------------------------------ As I understand, radius cannot understand crypted "User-Password" (by mysql function "password"). Is it possible to slide over it? How to do it, can someone give advice? ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

2 1

Realms in DB
by Santiago Balaguer García 07 Mar '06

07 Mar '06

Hi people, I am using freeradius-1.0.4 for more than two years in a Debian machine. I have all my user configurations in a Postgres DB. Now I migrate the clients.conf to DB successfully. For that porpouse I write at the end of my sql.conf: # Set to 'yes' to read radius clients from the database ('nas' table). readclients=yes I want to do the same with realm.conf file, but I don't know what line I must write in postgresql.conf file for reading realms table in my DB. Any suggestion?????? _________________________________________________________________ Acepta el reto MSN Premium: Protección para tus hijos en internet. Descárgalo y pruébalo 2 meses gratis. http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_proteccionin…

3 5

FreeRADIUS + LDAP + Wireless auth
by James Cort 07 Mar '06

07 Mar '06

Hi, I have an existing LDAP infrastructure which provides unified authentication for Windows and Linux (think Samba). I am trying to integrate WPA on a wireless access point with this using FreeRadius. The ultimate plan is that anyone who provides a valid username/password and whose account is not locked may connect through the wireless access point. I am using freeradius-1.0.5-r3. The problem I am having is that I cannot figure out how to get both the LDAP backend and the EAP parts working simultaneously. If I enable the "with_ntdomain_hack" option, LDAP works but EAP gives the "rlm_eap: Identity does not match User-Name, setting from EAP Identity." error. Removing the with_ntdomain_hack option results in the log below. The research I've done suggests I need something set up in the hints file, which I have: DEFAULT Prefix == "U4EATECH\" Hint = "EAP", Service-Type = Framed-User, Framed-Protocol = EAP LOG -------------------------------------------------------- rad_recv: Access-Request packet from host 172.30.10.40:1281, id=21, length=109 User-Name = "U4EATECH\\jamesc" NAS-IP-Address = 172.30.10.40 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021500140155344541544543485c6a616d657363 Message-Authenticator = 0xad5561811aaffaf393b9c77ce04f5572 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.30.10.40/auth-detail-20060303' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.30.10.40/auth-detail-20060303 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_eap: EAP packet type response id 21 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for U4EATECH\jamesc radius_xlat: '(uid=U4EATECH)' radius_xlat: 'ou=people,dc=u4eatech,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.u4eatech.com:389, authentication 0 rlm_ldap: bind as cn=smbadmin,dc=u4eatech,dc=com/N0pm4Ln0 to ldap.u4eatech.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=u4eatech,dc=com, with filter (uid=U4EATECH) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'U4EATECH\jamesc' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 21 to 172.30.10.40:1281 EAP-Message = 0x011600061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f7167d39d5e06712574b4b38f69116b Finished request 0 Going to the next request ---------------------------------------------------------------- radiusd.conf prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } ldap { server = "ldap.u4eatech.com" identity = "cn=smbadmin,dc=u4eatech,dc=com" password = <HIDDEN> basedn = "ou=people,dc=u4eatech,dc=com" filter = "(uid=%u)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = yes with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Stripped-User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess files auth_log eap ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

2 3

RE: Radius server health monitor :
by Bart van Daal 07 Mar '06

07 Mar '06

Check out 'monit' too. It's able to take some defined actions when the server dies or something goes wrong. kr, Bart -----Original Message----- From: freeradius-users-bounces+b.vandaal=edpnet.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+b.vandaal=edpnet.net@lists.freeradius.org] On Behalf Of Devaraj Hattibelegal Patil Sent: dinsdag 7 maart 2006 15:44 To: FreeRadius users mailing list Subject: RE: Radius server health monitor : Can I get any idea on writing our own new open code? I mean I am looking for new small really light wait application which does monitoring and uses the best method (either snmp ping or Server status message or some radius API). Regards, Devah -----Original Message----- From: freeradius-users-bounces+devaraj=airvana.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+devaraj=airvana.com@lists.freeradius.or g] On Behalf Of Peter Nixon Sent: Tuesday, March 07, 2006 4:50 AM To: FreeRadius users mailing list Subject: Re: Radius server health monitor : On Mon 06 Mar 2006 15:11, Devaraj Hattibelegal Patil wrote: > Radius server health monitor: I was looking from best way monitor the > health of the Radius server. Can some body suggest the best possible > way? > Thanks in advance Nagios, OpenNMS (Which I use) and many other NMS systems have radius monitoring plugins that work just fine. They can also monitor your backend auth and accounting stores for you (LDAP and SQL for example) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0