- Freeradius-Users - lists.freeradius.org

Any Trusted CA problem
by Torkel Mathisen 17 Feb '06

17 Feb '06

Hi, I run freeradius 1.0.5 with PEAP/MS-CHAPv2 authentication through the users file. I got a problem with the "Any Trusted CA" part on some of my clients. Some of the clients can't uncheck that option in the driver and then they won't be able to use the WLAN, because it tries to contact a CA. Is there any way around this problem? Regards, Torkel

1 0

rlm_counter location needed in freeradius
by Rupesh Amatya 17 Feb '06

17 Feb '06

where can i find rlm_counter in freeradius?? can anyone suggest me? rupesh Your Name -------- Original Message -------- ==> From: "Alan DeKok" <aland(a)ox.org> ==> Date: Thu, 16 Feb 2006 11:21:38 -0500 "Rupesh Amatya" <rupesh.amatya(a)info.com.np> wrote: > If I put 4hours in Session time and after using 3 hours , if he > disconnects and then reconnects, he can again use 4 hours. > Is there a way that he can no more log in after he uses 4 hours/day ? rlm_counter. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FATAL! Server is too busy to process requests
by Mitchell, Michael J 17 Feb '06

17 Feb '06

Hi all, I'm at a bit of a loss. I'm currently trying to load test the authentication proxy performance of freeRADIUS 1.0.1 in preparation for a deployment this weekend. Unfortunately, I'm running into this error "Error: FATAL! Server is too busy to process requests". My scenario is: Authentication Request comes in, we look the username up in openLDAP running on the same server, and if the user doesn't exist, proxy the request by setting Proxy-To-Realm using the attribute rewrite module. I have made changes to the rlm_ldap module for local requirements, and also running a couple of custom modules, so its not pure 1.0.1. The error still occurs when I disable all of my custom modules (except rlm_ldap of course). Interestingly, this error doesn't seem to occur when the openLDAP server is running on a different server, however the rate of requests that I can push through the server is also a lot less in this circumstance (about 25%). Oh, and finally, this is running Solaris 9 on a V240. >From what I can tell, it doesn't seem to be related to thread starvation, and the time it takes to reach this error seems to be somewhat variable. The CPU (according to prstat) doesn't need to be at 100% for this to occur either. However typically when it does occur radiusd is using all or close to all of one of the CPU's. It also doesn't happen when I run the server with -xx. Presumably this is because the extra output slows the server down enough such that its not hitting whatever barrier is causing this. To do the testing I'm using radclient sending using multiple threads. The number of radclient threads does seem to have a bearing, and I can stop the error from happening by reducing the number of threads. Once again I presume this is due to the reduced throughput or requests. I've just worked 11 days straight and averaged at least 15 hours a day, and at the moment I'm just too tired to trace right through the code to see what might be causing the issue. It is 3am here after all. Any advice or help is really appreciated at this stage. What might be the cause of (*request)->child_pid != NO_SUCH_CHILD_PID in request_dequeue? Anything I should look at, or tune to reduce the likelyhood of this occurring? It seems that I can also resolve the issue (at least for the same requests rate) by looping at the "select" in requests_dequeue 20 times instead of 10. What risk does this present? I then get errors like: Fri Feb 17 03:10:54 2006 : Error: Dropping conflicting packet from client dbst1:63628 - ID: 198 due to unfinished request 44357 Which is better (to me) than the server stopping. ;-) Thankyou kindly for your time to read this email. Sorry it was so long winded. Hopefully you will be able to offer some advice! kind regards, Mike

3 2

dictionary.cablelabs[168]: dict_addvalue: value name too long
by Ryan Melendez 16 Feb '06

16 Feb '06

Hello, In order to correctly link to libssl.so.0.9.7 and libcrypto.so.0.9.7 at run time. I set LDFLAGS="-R/usr/local/openssl-0.9.7/lib" at compile time. When I execute the bin I get the following error: Thu Feb 16 18:39:40 2006 : Debug: read_config_files: reading dictionary Thu Feb 16 18:39:40 2006 : Error: Errors reading dictionary: dict_init: //usr/local/share/freeradius/dictionary.cablelabs[168]: dict_addvalue: value name too long Thu Feb 16 18:39:40 2006 : Error: Errors reading radiusd.conf If I remove line 168 in the cablelabs dictionary file everything loads fine: Thu Feb 16 18:43:14 2006 : Debug: security: reject_delay = 1 Thu Feb 16 18:43:14 2006 : Debug: security: status_server = no Thu Feb 16 18:43:14 2006 : Debug: main: debug_level = 0 Thu Feb 16 18:43:14 2006 : Debug: read_config_files: reading dictionary Thu Feb 16 18:43:14 2006 : Debug: read_config_files: reading naslist Thu Feb 16 18:43:14 2006 : Debug: read_config_files: reading clients This is the line I removed. dictionary.cablelabs[168] VALUE CableLabs-QoS-Release-Reason Inactivity-Resource-Recovery-Timer-Expiration 2 Alternativly, if I do not set LDFLAGS when I compile and set LD_LIBRARY_PATH at runtime (which I don't want to do) I do not get an error. Am I doing something wrong or is the dictionary file malformed? Please let me know if I can provide any other information. Thanks, Ryan

2 3

Re: Freeradius 1.1.0 and rlm_ldap
by Mark Martinec 16 Feb '06

16 Feb '06

>From futhwo on Thu, 02 Feb 2006: > ... All worked fine untill i upgraded FreeRADIUS form 1.0.5 to 1.1.0. > From there on i cannot authenticate because the Auth-Type attribute is no more valorized to LDAP by the ldap module during authorize section. > ... > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user > ... > So if the Auth-Type LDAP is no more defined,how can i perform authentication against a LDAP server? I noticed the same symptoms after upgrading 1.0.5 to 1.1.0. Somehow the Auth-Type no longer had a value that would match the Auth-Type LDAP {...} entry in the authenticate section, even though the rlm_ldap successfully completed authorization. ChangeLog didn't mention incompatibilities, debug log with -X wasn't helpful, bug database turned out nothing, and mailing list archive turned up similar futhwo's problem report with no replies. Digging on rlm_ldap source and adding some debug printouts revealed that the Auth-Type wasn't left undefined like the debug message lead me to believe, but its value became the name of a LDAP instance (I'm using two LDAP servers in redundant radius group), which did not match the name of the Auth-Type LDAP {} authenticate section. In my case the solution was to replace the: authenticate { ... Auth-Type LDAP {...} with: authenticate { ... Auth-Type ldap-instance1 { ldap-instance1 } Auth-Type ldap-instance2 { ldap-instance2 } I would guess that futhwo's problem has a similar solution, perhaps replacing Auth-Type LDAP with Auth-Type ldap or giving a name to an instance and using that in the authenticate section. It would be helpful to document explicitly what comments in rlm_ldap.c indicate: * Module should default to LDAP authentication if no Auth-Type * specified. Note that we do this ONLY if configured, AND we * set the Auth-Type to our module name, which allows multiple * ldap instances to work. It wouldn't hurt if the inst->set_auth_type = 0 would be accompanied with a debug log entry, and if the pairadd in: if (inst->set_auth_type && (pairfind(*check_pairs, PW_AUTH_TYPE) == NULL) && request->password && (request->password->attribute == PW_USER_PASSWORD)) pairadd(check_pairs, pairmake("Auth-Type", inst->xlat_name, T_OP_EQ)); would also log the inst->xlat_name. But above all, please document incompatibilities between versions. Mark

3 2

Can I proxy by PPPoE service name?
by Zach T Hall 16 Feb '06

16 Feb '06

It seems that the features says it can be done, but I have no idea how. Basically I'm just wondering if I can take the service-name of the PPPoE server and have freeradius proxy out depending on which service name. Does anybody have any suggestions on where I might start looking for information on doing this type of thing? Thanks, Zach Hall

2 1

Allowing Access based on Group Membership
by Jay Lee 16 Feb '06

16 Feb '06

After a bit of effort I have managed to get Wireless with WPA encryption working with FreeRadius and an eDirectory LDAP Backend (using Universal password). My last task is to allow Wireless authentication only to members of a given LDAP Group. I seem to be having some issues though. Here is my ldap config in /etc/raddb/radiusd.conf: ldap { server = "ldap.pbu.edu" identity = "cn=admin,o=PBU" password = "password" basedn = "o=PBU" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = yes tls_cacertfile = /etc/raddb/certs/rootder.b64 access_attr = "cn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword edir_account_policy_check=yes groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } If I empty out /etc/raddb/users completely, authentication works. If I put the following in users: DEFAULT LDAP-Group == "Wireless", Auth-Type := Accept Fall-Through = No DEFAULT Auth-Type := Reject and start freeradius with "radiusd -X -A" I get: rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=PBU' radius_xlat: '(uid=jlee)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=PBU, with filter (uid=jlee) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=jlee,o=PBU))(&(objectCla ss=GroupOfUniqueNames)(uniquemember=cn=jlee,o=PBU)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=PBU, with filter (&(cn=Wireless)(|(&(objectClas s=GroupOfNames)(member=cn=jlee,o=PBU))(&(objectClass=GroupOfUniqueNames)(uniquem ember=cn=jlee,o=PBU)))) rlm_ldap::ldap_groupcmp: User found in group Wireless rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jlee radius_xlat: '(uid=jlee)' radius_xlat: 'o=PBU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=PBU, with filter (uid=jlee) rlm_ldap: checking if remote access for jlee is allowed by cn rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jlee authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: ldap_release_conn: Release Id: 0 modcall[post-auth]: module "ldap" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 194 to 10.1.1.44:32769 Finished request 1 However, the wireless client never quite seems to finish associating. Any ideas what I'm doing wrong here? What should the users file look like to allow anyone who is a member of the Wireless LDAP group and deny everyone else? Jay Lee -- Jay Lee Network / Systems Administrator Information Technology Dept. Philadelphia Biblical University --

2 2

Re: Re: how to disconnect user after quota given to him finishes ?
by Rupesh Amatya 16 Feb '06

16 Feb '06

Dear all, The user gets logged out exactly after the time set in Session Time Out. But I am trying to create package like 4hours per day, 2 hours perday. If I put 4hours in Session time and after using 3 hours , if he disconnects and then reconnects, he can again use 4 hours. Is there a way that he can no more log in after he uses 4 hours/day ? Thanking you all, Rupesh Amatya -------- Original Message -------- ==> From: Lewis Bergman <lbergman(a)wtxs.net> ==> Date: Wed, 15 Feb 2006 08:38:33 -0600 Dear all, I am using Freeradius(with mysql as database for users ) with Mikrotik as NAS. This for PPPOE users. I used Dialup Admin to manage freeradius. There is default package of 4hours/day but the users do not get > disconnect after 4 hours. It just shows " Out of Quota". What needs > to be done to automatically disconnect user after the daily quota is > finished ? ************************************** There a few session attrbutes you could use for this. Session-Timeout is the first one that springs to mind. I don't know if the client will pay attention to it though.

3 2

Possibility to set acct_table1 outside of sql.conf?
by Andreas Engler 16 Feb '06

16 Feb '06

Dear All, i would like to insert Accounting-Information in different tables for different NASs. Therefor i would use different sql-Instances and the acct_users file. The instances would only differ in acct_tabl1 and acct_table2. I tryed to set the variables in the sections of every instance in radiusd.conf before including sql.conf. In sql.conf i commented out the variables. But then there is reported an error, that the variable acct_table1 is unknown. Is there a possibility to set the variables acct_table1 and acct_table2 in the sections for the different instances in radiusd.conf? Or have i to provide for every instance an own sql.conf. Hopefully my problem gets clear!? Thank you Andreas Engler

2 1

Adding Extra Attribute
by Abdul Lateef 16 Feb '06

16 Feb '06

Hi all, Is possible to send some extra cisco VSA attribute in AccessResponse Packet? This is what i want to include in the packet: Cisco VSA(252): GWname/option//CalledID//CallerID/GWip:172 I tried in user file with the following configuration but it doesnot seems to work 12122 Auth-Type := Login-User h323-credit-time = 500 Cisco VSA(252): GWname/option//CalledID//CallerID/GWip:1719 Please advice me to add this thing in response packet. -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 ICQ: 276994704 MSN: abdulzu(a)hotmail.com GoogleTalk: lateef.np(a)gmail.com YM!: abdul_zu Doha Qatar http://www.hatif.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1