- Freeradius-Users - lists.freeradius.org

RE: FreeRadius and PostgreSQL configuration question
by Shepherd, Dave 15 Jun '05

15 Jun '05

Sorry, my mistake. Mine is set to the default (32) and works fine. When you say 100 concurrent do you mean connections or requests? Dave Shepherd Technical Support Manager Compass Group UK and Ireland T : +44 121 457 5037 F : +44 121 457 5038 M : +44 7767 274 087 > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of NECTIS NetVoice Sales > Sent: 15 June 2005 13:30 > To: 'FreeRadius users mailing list' > Subject: RE: FreeRadius and PostgreSQL configuration question > > You look wrong configurations. > That file you look is a Postgres connection config for freeradius. > > I've ask for PostgreSQL database configuration which present in the > PostgreSQL configuration folder /var/lib/psql/data/ > > Regards, > > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > Shepherd, Dave > Sent: 15 June 2005 09:41 > To: FreeRadius users mailing list > Subject: RE: FreeRadius and PostgreSQL configuration question > > > How much max_connections we should configure in a postgresql.conf > file? > > [DLS >] I can't find this setting in the postgresql.conf file that I've > got, but it does appear in the /usr/share/pgsql/postgresql.conf.sample > file. > > I've checked 2 boxes one with 0.9.3 and the other with 1.0.2 installed > and in the /etc/raddb directory the postgresql.conf file does not > contain this setting. > > Are you using the correct configuration file? > > My freeRADIUS server uses postgreSQL for Authentication/Accounting fine > and the postgresql.conf file looks very similar to the sql.conf and > mssql.conf and nothing like the postgresql.conf.sample, and I don't use > the max_connections setting. > > HTH > > Dave > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

RE: FreeRadius and PostgreSQL configuration question
by Shepherd, Dave 15 Jun '05

15 Jun '05

> How much max_connections we should configure in a postgresql.conf file? [DLS >] I can't find this setting in the postgresql.conf file that I've got, but it does appear in the /usr/share/pgsql/postgresql.conf.sample file. I've checked 2 boxes one with 0.9.3 and the other with 1.0.2 installed and in the /etc/raddb directory the postgresql.conf file does not contain this setting. Are you using the correct configuration file? My freeRADIUS server uses postgreSQL for Authentication/Accounting fine and the postgresql.conf file looks very similar to the sql.conf and mssql.conf and nothing like the postgresql.conf.sample, and I don't use the max_connections setting. HTH Dave

2 1

checkval or proxy
by Craig Hancock 15 Jun '05

15 Jun '05

Hello All General Question I am a freeradius system setup where I am authenticating 2 kinds of users 1) Authorized users: Authorized users are users who have are directly afflited with an organization and well be using the system indefintely. 2) Guest Users: Authorized users who are indirectly afflited with an organization and will be using the system for a very short period. With that said all my accounts our stored in a LDAP directory and users are placed into authorized users groups. The question that I have is that in the users file I want to be able to have another level of authorization for users based on NAS-IP-Address attribute. From reading the archive I understand that I can do this with checkval. Unfortantely the only reference I have been able to fine is an example based on the default radius.conf file. What is the syntax for checkval in the sense of having multiple checkval statements. I presume this would work but unfortantely it doesn't. checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string nofound-reject = no } checkval { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = ipaddr notfound-reject = yes } Unfortantely the first checkval is processed but not the 2nd one. I think I need to give it in additional name like I would if I had multiple LDAP directives i.e checkval NAS-CHECK. Am I correct on this and if so do I have to change the authorize section and put something like Autz-Type CHECKVAL { checkval NAS-CHECK } Lastly is it possible to construct Autz-Types based on Proxies (Proxies being done locally) Thanks for your assitance. -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

1 0

freeradius no longer accepts Crypt-Password after upgrade
by shadur＠systemec.nl 15 Jun '05

15 Jun '05

Hello group, Due to a recent catastrophic hardware failure on one of our radius servers I've had to install a new machine. In the process we also upgraded freeradius from 0.9.3 to 1.0.2-4, and somehow the radius server now refuses to accept anything other than a User-Password attribute -- it keeps failing to log in users that have a Crypt-Password set. I've attached a -xxx debug log below, minus passwords and usernames. The literal same configuration works fine on another machine running 0.9.3 and retrieving its data from the same database server. Can anyone suggest what I might be missing? -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://swordbreaker.systemec.nl/~shadur/shadur.key.asc

2 2

Authorization failed
by Kheli 14 Jun '05

14 Jun '05

Dear list, I am using free radius, for authorizing, authenticating and accounting dial-up connection. I use sql for authorization, but users cannot be authorized Here what the log files produced Info: rlm_sql (sql): No matching entry in the database for request from user [swan] Any idea, what's wrong ? thanks

1 0

FreeRadius and PostgreSQL configuration question
by NECTIS NetVoice Sales 14 Jun '05

14 Jun '05

Dear Gurus! We try to install Freeradius with PostgreSQL but got question We expect about 100 concurrent calls and our switch sent 3 requests to radius: Authorization, accounting start and accounting stop or update. How much max_connections we should configure in a postgresql.conf file? Normally at the same time we will get about 1-30 calls. But we are not sure How much it will be. Is there some other or special recommendation for correct configuring of PostgreSQL and FreeRadius. Please, who had installed and configured that, send this information ASAP, it's really necessary. Best regards,

1 0

FW: How to get Hint to match in users file
by Matt Cobb 14 Jun '05

14 Jun '05

-----Original Message----- From: Matt Cobb Sent: Tuesday, June 14, 2005 2:07 PM To: 'freeradius-users-request(a)lists.freeradius.org' Subject: How to get Hint to match in users file What syntax do you use to get Hint to match in the users file? In Hint I have: DEFAULT Prefix == "LOCKDOWN\\", Strip-User-Name = Yes Hint = "LDAP1" DEFAULT Prefix == "testlab\\", Strip-User-Name = Yes Hint = "LDAP2" And in the users file: DEFAULT Hint == "LDAP1", Auth-Type := LDAP1, Autz-Type := LDAP1 DEFAULT Hint == "LDAP2", Auth-Type := LDAP2, Autz-Type := LDAP2 The user name gets stripped before going into the users section, but no Auth-Type is set. >From freeradius 1.0.2... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=16, length=105 User-Name = "testlab\\tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 16 to 127.0.0.1:1026 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 16 with timestamp 42af5799 Nothing to do. Sleeping until we see a request.

1 0

SQL based Simultaneous-Use troubles
by Aaron Paetznick 14 Jun '05

14 Jun '05

I'm having some trouble getting FreeRADIUS to use the SQL tables for determining Simultaneous-Use. I've reviewed the doc/Simultaneous-Use file. I've uncommented the simul_count_query line in sql.conf. I'm already successfully using SQL authentication and accounting. I've entered Simultaneous-Use:=1 in the radgroupcheck table. No matter what I do, this is what I get in the log: Mon Jun 13 09:32:23 2005 : Error: Check-TS: timeout waiting for checkrad You can go to http://www.tnics.com/raddb/ to see my entire etc/raddb directory (with the clients file, passwords, secrets, and other sensitive bits removed). Can anybody offer any suggestions? I'm just trying to use 100% SQL-based Simultaneous-Use checking, so checkrad shouldn't even be called, right? I'm probably missing something really simple. Thanks! --Aaron

2 5

RE: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

Well ok, would it be possible to see some examples of some pam file setting for RH environment? I think I am not setting the right pam modules. Thanks, __________________________ Puneet Talwar Contractor/CIPS UNIX Administrator 301-451-9971 ( c ) 301-252-5366 **************************************** Disclaimer: The information in this e-mail and any of its attachments is confidential and may contain sensitive information. It should not be used by anyone who is not the original intended recipient. If you have received this e-mail in error please inform the sender and delete it from your mailbox or any other storage devices. The National Institute of Allergy and Infectious Diseases (NIAID) shall not accept liability for any statement made that are the sender's own and not expressly made on behalf of the NIAID by one of its representatives. -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, June 14, 2005 2:57 PM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > Here is the full content of the file. ... > IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 That line is NONSENSE. If it's actually in your configuration file, it WON'T WORK. You have to list the IP address, not the text "IP Address". See the line just above this one, which gives an example ot what to do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

Sorry about that, Here is the full content of the file. # cat pam_radius_auth.conf # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # server[:port] shared_secret timeout (s) #127.0.0.1 secret 1 IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, June 14, 2005 12:48 PM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > Here is the content of the pam_radius_auth.conf file and yes it does exist > in /etc/raddb/server folder. > > # server[:port] shared_secret timeout (s) > #127.0.0.1 secret 1 > IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 Either you've edited it so much as to be useless, or you're using that file as-is. Either way, I have no idea what the ACTUAL contents of the file is, and therefore I have no way to help you. If you don't know how to fix the problem on your own, any editing of the configuration files you do before posting them here is guaranteed to make those files useless. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1