- Freeradius-Users - lists.freeradius.org

Accounting question
by Joseph Abadi 15 Jun '05

15 Jun '05

Hello, I have a question regarding the way accounting is done. I configured freeradius 1.0.1 with openssl and mysql support on a Fedora Core 3 system. I'm using it with PEAP and TLS for wireless authentication. The authentication works fine, but the accounting packets are always missing the username and the IPs of client and NAS seem to be interchanged. Here is a sample packet extracted from running radiusd with debugging: rad_recv: Accounting-Request packet from host 192.168.30.11:1223, id=211, length=182 Acct-Status-Type = Alive Acct-Session-Id = "0002e3412adf-000e6ad5debc-b0e1" NAS-IP-Address = 192.168.30.34 Acct-Input-Octets = 10179 Acct-Output-Octets = 11165 Acct-Input-Packets = 47 Acct-Output-Packets = 97 Vendor-Specific = 0x45415020557365726e616d652069733a204a4f53455048 Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x4553534944203d2055746570736120486f742053706f74 Vendor-Specific = 0x45415020547970652069733a204541502d50454150 Acct-Session-Time = 63418 My question is.... Isn the NAS suppossed to be the wireless access point? (in our case 192.168.30.11, not 192.168.30.34). Isn't the client suppossed to be the computer from which the user authenticated? (192.168.30.34 instead of .11). Is this just access point related? or can I configure it in clients.conf? The relevant portion of clients.conf looks like this: client 192.168.30.0/24 { secret = XXXXXX shortname = wifiAP } Thanks for any help,

3 2

Hints file can't match on prefix with back slash, forward slash works
by Matt Cobb 15 Jun '05

15 Jun '05

In the hints file I want to look for one of two domains to pick which ldap server to auth to. Users are used to the DOMAIN\user syntax, so I put in hint prefix checks for DOMAIN1\ and DOMAIN2\. What I found was that trying to match on the back slash doesn't work, despite trying several checks with escaping. A prefix check using a forward slash or a postfix check using @ (user@realm) works fine. Here is the configuration of hints and users along with the output (1.0.2 radiusd -X) of a login with TESTLAB\tester, which fails to set Auth-Type, followed by a user TESTLAB/test which matches and sets the Auth-Type successfully. hints file... DEFAULT Prefix == "TESTLAB\", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Prefix == "TESTLAB\\", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Prefix == "TESTLAB\\\\", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Prefix == "TESTLAB/", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Suffix == "@TESTLAB", Strip-User-Name = Yes Hint == "LDAP2" DEFAULT Prefix == "CORP\", Strip-User-Name = Yes Hint = "LDAP1" DEFAULT Prefix == "CORP\\", Strip-User-Name = Yes Hint = "LDAP1" Users file... DEFAULT Hint == "LDAP1", Auth-Type := LDAP1, Autz-Type := LDAP1 DEFAULT Hint == "LDAP2", Auth-Type := LDAP2, Autz-Type := LDAP2 radiusd -X ... qid = 0 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "braka.lockdownnetworks.com" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=LDAP_USER,cn=Users,dc=lockdownnetworks,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "xyz" ldap: basedn = "dc=lockdownnetworks,dc=com" ldap: filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: ldap_referrals = 0 rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute LOCKDOWN-Ldap-Group rlm_ldap: Registering ldap_groupcmp for LOCKDOWN-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name LOCKDOWN rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8153570 Module: Instantiated ldap (LOCKDOWN) ldap: server = "192.168.11.3" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "administrator(a)testlab.lockdownnetworks.com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "xyz" ldap: basedn = "dc=testlab,dc=lockdownnetworks,dc=com" ldap: filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: ldap_referrals = 0 rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute testlab-Ldap-Group rlm_ldap: Registering ldap_groupcmp for testlab-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name testlab rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8154620 Module: Instantiated ldap (testlab) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1026, id=189, length=105 User-Name = "TESTLAB\\tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 189 to 127.0.0.1:1026 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 189 with timestamp 42b054b6 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1026, id=239, length=105 User-Name = "TESTLAB/tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 47 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for tester radius_xlat: '(sAMAccountName=tester)' radius_xlat: 'dc=testlab,dc=lockdownnetworks,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.11.3:389, authentication 0 rlm_ldap: bind as administrator(a)testlab.lockdownnetworks.com/xyz to 192.168.11.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=testlab,dc=lockdownnetworks,dc=com, with filter (sAMAccountName=tester) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "testlab" returns ok for request 1 modcall: group Autz-Type returns ok for request 1 rad_check_password: Found Auth-Type LDAP2 auth: type "LDAP2" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "tester" with password "xyz" rlm_ldap: user DN: CN=Tester,CN=Users,DC=testlab,DC=lockdownnetworks,DC=com rlm_ldap: (re)connect to 192.168.11.3:389, authentication 1 rlm_ldap: bind as CN=Tester,CN=Users,DC=testlab,DC=lockdownnetworks,DC=com/testing to 192.168.11.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user tester authenticated succesfully modcall[authenticate]: module "testlab" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 239 to 127.0.0.1:1026 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 239 with timestamp 42b054c9 Nothing to do. Sleeping until we see a request.

1 0

Accounting ReceiveQueue
by Edgars Klavinskis 15 Jun '05

15 Jun '05

In which case the accounting queue is getting so big (see below) while a authorization works perfect? Proto Recv-Q Send-Q Local Address Foreign Address State moon:~# netstat -l |grep radius udp 0 0 *:radius *:* udp 100608 0 *:radius-acct *:* Thanks in advance. Edgars

1 0

RE: FreeRadius and PostgreSQL configuration question
by Shepherd, Dave 15 Jun '05

15 Jun '05

Sorry, my mistake. Mine is set to the default (32) and works fine. When you say 100 concurrent do you mean connections or requests? Dave Shepherd Technical Support Manager Compass Group UK and Ireland T : +44 121 457 5037 F : +44 121 457 5038 M : +44 7767 274 087 > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of NECTIS NetVoice Sales > Sent: 15 June 2005 13:30 > To: 'FreeRadius users mailing list' > Subject: RE: FreeRadius and PostgreSQL configuration question > > You look wrong configurations. > That file you look is a Postgres connection config for freeradius. > > I've ask for PostgreSQL database configuration which present in the > PostgreSQL configuration folder /var/lib/psql/data/ > > Regards, > > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > Shepherd, Dave > Sent: 15 June 2005 09:41 > To: FreeRadius users mailing list > Subject: RE: FreeRadius and PostgreSQL configuration question > > > How much max_connections we should configure in a postgresql.conf > file? > > [DLS >] I can't find this setting in the postgresql.conf file that I've > got, but it does appear in the /usr/share/pgsql/postgresql.conf.sample > file. > > I've checked 2 boxes one with 0.9.3 and the other with 1.0.2 installed > and in the /etc/raddb directory the postgresql.conf file does not > contain this setting. > > Are you using the correct configuration file? > > My freeRADIUS server uses postgreSQL for Authentication/Accounting fine > and the postgresql.conf file looks very similar to the sql.conf and > mssql.conf and nothing like the postgresql.conf.sample, and I don't use > the max_connections setting. > > HTH > > Dave > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

RE: FreeRadius and PostgreSQL configuration question
by Shepherd, Dave 15 Jun '05

15 Jun '05

> How much max_connections we should configure in a postgresql.conf file? [DLS >] I can't find this setting in the postgresql.conf file that I've got, but it does appear in the /usr/share/pgsql/postgresql.conf.sample file. I've checked 2 boxes one with 0.9.3 and the other with 1.0.2 installed and in the /etc/raddb directory the postgresql.conf file does not contain this setting. Are you using the correct configuration file? My freeRADIUS server uses postgreSQL for Authentication/Accounting fine and the postgresql.conf file looks very similar to the sql.conf and mssql.conf and nothing like the postgresql.conf.sample, and I don't use the max_connections setting. HTH Dave

2 1

checkval or proxy
by Craig Hancock 15 Jun '05

15 Jun '05

Hello All General Question I am a freeradius system setup where I am authenticating 2 kinds of users 1) Authorized users: Authorized users are users who have are directly afflited with an organization and well be using the system indefintely. 2) Guest Users: Authorized users who are indirectly afflited with an organization and will be using the system for a very short period. With that said all my accounts our stored in a LDAP directory and users are placed into authorized users groups. The question that I have is that in the users file I want to be able to have another level of authorization for users based on NAS-IP-Address attribute. From reading the archive I understand that I can do this with checkval. Unfortantely the only reference I have been able to fine is an example based on the default radius.conf file. What is the syntax for checkval in the sense of having multiple checkval statements. I presume this would work but unfortantely it doesn't. checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string nofound-reject = no } checkval { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = ipaddr notfound-reject = yes } Unfortantely the first checkval is processed but not the 2nd one. I think I need to give it in additional name like I would if I had multiple LDAP directives i.e checkval NAS-CHECK. Am I correct on this and if so do I have to change the authorize section and put something like Autz-Type CHECKVAL { checkval NAS-CHECK } Lastly is it possible to construct Autz-Types based on Proxies (Proxies being done locally) Thanks for your assitance. -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

1 0

freeradius no longer accepts Crypt-Password after upgrade
by shadur＠systemec.nl 15 Jun '05

15 Jun '05

Hello group, Due to a recent catastrophic hardware failure on one of our radius servers I've had to install a new machine. In the process we also upgraded freeradius from 0.9.3 to 1.0.2-4, and somehow the radius server now refuses to accept anything other than a User-Password attribute -- it keeps failing to log in users that have a Crypt-Password set. I've attached a -xxx debug log below, minus passwords and usernames. The literal same configuration works fine on another machine running 0.9.3 and retrieving its data from the same database server. Can anyone suggest what I might be missing? -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://swordbreaker.systemec.nl/~shadur/shadur.key.asc

2 2

Authorization failed
by Kheli 15 Jun '05

15 Jun '05

Dear list, I am using free radius, for authorizing, authenticating and accounting dial-up connection. I use sql for authorization, but users cannot be authorized Here what the log files produced Info: rlm_sql (sql): No matching entry in the database for request from user [swan] Any idea, what's wrong ? thanks

1 0

FreeRadius and PostgreSQL configuration question
by NECTIS NetVoice Sales 15 Jun '05

15 Jun '05

Dear Gurus! We try to install Freeradius with PostgreSQL but got question We expect about 100 concurrent calls and our switch sent 3 requests to radius: Authorization, accounting start and accounting stop or update. How much max_connections we should configure in a postgresql.conf file? Normally at the same time we will get about 1-30 calls. But we are not sure How much it will be. Is there some other or special recommendation for correct configuring of PostgreSQL and FreeRadius. Please, who had installed and configured that, send this information ASAP, it's really necessary. Best regards,

1 0

FW: How to get Hint to match in users file
by Matt Cobb 14 Jun '05

14 Jun '05

-----Original Message----- From: Matt Cobb Sent: Tuesday, June 14, 2005 2:07 PM To: 'freeradius-users-request(a)lists.freeradius.org' Subject: How to get Hint to match in users file What syntax do you use to get Hint to match in the users file? In Hint I have: DEFAULT Prefix == "LOCKDOWN\\", Strip-User-Name = Yes Hint = "LDAP1" DEFAULT Prefix == "testlab\\", Strip-User-Name = Yes Hint = "LDAP2" And in the users file: DEFAULT Hint == "LDAP1", Auth-Type := LDAP1, Autz-Type := LDAP1 DEFAULT Hint == "LDAP2", Auth-Type := LDAP2, Autz-Type := LDAP2 The user name gets stripped before going into the users section, but no Auth-Type is set. >From freeradius 1.0.2... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=16, length=105 User-Name = "testlab\\tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 16 to 127.0.0.1:1026 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 16 with timestamp 42af5799 Nothing to do. Sleeping until we see a request.

1 0