- Freeradius-Users - lists.freeradius.org

update of freeradius 2.x to 3.015
by Pedro Loupa 25 Jun '18

25 Jun '18

Hello, I had an old version of freeradius working perfectly with sql and after updating to ubuntu 17. I get the following errors on trying to authenticate wit radtest. (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject I created a test user in radcheck for testing and I followed this tutorial; https://wiki.freeradius.org/guide/SQL%20HOWTO But I don't know how to go on, Could anybody give me a hint? Thanks in advance Best

1 0

best performance alternative using multiple virtual server to bound IP/port
by Philemon Jaomalaza 25 Jun '18

25 Jun '18

Hello Dear, I need to decide a structure of my deplyement, what the best practice and give best performance and memory usage if I want to have a separate service per client : - define multiple virtual servers with one global "listen" section IP/port for all virtual server. - define multiple virtual servers and each server has its listen section IP/port difffrent - define single virtual servers and use if ....elsif....else to select the proper sql module. One Nas will use one virtual and server It can have more than 50 NAS and arround 20 to 50 simultanews connexion by NAS. Philemon Jaomalaza

2 2

Large Deployment advice. 10000 users
by Uchenna Nebedum 25 Jun '18

25 Jun '18

Good Day all, If i wanted to use freeRADIUS to manage about 100 NAS each with about 1000 users, could i use a single server for all the NAS, if yes, what spec of server. And would MySQL still be the best database to use considering performance or would Redis be better. And what would be the best configurations. Please i need advice. Thanks a lot for any help.

2 2

Apache client certificat To freeradiis
by vince technical address 25 Jun '18

25 Jun '18

Hi, Is it possible to send client certificate to à freeradius server by apache. I would like to manage authentication by radius only. No way to do something like 802.1x with radius and apache and navigator ? Tanks. Vince

2 3

User-Password
by Javier Escalante 25 Jun '18

25 Jun '18

Hello, Could it be correct? http://freeradius.1045715.n5.nabble.com/ISSUE-Authentication-will-fail-unle… If so? Where should I change it? Thanks BR Javier Escalante Business Development Manager Javier.escalante(a)bwireless.eu 00 34 626 785 675 00 34 93 141 56 36 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: www.bsmart.global http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de B’W & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a B’W & TAKACS TELECOM, S.L. con domicilio en Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+javier.escalante=bwireless.eu@lists.freeradius.org] On Behalf Of Javier Escalante Sent: domingo, 24 de junio de 2018 15:57 To: 'FreeRadius users mailing list' Subject: RE: right tutorial Hello, Sorry guys, based on the answers of Alan, I might be stupid...I'll explain another time and I hope this time I get some help: 1. I installed a fresh server (I have my all server already configured and working since 4 years) 2. I installed freeradius 3.0.16 and mysql. No errors during installation 3. I tested with user and password in file, and it worked perfectly 4. I tested by putting the user test with password test in radcheck and the authentication failed as it is shown further down. 5. I have searched in all kind of forums and obviously also in www.freeradius.org. No solution yet. 6. The sql seems to be working despite the include line is not uncommented in radiusd.conf. Can somebody confirm? Can anybody give me a clue of how to solve this problem? Request: radtest test test localhost 10 1107 Freeradius debug output: Ready to process requests (0) Received Access-Request Id 195 from 127.0.0.1:37474 to 127.0.0.1:1812 length 74 (0) User-Name = "test" (0) User-Password = "test" (0) NAS-IP-Address = 5.135.246.127 (0) NAS-Port = 10 (0) Message-Authenticator = 0x05270c450007175556849d0b38cc7a27 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/de fault (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE us ername = 'test' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User- Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE userna me = 'test' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth -Type (0) pap: WARNING: Authentication will fail unless a "known good" password is ava ilable (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet- Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test', 'Access-Reject', '2018-06-24 13:55:21') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authda te) VALUES ( 'test', 'test', 'Access-Reject', '2018-06-24 13:55:21') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 195 from 127.0.0.1:1812 to 127.0.0.1:37474 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 195 with timestamp +2 Ready to process requests Thanks in advance BR Javier Escalante Business Development Manager Javier.escalante(a)bwireless.eu 00 34 626 785 675 00 34 93 141 56 36 00 41 78 689 85 69 Skype: fruiz002 Do you know our IoT solutions? Have a look here: www.bsmart.global http://www.bwireless.eu Le informamos que, de conformidad con la Ley Orgánica 15/1999, de 13 de diciembre, de Protección de Datos de Carácter Personal, se informa que todos los datos personales que nos ha facilitado serán incorporados y tratados en los ficheros de B’W & TAKACS TELECOM, S.L. para las finalidades de su e-mail. Puede ejercer sus derechos de acceso, rectificación, cancelación y oposición mediante una comunicación a B’W & TAKACS TELECOM, S.L. con domicilio en Camil Oliveras, 26, 08032 Barcelona (España), o bien mediante una comunicación a la dirección de correo electrónico info(a)bwireless.eu. En ambos casos, deberá acompañar una copia de su documento nacional de identidad o documento válido que lo identifique. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+javier.escalante=bwireless.eu@lists.freeradius.org] On Behalf Of Alan Buxey Sent: viernes, 22 de junio de 2018 20:06 To: FreeRadius users mailing list Subject: Re: right tutorial hi, Could somebody tell us which tutorial /wiki can we follow in order to > properly configure freeradius 3.0.16? > properly configure? you need to define what it is you are trying to do. based on other replies there is history here that I havent seen (or deleted amongst deluge of other posts) one persons requirement/use-case rarely matches with another. take FreeRADIUS 3.0.16 - either built form source or via package. then follow the guides (or read the docs in the config files themselves) as required. DONT hack a load of the config around , start with basics (as per docs) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 10

RE: Large Deployment advice. 10000 users
by Angel Elena 25 Jun '18

25 Jun '18

1) bbdd tunning if your setup is mysql, create tables as innodb, or setup percona. Define buffers, etc... https://www.linode.com/docs/databases/mysql/how-to-optimize-mysql-performan… tune linux kernel also, like swap file location, file descriptors ... google is your friend. 3) tunning freeradius config read radius.conf file and adapt to your setup. -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp. -----Mensaje original----- De: Uchenna Nebedum <nebeduch(a)gmail.com> Enviado: Lun 25-06-2018 11:32 Asunto: Re: Large Deployment advice. 10000 users Para: FreeRadius users mailing list <Freeradius-Users(a)lists.freeradius.org>; > Wow, 10000 is little FreeRADIUS is a lot more powerful than i thought, can > you be more specific about the tunings? Like what exactly? > > On Mon, Jun 25, 2018, 10:28 Angel Elena <craem(a)craem.net> wrote: > > > 10k users it's a little deploy. > > > > your performance depends only: > > > > 1) bbdd tunning (mysql - postgree) > > 2) Operating system tunning (file descriptors, etc...) > > 3) split radius server and bbdd servers > > 4) tunning freeradius config. > > > > > > > > > > > > > > > > -------------------------------- > > Ángel Elena Medina _o) > > craem(a)craem.net / \\ > > http://blog.craem.net _(___V > > @craem_ > > www.linkedin.com/in/angel-elena-medina > > -------------------------------- > > Zarafa Webapp. > > > > -----Mensaje original----- > > De: Uchenna Nebedum <nebeduch(a)gmail.com> > > Enviado: Lun 25-06-2018 11:21 > > Asunto: Large Deployment advice. 10000 users > > Para: FreeRadius users mailing list < > > Freeradius-Users(a)lists.freeradius.org>; > > > Good Day all, > > > > > > If i wanted to use freeRADIUS to manage about 100 NAS each with about > > > 1000 users, could i use a single server for all the NAS, if yes, what > > spec > > > of server. And would MySQL still be the best database to use considering > > > performance or would Redis be better. And what would be the best > > > configurations. > > > > > > Please i need advice. Thanks a lot for any help. > > > - > > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Large Deployment advice. 10000 users
by Angel Elena 25 Jun '18

25 Jun '18

10k users it's a little deploy. your performance depends only: 1) bbdd tunning (mysql - postgree) 2) Operating system tunning (file descriptors, etc...) 3) split radius server and bbdd servers 4) tunning freeradius config. -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ www.linkedin.com/in/angel-elena-medina -------------------------------- Zarafa Webapp. -----Mensaje original----- De: Uchenna Nebedum <nebeduch(a)gmail.com> Enviado: Lun 25-06-2018 11:21 Asunto: Large Deployment advice. 10000 users Para: FreeRadius users mailing list <Freeradius-Users(a)lists.freeradius.org>; > Good Day all, > > If i wanted to use freeRADIUS to manage about 100 NAS each with about > 1000 users, could i use a single server for all the NAS, if yes, what spec > of server. And would MySQL still be the best database to use considering > performance or would Redis be better. And what would be the best > configurations. > > Please i need advice. Thanks a lot for any help. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius realm using multiple sql and virtual server
by Philemon Jaomalaza 24 Jun '18

24 Jun '18

Hello Dear, On the same server where Freeradius 3 is installed, I would like to have more instance of sql for each NAS to use its virtual server and its database. I do not know if it's a good idea but that's what I did: - in proxy.conf ..................... ....................... realm mydomaintest.com { auth_pool = my_auth_failover virtual_server = mydomaintest.com } - I then created a module sql1 which is confgured for the database "radius1" from the sql module template in /freeradius/3.0/mods-available/ and linked in /freeradius/3.0/mods-enabled/ sql sql1 { driver = "rlm_sql_mysql" ....................... ....................... pool = sql ...................... group_attribute = "$ {.: instance} -SQL-Group" # This entry should be used for the default instance (sql {}) # of the SQL module. # group_attribute = "SQL-Group" ...................................... ..................................... etc. } - in /freeradius/3.0/sites-available/ I created a mydomaintest.com virtual server from the deflaut.conf template and linked it to /freeradius/3.0/sites-enabled/ and I changed all the words "sql" by default to "sql1": server mydomaintest.com { authorize { ........................... sql1 ........................... } authenticate { # all default content } # etc. } The problems now when I try to authenticate like user(a)mydomaintest.com, he sees realm "mydomaintest.com" and Stripped the username in "user" but he does not try to use it in the database " radius1 "but always in sql the database" radius "of the blow it does not find the user and that gives Access-Reject. Where should I have made a mistake? What is the best trick to make this feature? Philemon Jaomalaza Tél. : +261 (0) 32 05 113 26 Email : <mailto:philemon.jaomalaza@gmail.com> philemon.jaomalaza(a)gmail.com

3 13

Stripping the calling station id
by Kefi Ammar . 22 Jun '18

22 Jun '18

Hello, Could someone help me to strip the calling station id recieved in the request to use it later for the checkval module. I am applying the mac authentication using checkval but the problem is that I am recieving a long calling station id containing the mac address. this is an exemple of the calling station id recieved : lag-50:1201.0#BNG Kasbah###pppoe 94:a7:b7:3e:93:5b# its always in this format and I only want to extract the mac address from it. I dont know if it can be achieved using unlang or anything else.

3 14

Errors in configuring sqlcounter with FreeRADIUS
by Rohith Asrk 22 Jun '18

22 Jun '18

Hi everyone, I'm working on the django-freeradius <https://github.com/openwisp/django-freeradius/> project and trying to enforce session limits on users using the web interface. To accomplish that I'm using the rlm_sqlcounter module of FreeRADIUS. When trying to configure sqlcounter module with FreeRADIUS I'm facing the errors as below. including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/sqlcounter /etc/freeradius/mods-enabled/sqlcounter[43]: Reference "${modules.sql.dialect}" not found /etc/freeradius/mods-enabled/sqlcounter[52]: Reference "${modconfdir}/sql/counter/${dialect}/${.:instance}.conf" points to a variable which has not been expanded. Errors reading or parsing /etc/freeradius/radiusd.conf I think FreeRADIUS is trying to load the sqlcounter module before sql module and therefore this errors. I've tried using the instantiate section as well but couldn't configure it properly. I've tried checking out the previous threads and with people having the same issues too but couldn't help myself. Any leads would be appreciated. Thank you, Rohith ASRK

2 3