- Freeradius-Users - lists.freeradius.org

using 2 autenticzation Schemes sql and ldap Ad
by Tal Assa 23 Jan '15

23 Jan '15

Hello friends im a newbie and any help will be appricaiate i would like to add the LDAP (ACTIVE DIRECTORY) Authenticaton Currently im using SQL database with daloradius support Now i would like to add the ldap authentiction . My questions is how to i telll free radius what to check first i hope i raised the question properly Tia Tal --

2 4

Documentation in HTML form
by Alan DeKok 23 Jan '15

23 Jan '15

The PDF documentation has proved to be popular. We’re getting about 100 unique addresses a day who download (and presumably read) the documentation. In the interest of making it even more accessible, we’ve converted it to HTML, with cross-links. It’s now available at: http://networkradius.com/doc/3.0.7/ We’ll update the documentation every time a new version is released. Want to see which configuration items a module takes, and what they do? No problem! Go read this page: http://networkradius.com/doc/3.0.7/raddb/mods-available/ Or which string expansions are available?. e.g. %{exec:…} http://networkradius.com/doc/3.0.7/raddb/mods-available/expansions.html And a list of “unlang” keywords: http://networkradius.com/doc/3.0.7/unlang/keywords.html As you’ll probably note, the documentation is *not* complete. However, we’re actively working on it. After a large amount of “behind the scenes” work, it’s time to make it public. Making it public means that people get to see the documentation, and we get incentive to keep it up to date. :) The web site has about 100 unique pages. We have another 100 in the pipeline which need reviewing and publishing. Then, there’s probably another 100-200 of new documentation which needs writing. Alan DeKok.

1 0

Configure SQL to timeout requests rather than rejecting if no connections available
by Noah Engelberth 23 Jan '15

23 Jan '15

I am using FreeRADIUS 3.0.4, compiled from source on CentOS 6.5. I'm using the source-compiled version rather than from package because my RADIUS servers need to make a connection to a MS SQL always-on availability group (cluster) that relies on the Microsoft SQL Native Client 11 ODBC driver (which requires a source-compiled version of unix-odbc and thus prevents me from installing the package versions of ODBC & FreeRADIUS). My infrastructure is set up with multiple MikroTik routers as the RADIUS clients, connecting to two FreeRADIUS servers in a round-robin fashion. The MikroTik routers are configured to wait 1500ms for a response from their primary RADIUS server before they re-submit the request. If they make a total of 3 unsuccessful requests with no response (the original + 2 resends) on the primary server, they will re-submit the request to the secondary server. The RADIUS requests are being made to authorize DHCP requests and hotspot sessions. Because of a difference in what reply information (for rate-limit and other similar properties) need to go out based on the two types of requests, we are using realms to route the requests off to an appropriate virtual server. Both virtual servers share the same SQL connection pool (and have different queries they pass). Occasionally, we have a network disruption (intentional or otherwise) that drops multiple hotspot sessions simultaneously, "crushing" the RADIUS server under a sharp spike in request load. The SQL module is configured as follows: pool { start = 15 min = 0 max = 45 spare = 15 uses = 0 lifetime = 0 idle_timeout = 0 } Under the heavy load situation, we're seeing entries in radius.log that there aren't enough spares, it starts opening another, and eventually runs out of connections before it can open enough additional connections (it usually only tries to add 1, maybe 2 new connections total during the course of the spike). Looking through the log of the "master" virtual server that handles the requests and proxies it off to the realm-specific handler (another virtual server on the same physical machine), we're seeing results along the lines of: Auth: Login incorrect (Home Server says so): [<client MAC>@hotspot<realm>] (from client <nas identity> port 16346 cli <client MAC>) The realm-specific virtual server is returning: Auth: Invalid user: [<client MAC>@hotspot<realm>] (from client <nas identity> port 16415 cli <client MAC> via TLS tunnel) Is there a setting change I can make to get the server to just ignore/drop the request if there are no SQL connections available, rather than sending a reject? I'm obviously still tuning my max concurrency limits to minimize the frequency of these spikes, but it would be nice if RADIUS would also help my by generating re-requests that spread out the load and distribute it across both servers, rather than just generating a bunch of rejects that block my customers until someone intervenes and cleans up the rejected sessions. Thank you, Noah Engelberth MetaLINK Technologies

4 11

FreeRadius 2.1.12 with winbind - performance issues
by Diggins Mike 23 Jan '15

23 Jan '15

Hi, I'm running two virtualized (ESXi) RedHat (v.5) version of FreeRadius (2.1.12-4.el5_8) and winbind (3.5.10-0.110.el5_8) using ntlm_auth for authentication and I've been running into performance issues. The systems mainly handle authentication traffic from a number of Cisco WLAN controllers (5508 series) serving a University with about 12000 active users during peak load. During class change my radiusd process id CPU usage can rise from 10% to over 100%. During those times I see a variety of symptoms: 1. radiusd[2042]: Discarding duplicate request from client xxx port 32769 - ID: 71 due to unfinished request 2860332 (very common) 2. WARNING: Please check the configuration file. The value for 'max_requests' is probably set too low. 3. Dropping request (1025 is too many): from client xxx port 32769 - ID: 155 4. At its worst, the WLAN controllers will fail over to the secondary radius server (back and forth too) I read through many of the posts on this list on the same topic and followed some of those recommendations. So far: 1. Increased my system resources (now 2 cores, 2G ram, previously 1 core, 1G ram) 2. Increased 'max_requests' to 2048 (from 1048) 3. Add the line "winbind max domain connections = 10" to samba smb.conf. 4. Increased the radius server timeout on the WLAN controller from 2 seconds to 5 seconds (recommended by Cisco) I've seen some improvement. I no longer see the complaints about increasing max_requests size (or dropping requests). WLAN controllers are no longer failing to the other radius server, at least not as often. I still see many of the "Discarding duplicate requests" and radiusd CPU utilization still goes very high during class change (>100%). Overall, system load averages have improved. My feeling is that increasing system resources again isn't going to make a significant improvement and I'm considering adding a third server. >From what I've read, radiusd should be able to handle a large number of simultaneous requests and that it's mostly likely the back end database that is slow (in my case winbind). Watching the process list, I see very few ntlm_auth child processes created and they don't last very long. The winbind process id never climbs above 3%. Questions: 1. How could I tell if winbind is slowing the system down? 2. Would switching to Kerberos for authentication instead of winbind help? 3. Would upgrading to the latest versions of FreeRadius and Winbind likely help (i.e. are there known improvements that would make a difference)? 4. Can anyone suggest other improvements I could make? -Mike

6 7

sites-available vs sites-enabled
by Jim Shi 22 Jan '15

22 Jan '15

What is the difference of these two directories? when configuring free radius, should I make change to files under site-enabled, not site-available? Thanks Jim

3 2

Re: encrypted response (parameter) (Alan DeKok)
by kavyamelinmaneprabhakar 22 Jan '15

22 Jan '15

Hi, I am getting valid response from fR server. But not able to change access level How to set access(privilege) level to radius user. I know how to set the sane if I am using Cisco avpair. But currently I want to use NET user access level info. Thanks in advance, Kavya ---------- Forwarded message ---------- From: freeradius-users-owner(a)lists.freeradius.org Date: 22-Jan-2015 6:06 am Subject: The results of your email commands To: kavyamelinmaneprabhakar(a)gmail.com Cc: > The results of your email command are provided below. Attached is your > original message. > > > - Unprocessed: > How to set access(privilege) level to radius user. > I know how to set the sane if I am using Cisco avpair. But currently I want to use NET user access level info. > Thanks in advance, > Kavya > On 22-Jan-2015 2:28 am, freeradius-users-request(a)lists.freeradius.org wrote: > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > - Ignored: > > > > �� 1. Re: Configure SQL to timeout requests rather than rejecting > > �� if no connections available (Alan DeKok) > > �� 2. RE: Configure SQL to timeout requests rather than rejecting > > �� if no connections available (Noah Engelberth) > > �� 3. encrypted response (parameter) (the2nd(a)otpme.org) > > �� 4. Re: encrypted response (parameter) (Alan DeKok) > > �� 5. Re: encrypted response (parameter) (the2nd(a)otpme.org) > > �� 6. Re: encrypted response (parameter) (Alan DeKok) > > �� 7. Re: encrypted response (parameter) (the2nd(a)otpme.org) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Wed, 21 Jan 2015 13:57:55 -0500 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Configure SQL to timeout requests rather than rejecting > > if no connections available > > Message-ID: <290AA10E-81DA-451A-8CC4-C9517E1C1EC8(a)deployingradius.com> > > Content-Type: text/plain; charset=windows-1252 > > > > On Jan 21, 2015, at 1:20 PM, Noah Engelberth <nengelberth(a)team-meta.net> wrote: > > > So, "in your existing configuration" means what I have with the virtual server not responding on an SQL "fail"?�� Or to revert that change and then add that post-proxy handling? > > > > �� <sigh>�� What I said was very clear.�� I said to change ONE thing.�� The PROXY.�� I didn?t say to revert a change. > > > > > My server configuration currently (with the virtual server not responding on SQL "fail") is: > > > > �� I didn?t ask for that.�� I asked for the DEBUG OUTPUT. > > > > �� Paying attention would be nice.�� Following instructions would be better. > > > > > So, basically, the mikrotik_realm module looks at the realm name that came in from the client (which might be requesting hotspot.metalink.net or dhcp.metalink.net) and update the username to username@realm.�� Suffix then proxies it off to the virtual server named platreg_<realm> > > > > �� NO.�� I said that the suffix module DOES NOT DO PROXYING. > > > > �� Please pay attention. > > > > > I can't easily run the live servers in debug mode -- they're under fairly heavy volume and it's hard to get useful information from them.�� I have fairly high request logging turned up at the moment, and I can try to set up my debug environment with a test case that could replicate the issue if necessary. > > > > �� If only there was a free ?radius client? tool which would let you send test packets. > > > > �� If only it was possible to create a test configuration *independent* of the live configuration, where test packets could be sent. > > > > �� Yes, I find this frustrating.�� I?m trying to help you, and you?re making it as difficult as possible. > > > > �� Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Wed, 21 Jan 2015 19:14:42 +0000 > > From: Noah Engelberth <nengelberth(a)team-meta.net> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: RE: Configure SQL to timeout requests rather than rejecting > > if no connections available > > Message-ID: <c39fc7ee4d7244f58a50402868be8fbe(a)def-exch.dh.local> > > Content-Type: text/plain; charset="us-ascii" > > > > > > >�� <sigh>�� What I said was very clear.�� I said to change ONE thing.�� The PROXY.�� I > > > didn't say to revert a change. > > > > > I read your previous as "The issue is that you don't want to respond to the *client*.�� You *do* want the virtual server to respond to the proxy." > > > > This made me think: "The previous change I made to make the virtual server not respond in the case of SQL failing is causing the virtual server not to respond the proxy, so I must need

1 0

encrypted response (parameter)
by the2nd＠otpme.org 21 Jan '15

21 Jan '15

hi, is it possible to add an attribute to an Access-Accept packet that is encrypted? just like the user password in the Access-Request? regards the2nd

2 5

Information you requested on Salt SHA512
by Robert Graham 21 Jan '15

21 Jan '15

Unicode encoding and we're hashing the salt and password in salt, then password order. Hash( salt + password ); Password Salt Hash Hellohello1 8888702 0x20D6AB7A8B3E40F62D8DC1022D0B0FDE4388FEA53C3ECD63395BA382B2596FFCD15711EEBCC3CCC5620A1B1BCFB4B89914609985994B1E3CB30C568D5FCD0311 Testtesttest1 8888975 0xDDF4C53D3AD71CB04A4BDD5F6B9B8586BB65723CE027EF26D0E0C121DD4A88311ECA987F5100360C2BD89675531A7AB261F283C64CC64B5DD57563A89507D5DF public static byte[] Hash(string salt, string password) { byte[] passwordBytes = Encoding.Unicode.GetBytes(password); byte[] saltedPasswordBytes; if (string.IsNullOrEmpty(salt)) { saltedPasswordBytes = new byte[passwordBytes.Length]; } else { byte[] saltBytes = Encoding.Unicode.GetBytes(salt); saltedPasswordBytes = new byte[passwordBytes.Length + saltBytes.Length]; Array.Copy(saltBytes, 0, saltedPasswordBytes, passwordBytes.Length, saltBytes.Length); } Array.Copy(passwordBytes, saltedPasswordBytes, passwordBytes.Length); using (var hashProvider = new SHA512Managed()) { return hashProvider.ComputeHash(saltedPasswordBytes); } } Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

3 3

problem with CA certificate using mschapv2
by marcos 21 Jan '15

21 Jan '15

Hi Im checking my configuration using freeradius 2.2.5 and I detect this error TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. Looking radiusd.conf all seems to be correct, but Im using TERENA CA and Im not sure which CA is the correct. Somebody knows how to concret the error? Is not reading CA? CA is not valid? Thanks -- For private content :-) Public key 0x0C05942A895BD10E FIngerprint 45B9 EC0B 58D5 B17C 8C37 95C3 0C05 942A 895B D10E

4 9

checkval module for calling-station-id & nasidentifier
by Russell Mike 20 Jan '15

20 Jan '15

Hi Friends, is it possible to use checkval module for Calling-Station-Id & nasidentifier simultaneously ? i.e. i am already using calling-Station-Id attribute for MAC authentication but i also need to use nas-identifier, to restrict a user to specific NAS. Can i do the following? *nano /etc/freeradius/modules/checkval* checkval Calling-Station-Id { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string notfound-reject = no } checkval nasidentifier { item-name = NAS-Identifier check-name = NAS-Identifier data-type = string notfound-reject = no } Thanks / --RM

2 2