- Freeradius-Users - lists.freeradius.org

Documentation in HTML form
by Alan DeKok 23 Jan '15

23 Jan '15

The PDF documentation has proved to be popular. We’re getting about 100 unique addresses a day who download (and presumably read) the documentation. In the interest of making it even more accessible, we’ve converted it to HTML, with cross-links. It’s now available at: http://networkradius.com/doc/3.0.7/ We’ll update the documentation every time a new version is released. Want to see which configuration items a module takes, and what they do? No problem! Go read this page: http://networkradius.com/doc/3.0.7/raddb/mods-available/ Or which string expansions are available?. e.g. %{exec:…} http://networkradius.com/doc/3.0.7/raddb/mods-available/expansions.html And a list of “unlang” keywords: http://networkradius.com/doc/3.0.7/unlang/keywords.html As you’ll probably note, the documentation is *not* complete. However, we’re actively working on it. After a large amount of “behind the scenes” work, it’s time to make it public. Making it public means that people get to see the documentation, and we get incentive to keep it up to date. :) The web site has about 100 unique pages. We have another 100 in the pipeline which need reviewing and publishing. Then, there’s probably another 100-200 of new documentation which needs writing. Alan DeKok.

1 0

Configure SQL to timeout requests rather than rejecting if no connections available
by Noah Engelberth 23 Jan '15

23 Jan '15

I am using FreeRADIUS 3.0.4, compiled from source on CentOS 6.5. I'm using the source-compiled version rather than from package because my RADIUS servers need to make a connection to a MS SQL always-on availability group (cluster) that relies on the Microsoft SQL Native Client 11 ODBC driver (which requires a source-compiled version of unix-odbc and thus prevents me from installing the package versions of ODBC & FreeRADIUS). My infrastructure is set up with multiple MikroTik routers as the RADIUS clients, connecting to two FreeRADIUS servers in a round-robin fashion. The MikroTik routers are configured to wait 1500ms for a response from their primary RADIUS server before they re-submit the request. If they make a total of 3 unsuccessful requests with no response (the original + 2 resends) on the primary server, they will re-submit the request to the secondary server. The RADIUS requests are being made to authorize DHCP requests and hotspot sessions. Because of a difference in what reply information (for rate-limit and other similar properties) need to go out based on the two types of requests, we are using realms to route the requests off to an appropriate virtual server. Both virtual servers share the same SQL connection pool (and have different queries they pass). Occasionally, we have a network disruption (intentional or otherwise) that drops multiple hotspot sessions simultaneously, "crushing" the RADIUS server under a sharp spike in request load. The SQL module is configured as follows: pool { start = 15 min = 0 max = 45 spare = 15 uses = 0 lifetime = 0 idle_timeout = 0 } Under the heavy load situation, we're seeing entries in radius.log that there aren't enough spares, it starts opening another, and eventually runs out of connections before it can open enough additional connections (it usually only tries to add 1, maybe 2 new connections total during the course of the spike). Looking through the log of the "master" virtual server that handles the requests and proxies it off to the realm-specific handler (another virtual server on the same physical machine), we're seeing results along the lines of: Auth: Login incorrect (Home Server says so): [<client MAC>@hotspot<realm>] (from client <nas identity> port 16346 cli <client MAC>) The realm-specific virtual server is returning: Auth: Invalid user: [<client MAC>@hotspot<realm>] (from client <nas identity> port 16415 cli <client MAC> via TLS tunnel) Is there a setting change I can make to get the server to just ignore/drop the request if there are no SQL connections available, rather than sending a reject? I'm obviously still tuning my max concurrency limits to minimize the frequency of these spikes, but it would be nice if RADIUS would also help my by generating re-requests that spread out the load and distribute it across both servers, rather than just generating a bunch of rejects that block my customers until someone intervenes and cleans up the rejected sessions. Thank you, Noah Engelberth MetaLINK Technologies

4 11

FreeRadius 2.1.12 with winbind - performance issues
by Diggins Mike 23 Jan '15

23 Jan '15

Hi, I'm running two virtualized (ESXi) RedHat (v.5) version of FreeRadius (2.1.12-4.el5_8) and winbind (3.5.10-0.110.el5_8) using ntlm_auth for authentication and I've been running into performance issues. The systems mainly handle authentication traffic from a number of Cisco WLAN controllers (5508 series) serving a University with about 12000 active users during peak load. During class change my radiusd process id CPU usage can rise from 10% to over 100%. During those times I see a variety of symptoms: 1. radiusd[2042]: Discarding duplicate request from client xxx port 32769 - ID: 71 due to unfinished request 2860332 (very common) 2. WARNING: Please check the configuration file. The value for 'max_requests' is probably set too low. 3. Dropping request (1025 is too many): from client xxx port 32769 - ID: 155 4. At its worst, the WLAN controllers will fail over to the secondary radius server (back and forth too) I read through many of the posts on this list on the same topic and followed some of those recommendations. So far: 1. Increased my system resources (now 2 cores, 2G ram, previously 1 core, 1G ram) 2. Increased 'max_requests' to 2048 (from 1048) 3. Add the line "winbind max domain connections = 10" to samba smb.conf. 4. Increased the radius server timeout on the WLAN controller from 2 seconds to 5 seconds (recommended by Cisco) I've seen some improvement. I no longer see the complaints about increasing max_requests size (or dropping requests). WLAN controllers are no longer failing to the other radius server, at least not as often. I still see many of the "Discarding duplicate requests" and radiusd CPU utilization still goes very high during class change (>100%). Overall, system load averages have improved. My feeling is that increasing system resources again isn't going to make a significant improvement and I'm considering adding a third server. >From what I've read, radiusd should be able to handle a large number of simultaneous requests and that it's mostly likely the back end database that is slow (in my case winbind). Watching the process list, I see very few ntlm_auth child processes created and they don't last very long. The winbind process id never climbs above 3%. Questions: 1. How could I tell if winbind is slowing the system down? 2. Would switching to Kerberos for authentication instead of winbind help? 3. Would upgrading to the latest versions of FreeRadius and Winbind likely help (i.e. are there known improvements that would make a difference)? 4. Can anyone suggest other improvements I could make? -Mike

6 7

sites-available vs sites-enabled
by Jim Shi 22 Jan '15

22 Jan '15

What is the difference of these two directories? when configuring free radius, should I make change to files under site-enabled, not site-available? Thanks Jim

3 2

Re: encrypted response (parameter) (Alan DeKok)
by kavyamelinmaneprabhakar 22 Jan '15

22 Jan '15

Hi, I am getting valid response from fR server. But not able to change access level How to set access(privilege) level to radius user. I know how to set the sane if I am using Cisco avpair. But currently I want to use NET user access level info. Thanks in advance, Kavya ---------- Forwarded message ---------- From: freeradius-users-owner(a)lists.freeradius.org Date: 22-Jan-2015 6:06 am Subject: The results of your email commands To: kavyamelinmaneprabhakar(a)gmail.com Cc: > The results of your email command are provided below. Attached is your > original message. > > > - Unprocessed: > How to set access(privilege) level to radius user. > I know how to set the sane if I am using Cisco avpair. But currently I want to use NET user access level info. > Thanks in advance, > Kavya > On 22-Jan-2015 2:28 am, freeradius-users-request(a)lists.freeradius.org wrote: > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > - Ignored: > > > > �� 1. Re: Configure SQL to timeout requests rather than rejecting > > �� if no connections available (Alan DeKok) > > �� 2. RE: Configure SQL to timeout requests rather than rejecting > > �� if no connections available (Noah Engelberth) > > �� 3. encrypted response (parameter) (the2nd(a)otpme.org) > > �� 4. Re: encrypted response (parameter) (Alan DeKok) > > �� 5. Re: encrypted response (parameter) (the2nd(a)otpme.org) > > �� 6. Re: encrypted response (parameter) (Alan DeKok) > > �� 7. Re: encrypted response (parameter) (the2nd(a)otpme.org) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Wed, 21 Jan 2015 13:57:55 -0500 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: Configure SQL to timeout requests rather than rejecting > > if no connections available > > Message-ID: <290AA10E-81DA-451A-8CC4-C9517E1C1EC8(a)deployingradius.com> > > Content-Type: text/plain; charset=windows-1252 > > > > On Jan 21, 2015, at 1:20 PM, Noah Engelberth <nengelberth(a)team-meta.net> wrote: > > > So, "in your existing configuration" means what I have with the virtual server not responding on an SQL "fail"?�� Or to revert that change and then add that post-proxy handling? > > > > �� <sigh>�� What I said was very clear.�� I said to change ONE thing.�� The PROXY.�� I didn?t say to revert a change. > > > > > My server configuration currently (with the virtual server not responding on SQL "fail") is: > > > > �� I didn?t ask for that.�� I asked for the DEBUG OUTPUT. > > > > �� Paying attention would be nice.�� Following instructions would be better. > > > > > So, basically, the mikrotik_realm module looks at the realm name that came in from the client (which might be requesting hotspot.metalink.net or dhcp.metalink.net) and update the username to username@realm.�� Suffix then proxies it off to the virtual server named platreg_<realm> > > > > �� NO.�� I said that the suffix module DOES NOT DO PROXYING. > > > > �� Please pay attention. > > > > > I can't easily run the live servers in debug mode -- they're under fairly heavy volume and it's hard to get useful information from them.�� I have fairly high request logging turned up at the moment, and I can try to set up my debug environment with a test case that could replicate the issue if necessary. > > > > �� If only there was a free ?radius client? tool which would let you send test packets. > > > > �� If only it was possible to create a test configuration *independent* of the live configuration, where test packets could be sent. > > > > �� Yes, I find this frustrating.�� I?m trying to help you, and you?re making it as difficult as possible. > > > > �� Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Wed, 21 Jan 2015 19:14:42 +0000 > > From: Noah Engelberth <nengelberth(a)team-meta.net> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: RE: Configure SQL to timeout requests rather than rejecting > > if no connections available > > Message-ID: <c39fc7ee4d7244f58a50402868be8fbe(a)def-exch.dh.local> > > Content-Type: text/plain; charset="us-ascii" > > > > > > >�� <sigh>�� What I said was very clear.�� I said to change ONE thing.�� The PROXY.�� I > > > didn't say to revert a change. > > > > > I read your previous as "The issue is that you don't want to respond to the *client*.�� You *do* want the virtual server to respond to the proxy." > > > > This made me think: "The previous change I made to make the virtual server not respond in the case of SQL failing is causing the virtual server not to respond the proxy, so I must need

1 0

encrypted response (parameter)
by the2nd＠otpme.org 21 Jan '15

21 Jan '15

hi, is it possible to add an attribute to an Access-Accept packet that is encrypted? just like the user password in the Access-Request? regards the2nd

2 5

Information you requested on Salt SHA512
by Robert Graham 21 Jan '15

21 Jan '15

Unicode encoding and we're hashing the salt and password in salt, then password order. Hash( salt + password ); Password Salt Hash Hellohello1 8888702 0x20D6AB7A8B3E40F62D8DC1022D0B0FDE4388FEA53C3ECD63395BA382B2596FFCD15711EEBCC3CCC5620A1B1BCFB4B89914609985994B1E3CB30C568D5FCD0311 Testtesttest1 8888975 0xDDF4C53D3AD71CB04A4BDD5F6B9B8586BB65723CE027EF26D0E0C121DD4A88311ECA987F5100360C2BD89675531A7AB261F283C64CC64B5DD57563A89507D5DF public static byte[] Hash(string salt, string password) { byte[] passwordBytes = Encoding.Unicode.GetBytes(password); byte[] saltedPasswordBytes; if (string.IsNullOrEmpty(salt)) { saltedPasswordBytes = new byte[passwordBytes.Length]; } else { byte[] saltBytes = Encoding.Unicode.GetBytes(salt); saltedPasswordBytes = new byte[passwordBytes.Length + saltBytes.Length]; Array.Copy(saltBytes, 0, saltedPasswordBytes, passwordBytes.Length, saltBytes.Length); } Array.Copy(passwordBytes, saltedPasswordBytes, passwordBytes.Length); using (var hashProvider = new SHA512Managed()) { return hashProvider.ComputeHash(saltedPasswordBytes); } } Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

3 3

problem with CA certificate using mschapv2
by marcos 21 Jan '15

21 Jan '15

Hi Im checking my configuration using freeradius 2.2.5 and I detect this error TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. Looking radiusd.conf all seems to be correct, but Im using TERENA CA and Im not sure which CA is the correct. Somebody knows how to concret the error? Is not reading CA? CA is not valid? Thanks -- For private content :-) Public key 0x0C05942A895BD10E FIngerprint 45B9 EC0B 58D5 B17C 8C37 95C3 0C05 942A 895B D10E

4 9

checkval module for calling-station-id & nasidentifier
by Russell Mike 20 Jan '15

20 Jan '15

Hi Friends, is it possible to use checkval module for Calling-Station-Id & nasidentifier simultaneously ? i.e. i am already using calling-Station-Id attribute for MAC authentication but i also need to use nas-identifier, to restrict a user to specific NAS. Can i do the following? *nano /etc/freeradius/modules/checkval* checkval Calling-Station-Id { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string notfound-reject = no } checkval nasidentifier { item-name = NAS-Identifier check-name = NAS-Identifier data-type = string notfound-reject = no } Thanks / --RM

2 2

Re: Freeradius-Users access level issues
by KAVYA PRABHAKAR 20 Jan '15

20 Jan '15

Hi, I want to configure user access level info in FR. If I am using Cisco I will be adding following line in users file Cisco-AVPair = "shell:priv-lvl = 15" But I want to add NET user access level info to 15,so that I can see the same in radius response I receive from FR. Could you please help me know where and what file I have to look into for this info. I know similar configuration and was successful when I used other radius server.But I am not able to relate the same with FR. Thanks in advance, Kavya On 20-Jan-2015 3:39 am, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Freeradius 3 and routers problem (alter1) > 2. Re: Freeradius 3 and routers problem (Alan DeKok) > 3. Re: VMPS sql error - WARNING: Unknown module "sql" in string > expansion "%" (Arran Cudbard-Bell) > 4. Re: Re: Freeradius 3 and routers problem (alter1) > 5. Re: Freeradius 3 and routers problem (Alan DeKok) > 6. test PEAP (Jim Shi) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 19 Jan 2015 12:29:14 +0100 > From: alter1 <alter1(a)onet.pl> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius 3 and routers problem > Message-ID: > <107867304-c4b8ba06baaf39b736858171721998e8(a)pmq5.m5r2.onet> > Content-Type: text/plain; charset="utf-8" > > Hello, > ? > I have a network: 3 soho wifi routers Dlink wrt54gl, wrt320n and Asus > RT-AC52U. On each is the same configuration (wifi wpa2-enterprise with > radius auth on 192.168.10.x server with 1812 port and secret key for each > client) > ? > Server is Centos 7 based with latest version with ip 192.168.10.x > # repoquery freeradius > freeradius-0:3.0.1-6.el7.x86_64 > # tail -19 /etc/raddb/clients.conf > client rt-a1-2 { > ??????? ipaddr = 192.168.10.4 > ??????? secret = test1 > ??????? shortname = rt-a1-2 > } > client rt-a1-1 { > ??????? ipaddr = 192.168.10.2 > ??????? secret = test2 > ??????? shortname = rt-a1-1 > } > client rt-a2-1 { > ??????? ipaddr = 192.168.10.3 > ??????? secret = test3 > ??????? shortname = rt-a2-1 > } > In /etc/raddb/users par example: > "test" Cleartext-Password := "test" > and others in the same format... > ? > This server is relay to other dhcp server therefore I have: > # cat /etc/raddb/sites-available/dhcp.relay > server dhcp.ens160 { > ??????? listen { > ??????????????? ipaddr = * > ??????????????? port = 67 > ??????????????? type = dhcp > ??????????????? interface = ens160 > ??????? } > ??????? dhcp DHCP-Discover { > ??????????????? update config { > ??????????????????????? DHCP-Relay-To-IP-Address := 192.168.10.1 > ??????????????? } > ??????????????? update request { > ??????????????????????? DHCP-Gateway-IP-Address := 192.168.10.254 > ??????????????? } > ??????????????? ok > ??????? } > ??????? dhcp DHCP-Request { > ??????????????? update config { > ??????????????????????? DHCP-Relay-To-IP-Address := 192.168.10.1 > ??????????????? } > ??????????????? update request { > ??????????????????????? DHCP-Gateway-IP-Address := 192.168.10.254 > ??????????????? } > ??????????????? ok > ??????? } > } > On 192.168.10.1 dhcpserver works ok > ? > In logs > /var/log/radius/radius.log > Mon Jan 19 12:07:14 2015 : Auth: (44) Login OK: [test/<via Auth-Type = > MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) > Mon Jan 19 12:07:14 2015 : Auth: (45) Login OK: [test/<via Auth-Type = > EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) > Mon Jan 19 12:13:23 2015 : Auth: (59) Login OK: [test/<via Auth-Type = > MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) > Mon Jan 19 12:13:23 2015 : Auth: (60) Login OK: [test/<via Auth-Type = > EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) > Mon Jan 19 12:15:18 2015 : Auth: (70) Login OK: [test/<via Auth-Type = > MSCHAP>] (from client rt-a1-2 port 0 via TLS tunnel) > Mon Jan 19 12:15:18 2015 : Auth: (71) Login OK: [test/<via Auth-Type = > EAP>] (from client rt-a1-2 port 0 cli 8C-3A-E3-XX-XX-XX) > Mon Jan 19 12:16:10 2015 : Auth: (80) Login OK: [test/<via Auth-Type = > MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) > Mon Jan 19 12:17:13 2015 : Auth: (85) Login OK: [test/<via Auth-Type = > EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) > And all works... But... Ater some period of time 30-60 minutes noone can > connect to wifi on AP's. > I tried with alternative firmwares. Still the same. > After tcpdump connections I have nothing... That mean. I tcpdump iface > (ens160) and cannot see ANY PACKETS from any AP's to radius server... > ? > Problem disappear after restart freeradius (systemctl restart > radiusd.service). And after some period of time... the same is happen. > What the point? Where can be a problem? > I tried to disable renew key on AP in radius configuration but this not > helps. > Thanx for help :-) > ? > With regards > MK > ? > ? > ? > > ------------------------------ > > Message: 2 > Date: Mon, 19 Jan 2015 07:44:01 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius 3 and routers problem > Message-ID: <FE155EBC-B18E-4B96-B77B-0B4807DC21F8(a)deployingradius.com> > Content-Type: text/plain; charset=windows-1252 > > On Jan 19, 2015, at 6:29 AM, alter1 <alter1(a)onet.pl> wrote: > > I have a network: 3 soho wifi routers Dlink wrt54gl, wrt320n and Asus > RT-AC52U. On each is the same configuration (wifi wpa2-enterprise with > radius auth on 192.168.10.x server with 1812 port and secret key for each > client) > > OK. That should be simple enough. > > > > Mon Jan 19 12:16:10 2015 : Auth: (80) Login OK: [test/<via Auth-Type = > MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) > > Mon Jan 19 12:17:13 2015 : Auth: (85) Login OK: [test/<via Auth-Type = > EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) > > And all works... But... Ater some period of time 30-60 minutes noone can > connect to wifi on AP?s. > > That?s bad. > > > I tried with alternative firmwares. Still the same. > > After tcpdump connections I have nothing... That mean. I tcpdump iface > (ens160) and cannot see ANY PACKETS from any AP's to radius server? > > Then the APs are broken. When a user logs in, the APs should start > doing RADIUS. > > > Problem disappear after restart freeradius (systemctl restart > radiusd.service). > > Restarting FreeRADIUS doesn?t cause the APs to start sending packets. > Something else is going on. > > What happens if you reboot the APs instead of FreeRADIUS? > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Mon, 19 Jan 2015 20:59:37 +0700 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: VMPS sql error - WARNING: Unknown module "sql" in string > expansion "%" > Message-ID: <B5E4DF5C-63CC-40EC-AAAA-527498C2DEAE(a)freeradius.org> > Content-Type: text/plain; charset=windows-1252 > > > > On 19 Jan 2015, at 10:54, Keith Olsen <keith.r.olsen(a)gmail.com> wrote: > > > > Thanks Alan, > > > > that resolved it. > > > > I?ve spent a fair bit of time getting the VMPS stuff working, in > particular with a mysql DB, and have been documenting for the project I am > using this on. > > > > I would be more than happy to share the cookbook on configuring the VMPS > if you think there?s any value. > > Yes, definitely. > > > I know there is not much call for VMPS, but I know I would have > appreciated a single source to follow. > > > > IF there?s value, let me know where and how I can contribute the > documentation. > > Feel free to add it to the wiki. There's already a cookbook section. > > -Arran > > > > ------------------------------ > > Message: 4 > Date: Mon, 19 Jan 2015 20:58:29 +0100 > From: alter1 <alter1(a)onet.pl> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Re: Freeradius 3 and routers problem > Message-ID: > <107959639-517888edf517a2f20159e5d9a91f7f7a(a)pmq5.m5r2.onet> > Content-Type: text/plain; charset="utf-8" > > Hello again, > > > I know it might sound impossible, but sometimes I have an idea that radius > in certain moment sent some like "deauth" packet to radius clients on AP's > and in this case those clients > dont talk to radius server anymore. Sorry I haven't so many time to read > right RFC :-). So just ask :) > > After rebooting AP's is the same as I described with radius server. It > works for 30-60 minutes and then after another... after another... > A few hours ago I compiled my favorite distro - gentoo and emerge > freeradius for this platform. > > I flashed wrt54gl with dd-wrt firmware (for better testing client from > linksys dd-wrt shell) > # radius-client test test 192.168.10.19 1812 link1 > Accept > > I repeated it every 2 hours and ... is still working without any problems. > But because of nighttime I can prove it tomorrowe with real wifi clients. > I'll back soon > > With regards, > MK > > The only difference is that is net-dialup/freeradius-2.2.5 version - not 3 > like in centos distr. > > W dniu 2015-01-19 13:44:01 u?ytkownik Alan DeKok < > aland(a)deployingradius.com> napisa?: > > On Jan 19, 2015, at 6:29 AM, alter1 <alter1(a)onet.pl> wrote: > > > I have a network: 3 soho wifi routers Dlink wrt54gl, wrt320n and Asus > RT-AC52U. On each is the same configuration (wifi wpa2-enterprise with > radius auth on 192.168.10.x server with 1812 port and secret key for each > client) > > > > OK. That should be simple enough. > > > > > > Mon Jan 19 12:16:10 2015 : Auth: (80) Login OK: [test/<via Auth-Type = > MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) > > > Mon Jan 19 12:17:13 2015 : Auth: (85) Login OK: [test/<via Auth-Type = > EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) > > > And all works... But... Ater some period of time 30-60 minutes noone > can connect to wifi on AP?s. > > > > That?s bad. > > > > > I tried with alternative firmwares. Still the same. > > > After tcpdump connections I have nothing... That mean. I tcpdump iface > (ens160) and cannot see ANY PACKETS from any AP's to radius server? > > > > Then the APs are broken. When a user logs in, the APs should start > doing RADIUS. > > > > > Problem disappear after restart freeradius (systemctl restart > radiusd.service). > > > > Restarting FreeRADIUS doesn?t cause the APs to start sending packets. > Something else is going on. > > > > What happens if you reboot the APs instead of FreeRADIUS? > > > > Alan DeKok. > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > Message: 5 > Date: Mon, 19 Jan 2015 15:06:56 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius 3 and routers problem > Message-ID: <2D43F89A-7262-4C5D-955E-BD0A1330B194(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Jan 19, 2015, at 2:58 PM, alter1 <alter1(a)onet.pl> wrote: > > I know it might sound impossible, but sometimes I have an idea that > radius in certain moment sent some like "deauth" packet to radius clients > on AP's and in this case those clients > > dont talk to radius server anymore. > > There is no such RADIUS packet. > > > After rebooting AP's is the same as I described with radius server. It > works for 30-60 minutes and then after another... after another... > > A few hours ago I compiled my favorite distro - gentoo and emerge > freeradius for this platform. > > Take your APs, and throw them in the garbage. Then, buy APs that work. > > Alan DeKok. > > > > ------------------------------ > > Message: 6 > Date: Mon, 19 Jan 2015 14:08:13 -0800 > From: Jim Shi <hanmao_shi(a)apple.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: test PEAP > Message-ID: <F64B0806-2459-4B40-94C2-A86FD367777A(a)apple.com> > Content-Type: text/plain; charset=windows-1252 > > I try test PEAP following steps described in > > http://www.freesoftwaremagazine.com/articles/howto_incremental_setup_freera… > > it says to send the following to radius server: > > $ cat eapol_test.conf.peap > network={ > eap=PEAP > eapol_flags=0 > key_mgmt=IEEE8021X > identity="testuser" > password="password" > ca_cert="/home/gcheng/myCA/cacert.pem" > phase2="auth=MSCHAPV2" > anonymous_identity="anonymous" > } > > When running the test, I noticed that it sends ?anonymous? user to the > server and the server try to authenticate user ?anonymous? and failed. > Any ideas what is ?anonymous? here? Do we need set up password for > ?anonymous? on the server? > > > Thanks > Jim > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 117, Issue 56 > ************************************************* >

2 1