- Freeradius-Users - lists.freeradius.org

Re: Beginner need help
by KAVYA PRABHAKAR 25 Sep '14

25 Sep '14

Hi, Thank you for yesterday's suggestion. I am able to run RADIUS server in debug mode. I have few more queries. Query1: When I send a request from IP:1645 port(gateway which acts as Radius client) to Radius server, i get an error as "request from unknown client IP.1645 ignored. I get reject message from server. Message authenticator is not present in request under AVP attributes. Query2: When I send Radius request from one host to another, request reaches server and server will never respond to the same. Message authenticate value is present. I have set message_authenticator value to no in radiusd.conf Why is the behavior different in these 2 case? In both the cases I sniffed it on ubuntu PC where server is running. I am sure request is reaching PC, but I am not sure if its hitting application. Should I have my Radius user details in my sql table. If yes, can you please tell me how do I do that. Can you please share the link. I am new to freeradius and ubuntu as well. Could you please help me in this regard. Thanks, Kavya

2 1

Re: move freeradius on mysql
by Zulzig 25 Sep '14

25 Sep '14

Hello Lalit, thank for your answer. i used the same method. But my issue, it' on the radcheck table. In my last setup, i used a default entry for my users in the users file. And i would like to do the same thing on mysql, instead of adding it manually kinds regard 2014-09-24 14:30 GMT+02:00 Lalit Choudhary <lalitvc(a)gmail.com>: > Check this link new Freeradius with mysql installation and configuration > http://lalitvc.wordpress.com/2014/07/03/freeradius-3-0-x-installation-and-c… > > On Sep 24, 2014 5:25 PM, Lovasoa Razaka <zulzig(a)gmail.com> wrote: > > > > Hello all. > > > > I need helps with my setup. > > > > Currently, i set up a freeradius server. I only use the next files: > > eap.conf > > hints > > clients.conf > > users > > radiusd.conf > > sites-available/default > > > > My solution allow a host with a signed certificate to switch in a > specific VLAN (802.1X). > > In my the users file. > > > > I added a DEFAULT entry > > DEFAULT Hint == "host/" > > Auth-Type := "EAP", > > Tunnel-type = "13", > > Tunnel-Medium-Type = "6", > > Fall-Through = Yes > > DEFAULT Hint == "host/" > > Tunnel-Private-Group-ID = "100" > > Fall-Through = Yes > > > > #DEFAULT Hint =="host/" > > # Tunnel-Private-Group-ID = "200" > > # Fall-Through = Yes > > > > DEFAULT Hint == "host/" > > Auth-Type = "reject" > > > > I would like to migrate this solution on a mysql database, but i didn't > understood, how i can use a default profil with Mysql. > > > > is it the best way to do ? Or mysql is not useful for my solution. > > > > thank a lot for your help

1 0

Re: Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Hi, Adding more to it: Basically count the number of auth request received and the number of responses returned with error code . Basically count the number of accounting request received and the number of responses returned with error code. Somebody please help me with this. Regards, Himanshu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Thu, 25 Sep 2014 15:00:53 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: Module Statistics in freeradius Hi, Adding something more to it. Like How many auth or accounting request received? How many of them failed? How many of them were OK,noop,reject etc. Regards, Sonu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Thu, 25 Sep 2014 11:34:58 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org>, "a.cudbardb(a)freeradius.org" <a.cudbardb(a)freeradius.org>, "aland(a)deployingradius.com" <aland(a)deployingradius.com> Subject: Module Statistics in freeradius Dear Friends, I have a requirement that I want "Module statistics". Meaning, say a module is hit 100 times in a session then the module statistics should consist of the count of say "reject" return code if any, count of say "OK" return code if any,count of say "fail" return code if any, count of say "noop" return code if any and so on and so forth. I have gone through radmin but it supports module status only. Is there anything in freeradius that supports Module statistics. If "No" then what piece of code to be included or modified and where exactly in freeradius. Basically how to achieve this. Regards, Sonu     Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Hi, Adding something more to it. Like How many auth or accounting request received? How many of them failed? How many of them were OK,noop,reject etc. Regards, Sonu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Thu, 25 Sep 2014 11:34:58 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org>, "a.cudbardb(a)freeradius.org" <a.cudbardb(a)freeradius.org>, "aland(a)deployingradius.com" <aland(a)deployingradius.com> Subject: Module Statistics in freeradius Dear Friends, I have a requirement that I want "Module statistics". Meaning, say a module is hit 100 times in a session then the module statistics should consist of the count of say "reject" return code if any, count of say "OK" return code if any,count of say "fail" return code if any, count of say "noop" return code if any and so on and so forth. I have gone through radmin but it supports module status only. Is there anything in freeradius that supports Module statistics. If "No" then what piece of code to be included or modified and where exactly in freeradius. Basically how to achieve this. Regards, Sonu     Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Dear Friends, I have a requirement that I want "Module statistics". Meaning, say a module is hit 100 times in a session then the module statistics should consist of the count of say "reject" return code if any, count of say "OK" return code if any,count of say "fail" return code if any, count of say "noop" return code if any and so on and so forth. I have gone through radmin but it supports module status only. Is there anything in freeradius that supports Module statistics. If "No" then what piece of code to be included or modified and where exactly in freeradius. Basically how to achieve this. Regards, Sonu    

1 0

recommendations for max_servers
by Louis Munro 24 Sep '14

24 Sep '14

Hello, While troubleshooting a system I came upon a case of 'hung children' and duplicate requests. I would usually ascribe this to a database issue but in this case the database is mostly unused and properly indexed. Accounting is not used, so that's one less thing to consider. On the other hand the max_servers setting had been set as high as 192 by someone with good intentions. Tuning it down to 64 seemed to significantly reduce the load on the system and the number of hung children was reduced by a factor of about 100. While there remains an issue with some (intermittent) slow ntlm_auth to take care of, I wondered how others tune the value of max_servers other than by trial and error. Most of the time the default of 32 has been enough for me. Higher is not necessarily better in my experience since at least in this case it seems to have led to the main thread working harder when under load (with most of the work done in the "system" space). This is a system running 2.2.5 on RHEL 6.4 in VmWare. It's got 24Gb of RAM and 16 cores so it should still be pretty capable. Does anyone have an algorithm, rule of thumb or other ballpark way of estimating the "ideal" maximum number of threads? Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

6 13

RE: Freeradius - EAP-TLS cert issue?
by Tucker, Benjamin H. 24 Sep '14

24 Sep '14

Anyone seen this before? From: Tucker, Benjamin H. Sent: Tuesday, September 23, 2014 8:51 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius - EAP-TLS cert issue? Hello all, I am a new user of Freeradius and am trying to get it up and running using EAP-TLS. I have the below error when I attempt to run. Is this a cert issue or a config issue with Freeradius? Thanks C:\FreeRADIUS.net\bin>radiusd -d c:/freeradius.net/etc/raddb -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-pri v-key.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/radius-pri v-cert.pem" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/cacert.pem" tls: private_key_password = "mercury" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls C:\FreeRADIUS.net\bin> C:\FreeRADIUS.net\bin> Ben Tucker | Leidos Network Architect III Cell: 501-400-5272 benjamin.h.tucker(a)leidos.com<mailto:benjamin.h.tucker@leidos.com> | Leidos.com<http://www.saic.com/>| Engineering [cid:image002.jpg@01CE5D30.354DD630] Portions of SAIC to be renamed Leidos, Inc. subject to stockholder approval and consummation of a separation

2 5

move freeradius on mysql
by Lovasoa Razaka 24 Sep '14

24 Sep '14

Hello all. I need helps with my setup. Currently, i set up a freeradius server. I only use the next files: eap.conf hints clients.conf users radiusd.conf sites-available/default My solution allow a host with a signed certificate to switch in a specific VLAN (802.1X). In my the users file. I added a DEFAULT entry DEFAULT Hint == "host/" Auth-Type := "EAP", Tunnel-type = "13", Tunnel-Medium-Type = "6", Fall-Through = Yes DEFAULT Hint == "host/" Tunnel-Private-Group-ID = "100" Fall-Through = Yes #DEFAULT Hint =="host/" # Tunnel-Private-Group-ID = "200" # Fall-Through = Yes DEFAULT Hint == "host/" Auth-Type = "reject" I would like to migrate this solution on a mysql database, but i didn't understood, how i can use a default profil with Mysql. is it the best way to do ? Or mysql is not useful for my solution. thank a lot for your help

2 1

SQL xlat and multivalued attributes
by Franks Andy (RLZ) IT Systems Engineer 24 Sep '14

24 Sep '14

Hi all, It would be immensely useful for me to be able to use multivalued attributes from SQL xlats. Is this something that is possible? I'm guessing from previous posts that the advice should be "use a programming language" but it seems a shame if we need to do that for multiple row returns from SQL and not for single row returns. Foreach is there for iterating over these, and we already have multivalued attributes supported in request / reply lists... Thanks! Andy

4 6

Re: Beginner's help
by KAVYA PRABHAKAR 24 Sep '14

24 Sep '14

Hi, I have installed Freeradius on ubuntu PC(10.253.6.235). Whenever I execute radtest command from that PC, request will go on 127.0.0.1 Now instead of that I will send RADIUS request from a gateway bearing IP 10.253.6.11. For this command to work, I should be editing clients.conf as: client 10.253.6.11 { secret = testing123 shortname = 10.253.6.11 } Request reaches RADIUS server and I get reject response back. Where can I find the log details in ubuntu. Let me also know if I will have to do more changes in my configuration file. Thanks in advance, Kavya

2 1