- Freeradius-Users - lists.freeradius.org

Simple 2 Server High Availability
by James Bensley 06 Aug '14

06 Aug '14

Hi All, I've had a scan of the archives and the Internet; I wish to deploy two new FreeRADIUS servers for a new network. I don't need fancy floating IPs like with LVS, incoming requests are load-balanced across both server IPs (but the session are "sicky" in that they always go to the same RADIUS once established). So all I need (I believe) is master-master MySQL replication so that authentication can be made against either RADIUS and updates like new users etc are replicated beween the two. For many people "master-master" is a bad phrase, is anyone doing this successfully? Post reading all I seem to need is the power of auto_increment_offset and auto_increment_increment to make my MySQL repliation safe from PK clashing issues. Can anyone who is doing this confirm what they have done or have you tried this and it failed terribly? If you have two servers for load-balacning how have you done it if you are using a different configuration? Cheers, James.

7 8

RE: radutmp
by Franks Andy (RLZ) IT Systems Engineer 06 Aug '14

06 Aug '14

Thanks Arran, Checked and it was using an old version of the radutmp config file for some reason, guess I just copied and pasted. Looks like what I put in was part of the comments field from that old version. Apologies Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 05 August 2014 18:07 To: FreeRadius users mailing list Subject: Re: radutmp On 5 Aug 2014, at 12:35, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: > Hi all, > > Doing some accounting with 3.1.0 (git #8be6046), and I've changed the radutmp module in a very small way to use stripped user name, and then user name if that isn't populated. > > i.e. in mods-available/radutmp: > > username = %{Stripped-User-Name:-%{User-Name}} > > during accounting it says : > > (225) radutmp : EXPAND /usr/local/var/log/radius/radutmp > > (225) radutmp : --> /usr/local/var/log/radius/radutmp > > (225) ERROR: radutmp : %{Stripped-User-Name:-%{User-Name}} > > (225) ERROR: radutmp : ^ Unknown module You've used the wrong syntax... should be: %{%{Stripped-User-Name}:-%{User-Name}} > > (225) [radutmp] = fail > > (225) } # accounting = fail > > Radwho also doesn't like me, all the policies I've written where I'm testing a control variable work fine in the FR main config but using radwho it complains that it's expecting a module return code : > > Tue Aug 5 17:34:54 2014 : Error: > /usr/local/etc/raddb/policy.d/vlan_override[4]: Parse error in > condition > > Tue Aug 5 17:34:54 2014 : Error: if (control:Ldap-SpecificUTVid) { > > Tue Aug 5 17:34:54 2014 : Error: ^ Expected a module return code > > Have I missed something obvious? This always used to work ok. Probably needs an &control:Ldap-SpecificUTVid or the attribute hasn't been defined. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

radutmp
by Franks Andy (RLZ) IT Systems Engineer 05 Aug '14

05 Aug '14

Hi all, Doing some accounting with 3.1.0 (git #8be6046), and I've changed the radutmp module in a very small way to use stripped user name, and then user name if that isn't populated. i.e. in mods-available/radutmp: username = %{Stripped-User-Name:-%{User-Name}} during accounting it says : (225) radutmp : EXPAND /usr/local/var/log/radius/radutmp (225) radutmp : --> /usr/local/var/log/radius/radutmp (225) ERROR: radutmp : %{Stripped-User-Name:-%{User-Name}} (225) ERROR: radutmp : ^ Unknown module (225) [radutmp] = fail (225) } # accounting = fail Radwho also doesn't like me, all the policies I've written where I'm testing a control variable work fine in the FR main config but using radwho it complains that it's expecting a module return code : Tue Aug 5 17:34:54 2014 : Error: /usr/local/etc/raddb/policy.d/vlan_override[4]: Parse error in condition Tue Aug 5 17:34:54 2014 : Error: if (control:Ldap-SpecificUTVid) { Tue Aug 5 17:34:54 2014 : Error: ^ Expected a module return code Have I missed something obvious? This always used to work ok. Thanks Andy

2 1

Disable radutmp/radwtmp ?
by Arnaud . 05 Aug '14

05 Aug '14

Hello, I use SQL to see my connections radius (table raddact etc.) The problem is that there are also entries in radutmp files / radwtmp which can cause a lot of bugs because I do not use them. It is a hotspot system with freeradius v 1.188.2.3. So to disable radutmp / radwtmp I must comment on certain lines in radiusd.conf. I commented that in accounting section (in bold): accounting { detail # daily # unix # radutmp # sradutmp sql # pgsql-voip } session { # radutmp sql } Is it good? By cons I also saw in radiusd.conf other things that appeal to radutmp as: radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp and radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } Should I also commented that? Or it is not necessary? When the radiusd.conf file will be good. Can I delete without radutmp radwtmp problem? Thank you for your help Regards

1 0

Fwd: warnings on users file
by rafa alfurqan 05 Aug '14

05 Aug '14

Hi all, again i've tried users configuration for a few times. i always failed when i'm trying these formats <1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org> 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0xBDA21CB60EF945da9A8BA56667B49027, EAP-Sim-SRES1 = 0x04d995bc, EAP-Sim-KC1 = 0xBBe0a7c68Aea1c00, EAP-Sim-Rand2 = 0x621F1DAC915B4dbf8A0842E88B97BBBE, EAP-Sim-SRES2 = 0xD9b5f235, EAP-Sim-KC2 = 0x33d1ae11914c4800, EAP-Sim-Rand3 = 0x6AD4284810DD42ca8A60A410F7746820, EAP-Sim-SRES3 = 0xB29eb39b, EAP-Sim-KC3 = 0x1E62ae2aA0a66400 but if i tried based on log, [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items so i do in one line, 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Sim-Rand1 = 0xBDA21CB60EF945da9A8BA56667B49027, EAP-Sim-SRES1 = 0x04d995bc, EAP-Sim-KC1 = 0xBBe0a7c68Aea1c00, EAP-Sim-Rand2 = 0x621F1DAC915B4dbf8A0842E88B97BBBE, EAP-Sim-SRES2 = 0xD9b5f235, EAP-Sim-KC2 = 0x33d1ae11914c4800, EAP-Sim-Rand3 = 0x6AD4284810DD42ca8A60A410F7746820, EAP-Sim-SRES3 = 0xB29eb39b, EAP-Sim-KC3 = 0x1E62ae2aA0a66400 i do the same when i follow this instruction http://lists.freeradius.org/pipermail/freeradius-users/2014-March/071123.ht… and the result is the warning is gone! so, it's okay to use that format? honestly i really new with freeradius, i'll appreciate for any helps. it's my log realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "eap-sim" shortname = "eap-sim" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file �?x�??? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 44186 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=151, length=259 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xf77502a9d1ebb44e40a997fb52f4ad2a # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: authorized user/imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] = ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 127 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 151 to 192.168.1.1 port 2049 EAP-Message = 0x017f0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7659c0b27626d231a8579b0cb8f3e694 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=152, length=303 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x027f0058120a000007050000b7a1d8dbcbb4ebc3626016889cbfc212100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0x7659c0b27626d231a8579b0cb8f3e694 Message-Authenticator = 0x946a59632d3b96d1ba18ad68545b1eb6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: authorized user/imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] = ok [eap] EAP packet type response id 127 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x027f0058120a000007050000b7a1d8dbcbb4ebc3626016889cbfc212100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0x7659c0b27626d231a8579b0cb8f3e694 Message-Authenticator = 0x946a59632d3b96d1ba18ad68545b1eb6 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000b7a1d8dbcbb4ebc3626016889cbfc212 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x3135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 [eap] Underlying EAP-Type set EAP ID to 128 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 152 to 192.168.1.1 port 2049 EAP-Message = 0x01800050120b0000010d0000bda21cb60ef945da9a8ba56667b49027621f1dac915b4dbf8a0842e88b97bbbe6ad4284810dd42ca8a60a410f77468200b05000066269155d778ece4a44df2898acaa745 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7659c0b277d9d231a8579b0cb8f3e694 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=153, length=243 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0280001c120b00000b0500004e314600d7dd8c432d922fe2e2f85e45 State = 0x7659c0b277d9d231a8579b0cb8f3e694 Message-Authenticator = 0xe28cce59df602509a3c3cfe9a99c5693 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: authorized user/imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] = ok [eap] EAP packet type response id 128 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 129 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 153 to 192.168.1.1 port 2049 MS-MPPE-Recv-Key = 0x6e3afcc0cada4349d9e50c5b059f09a8561950974fc7a91ab4b085927b88ec4c MS-MPPE-Send-Key = 0xa1642e8992cf8c5937455aef07338c3b112ebbfcde037305d185b5367de606b0 EAP-Message = 0x03810004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 3.9 seconds. Cleaning up request 0 ID 151 with timestamp +10 Cleaning up request 1 ID 152 with timestamp +11 Waking up in 1.0 seconds. Cleaning up request 2 ID 153 with timestamp +12 Ready to process requests. thank you

2 4

Adding a variable to Free Radius
by Nick Cameo 05 Aug '14

05 Aug '14

Hello Everyone, I would like to add a custom variable to get stored in our Free Radius DB. We have a functioning environment, and would like to know the suggested way of adding a new variable to the long list. The service is Session Initiation Protocol (SIP) Kind Regards, Nick from Toronto.

2 3

warnings on users file
by rafa alfurqan 04 Aug '14

04 Aug '14

Dear all, I'm trying to configure freeradius for eap-sim authenticatio. in my case my supplicant was success to connect the ap with eap-sim authentication, but in the freeradius log there's warnings on the users file. reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user " 1510101425520064(a)wlan.mnc101.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items i have read anything about this but still i can't get fix this problem. what makes me confuse is why the supplicant could connect to the ap however i still got warnings on the log? this is my users configuration <1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org> 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0xBDA21CB60EF945da9A8BA56667B49027, EAP-Sim-SRES1 = 0x04d995bc, EAP-Sim-KC1 = 0xBBe0a7c68Aea1c00, EAP-Sim-Rand2 = 0x621F1DAC915B4dbf8A0842E88B97BBBE, EAP-Sim-SRES2 = 0xD9b5f235, EAP-Sim-KC2 = 0x33d1ae11914c4800, EAP-Sim-Rand3 = 0x6AD4284810DD42ca8A60A410F7746820, EAP-Sim-SRES3 = 0xB29eb39b, EAP-Sim-KC3 = 0x1E62ae2aA0a66400 if i have to follow the freeradius log, then i should do: 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org <http://lists.freeradius.org/mailman/listinfo/freeradius-users> EAP-Type := SIM EAP-Sim-Rand1 := <value>, EAP-Sim-SRES1 := <value>, EAP-Sim-KC1 := <value>, EAP-Sim-Rand2 := <value>, EAP-Sim-SRES2 := <value>, EAP-Sim-KC2 := <value>, EAP-Sim-Rand3 := <value>, EAP-Sim-SRES3 := <value>, EAP-Sim-KC3 := <value> but if i read the right format for the users file is like i did before, user check reply, reply, reply so, what i have to do for fix the warnings in users file? I'm using Ubuntu 10.04 desktop LTE, freeradius 2.2.5 for server, air-live for ap and blackberry 9320 for the supplicant. here's the log realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "eap-sim" shortname = "eap-sim" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file �Bw�?B modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:204 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user " 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 47457 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=146, length=259 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x3b7cec016f9e7d837e6c6fd3b4eb20ef # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org at line 204 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 226 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 146 to 192.168.1.1 port 2049 EAP-Message = 0x01e20014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2868fcaa2649d86228f5cbe0864a028 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=147, length=303 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02e20058120a000007050000e4e69b2af151f7b962b59341f135ec28100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0xa2868fcaa2649d86228f5cbe0864a028 Message-Authenticator = 0xdb930ab0a6fe572dc35ab89c7d62a32d # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 226 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org at line 204 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02e20058120a000007050000e4e69b2af151f7b962b59341f135ec28100100010e0e00333135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 State = 0xa2868fcaa2649d86228f5cbe0864a028 Message-Authenticator = 0xdb930ab0a6fe572dc35ab89c7d62a32d EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000e4e69b2af151f7b962b59341f135ec28 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x3135313030313934363332383631363840776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 [eap] Underlying EAP-Type set EAP ID to 227 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 147 to 192.168.1.1 port 2049 EAP-Message = 0x01e30050120b0000010d0000bda21cb60ef945da9a8ba56667b49027621f1dac915b4dbf8a0842e88b97bbbe6ad4284810dd42ca8a60a410f77468200b05000054a12566dba5ea107876abb8ce63c51b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa2868fcaa3659d86228f5cbe0864a028 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=148, length=243 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "70aab2eb15af" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02e3001c120b00000b050000972372a41c5202143e5d4624453ee9a4 State = 0xa2868fcaa3659d86228f5cbe0864a028 Message-Authenticator = 0x84e6bf6274f86ccbbcf74dd0fd0ccdbc # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 227 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org at line 204 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 228 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 148 to 192.168.1.1 port 2049 MS-MPPE-Recv-Key = 0x4cf85cf91585ad5b0150cfcf0891da3c700186a1f529c33a77b858b7c2792425 MS-MPPE-Send-Key = 0x73cddffcb9182dcbdb08f9a1a75e96cfb11145d41b6a6734ddd8b2befa96c5c8 EAP-Message = 0x03e40004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510019463286168(a)wlan.mnc001.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 3.8 seconds. Cleaning up request 0 ID 146 with timestamp +22 Cleaning up request 1 ID 147 with timestamp +22 Waking up in 1.0 seconds. Cleaning up request 2 ID 148 with timestamp +23 Ready to process requests.

1 0

Proxy listens to TCP home server on UDP port
by Nikolai Kondrashov 04 Aug '14

04 Aug '14

Hi everyone, Red Hat QA has noticed that a FreeRADIUS v3.0.1 server set up to use TCP with a home server still listens for replies on UDP. I couldn't find any requirements for that in RFCs and I lack the necessary protocol knowledge to conclude if this is a correct behavior. Could someone say if this is right or not? Could this have been done to simplify handling of mixed-protocol server pools? Some more details follow. The default configuration was modified to use TCP everywhere. I.e. to have default server listen for authentication and accounting on TCP, to have inner-tunnel virtual server listen on TCP, and to have localhost home server protocol specified as TCP. See attached patch for exact changes done. After starting "radiusd -X" these are the last few lines printed: Listening on auth proto tcp address * port 1812 as server default Listening on acct proto tcp address * port 1813 as server default Listening on auth proto tcp address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 And "lsof" outputs these lines for radiusd: radiusd 2728 radiusd 3u IPv4 21180 0t0 TCP *:1812 (LISTEN) radiusd 2728 radiusd 4u IPv4 21181 0t0 TCP *:1813 (LISTEN) radiusd 2728 radiusd 5u IPv4 21182 0t0 TCP 127.0.0.1:18120 (LISTEN) radiusd 2728 radiusd 6u IPv4 21183 0t0 UDP *:1814 The original bug reported by QA: https://bugzilla.redhat.com/show_bug.cgi?id=1115137 Thank you. Nick

3 4

CPU utilization (Stefano PASCALI)
by Rui Ribeiro 04 Aug '14

04 Aug '14

Hello Stefano, 2.12 is quite old, and is has several bugs. Why not update it to at least 2.2.5? As for problems, there is a know bug when using mschap in 2.1.12, that often freeradius stops answering requests after a reload when rotating logs. You have to edit /etc/logrotate.d/freeradius and change the reload for a restart if that is your case. Another probable source of cpu/ I/O load is radwtmp and similar files, as they grow and are not rotated per the default configuration. I dont use them, I rely on the (My)SQL data. Hope these tips help you in some way. You are welcome to ask me any questions. Regards, Rui Date: Fri, 1 Aug 2014 10:57:48 +0200 > From: Stefano PASCALI <stefano.pascali(a)unisalento.it> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: CPU utilization > Message-ID: <488B69B7-9992-4940-B9D0-04A1DD6CD698(a)unisalento.it> > Content-Type: text/plain; charset=us-ascii > > Hi FR folks, > > I got a strange cpu load on my FR installation. Sometimes CPU utilization > rises to 100% and FR service doesn't respond anymore to the clients. I got > two virtual servers enabled: default and inner-tunnel and their > configurations are the provided ones by the FR installation. > Configuration details in the following: > > OS: Ubuntu server 14.04 > Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 > 2 vcpu > RAM 4GB > > Users on freeradius MySQL (5.x) DB installed on a different virtual host > on the same hosting server. > > Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 > CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores > 2x4 = 8] > RAM 16GiB > > Do you have any ideas to solve my issue? > Hope someone help me. > > Regards > Stefano > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 112, Issue 1 > ************************************************ >

3 2

Authorization according to openLDAP group or attribute?
by Mark jensen 03 Aug '14

03 Aug '14

I have configured freeradius successfully to authenticate users using IEEE802.1x && openLDAP as a back-end DB. I have seen that we can add `ldap` to the authorize section like this: authorize { ... ldap ... } and we can forbid some users according to openLDAP attribute authorize { ... ldap if (reply:Eduroam-Enabled != "Y") { reject } ... } But what if we want to do authorization like this: We have multiple web servers: 192.168.1.5 192.168.1.6 192.168.1.7 And we want only some users to have access to `192.168.1.5` web server, how can we forbid other users to access this web server or restrict this web servers to some users according to openLDAP attribute or openLDAP group? Is there could be done using "authorize" section or "post-auth" section? (provide me with links please)

2 4