- Freeradius-Users - lists.freeradius.org

Mysql - radusergroup
by Neven 12 Feb '13

12 Feb '13

Hi, i'm using Freeradius 2, fedora16, mysql 5. 500 000 different users in table. i have a user in table radcheck (username and pass), i add that user in radusergroup, then I add usergroup in radgroupcheck and add attributes for that group. That works well as far as i know. Question: Can I add a user in one group without adding that user in radusergroup table? Is there some attribute that i can add in radcheck that will add a user in one user group? id Username Attribute OP Value 1 User1 Cleartext-password := 123456 2 User1 "Attribute for user group" == "Group that i can add attributes in radgroupcheck table" Could this be done? Thank u. Neven

1 0

Load Balancing Issue
by Muhammad Nadeem 12 Feb '13

12 Feb '13

Hi, I am using Freeradius 2.2.0 on redhat 5. My goal was to increase the speed of user authentication. To achieve this I configured Load Balancing (with realms). I have a proxy Freeradius server, that is just proxying requests to 2 other freeradius servers. Problem is that, when i sent a specific number (10 million) requests to proxy server (that just proxy requests to 2 other servers) , it took about 45 minutes to complete these requests. But if I send same amount of requests direct to on of the server (without sending it to proxy server), requests are entertained rapidly (in around 16 minutes). Can any one please tell me , what's the issue. Thanks a lot.

1 0

rlm_sql_mysql driver issue
by QASIM RAO 11 Feb '13

11 Feb '13

Hi,i am trying to configure rlm_sql_mysql driver but it is showing radisud is not working :( mysql devel is installed. [root@localhost rlm_sql_mysql]# ./configure checking for gcc... gccchecking for C compiler default output file name... a.outchecking whether the C compiler works... yeschecking whether we are cross compiling... nochecking for suffix of executables... checking for suffix of object files... ochecking whether we are using the GNU C compiler... yeschecking whether gcc accepts -g... yeschecking for gcc option to accept ANSI C... none neededchecking for mysql_config... yeschecking for pthread_create in -lpthread... yeschecking for mysql_init in -lmysqlclient_r (using mysql_config)... nochecking for mysql_init in -lmysqlclient_r... noconfigure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>.checking for mysql.h (using mysql_config)... yesconfigure: WARNING: sql submodule 'mysql' disabledconfigure: creating ./config.statusconfig.status: creating Makefileconfig.status: creating config.h[root@localhost rlm_sql_mysql]# makemake: Nothing to be done for `all'. Please Help me in this Regards:Rao Qasim

3 2

Fwd: FW: Radius server is dumping regularly
by ramakrishna 11 Feb '13

11 Feb '13

** ** Hi **** I have been using FreeRadius 2.2 for a while now. Recently i have started seeing regular code dumps by RADIUS server. I have attached pstack output of three core files generated within last four days. I observed that core dump is happening consistently in rad_decode function and its sub functions. **** Please lemme know what might have gone wrong.**** Thanks,**** -- Best Regards, M.Rama Krishna Prasad,

2 3

Re: Degradation of service when authentication fails with Windows AD
by Antonio Alberola 11 Feb '13

11 Feb '13

> If you can describe the problem you're having, in correct terminology, > people might be able to make a suggestion. Be specific, about the > issues, the architecture you have, what you're trying to achieve, and so on. > Sorry, I will try to explain the problem better. I have a mail server where users are validated with local accounts (UNIX) or against a Windows AD. For this reason we use Radius. Sometimes the Radius server fails and stops authentication for everybody. In that point the logs that I sent to you appear. I need to restart Radius in order to it works again. > From what you've described so far, it sounds like you are losing > connectivity to one or more AD controllers, which is causing PAM > to hang (waiting for a Kerberos reply) or Samba/ntlm_auth to hang > (waiting for an RPC reply). > > It should be obvious what the solution is - reliable connectivity to a reliable AD controller. When we monitored the network and one of the Windows AD we could confirm that requests from Radius don't reach the AD, because they don't leave Radius. We believe that connectivity between Radius and AD is correct, they are on the same LAN and the AD continues to validate correctly even when Radius is failing. >From my point of view, for any reason, Radius receives requests that it can not manage, because of the AD, the network or whatever. These requests keep waiting and the buffer fills completly. I don't know why these requests are not removed from the queue and the buffer is cleared in order to allow new request. In this way we could avoid that request to the rest of the AD fail because of a particular AD.

3 2

Dualstack NAS ignored by RADIUS server when using IPv4
by Ondrej Famera 11 Feb '13

11 Feb '13

Hello all, I'm running freeRADIUS 2.2.0 server on dualstack machine. Some of the NAS devices that are using this server are dualstack, but they are not able to use IPv6 for communicating with RADIUS server so they use only the IPv4. Problem is that these NAS devices are rejected by RADIUS server with following error: Error: Ignoring request to authentication address 10.0.0.1 port 1812 from unknown client 10.0.0.2 port 1812 DNS: freeRADIUS server: radius.example.com - IPv4: 10.0.0.1 - IPv6: 2001:a:b:c::1 NAS device: dev1.example.com - IPv4: 10.0.0.2 - IPv6: 2001:a:b:c::2 RADIUS nas table: id | nasname | shortname | type | ports | secret | community | description | server ----+-------------------+-----------+-------+--------+---------------+-----------+-------------+-------------- 1 | dev1.example.com | dev1 | other | <NULL> | shared_secret | <NULL> | <NULL> | inner-tunnel By adding folloving to nas table it works: id | nasname | shortname | type | ports | secret | community | description | server ----+-------------------+-----------+-------+--------+---------------+-----------+-------------+-------------- 2 | 10.0.0.2 | dev1 | other | <NULL> | shared_secret | <NULL> | <NULL> | inner-tunnel ( it works as workaround but i think that it should work as well with hostname only ) Having IPv4-only or IPv6-only NAS doesn't trigger this problematic behaviour, as well as having dualstack NAS taht can communicate with RADIUS over IPv6. looks like bug to me, anyone experienced similiar problems? -- Ondrej Famera unix@fi

7 8

freeradius not working in normal mode but working in debug mode
by Nandkumar Palkar 11 Feb '13

11 Feb '13

Hi freeradius not working in normal mode but working in debug mode. Please suggest. Thanks, Nand

3 7

Libraries issue
by QASIM RAO 11 Feb '13

11 Feb '13

hi,i am facing problem during compilation of freeradius rlm_sql_mysql driver [root@localhost rlm_sql_mysql]# ./configure checking for gcc... gccchecking for C compiler default output file name... a.outchecking whether the C compiler works... yeschecking whether we are cross compiling... nochecking for suffix of executables... checking for suffix of object files... ochecking whether we are using the GNU C compiler... yeschecking whether gcc accepts -g... yeschecking for gcc option to accept ANSI C... none neededchecking for mysql_config... yeschecking for pthread_create in -lpthread... yeschecking for mysql_init in -lmysqlclient_r (using mysql_config)... yeschecking for mysql.h (using mysql_config)... yesconfigure: creating ./config.statusconfig.status: creating Makefileconfig.status: creating config.hconfig.status: config.h is unchanged[root@localhost rlm_sql_mysql]# make/usr/src/radius-iptv/libtool --mode=compile gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.cmkdir .libs gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.c -fPIC -DPIC -o .libs/sql_mysql.osql_mysql.c: In function 'sql_error':sql_mysql.c:335: warning: return discards qualifiers from pointer target type gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.c -o sql_mysql.o >/dev/null 2>&1/usr/src/radius-iptv/libtool --mode=link gcc -release 1.1.6 \ -module -export-dynamic -o rlm_sql_mysql.la \ -rpath /usr/local/lib sql_mysql.lo -L/usr/lib64 -lmysqlclient_r -lpthread -lm -lrt -ldl gcc -shared .libs/sql_mysql.o -L/usr/lib64 -lmysqlclient_r -lpthread -lm -lrt -ldl -Wl,-soname -Wl,rlm_sql_mysql-1.1.6.so -o .libs/rlm_sql_mysql-1.1.6.so(cd .libs && rm -f rlm_sql_mysql.so && ln -s rlm_sql_mysql-1.1.6.so rlm_sql_mysql.so)ar cru .libs/rlm_sql_mysql.a sql_mysql.oranlib .libs/rlm_sql_mysql.acreating rlm_sql_mysql.la(cd .libs && rm -f rlm_sql_mysql.la && ln -s ../rlm_sql_mysql.la rlm_sql_mysql.la)cp: target `../lib' is not a directorymake: *** [build-module] Error 1

1 0

FTP Error when Radius is UP
by George Innocent 11 Feb '13

11 Feb '13

Hi; I am using Freeradius on Ubuntu; The authentification part works fine but i am facing challenges when i try to ftp nodes on the network. When the Radius server is UP i get ftp error failure connection on the Nodes but with the Radius off the ftp works. FTP configuration on the Nodes are configured well. What could i be missing -- Regards: George Innocent.

4 5

Any interoperability issues with Aruba and Freeradius
by Alex Sharaz 10 Feb '13

10 Feb '13

Hi All, I'm sure the answer to this is nope, but ... At a recent Aruba training course in amongst the documentation supplied to us were a couple of presentation slides showing different types of eap authentication against recommended RADIUS servers for use with Aruba equipment (Just to be sure the slide heading said Aruba RADIUS Compatibility). The surprising bit was the fact that there was a "No" against Freeradius/TTLS (MD5,TLS,PEAP,LEAP,FAST all were yes) and a coment that said Freeradius also supports TTLS. Now it my well be that the slide is a bit old and just hasn't been updated but it does beg the question have any people using Freeradius with Aruba kit experienced any funnies that needed a specific set of "tweaking" for Aruba? I really can't imaging that it would be the case, but just thought I'd check. Rgds Alex

5 7