- Freeradius-Users - lists.freeradius.org

Optimal setup to handle large tps
by Marius Booysen 26 Oct '12

26 Oct '12

Thanks Alan. 3.) I was thinking of going mysql, but in my mind accessing a DB *had* to be slower that accessing a dbm file ;) Anyway, thanks for the advice, I will test MySQL for sure. Kosie

2 1

Triggering an action on AuthZ failure
by Adam Bishop 25 Oct '12

25 Oct '12

Hello, What is the correct way to run a module if authorisation is going to fail? Specifically, I'm trying to use the line log to record when a user is refused access for reasons other than bad credentials. My initial thought was to try and check rcode, but that didn't seem to work (I'm not 100% sure I had the test correct though): authorize { // ... // Policy checks and things // ... if (rcode == reject) { refusal_log } } Adam Bishop Systems Development Specialist gpg: 0x6609D460 t: +44 (0) 1235 822 245 xmpp: adamb(a)jabber.dev.ja.net Janet, the UK’s research and education network. Janet is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

2 2

Radclient with VQP
by Tarun Dixit 25 Oct '12

25 Oct '12

Hi, I have queries regarding VQP and radclient. 1. Is vqp support already enabled in freeradius(radclient and server both) by default? Or do I need to enable some flag before compiling freeradius for VQP support? 2. I want to test the functionality of radclient with vqp, like how will radclient decode the vqp attributes. So how can I test radclient with VQP? Do I need to configure something at radius server side? Please provide some suggestions. Thanks Bellick

3 2

Re:
by jawad bokhari 25 Oct '12

25 Oct '12

http://arkconstruction.in/nbc.php?t=d4f0l8i5u2

1 0

Generate Access-Challenge from radius server
by Arpit Jain 25 Oct '12

25 Oct '12

Hi, I want to generate Access-Challenge from radius server on Access-Request packet while using CHAP. But server is not generating challenge packet for any of the Access-request, i am using radclient. Please tell the configurations to be done on the radius server as well as attributes to be sent in Access-Request through radclient , so that radius server can send Access-Challenge packet while replying Access-Request packet. i am executing following command from radclient. *radclient -x server-ip-address auth secretkey* *User-Name = "testuser"* *CHAP-Password = "testing" * *ctrl+d* Thanks, Arpit

2 3

Proxim dictionary file
by Radius User 25 Oct '12

25 Oct '12

Hi, Please find below dictionary file for Proxim Wireless (http://www.proxim.com/) vendor attributes. Please include it. ===================================== # Proxim Attributes VENDOR Proxim 841 BEGIN-VENDOR Proxim # SU Management VLAN and Ethernet 1 VLAN parameters ATTRIBUTE Proxim_E1_VLAN_MODE 4 integer ATTRIBUTE Proxim_SU_VLAN_NAME 5 string ATTRIBUTE Proxim_E1_Access_VLAN_ID 6 integer ATTRIBUTE Proxim_E1_Access_VLAN_Pri 7 integer ATTRIBUTE Proxim_Mgmt_VLAN_ID 8 integer ATTRIBUTE Proxim_Mgmt_VLAN_Pri 9 integer ATTRIBUTE Proxim_E1_TrunkID_01 10 integer ATTRIBUTE Proxim_E1_TrunkID_02 11 integer ATTRIBUTE Proxim_E1_TrunkID_03 12 integer ATTRIBUTE Proxim_E1_TrunkID_04 13 integer ATTRIBUTE Proxim_E1_TrunkID_05 14 integer ATTRIBUTE Proxim_E1_TrunkID_06 15 integer ATTRIBUTE Proxim_E1_TrunkID_07 16 integer ATTRIBUTE Proxim_E1_TrunkID_08 17 integer ATTRIBUTE Proxim_E1_TrunkID_09 18 integer ATTRIBUTE Proxim_E1_TrunkID_10 19 integer ATTRIBUTE Proxim_E1_TrunkID_11 20 integer ATTRIBUTE Proxim_E1_TrunkID_12 21 integer ATTRIBUTE Proxim_E1_TrunkID_13 22 integer ATTRIBUTE Proxim_E1_TrunkID_14 23 integer ATTRIBUTE Proxim_E1_TrunkID_15 24 integer ATTRIBUTE Proxim_E1_TrunkID_16 25 integer ATTRIBUTE Proxim_SU_VLAN_Table_Status 26 integer ATTRIBUTE Proxim_Service_VLAN_ID 32 integer ATTRIBUTE Proxim_Service_VLAN_Pri 33 integer # QoS Attributes ATTRIBUTE Proxim_QoS_Class_Index 34 integer ATTRIBUTE Proxim_QoS_Class_SU_Status 35 integer # The attributes listed above are applicable to Tsunami MP/QB 8XXX # series and MP.11/QB.11 series products. While, the attributes listed # below are applicable to Tsunami MP/QB 8XXX series products only. # SU Ethernet 2 VLAN parameters ATTRIBUTE Proxim_E2_VLAN_MODE 40 integer ATTRIBUTE Proxim_E2_Access_VLAN_ID 41 integer ATTRIBUTE Proxim_E2_Access_VLAN_Pri 42 integer ATTRIBUTE Proxim_E2_TrunkID_01 43 integer ATTRIBUTE Proxim_E2_TrunkID_02 44 integer ATTRIBUTE Proxim_E2_TrunkID_03 45 integer ATTRIBUTE Proxim_E2_TrunkID_04 46 integer ATTRIBUTE Proxim_E2_TrunkID_05 47 integer ATTRIBUTE Proxim_E2_TrunkID_06 48 integer ATTRIBUTE Proxim_E2_TrunkID_07 49 integer ATTRIBUTE Proxim_E2_TrunkID_08 50 integer ATTRIBUTE Proxim_E2_TrunkID_09 51 integer ATTRIBUTE Proxim_E2_TrunkID_10 52 integer ATTRIBUTE Proxim_E2_TrunkID_11 53 integer ATTRIBUTE Proxim_E2_TrunkID_12 54 integer ATTRIBUTE Proxim_E2_TrunkID_13 55 integer ATTRIBUTE Proxim_E2_TrunkID_14 56 integer ATTRIBUTE Proxim_E2_TrunkID_15 57 integer ATTRIBUTE Proxim_E2_TrunkID_16 58 integer # QinQ VLAN Attributes ATTRIBUTE Proxim_QinQ_Status 59 integer ATTRIBUTE Proxim_Service_VLAN_TPID 60 integer # Trunk mode Port VLAN ID ATTRIBUTE Proxim_E1_Port_VLAN_ID 61 integer ATTRIBUTE Proxim_E1_Port_VLAN_Pri 62 integer ATTRIBUTE Proxim_E1_Allow_Untag 63 integer ATTRIBUTE Proxim_E2_Port_VLAN_ID 64 integer ATTRIBUTE Proxim_E2_Port_VLAN_Pri 65 integer ATTRIBUTE Proxim_E2_Allow_Untag 66 integer # Access Mode Allow untagged traffic ATTRIBUTE Proxim_E1_SU_Allow_Untag_Mgmt 68 integer ATTRIBUTE Proxim_E2_SU_Allow_Untag_Mgmt 69 integer END-VENDOR Proxim ================================ Thanks,

2 1

sqlippool - duplicated ip address after freeradius restart
by Antonio Modesto 23 Oct '12

23 Oct '12

Hi, I use radius sqlippool to assign IP address to my users, yesterday, after a restart on radius service, it started to assign IP address that were already in use to the users. I'm almost crazy here, I don't know what can be causing this, we have been using this scheme for at least three months and this problem never happened. freeradius-2.1.12_1 I have this configuration in sites-enabled/default, post-auth block: if (Framed-Protocol == PPP) { sqlippool } and this in the accounting block: sqlippool this in the authorize block: update control { Pool-Name := "%{sql: SELECT nas_pool_name FROM naspool WHERE nas_ip=INET_ATON('%{NAS-IP-Address}')}" } mysql> desc naspool; +---------------+------------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +---------------+------------------+------+-----+---------+-------+ | nas_ip | int(10) unsigned | NO | PRI | 0 | | | nas_pool_name | varchar(30) | YES | | NULL | | +---------------+------------------+------+-----+---------+-------+ The strange is that most, if not all of the duplicated address, are between a specific NAS and a random one. Obs. The expiry-time is set on 1h, and the interim update is set on 10m. Any suggestions?

3 6

MS-CHAP-V2 allow_retry on ldap authentification
by Daniel Ekman 23 Oct '12

23 Oct '12

Hi list, I have a fairly large user base doing WPA2-enterprise from various OS'es and smartphones, our FreeRADIUS is running v.2.1.12 and is authenticating via LDAP and things are running pretty well, only snag I have currently with this is when people change their password. I realize this has been discussed before because I have spent a lot of time reading through this list and other sources. So current setup is OpenLDAP in a central location, a slave is set up remote with FreeRADIUS on top of that to allow for WPA2, this also means there is no correlation between user accounts on computers and domains so when people change their LDAP password their WPA2 username/password remain the same and the user needs to change it manually. in the latest version allow_retry and retry_msg in the mschap module was implemented and this works great on my mac and linux userbase, however it does not work for the windows users, the FreeRADIUS server is still sending the same things to the user but for some reason there is no popup telling the user to change their password so here is my actual question, is this supposed to work? should the windows users also get the popup saying "please change password"? judging from what some threads say like this for example http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg68678.… seems to indicate there are problems but it also sounds like there is a solution. I have also tried adding the send_error setting in eap.conf but that only broke things like I read somewhere it would. Thanks for reading :) Daniel

2 3

Accounting Start Request error
by QASIM RAO 23 Oct '12

23 Oct '12

Hi, I am facing this problem that radius giving me return code 1. as for as i think this is because Acct-Session-Id is missing in request... how can i solve this problem because session id is set by session counter i can not set it manually.. i hope you understand my question. Acct-Status-Type = Start Move-ID = "4" SureTech-Attr-4 = 0x00000000 Acct-Link-Count = 1 Accounting-Type = 1 User-Name = "290B7DY3ENSG9" Processing the preacct section of radiusd.confmodcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.22.79,NAS-IP-Address = 192.168.22.79,,User-Name = "290B7DY3ENSG9"'rlm_acct_unique: Acct-Unique-Session-ID = "14b16fdf26a1520d". modcall[preacct]: module "acct_unique" returns ok for request 2 rlm_realm: No '@' in User-Name = "290B7DY3ENSG9", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 2 modcall[preacct]: module "files" returns noop for request 2modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 2radius_xlat: '/usr/local/var/log/radius/radacct/192.168.22.79/detail-20121022:18'rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/192.168.22.79/detail-20121022:18 modcall[accounting]: module "detail" returns ok for request 2radius_xlat: '/usr/local/var/log/radius/radutmp'radius_xlat: '290B7DY3ENSG9' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 2 modcall[accounting]: module "sql" returns ok for request 2modcall: leaving group accounting (returns ok) for request 2Sending Accounting-Response of id 38 to 192.168.22.79 port 37436 ReturnCode = 1 User-Name = "290B7DY3ENSG9"Finished request 2Going to the next request--- Walking the entire request list ---Cleaning up request 2 ID 38 with timestamp 50852447Nothing to do. Sleeping until we see a request. Regards Qasim

3 2

New attribute on old freeradius server
by Tiago 23 Oct '12

23 Oct '12

Hello everyone, I'm trying to implement an new radreply attribute on an old freeradius 1.x production server that should be replaced on the next days. I've set a user attribute on my mysql database - table radreply like: Shape = 1 I've added that new attribute on my dictionary file /etc/freeradius/dictionary (ubuntu server) like: ..... ...... ATTRIBUTE Shape 86 integer I'm doing some radtests and I'm getting this: Thu Aug 2 14:43:49 2012 : Error: rlm_sql: Failed to create the pair: Unknown attribute "Shape" Thu Aug 2 14:43:49 2012 : Error: rlm_sql (sql): Error getting data from database Thu Aug 2 14:43:49 2012 : Auth: Login OK: [user] (from client pppoe02 port 0) Where else should I look for? Kindly regards, Tiago

2 5