- Freeradius-Users - lists.freeradius.org

Proxy and requests queue
by AemNet 17 Sep '12

17 Sep '12

Hi everybody I've a question about the management of the queue in freeradius 2.1.12. Let's assume my server are used for local authentication for the realm mydomanin.org and proxy the request for the realm remote.org (a pool with a single home server). Let's assume also that max_servers and max_spare_server are sets correctly. What happens if the home server for the proxy takes too long to respond? The requests for the local side are ignored or have their own queue? And if my proxy are used for different realm (remote1.org, remote2.org etc...) all with their own single home_server what happens if a remote home server takes too long to respond? To make a long story short it's possible that a problem on a remote home server (that receives a huge number of requests) blocks the requests for my local server? Thanks I know this can be a stupid question but I didn't find an answer in the wiki or in the docs (probably I've searched in the wrong place or the wrong terms sorry) PS: sorry for my English

2 2

users file case sensitive
by Gregg Douglas 17 Sep '12

17 Sep '12

Hi, Background: FreeRadius Version: 2.1.1-7.10.1 Users are stored in LDAP, I am using the users file to assign static IP Addresses to certain users. It seems that the users file is case sensitive, I found a few articles on the net regarding this, but none really supplied a definitive answer. Is there a way to prevent the users file from being case sensitive ? If not, what is the recommended method to elegantly avoid this problem. Regards Gregg

2 1

Segmentation fault when linking 2.2.0 against openSSL 1.0.1c
by Stefan Winter 17 Sep '12

17 Sep '12

Hi, until today, I have been running FreeRADIUS 2.2.0 successfully with a system-supplied openSSL. Today, I compiled with --with-openssl --with-openssl-includes=/usr/local/freeradius/openssl-1.0.1c/include/openssl --with-openssl-libraries=/usr/local/freeradius/openssl-1.0.1c/lib the path is in ld.so.conf, and ldd shows that linking against this new version works. However, when running PEAP on this version, I get a segmentation fault now: [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept User-Name = "test.eduroam(a)education.lu" Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Reply-Message = "What shall we do with the drunken sailor? What shall we do with the drunken sailor? What shall we do with the drunken sailor - early in the morning? Give him eduroam." Segmentation fault The repetition of that attribute is NOT an error; it's there to inflate the packet beyond 1500 bytes to trigger UDP fragmentation (this is our Nagios testing). In 2.2.0 against the old openSSL version, everything works fine - Access-Accept. Any hints? Greetings, Stefan winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

(no subject)
by QASIM RAO 17 Sep '12

17 Sep '12

hi, i want to test performance of my radius server. can any body give me suggestion how i can perform performance test of my radius server. i have check some performance testing tools like (radlogin,radtest,Evolynx RADIUS Load Test tool) but they are not working according to my requirement i want to send bulk number of request including additional attributes i have included in my server. regards, Qasim Rao

2 1

module loaded while running Radius
by QASIM RAO 17 Sep '12

17 Sep '12

hi,i have a probelm related to performance of free radius. so i want to know how many module are loading when i run radiusd -X command. like auth module and accounting module... please help me in this.

2 1

Chap Authentication Error
by Daniel Niasoff 16 Sep '12

16 Sep '12

Hi I have had freeradius working for a while without issues serving ppp authentication requests. I am now getting a strange chap issue. A customer is unable to login even though the password is correct This is what I see in the logs Fri Sep 14 17:22:37 2012 : Info: [chap] login attempt by "f3207920(a)surf4sure.net" with CHAP password Fri Sep 14 17:22:37 2012 : Info: [chap] Using clear text password "1234" for user f3207920(a)surf4sure.net authentication. Fri Sep 14 17:22:37 2012 : Info: [chap] Password check failed However if I try to repeat the test using radtest with -t chap it works fine. Fri Sep 14 17:22:32 2012 : Info: [chap] login attempt by "f3207920(a)surf4sure.net" with CHAP password Fri Sep 14 17:22:32 2012 : Info: [chap] Using clear text password "1234" for user f3207920(a)surf4sure.net authentication. Fri Sep 14 17:22:32 2012 : Info: [chap] chap user f3207920(a)surf4sure.net authenticated successfully Now where do I go from here? Thanks Daniel

2 2

Ideas
by Franks Andy (RLZ) IT Systems Engineer 16 Sep '12

16 Sep '12

Hi All, I've been following Thomas Glanzmann's work on sms/email otp with freeradius and can see it could REALLY save our organisation a lot of money (we're using securid tokens exclusively ATM). I'm trying to work out something to suit us and at the same time be helpful to others into making something useful, not that I'm a coder particularly. Can I just ask if anyone has any ideas about implementing a beginning process like this; Authorization : - Check user is in an ldap group "allowed" to do otp; using the files, and ldap modules. I'm thinking pass back the phone number for sms from the ldap module, and place in a custom attribute. Ok on that bit Authentication: - Assuming user has a phone number in ldap and is allowed to do OTP, and if the request is new and, they authenticate, then we want to generate an OTP and store it. I guess the generation *could* be done in exec or perl modules quite easily or using xlat, but not sure how to do it using that. Then the user, otp failed attempts and maybe lock state are stored, preferably in a sql table. If request isn't new, how many tries have they already had? - The ordering is the tricky thing here - we need to authenticate the user before an otp is generated, then challenge against that otp, incrementing the failure count if the auth fails and then rechallenging up to the failure limit and then setting auth-type if we pass the user. I can't do unlang in the authentication phase and presumably the post auth section may not be the place to do all these other checks and sql bits. I can see why it's perhaps easier to do all this in exec or perl modules and just return an exit code, but I'd like to see if it can all be done within FR. Once the challenge fails, we need to prompt again until the retry limit.. - At some point we need to return control variables from the to determine the account lock state and failed attempts if the user fails and then revisits the NAS - from the SQL module, where I'd like to see the session data stored. I guess this is possible but am not 100% on how it's done. These are just ramblings. I'd forgive people for just ignoring this post, but hopefully someone is interested enough to get something like this working - it's a great cheap way of 2 factor authentication and it'd be nice not to have to go and buy software to do this. I know Thomas Glanzmann has already got this going with rlm_perl and the smsotp module methods using a file based db, but I'd like to see ldap authorization and variable passback (phone numbers/ email addresses if using email OTP) filling an sql DB, or maybe rlm_cache (of which I've no knowledge and I think is experimental?) for storage of variables. Also some post auth sql storage of cumulative sessions, failed attempts etc, if possible all using FR natively without perl/exec etc, which wouldn't be too difficult. Am I dreaming or can this be done completely within FR without using perl/exec/..? Cheers Andy

3 7

Re: NEW PIN MODE
by aa ss 16 Sep '12

16 Sep '12

> Read the documentation for the RADIUS clients. Already did and already made lots of tests. I'm using citrix netscaler as a client. Citrix does not support directly securid, but need a radius integrated with RSA. So i configured FreeRadius with SecurID and all work but "new pin mode". I need to find a way to update pins, using also an alternative client that support NEW PIN and NEXT TOKENCODE. After examining lots of documentations, trying lots of configurations, i'm searching for peoples who have experience with similar needs, or someone that give me advices about using alternative clients only to update pins. > Many clients will automatically work with PAP and challenges. But not > all. Consult the client documentation. Yes i know about that, i have tryed many clients, trust me. > And *which* client are you using? Where did you get it from? I don't > really care, as you should be checking the vendor documentation. But > those are questions you should be asking yourself. I! 'm posting here only as a "last solution" and only because i use freeradius as a frontend. I already opened ticket with citrix and rsa, but no solution suitable for my needs. I also already asked to me why i'm here, and if no one could reply to me "ok no problems", i will try again by myself. Thanks Giulius Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Commit report for master branch
by a.cudbardb＠freeradius.org 15 Sep '12

15 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

2 1

Commit report for master branch
by a.cudbardb＠freeradius.org 15 Sep '12

15 Sep '12

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ======

1 0