- Freeradius-Users - lists.freeradius.org

None
by jerry kwajaffa 21 Aug '12

21 Aug '12

http://choirisetyawan.com/amethyst/makoler.html?lxx=fbcnlf

1 0

MOTP-AS + Freeradius startup problem
by Бедняков Алексей 21 Aug '12

21 Aug '12

3 2

some mysql errors
by Tony Peña 20 Aug '12

20 Aug '12

Hi... i'm getting some many errors like this... Mon Aug 20 11:27:26 2012 : Error: [sql] Couldn't update SQL accounting STOP record - Lock wait timeout exceeded; try restarting transaction Mon Aug 20 11:27:26 2012 : Error: rlm_sql_mysql: Cannot store result Mon Aug 20 11:27:26 2012 : Error: rlm_sql_mysql: MySQL error 'Lock wait timeout exceeded; try restarting transaction' and other lines with Logins OK... but have more errors sql than logins ok... i guess missing some tunning parameters... i have, 15 NAS vs 2 freeradius-servers ..... this do AA vs 2 LDAP balanced and A vs cluster-mysql can help me more less to up or down some numbers to tune efficient the requests about some experience ? thx any way -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

3 7

Segmentation Fault after PPP proxy
by David Aldwinckle 20 Aug '12

20 Aug '12

Hello, This morning I was attempting to move dialup (PPP) authentication to FreeRadius, and was met with a segmentation fault. I am using version 2.2 on RHEL. Below are details of my configuration. Users are using MSCHAPv2. /etc/raddb/users DEFAULT Framed-Protocol == PPP, Proxy-To-Realm := DIALUP_REALM /etc/raddb/proxy.conf realm DIALUP_REALM { virtual server = dialup } /etc/raddb/sites-enabled/dialup server dialup { authorize { files mschap pap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } } post-auth { #20+ group checks via LDAP } } In this configuration, I get a segmentation fault. It occurs before the mschap module is called in the authenticate stanza. (I cannot provide debug at this time, since I am outside the service window.) If I remove the manual proxying from the users file, the default server will handle the request fine. The default server looks like this: authorize { preprocess chap mschap files suffix eap { ok = return } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } Finally, if I put the manual proxy back in, and mirror the default server in my dialup virtual server, the seg fault returns. Any ideas would be appreciated. Dave

4 6

Users on the multiple APs
by Dagia Dorjsuren 20 Aug '12

20 Aug '12

Hello, Does anyone know that how to configure the wifi chillispot users by each NAS? For example : There are "testuser" wifi chillispot user and three Wifi zones which are AP1, AP2 and AP3. That AP{1-2} are nas-identifier. AP1 has 10.10.10.1, AP2 has 10.10.10.2 and AP3 has 10.10.10.3 ip address. That "testuser" must be available for AP1 and AP2 wifi zones. But, that user must be unavailable for AP3 wifi zone. How will do it?

1 0

Framed-Protocol PPP question
by Jonas Fornander 18 Aug '12

18 Aug '12

We have successfully installed and tested FreeRadius. However authentication fails when we try with a live customer. Here is the lines in the debug file where it fails: <snip> # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok : ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "3108396020(a)netwood.net" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [3108396020(a)netwood.net/<CHAP-Password>] (from client LosAngeles port 67371072) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} </snip> This is the entry we have for the customer in the users file: <snip> 3108396020(a)netwood.net Cleartext-Password := "testing123" </snip> Any advice is greatly appreciated. Cheers, Jonas Fornander System Administrator <http://www.netwood.net/> Netwood Communications, LLC Providing All Your Internet Needs Tel: 310-442-1530 Fax: 310-496-0712 ************************************* Like us - Facebook <http://on.fb.me/hOVxtl> http://on.fb.me/hOVxtl, Follow us -Twitter <http://bit.ly/fqxj64> http://bit.ly/fqxj64 Link in - LinkedIn <http://linkd.in/Hdc3Ce> http://linkd.in/Hdc3Ce Read our Yelp reviews <http://bit.ly/kjbxEV> http://bit.ly/kjbxEV ************************************************************** P THINK GREEN BEFORE YOU PRINT. Supporting Paperless Office Concepts

2 10

Re: Logging raw accounting packets
by Alan Buxey 18 Aug '12

18 Aug '12

A bit of radsniff and even raddebug (just capturing accounting packets) via radmin might be enough to capture the badness they are sending? alan

1 0

Logging raw accounting packets
by Brian Candler 18 Aug '12

18 Aug '12

I would like to put accounting logs into some sort of database, but store the entire raw binary packet as well as some decoded attributes. I can think of plenty of options for the storage: e.g. mysql Blob column, CouchDB binary attachment, MongoDB etc. But I can't see how to get at the raw packet from the freeradius config. Even rlm_perl doesn't seem to receive the raw packet, only a hash of decoded attributes. Is there a module which can do this already, or should I be looking to hack something up in C? Thanks, Brian.

2 3

New FreeRADIUS Deployment
by Mauricio Harley 17 Aug '12

17 Aug '12

Dear friends, I searched list archive, but I couldn't find anything about this. I need to correctly design and deploy a brand new FreeRADIUS server. It will receive about 25.000 simultaneous users, so I'm planning to have, at least, two servers. My questions are: 1. What would be recommended server hardware (memory, disk, CPU, ...) and software (Linux distribution, kernel version, ...)? 2. How could I synchronize both servers' users? I mean, in the beginning, I'd have two separate /etc/shadow files but this is not scalable. I need to share a single file between both servers. Is it possible? How? 3. Any recommendations to the backup policy? Best regards, Maurício Harley Suporte Técnico Cisco IP Phone: +55 (85) 3133-7910 Auriga Tecnologia & Negócios Cisco SILVER Certified Partner IBM Business Partner

4 10

Problem with FreeRadius + PostgreSQL
by Антипов Сергей 17 Aug '12

17 Aug '12

Hi! I use Debian Squeeze with FreeRADIUS Version 2.1.10 (2.1.10+dfsg-2) and PostgreSQL 8.4 (8.4.12-0squeeze1). VSA Cisco, having a sign '=' in value, like 'Cisco-AVPair = "out-carrier-id=***"' are written to te base in bad form - "out-carrier-id=3D***". How to solve this problem? -- С уважением, Сергей Антипов. email: greendayonfire(a)gmail.com skype: greendayonfire

3 2