I build it by adding rlm_opendirectory to the ./src/modules/stable file. Then, run: make distclean ./configure <stuff> etc… Everything you need should be on the desktop OS. Let me know if that is not the case. If you are on desktop, you'll probably want to set up a service access list. The magic group name that gets set up by the admin tools is: com.apple.access_radius. - Steven On Jan 22, 2008, at 7:54 AM, freeradius-users-request@lists.freeradius.org wrote:
From: Info <info@sparkmediagroup.com> Date: January 22, 2008 7:50:57 AM PST To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org
Subject: rlm_opendirectory (FR 2.0.0) Reply-To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org
Hello all,
Quick Qs about the experimental rlm_opendirectory module:
* Has anyone built in this module successfully?
* Is it possible to add this in without the other experimental modules and, if so, what is the proper flag? (Note, I've tried on separate runs --with-rlm_opendirectory, --enable-rlm_opendirectory, and --with-modules="rlm_opendirectory" seemingly to no avail.)
* Does the module need to be built against a server version of the Framework or should I be able to build this from the libraries on any os x workstation?
Cheers,
Jim
Hi there Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please. Pawel Cieplinski
Hi, in sql.conf it says: Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running. Best, Walter Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Ok walter that is clear to me. How would you solve that problem? Lets say I need NAS working just after its added to SQL. Restarting freeradius daemon using cron ? Or Use script wchich add NAS to SQL and restarting freerdius ? Regards Pawel Cieplinski -----Original Message----- From: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.org [mailto:freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or g] On Behalf Of Walter Krivanek, VividVisions Sent: 22 January 2008 18:46 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server. Hi, in sql.conf it says: Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running. Best, Walter Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.19.8/1236 - Release Date: 21/01/2008 20:23
Cron can help but how will you know that NAS is added and you can lost some updates while your radius server was down. Better idea is to make script and call it after every insert.... PHP can do this... Pawel Cieplinski wrote:
Hi
Ok walter that is clear to me.
How would you solve that problem? Lets say I need NAS working just after its added to SQL.
Restarting freeradius daemon using cron ?
Or
Use script wchich add NAS to SQL and restarting freerdius ?
Regards Pawel Cieplinski
-----Original Message----- From: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.org [mailto:freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or g] On Behalf Of Walter Krivanek, VividVisions Sent: 22 January 2008 18:46 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server.
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Maybe freeradius can read the nas list from sql at startup to some linked list and this list will be updated every given interval with a query to the database. Sounds reasonable. Regards, Liran Tal. On Jan 23, 2008 12:51 AM, Marinko Tarlac <mangia81@gmail.com> wrote:
Cron can help but how will you know that NAS is added and you can lost some updates while your radius server was down.
Better idea is to make script and call it after every insert....
PHP can do this...
Pawel Cieplinski wrote:
Hi
Ok walter that is clear to me.
How would you solve that problem? Lets say I need NAS working just after its added to SQL.
Restarting freeradius daemon using cron ?
Or
Use script wchich add NAS to SQL and restarting freerdius ?
Regards Pawel Cieplinski
-----Original Message----- From: freeradius-users-bounces+pawel= parkandmarine.com@lists.freeradius.org [mailto: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or g] On Behalf Of Walter Krivanek, VividVisions Sent: 22 January 2008 18:46 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server.
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
liran tal wrote:
Maybe freeradius can read the nas list from sql at startup to some linked list and this list will be updated every given interval with a query to the database.
It's more complicated than that. The NASes need to be deleted, too. And this has to be done without affecting normal server operation. As always, patches are welcome. Alan DeKok.
Hey Alan, On Jan 23, 2008 9:47 AM, Alan DeKok <aland@deployingradius.com> wrote:
liran tal wrote:
Maybe freeradius can read the nas list from sql at startup to some linked list and this list will be updated every given interval with a query to the database.
It's more complicated than that. The NASes need to be deleted, too. And this has to be done without affecting normal server operation.
As always, patches are welcome.
Well, every given interval a query will run on the database server to get the list of nases and it will build a new linked list based on that and delete the other nodes and free the pointers of those. I guess that coming up with a method to check against each nas if it's there or not, and to remove or add it based on a check is do-able but would probably face some efficiency issues where-as I think it would be proper to create a new linked list with whatever nases that query returns and free the previous linked list from memory. I haven't had a look at the relevant code but it seems quite basic to implement unless I'm over-seeing some critical aspects :-) I'll be glad to take a look if you can refer me to the current piece of code where freeradius handles the nas lists read from the database and stores them. Regards, Liran Tal.
Well how many times per day do you add nases? On Jan 23, 2008 10:20 AM, liran tal <liransgarage@gmail.com> wrote:
Hey Alan,
On Jan 23, 2008 9:47 AM, Alan DeKok <aland@deployingradius.com> wrote:
liran tal wrote:
Maybe freeradius can read the nas list from sql at startup to some linked list and this list will be updated every given interval with a query to the database.
It's more complicated than that. The NASes need to be deleted, too. And this has to be done without affecting normal server operation.
As always, patches are welcome.
Well, every given interval a query will run on the database server to get the list of nases and it will build a new linked list based on that and delete the other nodes and free the pointers of those.
I guess that coming up with a method to check against each nas if it's there or not, and to remove or add it based on a check is do-able but would probably face some efficiency issues where-as I think it would be proper to create a new linked list with whatever nases that query returns and free the previous linked list from memory.
I haven't had a look at the relevant code but it seems quite basic to implement unless I'm over-seeing some critical aspects :-)
I'll be glad to take a look if you can refer me to the current piece of code where freeradius handles the nas lists read from the database and stores them.
Regards, Liran Tal.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I wont be adding NASes, but users will do, so i am thinking 0-10 a day. Linking to a dynamic list using interal its not a good solution, becouse i will need to wait for list update after adding NAS. Other solution i am thinking is to run two instances of server and restart them in round robin and use iptables to redirect packets to actual working server. Goal is to serveradius to third party as a service, so users will add their own nases, modified them etc, at this stage i cannot really say how many times a day i will need a restart, but i am wondering about also about following soltion: Run two servers: Primary and Secondary, primary will be restarted once a day, and secondary every time NAS list will be changed. After adding a NAS primimary will not respond (unknown NAS) so NAS will ask secondary instead) also request from other nases will not be lost becouse primary is not restarded on NAS list change. What do you think ? ________________________________ From: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.org [mailto:freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or g] On Behalf Of Marinko Tarlac Sent: 23 January 2008 10:05 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server. Well how many times per day do you add nases? On Jan 23, 2008 10:20 AM, liran tal <liransgarage@gmail.com> wrote: Hey Alan, On Jan 23, 2008 9:47 AM, Alan DeKok <aland@deployingradius.com> wrote: liran tal wrote: > Maybe freeradius can read the nas list from sql at startup to some > linked list and this list will be updated every given interval with a query > to the database. It's more complicated than that. The NASes need to be deleted, too. And this has to be done without affecting normal server operation. As always, patches are welcome. Well, every given interval a query will run on the database server to get the list of nases and it will build a new linked list based on that and delete the other nodes and free the pointers of those. I guess that coming up with a method to check against each nas if it's there or not, and to remove or add it based on a check is do-able but would probably face some efficiency issues where-as I think it would be proper to create a new linked list with whatever nases that query returns and free the previous linked list from memory. I haven't had a look at the relevant code but it seems quite basic to implement unless I'm over-seeing some critical aspects :-) I'll be glad to take a look if you can refer me to the current piece of code where freeradius handles the nas lists read from the database and stores them. Regards, Liran Tal. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I think that having 2 servers running in master/slave and constantly exchanging the roles between them is highly a compromise for reading once in a while a cached nas list and updating it every now and then. The interval to update the nas list can be user defined and will solely depend on your system being able to support it. Ofcourse I wouldn't recommend doing it every second but a reasonable time is in place I think. Also I'm thinking that like most services in the world changes take affect only after a limited time which you can enforce in a policy. For example, you tell your users or whomever operates the nas list that changes to the nas are affected only after 3 hours and set that time as the interval for freeradius to re-build the list. Very much like that is what happens with DNS record updates for example (although for somewhat different reasons) which you have to wait at least a couple of hours if not the full 72 hours for the dns records to update on servers/routers across the globe. Regards, Liran Tal. On Jan 23, 2008 12:08 PM, Pawel Cieplinski <pawel@parkandmarine.com> wrote:
I wont be adding NASes, but users will do, so i am thinking 0-10 a day.
Linking to a dynamic list using interal its not a good solution, becouse i will need to wait for list update after adding NAS.
Other solution i am thinking is to run two instances of server and restart them in round robin and use iptables to redirect packets to actual working server.
Goal is to serveradius to third party as a service, so users will add their own nases, modified them etc, at this stage i cannot really say how many times a day i will need a restart, but i am wondering about also about following soltion:
Run two servers:
Primary and Secondary, primary will be restarted once a day, and secondary every time NAS list will be changed. After adding a NAS primimary will not respond (unknown NAS) so NAS will ask secondary instead) also request from other nases will not be lost becouse primary is not restarded on NAS list change.
What do you think ?
________________________________
From: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.org [mailto: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or g] On Behalf Of Marinko Tarlac Sent: 23 January 2008 10:05 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server.
Well how many times per day do you add nases?
On Jan 23, 2008 10:20 AM, liran tal <liransgarage@gmail.com> wrote:
Hey Alan,
On Jan 23, 2008 9:47 AM, Alan DeKok <aland@deployingradius.com> wrote:
liran tal wrote: > Maybe freeradius can read the nas list from sql at startup to some > linked list and this list will be updated every given interval with a query > to the database.
It's more complicated than that. The NASes need to be deleted, too. And this has to be done without affecting normal server operation.
As always, patches are welcome.
Well, every given interval a query will run on the database server to get the list of nases and it will build a new linked list based on that and delete the other nodes and free the pointers of those.
I guess that coming up with a method to check against each nas if it's there or not, and to remove or add it based on a check is do-able but would probably face some efficiency issues where-as I think it would be proper to create a new linked list with whatever nases that query returns and free the previous linked list from memory.
I haven't had a look at the relevant code but it seems quite basic to implement unless I'm over-seeing some critical aspects :-)
I'll be glad to take a look if you can refer me to the current piece of code where freeradius handles the nas lists read from the database and stores them.
Regards, Liran Tal.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello My radius server is not implemented yet, but i am wondering of a performance of it before it starts, I will need to simulate a performance test, My idea is to generate packet to analize the server. 1. If anyone done that before, could you give some clues of how to test it, and what to focus on. 2. Is there a ready tool to do that for me? (i've heard about it, but cannot find it) 3. In your experience of bad performace what to focus on to improve it? Interfaces, RAM or proessor ? Cheers Pawel Cieplinski
1 & 2 - radclient is included with the server: http://wiki.freeradius.org/Radclient 3 - database. (Free)radius server should outperform the database with some ease, even if the database box is much better. Ivan Kalik Kalik Informatika ISP Dana 23/1/2008, "Pawel Cieplinski" <pawel@parkandmarine.com> piše:
Hello
My radius server is not implemented yet, but i am wondering of a performance of it before it starts, I will need to simulate a performance test, My idea is to generate packet to analize the server.
1. If anyone done that before, could you give some clues of how to test it, and what to focus on.
2. Is there a ready tool to do that for me? (i've heard about it, but cannot find it)
3. In your experience of bad performace what to focus on to improve it? Interfaces, RAM or proessor ?
Cheers Pawel Cieplinski
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Pawel Cieplinski wrote:
My radius server is not implemented yet, but i am wondering of a performance of it before it starts, I will need to simulate a performance test, My idea is to generate packet to analize the server.
1. If anyone done that before, could you give some clues of how to test it, and what to focus on.
doc/performance-testing ? The server *does* come with documentation.
3. In your experience of bad performace what to focus on to improve it? Interfaces, RAM or proessor ?
Databases. RAM / CPU are almost irrelevant. Alan DeKok.
Hi,
My radius server is not implemented yet, but i am wondering of a performance of it before it starts, I will need to simulate a performance test, My idea is to generate packet to analize the server.
doc/performance-testing its in the freeradius archive - eg freeradius-server-2.0.1.tar.gz from FTP or WWW freeradius.org
3. In your experience of bad performace what to focus on to improve it? Interfaces, RAM or proessor ?
depends on the type of authentication and methods being used. the vast vast vast number of performance problems that are mentioned on this list are due to SQL bottlenecks. the DB is never fast enough. alan
Hi Liran I think, that will have to be a solution, i havegot also an idea to run two instances of server on one machine on diffrent ports and redirect ports using iptables, for egzample: Radius A listening on ports 1820-1821 Radius B listening on ports 1822-1823 Variable server_on; Start script is to run both servers and tell ip tables to redirect ports 1812-1813 to 1820-1821. Variable server_on is set to A; And "reboot server script" is checking server_on value: If server_on == A then { reboot server B; tell iptables to forward request to server B; server_on = B; } else { reboot server A; tell iptables to forward request to server A; server_on = A; } Theoreticly non working server is idle and not taking resoures. The only thing i dont know yet is switching while request is operating eg: user send auth_request... Get response, and we swithed servers before accounting. Its just an idea, maybe it will be useful to someone Pawel Cieplinski ________________________________ From: freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.org [mailto:freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or g] On Behalf Of liran tal Sent: 23 January 2008 12:07 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server. I think that having 2 servers running in master/slave and constantly exchanging the roles between them is highly a compromise for reading once in a while a cached nas list and updating it every now and then. The interval to update the nas list can be user defined and will solely depend on your system being able to support it. Ofcourse I wouldn't recommend doing it every second but a reasonable time is in place I think. Also I'm thinking that like most services in the world changes take affect only after a limited time which you can enforce in a policy. For example, you tell your users or whomever operates the nas list that changes to the nas are affected only after 3 hours and set that time as the interval for freeradius to re-build the list. Very much like that is what happens with DNS record updates for example (although for somewhat different reasons) which you have to wait at least a couple of hours if not the full 72 hours for the dns records to update on servers/routers across the globe. Regards, Liran Tal. On Jan 23, 2008 12:08 PM, Pawel Cieplinski <pawel@parkandmarine.com
wrote:
I wont be adding NASes, but users will do, so i am thinking 0-10 a day. Linking to a dynamic list using interal its not a good solution, becouse i will need to wait for list update after adding NAS. Other solution i am thinking is to run two instances of server and restart them in round robin and use iptables to redirect packets to actual working server. Goal is to serveradius to third party as a service, so users will add their own nases, modified them etc, at this stage i cannot really say how many times a day i will need a restart, but i am wondering about also about following soltion: Run two servers: Primary and Secondary, primary will be restarted once a day, and secondary every time NAS list will be changed. After adding a NAS primimary will not respond (unknown NAS) so NAS will ask secondary instead) also request from other nases will not be lost becouse primary is not restarded on NAS list change. What do you think ? ________________________________ From: freeradius-users-bounces+pawel= parkandmarine.com@lists.freeradius.org [mailto:freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or <mailto:freeradius-users-bounces+pawel=parkandmarine.com@lists.freeradius.or
g] On Behalf Of Marinko Tarlac Sent: 23 January 2008 10:05 To: FreeRadius users mailing list Subject: Re: NAS list update without restarting radius server. Well how many times per day do you add nases? On Jan 23, 2008 10:20 AM, liran tal <liransgarage@gmail.com > wrote: Hey Alan, On Jan 23, 2008 9:47 AM, Alan DeKok <aland@deployingradius.com> wrote: liran tal wrote: > Maybe freeradius can read the nas list from sql at startup to some > linked list and this list will be updated every given interval with a query > to the database. It's more complicated than that. The NASes need to be deleted, too. And this has to be done without affecting normal server operation. As always, patches are welcome. Well, every given interval a query will run on the database server to get the list of nases and it will build a new linked list based on that and delete the other nodes and free the pointers of those. I guess that coming up with a method to check against each nas if it's there or not, and to remove or add it based on a check is do-able but would probably face some efficiency issues where-as I think it would be proper to create a new linked list with whatever nases that query returns and free the previous linked list from memory. I haven't had a look at the relevant code but it seems quite basic to implement unless I'm over-seeing some critical aspects :-) I'll be glad to take a look if you can refer me to the current piece of code where freeradius handles the nas lists read from the database and stores them. Regards, Liran Tal. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Pawel Cieplinski wrote:
I wont be adding NASes, but users will do, so i am thinking 0-10 a day.
Linking to a dynamic list using interal its not a good solution, becouse i will need to wait for list update after adding NAS.
If the list update takes longer than 1/10 of a second, something is very wrong.
Other solution i am thinking is to run two instances of server and restart them in round robin and use iptables to redirect packets to actual working server.
Yuck. That's a lot more complicated.
Goal is to serveradius to third party as a service, so users will add their own nases, modified them etc, at this stage i cannot really say how many times a day i will need a restart, but i am wondering about also about following soltion:
For all that work, why not just fix the server so that it can be safely HUP'd? Honestly, I'm wondering why people will put huge efforts into building and maintaining multiple machines rather than doing tiny bits of coding. If the functionality is *that* important, it should be important enough to add to the server core. Alan DeKok.
Exactly my point Alan :) Regards, Liran Tal. On Jan 23, 2008 2:04 PM, Alan DeKok <aland@deployingradius.com> wrote:
Pawel Cieplinski wrote:
I wont be adding NASes, but users will do, so i am thinking 0-10 a day.
Linking to a dynamic list using interal its not a good solution, becouse i will need to wait for list update after adding NAS.
If the list update takes longer than 1/10 of a second, something is very wrong.
Other solution i am thinking is to run two instances of server and restart them in round robin and use iptables to redirect packets to actual working server.
Yuck. That's a lot more complicated.
Goal is to serveradius to third party as a service, so users will add their own nases, modified them etc, at this stage i cannot really say how many times a day i will need a restart, but i am wondering about also about following soltion:
For all that work, why not just fix the server so that it can be safely HUP'd?
Honestly, I'm wondering why people will put huge efforts into building and maintaining multiple machines rather than doing tiny bits of coding. If the functionality is *that* important, it should be important enough to add to the server core.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan DeKok wrote:
Pawel Cieplinski wrote:
I wont be adding NASes, but users will do, so i am thinking 0-10 a day.
Linking to a dynamic list using interal its not a good solution, becouse i will need to wait for list update after adding NAS.
If the list update takes longer than 1/10 of a second, something is very wrong.
Ours often takes ~20 seconds for 600 NAS.
Other solution i am thinking is to run two instances of server and restart them in round robin and use iptables to redirect packets to actual working server.
Yuck. That's a lot more complicated.
Goal is to serveradius to third party as a service, so users will add their own nases, modified them etc, at this stage i cannot really say how many times a day i will need a restart, but i am wondering about also about following soltion:
For all that work, why not just fix the server so that it can be safely HUP'd?
Honestly, I'm wondering why people will put huge efforts into building and maintaining multiple machines rather than doing tiny bits of coding. If the functionality is *that* important, it should be important enough to add to the server core.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Arran Cudbard-Bell wrote:
If the list update takes longer than 1/10 of a second, something is very wrong.
Ours often takes ~20 seconds for 600 NAS.
Ouch. 600 SQL qeuries really take that long? i.e. if the SELECT for NASes from SQL takes less than 20s on the command-line, then something else is doing wrong inside of the server. Alan DeKok.
Hi, I had actually kept this email in my queue to implement someday. Today is someday. But I have a question. The config file contains IP addresses, which the nas.sql doesn't. How do I sync up the format of the clients.conf with the nas.sql? client nas_shortname { ipaddr = ?????????? (or) ipv6addr = ???????? netmask = ???????? secret = nas_secret require_message_authenticator = ???????? shortname = nas_shortname nastype = nas_type virtual_server = ???????? } Thanks, Tuc
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
IP address (or DNS name) goes into nasname field. Ivan Kalik Kalik Informatika ISP Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> piše:
Hi,
I had actually kept this email in my queue to implement someday. Today is someday. But I have a question.
The config file contains IP addresses, which the nas.sql doesn't. How do I sync up the format of the clients.conf with the nas.sql?
client nas_shortname { ipaddr = ?????????? (or) ipv6addr = ???????? netmask = ???????? secret = nas_secret require_message_authenticator = ???????? shortname = nas_shortname nastype = nas_type virtual_server = ???????? }
Thanks, Tuc
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, If I choose DNS name, and I don't fully qualify it, does it follow the standard BIND rules of using the "domain" setting, or going down the "search" path? Reason I'm trying to avoid the IP or the FQDN is that I was hoping to use the nasname along with the secret in the UAM program I'm using for a "Secret per NAS" situation. The hotspots are already using just a nasname currently (Which is just something like SBC-1427). (Then again, getting the client to put all the NAS into DNS is going to be a tough sell too) Thanks, Tuc
IP address (or DNS name) goes into nasname field.
Ivan Kalik Kalik Informatika ISP
Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> pi�e:
Hi,
I had actually kept this email in my queue to implement someday. Today is someday. But I have a question.
The config file contains IP addresses, which the nas.sql doesn't. How do I sync up the format of the clients.conf with the nas.sql?
client nas_shortname { ipaddr = ?????????? (or) ipv6addr = ???????? netmask = ???????? secret = nas_secret require_message_authenticator = ???????? shortname = nas_shortname nastype = nas_type virtual_server = ???????? }
Thanks, Tuc
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
Tuc at T-B-O-H.NET wrote:
If I choose DNS name, and I don't fully qualify it, does it follow the standard BIND rules of using the "domain" setting, or going down the "search" path?
It follows the normal process to look up domain names. Alan DeKok.
nasname on your AP goes into NAS-Identifier filed in access request. It's not the same as nasname in nas table which takes NAS IP or FQDN. You can put it in shortname filed. "Secret per NAS" = "Secret per NAS IP address". Ivan Kalik Kalik Informatika ISP Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> piše:
Hi,
If I choose DNS name, and I don't fully qualify it, does it follow the standard BIND rules of using the "domain" setting, or going down the "search" path?
Reason I'm trying to avoid the IP or the FQDN is that I was hoping to use the nasname along with the secret in the UAM program I'm using for a "Secret per NAS" situation. The hotspots are already using just a nasname currently (Which is just something like SBC-1427). (Then again, getting the client to put all the NAS into DNS is going to be a tough sell too)
Thanks, Tuc
IP address (or DNS name) goes into nasname field.
Ivan Kalik Kalik Informatika ISP
Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> piše:
Hi,
I had actually kept this email in my queue to implement someday. Today is someday. But I have a question.
The config file contains IP addresses, which the nas.sql doesn't. How do I sync up the format of the clients.conf with the nas.sql?
client nas_shortname { ipaddr = ?????????? (or) ipv6addr = ???????? netmask = ???????? secret = nas_secret require_message_authenticator = ???????? shortname = nas_shortname nastype = nas_type virtual_server = ???????? }
Thanks, Tuc
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
Hi Ivan, Thanks for the reply. I think its starting to sink in. :) I have to test out how we'll do a bit of it, but I think I get the jist of it. I don't see how any of the netmask, require_message_authenticator or virtual_server fit into it... But since I wasn't using it anyway, I won't push my luck. ;) (Unless for netmask your saying the nasname could be 192.168.3.0/24) Thanks, Tuc
nasname on your AP goes into NAS-Identifier filed in access request. It's not the same as nasname in nas table which takes NAS IP or FQDN. You can put it in shortname filed. "Secret per NAS" = "Secret per NAS IP address".
Ivan Kalik Kalik Informatika ISP
Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> pi�e:
Hi,
If I choose DNS name, and I don't fully qualify it, does it follow the standard BIND rules of using the "domain" setting, or going down the "search" path?
Reason I'm trying to avoid the IP or the FQDN is that I was hoping to use the nasname along with the secret in the UAM program I'm using for a "Secret per NAS" situation. The hotspots are already using just a nasname currently (Which is just something like SBC-1427). (Then again, getting the client to put all the NAS into DNS is going to be a tough sell too)
Thanks, Tuc
IP address (or DNS name) goes into nasname field.
Ivan Kalik Kalik Informatika ISP
Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> pi�e:
Hi,
I had actually kept this email in my queue to implement someday. Today is someday. But I have a question.
The config file contains IP addresses, which the nas.sql doesn't. How do I sync up the format of the clients.conf with the nas.sql?
client nas_shortname { ipaddr = ?????????? (or) ipv6addr = ???????? netmask = ???????? secret = nas_secret require_message_authenticator = ???????? shortname = nas_shortname nastype = nas_type virtual_server = ???????? }
Thanks, Tuc
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
Hi there
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
Pawel Cieplinski
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello, - Anyone can point me in the right direction if I am getting this error, from the client: "CTRL-EVENT-EAP-FAILURE EAP authentication failed" - And on the freeradius console I have this: Called-Station-Id = "00-20-a6-64-c3-b1:MVG-Personal" Calling-Station-Id = "00-0f-cb-f9-3b-f9;MVG-Personal" NAS-Identifier = "MVG-1" State = 0x73e4f46973e6f0393091c54faaf880fd Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060315 Message-Authenticator = 0x330b306447495e1a49cd5c7cfe5c1c6d +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "easy", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry easy at line 90 expand: Hello, %{User-Name} -> Hello, easy ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Reply-Message = "Hello, easy" EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73e4f46972e7e1393091c54faaf880fd Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 153 with timestamp +279 Cleaning up request 1 ID 154 with timestamp +279 Ready to process requests. - And the client don't get an IP address, guessing it has something to do with EAP authentication "No EAP Start". Thanks very much for help! Best regards, Johan Nyman
Yes, you can specify a network, not just single IP address. Ivan Kalik Kalik Informatika ISP Dana 12/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> piše:
Hi Ivan,
Thanks for the reply. I think its starting to sink in. :) I have to test out how we'll do a bit of it, but I think I get the jist of it. I don't see how any of the netmask, require_message_authenticator or virtual_server fit into it... But since I wasn't using it anyway, I won't push my luck. ;) (Unless for netmask your saying the nasname could be 192.168.3.0/24)
Thanks, Tuc
nasname on your AP goes into NAS-Identifier filed in access request. It's not the same as nasname in nas table which takes NAS IP or FQDN. You can put it in shortname filed. "Secret per NAS" = "Secret per NAS IP address".
Ivan Kalik Kalik Informatika ISP
Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> piše:
Hi,
If I choose DNS name, and I don't fully qualify it, does it follow the standard BIND rules of using the "domain" setting, or going down the "search" path?
Reason I'm trying to avoid the IP or the FQDN is that I was hoping to use the nasname along with the secret in the UAM program I'm using for a "Secret per NAS" situation. The hotspots are already using just a nasname currently (Which is just something like SBC-1427). (Then again, getting the client to put all the NAS into DNS is going to be a tough sell too)
Thanks, Tuc
IP address (or DNS name) goes into nasname field.
Ivan Kalik Kalik Informatika ISP
Dana 11/4/2008, "Tuc at T-B-O-H.NET" <ml@t-b-o-h.net> piše:
Hi,
I had actually kept this email in my queue to implement someday. Today is someday. But I have a question.
The config file contains IP addresses, which the nas.sql doesn't. How do I sync up the format of the clients.conf with the nas.sql?
client nas_shortname { ipaddr = ?????????? (or) ipv6addr = ???????? netmask = ???????? secret = nas_secret require_message_authenticator = ???????? shortname = nas_shortname nastype = nas_type virtual_server = ???????? }
Thanks, Tuc
Hi,
in sql.conf it says:
Set readclients to 'yes' to read radius clients from the database ('nas' table) Clients will ONLY be read on server startup. For performance and security reasons, finding clients via SQL queries CANNOT be done "live" while the server is running.
Best, Walter
Am 22.01.2008 um 19:30 schrieb Pawel Cieplinski:
> Hi there > > > > Everything works fine so far, but after adding a new NAS to DB, > radius server need restart to read this data, I am trying to > manipulate nas list without restarting freeradius, but due to lack > od documentation could you help me with that please. > > > > Pawel Cieplinski
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Pawel Cieplinski wrote:
Everything works fine so far, but after adding a new NAS to DB, radius server need restart to read this data, I am trying to manipulate nas list without restarting freeradius, but due to lack od documentation could you help me with that please.
As always, patches are welcome. Alan DeKok.
Hi All, I want to debug the shared library "rlm_eap_sim.so", when running with "radiusd" [FreeRadius Server]. We are using gdb in Linux (2.6.9-5.ELsmp) platform. I have followed the following steps: ============================ 1) $ gdb radiusd 2) (gdb) file ../lib/rlm_eap_sim.so [Since rlm_eap_sim.so symbols are not loaded still by radiusd, so gdb can not find symbol] 3) (gdb) b rlm_eap_sim.c:371 Breakpoint 1 at 0x1159: file rlm_eap_sim.c, line 371. 4)(gdb) run -X Starting program: /home/nilanjan/imp_soft/freeradius-1.1.7/install2/lib/rlm_eap_sim.so -X Breakpoint 1 at 0xf54159: file rlm_eap_sim.c, line 371. warning: shared library handler failed to enable breakpoint Program received signal SIGSEGV, Segmentation fault. 0x00000002 in ?? () ======================= In this case, radiusd server exited abnormally. But if we run "$ radiusd -X", it runs fine, and can do EAP-SIM authentication successfully. If anyone has any solution, about how to debug dynamically loaded module in "gdb" please let me know. Thanks in advance. Best Regards, Nilanjan
Thanks, Steven ... I'll give that a try! ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com On Jan 22, 2008, at 1:18 PM, Steven Simon wrote: I build it by adding rlm_opendirectory to the ./src/modules/stable file. Then, run: make distclean ./configure <stuff> etc… Everything you need should be on the desktop OS. Let me know if that is not the case. If you are on desktop, you'll probably want to set up a service access list. The magic group name that gets set up by the admin tools is: com.apple.access_radius. - Steven On Jan 22, 2008, at 7:54 AM, freeradius-users- request@lists.freeradius.org wrote:
From: Info <info@sparkmediagroup.com> Date: January 22, 2008 7:50:57 AM PST To: FreeRadius users mailing list <freeradius- users@lists.freeradius.org> Subject: rlm_opendirectory (FR 2.0.0) Reply-To: FreeRadius users mailing list <freeradius- users@lists.freeradius.org>
Hello all,
Quick Qs about the experimental rlm_opendirectory module:
* Has anyone built in this module successfully?
* Is it possible to add this in without the other experimental modules and, if so, what is the proper flag? (Note, I've tried on separate runs --with-rlm_opendirectory, --enable-rlm_opendirectory, and --with-modules="rlm_opendirectory" seemingly to no avail.)
* Does the module need to be built against a server version of the Framework or should I be able to build this from the libraries on any os x workstation?
Cheers,
Jim
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
participants (14)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Info -
Ivan Kalik -
Johan Nyman -
liran tal -
Marinko Tarlac -
Nilanjan Sarkar -
Pawel Cieplinski -
Steven Simon -
tnt＠kalik.co.yu -
Tuc at T-B-O-H.NET -
Walter Krivanek, VividVisions