<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Nur Text Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.NurTextZchn
{mso-style-name:"Nur Text Zchn";
mso-style-priority:99;
mso-style-link:"Nur Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoPlainText>Hello,<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>we’ve got a problem with FreeRADIUS / rlm_sql behavior that prevents us from enjoying a fully redundant RADIUS service, consisting of 3 FreeRADIUS servers, probably because of compounded mistakes / misunderstandings in our configuration that I've attached at the bottom of this post.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Setup:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>- each of the 3 servers consists of a FR instance and a MySQL instance that contains all auth data and the radacct table to store acct data<o:p></o:p></p><p class=MsoPlainText>- each FR instance connects to its local SQL instance only, there’s no redundant or load-balance setup required – going that route and have FR try to connect to the SQL instance on one of the other nodes in case of errors with the local one would also solve our problem, but we deem it unnecessary if FR was able to handle a failed SQL connection “properly"<o:p></o:p></p><p class=MsoPlainText>- the SQL nodes are configured as Galera multi-master cluster, so any node is operating on the same set of data<o:p></o:p></p><p class=MsoPlainText>-> this means every node should work perfectly fine on its own, which is why we don’t think we need to implement the redundancy options that FR offers.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>If SQL is unavailable before we start FR, FR refuses to start and exits immediately after it finds out it cannot connect to the local SQL instance, with „Instantiation failed for module sql_localhost“. This behavior is perfectly fine because it means that any NAS client sending requests to that particular FR node will find that the node does not respond, and the client will retry the request with the other RADIUS servers it knows of and hopefully, at least one of them will answer.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>However, if we start FR while and subsequently shut down the SQL instance, rlm_sql returns a fail, “SQL query error; rejecting user”, and FR subsequently sends a REJECT response to any NAS request it receives, which is not at all the behavior we’d like to see as it means that any NAS querying this particular FR node will deny all requests instead of retrying the request with another node. I’ve seen a post on this list by Alan DeKok suggesting that “fail = ok” (or = invalid or whatever we should use in this case) is proper unlang or at least was proper syntax back in 2007, but with FR 2.1 (the respective version packaged with Ubuntu 10.04 LTS and CentOS 6.5) I was unable to start FR with such a statement added in either the “authorize” or “post-auth” section, declaring “Unknown action 'invalid'” when parsing the config.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Respective thread which I hoped would give me some pointers:<o:p></o:p></p><p class=MsoPlainText><a href="http://lists.freeradius.org/pipermail/freeradius-users/2007-December/024055.html">http://lists.freeradius.org/pipermail/freeradius-users/2007-December/024055.html</a><o:p></o:p></p><p class=MsoPlainText>Reply by Alan DeKok which I went on to try, unsuccessfully, with the error message quoted above:<o:p></o:p></p><p class=MsoPlainText><a href="http://lists.freeradius.org/pipermail/freeradius-users/2007-December/024059.html">http://lists.freeradius.org/pipermail/freeradius-users/2007-December/024059.html</a><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Actually, FR's current behavior is a bit more irritating to us because we need to use a custom huntgroup SQL query that we placed in an "update request" section right before we (try to) query SQL for auth in the "authorize" section, but instead of two times "fail" we get two different error codes from the two statements when SQL is unavailable:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>- "++ [request] returns notfound"<o:p></o:p></p><p class=MsoPlainText>and later<o:p></o:p></p><p class=MsoPlainText>- " ++[sql_localhost] returns fail"<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Do we need to suppress / rewrite both of them? Suppressing the first one is impossible, I think, because in "update request" apparently FR doesn't differentiate between a query that was executed returned but returned an empty result, and a failed query (because SQL was unavailable). The invocation of sql_localhost, right below, does differentiate, as it returns fail instead of notfound.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>What is the proper way to allow the NAS clients to fail over to another FR node altogether instead of getting misleading and in most cases outright wrong information ("Invalid user" is what FR tells the NAS) from FR? Can we make FR just not reply to the request at all in these cases, or send a request that signals to the NAS that it should try the FR node next door instead because this FR node is unable to make any definitive statement?<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>And finally, we're forwarding exactly one particular realm to another RADIUS server outside of our administrative control, and while any information FR needs to be able identify these requests as "to-be-proxied" is configured in plaintext files and thus should continue to work if SQL fails, requests for this realm also fail as soon as we shut down SQL, because the explicit REJECT from SQL makes FR not even proxy the request to the home server before telling the NAS that the Login request should be denied.<o:p></o:p></p><p class=MsoPlainText>Why does FR try to run the query against SQL (i.e. its own authorize section) at all if it knows from config that it should simply forward the request (unmodified even, we don't use pre-proxy or post-proxy at all) and wait for the reply of the home server for this particular realm?<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>The last issue doesn't occur if we put a redundant {sql_localhost; handled} block instead of the single "sql_localhost" statement in the auth section, but I don't know WHY it works (it probably causes side effects we don't want), or rather, I figured that somehow the reseller request always gets checked against the local SQL database first (which it shouldn't or at least doesn't need to waste any CPU cycles on as it will never find anything in there about the reseller's customers), no matter whether the SQL connections works or doesn't work, but somehow a "notfound" from SQL leads FR to finally proxy the request to the reseller RADIUS server and get a proper answer, while a "fail" from SQL somehow skips the proxying step and outright denies the request. <o:p></o:p></p><p class=MsoPlainText>Obviously we don't want the proxy requests to ever get checked locally - this would solve this issue completely.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I've attached the configuration we use currently below - if you need radius -X output for a particular scenario, let me know. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>- Patrick Wagner<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>__________________________<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Configuration of the only sites-enabled/ site document:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>authorize {<o:p></o:p></p><p class=MsoPlainText> update request {<o:p></o:p></p><p class=MsoPlainText> Huntgroup-Name := "%{sql_localhost:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}"<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText> preprocess<o:p></o:p></p><p class=MsoPlainText> chap<o:p></o:p></p><p class=MsoPlainText> mschap<o:p></o:p></p><p class=MsoPlainText> realmraute # realms are differentiated by #suffix<o:p></o:p></p><p class=MsoPlainText> eap {<o:p></o:p></p><p class=MsoPlainText> ok = return<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> sql_localhost<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText># the following allows reseller requests to get proxied to the correct home server, but with unknown side effects<o:p></o:p></p><p class=MsoPlainText># redundant {<o:p></o:p></p><p class=MsoPlainText># sql_localhost<o:p></o:p></p><p class=MsoPlainText># handled<o:p></o:p></p><p class=MsoPlainText># }<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> expiration<o:p></o:p></p><p class=MsoPlainText> logintime<o:p></o:p></p><p class=MsoPlainText> pap<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>authenticate {<o:p></o:p></p><p class=MsoPlainText> Auth-Type PAP {<o:p></o:p></p><p class=MsoPlainText> pap<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText> Auth-Type CHAP {<o:p></o:p></p><p class=MsoPlainText> chap<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText> Auth-Type MS-CHAP {<o:p></o:p></p><p class=MsoPlainText> mschap<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText> unix<o:p></o:p></p><p class=MsoPlainText> eap<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>preacct {<o:p></o:p></p><p class=MsoPlainText> preprocess<o:p></o:p></p><p class=MsoPlainText> acct_unique<o:p></o:p></p><p class=MsoPlainText> realmraute<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>accounting {<o:p></o:p></p><p class=MsoPlainText> detail {<o:p></o:p></p><p class=MsoPlainText> fail = 1<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText> unix<o:p></o:p></p><p class=MsoPlainText> radutmp<o:p></o:p></p><p class=MsoPlainText> sql_localhost<o:p></o:p></p><p class=MsoPlainText> attr_filter.accounting_response<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>session {<o:p></o:p></p><p class=MsoPlainText> sql_localhost<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>post-auth {<o:p></o:p></p><p class=MsoPlainText> exec<o:p></o:p></p><p class=MsoPlainText> Post-Auth-Type REJECT {<o:p></o:p></p><p class=MsoPlainText> attr_filter.access_reject<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>pre-proxy {<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>post-proxy {<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>______________________<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Configuration of radiusd.conf:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>prefix = /usr<o:p></o:p></p><p class=MsoPlainText>exec_prefix = /usr<o:p></o:p></p><p class=MsoPlainText>sysconfdir = /etc<o:p></o:p></p><p class=MsoPlainText>localstatedir = /var<o:p></o:p></p><p class=MsoPlainText>sbindir = ${exec_prefix}/sbin<o:p></o:p></p><p class=MsoPlainText>logdir = /var/log/freeradius<o:p></o:p></p><p class=MsoPlainText>raddbdir = /etc/freeradius<o:p></o:p></p><p class=MsoPlainText>radacctdir = ${logdir}/radacct<o:p></o:p></p><p class=MsoPlainText>name = freeradius<o:p></o:p></p><p class=MsoPlainText>confdir = ${raddbdir}<o:p></o:p></p><p class=MsoPlainText>run_dir = ${localstatedir}/run/${name}<o:p></o:p></p><p class=MsoPlainText>db_dir = ${raddbdir}<o:p></o:p></p><p class=MsoPlainText>libdir = /usr/lib/freeradius<o:p></o:p></p><p class=MsoPlainText>pidfile = ${run_dir}/${name}.pid<o:p></o:p></p><p class=MsoPlainText>user = freerad<o:p></o:p></p><p class=MsoPlainText>group = freerad<o:p></o:p></p><p class=MsoPlainText>max_request_time = 30<o:p></o:p></p><p class=MsoPlainText>cleanup_delay = 5<o:p></o:p></p><p class=MsoPlainText>max_requests = 1024<o:p></o:p></p><p class=MsoPlainText>listen {<o:p></o:p></p><p class=MsoPlainText> type = auth<o:p></o:p></p><p class=MsoPlainText> ipaddr = 2.2.2.2<o:p></o:p></p><p class=MsoPlainText> port = 1645<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>listen {<o:p></o:p></p><p class=MsoPlainText> ipaddr = 2.2.2.2<o:p></o:p></p><p class=MsoPlainText> port = 1646<o:p></o:p></p><p class=MsoPlainText> type = acct<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>listen {<o:p></o:p></p><p class=MsoPlainText> ipaddr = 192.168.5.2<o:p></o:p></p><p class=MsoPlainText> port = 1645<o:p></o:p></p><p class=MsoPlainText> type = auth<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>listen {<o:p></o:p></p><p class=MsoPlainText> ipaddr = 192.168.5.2<o:p></o:p></p><p class=MsoPlainText> port = 1646<o:p></o:p></p><p class=MsoPlainText> type = acct<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>hostname_lookups = no<o:p></o:p></p><p class=MsoPlainText>allow_core_dumps = no<o:p></o:p></p><p class=MsoPlainText>regular_expressions = yes<o:p></o:p></p><p class=MsoPlainText>extended_expressions = yes<o:p></o:p></p><p class=MsoPlainText>log {<o:p></o:p></p><p class=MsoPlainText> destination = files<o:p></o:p></p><p class=MsoPlainText> file = ${logdir}/radius.log<o:p></o:p></p><p class=MsoPlainText> syslog_facility = daemon<o:p></o:p></p><p class=MsoPlainText> stripped_names = no<o:p></o:p></p><p class=MsoPlainText> auth = no<o:p></o:p></p><p class=MsoPlainText> auth_badpass = no<o:p></o:p></p><p class=MsoPlainText> auth_goodpass = no<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>checkrad = ${sbindir}/checkrad<o:p></o:p></p><p class=MsoPlainText>security {<o:p></o:p></p><p class=MsoPlainText> max_attributes = 200<o:p></o:p></p><p class=MsoPlainText> reject_delay = 1<o:p></o:p></p><p class=MsoPlainText> status_server = yes<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>proxy_requests = yes<o:p></o:p></p><p class=MsoPlainText>$INCLUDE proxy.conf<o:p></o:p></p><p class=MsoPlainText>thread pool {<o:p></o:p></p><p class=MsoPlainText> start_servers = 5<o:p></o:p></p><p class=MsoPlainText> max_servers = 50<o:p></o:p></p><p class=MsoPlainText> min_spare_servers = 3<o:p></o:p></p><p class=MsoPlainText> max_spare_servers = 10<o:p></o:p></p><p class=MsoPlainText> max_requests_per_server = 0<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>modules {<o:p></o:p></p><p class=MsoPlainText> $INCLUDE ${confdir}/modules/<o:p></o:p></p><p class=MsoPlainText> $INCLUDE eap.conf<o:p></o:p></p><p class=MsoPlainText> $INCLUDE sql_localhost.conf<o:p></o:p></p><p class=MsoPlainText> $INCLUDE sql/mysql/counter.conf<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>instantiate {<o:p></o:p></p><p class=MsoPlainText> exec<o:p></o:p></p><p class=MsoPlainText> expr<o:p></o:p></p><p class=MsoPlainText> expiration<o:p></o:p></p><p class=MsoPlainText> logintime<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>$INCLUDE policy.conf<o:p></o:p></p><p class=MsoPlainText>$INCLUDE sites-enabled/<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>_________________<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Configuration of proxy.conf:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>proxy server {<o:p></o:p></p><p class=MsoPlainText> synchronous = no<o:p></o:p></p><p class=MsoPlainText> retry_delay = 5<o:p></o:p></p><p class=MsoPlainText> retry_count = 3<o:p></o:p></p><p class=MsoPlainText> dead_time = 120<o:p></o:p></p><p class=MsoPlainText> default_fallback = no<o:p></o:p></p><p class=MsoPlainText> post_proxy_authorize = no<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>realm <a href="mailto:resrealm@domain.tld">resrealm@domain.tld</a> {<o:p></o:p></p><p class=MsoPlainText> type = radius<o:p></o:p></p><p class=MsoPlainText> authhost = 10.10.10.10:1645<o:p></o:p></p><p class=MsoPlainText> accthost = 10.10.10.10:1646<o:p></o:p></p><p class=MsoPlainText> secret = respw<o:p></o:p></p><p class=MsoPlainText> nostrip<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText>realm LOCAL {<o:p></o:p></p><p class=MsoPlainText> type = radius<o:p></o:p></p><p class=MsoPlainText> authhost = LOCAL<o:p></o:p></p><p class=MsoPlainText> accthost = LOCAL<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>