problem with proxy and 2.0pre2
hi, I've been upgrading a few 1.1.7 boxes to 2.0pre2 due to now requiring the extensive new features and fixes ;-) anyway, i am facing an issue with proxying.... leaving the config pretty much as was the default I see the following with rlm_realm in the radiusd -X logging ++[auth_log] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "example.co.uk" for User-Name = "testuser@example.co.uk" rlm_realm: No such realm "example.co.uk" ...i have a DEFAULT entry realm in the proxy.conf - as before - but it is not being used or, it seems, detected. a NULL entry is happily used and my locally defined realms and LOCAL realm are also being used. I'll carry on digging to see if theres an assumption or peculiarity being made here. alan
A.L.M.Buxey@lboro.ac.uk wrote:
...i have a DEFAULT entry realm in the proxy.conf - as before - but it is not being used or, it seems, detected. a NULL entry is happily used and my locally defined realms and LOCAL realm are also being used.
It may not be working right. See src/main/realms.c, function home_server_ldb(). It SHOULD look for DEFAULT. But it isn't well tested. And in any case, the "ignore_default" and "ignore_null" configurations in the "realms" module are evil. They SHOULD be removed ASAP. The new "unlang" features can be used to do the same thing, in a much more configurable and understandable way. Alan DeKok.
Hi,
It may not be working right.
See src/main/realms.c, function home_server_ldb(). It SHOULD look for DEFAULT. But it isn't well tested.
aha. thanks for the feedback. i also see another issue. if i have a few servers defined in a pool, then i am given the 'already exists' error and the server wont start eg test_config { server0 = radius1.our.tld server1 = radius2.our.tld secret0 = monkey_heaven secret1 = iguana_depot } server_pool testing { home_server = test0 home_server = test1 } home_server test0 { hostname = ${test_config.server0} secret = ${test_config.secret0} port = 1812 type = auth+acct nostrip } home_server test1 { hostname = ${test_config.server1} secret = ${test_config.secret1} port = 1812 type = auth+acct nostrip } the server complains that test0 already exists when loading in test1 i also note another pseudo-issue. the example proxy.conf supplied comes with the last few lines.... # # This realm is for requests which don't have an explicit realm # prefix or suffix. User names like "bob" will match this one. # #realm NULL { # type = radius # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 # secret = testing123 #} # # This realm is for ALL OTHER requests. # #realm DEFAULT { # type = radius # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 # secret = testing123 #} however, 'type = radius' is now defunt - and the server doesnt like it at all. acct+auth is the correct and only alternative, yes? alan
A.L.M.Buxey@lboro.ac.uk wrote:
aha. thanks for the feedback. i also see another issue. if i have a few servers defined in a pool, then i am given the 'already exists' error and the server wont start eg ... home_server test0 { hostname = ${test_config.server0}
Errr... the "hostname" parsing stuff isn't done yet. Use IP addresses. The larger problem is "what do you mean by a hostname"? In many cases, there will be one IPv4/v6 address for a hostname. If there is more than one...
i also note another pseudo-issue. the example proxy.conf supplied comes with the last few lines.... .... #realm NULL { # type = radius ... however, 'type = radius' is now defunt - and the server doesnt like it at all. acct+auth is the correct and only alternative, yes?
The "type" in 1.1.x didn't do anything, and was there just for show. I don't think it's necessary at all here. i.e. just delete it, and the server should work. That's how I do my testing... Alan DeKok.
Alan DeKok wrote:
A.L.M.Buxey@lboro.ac.uk wrote:
aha. thanks for the feedback. i also see another issue. if i have a few servers defined in a pool, then i am given the 'already exists' error and the server wont start eg
...
home_server test0 { hostname = ${test_config.server0}
Errr... the "hostname" parsing stuff isn't done yet. Use IP addresses.
home_server test0 { ipaddr = my.domain.ac.uk works though :)
The larger problem is "what do you mean by a hostname"? In many cases, there will be one IPv4/v6 address for a hostname. If there is more than one...
Expand the address record into multiple home servers, each deriving their secrets/ports from the original. Then if the original home server is referenced in a pool, add all the other ones associated with it... That way stuff like client balance would still work.
i also note another pseudo-issue. the example proxy.conf supplied comes with the last few lines....
....
#realm NULL { # type = radius
...
however, 'type = radius' is now defunt - and the server doesnt like it at all. acct+auth is the correct and only alternative, yes?
Yes, acct+auth means that account packets will go out on the defined port + 1. Saves having to duplicate home servers for acct+auth.
The "type" in 1.1.x didn't do anything, and was there just for show. I don't think it's necessary at all here.
Erm ... above feature needs it ?
i.e. just delete it, and the server should work. That's how I do my testing...
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Arran
Arran Cudbard-Bell wrote:
home_server test0 { ipaddr = my.domain.ac.uk
works though :)
Great. I'll delete the "hostname" configuration entry.
The larger problem is "what do you mean by a hostname"? In many cases, there will be one IPv4/v6 address for a hostname. If there is more than one...
Expand the address record into multiple home servers, each deriving their secrets/ports from the original.
Then if the original home server is referenced in a pool, add all the other ones associated with it...
I'd add that only as a special option, I think. Such behavior may be surprising..
The "type" in 1.1.x didn't do anything, and was there just for show. I don't think it's necessary at all here.
Erm ... above feature needs it ?
"type" is needed in the "realms" structure for NEW style realms. The example uses "type = radius" for OLD style realms. It's not necessary for those realms, as it was never used. And "type = radius" is not valid for new style realms. So that entry in the examples isn't necessary, and can be deleted. Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell