checkrad not called after upgrade to 2.x and virtual servers.
List, I have a fairly standard implementation other than a custom checkrad script and virtual servers. Today when debugging some simultaneous use issues I discovered that radiusd isn't calling checkrad and is logging this when I run in debug mode: checkrad: Unknown NAS x.x.x.x, not checking Because radius thinks it doesn't know about the nas it doesn't bother calling checkrad, however the nas is defined in the clients.conf: client x.x.x.x { secret = <secret> shortname = x.x.x.x password = <snmp ro key> nastype = cisco_snmp virtual_server = dsl } I couldn't find anything in the documentation that refers to a change in checkrad behavior when dealing with virtual servers, so I'm assuming that if the client is defined and the dsl virtual server can find it and authenticate customers against it then shouldn't the client.c code also find it and pass session and username to checkrad? Thanks, schu
Matthew Schumacher wrote:
I have a fairly standard implementation other than a custom checkrad script and virtual servers. Today when debugging some simultaneous use issues I discovered that radiusd isn't calling checkrad and is logging this when I run in debug mode:
checkrad: Unknown NAS x.x.x.x, not checking
Ah... the NAS isn't defined globally, so it isn't being used.
I couldn't find anything in the documentation that refers to a change in checkrad behavior when dealing with virtual servers, so I'm assuming that if the client is defined and the dsl virtual server can find it and authenticate customers against it then shouldn't the client.c code also find it and pass session and username to checkrad?
In theory, yes. The issue (IIRC) is that the client is either tied to a virtual server, or to a specific "listen" section. The API used by checkrad hasn't been updated to handle some of the new features, so the client isn't being found. Part of the issue is that in 2.0, the client can be defined *multiple* times, with *different* shared secrets. It can be difficult to say which one to use. If it's OK to find the client that is tied to the virtual server, that should be possible. Alan DeKok.
Alan DeKok wrote:
In theory, yes. The issue (IIRC) is that the client is either tied to a virtual server, or to a specific "listen" section. The API used by checkrad hasn't been updated to handle some of the new features, so the client isn't being found.
Part of the issue is that in 2.0, the client can be defined *multiple* times, with *different* shared secrets. It can be difficult to say which one to use.
If it's OK to find the client that is tied to the virtual server, that should be possible.
Alan DeKok.
Any thoughts on a workaround? I defined my nas a second time without the virtual server context and I get this in my debug: Failed to add duplicate client x.x.x.x /etc/freeradius/raddb/clients.conf[303]: Failed to add client x.x.x.x At this point I'm not sure how to get this working since it doesn't recognize the client when defined with a virtual server, nor will it allow me to define a second client in the global context. Thanks, schu
Matthew Schumacher wrote:
Any thoughts on a workaround? I defined my nas a second time without the virtual server context and I get this in my debug:
Failed to add duplicate client x.x.x.x /etc/freeradius/raddb/clients.conf[303]: Failed to add client x.x.x.x
That message occurs when you have two definitions for the same client.
At this point I'm not sure how to get this working since it doesn't recognize the client when defined with a virtual server, nor will it allow me to define a second client in the global context.
It *should* find the first, globally defined, client. I don't know why it wouldn't... Alan DeKok.
Alan DeKok wrote:
Matthew Schumacher wrote:
Any thoughts on a workaround? I defined my nas a second time without the virtual server context and I get this in my debug:
Failed to add duplicate client x.x.x.x /etc/freeradius/raddb/clients.conf[303]: Failed to add client x.x.x.x
That message occurs when you have two definitions for the same client.
At this point I'm not sure how to get this working since it doesn't recognize the client when defined with a virtual server, nor will it allow me to define a second client in the global context.
It *should* find the first, globally defined, client. I don't know why it wouldn't...
Can I put this in bugzilla? Seems like simultaneous use is completely broken in 2.x which is a fairly significant feature. Also, I have some code I can contribute if the project wants, it's a checkrad daemon that accepts connections from a small checkradc client written in c. Because checkradd.pl is always running the overhead to do an snmp lookup is significantly reduced. What would be even better is if radiusd directly connected to checkradd.pl which would eliminate the need for the small client. This code has been in prod for a very long time and is stable. schu
Matthew Schumacher wrote:
Can I put this in bugzilla? Seems like simultaneous use is completely broken in 2.x which is a fairly significant feature.
To me checkrad seems to be broken too. I'm using 2.0.5 without virtual servers. Checkrad says, my NAS is Unknown when it is invoked, although I have it in my clients.conf: client testerx { ipaddr = 212.x.x.x secret = xxxxxxx nastype = erx } radiusd -X [...] auth: user supplied User-Password matches local User-Password +- entering group session expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp expand: %{User-Name} -> smith checkrad: Unknown NAS 212.x.x.x, not checking ++[radutmp] returns ok Multiple logins (max 1) [MPP attempt]: [smith] (from client testerx port 1610612780 cli #erx705#E60#44) Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 88 to 212.x.x.x port 50000 Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" Finished request 2. [...] For our customers I have Simultaneous-Use := 1 in my users-file and checkrad is invoked, when a stale session in radutmp is found: # radwho -ir smith,04279558,PPP,S1610612780,Wed 12:2,212.x.x.x,x.x.x.x It is possible, that in 2.0.3 checkrad was ok, because I noticed no problems with Simultaneous-Use there ... but maybe accidentally. Is it really a bug in freeradius-2.0.5? oz
participants (3)
-
Alan DeKok -
Matthew Schumacher -
oz