April 2009 - Freeradius-Users - lists.freeradius.org

performance freeradius with psql (auth only)
by Uwe Kastens 23 Apr '09

23 Apr '09

Hi lists, I am just measuring (maybe more guessing) some performance figures. I started 3 radclients (1 on localhost, 2 on different remote hosts) with 12K different user and credentials. I am working with virtual hosts under XEN. I am just counting the logfile entries from logfile for Auth: Login entries. With a single radclient from a remote host its something between 10 to 15 auth per sec. With 3 radclients its something between 30 to 45 auth per sec. There is no change in that values, if I increase the max database connections. So I think it might be a problem, that there are not enough requests produced from the radclient(s) aprox 800 per minute. Could that be? Any other figures measured by someone? BR Uwe -- kiste lat: 54.322684, lon: 10.13586

3 4

failover and load balancing
by Kanwar Ranbir Sandhu 22 Apr '09

22 Apr '09

Hello Everyone, I'm stepping into the world of Freeradius for the first time - holy shit is there a lot to learn. Anyway, I've been wondering how many servers are required to have a proper (i.e. no single point of failure) on the freeradius side of things. I know that I can have one freeradius server proxying requests to any number of authorization and/or accounting servers - great. But, what if I don't want to proxy and only want two freeradius servers that do auth, and two separate servers for accounting? I can conceptualize a cluster or even simple fail over using heartbeat for the database bit. What I don't understand is how the failover and load balancing is done on the freeradius level (i.e. for auth) and still enter a single IP for freeradius on the NAS. Am I supposed to configure a virtual server on the first freeradius server, copy the config to the second machine, and then use that virtual server IP on the NAS? I don't get it. I must be missing something. Any help would be appreciated. Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 13:45:51 up 3 days, 13:42, 3 users, load average: 1.07, 0.61, 0.50

14 23

RE: Freeradius 2.1.5 and Solaris gmake install problem. (Solved)
by Ville Leinonen 22 Apr '09

22 Apr '09

Hi, I try to make "gmake clean" and try again. Now everything went fine. Maybe Moon is moving again for new position :) Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 20/04/2009 14:42 To: FreeRadius users mailing list Subject: Re: Freeradius 2.1.5 and Solaris gmake install problem. Ville Leinonen wrote: > Yes i go make "gmake" before 2gmake install" and i went fine. <shrug> It works for me on the Solaris Sparc / x86 boxes I have access to. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Releasing 2.1.5 or 2.1.6
by John Dennis 22 Apr '09

22 Apr '09

I'd like to package up the current release but I can't because the current tar files have version problems. What is currently on the download link is 2.1.4 but builds as 2.1.5. There have been two different versions of the 2.1.4 tar file. This means we can never release a 2.1.4 RPM because it's versioning is ambiguous. IMHO the 2.1.4 release should be considered defunct. There is a 2.1.5 trial version on the build server that I've lightly tested, perhaps others should as well. Can we move the next release forward to an official release so we can get a release out to supercede the current version, which to my thinking is 2.1.3 (because 2.1.4 is not identifiable). P.S.: We also need to be careful, if what becomes 2.1.5 is not identical to what's in the 2.1.4 tar file we should go to 2.1.6 because we won't be able to disambiguate between a 2.1.5 built from a 2.1.4 tar file and the actual 2.1.5 built from a 2.1.5 tar file. This means the next release should probably be 2.1.6 with 2.14 and 2.1.5 marked as suspect in the changelog. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 5

[OT (possibly)] problem with WinXP SP3 connecting, reconnecting
by Craig White 22 Apr '09

22 Apr '09

It's possible that this is my laptop that is causing this and not the Wireless AP or FreeRadius but I thought I would ask because my laptop doesn't do this on WPA-PSK on my home setup. Using Windows supplicant, clearly connects using PEAP and am given an IP address via LAN DHCP server. If I try to ping LAN devices, I get dropouts, perhaps as high as 100% but usally get at least 1 out of four, sometimes 3 out of 4 pings returned and frequently, the status try indicates reconnecting. I tried shutting off fast reconnect but it seems to not matter either way. I presume that this is somehow a problem between my Linksys Wireless AP and my laptop wireless (Atheros) and nothing at all to do with FreeRadius but I'm wondering if others have experienced this issue and might suggest something that I could try to remedy the problem. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: Exec-Program problem
by Nirmal 22 Apr '09

22 Apr '09

Thanks man, done. --- On Wed, 4/22/09, Alan DeKok <aland(a)deployingradius.com> wrote: From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Exec-Program problem To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, April 22, 2009, 5:25 PM Nirmal wrote: ... > Wed Apr 22 17:05:03 2009 : Debug: Exec-Program-Wait: plaintext: Wed Apr > 22 17:05:03 2009 : Error: Exec-Program: FAILED to execute > /etc/raddb/getmac: Exec format error ... > #/bin/bash You can't run that program from a shell prompt, either. You have a typo. It should be: #!/bin/bash Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Exec-Program problem
by Nirmal 22 Apr '09

22 Apr '09

Hi, I am running freeradius-server-2.1.1-7. +----+----------+-------------------+----+-------------------------+ | id | username | attribute | op | value | +----+----------+-------------------+----+-------------------------+ | 1 | spark | Exec-Program-Wait | := | /etc/raddb/getmac %u %i | +----+----------+-------------------+----+-------------------------+ radisud -XX -d /etc/raddb/ Wed Apr 22 17:05:03 2009 : Auth: Login OK: [spark] (from client localhost port 2 cli 00:19:D1:4A:53:F8) Wed Apr 22 17:05:03 2009 : Info: +- entering group post-auth {...} Wed Apr 22 17:05:03 2009 : Info: [exec] expand: %u -> spark Wed Apr 22 17:05:03 2009 : Info: [exec] expand: %i -> 00:19:D1:4A:53:F8 Wed Apr 22 17:05:03 2009 : Debug: Exec-Program output: Wed Apr 22 17:05:03 2009 : Error: Exec-Program: FAILED to execute /etc/raddb/getmac: Exec format error Wed Apr 22 17:05:03 2009 : Debug: Exec-Program-Wait: plaintext: Wed Apr 22 17:05:03 2009 : Error: Exec-Program: FAILED to execute /etc/raddb/getmac: Exec format error Wed Apr 22 17:05:03 2009 : Debug: Exec-Program: returned: 1 Wed Apr 22 17:05:03 2009 : Info: [exec] Login incorrect (external check said so) Wed Apr 22 17:05:03 2009 : Info: ++[exec] returns reject Wed Apr 22 17:05:03 2009 : Info: Delaying reject of request 1 for 1 seconds file /etc/raddb/getmac contains following with execute+radiusd permission #/bin/bash echo "$1 --- $2 ----- done" >> /etc/raddb/mac_entries What could be wrong? Nirmal Patel | Mumbai

2 1

Re: Exec-Program problem
by Nirmal 22 Apr '09

22 Apr '09

changed permission of /etc/raddb/mac_entries now getting wrong format error. Wed Apr 22 17:21:27 2009 : Auth: Login OK: [spark] (from client localhost port 0 cli 00:19:D1:4A:53:F8) Wed Apr 22 17:21:27 2009 : Info: +- entering group post-auth {...} Wed Apr 22 17:21:27 2009 : Info: [exec] expand: %u -> spark Wed Apr 22 17:21:27 2009 : Info: [exec] expand: %i -> 00:19:D1:4A:53:F8 Wed Apr 22 17:21:27 2009 : Debug: Exec-Program output: Wed Apr 22 17:21:27 2009 : Error: Exec-Program: FAILED to execute /etc/raddb/getmac: Exec format error Wed Apr 22 17:21:27 2009 : Debug: Exec-Program-Wait: plaintext: Wed Apr 22 17:21:27 2009 : Error: Exec-Program: FAILED to execute /etc/raddb/getmac: Exec format error Wed Apr 22 17:21:27 2009 : Debug: Exec-Program: returned: 1 in my previous version i was using the same format. +----+----------+-------------------+----+-------------------------+ | id | username | attribute | op | value | +----+----------+-------------------+----+-------------------------+ | 1 | spark | Exec-Program-Wait | := | /etc/raddb/getmac %u %i | +----+----------+-------------------+----+-------------------------+ where to check syntax for exec-program ? --- On Wed, 4/22/09, Nirmal <nirmal_909(a)yahoo.com> wrote: From: Nirmal <nirmal_909(a)yahoo.com> Subject: Exec-Program problem To: "freeradius users" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, April 22, 2009, 5:11 PM Hi, I am running freeradius-server-2.1.1-7. +----+----------+-------------------+----+-------------------------+ | id | username | attribute | op | value | +----+----------+-------------------+----+-------------------------+ | 1 | spark | Exec-Program-Wait | := | /etc/raddb/getmac %u %i | +----+----------+-------------------+----+-------------------------+ radisud -XX -d /etc/raddb/ Wed Apr 22 17:05:03 2009 : Auth: Login OK: [spark] (from client localhost port 2 cli 00:19:D1:4A:53:F8) Wed Apr 22 17:05:03 2009 : Info: +- entering group post-auth {...} Wed Apr 22 17:05:03 2009 : Info: [exec] expand: %u -> spark Wed Apr 22 17:05:03 2009 : Info: [exec] expand: %i -> 00:19:D1:4A:53:F8 Wed Apr 22 17:05:03 2009 : Debug: Exec-Program output: Wed Apr 22 17:05:03 2009 : Error: Exec-Program: FAILED to execute /etc/raddb/getmac: Exec format error Wed Apr 22 17:05:03 2009 : Debug: Exec-Program-Wait: plaintext: Wed Apr 22 17:05:03 2009 : Error: Exec-Program: FAILED to execute /etc/raddb/getmac: Exec format error Wed Apr 22 17:05:03 2009 : Debug: Exec-Program: returned: 1 Wed Apr 22 17:05:03 2009 : Info: [exec] Login incorrect (external check said so) Wed Apr 22 17:05:03 2009 : Info: ++[exec] returns reject Wed Apr 22 17:05:03 2009 : Info: Delaying reject of request 1 for 1 seconds file /etc/raddb/getmac contains following with execute+radiusd permission #/bin/bash echo "$1 --- $2 ----- done" >> /etc/raddb/mac_entries What could be wrong? Nirmal Patel | Mumbai -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Exec-Program-Wait problem
by enid 22 Apr '09

22 Apr '09

Hello all, I' running FreeRADIUS Version 2.1.5, and I'm trying to execute an external script when users authenticate. I have included the exec module. The script is executed in this form (in the users file): DEFAULT Simultaneous-Use := 1 Idle-Timeout = 600, Session-Timeout = 5400, Framed-IP-Address = 255.255.255.254, Framed-Compression = Van-Jacobson-TCP-IP, Exec-Program-Wait = "/etc/freeradius/somescript", Fall-Through = Yes but I want that the output of it to append to the AV pair reply that goes back to the client. So I have the problem that when the script is executed, its output doesn't append to the AV pair reply. (For example: Reply-Message=Email Only Account) I can post here my configuration files, if you tell me which. Thanks in advance ! -- View this message in context: http://www.nabble.com/Exec-Program-Wait-problem-tp23161038p23161038.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

sql.conf failover readclients=yes
by leopold 21 Apr '09

21 Apr '09

Recently in rel 2.1.4 you fixed and issue for replicated databases that allow readclients=yes option in sql.conf. This worked great if ALL databases are up and running. The issue happens if radiusd can't connect to a database and process cannot start even though it can read NAS info from sql2 if sql1 is down. Could you please check if you can still enable readclients=yes but allow radiusd to start if at least one of sql1 or sql2 is UP? Thanks for your reply. -- View this message in context: http://www.nabble.com/sql.conf-failover-readclients%3Dyes-tp23103617p231036… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5