July 2009 - Freeradius-Users - lists.freeradius.org

RE: Accounting redundancy problem
by Antoine.Jean-Toussaint＠bull.net 20 Jul '09

20 Jul '09

First of all, thank you for your quick answer. I just had a look at "buffered-sql virtual server" and it seems to be a solution. Anyway, I would really prefer to find out the way to tell the freeradius to stop waiting for the database and keeping my current configuration. Indeed, I have already configured the server and did some scripts in order to handle backup of accounting information. Right now my solution's philosophy is: log to database and alternatively to sql_log file with some automatic scripts which regularly check the sql_log file and database status to insert backup sql requests within. I would like to take advantage of the previous effort if possible. Antoine -----Message d'origine----- De : freeradius-users-bounces+antoine.jean-toussaint=bull.net(a)lists.freeradius. org [mailto:freeradius-users-bounces+antoine.jean-toussaint=bull.net@lists.fre eradius.org] De la part de Ivan Kalik Envoyé : lundi 20 juillet 2009 15:49 À : FreeRadius users mailing list Objet : Re: Accounting redundancy problem > I'm running Freeradius Version 2.0.4 with sql_postgres and sql_log > modules. > > Through the redundant module I can use a postgres database (on a remote > server) as a primary destination of my accounting messages and a sql_relay > file as an alternative in case of my database failure. > > > > Almost, everything works fine, meaning that if I stop the postgres process > on my remote server, freeradius try to send accounting messages to it and > as it receive messages from the server telling that the connection is > refused, freeradius logs accounting sql request into the sql_relay file. > > > > Now here's my problem: If I shutdown the server which host the postgres > database, freeradius try to send request to it and as there's no answer > from the server Freeradius doesn't pass through the SQL request through > the sql_log module. It keeps on waiting for an answer infinitely. > > > > When I launch freeradius whith the "freeradius -X" command, I can see the > following message: Error: rlm_sql (sql_TMS): Failed to connect DB handle > #0 > > > > It's very annoying because my backup solution doesn't handle the database > server unavailability! > > > > NB: I tried to use the "connect_failure_retry_delay" directive within the > rlm_sql_postgres module but this has no effect! Have a look at buffered-sql virtual server. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Accounting redundancy problem
by Antoine.Jean-Toussaint＠bull.net 20 Jul '09

20 Jul '09

Hi, I deal with a problem that I would need some help to solve. I'm running Freeradius Version 2.0.4 with sql_postgres and sql_log modules. Through the redundant module I can use a postgres database (on a remote server) as a primary destination of my accounting messages and a sql_relay file as an alternative in case of my database failure. Almost, everything works fine, meaning that if I stop the postgres process on my remote server, freeradius try to send accounting messages to it and as it receive messages from the server telling that the connection is refused, freeradius logs accounting sql request into the sql_relay file. Now here's my problem: If I shutdown the server which host the postgres database, freeradius try to send request to it and as there's no answer from the server Freeradius doesn't pass through the SQL request through the sql_log module. It keeps on waiting for an answer infinitely. When I launch freeradius whith the "freeradius -X" command, I can see the following message: Error: rlm_sql (sql_TMS): Failed to connect DB handle #0 It's very annoying because my backup solution doesn't handle the database server unavailability! NB: I tried to use the "connect_failure_retry_delay" directive within the rlm_sql_postgres module but this has no effect! I would really appreciate any help about this problem. Antoine JEAN-TOUSSAINT Network & Security Architect

2 1

White papers: Scaling FreeRADIUS & MySQL
by Alan DeKok 20 Jul '09

20 Jul '09

We have worked with MySQL to create two white papers on MySQL scalability and MySQL cluster. They are now available: 1) Delivering Scalable & Highly Available AAA Services This white paper discusses the concepts of current data storage solutions for Authentication, Authorization and Accounting (AAA) environments and their potential limitations as network use grows and services become more dynamic. The paper then presents an alternative deployment scenario based on the FreeRADIUS Server and MySQL Cluster serving as the back-end AAA database, providing an infrastructure for high growth and availability, with low complexity. A sizing study and user case study are presented to demonstrate how the solution performs in real-world FreeRADIUS environments Read the whitepaper, posted here: http://www.mysql.com/why-mysql/white-papers/mysql_wp_ha_auth_account.php 2) Deployment Guide: FreeRADIUS with the MySQL Cluster Database This Guide documents a best-practice approach to configuring and testing a FreeRADIUS server deployed with the MySQL Cluster database storage engine serving as the back-end data store for user and accounting data. Deployment topologies and configurations are presented, enabling users to quickly and simply replicate the solution in their own environment. Read the guide, posted here: http://www.mysql.com/why-mysql/white-papers/mysql_wp_deploying_FreeRADIUS.p…

3 2

huntgroup as an unlang check?
by A.L.M.Buxey＠lboro.ac.uk 20 Jul '09

20 Jul '09

hi, i've got a few virtual hosts that do checks on the NAS-IP-Address - all works fine - but those lists of NAS are now growing so in order to maintain sanity I thought 'heck, lets use a Huntgroup' however, I recall hu8ntgroups being very much tied to users and wasnt sure of their status in unlang. if i have raddb/hntgroups alphen NAS-IP-Address == 192.168.2.5 alphen NAS-IP-Address == 192.168.2.6 alphen NAS-IP-Address == 192.168.2.7 and, in the virtual host i have if("%{HuntGroup}" == "alphen"){ sql ok = return } would this work as expected with unlang and this variable? ie would the SQL only be hit if the NAS was 192.168.2.5, 192.168.2.6 or 192.168.2.7 - which in theory it looks like? alan

2 1

rlm_eap_md5: Cleartext-Password is required for EAP-MD5authentication
by youler 20 Jul '09

20 Jul '09

My running environment is freeraius-2.1.3，The authentication type is EAP/MD5. It's running not well with individual 'user' file.I can't find the problem. My mainly configuration file as follow: IN sites-enabled/default ---------------------- authorize { eap { ok = return } files #sql expiration logintime } authenticate { eap } IN eap.conf ---------------------- eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no max_sessions = 2048 md5 { } } IN users ------------------------ chenyongle Cleartext-Password := "123456" ------------------------------------------ debug information as following: rad_recv: Access-Request packet from host 127.0.0.1 port 43289, id=134, length=260 EAP-Message = 0x0285002004108010475cd7f849537fae81777bc3287f6368656e796f6e676c65 User-Name = "chenyongle@localhost" Prompt = 0x313233343536 Service-Type = Framed-User Framed-MTU = 1400 State = 0xa554770ea5d17374eb266130b8a3c5d8 Message-Authenticator = 0xd3f3ddc1a6813a6862213b0e5bc2fc02 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "localhost" for User-Name = "chenyongle@localhost" [suffix] No such realm "localhost" ++[suffix] returns noop ++[files] returns noop [eap] EAP packet type response id 133 length 32 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chenyongle@localhost attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 43289, id=134, length=260 Waiting to send Access-Reject to client localhost port 43289 - ID: 134 Sending delayed reject for request 1 Sending Access-Reject of id 134 to 127.0.0.1 port 43289 EAP-Message = 0x04850004 Message-Authenticator = 0x00000000000000000000000000000000 -- View this message in context: http://www.nabble.com/rlm_eap_md5%3A-Cleartext-Password-is-required-for-EAP… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Accounting of Radius server for NMS applications
by Parashar Singh 20 Jul '09

20 Jul '09

I am using Free Radius in linux, and LDAP as directory server. I am able to perform Authorization, Authentication & Accounting for Cisco Swithches, Routes an APs. In that cases all accounting data are stored in /var/log/radius/radacct folder. In addition I have configure many NMS & EMS applications for radius authentication. For example CiscoWorks LMS, IPS Tipping Point etc. They are performing authentication and the logs are visible in /var/log/radius/radius.log file. But there is no accounting data for all these. Can anyone please suggest me how to reconfigure Radius or Applications so that all accounting data may be available for these applications as well. The type of log generated agaist these are given below: Sat Jul 18 12:59:06 2009 : Auth: Login OK: [admin] (from client private-network- 1 port 0) Sat Jul 18 13:12:37 2009 : Auth: Login OK: [kmcsms] (from client private-network -1 port 0)

3 2

how to add new modules(like java) to freeradius
by shivashankar 20 Jul '09

20 Jul '09

hi all, how to add new modules(like java) to freeradius2.1.6 with simple java module . plz help me out. thax for advace -- View this message in context: http://www.nabble.com/how-to-add-new-modules%28like-java%29-to-freeradius-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

A small gift for you.
by Sunkara Ravi Prakash 19 Jul '09

19 Jul '09

1 0

mysql.sql
by Eric 19 Jul '09

19 Jul '09

I want to create radius tables but mysql.sql file isn't in my system. How should I find it?

3 2

Invalid Operator on 64bit Systems (amd64)
by Bernd Strehhuber 18 Jul '09

18 Jul '09

Hi, just found a weird behavior on 64bit Systems (Ubuntu 8.04 LTS amd64) with freeradius 1.1.7 (Dist Package 1.1.7-1build4). I created a setup with Validity Ranges for usernames and/or realms (Data is stored in a mysql Database): - for the realm - | id | Realm | Attribute | op | Value | Type | | 178 | test | group-validity | <= | 1388534400 | RadiusCheck | | 177 | test | group-validity | >= | 1143849600 | RadiusCheck | - for the user - | id | User | Realm | Attribute | op | Value | Type | | 201 | user | test | account-validity | >= | 1226448000 | RadiusCheck | | 202 | user | test | account-validity | <= | 1860105600 | RadiusCheck | freeradius on amd64 refuses to accept my access request to the user user@test: Sat Jul 18 12:19:55 2009 : Error: Invalid operator for item account-validity: reverting to '==' Sat Jul 18 12:19:55 2009 : Auth: Login incorrect: [user@test] (from client local port 0) If I delete the validity for the username, a access request is still refused: Sat Jul 18 12:23:03 2009 : Error: Invalid operator for item group-validity: reverting to '==' Sat Jul 18 12:23:03 2009 : Auth: Login incorrect: [user@test] (from client local port 0) If I delete the validity for the realm too, everything is ok: Sat Jul 18 12:25:28 2009 : Auth: Login OK: [user@test] (from client local port 0) I found a question about Expiration/rlm_sql bug in 64-bit architecture here on the List dated two years ago. But no solution for the problem. So it might be a problem on 64bit Systems. I checked that with a fresh install of Ubuntu 8.04 LTS i386 (32bit) and freeradius also in Version 1.1.7 (same Dist Package Version 1.1.7-1build4), but as i386 Package of course. Config is the same as on the 64bit System (also with mysql as storage for the user credentials). The result is, that on 32bit Ubuntu, a access request is accepted, and account/group validity is checked correctly: Sat Jul 18 12:36:29 2009 : Auth: Login OK: [user@test] (from client local port 0) The question is now, what can be done to get the Operators "<=" and ">=" working with freeradius 1.1.7 on amd64 Systems? TIA Bernd

2 1