September 2009 - Freeradius-Users - lists.freeradius.org

RE: Accounting doesn't increase Daily's count.
by Pablo Zanitti 23 Sep '09

23 Sep '09

My bad, this is it refusing to update: rad_recv: Accounting-Request packet from host 192.168.63.1:15138, id=249, length=196 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" Acct-Status-Type = Stop Acct-Session-Time = 100 Acct-Authentic = RADIUS Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Acct-Session-Id = "01e56ba6b4be990c" Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Acct-Input-Packets = 25 Acct-Input-Octets = 1888 Acct-Input-Gigawords = 0 Acct-Output-Packets = 29 Acct-Output-Octets = 39478 Acct-Output-Gigawords = 0 Acct-Session-Time = 100 Acct-Terminate-Cause = NAS-Request Processing the preacct section of radiusd.conf modcall: entering group preacct for request 5 modcall[preacct]: module "preprocess" returns noop for request 5 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.63.1,NAS-IP-Address = 192.168.11.146,Acct-Session-Id = "01e56ba6b4be990c",User-Name = "Prueba3"' rlm_acct_unique: Acct-Unique-Session-ID = "c968f78b6779a240". modcall[preacct]: module "acct_unique" returns ok for request 5 modcall[preacct]: module "files" returns noop for request 5 modcall: leaving group preacct (returns ok) for request 5 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 5 radius_xlat: '/var/log/radacct/192.168.63.1/detail-20090923' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.63.1/detail-20090923 modcall[accounting]: module "detail" returns ok for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "daily" returns noop for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "weekly" returns noop for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "monthly" returns noop for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "forever" returns noop for request 5 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' rlm_radutmp: Logout for NAS 192.168.11.146 port 0, but no Login record modcall[accounting]: module "radutmp" returns ok for request 5 modcall: leaving group accounting (returns ok) for request 5 Sending Accounting-Response of id 249 to 192.168.63.1 port 15138 Finished request 5

1 0

Problem with proxying accounting packets on FR 2.1.3
by Patric 23 Sep '09

23 Sep '09

Hi all, I hope I can explain this clearly and concisely :) I have 2 freeradius servers: Primary: freeradius 1.1.6 (I know, its old, busy trying to get issues resolved so that I can update...) Secondary: freeradius 2.1.3 I have radrelay proxying accounting packets from the primary to the secondary which appears to be working fine. I am trying to get the secondary to proxy accounting requests to the primary as well, but there seems to be some trouble. It *appears* that the secondary is receiving proxy updates from the primary, applying them, and then proxying them back to the primary. I eventually noticed that the secondary is not adding the Client-IP-Address to incoming requests (I found the posts in the archive mentioning that this is normal and is no longer done in FR2). So I suspect the primary is sending the update to the secondary, the secondary is applying it and sending it back instead of stopping there. My question is: How do I get the secondary to realize it must not send the proxied request back again. I include my secondary config in case ive munged it somewhere. Any pointers would be very much appreciated! Freeradius 2.1.3 radiusd.conf ------------ proxy_requests = yes $INCLUDE proxy.conf proxy.conf ---------- proxy server { default_fallback = no } home_server copy-acct-to-home-server { type = acct ipaddr = ip_of_primary_server port = 1813 secret = shared_secret response_window = 20 zombie_period = 40 revive_interval = 120 } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } sites-enabled/default --------------------- authorize { preprocess files exec-radauth # custom authorization... } authenticate { } preacct { preprocess acct_unique } accounting { detail detail-radrelay sql } pre-proxy { } post-proxy { } sites-enabled/copy-acct-to-home-server -------------------------------------- server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-combined load_factor = 10 } preacct { suffix } accounting { ok } I have tried include all relevant info but please advise if anything further is required. Many many thanks as always Patric

2 2

Munin Plugins
by Neville 23 Sep '09

23 Sep '09

Hi everyone, This is not directly FreeRadius related, but I would really appreciate if anyone share any munin plugins that would monitoring number of users connected during the day or anything else worth monitoring. I've googled and can only find ones for login attempts by parsing the radius.log. I'm currently using MYSQL to store the current open connections and get retrieve the current connections by doing... SELECT COUNT(*) FROM radacct WHERE (radacct.AcctStopTime IS NULL OR radacct.AcctStopTime = '0000-00-00 00:00:00'); Apologies if anyone feels offend by me posting to the list for such a basic request. Thx Nev

2 1

radwho doesn't work
by José Johnny RANDRIAMAMPIONONA 22 Sep '09

22 Sep '09

Hi all, Systems: CentOs v5.3, FreeRadius-server-2.1.6 + Openldap ---------------------------------------------------------------------------------------------------- I d like to know who are logged on(uid, duration ...) so I did radwho but it said that the radutmp file is not found ... radwho: Error reading /usr/local/freeradius-server-2.1.6/var/log/radius/radutmp: No such file or directory Can anyone help me?I checked in the indicated directory and it was right (anyway, it's temporary file) Best regards! -- JJohnny RANDRIAMAMPIONONA Phone: +212663682554, +212533158575 National School of Applied Sciences ZIP 1818 TANGIER 90000 ---------Morocco ---------------

1 0

EAP-TLS:Error: rlm_eap: Failed to store handler
by leopold 22 Sep '09

22 Sep '09

We are using 2.1.4 version and sometimes we see the following error Wed Sep 16 11:21:01 2009 : Error: rlm_eap: Failed to store handler This error is very difficult to reproduce, but if the server goes into this mode it starts randomly rejecting some users and accepting others. Many users get rejected with the same error message The only way now is to restart server and then it works fine. Could there be some kind of rbtree corruption or there is a way to explain this when EAP session is already in the tree and client retries or for some reason sends message twice the server finds the session based on STATE variable in the tree and prints this message? This would be okay if one client gets rejected is supplicant misbehaves and sends duplicate requests, but many clients get the same failure. Are there any code fixes from 2.1.4 and 2.1.7 that fix exact same problem? Thank you for your reply. -- View this message in context: http://www.nabble.com/EAP-TLS%3AError%3A-rlm_eap%3A-Failed-to-store-handler… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

[freeradius-users] Freeradius exiting normally
by Vincent Arniego 22 Sep '09

22 Sep '09

Hi Everyone! My radius server suddenly logs "Exiting normally" while the process is still up. Though it looks like the process is already a zombie as it does not reply. I'm using freeradius 2.1.5 and using a perl-module that connects to ldap. The server specs are as follows: Linux RHEL 5 kernel 2.6.18 x86_64 ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited max nice (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 71680 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 max rt priority (-r) 0 stack size (kbytes, -s) 10240 cpu time (seconds, -t) unlimited max user processes (-u) 71680 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited installed freeradius from source. and using syslog for logging (configured in radius) Just for additional info, I'm using daemontools to up the process and uses this as the commandline : /usr/local/sbin/radiusd -sfx and this are the last entries in the radiusd.log file. Sep 20 09:35:46 radiusprod radiusd[28724]: rlm_perl: Added pair Reply-Message = Access-Accept Sep 20 09:35:46 radiusprod radiusd[28724]: rlm_perl: Added pair Service-Type = Framed Sep 20 09:35:46 radiusprod radiusd[28724]: rlm_perl: Added pair Auth-Type = perl Sep 20 09:35:46 radiusprod radiusd[28724]: Waking up in 1.9 seconds. Sep 20 09:35:46 radiusprod radiusd[28724]: Waking up in 1.6 seconds. Sep 20 09:35:46 radiusprod radiusd[28724]: Waking up in 1.6 seconds. Sep 20 09:35:48 radiusprod radiusd[28724]: Ready to process requests. Sep 20 09:36:09 radiusprod last message repeated 14 times Sep 20 09:36:09 radiusprod radiusd[28724]: Exiting normally. Any help is most appreciated thanks!

2 1

MS-CHAP Authentication / Bug 17
by Garber, Neal 21 Sep '09

21 Sep '09

I've been running 2.1.6 in Production with the patch from Bug 17, for a month, and everything has been working fine. As a reminder, this patch corrects a bug in MS-CHAP with the calculation of the MS-CHAPv1 challenge passed to ntlm_auth. It causes inappropriate Logon Failure errors, in certain circumstances having to do with the case of the userid and the logon method (see the bug report and previous posts for more details if you didn't follow the thread). Others have reported this problem in the past and the workaround has been to create all users in a specific case and force the userid to the same case in FR. (I'd really like to see this fix incorporated in the code, as other RADIUS servers don't have this userid case-sensitivity issue and this gives people an opportunity to cast stones at FR.) Arran: You seemed a bit interested in this patch - have you had the time/desire to apply and test it? If anyone else has some time to apply and test the patch, it is very much appreciated. Thanks in advance for your assistance and feedback..

3 9

h323-class
by Sokvantha YOUK 21 Sep '09

21 Sep '09

Dear All, I got this error in my radius server. I could not understand about this error. Please help me to get this problem fixed. Error: Mon Sep 21 21:11:58 2009 : Error: rlm_sql: Failed to create the pair: Unknown attribute "h323-class" -- Best Regards, YOUK Sokvantha Tell: (855) 89896589 email: sokvantha(a)gmail.com

1 0

Re: dialup-admin problem
by Franz X. Maier 21 Sep '09

21 Sep '09

I have the same problem: installed freeradius on Suse Linux 11.2 and got the dialupadmin partially working, but the web-interface only shows the dialup-admin Page with no main menu on the left side - only white. I get no errors in the logs, but I also had to remove the two lines >> # Scott Added for freeradius dialup-admin >> #LoadModule php4_module libexec/libphp4.so >> #AddModule mod_php4.c or it didn't work at all. Any help? Franz X. Maier IT-Berater Promenadegasse 11-13/2/1 1170 Wien Tel.: 01-8904222 Mobil: 0664-1004513 eMail: franz.x.maier(a)inode.at Mobile eMail: franzxmaier(a)mobileemail.vodafone.at

1 0

Redundant SQL
by Garber, Neal 21 Sep '09

21 Sep '09

I would like to have redundant SQL modules (that point to 2 different databases that are kept in sync using SQL replication) for the purpose of reading clients at startup and for the dynamic_clients virtual server. I don't use SQL for any other purpose. I've tried some things and done some searching and, so far, I haven't gotten anything to work. (I do have readclients=yes, dynamic_clients and Huntgrouop-Name lookup working for one SQL server and I believe I know how to get dynamic Huntgroup-Name working for more than one SQL server using unlang, but I'd like readclients/dynamic_clients to try a 2nd server if the first fails.) Is this possible without code changes?

4 7