June 2010 - Freeradius-Users - lists.freeradius.org

Use rlm_ldap reply for the next authorization module
by JUND, Aurélien 16 Jun '10

16 Jun '10

Hello, In order to allow a user to access the service (send a Access-Accept) I need to validate several things: First the password must be OK: * The User-name and password are stored in cleartext in a ldap (I use Chap), I must get another ldap attribute wich specify the crm Id matching the username. The user must be allowed to use the service: * Daily I get a files matching a crm Id and a status (can access, cant access) => I can't have a matching between user-name / Status. The crm don't know the user-name, and the ldap don't know the client's status (only the Crm ID) I have no trouble to check the User-Name/Password using ldap and chap modules. But I can't figure out how to use the ldap reply to request the local mysql where is store the match between crm Id and status. I don't know how to use a reply of a authorization module (ldap) in an another one (sql). Since I didn't find out how to do this, I tried to add the crmID in a unused radius attribute: Callback-Number: In the ldap attrmap configuration file I added: replyItem Callback-Number SFRrelationLoginService And in the sql configuration: sql_user_name = "%{Callback-Number}" Unfortunately as expected the replyItem is only add when the reply is generate. I also tried with a checkItem without more success... Is it possible to configure the ldap module in order to store a ldapattribute in a variable usable by the mysql module ? Or to replace/add a radius attribute in the request, base on the ldap reply before the next module is compute? Examples : Goal case: echo "User-Name= toto,Chap-Password=111111", | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 202 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0xcab5c3da9c9ebb891608c1991c2e37bea3 rad_recv: Access-Reject packet from host 172.16.0.135 port 1812, id=202, length=20 log: Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> '' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User not found Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[scratchcounter_lyo] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[reply_log] returns ok Test addin the crmId in the request before computing => not possible in real situation, but to test everything else echo "User-Name= toto,Chap-Password=111111",Callback-Number='siebelsIdFortoto' | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 159 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0x9fb08ff7f454d0c9998fc5dd72479940cd Callback-Number = "siebelsIdFortoto" rad_recv: Access-Accept packet from host 172.16.0.135 port 1812, id=159, length=20 log: Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 got semaphore Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 handling request 0, (1 handled so far) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group authorize {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[preprocess] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[mschap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No '/' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[IPASS] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No '@' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[suffix] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[files] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] performing user authorization for toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{Stripped-User-Name} -> Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{User-Name} -> toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: (USERlogin=%{%{Stripped-User-Name}:-%{User-Name}}*) -> (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: ou=EndUser,dc=USER,dc=fr -> ou=EndUser,dc=USER,dc=fr Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Checking Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Got Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: attempting LDAP reconnection Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: (re)connect to 10.33.245.241:389, authentication 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: bind as cn=Radius Gp,ou=Application,dc=USER,dc=fr/radiusgp to 10.33.245.241:389 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Threads: total/active/spare threads = 5/1/4 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> siebelsIdFortoto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> 'siebelsIdFortoto' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = 'siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '=siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User siebelsIdFortoto not found Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} JJun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Finished request 0. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Going to the next request Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 waiting to be assigned a request Jun 16 12:33:30 radius-wifi1-aub freeradius[7106]: Waking up in 4.0 seconds. Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Cleaning up request 0 ID 159 with timestamp +4 Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Ready to process requests.

2 1

Getting PAP to work with ntlm_auth
by Neil Prockter 16 Jun '10

16 Jun '10

Hello I want to authenticate users against Active Directory for EAP-MSCHAPv2 and PAP. PAP is for a wireless web authentication redirection service that authenticates using PAP and its PAP I'm trying to debug not MSCHAP at present. I've been following http://deployingradius.com/documents/configuration/active_directory.html All goes well until I get towards the end. Once I remove DEFAULT Auth-Type = ntlm_auth from users PAP stops working where do I add the configuration to allow PAP to continue with ntlm_auth rather than just failing? with the setting I get success Info: +- entering group authorize {...} Info: ++[preprocess] returns ok Info: ++[chap] returns noop Info: ++[mschap] returns noop Info: [suffix] No '@' in User-Name = "np", looking up realm NULL Info: [suffix] No such realm "NULL" Info: ++[suffix] returns noop Info: [eap] No EAP-Message, not doing EAP Info: ++[eap] returns noop Info: ++[unix] returns notfound Info: [files] users: Matched entry DEFAULT at line 1 Info: ++[files] returns ok Info: ++[expiration] returns noop Info: ++[logintime] returns noop Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Info: ++[pap] returns noop Info: Found Auth-Type = ntlm_auth Info: +- entering group authenticate {...} Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=ID Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=SECRET Debug: Exec-Program output: NT_STATUS_OK: Success (0x0) Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Debug: Exec-Program: returned: 0 Info: ++[ntlm_auth] returns ok Info: +- entering group post-auth {...} Info: ++[exec] returns noop Sending Access-Accept of id 243 to 158.143.207.212 port 42687 without it no ntlm is attempted Info: +- entering group authorize {...} Info: ++[preprocess] returns ok Info: ++[chap] returns noop Info: ++[mschap] returns noop Info: [suffix] No '@' in User-Name = "np", looking up realm NULL Info: [suffix] No such realm "NULL" Info: ++[suffix] returns noop Info: [eap] No EAP-Message, not doing EAP Info: ++[eap] returns noop Info: ++[unix] returns notfound Info: ++[files] returns noop Info: ++[expiration] returns noop Info: ++[logintime] returns noop Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Info: ++[pap] returns noop Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Info: Failed to authenticate the user. Info: Using Post-Auth-Type Reject Info: +- entering group REJECT {...} Info: [attr_filter.access_reject] expand: %{User-Name} -> ID Debug: attr_filter: Matched entry DEFAULT at line 11 Info: ++[attr_filter.access_reject] returns updated Info: Delaying reject of request 0 for 1 seconds Debug: Going to the next request Debug: Waking up in 0.9 seconds. Info: Sending delayed reject for request 0 Sending Access-Reject of id 7 to 158.143.207.212 port 53676 TIA, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

2 2

(no subject)
by Jasenko Sehanovic 16 Jun '10

16 Jun '10

Jasenko Sehanovic |t: + 387 33 768 000|f: + 387 33 768 001|m: + 387 61 103 444 Teleinformatica doo, Tvornička 3, 71000 Sarajevo, Bosnia and Herzegovina -- cid:part1.05030807.04020006@teleinformatica.ba

1 0

Re: Virtual server specific SQL schema.
by Stephen Fulton 16 Jun '10

16 Jun '10

Hi Stefan, Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements. -- Stephen On 6/15/2010 15:20, Stefan A. wrote: > Stephen, > > what's about using instances in the sql.conf like > > sql sql_virtual_1{ > database = "mysql" > driver = "rlm_sql_${database}" > server = "dbcnode2" > port="3306" > login = "user" > password = "pw" > radius_db = "dbname" > ...all the other stuff... > } > > Having several such sections, you'd be able to call them in cour virtual > server as > > authorize { > preprocess > chap > mschap > suffix > eap { > ok = return > } > unix > --> sql_virtual_1 > files > expiration > logintime > pap > } > > > You only have to exchange the values of > server = "dbcnode2" > port="3306" > login = "user" > password = "pw" > > for each instance... > > > > > Does this help? > Stefan > > > >> -----Original Message----- >> From: freeradius-users- >> bounces+a.freeradius=premit.de(a)lists.freeradius.org [mailto:freeradius- >> users-bounces+a.freeradius=premit.de(a)lists.freeradius.org] On Behalf Of >> Stephen Fulton >> Sent: Tuesday, June 15, 2010 8:43 PM >> To: freeradius user >> Subject: Virtual server specific SQL schema. >> >> Greetings, >> >> I am building an FR server using a shared MySQL database that will have >> multiple >> virtual servers. Each of the virtual servers needs to use different >> radcheck >> and radacct tables, each of which has a unique name (eg. radcheck1, >> radcheck2). >> The stated preference is that a single database be used, and the >> different >> tables reside within. For performance reasons, I would rather specify >> the DB >> server specific parameters (hostname, user/pass, maximum number of >> sockets etc) >> globally. >> >> My question: Is it possible to use a global DB configuration as >> outlined above, >> but call the schema specific info from within a virtual server? >> >> Thanks, >> >> -- Stephen >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 5

Ubuntu OpenSSL
by David Peterson 15 Jun '10

15 Jun '10

I know there is probably something easy I am missing but I cannot for the life of me get FR to compile with OpenSSL for EAP-TTLS support. Are there any how-to's on getting Ubuntu to compile OpenSSL support into FR2.1.9 David Peterson

7 11

Problems authenticating with a Cisco ASA 5510
by Daniel Davidson 15 Jun '10

15 Jun '10

We have had a radius server running for years that we use to authenticate our wireless users over wpa. It works flawlessly and connections are authenticated as shown by the log below. Mon Jun 14 14:57:40 2010 : Auth: Login OK: [miyagi72/<no User-Password attribute>] (from client 1s port 109133 cli d830.629b.3ae9) Above is an exact log entry. Now we are attempting to authenticate our new ASA 5510 with radius for our vpn, authentication with it is failing. Mon Jun 14 14:59:07 2010 : Auth: Login incorrect: [danield/password] (from client igbvpn port 26) In the example log above, I removed my password and replaced with the word "password". My guess is that the password is being thrown into the wrong field, but I have no idea how to resolve the issue. Can anyone point me in the right direction. Dan

2 3

Virtual server specific SQL schema.
by Stephen Fulton 15 Jun '10

15 Jun '10

Greetings, I am building an FR server using a shared MySQL database that will have multiple virtual servers. Each of the virtual servers needs to use different radcheck and radacct tables, each of which has a unique name (eg. radcheck1, radcheck2). The stated preference is that a single database be used, and the different tables reside within. For performance reasons, I would rather specify the DB server specific parameters (hostname, user/pass, maximum number of sockets etc) globally. My question: Is it possible to use a global DB configuration as outlined above, but call the schema specific info from within a virtual server? Thanks, -- Stephen

2 1

Re: Proxy to two RADIUS Servers
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > Here comes the provisioning part: > At the beginning of an IP session, we will get the assignment "IP address to > Subscriber Number" including a Filter-ID, advising pointing to the correct > optimization. This will be done, using RADIUS Accounting > This is not odd and several vendors of such systems are using this > mechanism. It's odd. Provisioning things via Accounting-Request packets is not part of RADIUS. > But what will happen, if the Accounting Packets are gone? Have a look at a > single Framed-IP-Address over the time: > > - If the START does not reach the Optimizer, User will get a default profile Well... the *NAS* is supposed to generate accounting packets. When it does, you can forward them. > - If STOP does not reach the Optimizer, no problem > - If STOP and START does not reach the Optimizer, user will get the setting > of the predecessor (Not good!). This might happen, if the link to the > optimizer is broken for some minutes > > At some Operators, Access to Mailboxes is given, using this mechanisms, > which might lead to wrong Access to wrong eMails... not good again! Sure... > I know, that this is hard to process... It's ugly, and not a nice solution. > Therefore my former question, whether it is possible to send START and STOP > directly, but only buffer the STOP packets for later transmission. This will > prevent constantly changing Subscribers, using a particular IP address, > during the phase, where the link is back up. Only sending /old/ stop packets > will delete assignments at the optimizer, even if the user just came online, > but this is much better, than wrong assignments. As I said earlier, you can use "radclient" to send any packet you want. You can use a Perl script to wrap radclient, and filter the attributes. > The milliseconds thing: > > The signaling flow (2G/3G Network): SGSN -> GGSN -> FR -> Optimizer > Still looking for a single Framed-IP-Address: > 1 PDP Context creation Request from SGSN to GGSN > 2 Access Request to FR > 3 Access Accept to GGSN > 4 Acct Start to FR > 5 write in detail file > 6 Acct ACK to GGSN > 7a1 Listener catches the Acct Start and sends it to Optimizer > 7a2 Acct ACK from optimizer > 7b1 GGSN sends PDP Context Creation Accept to SGSN > 7b2 SGSN allows IP Packets to pass the link No... that's not a *required* flow. You *can* proxy packets directly. See raddb/sites-available/robust-proxy-accounting It's up to *you* to configure the packet flow you want. And *none* of the above description shows accounting packets going to *two* different locations, like you originally asked. Please keep a *consistent* story in your messages. > Depending on system load and number of concurrent accesses, the 7a' and 7b' > might change their sequence, because they are decoupled. This will possibly > start a TCP Session via the optimizer, which will most likely use the > default profile. > But back to the eMail disaster: dropping a STOP and delaying the next START > for the same IP, will give the user Access to the wrong mailbox. > > I hope this describes a little bit, why I'm asking possibly odd questions. So... configure the server to do what you want. If you want accounting packets to go quickly to the optimizer, proxy them directly. If you want them to be copied elsewhere, *that* isn't time critical, and can use the "detail" file. > Any ideas on how to solve this problem beside looking for an new job or > industry? Ask vendors to not design && ship broken products. But I've given up hope on that. Alan DeKok.

1 0

Re: Proxy to two RADIUS Servers
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > I have to provision the DEST1 using live session information, and DEST1 only > needs the information during the current IP, but if I set up: > 1. manual Proxy from sites-enabled/default file: all ACK Packages are > delayed to the NAS, if DEST1 is not there, and the NAS possibly retries... > not good!? That's why the other virtual servers exist. > 2. if I use'copy-acct-to-home-server', I have to keep track of the packet, > to not send too old information to the DEST1. In strange cases, where DEST1 > is down for hours, I will keep sending packets of old sessions, until I went > through all left files... Uh... the server keeps track of the packet. And the whole point of accounting is to store data. i.e. to send *all* traffic, even after the home server has been down for hours. If you don't like this, you can change the proxying rules to *ignore* accounting packets that are older than X hours. See Acct-Delay-Time. > 3. I could possibly mix it: I might send START and STOP packets to DEST1. In > case DEST1 is not available, I put all STOP Packets into the > 'copy-acct-to-home-server' files. After DEST1 is back up, all previous ended > sessions will be cleared and new sessions will overwrite the possibly old > status in the DEST1 databases ..., but this might not work, as 'redundant' > does not take updates on a attribute list. That sounds complicated. > also... 'copy-acct-to-home-server' seems to delay the forwarded packet at > about 0.2 to 0.5 seconds... > I checked to use a ramdisk for this, but it did not speed up the process... > I sometimes see 0.05 but often 0.4 I don't understand why that's a problem. Do you really need millisecond resolution on accounting packets? > Again, nobody cares about start packets after the session has been > terminated, but fast delivery is critical... Why? No one else needs millisecond response time for accounting packets. Alan DeKok.

2 1

Looking for an editor for FreeRADIUS documentation
by Alan DeKok 15 Jun '10

15 Jun '10

In the interest of making the project better, we're looking for an editor for the documentation. The existing documentation is an "ad hoc" collection of files thrown together over a decade of effort, and written by many different people. We'd like to organize the documentation ("doc/" directory), and clean it up. We're looking for an editor with the following skills: - willing to do the work - can write reasonably clearly - basic knowledge of RADIUS The goal is to *organize* the documentation, not to write more. The existing documentation is basic, and could be improved through simple re-organization. No knowledge of "git" is required. Familiarity with "restructured text" would be good. We're looking to move the documentation to that format. If it matters, this is a *paid* position. We can't afford a lot, but we can afford to pay for work done. The rates will be negotiable based on quantity of work and results. Please send email to the list if you're interested. We can choose a candidate, and do the edits publicly, so people see visible progress. Alan DeKok.

10 24