July 2012 - Freeradius-Users - lists.freeradius.org

RE: sql returns fail for some stop requests
by Amir Tal 22 Jul '12

22 Jul '12

Adding unique key to the database results in the following being returned from rlm_sql, What happen to accounting data when a duplicate entry is encountered? In addition, currently there is no scheduled clearing of the data in radacct table, wont this increase in occurrence? -- [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> shimoni [sql] sql_set_user escaped user --> 'shimoni' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 0 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 0 [sql] expand: %{Acct-Delay-Time} -> 12 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-22 02:03:28', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '12', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:172.29.81.67:3280:96f8:1aa8:87fb:4d2:0062712021' AND username = 'shimoni' AND nasipaddress = '109.226.1.12' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql_mysql: MYSQL check_error: 1062 received [sql] Couldn't insert SQL accounting STOP record - Duplicate entry 'c6d3d253355b3dcf' for key 2 rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry 'c6d3d253355b3dcf' for key 2' rlm_sql (sql): Released sql socket id: 11 ++[sql] returns fail -- [detail.moreshet] /var/log/radius/radacct/moreshet.relay expands to /var/log/radius/radacct/moreshet.relay [sql] expand: %{Acct-Delay-Time} -> 0 [detail.moreshet] expand: %t -> Sun Jul 22 02:03:34 2012 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-22 02:03:34', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:172.24.245.233:2653:c9e:101:e0ba:4d2:0062712040' AND username = 'mosh19703' AND nasipaddress = '109.226.1.12' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql [detail.moreshet] expand: /var/log/radius/radacct/moreshet.relay -> /var/log/radius/radacct/moreshet.relay [detail.moreshet] /var/log/radius/radacct/moreshet.relay expands to /var/log/radius/radacct/moreshet.relay [detail.moreshet] expand: %t -> Sun Jul 22 02:03:34 2012 ++[detail.moreshet] returns ok rlm_sql_mysql: MYSQL check_error: 1062 received [sql] Couldn't insert SQL accounting ALIVE record - Duplicate entry '923952cbd6569744' for key 2 rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry '923952cbd6569744' for key 2' rlm_sql (sql): Released sql socket id: 27 ++[sql] returns fail -- Just wanted to state that I had started with the default provided configuration files, Alredy changed the rlm_sql source code, default SQL queries, default DB structure. There are still unclosed accounting packets existing. Log shows a lot of warning messages: rlm_sql (sql): Reserving sql socket id: 31 rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.23.184.73:dd94:1847:fcca:a66:4d2:0051412783' AND username = 'yali4780' AND nasipaddress = '109.226.1.20' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 0 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 0 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:147.235.134.62:3742:41fe:4d2:5019:56ac253:0062712137' AND username = '8532433' AND nasipaddress = '109.226.1.12' [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 30 rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.9:147.235.134.62:3742:41fe:4d2:5019:56ac253:0062712137' AND username = '8532433' AND nasipaddress = '109.226.1.12' WARNING: Child is hung for request 5763408 in component <core> module <queue>. WARNING: Child is hung for request 5763409 in component <core> module <queue>. WARNING: Child is hung for request 5763410 in component <core> module <queue>. rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): Reserving sql socket id: 20 rlm_sql (sql): got socket 20 after skipping 0 unconnected handles, tried to reconnect 1 though rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Error', acctstopdelay = '9', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.20.11.9:a3b4:30bf:3c4d:3ae3:4d2:0051412759' AND username = 'l100200' AND nasipaddress = '109.226.1.20' WARNING: Child is hung for request 5763411 in component <core> module <queue>. WARNING: Child is hung for request 5763412 in component <core> module <queue>. rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): Reserving sql socket id: 18 rlm_sql (sql): got socket 18 after skipping 0 unconnected handles, tried to reconnect 1 though rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', acctstopdelay = '6', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.28.242.195:f4ad:67aa:a8d9:ffcf:4d2:0051412766' AND username = 'avico313' AND nasipaddress = '109.226.1.20' rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): Reserving sql socket id: 9 rlm_sql (sql): got socket 9 after skipping 0 unconnected handles, tried to reconnect 1 though rlm_sql_mysql: query: UPDATE radacct SET acctstoptime = '2012-07-22 02:04:57', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = 'erx ip:109.226.0.17:172.20.5.237:f847:c445:f249:dfce:4d2:0051412782' AND username = 'sapir25' AND nasipaddress = '109.226.1.20' Child is finally responsive for request 5755840 Child is finally responsive for request 5755841 Child is finally responsive for request 5758217 Child is finally responsive for request 5758218 Child is finally responsive for request 5758219 Child is finally responsive for request 5757227 Child is finally responsive for request 5758220 Child is finally responsive for request 5757228 Child is finally responsive for request 5757229 Child is finally responsive for request 5757230 Child is finally responsive for request 5758221 Child is finally responsive for request 5758222 Child is finally responsive for request 5758223 Child is finally responsive for request 5758224 WARNING: Child is hung for request 5763245 in component <core> module <queue>. WARNING: Child is hung for request 5763246 in component <core> module <queue>. WARNING: Child is hung for request 5763247 in component <core> module <queue>. WARNING: Child is hung for request 5763248 in component <core> module <queue>. WARNING: Child is hung for request 5763249 in component <core> module <queue>. WARNING: Child is hung for request 5763063 in component <core> module <queue>. WARNING: Child is hung for request 5763072 in component <core> module <queue>. WARNING: Child is hung for request 5763073 in component <core> module <queue>. WARNING: Child is hung for request 5763074 in component <core> module <queue>. WARNING: Child is hung for request 5763075 in component <core> module <queue>. Amir.

3 2

Re: Duplicate clients entry & segmentation fault after killing radius server
by Alan Buxey 21 Jul '12

21 Jul '12

...and what information are you providing? I see nothing with this report (ps if this is with an version, then the first thing you do is try the latest release as it may have already been fixed) alan

1 0

Duplicate clients entry & segmentation fault after killing radius server
by Prateek Kumar 21 Jul '12

21 Jul '12

Hi, I have 2 ldap modules which are selected by unlang logic and I have configured my certificates as default. Now when I put a dupticate client entry in clients.conf file & then kill the radius server I got a error like *** glibc detected *** radiusd: free(): invalid pointer: 0xb778e994. Also some time I get the error like munmap_chunk(): invalid pointer. If I remove the duplicate client entry then I don't see the error. radiusd -X . My freerdaius version -> FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Oct 27 2009 at 17:05:49. including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.38 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 172.20.1.146 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 192.168.1.1 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 192.168.1.1 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } WARNING: Ignoring duplicate client 192.168.1.1 radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_ldap Module: Instantiating HR ldap HR { server = "127.0.0.1" port = 389 password = "mypass" identity = "cn=Administrator,dc=prateek,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=HR,dc=prateek,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute HR-Ldap-Group rlm_ldap: Registering ldap_groupcmp for HR-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name HR rlm_ldap: Over-riding set_auth_type, as there is no module HR listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xb78b2628 Module: Instantiating dev ldap dev { server = "127.0.0.1" port = 389 password = "mypass" identity = "cn=Administrator,dc=prateek,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=development,dc=prateek,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute dev-Ldap-Group rlm_ldap: Registering ldap_groupcmp for dev-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name dev rlm_ldap: Over-riding set_auth_type, as there is no module dev listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xb78b3af8 Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_counter Module: Instantiating daily counter daily { filename = "/etc/raddb/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11278 rlm_counter: Current Time: 1342783833 [2012-07-20 17:00:33], Next reset 1342809000 [2012-07-21 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" mode = "rw" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Ready to process requests. Exiting normally.

4 5

Radius reject the request
by Reza Hajjizadeh 21 Jul '12

21 Jul '12

Hello I'm newbie in Linux, install a new radius server as http://wiki.freeradius.org/Build explain tar zxvf freeradius-server-2.1.12.tar.gz ./configure make su - root make install edit /home/reze/freeradius-server-2.1.12/users at top of file add testing Cleartext-Password :="123456" and start radius #radius -X > output.txt on another terminal type #radtest resting 123456 127.0.0.1 10 testing123 but reject the request. Please help me to solve this problem. Best Regards

2 2

Proxim Wireless - Vendor Specific Attributes
by Simha 20 Jul '12

20 Jul '12

All, Will FreeRADIUS support Proxim Wireless (IANA ID - 841) - Vendor Specific Attributes? I have few Tsunami 8000 - MP-8100-BSU and MP-8150-CPEs and need to provision VLAN and QoS using FreeRADIUS. Any information in this regard will be helpful. BR, Simha.

3 2

Re: Re: FreeRADIUS in failover - HA setup (question)(Arran Cudbard-Bell)
by Aldo Zavala 20 Jul '12

20 Jul '12

Arran, many thanks for your reply. After read you reply I have two basic questions below: 1.- Although there are more options to achieve redundancy in MySQL I will choose either MySQL Cluster or MySQL Replication in which I believe (please correct me any time if I am wrong) you have the option of have a floating IP address, all nodes will be master in Cluster, and Master/Slave combinations could be setup in Replication in any case I will always connect to one MySQL IP address so why would I need to call more than one instance of SQL module? 2.- Also, I think Sun (x86 or 64) with Solaris 10 OS will be my platform of choice for the MySQL Cluster or Replication setup, would you recommend me to compile the FreeRADIUS 3.0 (from Git), in other words: - Is there any special document or list of tips to compile FreeRADIUS 3.0 it under Solaris 10?, I have seen many post of people having compilation issues. - In general, is Solaris 10 a recommended platform to run FreeRADIUS 3.0 ? Thanks again! Aldo Zavala ----- Original Message ----- On 19 Jul 2012, at 01:11, Aldo Zavala wrote: > Hi, everybody. > > I was reading the "Deploying FreeRADIUS with the MySQL Cluster Database" whitepaper downloaded from MySQL website, it mentions in "3.1 Deployment Topologies" section that MySQL cluster can be integrated with FreeRADIUS but it always mention FreeRADIUS to be installed in a single node, would be a way to setup FreeRADIUS to be also failover the same way MySQL is, and not run just in a single node always? Yes. You use multiple instances of the SQL module and point them at different SQL nodes, the local node and then any other SQL node in the cluster. You can then use the redundant construct to switch between them in case of failure: redundant { sql sql_remote0 sql_remote1 sql_remoteN } The problem is (with 2.1x and 3.0) is that if all the connections in the SQL connection pool are down, the SQL module will only fail once its tried to establish a new connection and failed. Only one thread can be modifying the contents of the connection pool at a given time because its protected by a mutex. Only one thread can try and open a new connection, and until that connection succeeds or fails all the other threads will block. This causes a bottleneck where a bunch of threads block waiting for their turn to try and re-establish the connection before failing over. Because the server is largely stateless this happens on every request. I believe a good fix would be to check the state of the pool and the mutex, and if were at 0 connections and the pool is locked, to fail instantly. I'll talk to Alan and see what he thinks, maybe it should be configurable. If you're using SQL via a unix socket you should be fine, but as soon as you hit a remote server where you have to wait for the TCP connection to time out, I can almost guarantee that the server will just lock up completely. So unlike the example above, i'd recommend you only specify one local node and one remote node. Or wait and we'll try and fix something for 3.0. -Arran > > Note: Before reply saying that this question should be posted in MySQL forums please consider that I am not asking about MySQL configurations, I am asking about FreeRADIUS product, many thanks to everybody! > > > Aldo Zavala

2 1

radacct is not filled up
by Andreas Meyer 19 Jul '12

19 Jul '12

Hello! I authenticate a users against a mysql-db and everything is fine. Get entries in the radpostauth table but the radacct table stays emtpy, instead the logging is done in /usr/var/log/radius/radacct/192.168.1.254 # itx:/usr/var/log/radius/radacct/192.168.1.254 # ll insgesamt 284 -rw------- 1 root root 12420 12. Jul 16:38 auth-detail-20120712 -rw------- 1 root root 12420 13. Jul 19:35 auth-detail-20120713 -rw------- 1 root root 6210 14. Jul 23:21 auth-detail-20120714 -rw------- 1 root root 9078 15. Jul 17:06 auth-detail-20120715 -rw------- 1 root root 180883 16. Jul 17:26 auth-detail-20120716 -rw------- 1 root root 12640 17. Jul 00:43 auth-detail-20120717 -rw------- 1 root root 1242 3. Jul 22:35 reply-detail-20120703 -rw------- 1 root root 2008 12. Jul 16:38 reply-detail-20120712 -rw------- 1 root root 2008 13. Jul 19:35 reply-detail-20120713 -rw------- 1 root root 1004 14. Jul 23:21 reply-detail-20120714 -rw------- 1 root root 1004 15. Jul 13:39 reply-detail-20120715 -rw------- 1 root root 5041 16. Jul 17:26 reply-detail-20120716 -rw------- 1 root root 2016 17. Jul 00:43 reply-detail-20120717 I cannot find the place where in a configurationfile I can change the value to log into the radacct table. This is what I have in sql.conf: acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" Andreas

3 10

Cisco, Dell Authentication for Admins
by brain conflict 19 Jul '12

19 Jul '12

Hello, Just looking for guidance to the easiest way to handle Privilege-level access to Dell or Cisco Network hardware, such as Routers, and switches. Currently I have freeRADIUS running for 802.1x WiFi authentication, which accesses a Kerberos database. i only need to identify a small group of Network Engineers as Admins and allow them access to the devices, but nobody else. What's the easiest way to accomplish this in freeRADIUS, or if I need to use another method? I'm not worried about command Authorization at the moment, although that would be a "nice to have". Thanks! -brconflict

2 3

Help needed configuring MAB on FreeRADIUS and Cisco switch
by Kaya Saman 19 Jul '12

19 Jul '12

Hi, I've created a server running CentOS 6.2 and FreeRADIUS 2.1.10-5. I also have installed the latest DaloRADIUS on the system to provide a web UI since ultimately that is where people will be provisioning systems from of which I believe it is installed correctly. I also have a Cisco 3560G switch of which my aim is to create a dynamic way of allocating VLANs similarly to VMPS, only by using modern standards. So far amongst others I have been following these pages: http://wiki.freeradius.org/Cisco http://wiki.freeradius.org/Mac-Auth My configuration in the Cisco switch is attached: In regards to the RADIUS config, I have these tables on MySQL: +------------------------+ | Tables_in_radius | +------------------------+ | batch_history | | billing_history | | billing_merchant | | billing_paypal | | billing_plans | | billing_plans_profiles | | billing_rates | | cui | | dictionary | | hotspots | | invoice | | invoice_items | | invoice_status | | invoice_type | | nas | | node | | operators | | operators_acl | | operators_acl_files | | payment | | payment_type | | proxys | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radhuntgroup | | radippool | | radpostauth | | radreply | | radusergroup | | realms | | userbillinfo | | userinfo | | wimax | +------------------------+ This is what clients.conf shows: client switch1 { ipaddr = 10.0.0.1 secret = pass } My sql.conf file has these lines in it: sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "mysql" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "localhost" #port = 3306 # login = "radius" # password = "radpass" login = "root" The username for the SQL server is root and no password has been set: this is ok as the server is not connected to any network other then the switch which is also not connected to anything!! In DaloRADIUS I created a user using the MAC address of my test laptop of which I then added the: AUTH-TYPE field as ACCEPT; EGRESS-VLANID field as 10; EGRESS-VLAN NAME as TEST_VLAN Unfortunately this hasn't worked and I am definitely missing something here but what I'm not sure. I am not very familiar with RADIUS (still learning) and through the documentation I have been reading running any of the Cisco debug commands or sh radius stuff didn't really tell me if the switch was even linked to the server. I additionally don't see anything in any of the RADIUS logs either....... This is all I get: # cat radius.log Tue Jul 10 12:11:17 2012 : Info: Loaded virtual server inner-tunnel Tue Jul 10 12:11:17 2012 : Info: Loaded virtual server <default> Tue Jul 10 12:11:17 2012 : Info: Ready to process requests. Wed Jul 11 10:46:02 2012 : Info: Exiting normally. Wed Jul 11 10:46:02 2012 : Info: Loaded virtual server inner-tunnel Wed Jul 11 10:46:02 2012 : Info: Loaded virtual server <default> Wed Jul 11 10:46:02 2012 : Info: Ready to process requests. Wed Jul 11 11:01:47 2012 : Info: Exiting normally. I have even tried running radiusd -sX and radiusd -X which did not print ANY debug output whatsoever :-( Can anybody help me in getting started trying to figure out the problem? Regards, Kaya

3 22

More certificate trouble
by Morris, Andi 19 Jul '12

19 Jul '12

I've been getting trouble using freeradius with certificate validation, and until now have been running without this option selected in a test environment, however even with validation unselected I'm still having trouble connecting clients, with the debug output showing the below warning: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xd8b9e275d8bcfbd1 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! So I decided to blitz the certificates and try and start afresh, following Alan's documentation on the http://deployingradius.com/documents/configuration/certificates.html webpage, and have hit a few issues along the way which I can't explain. Firstly, even when using the snake oil certificates I cannot get the radius service to start without manually entering the PEM password, why isn't this happening automatically? Secondly, I've successfully created the certificates after entering the information in server.cnf and ca.cnf, then running the make command, but I'm still seeing the certificate compatibility warning on my Windows client, even with the validate server box unchecked. debug files attached. Thanks for any help, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

3 9