October 2013 - Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 102, Issue 65
by Okis Chuang 21 Oct '13

21 Oct '13

Thanks Fajar for quick response! Now I know there exists mutual influence among virtual servers. Oddly, instead of seeing the error message " There are no DB handles to use ", there are bulk of "Discarding duplicate request from NMS - ID xx due to unfinished request xxxx", then after about short period of time, it showed msg "WARNING: Unresponsive child for request xxxx, in component authorized module", can I still say that is due to problematic DB? > > That is, even virtual server ?A? only has few operation to check, > > while ?B? has much more things need to check and unfortunately maybe > > it could have low performance DB backend, does B might occupy resource > > in whole Authorize section so that A also become more and more busier? > > > > ** > > > > Yes > > > > ** > > > > In fact, I got many times of Error msg ?child is hung for request in > > component authorize module? in radius.log. I would not think the > > loading in our server was really much high enough for causing late > > response to simulated request from our NMS per **minute**. Our wifi > > auth request per day is among 2000~3000 in average. > > > > only 2k per day? That's tiny. Something if seriously wrong with your db if it > can't handle that much requests. > > IIRC one way to isolate problematic db is to use small num_sql_socks in > sql.conf (default is 5). If the db is slow, it should bomb out quickly with "There > are no DB handles to use" errors, but there should be only a small count of FR > threads interacting with that db so that processes not using it (e.g. other > virtual server) should still work just fine. > > -- > Fajar

2 1

sqlcounter doesn't work with bytes instead of time
by Fabrizio Fiore Donati 21 Oct '13

21 Oct '13

Hi, i'm configuring a server with a sql counter to check the total byte in a week for the users. But the server will reply a wrong count. Here's the counter: sqlcounter weeklybytecounter { counter-name = Weekly-Total-Max-Octets check-name = Max-Weekly-Octets reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = weekly query = "SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" But the reply doesn't is the operation between (check-name value) - (query value) for example: rlm_sqlcounter: Authorized user fabrizio, check_item=3000000000, counter=38101894 I expect a reply of 3000000000 - 38101894 = 2961898106 but i receive different value also bigger..... Any idea ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

2 1

interaction between Virtual server & Authorize section
by Okis Chuang 21 Oct '13

21 Oct '13

Hi all, I have two running virtual servers listening different auth port(1645 and 1812), first one for wifi service Authorization and the second for radius check from our NMS by sending simulated auth request. Virtual Server listening on 1645 is connecting to DB by number of sockets, but the other one listening on 1812 doesn't. Just proxy auth request to external AAA and return reply to NMS. My question is: Suppose the DB that one of our virtual server connected is slow, does this virtual server would impact operations of the other virtual server that for NMS? For example, causing other authorized procedures in another virtual server becoming delayed. That is, even virtual server "A" only has few operation to check, while "B" has much more things need to check and unfortunately maybe it could have low performance DB backend, does B might occupy resource in whole Authorize section so that A also become more and more busier? In fact, I got many times of Error msg "child is hung for request in component authorize module" in radius.log. I would not think the loading in our server was really much high enough for causing late response to simulated request from our NMS per *minute*. Our wifi auth request per day is among 2000~3000 in average. So I was curious that is there any mutual influence or interaction between different virtual servers in the same section. If yes, then I think our new DB is highly suspicious. Best regards, Okis.

2 1

RE: Reply-Message order and format
by Sanity Computers 20 Oct '13

20 Oct '13

" The message is hard-coded. There is no documentation on formatting, because it's not possible to format the message. If you want to change the message, you can do it in the post-auth Reject section." Thanks for the response. My near default setup in the authorise section provides a valid reply message for the sql counter, the dailycounter and the expiration. Albeit some of the logic in my example are missed. The noresetcounter and bytecounter do not provide a response. Every googled example shows something like this for a max bytes counter in the authorised section. Yet nothing extra in the post-auth... So I'm lost. The closest I have come is this site; http://tim.purewhite.id.au/tag/access-reject/ were the priority and order are talked about. My thought is the bytescounter is working but it does not show a reject when asked... thanks for any help offered.

1 0

exec module bash script authentication
by Ahmet Hakan 20 Oct '13

20 Oct '13

Dear All, I am new at freeradius (2.1.4) I am using sql authentication with mysql successfuly and I want to add second authentication via bash. (if sql authentication fail then check bash authentication) I added file (bashauth) to module directory exec bashauth { wait = yes program = "/usr/local/bin/bash /bin/radcheck %{User-Name} %{User-Password}" input_pairs = request output_pairs = reply shell_escape = yes } then I modified sites-enabled/default authorize { ... bashouth pap } authenticate { Auth-Type BASHAUTH { bashauth } ... } but I cant authenticate user via bash script radiusd -X output is below. [bashauth] expand: %{User-Name} -> a [bashauth] expand: %{User-Password} -> a Exec-Program output: Exec-Program: returned: 0 ++[bashauth] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. What must I do for solving problem? Thanks for your help, Ahmet

2 3

SQL fields not lining up
by Scott Pettit - Vorco 20 Oct '13

20 Oct '13

Hi all, Running FreeRADIUS Version 2.1.10. I have a happily working FreeRADIUS + mySQL backend setup, however in the radacct table it seems FreeRADIUS just dumps fields in the order of what it has. For example I store nastxspeed and nasrxspeed and disccauseext. Some sessions end and store the tx speed, rx speed and cause in the correct field, but other sessions I end up with the remote-id in the tx speed field, then tx speed in the rx field, rx speed in the disccauseext field. It seems as if the RADIUS server completely ignores the field names, so if it has a missing attribute on a session or an additional attribute, the entire accounting row moves left or right and continues on rather than leaving a blank field if it didn¹t have an attribute. Is this something I can fix by getting FreeRADIUS to somehow explicitly put each attribute in the appropriate field? -Scott ________________________________ The content of this message and any attachments may be privileged, confidential or sensitive. Any unauthorised used is prohibited. Views expressed in this message are those of the individual sender, except where stated otherwise with appropriate authority. All pricing provided is valid at the time of writing only and due to factors such as the exchange rate, may change without notice. Sales are made subject to our Terms & Conditions, available on our website or on request. ________________________________

3 3

Reply-Message order and format
by Sanity Computers 19 Oct '13

19 Oct '13

Hi all, FR 2.2 is working fine but I can't find detail on how to order the counters and provide a logical reply message. The max-daily-session code works and reply's perfectly and is how I would like a max-daily-bytes to work. If a user exceeds the bytes allowance the reply message is always the expiry message. Is there documentation on the formatting and rules ? The debug output always shows the below, Sat Oct 19 01:13:41 2013 : Info: ++[noresetBytecounter] returns noop Sat Oct 19 01:13:41 2013 : Info: ++? if (reject) Sat Oct 19 01:13:41 2013 : Info: ? Evaluating (reject) -> FALSE Sat Oct 19 01:13:41 2013 : Info: ++? if (reject) -> FALSE In sites/available/default I have: ------------------------ authorize { sql{ notfound = 1 reject = 2 } if(notfound){ update reply { Reply-Message := "Username not found. Please check your details" } ok = reject } if(reject){ update reply { Reply-Message := "Login Failed. Please check your Username and Password" } ok = reject } noresetBytecounter{ reject = 1 } if(reject) { update reply { Reply-Message := "You have reached your data volume limit." } ok } noresetcounter{ reject = 1 } if(reject){ update reply { Reply-Message := "You have reached your time limit" } ok = reject } dailycounter expiration{ userlock = 1 } if(userlock){ update reply { Reply-Message := "Your account - %{User-Name} - has expired, " } ok = reject } } ------------ And this is /mysql/counter.conf -------------- sqlcounter noresetBytecounter { counter-name = Total-Max-Octets check-name = ChilliSpot-Max-Total-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='%{${key}}'" } ------------------------------ Regards Jim

2 1

LDAP Broken in 3.0?
by Mikael Tomt 19 Oct '13

19 Oct '13

Hello We are currently using freeradius 2.1.12 which works fine. I tried to install 3.0, everything went fine except ldap. When I try ldaps on port 636 it fails on startup with: rlm_ldap (ldap): Connecting to SERVERNAME:636 rlm_ldap (ldap): Bind with CN=USERNAME,OU=XXX,DC=XXX,DC=XXX,DC=XXX to SERVER:636 failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/etc/raddb/mods-enabled/ldap[1]: Instantiation failed for module "ldap" With ldap on port 389 it starts but fails when I connect with: (35) ERROR: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details. (35) ERROR: Server said: 000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1772. I have chase_referrals=yes and rebind=yes in ldap module file and tried to move it around without success. The AD account and settings works in 2.1.12 MvH Mikael Tomt It-Enheten Mora, Orsa, Älvdalen

3 3

mac authentication, log rejected device in radius.log
by Bertalan Voros 18 Oct '13

18 Oct '13

Hello All I have freeradius set up with eap and mac authentication, all is well thanks to the excellent documentation and this list. I have one question, I would like to log a message in radius.log when a device is rejected based on its mac address. I would like to put a message saying that the device was unauthorised and the Calling-Station-Id into the radius.log logfile. Is that possible. authorized_macs if (!OK) { reject and write reason for rejection into radius.log } Currently the log entry is the same for a mistyped password and a rejected mac address. Thanks and best regards, Bertalan Voros

4 3

Re: Active Directory authentication question
by Roberto Carna 18 Oct '13

18 Oct '13

Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error: # make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1 I've followed all the steps to use this tool, but I can't make it. What can be the problem ??? Thanks 2013/9/24 <stefan.paetow(a)diamond.ac.uk>: > Hi Roberto, > > You have to install Kerberos, yes. I believe you'll need the krb5-user package. > > When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically. > > Stefan > > >> -----Original Message----- >> From: Roberto Carna [mailto:robertocarna36@gmail.com] >> Sent: 23 September 2013 19:16 >> To: Paetow, Stefan (DLSLtd,RAL,LSCI) >> Subject: Re: Active Directory authentication question >> >> Dear Stepahn, I use Debian 7 for my Freeradius server and there I've >> installed Samba, Winbind and krb5.conf....not Kerberos (or whatever the >> package is called). >> >> Do I need to install the Kerberos package, or simply install the >> krb5.conf and then edit it ??? >> >> Thanks again. >> >> Roberto >> >> 2013/9/23 <stefan.paetow(a)diamond.ac.uk>: >> > Hi Roberto, >> > >> > When in the process do you get that error? >> > >> > Here are my configuration bits. In the [global] section of the >> SMB.CONF file I have: >> > >> > workgroup = DIAMOND >> > security = ads >> > realm = DIAMOND.LOCAL (my test domain) password server = IP address >> of >> > my primary domain controller >> > >> > Everything else is left as-is (default). My test domain is called >> DIAMOND.LOCAL. >> > >> > Stefan >> > >> > >> > >> > >> > >> >> -----Original Message----- >> >> From: Roberto Carna [mailto:robertocarna36@gmail.com] >> >> Sent: 23 September 2013 15:58 >> >> To: Paetow, Stefan (DLSLtd,RAL,LSCI) >> >> Subject: Re: Active Directory authentication question >> >> >> >> Dear Stephan, can you send me a complete smb.conf file because I am >> a >> >> bit lost in the correct configuration ? >> >> >> >> I'm getting the error: >> >> >> >> Could not connect to server 10.11.0.64 Connection failed: >> >> NT_STATUS_BAD_NETWORK_NAME >> > >> > >> > >> > -- >> > This e-mail and any attachments may contain confidential, copyright >> and or privileged material, and are for the use of the intended >> addressee only. If you are not the intended addressee or an authorised >> recipient of the addressee please notify us of receipt by returning the >> e-mail and do not use, copy, retain, distribute or disclose the >> information in or attached to the e-mail. >> > Any opinions expressed within this e-mail are those of the individual >> and not necessarily of Diamond Light Source Ltd. >> > Diamond Light Source Ltd. cannot guarantee that this e-mail or any >> attachments are free from viruses and we cannot accept liability for >> any damage which you may sustain as a result of software viruses which >> may be transmitted in or with the message. >> > Diamond Light Source Limited (company no. 4375679). Registered in >> > England and Wales with its registered office at Diamond House, >> Harwell >> > Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United >> > Kingdom >> > >> > >> > >> > > > -- > This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. > Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. > Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. > Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom > > > >

4 11