January 2014 - Freeradius-Users - lists.freeradius.org

2.1.12: rlm_radutmp errors
by Karsten Honsack 09 Jan '14

09 Jan '14

Hello, this is my first mail to a mailinglist so please be patient. I am running three debian radius-servers using freeradius 2.1.12 with about 40 clients for service and wlan authentication. Everything runs fine but there is one client which always causes errors in the log and i would like to ask if somebody had a similar problem and any suggestions for a solution. The servers make no accounting. I get the following error message in the logs: Error: rlm_radutmp: NAS xxx port 0 unknown packet type 16777216) or Error: rlm_radutmp: NAS xxx port 0 unknown packet type 33554432) The Client Configuration is: client xxxx { ipaddr = xxx.xxx.xxx.xxx secret=xxx nas=other netmask = xx } The Client-Network uses pGina for Windows-Radius-Authentication. Thank you for your help! -- Rheinische Friedrich-Wilhelms-Universität Bonn Hochschulrechenzentrum Karsten Honsack Wegelerstraße 6 53115 Bonn Tel.: +49 (0)228 73-3456

2 2

Re: coa / proxy question
by Richard J Palmer 09 Jan '14

09 Jan '14

OK I now have part one of this done - radacct now holds the LNS IP address thank you. I just want to clarify one small thing if I may ... With the CoA I currently have one CoA server enabled on port 3799 on the radius server. How should I forward the CoA to the LNS ? Do I setup 2 CoA servers either on different ports or IPs within FreeRadius and each send to a different LNS, or Can FreeRadius itself do a SQL query based on the AcctUniqueId and use that to get the IP to forward to ? Or have I again got this totally wrong ? Thanks in advance I do appreciate your help -- Richard Palmer | Director | Merula Limited Company Registered in England and Wales No. 3243995 5 Avro Court, Huntingdon, Cambridgeshire, PE29 6XS Phone 01480 222940 | Support 0845 330 0666 Support Email support(a)merula.net > --- Original message --- > Subject: Re: coa / proxy question > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Monday, 06/01/2014 3:29 PM > > Richard J Palmer wrote: >> >> What I would ideally like to do (simple solution) is send the coa >> request to both LNS routers - one will obviously say 'no match' the >> other will correctly affect the session. With the pool set to failover >> I >> find that second LNS is not sent the coa as the first LNS replied >> (albeit saying no match), load balance works 50/50. > > That's a terrible solution. > >> >> Is there a simple way to configure coa to send the request to both >> here. > > No. Packets go to ONE destination, and ONLY one destination. > >> >> I'm also open to any betrter routes to do this > > Add a column to the accounting table. It should be "LNS IP > Address". > Then, update the accounting queries to store Packet-Src-IP-Address > there. > > For CoA, you just look up the session in the accounting table, and > sent the CoA packet to the LNS IP Address. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Question about FreeRadius client programming
by Alexandre Harly 08 Jan '14

08 Jan '14

Hello, I am using the freeRadius client sample to do my own client and it appears that the request sent by this client contains a non crypted password. (I checked with Wireshark). Where can I find the documentation about the way to make the password being crypter ? Did I forgot something ? My source is below. Thanks a lot ! rh = rc_new(); rh = rc_config_init(rh); rc_add_config(rh, "auth_order", "radius", "config", 0); rc_add_config(rh, "login_tries", "4", "config", 0); rc_add_config(rh, "dictionary", "......./dictionary", "config", 0); rc_add_config(rh, "seqfile", "........./radius.seq", "config", 0); rc_add_config(rh, "radius_retries", "3", "config", 0); rc_add_config(rh, "radius_timeout", "5", "config", 0); rc_add_config(rh, "acctserver", "my_ip:my_port:my_secret", "config", 0); rc_read_dictionary(rh, rc_conf_str(rh, "dictionary")); rc_avpair_add(rh, &send, PW_USER_NAME, "my_login", -1, 0); rc_avpair_add(rh, &send, PW_CHAP_PASSWORD, "my_pwd", -1, 0); rc_auth(rh, 0, send, &received, msg);

2 3

Re: restarting? database, radius
by Ryan Milton 07 Jan '14

07 Jan '14

Got it. On 1/7/14, 3:57 PM, "Alan DeKok" <aland(a)deployingradius.com> wrote: >Ryan Milton wrote: >> The error log show the following (I don’t understand it): >> >> /var/db/mysql/serv03XXX.net.err  >> >> 140107 20:20:22 mysqld_safe Starting mysqld daemon with databases from >> /usr/local/data >> ^G/usr/local/libexec/mysqld: Can't find file: './mysql/plugin.frm' >> (errno: 13) > > Ask the MySQL people about MySQL. > > Once you have MySQL working properly, *then* you can look at any >issues with FreeRADIUS. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

FW: restarting? database, radius
by Ryan Milton 07 Jan '14

07 Jan '14

From: Ryan Milton <rmilton(a)mvsusa.com<mailto:rmilton@mvsusa.com>> Date: Tuesday, January 7, 2014 at 3:16 PM To: "freeradius-users(a)lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org>" <freeradius-users(a)lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org>> Subject: restarting? database, radius Hi, I am using FreeRADIUS 2.1 on a FreeBSD 8.2 In the process of inserting lines into tables on the master server, one server, the one in question wasn’t replicating properly. I attempted to stop radius - /usr/local/etc/rc.d/radiusd stop  and restart MySQL - /usr/local/etc/rc.d/mysql-server restart But that did not work. when I ran a tail command on the radius.log file, I got these errors: Tue Jan 7 20:18:00 2014 : Error: Failed to load clients from SQL. Tue Jan 7 20:18:00 2014 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue Jan 7 20:18:00 2014 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue Jan 7 20:18:00 2014 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue Jan 7 20:18:00 2014 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue Jan 7 20:18:00 2014 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue Jan 7 20:18:00 2014 : Error: /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Tue Jan 7 20:18:00 2014 : Error: /usr/local/etc/raddb/sites-enabled/default[177]: Failed to load module "sql". Tue Jan 7 20:18:00 2014 : Error: /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. Tue Jan 7 20:18:00 2014 : Error: Failed to load virtual server <default> The error log show the following (I don’t understand it): /var/db/mysql/serv03XXX.net.err  140107 20:20:22 mysqld_safe Starting mysqld daemon with databases from /usr/local/data ^G/usr/local/libexec/mysqld: Can't find file: './mysql/plugin.frm' (errno: 13) 140107 20:20:22 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it. 140107 20:20:22 InnoDB: The InnoDB memory heap is disabled 140107 20:20:22 InnoDB: Mutexes and rw_locks use GCC atomic builtins 140107 20:20:22 InnoDB: Compressed tables use zlib 1.2.3 140107 20:20:22 InnoDB: Initializing buffer pool, size = 128.0M 140107 20:20:22 InnoDB: Completed initialization of buffer pool 140107 20:20:22 InnoDB: Operating system error number 13 in a file operation. InnoDB: The error means mysqld does not have the access rights to InnoDB: the directory. InnoDB: File name ./ibdata1 InnoDB: File operation call: 'create'. InnoDB: Cannot continue operation. 140107 20:20:22 mysqld_safe mysqld from pid file /usr/local/data/serv03.ams5.bganglobalnet.net.pid ended 140107 20:23:33 mysqld_safe Starting mysqld daemon with databases from /usr/local/data ^G/usr/local/libexec/mysqld: Can't find file: './mysql/plugin.frm' (errno: 13) 140107 20:23:33 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it. 140107 20:23:33 InnoDB: The InnoDB memory heap is disabled 140107 20:23:33 InnoDB: Mutexes and rw_locks use GCC atomic builtins 140107 20:23:33 InnoDB: Compressed tables use zlib 1.2.3 Now, I’m getting this beloved error when I attempt to go back into the MySQL db: ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) I am completely new at this, but I hesitate to do anything drastic to the server since I don’t fully understand it. Thanks in advance for any assistance, Ryan

3 2

RE: Order of loading modules
by stefan.paetow＠diamond.ac.uk 07 Jan '14

07 Jan '14

Compare your two perl modules. The FreeRADIUS configuration might be identical, but the *CONTENTS* of the /product/freeradius-server-2.1.12_0/etc/raddb//modules/perl files are different between the two servers. On the one, the default example.pl is listed as the perl module. On the other, the module to load has been specified as perl_Originale. Read the debug output carefully when you look at the log, and you would notice the difference. It’s subtle, but it’s there. Stefan From: freeradius-users-bounces+stefan.paetow=diamond.ac.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Francesco Maisano Sent: 07 January 2014 00:13 To: FreeRadius users mailing list Subject: Re: Order of loading modules Sorry Alan, i see my configuration in instantiate section and I do not understand where it is shown the load order of the modules, please explain me. Below my radiusd.conf (same file for each servers) and startup of freeradius in debug mode on server A and on server B and you see the difference in loading modules order. Debug log info: radius_debug_server_A.log --> be careful to line number 46 (load perl module) and 62 (load perl_Originale module) radius_debug_server_B.log --> be careful to line number 45 (load perl_Originale module) and 58 (load perl module) [snipped for brevity] -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

1 0

Order of loading modules
by Francesco Maisano 07 Jan '14

07 Jan '14

Hi all, I need to known the order of loading of freeradius modules because i have two server with same configuration but when i start freeradius on server 1 charge, in order, module x (perl) and y (perl_Original) after, on server 2 viceversa. This info is needed because i have modified the perl module and first, i have saved the original perl with name perl_Original and i have modified the perl with the execution of my perl script. Best regards maframan My servers: Freeradius version 2.1.12 with perl library 5.14.2 on solaris SPARC 10 operating system

4 14

Defects - A reminder
by Arran Cudbard-Bell 07 Jan '14

07 Jan '14

The following can be found bundled with the server in doc/bugs and at https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/bugs. 1.YOU FOUND A BUG Where the server terminates ungracefully due to a bus error, segmentation violation, or other memory error, you should create a new issue in the issue tracker <URL: http://bugs.freeradius.org>, including information from sections 4 and 5. For other issues, you should first discuss them on the users list, to see if anyone can reproduce them. Often there's a simple explanation of why the server behaves as it does, and it's not necessarily a bug in the code, so browse the lists' archives of the last two months, and if you don't see messages about it, ask! If the behavior is correct but confusing, we think that's a bug too, and you should file a bug against our documentation. For more information about the users list, the lists' archives and the faq, please visit http://www.freeradius.org/list/users.html Please make sure to READ and RESPECT the house-rules. You will get much better response and much faster if you do! 2.CORE DUMPS If the server, or one of the accompyaning programs core dumps, then you should rebuild the server as follows: $ ./configure --enable-developer $ make $ make install and then run the program again. You may have to to enable core dumps, via: $ ulimit -c unlimited When it core dumps, do: $ gdb /path/to/executable /path/to/core/file Enable logging in gdb via the following commands: (gdb) set logging file gdb-radiusd.log (gdb) set logging on and follow the instructions in section 4, below. 3. DEBUGGING A LIVE SERVER If you can't get a core dump, or the problem doesn't result in a core dump, you may have to run the server under gdb. To do this, ensure that you have symbols in the binaries (i.e. a non-stripped binary) by re-building the server as described in the previous section. Then, run the server under gdb as follows: $ gdb radiusd Enable logging in gdb via the following commands: (gdb) set logging file gdb-radiusd.log (gdb) set logging on Tell gdb to pass any necessary command-line arguments to the server: (gdb) set args ... Where the "..." are the command-line arguments you normally pass to radiusd. Fo debugging, you probably want to do: (gdb) set args -f Then, do: (gdb) run When something interesting happens, you can hit CTRL-C in the window, and you should be back at the gdb prompt: (gdb) And follow the instructions in section 4, below. 4. OBTAINING USEFUL INFORMATION Once you have a core dump loaded into gdb, or FreeRADIUS running under gdb, you may use the commands below to get useful information about the state of the server. If the server was built with threads, you can do: (gdb) info threads Which will give you information about the threads. If the server isn't threaded, that command-line will print a message saying so. Then, do: (gdb) thread apply all bt full If the server isn't threaded, the "thread apply" section isn't necessary The output should be printed to the screen, and also sent to the gdb-radiusd.log file. You should then submit the information from the log file, along with any server output, the output of radiusd -xv, and information about your operating system to: http://bugs.freeradius.org/ Submitting it to the bug database ensures that the bug report won't get forgotten, and that it will be dealt with in due course. You should provide the issue number in any mail sent to the user's list. 5. VALGRIND On Linux systems, "valgrind" is a useful tool that can catch certain classes of bugs. To use it, run the server via: $ valgrind --tool=memcheck --leak-check=full radiusd -Xm It will print out certain kinds of errors to the screen. There may be a number of errors related to OpenSSL, dlopen(), or libtldl. We cannot do anything about those problems. However, any errors that are inside of the FreeRADIUS source should be brought to our attention. 6. Running with "screen" If the bug is a crash of the server, and it takes a long time for the crash to happen, perform the following steps: * log in as root * open a screen session (http://blogamundo.net/code/screen/) $ screen bash * make sure FreeRADIUS is not running * make sure you have all the debug symbols about, or a debugable version of the server installed * configure screen to log to a file; 'Ctrl-A H' * type 'gdb /path/to/radius' (or /path/to/freeradius on Debian) * at the (gdb) prompt, type 'run -X' * detach from screen 'Ctrl-A D' * when you notice FreeRADIUS has died, reconnect to your screen session $ screen -D -r * at the (gdb) prompt type 'where' or for *lots* of info try 'thread apply all bt full' * tell screen to stop logging, 'Ctrl-A H' * logout from screen -- FreeRADIUS Project, copyright 2014 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Re: coa / proxy question
by Richard J Palmer 06 Jan '14

06 Jan '14

That sounds perfect I will give that a go - I may come back with a couple more questions but it seems simple enough. Thanks for the pointers -- Richard Palmer > --- Original message --- > Subject: Re: coa / proxy question > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Monday, 06/01/2014 3:29 PM > > Richard J Palmer wrote: >> >> What I would ideally like to do (simple solution) is send the coa >> request to both LNS routers - one will obviously say 'no match' the >> other will correctly affect the session. With the pool set to failover >> I >> find that second LNS is not sent the coa as the first LNS replied >> (albeit saying no match), load balance works 50/50. > > That's a terrible solution. > >> >> Is there a simple way to configure coa to send the request to both >> here. > > No. Packets go to ONE destination, and ONLY one destination. > >> >> I'm also open to any betrter routes to do this > > Add a column to the accounting table. It should be "LNS IP > Address". > Then, update the accounting queries to store Packet-Src-IP-Address > there. > > For CoA, you just look up the session in the accounting table, and > sent the CoA packet to the LNS IP Address. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

coa / proxy question
by Richard J Palmer 06 Jan '14

06 Jan '14

We have a setup for l2tp ADSL and other connections using freeradius. All is generally working fine - I am building some coa functionality. The good news is that this in general works fine - I have however one problem and while I can see hints on the list and on the freeradius site I would appreciate some clarification. We have currently 2 LNS Servers. Sessions to us can end up on either one of our LNS Servers. However I can't easily say which of the LNS devices to send the request to - the NAS IP we hold in radact is actually the Wholesale providers NAS IP not the LNS IP address. What I would ideally like to do (simple solution) is send the coa request to both LNS routers - one will obviously say 'no match' the other will correctly affect the session. With the pool set to failover I find that second LNS is not sent the coa as the first LNS replied (albeit saying no match), load balance works 50/50. Is there a simple way to configure coa to send the request to both here. I'm also open to any betrter routes to do this coa config is currently --- listen { type = coa ipaddr = * port = 3799 server = coa } server coa { recv-coa { update control { Home-Server-Pool := firebrick_pool } ok } send-coa { ok } } --- proxy.conf is currently: --- home_server firebrick-1 { type = coa ipaddr = 2.3.4.5 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server firebrick-2 { type = coa ipaddr = 1.2.3.4 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool firebrick_pool { type = load-balance home_server = firebrick-1 home_server = firebrick-2 } --- Any pointers would be gratefully received -- Richard Palmer

3 2