May 2014 - Freeradius-Users - lists.freeradius.org

Originate-coa ip addresses
by Brian Wallen 22 May '14

22 May '14

Sorry, I accidentally hit send before I was finished. I tried setting ipaddr = 192.168.0.0 netmask = 24 to originate-ca, but that still resulted in this error WARNING: Unkown destination 192.168.0.6:3799 for CoA request If I set ipaddr = 192.168.0.6, it works as expected. So is there a way to specify entire subnets in originate-coa?

2 1

Originate-coa ip addresses
by Brian Wallen 22 May '14

22 May '14

I was able to use the originate-coa example to setup CoA requests one of my test NASes. The only problem is that it only works if I set ipaddr to the ip address of the NAS. Is there a way to specify an entire subnet of NASes, kind of like you can in clients.conf? I tried ipaddr = 192.168.0.0

1 0

Is rlm_unbound stable?
by Nikolai Kondrashov 22 May '14

22 May '14

Hi everyone, Can the new "rlm_unbound" module be considered stable, or is it meant to be experimental for now? There was no note in ChangeLog. If it's still experimental, then perhaps I'll not include it and the associated dependencies into 3.0.3 Fedora packages. Thank you. Nick

3 3

Re: MySQL Accounting records advice (Mike Poole)
by Rui Ribeiro 22 May '14

22 May '14

Hi Mike, Fist of all I would advise you to upgrade that FreeRadius. The 2.12 has some serious bugs. About the MySQL, with 5.5 I would have a look at partitioning; if we are talking about performance problems, there is also Sharding. With some thought you can do the partitioning by month. Be aware of the diferences of the queries before doing that. We are using partitioning here. Regards, Rui Ribeiro pt.linkedin.com/pub/rui-ribeiro/16/ab8/434/ > > Date: Wed, 21 May 2014 15:23:46 +0000 > From: Mike Poole <mpoole(a)pavlovmedia.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: MySQL Accounting records advice > Message-ID: > <6712C775E82EB247807B5D7CCFBE940786B23393(a)sula.pavlovmedia.corp> > Content-Type: text/plain; charset="us-ascii" > > Using FreeRADIUS 2.1.12 with MySQL 5.5. > > Not a freeradius request per se but just wanted to know if others have > ideas on accounting records in sql. > > We've a mid-size ISP and recently turned on accounting writes to SQL for > CALEA. The table has grown enormously and now dwarfs our other databases > (20+ GB in about three months). > > Has anyone run into this and did you solve it? I'm thinking we should be > archiving the table and clearing it out on a regular basis either to a file > share or mysql ARCHIVE engine db. > > Perhaps even changing the way we do accounting in mysql would be better. > A lot of what we do is constrained by mgmt so not always the most > efficient. > > Thanks for your help. Freeradius has worked great for us! > > Mike > > >

1 0

User Group Not Working.
by * 22 May '14

22 May '14

1 0

radius cached results / cleanup_delay
by Chris Knipe 22 May '14

22 May '14

Hi All, First and foremost, well done with FR 3. Very nice revamp and whilst I did put off upgrading for a long time, I'm very pleased that I did eventually take the time to upgrade. Proud to say I'm running 3.0.3 now. Everything is working fine as expect, but I am experiencing one small issue that did not represent itself whilst using FR2.1.10. I am using FR to authenticate users with AAA in a custom application (not the traditional PPP type of scenario). The application sends of the request to FR, and I almost exclusively rely on rlm_perl to process and authenticate the user. rlm_perl crafts a specialised Reply-Message attribute, together with a Configuration-Token attribute and sends this back to the application for Access-Accepts, as well as Access-Rejects. When a user authenticates multiple times in quick succession (I am talking about almost 30 or 40 identical requests at the same time) off to FR, not all the requests make it to my rlm_perl application (but they all make it to FR). I am suspecting that FR caches the results internally as documented by the cleanup_delay in the configuration file. That is fine and dandy, doesn't affect me, and frankly, I appreciate it as it takes allot of processing time away from FR. The problem however, is that because not all the requests make it to rlm_perl, not all the responses from FR back to my application includes the Reply-Message / Configuration-Token attributes. This is especially troublesome for me on proxied requests which is sent to another home server, where there may be a delay before receiving a response from the home server. What is interesting to me, is that even when using the detail module to log all the auth-replies, the log indicates that ALL attributes are always sent. But when the packet gets to my application, the application cannot find the attribute. Surely, an attribute cannot just "magically" disappear from a packet? I'm not saying FR is to blame here per say, but I find it hard to believe that anything other than FR can be crafting and sending a packet to my application, or that there is something magical between the FR box and the application box that modifies the packets. So the question is, when FR caches results internally, does it only send an access-accept / access-reject back, or does it send ALL the attributes together with the access-accept / access-reject back? Posting a radiusd -X is pretty much pointless as everything works fine under low usage (or one or two requests). The issue only presents itself when FR processes like 30 or 40 identical requests.. Many thanks, and hopefully someone can shed some light on the cleanup_delay for me. -- Chris.

2 1

MySQL Accounting records advice
by Mike Poole 22 May '14

22 May '14

Using FreeRADIUS 2.1.12 with MySQL 5.5. Not a freeradius request per se but just wanted to know if others have ideas on accounting records in sql. We've a mid-size ISP and recently turned on accounting writes to SQL for CALEA. The table has grown enormously and now dwarfs our other databases (20+ GB in about three months). Has anyone run into this and did you solve it? I'm thinking we should be archiving the table and clearing it out on a regular basis either to a file share or mysql ARCHIVE engine db. Perhaps even changing the way we do accounting in mysql would be better. A lot of what we do is constrained by mgmt so not always the most efficient. Thanks for your help. Freeradius has worked great for us! Mike

2 1

Setting and extending Session-timeout
by Matej Žerovnik 20 May '14

20 May '14

Hello! I'm a RADIUS newbie, so bear with me in case I ask stupid questions.... So here is a short description of what my project would needs to do: - every user can login via WIFI or LAN(public computer) - he can use wifi 24h/day - he can use public pc only 1h/day if he's authorized by default and he can extend the use if needed Logging is now working and users can log in, so one thing done:) Current problems: - how to not limit session-timeout for wifi and limit for public computers. All users have only 1 login name. I guess my best bet is some scripting with unlang?

2 4

FR 2.2.5 build fail on ubuntu saucy
by Fajar A. Nugraha 20 May '14

20 May '14

While updating freeradius stable ppa, I found a strange error on ubuntu saucy. This is low priority, just wondering whether anyone got this error before or found a way to fix this. libtool: link: gcc -o .libs/rlm_dbm_parser .libs/rlm_dbm_parser.o /build/buildd/freeradius-2.2.5/src/lib/.libs/libfreeradius-radius.so -lgdbm_compat -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-rpath -Wl,/usr/lib/freeradius /build/buildd/freeradius-2.2.5/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_getspecific' /build/buildd/freeradius-2.2.5/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_key_create' /build/buildd/freeradius-2.2.5/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_once' /build/buildd/freeradius-2.2.5/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_setspecific' collect2: error: ld returned 1 exit status make[7]: *** [rlm_dbm_parser] Error 1 Full log (which includes configure line invoked by debian/rules, as well as gcc versions) here: https://launchpadlibrarian.net/175869042/buildlog_ubuntu-saucy-amd64.freera… The strange thing is that trusty (which is newer) and precise (which is older than precise) can build the same recipe succesfully. Full log for trusty https://launchpadlibrarian.net/175868642/buildlog_ubuntu-trusty-amd64.freer… , while for precise https://launchpadlibrarian.net/175869076/buildlog_ubuntu-precise-amd64.free… . Upon a glance, the link command line is exactly the same. I'm inclined to believe that this is gcc 4.8.1 bug in saucy (precise uses 4.6.3, while trusty 4.8.2). -- Fajar

1 1

RE: VSA attributes sent with Access-Reject response
by Alan Buxey 20 May '14

20 May '14

Put all into in one email. You think I kept your old email, or want to visit mailing list archive to dig it up? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 1