August 2014 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 112, Issue 1
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hello Stefano, 2.12 is quite old, and is has several bugs. Why not update it to at least 2.2.5? As for problems, there is a know bug when using mschap in 2.1.12, that often freeradius stops answering requests after a reload when rotating logs. You have to edit /etc/logrotate.d/freeradius and change the reload for a restart if that is your case. Another probable source of cpu/ I/O load is radwtmp and similar files, as they grow and are not rotated per the default configuration. I dont use them, I rely on the (My)SQL data. Hope these tips help you in some way. You are welcome to ask me any questions. Regards, Rui > Message: 7 > Date: Fri, 1 Aug 2014 10:57:48 +0200 > From: Stefano PASCALI <stefano.pascali(a)unisalento.it> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: CPU utilization > Message-ID: <488B69B7-9992-4940-B9D0-04A1DD6CD698(a)unisalento.it> > Content-Type: text/plain; charset=us-ascii > > Hi FR folks, > > I got a strange cpu load on my FR installation. Sometimes CPU utilization > rises to 100% and FR service doesn't respond anymore to the clients. I got > two virtual servers enabled: default and inner-tunnel and their > configurations are the provided ones by the FR installation. > Configuration details in the following: > > OS: Ubuntu server 14.04 > Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 > 2 vcpu > RAM 4GB > > Users on freeradius MySQL (5.x) DB installed on a different virtual host > on the same hosting server. > > Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 > CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores > 2x4 = 8] > RAM 16GiB > > Do you have any ideas to solve my issue? > Hope someone help me. > > Regards > Stefano > >

1 0

migration to rlm_perl with two user domains setup
by Saša Babić 01 Aug '14

01 Aug '14

Hi. My situation: - freeradius 2.1.12 on debian, - eap/ttls setup (eduroam) by someone who doesn't work here any more, - pretty vague understanding of freeradius, I'm affraid, - two separate groups of users (employees and students); user accounts in AD and in Postgresql, - two virtual servers: eduroam & eduroam-inner-tunnel, - each group uses its own domain for authentication (e.g. user(a)example.edu & user(a)sub.example.edu) Right now I have a Ruby script which I planted instead of ntlm_auth (called by eduroam-inner-tunnel) that does the actual work. At the moment, the script accepts non-stripped User-Name, matches the domain and calls the appropriate method. Obviously not the most elegant solution, but it works. Now I want to migrate the script to Perl and use rlm_perl, since it looks like rlm_ruby is not that mature. If I understood correctly the way freeradius/rlm_perl works, the database connection should be set inside a CLONE() subroutine. Since my script connects to two different types of databases (LDAP & Postgresql), I'm thinking that it would be more elegant to use different virtual servers (per domain) with two different scripts. That way each virtual server would call a separate script (or rlm_perl module in the future), and each script could have its own CLONE() subroutine. The confusing part is that eduroam-inner-tunnel virtual server is set in eap.conf in the ttls {} section. Can I do some sort of workflow controll there so that the actual virtual server is determined by the user's domain? Or is there a better way to do it? BTW, I'm planning to migrate to freeradius 3.0.x at the same time, so any hints and/or examples for that version are more then welcome. Thanks. Regards, -- Saša

1 0

problems with reinstallation of deb packages from repositories
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hi, It is just me, or have people noticed problems while creating debs from freeradius.org and upgrading them from (local) repositories? Whilst upgrading with debs from command line (dpkg -i), normally works ok, installing them with apt/aptitude install normally breaks the configuration to a point I have to recover /etc/freeradius from backups to be back on track. I have noticed this since setting up a local apt/deb repository. Has anyone noticed this? Regards, Rui

2 1

Reduce the sleep time?
by khali singh 01 Aug '14

01 Aug '14

Hi I am running a freeradius server that is proxying my requests to another radius server. The other radius server supports a special proble message to indicate to a connecting supplicant that it supports a particular EAP method. IT simply results in a FAILURE to the authentication request indicating that it does support this EAP method and it can try with correct credentials. However, the proxying freeradius server shows : Debug: Waking up in 4.9 seconds. . . . . Debug: Waking up in 103.9 seconds. My question is, how can I reduce these times? I use UDP and not TCP? IS there some configuration that I can change or can I compile my own custom version! Khali

2 1