September 2014 - Freeradius-Users - lists.freeradius.org

rlm_perl multiple processes/threads behavior
by Nick Rogers 19 Sep '14

19 Sep '14

Hello, I am hoping someone can clarify some questions I have about how rlm_perl should behave in FreeRADIUS 2.2.5 with respect to multiple instances and freeradius threads. I know there has been some discussion and changes/fixes to this behavior over the years, and I've been using rlm_perl successfully for nearly the last decade. Previously rlm_perl had its own "thread" pool, where multiple instances of the perl process would run simultaneously. Now I understand that rlm_perl uses the same freeradius thread management that everything else does. My problem is that my freeradius rlm_perl installation no longer spawns multiple instances of the perl process, effectively causing my server to be single threaded, which has begun to cause performance issues at some of my larger sites with increased load. I do not have perl with multiplicity or ithreads compiled, as this causes issues with other perl applications running on the same server. My question is, is there a way to support multiple instances of the rlm_perl interpreter without having ithreads or multiplicity compiled with perl? Is there a way for freeradius to simply launch a perl process for every freeradius server thread, instead of all threads relying on the same rlm_perl process? I am not interested in using perl threads or having multiple perl interpreters within the same perl process. I would really appreciate some clarification if this is possible or not. Thanks! -Nick

3 7

Re: Freeradius Queries
by Arran Cudbard-Bell 18 Sep '14

18 Sep '14

> Fine I will go through the code thoroughly now. Good luck. As Alan said, if you have a specific need to modify the code then tell us what it is and we can advise you on the best way to achieve what you want. > One question that I have is how AVPs (Attribute Value Pairs) are stored in memory in freeradius. http://doc.freeradius.org/libradius_8h.html#structVALUE__PAIR They're stored in the above structure, and alloced on the heap at run time. They're parented from either the REQUEST struct, or from a RADIUS_PACKET struct to ensure they're cleaned up when the REQUEST is freed. Fixed length values are stored in the value_data_t union, octets, text and tlv attributes have dynamically allocated buffers parented off the VALUE_PAIR. These buffers are pointed to by the value_data_t union. VALUE_PAIRs are always allocated with pairalloc, and are freed using talloc_free or pairfree (if you need to free a linked list of AVPs). The vendor, number and type of attributes are in the DICT_ATTR struct. These are usually allocated on startup when reading the config and dictionaries. The da field of the VALUE_PAIR struct points to a DICT_ATTR struct. VALUE_PAIR (text, octets, tlv) buffers should be considered immutable. If a new value needs to be assigned, the old buffer is freed and a new one allocated. talloc_free performs all necessary cleanup for VALUE_PAIRs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

help! Windows Phone8.1 access authentication failed
by Farrell Yang 18 Sep '14

18 Sep '14

I'm running FreeRADIUS Version 2.2 and Mysql for VPN access authentication on ubuntu 14.04, the Windows Phone8.1 clients send username as *Windows Phone\username*, the Mysql radcheck table doesn't include *Windows Phone\*, so access authentication failed. I 've googled this issue, and haven't found anything that worked. I have tried the methods in this post: http://lists.freeradius.org/pipermail/freeradius-users/2011-March/052650.ht…, but problem still exists.

3 2

Re: Freeradius Queries
by Himanshu Pandey 18 Sep '14

18 Sep '14

Hi Alan, Fine I will go through the code thoroughly now. One question that I have is how AVPs (Attribute Value Pairs) are stored in memory in freeradius. Thanks & Regards,Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Thu, 18 Sep 2014 21:46:11 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Queries Himanshu Pandey wrote: > If you could please answer the following 3 questions, it would be of > great help:  What helps more is to read the code.  I'm sorry, but this list isn't the palce to learn C programming. Anyone familiar with C programming should be able to read the code, and understand what it's doing.  If you're just trying to understand the code for fun, you need to figure it out yourself.  If you're doing it because you need to write some patches, describe the goal, and ask how to implement it.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: using userPassword instead sambaNTPassword
by Nicolás Guerra 18 Sep '14

18 Sep '14

this is the server log output: # radiusd -X > log.radius I don't understand what "**WARNING: No "known good" password was found in LDAP. Are you sure that *the **user is configured correctly?*" means? what is freeradius expecting from the openldap user's configuration? and, why if I enter sambaNTPassword works fine? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.202.10.93 port 60123, id=47, length=165 User-Name = "nicolas.guerra" Called-Station-Id = "A0-F3-C1-CF-E3-06:OpenWrt" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "CC-FE-3C-92-E0-1B" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x02dc0013016e69636f6c61732e677565727261 Message-Authenticator = 0xb415d249f91323467312cdea8bd9ff84 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "nicolas.guerra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 220 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for nicolas.guerra [ldap] expand: (uid=%u) -> (uid=nicolas.guerra) [ldap] expand: ou=People,ou=Users,dc=asse -> ou=People,ou=Users,dc=asse [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap:389, authentication 0 [ldap] bind as / to ldap:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,ou=Users,dc=asse, with filter (uid=nicolas.guerra) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... *WARNING: No "known good" password was found in LDAP. Are you sure that the **user is configured correctly?** *[ldap] user nicolas.guerra authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop *[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.** *++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 47 to 10.202.10.93 port 60123 EAP-Message = 0x01dd001604107fe91282f5b1fe93fa0490f7444fb1f6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x02a12214027c2680a4308d96285f86cc Finished request 0. any help woould be wellcome, Sds Nicolas.

2 1

Re: Freeradius Queries
by Alan DeKok 18 Sep '14

18 Sep '14

Himanshu Pandey wrote: > If you could please answer the following 3 questions, it would be of > great help: What helps more is to read the code. I'm sorry, but this list isn't the palce to learn C programming. Anyone familiar with C programming should be able to read the code, and understand what it's doing. If you're just trying to understand the code for fun, you need to figure it out yourself. If you're doing it because you need to write some patches, describe the goal, and ask how to implement it. Alan DeKok.

1 0

Re: Freeradius Queries
by Himanshu Pandey 18 Sep '14

18 Sep '14

Dear Alan, Thanks for the response. If you could please answer the following 3 questions, it would be of great help:I am not able to understand these concepts. 1. What is the role of configuration item linked list? 2. How is the linked list and Red-Black trees associated with each other.3. How the structures conf_item and conf_part are related to each other struct conf_item {         struct conf_item *next;         struct conf_part *parent;         int lineno;         const char *filename;         CONF_ITEM_TYPE type;     }; struct conf_part {         CONF_ITEM item;         const char *name1;         const char *name2;         struct conf_item *children;         struct conf_item *tail; /* for speed */         CONF_SECTION    *template;         rbtree_t        *pair_tree; /* and a partridge.. */         rbtree_t        *section_tree; /* no jokes here */         rbtree_t        *name2_tree; /* for sections of the same name2 */         rbtree_t        *data_tree;         void            *base;         int depth;         const CONF_PARSER *variables; }; Thanks in advance.Regards,Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Thu, 18 Sep 2014 19:07:48 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Queries Himanshu Pandey wrote: > I am very new to freeradius and right now I am going through the code of >  freeradius. I am facing problem to understand a couple of concepts. > They are: > > 1. What is the overall architecture of Freeradius?  Complicated.  We don't really have an architecture diagram.  For detailed API docs, see http://doc.freeradius.org/  As for the rest of your questions, they are both too vague and too specific.  The main reason to ask questions is to solve a particular problem.  You're asking a series of vague questions "how does it work", along with detailed questions "why is it done this way".  They're all nice questions, but they can usually be answered by reading the source.  The code is VERY well commented.  I see no reason to cut & paste those comments here.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius Queries
by Alan DeKok 18 Sep '14

18 Sep '14

Himanshu Pandey wrote: > I am very new to freeradius and right now I am going through the code of > freeradius. I am facing problem to understand a couple of concepts. > They are: > > 1. What is the overall architecture of Freeradius? Complicated. We don't really have an architecture diagram. For detailed API docs, see http://doc.freeradius.org/ As for the rest of your questions, they are both too vague and too specific. The main reason to ask questions is to solve a particular problem. You're asking a series of vague questions "how does it work", along with detailed questions "why is it done this way". They're all nice questions, but they can usually be answered by reading the source. The code is VERY well commented. I see no reason to cut & paste those comments here. Alan DeKok.

1 0

About copy-acct-to-home-server
by Tiago 18 Sep '14

18 Sep '14

Hello, I need to do an integration with Fortigate appliance. Basically, I need to send a copy of Account-Request Class attribute +UserName to Fortigate (so I can enable a Fortigate feature for that customer authenticating). So, I'm trying to use the detail file (I did the most basic setup I think, with minimum changes on proxy.conf and copy-acct-to-home-server file). It worked fine, except it seems that is sending auth+acct packets instead of acct packets only. >From what I understood, the realm NULL: realm NULL { accthost = 192.168.250.2:1813 secret = ########## } Would do it fine for my case (considering the usernames exchanged), but I'm not sure how can limit only acct packets for it, or if I need to do this on a different way. Thanks for the great software.

3 7

Freeradius Queries
by Himanshu Pandey 18 Sep '14

18 Sep '14

Hi Friends, I am very new to freeradius and right now I am going through the code of  freeradius. I am facing problem to understand a couple of concepts. They are: 1. What is the overall architecture of Freeradius?2. Do we have separate Pair,Data and Section trees? If yes then how are they related with each other.3. What is the role of configuration item linked list?4. How is the linked list and Red-Black trees associated with each other.5. Which nodes shall be marked as Red and which nodes shall be marked as Black. What is the relationship between them?6. How the structures conf_item and conf_part are related to each otherstruct conf_item {        struct conf_item *next;        struct conf_part *parent;        int lineno;        const char *filename;        CONF_ITEM_TYPE type;    }; struct conf_part {        CONF_ITEM item;        const char *name1;        const char *name2;        struct conf_item *children;        struct conf_item *tail; /* for speed */        CONF_SECTION    *template;        rbtree_t        *pair_tree; /* and a partridge.. */        rbtree_t        *section_tree; /* no jokes here */        rbtree_t        *name2_tree; /* for sections of the same name2 */        rbtree_t        *data_tree;        void            *base;        int depth;        const CONF_PARSER *variables;}; 7. In function cf_item_add(CONF_SECTION *cs, CONF_ITEM *ci)What this piece of code does?for (/* nothing */; ci != NULL; ci = ci->next) {                cs->tail = ci; 8. What these function call means?cf_itemtopair(ci);cf_itemtosection(ci);cf_itemtodata(ci); I request you to please help me in understanding the concepts. Regards,Sonu Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More >

1 0