March 2015 - Freeradius-Users - lists.freeradius.org

questions about 3.0.7 under load using file listen server
by adrian.p.smith＠bt.com 19 Mar '15

19 Mar '15

We are running 3.0.7 and writing packets to a file to be read by a detail server. We find that, when the server is under a lot of client load the detail server stops working. When the load reduces, the detail server resumes sending packets. Is this a deliberate design? We didn't see that with earlier versions. Perhaps there is some config we can adjust? Thanks in advance. Adrian

2 1

pre-proxy ?
by Olivier CALVANO 19 Mar '15

19 Mar '15

Hi I am new in Freeradius and i am search a small help. - I receive a Radius Access request of the radius of my supplier. this Radius have the ip address 192.168.10.100 - Based on the realm, i forward the request to my customer. i want add in the process a action before sent the request to my customer. Actually i have: in proxy.conf home_server rad-auth-primaire-1.customer_realm.myrealm { type = auth ipaddr = 172.16.1.1 port = 1812 secret = password require_message_authenticator = yes response_window = 20 zombie_period = 40 status_check = status-server check_interval = 20 num_answers_to_alive = 3 } home_server_pool pool-auth.customer_realm.myrealm { type = fail-over home_server = rad-auth-primaire-1.customer_realm.myrealm home_server = rad-auth-secondaire-1.customer_realm.myrealm } realm "~(customer_realm.myrealm)" { auth_pool = pool-auth.customer_realm.myrealm nostrip } i want add this action: Before sent the access request to my customer, i want that my radius answer to the radius server of my supplier a Access-Accept with a: Tunnel-Server-Endpoint:0 = "172.17.10.250" With this information, my supplier sent the tunnel to 172.17.10.250, it's a Cisco router, when i receive the tunnel he sent a access request to my radius and i want that my radius forward the request to the radius server of my customer with a : NAS-IP-Address = 172.17.10.250 It's possible ? CPE Customer ==> My_Cisco_172.17.10.250 ==> Cisco of my Customer (replied in radius tunnel end point) I don't know what file i modify for this, policy.conf ? other ? very very new ;=) thanks for your help Olivier

2 8

VLAN assignment with Certificate attributes
by Gérold Mougenel 19 Mar '15

19 Mar '15

Hi, I'm running freeradius 3.0.6. I'm already able to assign a VLAN to the port when my client is authenticated with a couple login/password but is it possible to be done when the client is authenticated via a certificate ? I can't find any ressources on the subject. Thank's for help. *MOUGENEL Gérold* Tel : 06.71.58.47.57

4 9

errors after migration
by Brian 19 Mar '15

19 Mar '15

Hello, I recently migrated my Radius server to a new machine but it's giving me errors now when I try to start it. I had to change permissions in /etc/raddb to 755 in order to get it to start (even 750 wouldn't work) but I know that isn't an ideal long-term solution. I am on CentOS 6.5 with FreeRadius version 2.1.12. Thanks in advance. Wed Mar 18 11:34:55 2015 : Error: rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied Wed Mar 18 11:34:55 2015 : Error: rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem Wed Mar 18 11:34:55 2015 : Error: rlm_eap: Failed to initialize type tls Wed Mar 18 11:34:55 2015 : Error: /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Wed Mar 18 11:34:55 2015 : Error: /etc/raddb/sites-enabled/default[310]: Failed to load module "eap". Wed Mar 18 11:34:55 2015 : Error: /etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Wed Mar 18 11:34:55 2015 : Error: Failed to load virtual server <default>

2 2

sql or radtmp - which best?
by Marcin 19 Mar '15

19 Mar '15

Hi, I starting with freeradius 2.4 with flat files. I've heard that freeradius with flat files works faster than works with sql (postgres or mysql). Which should i chose to accounting users, sql or files? maybye both? In some documents I've read that accountigs should be stored with two tables. one table to online sessions and second table to archive data, but how to split it? In that case when client disconnects i should use two questions to database with different tables, one to delete online sessions and second to insert data to "archive" table. but when we use database we should replicate data, how to synchronize databases? What are the best practices to store users, nas and accounting data, sql or files? -- Pozdrawiam Marcin / nicraM

2 1

Traffic Volume Limit per Month cannot exceed 4Gbytes
by chenjiang 19 Mar '15

19 Mar '15

Hi! Experts I want to achieve user traffic volume limit per month, but found there is a limit for user traffic to exceed 4Gbytes. Below is my DB structure, you could see the "Max-Monthly-Trafficâ groupcheck attribute is 10Gbytes and it type is âvarchar", but it seems system deal it like a âinteger" type, so it cannot exceed 4Gbytes. mysql> desc radgroupcheck; +-----------+------------------+------+-----+---------+---------------- + | Field | Type | Null | Key | Default | Extra | +-----------+------------------+------+-----+---------+---------------- + | id | int(11) unsigned | NO | PRI | NULL | auto_increment | | groupname | varchar(64) | NO | MUL | | | | attribute | varchar(64) | NO | | | | | op | char(2) | NO | | == | | | value | varchar(253) | NO | | | | +-----------+------------------+------+-----+---------+---------------- + 5 rows in set (0.00 sec) mysql> select * from radgroupcheck; +----+--------------------+-----------------------+----+------------+ | id | groupname | attribute | op | value | +----+--------------------+-----------------------+----+------------+ | 1 | disabled | Auth-Type | := | Reject | | 25 | group2 | Max-Monthly-Traffic | := | 10737418240| | 33 | microshield | Acct-Interim-Interval | := | 300 | +----+--------------------+-----------------------+----+------------+ 3 rows in set (0.00 sec) In FreeRADIUS debug mode, we could see that the rlm_sqlcounter âcheck_itemâ is always warpped in 4294967296 just like below: [monthlytrafficcounter] expand: %{sql:SELECT SUM(acctinputoctets+acctoutputoctets) FROM radacct WHERE username='lichan' AND UNIX_TIMESTAMP(acctstarttime) > '1425139200'} -> 7250810110 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user lichan, check_item=2147483648, counter=3955842814 ++[monthlytrafficcounter] returns reject And this always leads users been rejected in authentication procedure. Do you have any experience in this and could shed some light? Thanks for your great help! BR! Chen Jiang Microshield Technology Co., Ltd åäº¬å¸æµ·æ·åºè¥¿ä¸ç¯åè·¯50å·è±ªæå¤§å¦C2åº§18-19å± 100048 (86)10-88518768 (86)18612696123 [1]chenjiang(a)microshield.com.cn References 1. mailto:chenjiang@microshield.com.cn

2 1

Re: Segmentation fault after [peap] Using saved attributes from theoriginal Access-Accept
by chenjiang 19 Mar '15

19 Mar '15

Hi! Experts I want to achieve user traffic volume limit per month, but found there is a limit for user traffic to exceed 4Gbytes. Below is my DB structure, you could see the "Max-Monthly-Trafficâ groupcheck attribute is 10Gbytes and it type is âvarchar", but it seems system deal it like a âinteger" type, so it cannot exceed 4Gbytes. mysql> desc radgroupcheck; +-----------+------------------+------+-----+---------+---------------- + | Field | Type | Null | Key | Default | Extra | +-----------+------------------+------+-----+---------+---------------- + | id | int(11) unsigned | NO | PRI | NULL | auto_increment | | groupname | varchar(64) | NO | MUL | | | | attribute | varchar(64) | NO | | | | | op | char(2) | NO | | == | | | value | varchar(253) | NO | | | | +-----------+------------------+------+-----+---------+---------------- + 5 rows in set (0.00 sec) mysql> select * from radgroupcheck; +----+--------------------+-----------------------+----+------------+ | id | groupname | attribute | op | value | +----+--------------------+-----------------------+----+------------+ | 1 | disabled | Auth-Type | := | Reject | | 25 | group2 | Max-Monthly-Traffic | := | 10737418240| | 33 | microshield | Acct-Interim-Interval | := | 300 | +----+--------------------+-----------------------+----+------------+ 3 rows in set (0.00 sec) In FreeRADIUS debug mode, we could see that the rlm_sqlcounter âcheck_itemâ is always warpped in 4294967296 just like below: [monthlytrafficcounter] expand: %{sql:SELECT SUM(acctinputoctets+acctoutputoctets) FROM radacct WHERE username='lichan' AND UNIX_TIMESTAMP(acctstarttime) > '1425139200'} -> 7250810110 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user lichan, check_item=2147483648, counter=3955842814 ++[monthlytrafficcounter] returns reject And this always leads users been rejected in authentication procedure. Do you have any experience in this and could shed some light? Thanks for your great help! BR! Chen Jiang Microshield Technology Co., Ltd åäº¬å¸æµ·æ·åºè¥¿ä¸ç¯åè·¯50å·è±ªæå¤§å¦C2åº§18-19å± 100048 (86)10-88518768 (86)18612696123 [1]chenjiang(a)microshield.com.cn References 1. mailto:chenjiang@microshield.com.cn

1 0

Segmentation fault after [peap] Using saved attributes from the original Access-Accept
by tom greisch 19 Mar '15

19 Mar '15

Hi together, the first Authentication of a User works fine. If there is a Request for the same User (in a short time intervall) i get the following message "[peap] Using saved attributes from the original Access-Accept". After this Message i get a Segmentation Fault. Any Ideas ? freeradius Version: 2.2.5 (compiled with--with-experimental-modules) OS Version: Debian 8 (Jessie) Output from valgrind: ====================== # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept User-Name = "anonymous" ==46641== Invalid read of size 8 ==46641== at 0x4E4B7E5: pairadd (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x7D32618: eaptls_gen_mppe_keys (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D31257: eaptls_success (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7B26FAB: eaptype_call (eap.c:175) ==46641== by 0x7B2745D: eaptype_select (eap.c:409) ==46641== by 0x7B26A8C: eap_authenticate (rlm_eap.c:327) ==46641== by 0x41C07C: call_modsingle (modcall.c:305) ==46641== by 0x41C07C: modcall_recurse (modcall.c:579) ==46641== by 0x41B9C8: modcall_child (modcall.c:423) ==46641== by 0x41BC68: modcall_recurse (modcall.c:628) ==46641== by 0x41C819: modcall (modcall.c:877) ==46641== by 0x41AD29: indexed_modcall (modules.c:750) ==46641== by 0x40A4EF: rad_check_password (auth.c:382) ==46641== by 0x40A4EF: rad_authenticate (auth.c:667) ==46641== Address 0x70 is not stack'd, malloc'd or (recently) free'd ==46641== ==46641== ==46641== Process terminating with default action of signal 11 (SIGSEGV) ==46641== Access not within mapped region at address 0x70 ==46641== at 0x4E4B7E5: pairadd (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x7D32618: eaptls_gen_mppe_keys (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D31257: eaptls_success (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7B26FAB: eaptype_call (eap.c:175) ==46641== by 0x7B2745D: eaptype_select (eap.c:409) ==46641== by 0x7B26A8C: eap_authenticate (rlm_eap.c:327) ==46641== by 0x41C07C: call_modsingle (modcall.c:305) ==46641== by 0x41C07C: modcall_recurse (modcall.c:579) ==46641== by 0x41B9C8: modcall_child (modcall.c:423) ==46641== by 0x41BC68: modcall_recurse (modcall.c:628) ==46641== by 0x41C819: modcall (modcall.c:877) ==46641== by 0x41AD29: indexed_modcall (modules.c:750) ==46641== by 0x40A4EF: rad_check_password (auth.c:382) ==46641== by 0x40A4EF: rad_authenticate (auth.c:667) ==46641== If you believe this happened as a result of a stack ==46641== overflow in your program's main thread (unlikely but ==46641== possible), you can try to increase the size of the ==46641== main thread stack using the --main-stacksize= flag. ==46641== The main thread stack size used in this run was 8388608. ==46641== ==46641== HEAP SUMMARY: ==46641== in use at exit: 2,789,061 bytes in 54,399 blocks ==46641== total heap usage: 113,115 allocs, 58,716 frees, 7,949,363 bytes allocated ==46641== ==46641== 312 bytes in 1 blocks are possibly lost in loss record 1,029 of 1,259 ==46641== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==46641== by 0x4E4B496: pairalloc (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x4E4CBBB: pairmake (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x7D32487: ??? (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D32618: eaptls_gen_mppe_keys (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D31257: eaptls_success (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7B26FAB: eaptype_call (eap.c:175) ==46641== by 0x7B2745D: eaptype_select (eap.c:409) ==46641== by 0x7B26A8C: eap_authenticate (rlm_eap.c:327) ==46641== by 0x41C07C: call_modsingle (modcall.c:305) ==46641== by 0x41C07C: modcall_recurse (modcall.c:579) ==46641== by 0x41B9C8: modcall_child (modcall.c:423) ==46641== by 0x41BC68: modcall_recurse (modcall.c:628) ==46641== ==46641== LEAK SUMMARY: ==46641== definitely lost: 0 bytes in 0 blocks ==46641== indirectly lost: 0 bytes in 0 blocks ==46641== possibly lost: 312 bytes in 1 blocks ==46641== still reachable: 2,788,749 bytes in 54,398 blocks ==46641== suppressed: 0 bytes in 0 blocks ==46641== Reachable blocks (those to which a pointer was found) are not shown. ==46641== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==46641== ==46641== For counts of detected and suppressed errors, rerun with: -v ==46641== Use --track-origins=yes to see where uninitialised values come from ==46641== ERROR SUMMARY: 14864 errors from 597 contexts (suppressed: 0 from 0) ==46641== could not unlink /tmp/vgdb-pipe-from-vgdb-to-46641-by-root-on-??? ==46641== could not unlink /tmp/vgdb-pipe-to-vgdb-from-46641-by-root-on-??? ==46641== could not unlink /tmp/vgdb-pipe-shared-mem-vgdb-46641-by-root-on-??? Segmentation fault

3 3

radclient port to node.js
by Michele Pangrazzi 19 Mar '15

19 Mar '15

Hi all, this is just to let you know that I’ve done a basic porting of the radclient <http://freeradius.org/radiusd/man/radclient.html> command to node.js <https://nodejs.org/>. Thanks for reading, Michele

1 1

Crash
by Ben Gatewood 18 Mar '15

18 Mar '15

Had a couple of crashes recently with log signature that looks like this: Tue Mar 17 18:36:05 2015 : Error: ASSERT FAILED src/main/connection.c[1085]: pool->active == pool->num CAUGHT SIGNAL: Aborted Backtrace of last 18 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x127)[0x7f6f83c46425] /usr/local/lib/libfreeradius-server.so(rad_assert_fail+0x53)[0x7f6f83ea2a68] /usr/local/sbin/radiusd[0x435c5d] /usr/local/sbin/radiusd(fr_connection_get+0x1d)[0x435e4c] /usr/local/lib/rlm_sql.so(+0x5ec9)[0x7f6f831ecec9] /usr/local/lib/rlm_sql.so(+0x639a)[0x7f6f831ed39a] /usr/local/sbin/radiusd[0x42799c] /usr/local/sbin/radiusd[0x4280f1] /usr/local/sbin/radiusd[0x427b7c] /usr/local/sbin/radiusd[0x428bb9] /usr/local/sbin/radiusd(modcall+0xa1)[0x429923] /usr/local/sbin/radiusd(indexed_modcall+0x2f0)[0x424ec1] /usr/local/sbin/radiusd(process_accounting+0x22)[0x4272cd] /usr/local/sbin/radiusd(rad_accounting+0xea)[0x40e60e] /usr/local/sbin/radiusd[0x43bddd] /usr/local/sbin/radiusd[0x437bee] /lib64/libpthread.so.0[0x3be42079d1] /lib64/libc.so.6(clone+0x6d)[0x3be3ee8b6d] No panic action set _EXIT(1) CALLED src/lib/debug.c[753]. Last error was: Tue Mar 17 19:39:14 2015 : Info: Debugger not attached? What info do you need to diagnose? Thanks, Ben

2 3