April 2015 - Freeradius-Users - lists.freeradius.org

3.0.8 struct and function name changes
by unbeliever012000 24 Apr '15

24 Apr '15

I was surprised to find two changes in 3.0.8 which effect C module developers; config_items within the rad_request structure was renamed to config fr_connection_pool_delete was renamed to fr_connection_pool_free I thought 3.0.7 had been tagged as stable and thus the variable and function names were locked to allow developers to migrate. For me this was not a problem, but it is worrying as it makes it more difficult to convince people with their own modules to migrate off of 2.x. Thus I am curious as to if this was a leak from 3.1.x where such changes should be expected? Or is 3.0.8 really the first stable release of 3.0.x and the previous update to the web site was in preparation for it? Geoff

2 1

unlang problem/feature
by Peter Balsianok 24 Apr '15

24 Apr '15

Hi, Is it correct ? May i use %{tolower:&Called-Station-Id} ? Wrong: (0) update request { (0) EXPAND %{Calling-Station-Id}@%{tolower:&Called-Station-Id} (0) --> 421917446704@&called-station-id (0) User-Name := 421917446704@&called-station-id (0) } # update request = noop Thx.

2 1

Freeradius 3.0.7 and multiple buffered-sql servers - detail file issues
by Rygl Aleš 24 Apr '15

24 Apr '15

Hello all. I am trying to migrate the freeradius 2.2.5 to 3.0.7. The server is doing just Acounting request processing and is loading requests to MariaDB with radacct table on InnoDB engine allowing row level locking. There are 128 detail files derived from Calling-Station-Id attribute using mod 128: Queue-Number = "%{expr: %{Calling-Station-Id} %% 128 }" detailfile = ${radacctdir}/detail.mobile/queue-${Queue-Number}/detail-%Y%m%d-%H Then there are 128 buffered-sql servers reading these detail files and feeding the radacct table: server buffered-sql-0 { listen { type = detail filename = "${radacctdir}/detail.mobile/queue-0/detail-*" load_factor = 85 track = yes poll_interval = 5 retry_interval = 30 } preacct { acct_unique } accounting { sql if (noop) { ok } } } . . . server buffered-sql-127 { listen { type = detail filename = "${radacctdir}/detail.mobile/queue-127/detail-*" load_factor = 85 track = yes poll_interval = 5 retry_interval = 30 } preacct { acct_unique } accounting { sql if (noop) { ok } } } This setup is working fine with 2.2.5 version and is very fast. I am able to process more that 1.500 Acct req/s realtime. When I try to use 3.0.7, I am facing some issues: 1. Bad file descriptor message. Looks like it is caused by track = yes config option. When switched to no, it dissapears. What is the problem here? Thu Apr 16 15:58:52 2015 : Warning: Failed marking detail request as done: Bad file descriptor Thu Apr 16 15:58:52 2015 : Warning: Failed marking detail request as done: Bad file descriptor Thu Apr 16 15:58:52 2015 : Warning: Failed marking detail request as done: Bad file descriptor 2. When the server is loaded with ~350 req/s, it is ok. When the load is ~1500 req/s, I can see tons of errors in the log file: Thu Apr 16 16:24:38 2015 : ERROR: (585809) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-58/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585810) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-28/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585811) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-122/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585812) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-102/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585813) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-10/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585814) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-118/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585815) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-0/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585816) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-36/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585817) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-0/detail-2015041616: Too many different filenames Thu Apr 16 16:24:38 2015 : ERROR: (585818) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-32/detail-2015041616: Too many different filename The config: sites-enabled/acct_detail server acct.mobile { listen { ipaddr = * port = 2813 type = acct limit { } } preacct { preprocess acct_unique_mobile } accounting { detail.mobile if (noop) { ok } } } sites-enabled/buffered-sql-mobile-0 server buffered-sql-0 { listen { type = detail filename = "${radacctdir}/detail.mobile/queue-0/detail-*" load_factor = 85 track = no poll_interval = 5 retry_interval = 120 } preacct { } accounting { sql_instance_mobile if (noop) { ok } } } mods-enabled/detail.mobile detail detail.mobile { Queue-Number = "%{expr: %{Calling-Station-Id} %% 128 }" filename = ${radacctdir}/detail.mobile/queue-${Queue-Number}/detail-%Y%m%d%H locking = yes } ./mods-available/sql_ar sql sql_instance_mobile { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "radius" password = "xxxxxxxxxxxxxxx" radius_db = "gprscalls" acct_table1 = "radacct_test" acct_table2 = "radacct_test" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes logfile = ${logdir}/sqllog_mobile.sql pool { start = 128 min = 128 # max = ${thread[pool].max_servers} max = 128 spare = 5 uses = 0 lifetime = 0 idle_timeout = 60 } client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries_mobile.conf } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid max_request_time = 10 cleanup_delay = 5 max_requests = 20000 hostname_lookups = no log { destination = files colourise = yes file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { user = freerad group = freerad allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = 'CVE-2014-0160' } $INCLUDE clients.conf thread pool { start_servers = 512 max_servers = 2000 min_spare_servers = 100 max_spare_servers = 300 max_requests_per_server = 0 auto_limit_acct = no } modules { $INCLUDE mods-enabled/ } instantiate { } policy { $INCLUDE policy.d/ } $INCLUDE sites-enabled/ Thanks With regards Ales

6 30

Linelog
by Franks Andy (IT Technical Architecture Manager) 23 Apr '15

23 Apr '15

Hi all, Just a quick question - just trying out the newest version in the git branch - 3.1.0 (git #390f216). Is there any reason that the default reference in the linelog module is set to: reference = "messages.%{%{Packet-Type}:-default}" I had to change the reference attribute to Reply:Packet-Type to get this to match access-rejects, otherwise it always resolves to Access-Request, I guess because it references the request packet? Thanks Andy

1 0

authentication options
by john espiro 23 Apr '15

23 Apr '15

I installed my certs on my Android phones... it asked for the password for the key, andI was off... just set it to 802.1x TLS and it worked. Now, on my Nook Color, I was able to add my cert, but this time, it only let me choose 802.1x EAP. That's fine I thought, but then it was looking for a username/password for a user in my MySQL database on the radius server. That's fine with me too, but I am trying to understand why that one device was the only one that wanted a username/password. Now, on Ubuntu, if I choose PEAP, it only asks for the cacert plus a use/pass from my mysql database.

3 2

Question regarding redundant-load-balance
by Sebastian Hagedorn 23 Apr '15

23 Apr '15

Hi, we've been using freeradius for many years, but now we're setting up new servers (3.0.8 as of today) and I'm testing configuration options we've never used before. Currently I'm trying to figure out how to achieve maximum resilience using LDAP backends. We're using LDAP the "right" way, i.e. we query for the password during authorize. That works just fine. Here's the problem: I'm trying to use redundant-load-balance like this - I set up separate modules with one LDAP server each: # # The ldap module reads passwords from the LDAP database. # redundant-load-balance { rrzk-ldap-centos rrzk-ldap-mailldap } If both LDAP servers are up when I start radiusd, all is well, even if I stop one of the LDAP servers later. But if one of them is down during startup of radiusd, this happens: # radiusd -X ... rlm_ldap (rrzk-ldap-centos): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (rrzk-ldap-centos): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (rrzk-ldap-centos): Connecting to ldap://redacted:389 rlm_ldap (rrzk-ldap-centos): Could not start TLS: Can't contact LDAP server rlm_ldap (rrzk-ldap-centos): Opening connection failed (0) rlm_ldap (rrzk-ldap-centos): Removing connection pool /etc/raddb/mods-enabled/rrzk-ldap-centos[8]: Instantiation failed for module "rrzk-ldap-centos" # What do I have to do to make freeradius ignore that it can't instantiate the module during startup? Or what else am I doing wrong? Thanks Sebastian -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

2 3

linelog (special character)
by Peter Balsianok 23 Apr '15

23 Apr '15

Hi, Is it possible to use special character 0x00 – 0x0F in linelog (freeradius 3.0.7)? Example: Start = "%l[special character e.g. \n]%{Acct-Status-Type}[special character e.g. \n]%{Acct-Session-Id}[special character e.g. \n]%{User-Name}" Thx.

3 7

Difference in escaping character
by Peter Balsianok 23 Apr '15

23 Apr '15

Hi, I have compared reply attributes between version 2.2.6 & 3.0.8 ( for the same request), i found little difference for Cisco-AVPair attribute (escaping \\n vs \n). Is it correct ? Debug log (version 3.0.8): ... (0) perl: &reply:Cisco-AVPair += $RAD_REPLY{'Cisco-AVPair'} -> 'lcp:interface-config=ip vrf forwarding TOPVAR \nip unnumbered Loopback1' (0) perl: &reply:Cisco-AVPair += $RAD_REPLY{'Cisco-AVPair'} -> 'ip:dns-servers=10.248.136.20 10.18.86.16' ... (0) [perl] = ok (0) } # post-auth = ok (0) Login OK: [421908290143@TOPVAR/<CHAP-Password>] (from client localhost port 2197 cli 421908290143) (0) Sent Access-Accept Id 173 from 127.0.0.1:1812 to 127.0.0.1:36008 length 0 (0) Framed-IP-Netmask = 255.255.255.255 (0) Framed-IP-Address = 172.30.72.54 (0) Cisco-AVPair += 'lcp:interface-config=ip vrf forwarding TOPVAR \\nip unnumbered Loopback1' (0) Cisco-AVPair += 'ip:dns-servers=10.248.136.20 10.18.86.16' (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Finished request Debug log (version 2.2.6): +group post-auth { ... rlm_perl: Added pair Cisco-AVPair = lcp:interface-config=ip vrf forwarding TOPVAR \nip unnumbered Loopback1 rlm_perl: Added pair Cisco-AVPair = ip:dns-servers=10.248.136.20 10.18.86.16 ++[perl] = ok +} # group post-auth = ok Sending Access-Accept of id 3 to 127.0.0.1 port 40061 Cisco-AVPair += "lcp:interface-config=ip vrf forwarding TOPVAR \nip unnumbered Loopback1" Cisco-AVPair += "ip:dns-servers=10.248.136.20 10.18.86.16" Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.30.72.54 Framed-IP-Netmask = 255.255.255.255 Finished request 0. Thank you very much

2 2

debug level
by Peter Balsianok 23 Apr '15

23 Apr '15

Hi, Is it possible to get current debug level in unlang ? Is it possible (in rlm_perl) ? config { debug_level = [get current debug level] } Thx.

2 3

SASL
by Brendan Kearney 22 Apr '15

22 Apr '15

i see that in 3.0.7 SASL binds were introduced and that non-interactive methods are available. does this mean kerberos5 or gssapi methods can be used? does this mean that the keytab i have for the krb5 module can be used by the ldap module to bind to the directory? thanks, brendan

2 3