June 2015 - Freeradius-Users - lists.freeradius.org

permit access on date/hour intervals and policy.conf problem
by Franz Angeli 04 Jun '15

04 Jun '15

Hi, I need to be able to specify an interval of date and time for accessing through a captive portal connected to freeradius; for example testuser can use network from 2015-05-01 17:00:00 to 2015-05-01 18:00:00 i create 3 custom attributes: ATTRIBUTE System-Date 3002 integer ATTRIBUTE Start_Time 3000 integer ATTRIBUTE Stop_Time 3001 integer System-Date to store system data Start_Time to assign a start auth period for user Stop_Time to assign the end of auithentication permission. I use UNIX time for every attribute for provisioning purpose i use Freeradius + MySQL and in my radcheck table i have for example: testuser | Cleartext-Password | := | testuser testuser | Start_Time | := | 1430499600 testuser | Stop_Time | := | 1430503200 to check account validity i add on policy.conf : check_validity { update control { System-Date := "%l" } if (Start_Time > control:System-Date) { update reply { Reply-Message := "account not yet active" } reject } if (Stop_Time < control:System-Date) { update reply { Reply-Message := "account no longer active" } reject } } freeradius start without error, System-Date take the correct value for Date but Start_Time and Stop_Time in this way seems to work with a file not mysql...(yes my default site has check_validity in authorize section) I don't know how use a query to assign database stored value for Start_Time and Stop_TIme, is it possbile? I need some examples... Thanks in advance Franz Angeli

2 12

Freeradius slow start
by absolutely_free＠libero.it 04 Jun '15

04 Jun '15

Hi, I am using freeradius 2.0.4 (official deb package) - unfortunately, this is a very old server with Debian 5. It's a VMware virtual machine with 3 GB ram and 4 vCPU. I noticed that freeradius take very long time to start. Here is strace output of starting pid: # strace -p 3889 Process 3889 attached - interrupt to quit brk(0x12cba000) = 0x12cba000 brk(0x12cdb000) = 0x12cdb000 brk(0x12cfc000) = 0x12cfc000 brk(0x12d1d000) = 0x12d1d000 brk(0x12d3e000) = 0x12d3e000 brk(0x12d5f000) = 0x12d5f000 brk(0x12d80000) = 0x12d80000 brk(0x12da1000) = 0x12da1000 brk(0x12dc2000) = 0x12dc2000 brk(0x12de3000) = 0x12de3000 brk(0x12e04000) = 0x12e04000 brk(0x12e25000) = 0x12e25000 munmap(0xb6caa000, 1052672) = 0 brk(0x12e46000) = 0x12e46000 time(NULL) = 1433373461 brk(0x12e6b000) = 0x12e6b000 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(0, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(1, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(2, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(2, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(2, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(2, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(18, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(18, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(19, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(19, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 brk(0x12e8c000) = 0x12e8c000 brk(0x12ead000) = 0x12ead000 brk(0x12ece000) = 0x12ece000 brk(0x12eef000) = 0x12eef000 brk(0x12f10000) = 0x12f10000 brk(0x12f31000) = 0x12f31000 mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x b6e6d000 brk(0x12f52000) = 0x12f52000 brk(0x12f73000) = 0x12f73000 brk(0x12f94000) = 0x12f94000 brk(0x12fb5000) = 0x12fb5000 brk(0x12fd6000) = 0x12fd6000 brk(0x12ff7000) = 0x12ff7000 mremap(0xb6e6d000, 135168, 266240, MREMAP_MAYMOVE) = 0xb6e2c000 brk(0x13018000) = 0x13018000 brk(0x13039000) = 0x13039000 brk(0x1305a000) = 0x1305a000 brk(0x1307b000) = 0x1307b000 brk(0x1309c000) = 0x1309c000 brk(0x130bd000) = 0x130bd000 brk(0x130de000) = 0x130de000 brk(0x130ff000) = 0x130ff000 brk(0x13120000) = 0x13120000 brk(0x13141000) = 0x13141000 brk(0x13162000) = 0x13162000 brk(0x13183000) = 0x13183000 brk(0x131a4000) = 0x131a4000 mremap(0xb6e2c000, 266240, 528384, MREMAP_MAYMOVE) = 0xb6dab000 brk(0x131c5000) = 0x131c5000 brk(0x131e6000) = 0x131e6000 brk(0x13207000) = 0x13207000 ... ... (many similar lines) brk(0x1f12d000) = 0x1f12d000 brk(0x1f14e000) = 0x1f14e000 brk(0x1f16f000) = 0x1f16f000 munmap(0xb6caa000, 1052672) = 0 time(NULL) = 1433373478 open("/usr/lib/freeradius/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such fi le or directory) open("/lib/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such file or directory ) open("/usr/lib/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such file or direc tory) open("/lib/i486-linux-gnu/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such fi le or directory) open("/usr/lib/i486-linux-gnu/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No suc h file or directory) open("/usr/local/lib/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such file or directory) access("/usr/lib/freeradius/rlm_acct_unique.so", R_OK) = 0 open("/usr/lib/freeradius/rlm_acct_unique.so", O_RDONLY) = 9 read(9, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\7\0\0004\0\0\0\\"..., 512) = 512 fstat64(9, {st_mode=S_IFREG|0644, st_size=6508, ...}) = 0 mmap2(NULL, 9340, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 9, 0) = 0xb6e8 b000 mmap2(0xb6e8d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRIT E, 9, 0x1) = 0xb6e8d000 close(9) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, chil d_tidptr=0xb71976f8) = 3940 exit_group(0) = ? Process 3889 detached Since I notice a very high load on this server (freeradius seems to be to root cause, according to top), I'm looking for some help. Thank you

2 1

Re: Openwrt Sqlite No Write Radacct Table
by bruno d'ambrosio 03 Jun '15

03 Jun '15

Hi Jorge On which version openwrt, sqlite work with freeradius? Best regard Bruno D'Ambrosio ----- Reply message ----- Da: "Jorge Pereira" <jpereiran(a)gmail.com> A: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Oggetto: Openwrt Sqlite No Write Radacct Table Data: gio, giu 4, 2015 00:51 Bruno, this version hás problem. Got it? You need to upgrade. Only this will works. Em 03/06/2015 19:45, "Bruno D'Ambrosio" <brunodambrosio2011(a)hotmail.it> escreveu: > Hi Arran > > Can you help me make it work? > Missing some piece of code to write the query in the database "Sqlite"? > > Best Regard > Bruno D'Ambrosio > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Openwrt Sqlite No Write Radacct Table
by Bruno D'Ambrosio 03 Jun '15

03 Jun '15

Hi Arran Can you help me make it work? Missing some piece of code to write the query in the database "Sqlite"? Best Regard Bruno D'Ambrosio

2 1

Re: Openwrt Sqlite No Write Radacct Table
by Bruno D'Ambrosio 03 Jun '15

03 Jun '15

You can not use it in the version of FreeRADIUS 2?there is a chance to do something? Best Regard Bruno D'Ambrosio

3 2

Openwrt Sqlite No Write Radacct Table
by Bruno D'Ambrosio 03 Jun '15

03 Jun '15

Hi Mate It is for days that I can not solve the problem in subject. I installed "*freeradius****2.2.0-1*" with mod "*sqlite3*" system "*OpenWRT*" version "*attitude_adjustment****/ 12.09*" but after you configure the following files: *- /Sql.conf/** **-/Dialup.conf/** **-/Radius.conf /** **-//Sites/Defaulft/* running the test: *- echo*"Acct-Status-Type=Start,Acct-Session-Id=testing,NAS-IP-Address=127.0.0.1,Client-IP-Address=127.0.0.1,Acct-Unique-Session-Id=test" *|* radclient -c 1 -r 2 -t 1 -x 127.0.0.1 acct testing123 *The table "RADACCT" is not updated.* Below is a small code query written by me, to check a evenutale writing: - *accounting_start_query = "INSERT INTO radacct (radacctid, acctsessionid, acctuniqueid, nasipaddress) \** ** values ('18', 'testing', '5debd18abc4f9899', '127.0.0.1');"* Here's the code of the original query file "Diaulp.conf" (MySQL): *- accounting_start_query = " \** ** INSERT INTO ${acct_table1} \** ** (acctsessionid, acctuniqueid, username, \** ** realm, nasipaddress, nasportid, \** ** nasporttype, acctstarttime, acctstoptime, \** ** acctsessiontime, acctauthentic, connectinfo_start, \** ** connectinfo_stop, acctinputoctets, acctoutputoctets, \** ** calledstationid, callingstationid, acctterminatecause, \** ** servicetype, framedprotocol, framedipaddress, \** ** acctstartdelay, acctstopdelay, xascendsessionsvrkey) \** ** VALUES \** ** ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \** ** '%{SQL-User-Name}', \** ** '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \** ** '%{NAS-Port-Type}', '%S', NULL, \** ** '0', '%{Acct-Authentic}', '%{Connect-Info}', \** ** '', '0', '0', \** ** '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \** ** '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \** ** '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" */You can kindly help me solve this problem?/**/THANKS./* * /Best Regards// //Bruno D'Ambrosio./* *

3 3

Suggestions for a high-scalability
by Jorge Pereira 03 Jun '15

03 Jun '15

Hi people, Nowadays we have two instances of FreeRadius using the latest 3.0.8 that it's configured set to InstanceA and InstanceB and the NAS servers have configured each instance like a redundance/fail-over. But it's expected more then 1 million of connections by day in the next month. And I would like to hear suggestions about what I can do to improve the services. Advices and suggestions are welcome! -- Jorge Pereira

2 1

Use dialup admin to authenticate with certificate
by rints harry 03 Jun '15

03 Jun '15

Hi, Help me how to configure dialup admin or another webgui when I use certificate to authenticate client. I want know a list of user connected , at what NAS. I know it s possible because I see these informations when I use radiusd -X Thx

1 0

Freeradius slowness in response time
by Mohd Alkhaldi 03 Jun '15

03 Jun '15

Hi, We are facing slowness in Freeradius(2.2.0) response time on authentication requests, it is running on Solaris 10, Some times it take from FR more than 15 sec to response to simple authentication request, back end is Oracle 10g DB, radius.log keep showing the following Warning: : Error: Discarding duplicate request from client fr_client port 51184 - ID: 180 due to unfinished request 35061633 : Error: Discarding duplicate request from client fr_client port 51184 - ID: 208 due to unfinished request 35061688 : Error: Discarding duplicate request from client fr_clientport 51184 - ID: 39 due to unfinished request 35061734 : Info: WARNING: Child is hung for request 35050073 in component <core> module . : Info: WARNING: Child is hung for request 35049865 in component <core> module . : Info: WARNING: Child is hung for request 35050073 in component <core> module . : Info: WARNING: Child is hung for request 35049865 in component <core> module . : Info: WARNING: Child is hung for request 35050073 in component <core> module . Do you have any idea what can we do to fix this issue and enhance response time. Thanks Alwad

5 5

Fallback method of authentication
by Rafael Domingues Quitério 03 Jun '15

03 Jun '15

Hi everybody; I have installed FreeRADIUS Version 3.0.7 from source and it's doing machine authentication on a Windows domain. The radius server is a samba member. The place doesn't have a DC, so, the radius authentication is done to a remote DC. If the WAN link to the DC site fails, machine authentication on the Freradius server will fail. Because of that , I'm considering having a fallback method for authentication (files) when the link goes down. Is that possible to implement via the configuration files? Could somebody give me hints to achieve that. Thanks very much for the help. Rafael

2 3