March 2016 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

RadPerf running in another server.
by Jim 19 Aug '16

19 Aug '16

Hello, I'm currently running FreeRADIUS 3.0.4 on a CentOS server and I wanted to use RadPerf for testing. Since I cannot install RadPerf in CentOS, I installed RadPerf in a separate Ubuntu 14.04 server, my question is: which is better for RadPerf installation? on the same server where FreeRADIUS was installed or different server?

4 4

ram_sql module do not write sql requests into log file
by Laurent Bourqui 21 Apr '16

21 Apr '16

Dear All, I'm quite new to this mailing list and I hope my question will be asked allright and that I will not need to eat my keyboard in order to stop posting in this mailing list;-) I'm currently trying to make the rim_sql run as I want. It's doing quite OK, but I'm having trouble to use the logfile configuration parameter in the sql configuration. As far I understood, this would log every sql requests in the file given in this argument. Basically I would like to have all requests logged in ${logdir}/sqllog.sql, mainly for debugging purpose. Unfortunatelly this is not working at all, the attribute is configured but nothing is written in the log file. I have also tried to touch the file manually in order to have it configured with the correct rights. I'm using following environment: CentOS 7 FreeRadius 3.0.4 Postgresql 9.2.15 When starting the server in debugging mode, it tells me that the attribute is configured with he file I want the information to be written into: [root@dev radius]# radiusd -X radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/postgresql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/debug including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = yes max_request_time = 30 cleanup_delay = 5 max_requests = 256 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no msg_badpass = "" msg_goodpass = "" colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client aruba-vc { ipaddr = 192.168.55.9 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 256 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:5 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:5 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_sql # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = no read_profiles = no read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/radius/sqllog.sql" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" simul_count_query = "" simul_verify_query = "" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-none}.query}" } post-auth { reference = ".query" } postgresql { send_application_name = yes } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21150 rlm_sql (sql): Opening additional connection (1) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21151 rlm_sql (sql): Opening additional connection (2) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21152 rlm_sql (sql): Opening additional connection (3) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21153 rlm_sql (sql): Opening additional connection (4) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21154 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 proto = "udp" } listen { type = "acct" ipaddr = * port = 1813 proto = "udp" } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Ready to process requests Below my mods-enabled/sql config file root@dev raddb]# more mods-enabled/sql # -*- text -*- ## ## sql.conf -- SQL modules ## ## $Id: 29fb4b28e1b085d66415052dcdb5cc255392dcc3 $ sql { driver = "rlm_sql_postgresql" postgresql { send_application_name = yes } dialect = "postgresql" server = "localhost" login = "radius" password = "durango" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" read_groups = no read_profiles = no delete_stale_sessions = yes logfile = ${logdir}/sqllog.sql pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } read_clients = no client_table = "nas" # Read database-specific queries $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } And the file I'm trying to log into: root@dev radius]# ls -la /var/log/radius/ total 60 drwx------. 3 radiusd radiusd 4096 Mar 27 16:46 . drwxr-xr-x. 7 root root 4096 Mar 27 03:17 .. drwx------. 3 radiusd radiusd 22 Dec 10 22:09 radacct -rw-r-----. 1 radiusd radiusd 22020 Mar 27 16:37 radius.log -rw-r-----. 1 radiusd radiusd 17339 Dec 23 22:06 radius.log-20160101.gz -rw-r-----. 1 radiusd radiusd 185 Jan 1 03:23 radius.log-20160201.gz -rw-r-----. 1 radiusd radiusd 2151 Feb 4 15:37 radius.log-20160301 -rw-r--r-- 1 radiusd radiusd 0 Mar 27 16:46 sqllog.sql Exists but keep being empty.... Is there something I haven't understood with this logfile configuration ? Many thanks in advance for your help. Best Regards Laurent

3 4

Memory leak parsing/relaying from detail files?
by Nathan Ward 16 Apr '16

16 Apr '16

Hi, I am working through debugging a memory leak I am hitting, and I think I have found the culprit. The trigger appears to be a malformed NAS-IPv6-Address attribute coming from a Cisco ASR9000, and I will certainly contact the vendor, however it occurs to me that we should work to solve this in FreeRADIUS as well. We use reliable proxied accounting with the detail file reader, however we write everything to a file and read from that file rather than writing only if the backend server pool has no reachable members. We are running 3.0.11, based on the 3.0.4 Redhat RPMs which we have forward ported. The ASR9000 sends a NAS-IPv6-Address attribute as follows: 0000 5f 16 1a 10 97 8c 00 00 00 00 00 00 00 00 00 00 _............... 0010 00 00 00 00 00 00 …… This has a length field of 0x16, while the standard defines this as always 0x12 - an IPv6 address is 16 bytes, plus two bytes for the type/len. I’m not sure what the ASR9000 thinks is going on.. but I guess that’s not in scope for this memory leak per se. FreeRADIUS interprets this as being not a valid NAS-IPv6-Address, so internally treats it as Attr-95 rather than NAS-IPv6-Address, which is the behaviour I’d expect. This gets written to a detail file, and some time later the detail file reader calls through to dict_unknown_afrom_fields, which allocates some memory that seems to never get freed. Running in valgrind, once for 5 mins, once for 25 mins, we note that the following call stack shows up as much larger after 25 mins. Here it is after about 5 mins: ==31363== 1,379,332 bytes in 5,653 blocks are definitely lost in loss record 1,935 of 1,937 ==31363== at 0x4C29BFD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==31363== by 0x5B0CA20: __talloc_with_prefix (talloc.c:615) ==31363== by 0x5B0CA20: __talloc (talloc.c:655) ==31363== by 0x5B0CA20: _talloc_named_const (talloc.c:812) ==31363== by 0x5B0CA20: _talloc_zero (talloc.c:2206) ==31363== by 0x50786DE: dict_unknown_afrom_fields (dict.c:2826) ==31363== by 0x508573F: data2vp (radius.c:3794) ==31363== by 0x507F1B1: fr_pair_from_unkown (pair.c:1267) ==31363== by 0x507F1B1: fr_pair_make_unknown (pair.c:1365) ==31363== by 0x507F1B1: fr_pair_make (pair.c:1439) ==31363== by 0x507F807: fr_pair_list_afrom_str (pair.c:1865) ==31363== by 0x146B18: detail_poll (detail.c:735) ==31363== by 0x147028: detail_handler_thread (detail.c:1085) ==31363== by 0x67BBDF4: start_thread (pthread_create.c:308) ==31363== by 0x6F431AC: clone (clone.S:113) Again after about 25 mins: ==10362== 7,163,840 bytes in 29,360 blocks are definitely lost in loss record 1,943 of 1,944 ==10362== at 0x4C29BFD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==10362== by 0x5B0CA20: __talloc_with_prefix (talloc.c:615) ==10362== by 0x5B0CA20: __talloc (talloc.c:655) ==10362== by 0x5B0CA20: _talloc_named_const (talloc.c:812) ==10362== by 0x5B0CA20: _talloc_zero (talloc.c:2206) ==10362== by 0x50786DE: dict_unknown_afrom_fields (dict.c:2826) ==10362== by 0x508573F: data2vp (radius.c:3794) ==10362== by 0x507F1B1: fr_pair_from_unkown (pair.c:1267) ==10362== by 0x507F1B1: fr_pair_make_unknown (pair.c:1365) ==10362== by 0x507F1B1: fr_pair_make (pair.c:1439) ==10362== by 0x507F807: fr_pair_list_afrom_str (pair.c:1865) ==10362== by 0x146B18: detail_poll (detail.c:735) ==10362== by 0x147028: detail_handler_thread (detail.c:1085) ==10362== by 0x67BBDF4: start_thread (pthread_create.c:308) ==10362== by 0x6F431AC: clone (clone.S:113) I have set up GDB to print out a backtrace whenever dict_unknown_afrom_fields is called with fr_pair_from_unkown 2 frames up the stack. We get this: #0 dict_unknown_afrom_fields (ctx=ctx@entry=0x0, attr=95, vendor=0) at src/lib/dict.c:2822 #1 0x00007fee4f416740 in data2vp (ctx=ctx@entry=0x0, packet=packet@entry=0x0, original=original@entry=0x0, secret=secret@entry=0x0, da=<optimized out>, start=<optimized out>, attrlen=20, packetlen=20, pvp=pvp@entry=0x7fee42bec848) at src/lib/radius.c:3794 #2 0x00007fee4f4101b2 in fr_pair_from_unkown (da=<optimized out>, vp=0x7fee340e3690) at src/lib/pair.c:1267 #3 fr_pair_make_unknown (op=<optimized out>, value=0x7fee42bec9d0 "Attr-95", attribute=0x7fee42bec9d0 "Attr-95", ctx=0x7fee5079c3f0) at src/lib/pair.c:1365 #4 fr_pair_make (ctx=ctx@entry=0x7fee5079c3f0, vps=vps@entry=0x0, attribute=attribute@entry=0x7fee42bec9d0 "Attr-95", value=value@entry=0x7fee42becad0 "0x1a108834", '0' <repeats 32 times>, op=<optimized out>) at src/lib/pair.c:1439 #5 0x00007fee4f410808 in fr_pair_list_afrom_str (ctx=ctx@entry=0x7fee5079c3f0, buffer=buffer@entry=0x7fee42bed570 "\tAttr-95 = 0x1a108834", '0' <repeats 32 times>, "\n", list=list@entry=0x7fee42becf48) at src/lib/pair.c:1865 #6 0x00007fee4facdb19 in detail_poll (listener=listener@entry=0x7fee5079c2a0) at src/main/detail.c:735 #7 0x00007fee4face029 in detail_handler_thread (arg=0x7fee5079c2a0) at src/main/detail.c:1085 #8 0x00007fee4dcd7df5 in start_thread (arg=0x7fee42bee700) at pthread_create.c:308 #9 0x00007fee4d5881ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113 Note Attr-95 - this is in every one of these backtraces that I looked at. I have attempted to filter out both Attr-95 and NAS-IPv6-Address at the start of my accounting section before it is written to the detail file - we don’t use this attribute so don’t care. I do this with the following: if (Attr-95) { update request { Attr-95 !* ANY } } But if (Attr-95) always returns false. I tried the same logic with NAS-IPv6-Address and get the same result, same trying this in preacct. Preacct has had no configuration changed from the standard “default” site config. Here is a trimmed output - let me know if you want the full thing, and I will get some test circuits set up which don’t have customer data: (469) Tue Mar 8 15:33:39 2016: Debug: Received Accounting-Request Id 141 from 103.241.56.176:51487 to 10.55.86.12:1813 length 1100 .. trimmed .. (469) Tue Mar 8 15:33:39 2016: Debug: Attr-95 = 0x1a10983400000000000000000000000000000000 .. trimmed .. (469) Tue Mar 8 15:33:39 2016: Debug: # Executing section preacct from file /etc/raddb/sites-enabled/trustpower-frontend .. trimmed .. (469) Tue Mar 8 15:33:40 2016: Debug: # Executing section accounting from file /etc/raddb/sites-enabled/trustpower-frontend (469) Tue Mar 8 15:33:40 2016: Debug: accounting { (469) Tue Mar 8 15:33:40 2016: Debug: if (Attr-95) { (469) Tue Mar 8 15:33:40 2016: Debug: if (Attr-95) -> FALSE I have two questions: 1) Can I filter this out in some way that I am unaware of as a short term fix? 2) I would like to figure out this memory leak myself and submit a patch, but I’m not sure how this part of the code works. I *think* that this should be freed after being proxied to the backend server - so, perhaps in process.c somewhere after a packet is sent, it should have any vp das that have is_unknown set to true freed? I’m not clear to me what impact that would have on other bits of code. -- Nathan Ward

3 6

radacct MySQL table only gets filled with the last session values for a given user ( no history logging )
by oatech 16 Apr '16

16 Apr '16

Client : Windows 10 NAS : Cisco SB WAP121 RADIUS Server : Debian 8 / FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, Authentication : PEAP/MSCHAPv2 While the /varl/log/freeradius/radacct/192.168.1.2/detail-20160324 files gets filled with correct data values for each user session : sudo cat /var/log/freeradius/radacct/192.168.1.2/detail-20160324 | grep Acct-Input-Octets Acct-Input-Octets = 43976 Acct-Input-Octets = 845 Acct-Input-Octets = 394240 Acct-Input-Octets = 371260 Acct-Input-Octets = 24927 the radacct MySQL table only gets filled with the last session values for a given user ( 24927 here ). There is no history logging : mysql> select radacct.username, radacct.nasipaddress, radacct.acctstarttime, radacct.acctstoptime, radacct.acctinputoctets, radacct.acctoutputoctets from radacct; +-----------+---------------+---------------------+---------------------+-----------------+------------------+ | username | nasipaddress | acctstarttime | acctstoptime | acctinputoctets | acctoutputoctets | +-----------+---------------+---------------------+---------------------+-----------------+------------------+ | User1 | 192.168.1.2 | 2016-03-24 08:44:46 | 2016-03-24 08:44:23 | 24927 | 20814 | | User2 | 192.168.1.2 | 2016-03-24 08:40:33 | 2016-03-24 08:42:22 | 0 | 0 | +-----------+---------------+---------------------+---------------------+-----------------+------------------+ 2 rows in set (0.00 sec) 2 rows in set (0.00 sec) Is this the normal expected behaviour ? I highy doubt it. I must have done something wrong, but I'm using a very standard Freeradius/MySQL install. Any help would be greatly appreciated :-) --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

3 2

Freeradius dhcp + allow unknown-clients
by Алексей Елиферов 08 Apr '16

08 Apr '16

Hi! We have freeradius v.2.2.9 with dhcp module And it's understand how to give IP-address with MAC or opt82. But if it's a new client, that does not established in mysqldb, how to give IP? In isc-dhcp it is doing by allow unknown-clients and dynamic pool. Does freeradius have anything like it? -- Sincerely yours, Yeliferov A. CTO LLC INTRAFFIC intraffic.ua / 044.200.44.00

4 3

comprehensive logging
by Anirudh Malhotra 06 Apr '16

06 Apr '16

Hi everyone, I am trying to do comprehensive logging of requests coming to the radius server, so that the administrators can know what user is doing wrong. So i read about linelog and have configured somethings as follows: - I have added a variable in dictionary - # default file authorize section -sql if(ok){ update control { My-Local-String := "sql_selected" } linelog } - # linelog module reference = "messages.%{%{control:My-Local-String}:-default}" messages { sql_selected = "user found in sql for %{User-Name}" } and it works, but I wanted to know is it the correct way to do it. As I want to achieve it in best possible way. if not Is there any other way to do comprehensive logging? BR, Anirudh Malhotra

2 3

Check NAS Authentication
by Aurélio de Souza Ribeiro Neto 05 Apr '16

05 Apr '16

Hello, How can I check if NAS is receiving the Radius authentication packets? I'm asking because I had a problem: my NAS was the wrong secret and didn't receive the Radius authentication packets. For this reason my pool ended. Thanks Aurelio

5 9