March 2016 - Freeradius-Users - lists.freeradius.org

Attribute to show authentication method
by Jonathan Gazeley 31 Mar '16

31 Mar '16

Is there an easy well to determin in post-auth which authentication method was used to authenticate a user? We have a fairly complex setup where a user can be "authenticated" by MAC address in the Authorize section or via EAP-TLS or EAP-PEAP, both with their own virtual servers. In the outer post-auth I want to call a logging module that explicitly says how the user was authenticated but I can't find an attribute which I can reliably check. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

3 4

CA.all
by Tevfik Ceydeliler 31 Mar '16

31 Mar '16

CA. all file is old file and not exist in newer freeradius source ? Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz. The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

FreeRADIUS 3.1.x not changing the status of a failed home server
by Donald Sherker 31 Mar '16

31 Mar '16

I am testing 3.1.x and I have a proxy server that will forward access-requests to a realm containing two home servers. If one of the home servers fails to respond the proxy server is not marking it a zombie, and does not start sending status-server checks to see if the failed server recovers. The proxy server is configured to sent status-server checks. The pool the home servers are in is using keyed-balance. All of the servers in question are running 3.1.x. Please let me know if you need any more configuration information on the proxy, or home servers. Mar 17 10:39:26 (231) Received Access-Request Id 26 from X.X.X.X:50708 to Y.Y.Y.Y:1812 via eth0 length 199 Mar 17 10:39:26 (231) User-Name = "User-Name" Mar 17 10:39:26 (231) NAS-IP-Address = X.X.X.X Mar 17 10:39:26 (231) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:26 (231) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:26 (231) NAS-Port = 0 Mar 17 10:39:26 (231) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:26 (231) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:26 (231) Acct-Session-Id = "56EABCC1-0000000D" Mar 17 10:39:26 (231) Framed-MTU = 1400 Mar 17 10:39:26 (231) EAP-Message = 0x02a3000d017161726573646f6e Mar 17 10:39:26 (231) Location-Capable = 3 Mar 17 10:39:26 (231) HS20-AP-Version = 1 Mar 17 10:39:26 (231) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:26 (231) Message-Authenticator = 0x20ddbd35221f67aeb9f8c2fa0cdded10 Mar 17 10:39:26 (231) Running section authorize from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:26 (231) authorize { Mar 17 10:39:26 (231) if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) { Mar 17 10:39:26 (231) update control { Mar 17 10:39:26 (231) EXPAND %{Calling-Station-Id} Mar 17 10:39:26 (231) --> 10417f1906f1 Mar 17 10:39:26 (231) &control:Load-Balance-Key := 10417f1906f1 Mar 17 10:39:26 (231) } # update control (noop) Mar 17 10:39:26 (231) } # if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) (noop) Mar 17 10:39:26 (231) else { Mar 17 10:39:26 (231) ... skipping else for request 231: Preceding "if" was taken Mar 17 10:39:26 (231) } Mar 17 10:39:26 (231) if (&User-Name == 'anonymous@realm0') { Mar 17 10:39:26 (231) ... Mar 17 10:39:26 (231) } Mar 17 10:39:26 (231) else { Mar 17 10:39:26 (231) update request { Mar 17 10:39:26 (231) &Login-Method := 802.1x Mar 17 10:39:26 (231) } # update request (noop) Mar 17 10:39:26 (231) } # else (noop) Mar 17 10:39:26 (231) preprocess (ok) Mar 17 10:39:26 (231) cui.authorize { Mar 17 10:39:26 (231) if ("%{client:add_cui}" == 'yes') { Mar 17 10:39:26 (231) EXPAND %{client:add_cui} Mar 17 10:39:26 (231) --> yes Mar 17 10:39:26 (231) update request { Mar 17 10:39:26 (231) &Chargeable-User-Identity := 0x00 Mar 17 10:39:26 (231) } # update request (noop) Mar 17 10:39:26 (231) } # if ("%{client:add_cui}" == 'yes') (noop) Mar 17 10:39:26 (231) } # cui.authorize (noop) Mar 17 10:39:26 (231) if (&User-Name =~ /anonymous.*(a)provider1\.com/) { Mar 17 10:39:26 (231) ... Mar 17 10:39:26 (231) } Mar 17 10:39:26 (231) elsif (&User-Name != "healthcheck") { Mar 17 10:39:26 (231) update control { Mar 17 10:39:26 (231) &control:Proxy-To-Realm := proxyrealm0 Mar 17 10:39:26 (231) } # update control (noop) Mar 17 10:39:26 (231) } # elsif (&User-Name != "healthcheck") (noop) Mar 17 10:39:26 (231) files - Found match "DEFAULT" one line 243 of /usr/local/etc/raddb/mods-config/files/authorize Mar 17 10:39:26 (231) files (ok) Mar 17 10:39:26 (231) suffix - Checking for suffix after "@" Mar 17 10:39:26 (231) suffix - No '@' in User-Name = "User-Name", looking up realm NULL Mar 17 10:39:26 (231) suffix - No such realm "NULL" Mar 17 10:39:26 (231) suffix (noop) Mar 17 10:39:26 (231) expiration (noop) Mar 17 10:39:26 (231) logintime (noop) Mar 17 10:39:26 (231) pap (noop) Mar 17 10:39:26 (231) } # authorize (ok) Mar 17 10:39:26 (231) Running section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:26 (231) pre-proxy { Mar 17 10:39:26 (231) cui.pre-proxy { Mar 17 10:39:26 (231) if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) { Mar 17 10:39:26 (231) EXPAND %{request:Packet-Type} Mar 17 10:39:26 (231) --> Access-Request Mar 17 10:39:26 (231) EXPAND %{client:add_cui} Mar 17 10:39:26 (231) --> yes Mar 17 10:39:26 (231) update proxy-request { Mar 17 10:39:26 (231) &proxy-request:Chargeable-User-Identity = 0x00 Mar 17 10:39:26 (231) } # update proxy-request (noop) Mar 17 10:39:26 (231) } # if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) (noop) Mar 17 10:39:26 (231) } # cui.pre-proxy (noop) Mar 17 10:39:26 (231) } # pre-proxy (noop) Mar 17 10:39:26 (231) Proxying request to home server Z.Z.Z.Z port 1812 timeout 20.000000 Mar 17 10:39:26 (231) Sent Access-Request Id 59 from 0.0.0.0:36831 to Z.Z.Z.Z:1812 length 212 Mar 17 10:39:26 (231) User-Name = "User-Name" Mar 17 10:39:26 (231) NAS-IP-Address = X.X.X.X Mar 17 10:39:26 (231) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:26 (231) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:26 (231) NAS-Port = 0 Mar 17 10:39:26 (231) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:26 (231) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:26 (231) Acct-Session-Id = "56EABCC1-0000000D" Mar 17 10:39:26 (231) Framed-MTU = 1400 Mar 17 10:39:26 (231) EAP-Message = 0x02a3000d017161726573646f6e Mar 17 10:39:26 (231) Location-Capable = 3 Mar 17 10:39:26 (231) HS20-AP-Version = 1 Mar 17 10:39:26 (231) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:26 (231) Message-Authenticator = 0x20ddbd35221f67aeb9f8c2fa0cdded10 Mar 17 10:39:26 (231) Event-Timestamp = "Mar 17 2016 10:39:26 EDT" Mar 17 10:39:26 (231) Chargeable-User-Identity := 0x00 Mar 17 10:39:26 (231) Proxy-State = 0x3236 Mar 17 10:39:26 Thread 5 waiting to be assigned a request Mar 17 10:39:27 (231) Expecting proxy response no later than 19.668615 seconds from now Mar 17 10:39:27 Waking up in 0.3 seconds. Mar 17 10:39:27 Thread 5 handling request 231, (251 handled so far) Mar 17 10:39:27 (231) Clearing existing &reply: attributes Mar 17 10:39:27 (231) Found Post-Proxy-Type Fail-Authentication Mar 17 10:39:27 (231) Post-Proxy-Type sub-section not found. Ignoring. Mar 17 10:39:27 (231) Login incorrect (Home Server failed to respond): [User-Name] (from client Client-A.A.A.A port 0 cli 10417f1906f1) Mar 17 10:39:27 (231) There was no response configured: rejecting request Mar 17 10:39:27 (231) Using Post-Auth-Type Reject Mar 17 10:39:27 (231) Running Post-Auth-Type Reject from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:27 (231) Post-Auth-Type REJECT { Mar 17 10:39:27 (231) attr_filter.access_reject - EXPAND %{User-Name} Mar 17 10:39:27 (231) attr_filter.access_reject - --> User-Name Mar 17 10:39:27 (231) attr_filter.access_reject - Matched entry DEFAULT at line 11 Mar 17 10:39:27 (231) attr_filter.access_reject (updated) Mar 17 10:39:27 (231) remove_reply_message_if_eap { Mar 17 10:39:27 (231) if (&reply:EAP-Message && &reply:Reply-Message) { Mar 17 10:39:27 (231) ... Mar 17 10:39:27 (231) } Mar 17 10:39:27 (231) else { Mar 17 10:39:27 (231) noop (noop) Mar 17 10:39:27 (231) } # else (noop) Mar 17 10:39:27 (231) } # remove_reply_message_if_eap (noop) Mar 17 10:39:27 (231) } # Post-Auth-Type REJECT (updated) Mar 17 10:39:27 (231) Sent Access-Reject Id 26 from Y.Y.Y.Y:1812 to X.X.X.X:50708 via eth0 length 0 Mar 17 10:39:27 (231) Finished request Mar 17 10:39:27 Thread 5 waiting to be assigned a request Mar 17 10:39:27 Waking up in 4.6 seconds. Mar 17 10:39:28 Waking up in 0.3 seconds. Mar 17 10:39:28 Thread 5 handling request 232, (252 handled so far) Mar 17 10:39:28 (232) Received Access-Request Id 27 from X.X.X.X:50708 to Y.Y.Y.Y:1812 via eth0 length 199 Mar 17 10:39:28 (232) User-Name = "User-Name" Mar 17 10:39:28 (232) NAS-IP-Address = X.X.X.X Mar 17 10:39:28 (232) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:28 (232) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:28 (232) NAS-Port = 0 Mar 17 10:39:28 (232) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:28 (232) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:28 (232) Acct-Session-Id = "56EABCC1-0000000E" Mar 17 10:39:28 (232) Framed-MTU = 1400 Mar 17 10:39:28 (232) EAP-Message = 0x025d000d017161726573646f6e Mar 17 10:39:28 (232) Location-Capable = 3 Mar 17 10:39:28 (232) HS20-AP-Version = 1 Mar 17 10:39:28 (232) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:28 (232) Message-Authenticator = 0xc390ccf8b070c383d30e99baf1025738 Mar 17 10:39:28 (232) Running section authorize from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:28 (232) authorize { Mar 17 10:39:28 (232) if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) { Mar 17 10:39:28 (232) update control { Mar 17 10:39:28 (232) EXPAND %{Calling-Station-Id} Mar 17 10:39:28 (232) --> 10417f1906f1 Mar 17 10:39:28 (232) &control:Load-Balance-Key := 10417f1906f1 Mar 17 10:39:28 (232) } # update control (noop) Mar 17 10:39:28 (232) } # if (&Calling-Station-Id =~ /([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})/i) (noop) Mar 17 10:39:28 (232) else { Mar 17 10:39:28 (232) ... skipping else for request 232: Preceding "if" was taken Mar 17 10:39:28 (232) } Mar 17 10:39:28 (232) if (&User-Name == 'anonymous@realm0') { Mar 17 10:39:28 (232) ... Mar 17 10:39:28 (232) } Mar 17 10:39:28 (232) else { Mar 17 10:39:28 (232) update request { Mar 17 10:39:28 (232) &Login-Method := 802.1x Mar 17 10:39:28 (232) } # update request (noop) Mar 17 10:39:28 (232) } # else (noop) Mar 17 10:39:28 (232) preprocess (ok) Mar 17 10:39:28 (232) cui.authorize { Mar 17 10:39:28 (232) if ("%{client:add_cui}" == 'yes') { Mar 17 10:39:28 (232) EXPAND %{client:add_cui} Mar 17 10:39:28 (232) --> yes Mar 17 10:39:28 (232) update request { Mar 17 10:39:28 (232) &Chargeable-User-Identity := 0x00 Mar 17 10:39:28 (232) } # update request (noop) Mar 17 10:39:28 (232) } # if ("%{client:add_cui}" == 'yes') (noop) Mar 17 10:39:28 (232) } # cui.authorize (noop) Mar 17 10:39:28 (232) if (&User-Name =~ /anonymous.*(a)provider1\.com/) { Mar 17 10:39:28 (232) ... Mar 17 10:39:28 (232) } Mar 17 10:39:28 (232) elsif (&User-Name != "healthcheck") { Mar 17 10:39:28 (232) update control { Mar 17 10:39:28 (232) &control:Proxy-To-Realm := proxyrealm0 Mar 17 10:39:28 (232) } # update control (noop) Mar 17 10:39:28 (232) } # elsif (&User-Name != "healthcheck") (noop) Mar 17 10:39:28 (232) files - Found match "DEFAULT" one line 243 of /usr/local/etc/raddb/mods-config/files/authorize Mar 17 10:39:28 (232) files (ok) Mar 17 10:39:28 (232) suffix - Checking for suffix after "@" Mar 17 10:39:28 (232) suffix - No '@' in User-Name = "User-Name", looking up realm NULL Mar 17 10:39:28 (232) suffix - No such realm "NULL" Mar 17 10:39:28 (232) suffix (noop) Mar 17 10:39:28 (232) expiration (noop) Mar 17 10:39:28 (232) logintime (noop) Mar 17 10:39:28 (232) pap (noop) Mar 17 10:39:28 (232) } # authorize (ok) Mar 17 10:39:28 (232) Running section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:28 (232) pre-proxy { Mar 17 10:39:28 (232) cui.pre-proxy { Mar 17 10:39:28 (232) if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) { Mar 17 10:39:28 (232) EXPAND %{request:Packet-Type} Mar 17 10:39:28 (232) --> Access-Request Mar 17 10:39:28 (232) EXPAND %{client:add_cui} Mar 17 10:39:28 (232) --> yes Mar 17 10:39:28 (232) update proxy-request { Mar 17 10:39:28 (232) &proxy-request:Chargeable-User-Identity = 0x00 Mar 17 10:39:28 (232) } # update proxy-request (noop) Mar 17 10:39:28 (232) } # if (("%{request:Packet-Type}" == 'Access-Request') && ("%{client:add_cui}" == 'yes')) (noop) Mar 17 10:39:28 (232) } # cui.pre-proxy (noop) Mar 17 10:39:28 (232) } # pre-proxy (noop) Mar 17 10:39:28 (232) Proxying request to home server Z.Z.Z.Z port 1812 timeout 20.000000 Mar 17 10:39:28 (232) Sent Access-Request Id 194 from 0.0.0.0:36831 to Z.Z.Z.Z:1812 length 212 Mar 17 10:39:28 (232) User-Name = "User-Name" Mar 17 10:39:28 (232) NAS-IP-Address = X.X.X.X Mar 17 10:39:28 (232) Called-Station-Id = "000d67218560:shore03PR020201" Mar 17 10:39:28 (232) NAS-Port-Type = Wireless-802.11 Mar 17 10:39:28 (232) NAS-Port = 0 Mar 17 10:39:28 (232) Calling-Station-Id = "10417f1906f1" Mar 17 10:39:28 (232) Connect-Info = "CONNECT 0Mbps 802.11b" Mar 17 10:39:28 (232) Acct-Session-Id = "56EABCC1-0000000E" Mar 17 10:39:28 (232) Framed-MTU = 1400 Mar 17 10:39:28 (232) EAP-Message = 0x025d000d017161726573646f6e Mar 17 10:39:28 (232) Location-Capable = 3 Mar 17 10:39:28 (232) HS20-AP-Version = 1 Mar 17 10:39:28 (232) HS20-Mobile-Device-Version = 0x000000 Mar 17 10:39:28 (232) Message-Authenticator = 0xc390ccf8b070c383d30e99baf1025738 Mar 17 10:39:28 (232) Event-Timestamp = "Mar 17 2016 10:39:28 EDT" Mar 17 10:39:28 (232) Chargeable-User-Identity := 0x00 Mar 17 10:39:28 (232) Proxy-State = 0x3237 Mar 17 10:39:28 Thread 5 waiting to be assigned a request Mar 17 10:39:28 Waking up in 0.3 seconds. Mar 17 10:39:28 Waking up in 0.3 seconds. Mar 17 10:39:28 Thread 5 handling request 233, (253 handled so far) Mar 17 10:39:28 Thread 5 waiting to be assigned a request Mar 17 10:39:29 (232) Expecting proxy response no later than 19.668392 seconds from now Mar 17 10:39:29 Thread 5 handling request 232, (254 handled so far) Mar 17 10:39:29 (232) Clearing existing &reply: attributes Mar 17 10:39:29 (232) Found Post-Proxy-Type Fail-Authentication Mar 17 10:39:29 (232) Post-Proxy-Type sub-section not found. Ignoring. Mar 17 10:39:29 (232) Login incorrect (Home Server failed to respond): [User-Name] (from client Client-A.A.A.A port 0 cli 10417f1906f1) Mar 17 10:39:29 (232) There was no response configured: rejecting request Mar 17 10:39:29 (232) Using Post-Auth-Type Reject Mar 17 10:39:29 (232) Running Post-Auth-Type Reject from file /usr/local/etc/raddb/sites-enabled/default Mar 17 10:39:29 (232) Post-Auth-Type REJECT { Mar 17 10:39:29 (232) attr_filter.access_reject - EXPAND %{User-Name} Mar 17 10:39:29 (232) attr_filter.access_reject - --> User-Name Mar 17 10:39:29 (232) attr_filter.access_reject - Matched entry DEFAULT at line 11 Mar 17 10:39:29 (232) attr_filter.access_reject (updated) Mar 17 10:39:29 (232) remove_reply_message_if_eap { Mar 17 10:39:29 (232) if (&reply:EAP-Message && &reply:Reply-Message) { Mar 17 10:39:29 (232) ... Mar 17 10:39:29 (232) } Mar 17 10:39:29 (232) else { Mar 17 10:39:29 (232) noop (noop) Mar 17 10:39:29 (232) } # else (noop) Mar 17 10:39:29 (232) } # remove_reply_message_if_eap (noop) Mar 17 10:39:29 (232) } # Post-Auth-Type REJECT (updated) Mar 17 10:39:29 (232) Sent Access-Reject Id 27 from Y.Y.Y.Y:1812 to X.X.X.X:50708 via eth0 length 0 Mar 17 10:39:29 (232) Finished request Mar 17 10:39:29 Thread 5 waiting to be assigned a request Mar 17 10:39:29 Waking up in 0.3 seconds. Mar 17 10:39:29 Waking up in 2.4 seconds. Mar 17 10:39:30 Waking up in 0.3 seconds. Mar 17 10:39:30 Thread 5 handling request 234, (255 handled so far) Thanks, Don

2 2

proxy accounting to two other radius servers
by Bill Schoolfield 31 Mar '16

31 Mar '16

I have a accounting only proxy in place to a single radius server. Works fine. I now need to proxy certain accounting packets to another server. Both request types have the same realm but there is a unique suffix to the username portion. I looked over the docs but I can't seem to figure out how to modify the configuration to do this. Can someone point me in the right direction? Bill

2 3

performance issues freeradius 2.1.12
by khouzam yaghi 30 Mar '16

30 Mar '16

hi i have around 10k users, i am creating a module for each acct-status-type and this module will call a php script in the accounting section, it is as follow if(Acct-Status-Type == "Start") { user-start } elsif (Acct-Status-Type == "Interim-Update") { user-interm-update } elsif(Acct-Status-Type == "Stop") { user-stop } is this a good design or there is a better one?? everything is working perfect, i have around 15 mikrotik nases, but sometimes i am receiving an error in the radius.log which is receiving conflicting packets , and the error is always from a specific nas i.e nas10, is it the nas that is not receiving the packet from the server or my server is slow, my database is well indexed + i am using an SSD hardisk

5 6

Re: performance issues freeradius 2.1.12
by khouzam yaghi 30 Mar '16

30 Mar '16

My cleanupdelay is set to 7 seconds, i am receiving alot of errors: receiving conflicting packet from nas11 , only after rebooting this nas, it will work fine, and after some hours , the error will come again, Regarding the sql database can you post more information on how to deal with it, In my database each service has its own speed and after a specific limit it will slow down( i.e 2MB after 1.5gb will drop to 1MB while 3MB after 2GB will drop to 1.5MB) This can be done using only sql database? Is it better use perl instead php? Will it show a big difference? On Wed, Mar 30, 2016 at 3:30 PM, <khouzamyaghi(a)gmail.com> wrote: > My cleanupdelay is set to 7 seconds, i am receiving alot of errors: > receiving conflicting packet from nas11 , only after rebooting this nas, it > will work fine, and after some hours , the error will come again, > > > Regarding the sql database can you post more information on how to deal > with it, > > In my database each service has its own speed and after a specific limit > it will slow down( i.e 2MB after 1.5gb will drop to 1MB while 3MB after 2GB > will drop to 1.5MB) > This can be done using only sql database? > > Is it better use perl instead php? Will it show a big difference? > > > On Mar 30, 2016, at 2:38 PM, Nathan Ward <lists+freeradius(a)daork.net> > wrote: > > > > Hi, > > > >> On 30/03/2016, at 22:47, khouzam yaghi <khouzam.yaghi(a)gmail.com> wrote: > >> > >> the php script calculate the overall quota for the user, the monthly and > >> the daily , each time i got an interim update for a user i added the > >> acctinputoctet and acctoutputoctet to the monthly and daily quota (daily > >> quota is to be reset everyday at 12 midnight) and it checks if the users > >> exceeds his daily or monthly quota it will decrease his speed as > specified > >> in the database, the script also take care of the free time, if the isp > >> specify a freetime , the server will not add the acctinputoctet and > >> acctoutputoctet to the quota at freetime. > >> > >> is it better to use perl instead of php or what do you think is better?? > > > > These things could be done directly with SQL to your database, which is > what I’d do. > > > >> what about receiving conflicting packets error (only from one nas out > of 15 > >> nases). is it the nas that is overloaded or the server is slow? > > > > > > I don’t have enough information to answer that. It’s strange that it’s > only that NAS, but, maybe that NAS just happens to be busy so there’s more > chance it happens there. > > > > Is the server replying before the NAS retransmits the request packet? > That would probably indicate packet loss in the downstream direction > towards the NAS. > > > > Perhaps you can post a debug of this happening. > > > > -- > > Nathan Ward > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 2

Re: Simultaneous-Use
by khouzam yaghi 30 Mar '16

30 Mar '16

The freeradius uses the checkrad only when it sees a duplicate user trying to connect , so it access the nas using snmp or telnet to check if the session is available on the nas or it is stuck only on the server On Wed, Mar 30, 2016 at 3:23 PM, <khouzamyaghi(a)gmail.com> wrote: > The freeradius uses the checkrad only when it sees a duplicate user trying > to connect , so it access the nas using snmp or telnet to check if the > session is available on the nas or it is stuck only on the server > > > On Mar 30, 2016, at 3:03 PM, Aurélio de Souza Ribeiro Neto < > netolistas(a)mpc.com.br> wrote: > > > > Hi Everyone, > > > > How the simultaneous-use check works? > > > > When FreeRadius receives an Authentication NAS Pack, it uses checkrad > or queries to check if user is on or not? > > > > Thanks > > > > Aurelio > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Re: Interim-Update
by khouzam yaghi 30 Mar '16

30 Mar '16

you can use the checkrad script which is already available with freeradius, you just need to enable it by inserting in the nas table (if you are using database) or clients.conf file the type of your nas. checkrad checks the nas to see if the user is already logged in the nas or not, if the user is not logged in, then it will end the session for this user and start a new session. On Wed, Mar 30, 2016 at 2:02 AM, khouzam yaghi <khouzamyaghi(a)gmail.com> wrote: > you can use the checkrad script which is already available with > freeradius, you just need to enable it by inserting in the nas table (if > you are using database) or clients.conf file the type of your nas. checkrad > checks the nas to see if the user is already logged in the nas or not, if > the user is not logged in, then it will end the session for this user and > start a new session. > > On Tue, Mar 29, 2016 at 10:13 PM, Bill Schoolfield <bill(a)billmax.com> > wrote: > >> You not going to be able to rely on the accounting packet stop receipt to >> release the ip. There's a SNMP script that you can use (i forget the name) >> to pol the nas for connections. If not found then you manually release the >> ip in the table. >> >> Someone here will know the details. >> >> Bill >> >> >> On 3/29/2016 1:48 PM, Aurélio de Souza Ribeiro Neto wrote: >> >>> Thanks Bill, >>> >>> Lost (not received) accounting packets will not have any affect on your >>>> customer's connection. >>>> >>>> For my customer's no affect but for my dhcp_pool I lost an IP. >>> >>> Aurélio >>> >>> >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

2 1

(no subject)
by khouzam yaghi 29 Mar '16

29 Mar '16

hi i have around 10k users, i am creating a module for each acct-status-type and this module will call a php script in the accounting section, it is as follow if(Acct-Status-Type == "Start") { user-start } elsif (Acct-Status-Type == "Interim-Update") { user-interm-update } elsif(Acct-Status-Type == "Stop") { user-stop } is this a good design or there is a better one?? everything is working perfect, i have around 15 mikrotik nases, but sometimes i am receiving an error in the radius.log which is receiving conflicting packets , and the error is always from a specific nas i.e nas10, is it the nas that is not receiving the packet from the server or my server is slow, my database is well indexed + i am using an SSD hardisk

1 0

Re: Support for EAP-AKA in free radius
by manjunath uthappa ponnachana 29 Mar '16

29 Mar '16

Hi, Heard there is patch to test eap-aka with lower version of freeradius.Please provide me the patch and steps to configure freeradius using this patch for eap-aka. Thanks & regardsManjunath From: Alan DeKok <aland(a)deployingradius.com> Sent: Sun, 27 Mar 2016 19:26:45 To: pu_manjunath(a)rediffmail.com, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Support for EAP-AKA in free radius On Mar 27, 2016, at 3:02 AM, manjunath uthappa ponnachana <pu_manjunath(a)rediffmail.com> wrote: > Wanted to know whether free radius support EAP-AKA.Heard there is some patch available for EAP-AKA in free radius.Please let me know &nbsp;the link/source from where this patch can be downloaded.It will be helpful, if somebody can send the steps for configuring free radius with EAP-AKA.  If FreeRADIUS supported EAP-AKA, it would include EAP-AKA in the main releases.  Alan DeKok.

1 0