November 2017 - Freeradius-Users - lists.freeradius.org

key_expiration variable not defined anywhere (in trustrouter.c in rlm_realm)
by Stefan Paetow 08 Nov '17

08 Nov '17

Hi Alan, During the build to make this all work with OpenSSL, I noticed that 'key_expiration' is used for the first time in line 422 of trustrouter.c in the rlm_realm module. According to Github this was a manual merge? Did something go missing (the declaration of key_expiration perhaps)? Build output snippet: -- begin -- CC src/modules/rlm_realm/trustrouter.c src/modules/rlm_realm/trustrouter.c: In function ‘srvr_blk_to_home_server’: src/modules/rlm_realm/trustrouter.c:422:36: error: ‘key_expiration’ undeclared (first use in this function); did you mean ‘get_realm_expiration’? tid_srvr_get_key_expiration(blk, &key_expiration); ^~~~~~~~~~~~~~ get_realm_expiration src/modules/rlm_realm/trustrouter.c:422:36: note: each undeclared identifier is reported only once for each function it appears in make: *** [scripts/boiler.mk:635: build/objs/src/modules/rlm_realm/trustrouter.lo] Error 1 -- end -- Could you have a look? I've copied Alex in, just in case. Thank you very much! With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

1 0

FreeRadius high availability lab
by Claudio Carvalho 08 Nov '17

08 Nov '17

Hi Users, I started a test for a large deployment and this topology was recommended, I tested it in the lab and apparently did it work, any comments from someone about the attached topology? is there something like this in production? Claudio.

8 12

Enabling accounting on Freeradius 3.0.15
by Peter Hutchison 08 Nov '17

08 Nov '17

I intend on enabling accounting on Freeradius so I can log user sessions including username and IP address of the user device. I think it is something to do with linelog module and the default (or my eduroam) virtual server accounting section. Is this correct? Has anyone deployed accounting logging and how they did it. Some useful instructions would be useful. Thanks. Peter University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 2

How to -> Accounting Monthly Update?
by Igor Karolesky 08 Nov '17

08 Nov '17

Hi there, May i ask for some help? I'm using freeradius 2.1.12 (can't upgrade it) My accounting is working finely but i don't know how to make it update monthly or weekly. Don't know here to configure it. Don't know where the fuck i put the Acct-Interim-Update. I have found a usefull book tho. But I can't reply what i learned on it to my actual network. --

2 1

Solved Freeradius calling station ID
by Marco Ramian 08 Nov '17

08 Nov '17

i addedd this : msg_goodpass = "%{Called-Station-Id}" msg_badpass = "%{Called-Station-Id}" in radius.conf and now can see AP Mac Address, thank u all guys

1 0

Troubleshooting apparent failed RADIUS challenges
by Turner, Ryan H 08 Nov '17

08 Nov '17

Hoping this does not invoke a beating from Alan... We are a LARGE EAP-TLS shop (one of the first), and authenticate 10s of thousands of clients every day. I am noticing (which doesn't mean it is necessarily our fault), that some percentage of our users that cannot connect appear to be breaking down in the Challenge phase. Initially it looks like they aren't even trying to authenticate on wireless (we don't log challenges), but a capture will tell me that a challenge is made, and then there are no responses... A few questions... I honestly find the Radius Challenge section difficult to understand. In our EAP-TLS environment, exactly what is happening during this challenge phase? Doing searching on this has so far returned nebulous answers. Exactly what is being checked of verified with an EAP-TLS client? Secondly, how do you even begin to troubleshoot why certain clients would not progress beyond the challenge? We have an android user that is onboarded with a certificate that will last a year. Periodically, it will just stop working. I will notice an incomplete challenge. If he reonboards with a new certificate, everything works again for some period (obviously looks like a client issue). We also notice that some users fail their challenge when traveling abroad with eduroam. We are running one of the most patched 2.X versions of FreeRadius (we are actively building for a deployment of 3 at this moment). Ryan Turner

2 2

Calling Station ID
by Marco Ramian 08 Nov '17

08 Nov '17

Hi guys, need your help please... have installed freeradius and send Wireless users authentications request through WLC to freeradius, in radius.log cant see Calling Station ID .... need to see Access Point Mac address in logs, Wed Nov 8 13:08:47 2017 : Auth: Login OK: [cc20e82a0636/cc20e82a0636] (from client BUS1 port 4 cli cc-20-e8-2a-06-36) i have defined a Client in Clients.conf and called BUS1 , it shows me the name of Client ... but how can i get Called staion id ( accesspoint mac address ) ? Thank you

2 1

rlm_rest module - authenticate
by philippe2.legoff＠orange.com 07 Nov '17

07 Nov '17

Hello, I’m using a Freeradius 4.0.x release with the rlm_rest module to store the accounting datas inside a key/value database. Storing accounting items works well, and also authorization, but I’m not able to perform authentication using the stored datas (as for MySQL). If anyone have an idea ? rlm_rest/accounting section accounting { uri = "${..connect_uri}/v2/keys/%{Framed-IP-Address}" method = 'put' body = 'post' data = "value=\"Cleartext-Password\": \"%{Framed-IP-Address}\",\"Calling-Station-Id\": \"%{Calling-Station-ID}\",\"3GPP-Location-Info\": \"%{3GPP-User-Location-Info}\",\"3GPP-SGSN-Address\": \"%{3GPP-SGSN-Address}\",\"3GPP-RAT-Type\": \"%{3GPP-RAT-Type}\"" } CLI command is : echo "Calling-Station-Id=237100000002,Framed-IP-Address=201.16.124.239,Service-Type=2,Framed-Protocol=ppp,Acct-Status-Type=Start,3GPP-SGSN-Address=70.70.70.70,3GPP-Location-Info=0x5c2730783030315c27,NAS-IP-Address=10.171.23.53,NAS-Port=1,3GPP-Rat-Type=0x01" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1813 acct testing123 Sent Accounting-Request Id 49 from 0.0.0.0:47843 to 10.104.145.4:1813 length 108 Calling-Station-Id = "237100000002" Framed-IP-Address = 201.16.124.239 Service-Type = Framed-User Framed-Protocol = PPP Acct-Status-Type = Start 3GPP-SGSN-Address = 70.70.70.70 3GPP-Location-Info = 0x5c2730783030315c27 NAS-IP-Address = 10.171.23.53 NAS-Port = 1 3GPP-RAT-Type = UTRAN Received Accounting-Response Id 49 from 10.104.145.4:1813 to 0.0.0.0:47843 via lo length 20 And the datas are correctly stored. Raddebug seems fine for accounting : Network received packet size 108 Ready to process requests Resetting worker cleanup timer to +30s (0) running request (0) Received Accounting-Request ID 49 (0) Calling-Station-Id = "237100000002" (0) Framed-IP-Address = 201.16.124.239 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Acct-Status-Type = Start (0) 3GPP-SGSN-Address = 70.70.70.70 (0) 3GPP-Location-Info = 0x5c2730783030315c27 (0) NAS-IP-Address = 10.171.23.53 (0) NAS-Port = 1 (0) 3GPP-RAT-Type = UTRAN (0) Running 'recv Accounting-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) recv Accounting-Request { (0) acct_unique { (0) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (0) EXPAND %{string:Class} (0) --> (0) ... (0) } (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> 6f0ca34d8adc2578048d2d1f4bb0f025 (0) &Acct-Unique-Session-Id := 6f0ca34d8adc2578048d2d1f4bb0f025 (0) } # update request (noop) (0) } # else (noop) (0) } # acct_unique (noop) (0) check_accounting_attributes { (0) if (Acct-Status-Type == Start) { (0) if ((!NAS-IP-Address) || (!Service-Type) || (!Framed-Protocol) || (!Framed-IP-Address) || (!3GPP-SGSN-Address) || (!3GPP-RAT-Type) || (!Calling-Station-Id)) { (0) ... (0) } (0) else { (0) ok (ok) (0) } # else (ok) (0) } # if (Acct-Status-Type == Start) (ok) (0) } # check_accounting_attributes (ok) (0) } # recv Accounting-Request (ok) (0) Running 'send Accounting-Response' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) send Accounting-Response { (0) detail - EXPAND /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (0) detail - --> /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - EXPAND %t (0) detail - --> Tue Nov 7 10:23:22 2017 (0) detail (ok) (0) unix (noop) (0) rest - Reserved connection (4) (0) rest - Expanding URI components (0) rest - EXPAND http://10.104.145.4:2379 (0) rest - --> http://10.104.145.4:2379 (0) rest - EXPAND /v2/keys/%{Framed-IP-Address} (0) rest - --> /v2/keys/201.16.124.239 (0) rest - Sending HTTP PUT to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (0) rest - EXPAND value="Cleartext-Password": "%{Framed-IP-Address}","Calling-Station-Id": "%{Calling-Station-ID}","3GPP-Location-Info": "%{3GPP-Location-Info}","3GPP-SGSN-Address": "%{3GPP-SGSN-Address}","3GPP-RAT-Type": "%{3GPP-RAT-Type}" (0) rest - --> value="Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - Content-Length will be 186 bytes (0) rest (yield) Waking up in 2.9 seconds. (0) Processing response header (0) Status : 200 (OK) (0) Type : json (application/json) (0) running request (0) rest - &REST-HTTP-Status-Code := 200 (0) rest - Parsing attribute "action" (0) rest - EXPAND set (0) rest - --> set (0) rest - &action := "set" (0) rest - Parsing attribute "node" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200088 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200088 (0) rest - Parsing attribute "prevNode" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200087 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200087 (0) rest - Released connection (4) (0) rest - Closing expired connection (3): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (2): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (1): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (0): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest (updated) (0) if (noop) { (0) ... (0) } (0) attr_filter.accounting_response - EXPAND %{User-Name} (0) attr_filter.accounting_response - --> (0) attr_filter.accounting_response - Matched entry DEFAULT at line 12 (0) attr_filter.accounting_response (updated) (0) } # send Accounting-Response (updated) (0) Sent Accounting-Response Id 49 from 10.104.145.4:1813 to 10.104.145.4:47843 via lo length 0 (0) done request (0) finished request. Ready to process requests Ready to process requests Ready to process requests For authorize and authenticate sections, I'm trying a GET using the URI on the User-name authorize { uri = "${..connect_uri}/v2/keys/%{User-Name}" method = 'get' body = ''' data = """ # tls = ${..tls} } (action, node, key and value words are declared in dictionary). echo "User-Name=201.16.124.239,NAS-Port=1812,Service-Type=8,NAS-Ip-Address=70.70.70.70,NAS-Identifier=1,Chap-Password=201.16.124.239,Chap-Challenge=1,Cleartext-Password=201.16.124.239" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1812 auth testing123 Sent Access-Request Id 128 from 0.0.0.0:50628 to 10.104.145.4:1812 length 79 User-Name = "201.16.124.239" NAS-Port = 1812 Service-Type = Authenticate-Only NAS-IP-Address = 70.70.70.70 NAS-Identifier = "1" CHAP-Password = 0x49c87256c50220fee804602c892c713d48 CHAP-Challenge = 0x31 Cleartext-Password = "201.16.124.239" Cleartext-Password = "201.16.124.239" Received Access-Reject Id 128 from 10.104.145.4:1812 to 0.0.0.0:50628 via lo length 20 (0) -: Expected Access-Accept got Access-Reject: Invalid character '' in attribute name I don’t see why the &value attribute isn’t parsed after Expanded : with raddebug : (1) running request (1) Received Access-Request ID 128 (1) User-Name = "201.16.124.239" (1) NAS-Port = 1812 (1) Service-Type = Authenticate-Only (1) NAS-IP-Address = 70.70.70.70 (1) NAS-Identifier = "1" (1) CHAP-Password = 0x49c87256c50220fee804602c892c713d48 (1) CHAP-Challenge = 0x31 (1) Running 'recv Access-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) recv Access-Request { (1) filter_user_password { (1) if (&User-Password) { (1) ... (1) } (1) } # filter_user_password (...) (1) rest - Closing connection (4): Hit idle_timeout, was idle for 1259 seconds (1) rest - You probably need to lower "min" (1) rest - 0 of 0 connections in use. You may need to increase "spare" (1) rest - Opening additional connection (5), 1 of 10 pending slots used (1) rest - Reserved connection (5) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (5) (1) rest - Need 4 more connections to reach min connections (5) (1) rest - Opening additional connection (6), 1 of 9 pending slots used (1) rest - Closing expired connection (5): Needs reconnecting (1) rest - You probably need to lower "min" (1) rest (updated) (1) check_authenticate_attributes { (1) if (!User-Password) { (1) update request { (1) &User-Password = &User-Name -> "201.16.124.239" (1) } # update request (noop) (1) update control { (1) &control:Auth-Type = rest (1) } # update control (noop) (1) } # if (!User-Password) (noop) (1) if ((!User-Name) || (!NAS-IP-Address) || (!Service-Type) || (!NAS-Identifier)) { (1) ... (1) } (1) else { (1) ok (ok) (1) } # else (ok) (1) } # check_authenticate_attributes (ok) (1) } # recv Access-Request (updated) (1) Running 'authenticate rest' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) authenticate rest { (1) rest - Reserved connection (6) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (6) (1) rest (updated) (1) } # authenticate rest (updated) (1) Failed to authenticate the user (1) Login incorrect: [201.16.124.239] (from client freeradius-cb-02 port 1812) (1) Running 'send Access-Reject' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) send Access-Reject { (1) attr_filter.access_reject - EXPAND %{User-Name} (1) attr_filter.access_reject - --> 201.16.124.239 (1) attr_filter.access_reject - Matched entry DEFAULT at line 11 (1) attr_filter.access_reject (updated) (1) } # send Access-Reject (updated) (1) Sent Access-Reject Id 128 from 10.104.145.4:1812 to 10.104.145.4:50628 via lo length 0 (1) done request (1) finished request. Ready to process requests Waking up in 29.9 seconds. Where is my error ? Best regards, Philippe _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

4 3

accounting and rlm_cache
by Dmitry Yashin 07 Nov '17

07 Nov '17

Hi, I have a bug in the network and sometimes the stop pack comes before updates. to fix this i write some like this accounting { if (Acct-Status-Type == Start) { rest } if (Acct-Status-Type == Interim-Update) { update control { Cache-Status-Only = 'yes' } cache if (notfound) { rest } else { ok } } if (Acct-Status-Type == Stop) { cache rest } #ok #rest } but this not work , in debug mode i see Tue Nov 7 21:51:00 2017 : Debug: (222) accounting { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Start) { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Start) -> FALSE Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) -> TRUE Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) { Tue Nov 7 21:51:00 2017 : Debug: (222) update control { Tue Nov 7 21:51:00 2017 : Debug: (222) Cache-Status-Only = yes Tue Nov 7 21:51:00 2017 : Debug: (222) } # update control = noop Tue Nov 7 21:51:00 2017 : Debug: (222) modsingle[accounting]: calling cache (rlm_cache) Tue Nov 7 21:51:00 2017 : Debug: %{Acct-Unique-Session-Id} Tue Nov 7 21:51:00 2017 : Debug: Parsed xlat tree: Tue Nov 7 21:51:00 2017 : Debug: attribute --> Acct-Unique-Session-Id Tue Nov 7 21:51:00 2017 : Debug: (222) cache: EXPAND %{Acct-Unique-Session-Id} Tue Nov 7 21:51:00 2017 : Debug: (222) cache: --> cc815c1b8cb89841330796a5f48bfa12 Tue Nov 7 21:51:00 2017 : Debug: (222) cache: Mutex acquired Tue Nov 7 21:51:00 2017 : Debug: (222) cache: No cache entry found for "cc815c1b8cb89841330796a5f48bfa12" Tue Nov 7 21:51:00 2017 : Debug: (222) cache: Mutex released Tue Nov 7 21:51:00 2017 : Debug: (222) modsingle[accounting]: returned from cache (rlm_cache) Tue Nov 7 21:51:00 2017 : Debug: (222) [cache] = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) } # if (Acct-Status-Type == Interim-Update) = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) } # accounting = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) Not sending reply to client. Tue Nov 7 21:51:00 2017 : Debug: (222) Finished request why not work if (notfound) in accounting ? thx

2 2

Deadlocks in Freeradius MySQL Database
by Claudio Carvalho 06 Nov '17

06 Nov '17

Hi, I am testing freeradius version 3 with RedHat Enterprise Server 7.4 and MySQL 5.6.35, even in a newly fresh/initialized database I get these messages in radius.log, has anyone else been through this situation yet? what would be the best choice of operating system, database and freeradius version that recommend as more stable? ############################################################################### ERROR: (1526654) sqlippool: ERROR: rlm_sql_mysql: ERROR 1213 (Deadlock found when trying to get lock; try restarting transaction): 40001 [root@rad-a-01 radius]# cat radius.log | wc -l 197357 [root@rad-a-01 radius]# cat radius.log | grep Deadlock | wc -l 2468 [root@rad-a-01 radius]# rpm -qa | grep freeradius freeradius-3.0.13-8.el7_4.x86_64 freeradius-mysql-3.0.13-8.el7_4.x86_64 freeradius-utils-3.0.13-8.el7_4.x86_64 freeradius-ldap-3.0.13-8.el7_4.x86_64 [root@rad-a-01 radius]# uname -a Linux rad-a-01 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 13 10:46:25 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux ############################################################################### Thanks, Claudio.

4 8