February 2017 - Freeradius-Users - lists.freeradius.org

buffered-sql problem
by Jouni Soini 07 Feb '17

07 Feb '17

there seems to be a problem with buffered-sql it sometimes doesn't pick the accounting request from detail file and just skip it. this happens once in a few million requests and I had to debug and monitor this for several days to find one (looking for a user who remains online) nothing special exists in debug logs. the accounting request is logged to detail file but the sql statement part doesn't exits. following is the debug logs as you can see the accounting request is logged to detail file (in my tests to two separate files for extra monitoring) but it is not sent to sql database tested with 3.0.12 version on Ubuntu 16.04 as you can see the sql query for user 'test1' is skipped (494090) Wed Jan 25 12:04:10 2017: Debug: Received Accounting-Request Id 188 from 82.21.11.91:28850 to 82.21.11.50:1813 length 107 (494090) Wed Jan 25 12:04:10 2017: Debug: User-Name = "test1" (494090) Wed Jan 25 12:04:10 2017: Debug: NAS-IP-Address = 82.21.11.91 (494090) Wed Jan 25 12:04:10 2017: Debug: NAS-Port = 23449 (494090) Wed Jan 25 12:04:10 2017: Debug: Acct-Status-Type = Stop (494090) Wed Jan 25 12:04:10 2017: Debug: Framed-IP-Address = 10.8.0.98 (494090) Wed Jan 25 12:04:10 2017: Debug: Acct-Input-Gigawords = 0 (494090) Wed Jan 25 12:04:10 2017: Debug: Acct-Input-Octets = 8323 (494090) Wed Jan 25 12:04:10 2017: Debug: Acct-Output-Octets = 8111 (494090) Wed Jan 25 12:04:10 2017: Debug: Acct-Session-Id = "68r3xt2pb8y8" (494090) Wed Jan 25 12:04:10 2017: Debug: Acct-Output-Gigawords = 0 (494090) Wed Jan 25 12:04:10 2017: Debug: Calling-Station-Id = "127.0.0.1" (494090) Wed Jan 25 12:04:10 2017: Debug: # Executing section preacct from file /etc/freeradius/sites-enabled/default (494090) Wed Jan 25 12:04:10 2017: Debug: preacct { (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[preacct]: calling preprocess (rlm_preprocess) (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[preacct]: returned from preprocess (rlm_preprocess) (494090) Wed Jan 25 12:04:10 2017: Debug: [preprocess] = ok (494090) Wed Jan 25 12:04:10 2017: Debug: policy acct_unique { (494090) Wed Jan 25 12:04:10 2017: Debug: update request { (494090) Wed Jan 25 12:04:10 2017: Debug: Tmp-String-9 := "ai:" (494090) Wed Jan 25 12:04:10 2017: Debug: } # update request = noop (494090) Wed Jan 25 12:04:10 2017: Debug: if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (494090) Wed Jan 25 12:04:10 2017: Debug: EXPAND %{hex:&Class} (494090) Wed Jan 25 12:04:10 2017: Debug: --> (494090) Wed Jan 25 12:04:10 2017: Debug: EXPAND ^%{hex:&Tmp-String-9} (494090) Wed Jan 25 12:04:10 2017: Debug: --> ^61693a (494090) Wed Jan 25 12:04:10 2017: Debug: if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (494090) Wed Jan 25 12:04:10 2017: Debug: else { (494090) Wed Jan 25 12:04:10 2017: Debug: update request { (494090) Wed Jan 25 12:04:10 2017: Debug: EXPAND %{md5:%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (494090) Wed Jan 25 12:04:10 2017: Debug: --> b1cbd13cc01616d5f451e33b24aeb893 (494090) Wed Jan 25 12:04:10 2017: Debug: &Acct-Unique-Session-Id := b1cbd13cc01616d5f451e33b24aeb893 (494090) Wed Jan 25 12:04:10 2017: Debug: } # update request = noop (494090) Wed Jan 25 12:04:10 2017: Debug: } # else = noop (494090) Wed Jan 25 12:04:10 2017: Debug: } # policy acct_unique = noop (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[preacct]: calling suffix (rlm_realm) (494090) Wed Jan 25 12:04:10 2017: Debug: suffix: Checking for suffix after "@" (494090) Wed Jan 25 12:04:10 2017: Debug: suffix: No '@' in User-Name = "test1", looking up realm NULL (494090) Wed Jan 25 12:04:10 2017: Debug: suffix: No such realm "NULL" (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[preacct]: returned from suffix (rlm_realm) (494090) Wed Jan 25 12:04:10 2017: Debug: [suffix] = noop (494090) Wed Jan 25 12:04:10 2017: Debug: } # preacct = ok (494090) Wed Jan 25 12:04:10 2017: Debug: # Executing section accounting from file /etc/freeradius/sites-enabled/default (494090) Wed Jan 25 12:04:10 2017: Debug: accounting { (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: calling detail (rlm_detail) (494090) Wed Jan 25 12:04:10 2017: Debug: detail: EXPAND /var/log/freeradius/radacct/detail-%Y%m%d (494090) Wed Jan 25 12:04:10 2017: Debug: detail: --> /var/log/freeradius/radacct/detail-20170125 (494090) Wed Jan 25 12:04:10 2017: Debug: detail: /var/log/freeradius/radacct/detail-%Y%m%d expands to /var/log/freeradius/radacct/detail-20170125 (494090) Wed Jan 25 12:04:10 2017: Debug: detail: EXPAND %t (494090) Wed Jan 25 12:04:10 2017: Debug: detail: --> Wed Jan 25 12:04:10 2017 (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: returned from detail (rlm_detail) (494090) Wed Jan 25 12:04:10 2017: Debug: [detail] = ok (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: calling detail2 (rlm_detail) (494090) Wed Jan 25 12:04:10 2017: Debug: detail2: EXPAND /var/log/freeradius/radacct/debug/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (494090) Wed Jan 25 12:04:10 2017: Debug: detail2: --> /var/log/freeradius/radacct/debug/82.21.11.91/detail-20170125 (494090) Wed Jan 25 12:04:10 2017: Debug: detail2: /var/log/freeradius/radacct/debug/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/debug/82.21.11.91/detail-20170125 (494090) Wed Jan 25 12:04:10 2017: Debug: detail2: EXPAND %t (494090) Wed Jan 25 12:04:10 2017: Debug: detail2: --> Wed Jan 25 12:04:10 2017 (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: returned from detail2 (rlm_detail) (494090) Wed Jan 25 12:04:10 2017: Debug: [detail2] = ok (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: calling exec (rlm_exec) (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: returned from exec (rlm_exec) (494090) Wed Jan 25 12:04:10 2017: Debug: [exec] = noop (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: calling attr_filter.accounting_response (rlm_attr_filter) (494090) Wed Jan 25 12:04:10 2017: Debug: attr_filter.accounting_response: EXPAND %{User-Name} (494090) Wed Jan 25 12:04:10 2017: Debug: attr_filter.accounting_response: --> test1 (494090) Wed Jan 25 12:04:10 2017: Debug: attr_filter.accounting_response: Matched entry DEFAULT at line 12 (494090) Wed Jan 25 12:04:10 2017: Debug: modsingle[accounting]: returned from attr_filter.accounting_response (rlm_attr_filter) (494090) Wed Jan 25 12:04:10 2017: Debug: [attr_filter.accounting_response] = updated (494090) Wed Jan 25 12:04:10 2017: Debug: } # accounting = updated (494090) Wed Jan 25 12:04:10 2017: Debug: Sent Accounting-Response Id 188 from 82.21.11.50:1813 to 82.21.11.91:28850 length 0 (494090) Wed Jan 25 12:04:10 2017: Debug: Finished request (494091) Wed Jan 25 12:04:10 2017: Debug: Received Accounting-Request Id 189 from 82.21.11.91:57448 to 82.21.11.50:1813 length 79 ... logs for next request "test2" ... (494090) Wed Jan 25 12:04:10 2017: Debug: Cleaning up request packet ID 188 with timestamp +243824 (494091) Wed Jan 25 12:04:10 2017: Debug: Cleaning up request packet ID 189 with timestamp +243824 (494092) Wed Jan 25 12:04:11 2017: Debug: Empty preacct section in virtual server "buffered-sql". Using default return values. (494092) Wed Jan 25 12:04:11 2017: Debug: # Executing section accounting from file /etc/freeradius/sites-enabled/buffered-sql (494092) Wed Jan 25 12:04:11 2017: Debug: accounting { (494092) Wed Jan 25 12:04:11 2017: Debug: modsingle[accounting]: calling sql (rlm_sql) (494092) Wed Jan 25 12:04:11 2017: Debug: sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (494092) Wed Jan 25 12:04:11 2017: Debug: sql: --> type.start.query (494092) Wed Jan 25 12:04:11 2017: Debug: sql: Using query template 'query' (494092) Wed Jan 25 12:04:11 2017: Debug: sql: EXPAND %{User-Name} (494092) Wed Jan 25 12:04:11 2017: Debug: sql: --> test2

3 24

Check Password Against External DB
by David Teston 07 Feb '17

07 Feb '17

Hi All, My company runs an application that hashes/encrypts user passwords in a central postgres DB. I have a bash script that can be run remotely to check a username and password against it: ./script.sh <user> <plaintext_pass> The end goal is to store the username and encrypted password on the local FR postgres DB, but always/only check the password against the central DB. This will account for any password/permissions changes that occur on the application DB. My fear is that I will not be able to use EAP or CHAP (and their various sub-types) because of client-side password hashing. It seems that PAP will be the only usable solution because it would still provide the server with a plaintext password to be passed into the script. But I run into security issues with PAP. Does anyone know of a proper method that would allow me to check all user credentials against the external DB while still remaining secure throughout the entire process? Thanks in advance, David -- David Teston PINES System Administrator

3 2

Additional request information in radius.log
by douglas eseng 07 Feb '17

07 Feb '17

Is it possible to have additional request attributes log into radius.log? Like the log entries below, other than a request number or ID. Maybe also log some of the radius attributes. Fri Feb 3 08:24:15 2017 : Error: Rejecting request 16044 (proxy Id 223) due to lack of any response from home server NAS02 port 1813 Fri Feb 3 08:25:34 2017 : Error: Discarding duplicate request from client NAS14 port 1645 - ID: 66 due to unfinished request 16900 in component <core> module <queue>. It would be helpful when tracing through packets capture from tcpdump. Thanks.

3 3

TACACS+ is now in the v4.0.x branch
by Alan DeKok 06 Feb '17

06 Feb '17

I've just committed a patch to add TACACS+ to the v4.0.x branch: https://github.com/FreeRADIUS/freeradius-server/commit/6a59647304955d984f2e… It's experimental, and works in basic tests. Minor things in the configuration are likely to change as we update v4, but the basic TACACS+ functionality should remain the same. Thanks to Alexander Clouter for doing the work. He had to read the TACACS+ proposed standard document, and figure out what it said: not much... The implementation is inter-operable with the switches we have access to, but you never now. People interested in trying the bleeding edge can now use TACACS+ in the v4 branch. Alan DeKok.

4 6

limiting fail timeout for an LDAP module
by Zenon Mousmoulas 06 Feb '17

06 Feb '17

Hi, I am working with a peculiar LDAP backend which, from time to time, will take upwards of 10 seconds to respond to a search request. I know that is what needs fixing, but let's say I have to live with it for now. There is a second LDAP backend which I can use a backup when the first one goes nuts. So I'm thinking let's setup two LDAP module instances and use them in a redundant group. For this to be usable for EAP authentication however, I need to make sure freeradius fails the first LDAP module within some (short) time limit. I have thus been trying to tweak the first LDAP module instance settings in order to achieve that. After experimenting with these settings: options.res_timeout options.srv_timelimit pool.start I found that if I set pool.start=0 and, say, options.res_timeout=2 freeradius reconnects (retrying the search once) and fails the module after a total of 4 seconds: Fri Feb 3 18:29:43 2017 : Debug: (1) ldap_first_bad: Waiting for search result... Fri Feb 3 18:29:44 2017 : Debug: Waking up in 0.4 seconds. Fri Feb 3 18:29:44 2017 : Debug: Waking up in 0.7 seconds. Fri Feb 3 18:29:45 2017 : Debug: Waking up in 1.1 seconds. Fri Feb 3 18:29:45 2017 : Debug: rlm_ldap: Closing libldap handle 0x7fa240000cb0 Fri Feb 3 18:29:45 2017 : Debug: rlm_ldap (ldap_first_bad): Reconnecting (0) Fri Feb 3 18:29:45 2017 : Debug: rlm_ldap (ldap_first_bad): Connecting to ldaps://xxxxxxxx Fri Feb 3 18:29:45 2017 : Debug: rlm_ldap (ldap_first_bad): New libldap handle 0x7fa238000da0 Fri Feb 3 18:29:45 2017 : Debug: rlm_ldap (ldap_first_bad): Waiting for bind result... Fri Feb 3 18:29:45 2017 : Debug: rlm_ldap (ldap_first_bad): Bind successful Fri Feb 3 18:29:45 2017 : WARNING: (1) ldap_first_bad: Search failed: Timed out while waiting for server to respond. Got new socket, retrying... Fri Feb 3 18:29:45 2017 : Debug: (1) ldap_first_bad: Waiting for search result... Fri Feb 3 18:29:46 2017 : Debug: Waking up in 1.6 seconds. Fri Feb 3 18:29:47 2017 : Debug: rlm_ldap: Closing libldap handle 0x7fa238000da0 Fri Feb 3 18:29:47 2017 : Debug: rlm_ldap (ldap_first_bad): Reconnecting (0) Fri Feb 3 18:29:47 2017 : Debug: rlm_ldap (ldap_first_bad): Connecting to ldaps://xxxxxxxx Fri Feb 3 18:29:47 2017 : Debug: rlm_ldap (ldap_first_bad): New libldap handle 0x7fa238000da0 Fri Feb 3 18:29:47 2017 : Debug: rlm_ldap (ldap_first_bad): Waiting for bind result... Fri Feb 3 18:29:47 2017 : Debug: rlm_ldap (ldap_first_bad): Bind successful Fri Feb 3 18:29:47 2017 : WARNING: (1) ldap_first_bad: Search failed: Timed out while waiting for server to respond. Got new socket, retrying... Fri Feb 3 18:29:47 2017 : Debug: (1) ldap_first_bad: Waiting for search result... Fri Feb 3 18:29:48 2017 : Debug: Waking up in 2.5 seconds. Fri Feb 3 18:29:48 2017 : Error: (1) Ignoring duplicate packet from client localhost port 34423 - ID: 11 due to unfinished request in component authorize module ldap_first_bad Fri Feb 3 18:29:48 2017 : Debug: Waking up in 1.9 seconds. Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap: Closing libldap handle 0x7fa238000da0 Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): Reconnecting (0) Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): Connecting to ldaps://xxxxxxxx Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): New libldap handle 0x7fa238000da0 Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): Waiting for bind result... Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): Bind successful Fri Feb 3 18:29:49 2017 : WARNING: (1) ldap_first_bad: Search failed: Timed out while waiting for server to respond. Got new socket, retrying... Fri Feb 3 18:29:49 2017 : ERROR: (1) ldap_first_bad: Hit reconnection limit Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): Released connection (0) Fri Feb 3 18:29:49 2017 : Info: rlm_ldap (ldap_first_bad): Need 1 more connections to reach 10 spares Fri Feb 3 18:29:49 2017 : Info: rlm_ldap (ldap_first_bad): Opening additional connection (2), 1 of 30 pending slots used Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): Connecting to ldaps://xxxxxxxx Fri Feb 3 18:29:49 2017 : Debug: rlm_ldap (ldap_first_bad): New libldap handle 0x7fa2380215b0 Fri Feb 3 18:29:50 2017 : Debug: rlm_ldap (ldap_first_bad): Waiting for bind result... Fri Feb 3 18:29:50 2017 : Debug: rlm_ldap (ldap_first_bad): Bind successful Fri Feb 3 18:29:50 2017 : Debug: (1) modsingle[authorize]: returned from ldap_first_bad (rlm_ldap) Fri Feb 3 18:29:50 2017 : Debug: (1) [ldap_first_bad] = fail Fri Feb 3 18:29:50 2017 : Debug: (1) modsingle[authorize]: calling ldap_backup (rlm_ldap) I am wondering if this is as good as it gets or if there are other things to tweak or to try, to get a shorter timeout in this particular case, perhaps avoiding the side effect of start=0 documented therein (Set to 0 to allow the server to start without the directory being available). This is on freeradius 3.0.12. Thanks for any insight, Z.

3 4

Accounting Packets and Anonymous Identity
by Selahattin Cilek 05 Feb '17

05 Feb '17

I have been checking the traffic between NASes and FreeRADIUS (2.2.9) and I have come across accounting packets with the User-Name field set to "anonymous." Sun Nov 13 02:41:50 2016 Acct-Session-Id = "57B6F41F-000014D2" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "anonymous" NAS-Identifier = "KAT_8_MERDIVEN" Called-Station-Id = "DC-9F-DB-34-CF-B4:TDV.NET" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Calling-Station-Id = "F8-16-54-1E-AB-2C" Connect-Info = "CONNECT 0Mbps 802.11b" Acct-Session-Id = "57B6F41F-000014D2" NAS-IP-Address = 192.168.0.38 FreeRADIUS-Acct-Session-Start-Time = "Nov 13 2016 02:41:50 EET" Acct-Unique-Session-Id = "6c4322c41296866a" Timestamp = 1478997710 1. This server does not use MySQL and keeps the accounting data in plain text files. If I were using MySQL as the back-end, would I still see the user's name as "anonymous" in the "radacct.username" field? 2. Is it possible to find the true identity of the user by means of reading some files or an SQL query and using the other data provided in the packet such as Acct-Session-Id, Calling-Station-Id or Acct-Unique-Session-Id etc? --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

7 13

v3.0.12 crashed (load testing)
by Chris Howley 05 Feb '17

05 Feb '17

Hi, I'm load testing freeradius 3.0.12 using GNU parallel and eapol_test. I'm trying to integrate freeradius with Active Directory. After ten hours of testing the freeradius server crashed (see below). The system is using the following: CentOS Linux release 7.2.1511 parallel-20160222-1.el7.noarch wpa_supplicant-2.0-17.el7_1.x86_64 samba-common-4.2.10-7 freeradius-3.0.12-2.el7 (built RPMS using gcc version 4.8.5) I can share the output from the debugger off-list. Help in fixing this issue would appreciated. Thanks, Chris Howley Sat Feb 4 20:01:47 2017 : Error: ASSERT FAILED src/main/connection.c[827]: pool->active == pool->num CAUGHT SIGNAL: Aborted Backtrace of last 39 frames: /usr/lib64/freeradius/libfreeradius-radius.so(fr_fault+0xa7)[0x7f48dabb0397] /usr/lib64/freeradius/libfreeradius-server.so(rad_assert_fail+0x29)[0x7f48dae09b59] /usr/sbin/radiusd[0x42c80c] /usr/lib64/freeradius/rlm_mschap.so(do_auth_wbclient+0x11a)[0x7f48d3f160aa] /usr/lib64/freeradius/rlm_mschap.so(+0x2301)[0x7f48d3f12301] /usr/lib64/freeradius/rlm_mschap.so(+0x4bc1)[0x7f48d3f14bc1] /usr/sbin/radiusd[0x426faf] /usr/sbin/radiusd[0x427ad9] /usr/sbin/radiusd[0x42688e] /usr/sbin/radiusd[0x427ad9] /usr/sbin/radiusd[0x42688e] /usr/sbin/radiusd(modcall+0x56)[0x427b96] /usr/sbin/radiusd(indexed_modcall+0xad)[0x42238d] /usr/lib64/freeradius/rlm_eap_mschapv2.so(+0x1dfb)[0x7f48cfa6edfb] /usr/lib64/freeradius/rlm_eap.so(+0x3795)[0x7f48d5dc4795] /usr/lib64/freeradius/rlm_eap.so(eap_method_select+0xb9)[0x7f48d5dc4b09] /usr/lib64/freeradius/rlm_eap.so(+0x2b36)[0x7f48d5dc3b36] /usr/sbin/radiusd[0x426faf] /usr/sbin/radiusd[0x427ad9] /usr/sbin/radiusd[0x42688e] /usr/sbin/radiusd(modcall+0x56)[0x427b96] /usr/sbin/radiusd(indexed_modcall+0xad)[0x42238d] /usr/sbin/radiusd(rad_authenticate+0x7be)[0x4112de] /usr/sbin/radiusd(rad_virtual_server+0x272)[0x411802] /usr/lib64/freeradius/rlm_eap_peap.so(eappeap_process+0x6d3)[0x7f48cfc75833] /usr/lib64/freeradius/rlm_eap_peap.so(+0x1c0a)[0x7f48cfc73c0a] /usr/lib64/freeradius/rlm_eap.so(+0x3795)[0x7f48d5dc4795] /usr/lib64/freeradius/rlm_eap.so(eap_method_select+0xb9)[0x7f48d5dc4b09] /usr/lib64/freeradius/rlm_eap.so(+0x2b36)[0x7f48d5dc3b36] /usr/sbin/radiusd[0x426faf] /usr/sbin/radiusd[0x427ad9] /usr/sbin/radiusd[0x42688e] /usr/sbin/radiusd(modcall+0x56)[0x427b96] /usr/sbin/radiusd(indexed_modcall+0xad)[0x42238d] /usr/sbin/radiusd(rad_authenticate+0x7be)[0x4112de] /usr/sbin/radiusd[0x4374c3] /usr/sbin/radiusd[0x42f443] /lib64/libpthread.so.0(+0x7dc5)[0x7f48d947edc5] /lib64/libc.so.6(clone+0x6d)[0x7f48d8d2eced] Calling: gdb -silent -x /etc/raddb/panic.gdb /usr/sbin/radiusd 47031 2>&1 | tee /var/log/radius/gdb-radiusd-47031.log Temporarily setting PR_DUMPABLE to 1 Resetting PR_DUMPABLE to 0 Panic action exited with 0 _EXIT(0) CALLED src/lib/debug.c[743]

2 1

getting error such max_requests set too low in configurations
by manjunath uthappa ponnachana 04 Feb '17

04 Feb '17

Hi,Getting following error when using  free radius under heavy load,Thu Feb  2 20:18:00 2017 : Error: Dropping request (13057 is too many): from client  port 41215 - ID: 244Thu Feb  2 20:18:00 2017 : Info: WARNING: Please check the configuration file.     The value for 'max_requests' is probably set too low. Thu Feb  2 20:18:00 2017 : Error: Dropping request (13057 is too many): from client  port 40991 - ID: 192Thu Feb  2 20:18:00 2017 : Info: WARNING: Please check the configuration file.     The value for 'max_requests' is probably set too low.Please let me know, what might be the problem and resolution for the problem. Thanks & regardsManjunath 

2 1

Garbage password from pam_radius_auth with skip_passwd set
by Ilkka Virta 03 Feb '17

03 Feb '17

I'm using pam_radius_auth with 'skip_passwd' to talk to FreeRADIUS, and seem to be receiving garbage passwords in the initial request, instead of the empty password I expected. (USAGE says pam_radius_auth sends a "NULL" password, but I don't know if it means the User-Password field is to be zero-length, zero-filled, or nonexisting.) PAM config: auth required pam_radius_auth-1.4.0.so debug skip_passwd The User-Password contained in the initial request appears as 16 random-looking bytes: > ------------- freeradius -X > rad_recv: Access-Request packet from host 127.0.0.1 port 41394, id=210, length=72 > User-Name = "user" > User-Password = "\222\350)\2304Z@ \374\217G>߇<\t" > ... > > rlm_perl: test.pl: RAD_REQUEST: User-Password = '\222\350)\2304Z@ \374\217G>�?<\t' > rlm_perl: Added pair User-Password = \222\350)\2304Z@ \374\217G>�?<\t The "rlm_perl: test.pl" line comes from a perl script that just prints the received values, like example.pl. If I give an empty response to a password prompt, I get the empty password as expected: > ------------- freeradius -X > rad_recv: Access-Request packet from host 127.0.0.1 port 41394, id=211, length=71 > User-Name = "user" > User-Password = "" > > rlm_perl: test.pl: RAD_REQUEST: User-Password = '' > rlm_perl: Added pair User-Password = This works with both the initial password prompt if skip_passwd is not set, and in replies to any Access-Challenges sent later on. I don't think this is the expected behaviour given the documentation, any thoughts?

2 2

Logging proxy server
by Chris Taylor (chtaylo2) 03 Feb '17

03 Feb '17

1.) Is it possible to log the home_server which proxied a connection? Log today: radiusd[22590]: (436) Login OK: [Radius-ACE-Prob@REMOTE] (from client Radius-ACE-Prob port 0) [Source: 111.111.111.111] I’d like to be able to log --> [Proxy: home_server_A]. If not possible there, how about in post-proxy { post_proxy_log } Thanks

2 5