- Freeradius-Users - lists.freeradius.org

FreeRADIUS Strange action (unfinished request/dropping conflict packet)
by Ali Majdzadeh 15 Sep '11

15 Sep '11

Hi I’m running freeradius 1.1.8 with rlm_exec. External program on ACCTOUNTING packets runs and my external program returns OK! And printout the following in its logfile: (PID 5036) 2011-09-15 18:24:28 Packet: updt UserName: hhsde0100413@tct9 187923(a)172.31.3.7 10320 Sec 3993228/61717432 Bytes FreeRADIUS Debugging shows log as the following and shows everything goes fine for that request. Thu Sep 15 18:24:28 2011 : Debug: Thread 1 handling request 175, (31 handled so far) User-Name = "hhsde0100413@tct9" NAS-Port = 136339956 NAS-IP-Address = 172.31.3.7 Framed-IP-Address = 2.179.17.211 Filter-Id = "tct9" Class = 0x68687364653031303034313340746374397c387c3137322e33312e332e377c316361666637623036653264 rad_recv: Accounting-Request packet from host 172.31.3.7:1813, id=92, length=530 NAS-Identifier = "KJ-RJ-ME60X16-01" Acct-Status-Type = Interim-Update Acct-Delay-Time = 0 Acct-Input-Octets = 3993228 Acct-Output-Octets = 61717432 Acct-Session-Id = "KJ-RJ-M08206050000000890a6e187923" Acct-Authentic = RADIUS Acct-Session-Time = 10320 Acct-Input-Packets = 45602 Acct-Output-Packets = 50322 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Thu Sep 15 18:24:28 2011 : Debug: Thread 1 handling request 175, (31 handled so far) Thu Sep 15 18:24:28 2011 : Debug: modcall: entering group preacct for request 175 Thu Sep 15 18:24:28 2011 : Debug: modsingle[preacct]: calling preprocess (rlm_preprocess) for request 175 Acct-Session-Time = 10320Thu Sep 15 18:24:28 2011 : Debug: modsingle[preacct]: returned from preprocess (rlm_preprocess) for request 175 Thu Sep 15 18:24:28 2011 : Debug: modcall[preacct]: module "preprocess" returns noop for request 175 Thu Sep 15 18:24:28 2011 : Debug: modsingle[preacct]: calling acct_unique (rlm_acct_unique) for request 175 Thu Sep 15 18:24:28 2011 : Debug: modsingle[preacct]: returned from acct_unique (rlm_acct_unique) for request 175 Thu Sep 15 18:24:28 2011 : Debug: modcall[preacct]: module "acct_unique" returns ok for request 175 Thu Sep 15 18:24:28 2011 : Debug: modcall: leaving group preacct (returns ok) for request 175 Thu Sep 15 18:24:28 2011 : Debug: modcall: entering group accounting for request 175 Thu Sep 15 18:24:28 2011 : Debug: modsingle[accounting]: calling detail (rlm_detail) for request 175 Thu Sep 15 18:24:28 2011 : Debug: modsingle[accounting]: returned from detail (rlm_detail) for request 175 Thu Sep 15 18:24:28 2011 : Debug: modcall[accounting]: module "detail" returns ok for request 175 Thu Sep 15 18:24:28 2011 : Debug: modsingle[accounting]: calling netbill_acct (rlm_exec) for request 175 Tcpdump shows the accounting packet issued and returned back to the RAS: IP 172.31.3.7.radius-acct > 172.26.60.3.radius-acct: RADIUS, Accounting Request (4), id: 0xx length: 527 IP 172.26.60.3.radius-acct > 172.31.3.7.radius-acct: RADIUS, Accounting Response (5), id: 0xxx length: 20 But after about 30 secound, I got the following error in freeRADIUS’s log!!!! Thu Sep 15 18:24:59 2011 : Error: WARNING: Unresponsive child (id 3086457744) for request 175 (in component accounting module rlm_exec) hhsde0100413@tct9 Thu Sep 15 18:24:59 2011 : Debug: Server rejecting request 175. And then shows: Thu Sep 15 18:43:54 2011 : Error: Dropping conflicting packet from client 172.31.3.7:1646 - ID: 151 due to unfinished request 175 My external program returns 0 (means OK) and freeRADIUS getting it and returns back to the BRAS, so why freeradius gives such error?! Kind Regards, Ali Majdzadeh Kohbanani

2 1

Slow DB / outstanding requests
by Johan Meiring 15 Sep '11

15 Sep '11

Hi, Seeing as the list is quiet, something that might be of interest. I am running 2.1.12 on a production server. The server is (was) severly underpowered and the database was straining. I was expenting the normal - "rejecting duplicate request". (Cant remember exact error). Then the server received about 30 access requests in about .1 second It then went into a state where the following appeared over and over in the log: Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 647 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 648 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 649 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 650 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 651 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 652 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 690 in component <core> module <queue>. Mon Sep 12 11:33:46 2011 : Info: WARNING: Child is hung for request 685 in component <core> module <queue>. Mon Sep 12 11:33:47 2011 : Info: WARNING: Child is hung for request 691 in component <core> module <queue>. Mon Sep 12 11:33:47 2011 : Info: WARNING: Child is hung for request 692 in component <core> module <queue>. Mon Sep 12 11:33:47 2011 : Info: WARNING: Child is hung for request 693 in component <core> module <queue>. Mon Sep 12 11:33:47 2011 : Info: WARNING: Child is hung for request 694 in component <core> module <queue>. Mon Sep 12 11:33:47 2011 : Info: WARNING: Child is hung for request 677 in component <core> module <queue>. Mon Sep 12 11:33:47 2011 : Info: WARNING: Child is hung for request 686 in component <core> module <queue>. Mon Sep 12 11:33:48 2011 : Info: WARNING: Child is hung for request 625 in component <core> module <queue>. Mon Sep 12 11:33:48 2011 : Info: WARNING: Child is hung for request 626 in component <core> module <queue>. Mon Sep 12 11:33:48 2011 : Info: WARNING: Child is hung for request 627 in component <core> module <queue>. Mon Sep 12 11:33:48 2011 : Info: WARNING: Child is hung for request 628 in component <core> module <queue>. It never recovered. Had to be restarted. Even with no database queries outstanding. Dont know if 2.1.12 has more "difficulty" with slow databases? Unfortunately dont have more info, so this can probably be ignored. Cheers, -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 -------------------- Before acting on this email or opening any attachments you should read Cape PC Service's email disclaimer at: http://www.pcservices.co.za/disclaimer.html

3 2

anybody out there?
by Arran Cudbard-Bell 15 Sep '11

15 Sep '11

poke poke Arran Cudbard-Bell a.cudbardb(a)freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !

3 2

Re: Test
by Imad Soltani 15 Sep '11

15 Sep '11

people are quiet :) Le jeu 15/09/11 16:49, Alan DeKok aland(a)deployingradius.com a écrit: > Is the list down, or are people quiet? > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

2 1

Re: Quick enable/disable user account.
by 2394263740 15 Sep '11

15 Sep '11

Hello, everyone, Thanks you all for your help. In my implementation, users have 3 states, 1. Need activation. 2. Enabled. 3. Disabled. So I use below method my my freeradiuis server. Update the attribute value to 3 status based on needs. It works. 1. Needactivation 2. Password 3. Disabled There're a couple of other solutions as people advised. I will try that needed. Thanks! Tom

1 0

Internal Sanity Check Fails
by DaveA 14 Sep '11

14 Sep '11

Hello, I have a perfectly working environment on a dev machine with FR 2.1.10-5 and very odd things are happening when I try and copy the configs to the production machine running the same version. The *ONLY* change I made on the prod version is in proxy.conf realm test.myrealdomain.com { } now reads realm myrealdomain.com { } The dev version properly handles the realm locally and everything is fine. After I make this change, FreeRadius tries proxying the requests for blah.com repeatedly to one of the servers configured in the DEFAULT realm, and then I get a log message: WARNING: Internal sanity check failed in event handler... If I revert my change on the prod box, everything goes back to normal. Ideas? Thanks, Dave -- View this message in context: http://freeradius.1045715.n5.nabble.com/Internal-Sanity-Check-Fails-tp48042… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRADIUS with NETGEAR WG103 WAP
by Ian Pilcher 14 Sep '11

14 Sep '11

Has anyone used $SUBJECT configuration? I am considering the WG103 for my home network, and I would really like to use its RADIUS support to start using "real" user IDs, rather than shared keys. I'm an experienced Linux admin (Red Hat RHCA certified), and I've got a pretty good familiarity with SSL and VLANs, but I have absolutely no experience with [Free]RADIUS. * Has anyone set up FreeRADIUS with the WG103 (or any other NETGEAR access point)? * How difficult is this likely to be? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================

4 6

WiSPr
by Luke Hammond 14 Sep '11

14 Sep '11

Hey al, iread that i can rate limit on a per user basis with the WISPr-Bandwidth-Max-Down and Up.. correct? Can someone please tell me how i can do this? I have freeradius running on Ubuntu server, with mysql atabase and daloradius for web management. My users connect to the freeradius through the captive portal on my pfSense firewall. Thanks in advance

3 6

Problem with update request
by Fabian Mikołajczak 14 Sep '11

14 Sep '11

Hi all, I'm trying to replace User-Name and User-Password with ADSL-Agent-Circuit-Id in request and it does not work. Configuration and debug output below. What I am doing wrong? freeradius: FreeRADIUS Version 2.1.10 --- config file --- if ADSL-Agent-Circuit-Id { update request { User-Name := "%{%{ADSL-Agent-Circuit-Id}:-bar}" User-Password := "%{ADSL-Agent-Circuit-Id}" } } --- debug Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 50917, id=104, length=69 User-Name = "00:16:17:eb:e1:ca" User-Password = "Redback" ADSL-Agent-Circuit-Id = "\000\001\001\024" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++? if ADSL-Agent-Circuit-Id Evaluating (ADSL-Agent-Circuit-Id) -> TRUE ++? if ADSL-Agent-Circuit-Id -> TRUE ++- entering if ADSL-Agent-Circuit-Id {...} expand: %{ADSL-Agent-Circuit-Id} -> ... expanding second conditional expand: %{%{ADSL-Agent-Circuit-Id}:-bar} -> bar expand: %{ADSL-Agent-Circuit-Id} -> +++[request] returns ok ++- if ADSL-Agent-Circuit-Id returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bar", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} ++[pap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject --- Do you have any idea? Thanks. -- Fabian

2 1

Quick enable/disable user account.
by 2394263740 14 Sep '11

14 Sep '11

Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql Sometime, I need disable a user account in mysql database. And then enable it later on after some check complete. Can you please advise how to toggle such status? There're may be multiple solutions, please advise them all, so I can choose a one most fit the needs. Thanks! Tom

7 21