- Freeradius-Users - lists.freeradius.org

Re: speed of detail reader server
by Alexandru Oprisan 24 Jun '10

24 Jun '10

On 23.06.2010 10:07, freeradius-users-request(a)lists.freeradius.org wrote: > On Mon, Jun 21, 2010 at 07:48:19PM +0300, Alexandru Oprisan wrote: >> > I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. >> > I have everything set up, the only problem seems to be the speed of >> > the 'detail reader server'. I do quite a lot off accounting packets on >> > the box ( no auth ), the detail writer has already written 1.9G of >> > details ( in about 5 hours ) to hourly files, but the detail reader is >> > lagging far behind (still working on the first file). I only see about 1 >> > row inserted per second, but I know the server can do far more. >> > I have set load-factor to 100, doesn't seem to help. > The detail reader is serial in nature, meaning it will read a packet, > transmit it, and wait for a response. Upon receipt of an ack it will > repeat for the next packet. If you have any sort of latency on your > link you can easily get heavily backlogged. > > We ended up implementing a proxy in between the detail file reader and > the remote end; the proxy (a custom Perl script) transmits across > several sockets, which the remote end seems to be able to deal with > properly. This has alleviated any backlog. > > I have grand plans to modify the reader to transmit non-serially, but so > far have not had the tuits to apply to the problem. I'm not sure I would > recommend the proxy solution, but if you can manage it, it may be a > reasonable stop-gap. > I have worked around the problem by compiling freeradius 2.1.7. I noticed in the release notes for 2.1.7 the following bug fix: Allow detail file reader to be faster when "load_factor = 100" It seems to work perfectly, the detail reader caught up with the detail writer in just a few hours. The reason I had not compiled 2.1.7 previously is that it does not compile in gentoo ( using emerge ) unless you add the "threads" USE flag ( which I didn't know ) Thanks for your answer. Alex

1 0

Re: Freeradius-Users Digest, Vol 62, Issue 96
by Alexandru Oprisan 24 Jun '10

24 Jun '10

On 23.06.2010 10:07, freeradius-users-request(a)lists.freeradius.org wrote: > On Mon, Jun 21, 2010 at 07:48:19PM +0300, Alexandru Oprisan wrote: >> > I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. >> > I have everything set up, the only problem seems to be the speed of >> > the 'detail reader server'. I do quite a lot off accounting packets on >> > the box ( no auth ), the detail writer has already written 1.9G of >> > details ( in about 5 hours ) to hourly files, but the detail reader is >> > lagging far behind (still working on the first file). I only see about 1 >> > row inserted per second, but I know the server can do far more. >> > I have set load-factor to 100, doesn't seem to help. > The detail reader is serial in nature, meaning it will read a packet, > transmit it, and wait for a response. Upon receipt of an ack it will > repeat for the next packet. If you have any sort of latency on your > link you can easily get heavily backlogged. > > We ended up implementing a proxy in between the detail file reader and > the remote end; the proxy (a custom Perl script) transmits across > several sockets, which the remote end seems to be able to deal with > properly. This has alleviated any backlog. > > I have grand plans to modify the reader to transmit non-serially, but so > far have not had the tuits to apply to the problem. I'm not sure I would > recommend the proxy solution, but if you can manage it, it may be a > reasonable stop-gap. > I have worked around the problem by compiling freeradius 2.1.7. I noticed in the release notes for 2.1.7 the following bug fix: Allow detail file reader to be faster when "load_factor = 100" It seems to work perfectly, the detail reader caught up with the detail writer in just a few hours. The reason I had not compiled 2.1.7 previously is that it does not compile in gentoo ( using emerge ) unless you add the "threads" USE flag ( which I didn't know ) Thanks for your answer. Alex

1 0

howto stop one connection and start another
by Spacelee 24 Jun '10

24 Jun '10

i use pptp and freeradius2+mysql the situation is : there is a user it set to be Simultaneous-Use := 1 when he login in his ipad, he watch some movie, then he want to login in his iphone, how can i stop his original connection and start another connection in freeradius? -- Spacelee

1 0

freeradius 2.1.8, eap-tls with 3Com AccessPoint
by Phanuphong Thipsuk 24 Jun '10

24 Jun '10

Hi, I've installed freeradius 2.1.8, eap-tls with 3Com Access point (3CRWE454G72). It's work fine. Unfortunately, window xp client have been disconnected/reconnected many time per day. and sometime, during it's trying to connect, I will see windows popup request the certificate as well. anyway, i just choose the right certificate, it gonna work normally. Do you have any idea ? Thank you, maxx

1 0

freeradius Kerberos config in users file ?
by Riccardo Veraldi 23 Jun '10

23 Jun '10

Hello, I have just a question. if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULT Auth-Type := Kerberos but it fails using EAP (EAP-TTLS) telling USer-PAssword attribute is missing... rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: Attribute "User-Password" is required for authentication. ++[krb5] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> veraldi(a)cnaf.infn.it attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 95 to 192.168.252.17 port 1645 Waking up in 2.9 seconds. if I instead use the following users file: DEFAULT Auth-Type = Kerberos both radtest and EAP authentication works, and thtat's good, but why ? thanks Rick

2 2

freeradius Kerberos config in users file ?
by Riccardo Veraldi 23 Jun '10

23 Jun '10

Hello, I ahve jsut a question. if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULT Auth-Type := Kerberos but it fails using EAP (EAP-TTLS) telling USer-PAssword attribute is missing... rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: Attribute "User-Password" is required for authentication. ++[krb5] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> veraldi(a)cnaf.infn.it attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 95 to 192.168.252.17 port 1645 Waking up in 2.9 seconds. if I instead use the following users file: DEFAULT Auth-Type = Kerberos both radtest and EAP authentication works, and thtat's good, but why ? thanks Rick

1 0

speed of detail reader server
by Alexandru Oprisan 23 Jun '10

23 Jun '10

Hello, I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. I have everything set up, the only problem seems to be the speed of the 'detail reader server'. I do quite a lot off accounting packets on the box ( no auth ), the detail writer has already written 1.9G of details ( in about 5 hours ) to hourly files, but the detail reader is lagging far behind (still working on the first file). I only see about 1 row inserted per second, but I know the server can do far more. I have set load-factor to 100, doesn't seem to help. What can I do? Alex Oprisan

4 4

setting freeradius2 to AD authentication
by Riccardo Veraldi 22 Jun '10

22 Jun '10

Hello, configuring freeradius2 to authenticate using AD as described by Enrik http://archives.free.net.ph/message/20060104.153134.68c5be76.en.html should it work with PEAP also ? or it works only eith EAP-TTLS ? The method is different from the one reported in the freeradius wiki http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO which uses ntlmauth instead and works with PEAP too. thanks Rick

2 2

Retain info between auth and acct
by James Devine 22 Jun '10

22 Jun '10

Does anyone know if there is a built in mechanism of retaining some sort of state information between auth and acct packets without using external means?

2 1

checkval and != op
by Christian Zoffoli 22 Jun '10

22 Jun '10

Hi to all, I've configured freeradius with mysql anche checkval and all works as expected when I try to authenticate users with Calling-Station-ID and := operators in radgroupcheck but I cannot use it with != operator. To sum up I want some accounts to login only on some machines and I don't want other accounts to login on the above machines. Can I use checkval also with != operator? ...if not, is there another way? thank you, Christian

2 11