- Freeradius-Users - lists.freeradius.org

Virtual server specific SQL schema.
by Stephen Fulton 15 Jun '10

15 Jun '10

Greetings, I am building an FR server using a shared MySQL database that will have multiple virtual servers. Each of the virtual servers needs to use different radcheck and radacct tables, each of which has a unique name (eg. radcheck1, radcheck2). The stated preference is that a single database be used, and the different tables reside within. For performance reasons, I would rather specify the DB server specific parameters (hostname, user/pass, maximum number of sockets etc) globally. My question: Is it possible to use a global DB configuration as outlined above, but call the schema specific info from within a virtual server? Thanks, -- Stephen

2 1

Re: Proxy to two RADIUS Servers
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > Here comes the provisioning part: > At the beginning of an IP session, we will get the assignment "IP address to > Subscriber Number" including a Filter-ID, advising pointing to the correct > optimization. This will be done, using RADIUS Accounting > This is not odd and several vendors of such systems are using this > mechanism. It's odd. Provisioning things via Accounting-Request packets is not part of RADIUS. > But what will happen, if the Accounting Packets are gone? Have a look at a > single Framed-IP-Address over the time: > > - If the START does not reach the Optimizer, User will get a default profile Well... the *NAS* is supposed to generate accounting packets. When it does, you can forward them. > - If STOP does not reach the Optimizer, no problem > - If STOP and START does not reach the Optimizer, user will get the setting > of the predecessor (Not good!). This might happen, if the link to the > optimizer is broken for some minutes > > At some Operators, Access to Mailboxes is given, using this mechanisms, > which might lead to wrong Access to wrong eMails... not good again! Sure... > I know, that this is hard to process... It's ugly, and not a nice solution. > Therefore my former question, whether it is possible to send START and STOP > directly, but only buffer the STOP packets for later transmission. This will > prevent constantly changing Subscribers, using a particular IP address, > during the phase, where the link is back up. Only sending /old/ stop packets > will delete assignments at the optimizer, even if the user just came online, > but this is much better, than wrong assignments. As I said earlier, you can use "radclient" to send any packet you want. You can use a Perl script to wrap radclient, and filter the attributes. > The milliseconds thing: > > The signaling flow (2G/3G Network): SGSN -> GGSN -> FR -> Optimizer > Still looking for a single Framed-IP-Address: > 1 PDP Context creation Request from SGSN to GGSN > 2 Access Request to FR > 3 Access Accept to GGSN > 4 Acct Start to FR > 5 write in detail file > 6 Acct ACK to GGSN > 7a1 Listener catches the Acct Start and sends it to Optimizer > 7a2 Acct ACK from optimizer > 7b1 GGSN sends PDP Context Creation Accept to SGSN > 7b2 SGSN allows IP Packets to pass the link No... that's not a *required* flow. You *can* proxy packets directly. See raddb/sites-available/robust-proxy-accounting It's up to *you* to configure the packet flow you want. And *none* of the above description shows accounting packets going to *two* different locations, like you originally asked. Please keep a *consistent* story in your messages. > Depending on system load and number of concurrent accesses, the 7a' and 7b' > might change their sequence, because they are decoupled. This will possibly > start a TCP Session via the optimizer, which will most likely use the > default profile. > But back to the eMail disaster: dropping a STOP and delaying the next START > for the same IP, will give the user Access to the wrong mailbox. > > I hope this describes a little bit, why I'm asking possibly odd questions. So... configure the server to do what you want. If you want accounting packets to go quickly to the optimizer, proxy them directly. If you want them to be copied elsewhere, *that* isn't time critical, and can use the "detail" file. > Any ideas on how to solve this problem beside looking for an new job or > industry? Ask vendors to not design && ship broken products. But I've given up hope on that. Alan DeKok.

1 0

Re: Proxy to two RADIUS Servers
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > I have to provision the DEST1 using live session information, and DEST1 only > needs the information during the current IP, but if I set up: > 1. manual Proxy from sites-enabled/default file: all ACK Packages are > delayed to the NAS, if DEST1 is not there, and the NAS possibly retries... > not good!? That's why the other virtual servers exist. > 2. if I use'copy-acct-to-home-server', I have to keep track of the packet, > to not send too old information to the DEST1. In strange cases, where DEST1 > is down for hours, I will keep sending packets of old sessions, until I went > through all left files... Uh... the server keeps track of the packet. And the whole point of accounting is to store data. i.e. to send *all* traffic, even after the home server has been down for hours. If you don't like this, you can change the proxying rules to *ignore* accounting packets that are older than X hours. See Acct-Delay-Time. > 3. I could possibly mix it: I might send START and STOP packets to DEST1. In > case DEST1 is not available, I put all STOP Packets into the > 'copy-acct-to-home-server' files. After DEST1 is back up, all previous ended > sessions will be cleared and new sessions will overwrite the possibly old > status in the DEST1 databases ..., but this might not work, as 'redundant' > does not take updates on a attribute list. That sounds complicated. > also... 'copy-acct-to-home-server' seems to delay the forwarded packet at > about 0.2 to 0.5 seconds... > I checked to use a ramdisk for this, but it did not speed up the process... > I sometimes see 0.05 but often 0.4 I don't understand why that's a problem. Do you really need millisecond resolution on accounting packets? > Again, nobody cares about start packets after the session has been > terminated, but fast delivery is critical... Why? No one else needs millisecond response time for accounting packets. Alan DeKok.

2 1

Looking for an editor for FreeRADIUS documentation
by Alan DeKok 15 Jun '10

15 Jun '10

In the interest of making the project better, we're looking for an editor for the documentation. The existing documentation is an "ad hoc" collection of files thrown together over a decade of effort, and written by many different people. We'd like to organize the documentation ("doc/" directory), and clean it up. We're looking for an editor with the following skills: - willing to do the work - can write reasonably clearly - basic knowledge of RADIUS The goal is to *organize* the documentation, not to write more. The existing documentation is basic, and could be improved through simple re-organization. No knowledge of "git" is required. Familiarity with "restructured text" would be good. We're looking to move the documentation to that format. If it matters, this is a *paid* position. We can't afford a lot, but we can afford to pay for work done. The rates will be negotiable based on quantity of work and results. Please send email to the list if you're interested. We can choose a candidate, and do the edits publicly, so people see visible progress. Alan DeKok.

10 24

authentication != authorization
by Erik Norgaard 15 Jun '10

15 Jun '10

Hi: I currently use freeradius 2.1.6 for authentication on my Wlan with WPA2-EAP-TLS. Now, I'd like to deploy multiple policies and authentication methods. As I use freeradius now, an authenticated user is authorized to whatever. I'd like to be able to differenciate this authorization such that, i.e. some users have full access, while other users have restricted access and others have no access even if authenticated successfully. Is there some way of having freeradius call a script or connect to some service, submitting the user authentication details and ip/mac address such that access can be granted according to the user privileges? More precisely, I'd like to deploy the following policies: a. If a user authenticates with a certificate I issued, I trust them with full access. b. If the user authenticates with a foreign trusted certificate I will grant web/mail access c. If the user authenticates with a temporal password, time limited access is granted to web/mail access d. If the user fails to authenticate, any web access is redirected to a web page explaining how to configure the system or request access So, even failure to authenticate should result in some sort of guest authentication without privileges. Regarding c, how can I manage temporal accounts? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818/+34.915211157 http://www.locolomo.org

1 0

Re: Send Accounting from any point in configuration
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > I mean *create* an Accounting Packet, if an Access Request comes in. Use "radclient". > This is will be used to provision a HTTP Proxy Platform about the upcoming > isage of an IP address. Oh... that. The HTTP proxy is completely and totally broken. Using accounting packet to provision data is wrong. I'll go update the RADIUS specs to say that. > I will have to check any Accounting Packet for some Attributes/Values. > If a packet matches, it has to be proxied to a destination RADIUS Server. > > For instance: > if > NAS-IP-Address = 10.10.19.173 > Called-Station-Id = "apn1.isp.de" > Acct-Status-Type =* "" > Then proxy to 10.200.1.1 > > if > NAS-IP-Address = 10.10.18.120 > Called-Station-Id = "apn1.isp.de" > Acct-Status-Type =* "" > Then proxy to 10.200.100.100 > > else > do not proxy > > In that case, I have to check the attributes to decide, to which RADISU > Server I have to send the packets. See "man unlang". You can write rules that look pretty much like what you have above. > I found the section in the proxy.conf: > > # rlm_realm"). To manually proxy the request put this entry in the > # "users" file: > # > # > #DEFAULT Proxy-To-Realm := "realm_name" > # > > > Does it mean, that the lines un users file will do the work? Well... yes. That's the intent of the documentation. > DEFAULT NAS-IP-Address = 10.10.19.173, Called-Station-Id = > "apn1.isp.de", Acct-Status-Type =* "", Proxy-To-Realm := "destination1" > DEFAULT NAS-IP-Address = 10.10.18.120, Called-Station-Id = > "apn1.isp.de", Acct-Status-Type =* "", Proxy-To-Realm := "destination2" Except see "man users". You need to use the *correct* comparison operators. And doing this is pointless: Acct-Status-Type =* "". Just delete that check. > Is manual proxying in unlang possible, using sites-available/default ? Yes. Anything you can do in the "users" file you can do in "unlang". Alan DeKok.

1 0

Re: Problem running 'radiusd -X'
by Zhouhuai Shen 14 Jun '10

14 Jun '10

Hi, > what version of OpenSSL have your got. what is the configuration of > eap.cofn regarding random option and does the file/link have read access > (or even exist!?)#> openssl version OpenSSL 0.9.8h 28 May 2008 The eap.conf is the default directly from the original freeradius-server-2.1.9, and all *.conf files have read access. Thanks for your help. Cheers, Henry _________________________________________________________________ Find a way to cure that travel bug MSN NZ Travel http://travel.msn.co.nz/

2 1

accounting without auth
by Omer Faruk Sen 14 Jun '10

14 Jun '10

Hi , Is it possible to configure freeradius for accounting only without authorization/authentication? Maybe by granting access to every auth request can be done but I want to hear your opinion before proceeding any further. Regards.

3 2

Re: Proxy to two RADIUS Servers
by Arran Cudbard-Bell 14 Jun '10

14 Jun '10

Use copy-acct-to-home-server, it's what it's there for. Delay is usually sub second, but it depends on the throttling values you set in the detail reader server. On 14/06/2010, Stefan A. <a.freeradius(a)premit.de> wrote: > I checked, whether I am able to manually proxy from sites-available/default, > using unlang. > It works fine, using the following commands. > > > if (request:Acct-Status-Type == "Start" || request:Acct-Status-Type > == "Stop") { > if (request:Called-Station-Id == "apn.isp.de") { > update control { > Replicate-To-Realm += "DEST1" > } > } > } > > > But I do not get it to work, if I try to proxy the same packet to two > servers: > > if (request:Acct-Status-Type == "Start" || request:Acct-Status-Type > == "Stop") { > if (request:Called-Station-Id == "apn.isp.de") { > update control { > Replicate-To-Realm += "DEST1" > Replicate-To-Realm += "DEST2" > } > } > } > > I only uses the first 'Replicate-To-Realm' entry DEST1 and does not seem to > cycle through a list or destination RADIUS Servers... > > > Is this the intended behavior? Should I go for 'copy-acct-to-home-server' ? > How much delay would this add between writing the file and sending the > packet to the home server? > > > Thank you > Stefan > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

FR 2.1.9 - segfault using status server
by John Horne 14 Jun '10

14 Jun '10

Hello, We are running FR 2.1.9 on CentOS 5, and are proxying requests to MS IAS 2003 servers. However, it seems the IAS servers do not support 'status-server' requests until a slightly later version. As such, I have configured FR to send a dummy userid/pwd instead. FR seems to receive a reply, but then segfaults. Running 'radiusd -X' shows: ============================================= Marking home server 141.163.66.101 port 1812 as zombie (it looks like it is dead). Sending Access-Request of id 168 to 141.163.66.101 port 1812 User-Name := "xxxxxx" User-Password := "xxxxxx" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 1.2 seconds. rad_recv: Access-Reject packet from host 141.163.66.101 port 1812, id=168, length=20 ============================================= So a reply was received, but radiusd has now died. Getting radiusd to dump a core file shows: ============================================= # gdb /usr/sbin/radiusd core.8509 GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.1) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/radiusd...(no debugging symbols found)...done. Reading symbols from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/libfreeradius-radius-2.1.9.so Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /usr/lib/libltdl.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libltdl.so.3 Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/libssl.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.2 Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libkrb5.so.3 Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libcom_err.so.2 Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libk5crypto.so.3 Reading symbols from /usr/lib/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib/libkrb5support.so.0 Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libkeyutils.so.1 Reading symbols from /lib/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libselinux.so.1 Reading symbols from /lib/libsepol.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libsepol.so.1 Reading symbols from /lib/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /lib/libnss_dns.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libnss_dns.so.2 Reading symbols from /usr/lib/freeradius/rlm_exec.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_exec.so Reading symbols from /usr/lib/freeradius/rlm_expr.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_expr.so Reading symbols from /usr/lib/freeradius/rlm_expiration.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_expiration.so Reading symbols from /usr/lib/freeradius/rlm_logintime.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_logintime.so Reading symbols from /usr/lib/freeradius/rlm_pap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_pap.so Reading symbols from /usr/lib/freeradius/rlm_mschap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_mschap.so Reading symbols from /usr/lib/freeradius/rlm_eap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap.so Reading symbols from /usr/lib/freeradius/libfreeradius-eap-2.1.9.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/libfreeradius-eap-2.1.9.so Reading symbols from /usr/lib/freeradius/rlm_eap_tls.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_tls.so Reading symbols from /usr/lib/freeradius/rlm_eap_ttls.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_ttls.so Reading symbols from /usr/lib/freeradius/rlm_eap_peap.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_peap.so Reading symbols from /usr/lib/freeradius/rlm_eap_mschapv2.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_eap_mschapv2.so Reading symbols from /usr/lib/freeradius/rlm_realm.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_realm.so Reading symbols from /usr/lib/freeradius/rlm_files.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_files.so Reading symbols from /usr/lib/freeradius/rlm_radutmp.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_radutmp.so Reading symbols from /usr/lib/freeradius/rlm_attr_filter.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_attr_filter.so Reading symbols from /usr/lib/freeradius/rlm_preprocess.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_preprocess.so Reading symbols from /usr/lib/freeradius/rlm_acct_unique.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_acct_unique.so Reading symbols from /usr/lib/freeradius/rlm_detail.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib/freeradius/rlm_detail.so Core was generated by `/usr/sbin/radiusd -X'. Program terminated with signal 11, Segmentation fault. #0 0x0806c936 in received_proxy_response () (gdb) bt #0 0x0806c936 in received_proxy_response () #1 0x0805a041 in ?? () #2 0x0806b110 in ?? () #3 0x00ac1f0d in fr_event_loop () from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so #4 0x0806bd26 in radius_event_process () #5 0x08063f6a in main () (gdb) q ============================================= The proxy.conf part just has: ============================================= status_check = request username = xxxxxx password = xxxxxx ============================================= Has anyone else seen this problem? At the moment we are running FR with the 'status_check = status-server' enabled, since it seems better to receive no reply at all rather than having radiusd segfaulting. Thanks, John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

3 3