- Freeradius-Users - lists.freeradius.org

freeradius 2.1.9 crashes working in proxy mode
by JOE 16 Jun '10

16 Jun '10

Hi all Actually I have two servers (in cluster mode with heartbeat) working each one with two radius services, one proxy and one radius as follow: Server1: .- freeradius server 2.1.9 : listening on port 1645 , working in proxy mode with load balance configuration and point to local radius and Server2 radius - freeradius server 2.1.9: listening on port 1812, working in radius mode. Server2: .- freeradius server 2.1.9 : listening on port 1645 , working in proxy mode with load balance and point to local radius an Server1 radius - freeradius server 2.1.9: listening on port 1812, working in radius mode. Load Balance works fine but when I force shutdown of one of local radius servers the proxy crashes with a segmentation. you have any idea what is happening? Regards

3 3

Segment Fault
by David Peterson 16 Jun '10

16 Jun '10

[61490.335957] freeradius[6212]: segfault at 6c ip 00a51951 sp bfd33070 error 4 in libfreeradius-radius-2.1.8.so[a3d000+1e000] [61510.556054] freeradius[6214]: segfault at 6c ip 00a97951 sp bfab1530 error 4 in libfreeradius-radius-2.1.8.so[a83000+1e000] [62031.935361] hrtimer: interrupt took 36340206 ns Anyone know what causes this sort of crash? It happens when I access EAP. If 2.1.9 fixes this, can someone point me to an Ubuntu repository that has it available. David Peterson

2 1

Use rlm_ldap reply for the next authorization module
by JUND, Aurélien 16 Jun '10

16 Jun '10

Hello, In order to allow a user to access the service (send a Access-Accept) I need to validate several things: First the password must be OK: * The User-name and password are stored in cleartext in a ldap (I use Chap), I must get another ldap attribute wich specify the crm Id matching the username. The user must be allowed to use the service: * Daily I get a files matching a crm Id and a status (can access, cant access) => I can't have a matching between user-name / Status. The crm don't know the user-name, and the ldap don't know the client's status (only the Crm ID) I have no trouble to check the User-Name/Password using ldap and chap modules. But I can't figure out how to use the ldap reply to request the local mysql where is store the match between crm Id and status. I don't know how to use a reply of a authorization module (ldap) in an another one (sql). Since I didn't find out how to do this, I tried to add the crmID in a unused radius attribute: Callback-Number: In the ldap attrmap configuration file I added: replyItem Callback-Number SFRrelationLoginService And in the sql configuration: sql_user_name = "%{Callback-Number}" Unfortunately as expected the replyItem is only add when the reply is generate. I also tried with a checkItem without more success... Is it possible to configure the ldap module in order to store a ldapattribute in a variable usable by the mysql module ? Or to replace/add a radius attribute in the request, base on the ldap reply before the next module is compute? Examples : Goal case: echo "User-Name= toto,Chap-Password=111111", | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 202 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0xcab5c3da9c9ebb891608c1991c2e37bea3 rad_recv: Access-Reject packet from host 172.16.0.135 port 1812, id=202, length=20 log: Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> '' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User not found Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[scratchcounter_lyo] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[reply_log] returns ok Test addin the crmId in the request before computing => not possible in real situation, but to test everything else echo "User-Name= toto,Chap-Password=111111",Callback-Number='siebelsIdFortoto' | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 159 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0x9fb08ff7f454d0c9998fc5dd72479940cd Callback-Number = "siebelsIdFortoto" rad_recv: Access-Accept packet from host 172.16.0.135 port 1812, id=159, length=20 log: Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 got semaphore Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 handling request 0, (1 handled so far) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group authorize {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[preprocess] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[mschap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No '/' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[IPASS] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No '@' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[suffix] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[files] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] performing user authorization for toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{Stripped-User-Name} -> Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{User-Name} -> toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: (USERlogin=%{%{Stripped-User-Name}:-%{User-Name}}*) -> (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: ou=EndUser,dc=USER,dc=fr -> ou=EndUser,dc=USER,dc=fr Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Checking Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Got Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: attempting LDAP reconnection Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: (re)connect to 10.33.245.241:389, authentication 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: bind as cn=Radius Gp,ou=Application,dc=USER,dc=fr/radiusgp to 10.33.245.241:389 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Threads: total/active/spare threads = 5/1/4 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> siebelsIdFortoto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> 'siebelsIdFortoto' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = 'siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '=siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User siebelsIdFortoto not found Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} JJun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Finished request 0. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Going to the next request Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 waiting to be assigned a request Jun 16 12:33:30 radius-wifi1-aub freeradius[7106]: Waking up in 4.0 seconds. Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Cleaning up request 0 ID 159 with timestamp +4 Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Ready to process requests.

2 1

Getting PAP to work with ntlm_auth
by Neil Prockter 16 Jun '10

16 Jun '10

Hello I want to authenticate users against Active Directory for EAP-MSCHAPv2 and PAP. PAP is for a wireless web authentication redirection service that authenticates using PAP and its PAP I'm trying to debug not MSCHAP at present. I've been following http://deployingradius.com/documents/configuration/active_directory.html All goes well until I get towards the end. Once I remove DEFAULT Auth-Type = ntlm_auth from users PAP stops working where do I add the configuration to allow PAP to continue with ntlm_auth rather than just failing? with the setting I get success Info: +- entering group authorize {...} Info: ++[preprocess] returns ok Info: ++[chap] returns noop Info: ++[mschap] returns noop Info: [suffix] No '@' in User-Name = "np", looking up realm NULL Info: [suffix] No such realm "NULL" Info: ++[suffix] returns noop Info: [eap] No EAP-Message, not doing EAP Info: ++[eap] returns noop Info: ++[unix] returns notfound Info: [files] users: Matched entry DEFAULT at line 1 Info: ++[files] returns ok Info: ++[expiration] returns noop Info: ++[logintime] returns noop Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Info: ++[pap] returns noop Info: Found Auth-Type = ntlm_auth Info: +- entering group authenticate {...} Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=ID Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=SECRET Debug: Exec-Program output: NT_STATUS_OK: Success (0x0) Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Debug: Exec-Program: returned: 0 Info: ++[ntlm_auth] returns ok Info: +- entering group post-auth {...} Info: ++[exec] returns noop Sending Access-Accept of id 243 to 158.143.207.212 port 42687 without it no ntlm is attempted Info: +- entering group authorize {...} Info: ++[preprocess] returns ok Info: ++[chap] returns noop Info: ++[mschap] returns noop Info: [suffix] No '@' in User-Name = "np", looking up realm NULL Info: [suffix] No such realm "NULL" Info: ++[suffix] returns noop Info: [eap] No EAP-Message, not doing EAP Info: ++[eap] returns noop Info: ++[unix] returns notfound Info: ++[files] returns noop Info: ++[expiration] returns noop Info: ++[logintime] returns noop Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Info: ++[pap] returns noop Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Info: Failed to authenticate the user. Info: Using Post-Auth-Type Reject Info: +- entering group REJECT {...} Info: [attr_filter.access_reject] expand: %{User-Name} -> ID Debug: attr_filter: Matched entry DEFAULT at line 11 Info: ++[attr_filter.access_reject] returns updated Info: Delaying reject of request 0 for 1 seconds Debug: Going to the next request Debug: Waking up in 0.9 seconds. Info: Sending delayed reject for request 0 Sending Access-Reject of id 7 to 158.143.207.212 port 53676 TIA, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

2 2

(no subject)
by Jasenko Sehanovic 16 Jun '10

16 Jun '10

Jasenko Sehanovic |t: + 387 33 768 000|f: + 387 33 768 001|m: + 387 61 103 444 Teleinformatica doo, Tvornička 3, 71000 Sarajevo, Bosnia and Herzegovina -- cid:part1.05030807.04020006@teleinformatica.ba

1 0

Re: Virtual server specific SQL schema.
by Stephen Fulton 16 Jun '10

16 Jun '10

Hi Stefan, Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements. -- Stephen On 6/15/2010 15:20, Stefan A. wrote: > Stephen, > > what's about using instances in the sql.conf like > > sql sql_virtual_1{ > database = "mysql" > driver = "rlm_sql_${database}" > server = "dbcnode2" > port="3306" > login = "user" > password = "pw" > radius_db = "dbname" > ...all the other stuff... > } > > Having several such sections, you'd be able to call them in cour virtual > server as > > authorize { > preprocess > chap > mschap > suffix > eap { > ok = return > } > unix > --> sql_virtual_1 > files > expiration > logintime > pap > } > > > You only have to exchange the values of > server = "dbcnode2" > port="3306" > login = "user" > password = "pw" > > for each instance... > > > > > Does this help? > Stefan > > > >> -----Original Message----- >> From: freeradius-users- >> bounces+a.freeradius=premit.de(a)lists.freeradius.org [mailto:freeradius- >> users-bounces+a.freeradius=premit.de(a)lists.freeradius.org] On Behalf Of >> Stephen Fulton >> Sent: Tuesday, June 15, 2010 8:43 PM >> To: freeradius user >> Subject: Virtual server specific SQL schema. >> >> Greetings, >> >> I am building an FR server using a shared MySQL database that will have >> multiple >> virtual servers. Each of the virtual servers needs to use different >> radcheck >> and radacct tables, each of which has a unique name (eg. radcheck1, >> radcheck2). >> The stated preference is that a single database be used, and the >> different >> tables reside within. For performance reasons, I would rather specify >> the DB >> server specific parameters (hostname, user/pass, maximum number of >> sockets etc) >> globally. >> >> My question: Is it possible to use a global DB configuration as >> outlined above, >> but call the schema specific info from within a virtual server? >> >> Thanks, >> >> -- Stephen >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 5

Ubuntu OpenSSL
by David Peterson 15 Jun '10

15 Jun '10

I know there is probably something easy I am missing but I cannot for the life of me get FR to compile with OpenSSL for EAP-TTLS support. Are there any how-to's on getting Ubuntu to compile OpenSSL support into FR2.1.9 David Peterson

7 11

Problems authenticating with a Cisco ASA 5510
by Daniel Davidson 15 Jun '10

15 Jun '10

We have had a radius server running for years that we use to authenticate our wireless users over wpa. It works flawlessly and connections are authenticated as shown by the log below. Mon Jun 14 14:57:40 2010 : Auth: Login OK: [miyagi72/<no User-Password attribute>] (from client 1s port 109133 cli d830.629b.3ae9) Above is an exact log entry. Now we are attempting to authenticate our new ASA 5510 with radius for our vpn, authentication with it is failing. Mon Jun 14 14:59:07 2010 : Auth: Login incorrect: [danield/password] (from client igbvpn port 26) In the example log above, I removed my password and replaced with the word "password". My guess is that the password is being thrown into the wrong field, but I have no idea how to resolve the issue. Can anyone point me in the right direction. Dan

2 3

Virtual server specific SQL schema.
by Stephen Fulton 15 Jun '10

15 Jun '10

Greetings, I am building an FR server using a shared MySQL database that will have multiple virtual servers. Each of the virtual servers needs to use different radcheck and radacct tables, each of which has a unique name (eg. radcheck1, radcheck2). The stated preference is that a single database be used, and the different tables reside within. For performance reasons, I would rather specify the DB server specific parameters (hostname, user/pass, maximum number of sockets etc) globally. My question: Is it possible to use a global DB configuration as outlined above, but call the schema specific info from within a virtual server? Thanks, -- Stephen

2 1

Re: Proxy to two RADIUS Servers
by Alan DeKok 15 Jun '10

15 Jun '10

Stefan A. wrote: > Here comes the provisioning part: > At the beginning of an IP session, we will get the assignment "IP address to > Subscriber Number" including a Filter-ID, advising pointing to the correct > optimization. This will be done, using RADIUS Accounting > This is not odd and several vendors of such systems are using this > mechanism. It's odd. Provisioning things via Accounting-Request packets is not part of RADIUS. > But what will happen, if the Accounting Packets are gone? Have a look at a > single Framed-IP-Address over the time: > > - If the START does not reach the Optimizer, User will get a default profile Well... the *NAS* is supposed to generate accounting packets. When it does, you can forward them. > - If STOP does not reach the Optimizer, no problem > - If STOP and START does not reach the Optimizer, user will get the setting > of the predecessor (Not good!). This might happen, if the link to the > optimizer is broken for some minutes > > At some Operators, Access to Mailboxes is given, using this mechanisms, > which might lead to wrong Access to wrong eMails... not good again! Sure... > I know, that this is hard to process... It's ugly, and not a nice solution. > Therefore my former question, whether it is possible to send START and STOP > directly, but only buffer the STOP packets for later transmission. This will > prevent constantly changing Subscribers, using a particular IP address, > during the phase, where the link is back up. Only sending /old/ stop packets > will delete assignments at the optimizer, even if the user just came online, > but this is much better, than wrong assignments. As I said earlier, you can use "radclient" to send any packet you want. You can use a Perl script to wrap radclient, and filter the attributes. > The milliseconds thing: > > The signaling flow (2G/3G Network): SGSN -> GGSN -> FR -> Optimizer > Still looking for a single Framed-IP-Address: > 1 PDP Context creation Request from SGSN to GGSN > 2 Access Request to FR > 3 Access Accept to GGSN > 4 Acct Start to FR > 5 write in detail file > 6 Acct ACK to GGSN > 7a1 Listener catches the Acct Start and sends it to Optimizer > 7a2 Acct ACK from optimizer > 7b1 GGSN sends PDP Context Creation Accept to SGSN > 7b2 SGSN allows IP Packets to pass the link No... that's not a *required* flow. You *can* proxy packets directly. See raddb/sites-available/robust-proxy-accounting It's up to *you* to configure the packet flow you want. And *none* of the above description shows accounting packets going to *two* different locations, like you originally asked. Please keep a *consistent* story in your messages. > Depending on system load and number of concurrent accesses, the 7a' and 7b' > might change their sequence, because they are decoupled. This will possibly > start a TCP Session via the optimizer, which will most likely use the > default profile. > But back to the eMail disaster: dropping a STOP and delaying the next START > for the same IP, will give the user Access to the wrong mailbox. > > I hope this describes a little bit, why I'm asking possibly odd questions. So... configure the server to do what you want. If you want accounting packets to go quickly to the optimizer, proxy them directly. If you want them to be copied elsewhere, *that* isn't time critical, and can use the "detail" file. > Any ideas on how to solve this problem beside looking for an new job or > industry? Ask vendors to not design && ship broken products. But I've given up hope on that. Alan DeKok.

1 0