- Freeradius-Users - lists.freeradius.org

Webinar with FreeRADIUS and MySQL: Sept. 30
by Alan DeKok 09 Sep '09

09 Sep '09

I will be giving a Webinar with MySQL on September 30. Registration is available at: http://www.mysql.com/news-and-events/web-seminars/display-419.html The webinar will be given via Webex. You will need an account on mysql.com in order to register and see webex details. The full announcement is below. Alan DeKok. +++++++++++++++++++++++++++++++++++++++++++++++++++++++ FreeRADIUS & MySQL Cluster: Scalable and Highly Available AAA Services Wednesday, September 30, 2009 As network use grows and services become more dynamic, so existing Authentication, Authorization and Accounting (AAA) environments can struggle to keep pace with demand Tune into this webinar where you can hear from the Alan DeKok, one of the founders of the FreeRADIUS project and CEO of Network RADIUS, discuss the concepts and implementation of RADIUS services using the FreeRADIUS server and the MySQL Cluster database to deliver highly available and scalable AAA services In this session, you will learn about: - potential AAA limitations as network environments grow - advantages of deploying FreeRADIUS with MySQL Cluster - Performance, sizing and deployment of an AAA environment using FreeRADIUS with MySQL Cluster - customer case studies - how to get started WHO: * Alan DeKok, Founder of FreeRADIUS and CEO of Network RADIUS * Matthew Keep, MySQL Cluster Product Management WHAT: FreeRADIUS & MySQL Cluster: Scalable and Highly Available AAA Services WHEN: Wednesday, September 30, 2009: 09:30 Pacific time (America) 06:30 Hawaii time 10:30 Mountain time (America) 11:30 Central time (America) 12:30 Eastern time (America) 16:30 UTC 17:30 Western European time 18:30 Central European time 19:30 Eastern European time The presentation will be approximately 45 minutes long followed by Q&A. WHERE: Simply access the web seminar from the comfort of your own office. WHY: To learn more about how you can use FreeRADIUS and MySQL Cluster 7.0 to deliver highly available and scalable AAA Services

1 0

Re: Deployment
by tech.subscriptions＠shepherdhill.biz 09 Sep '09

09 Sep '09

tech.subscriptions(a)shepherdhill.biz wrote: >> I have done the gdb and valgrind dumps. They are on: >> http://www.leadservers.com/gdb-radiusd.log & >> http://www.leadservers.com/valgrind-radiusd.log Alan DeKok wrote: > It looks like an issue that was fixed in 2.1.7. Thanks. I was told version 2.1.3 has a little issue with regular expressions and I am having an issue with version 2.1.6. While waiting for version 2.1.7 which version can I use? Regards, Chris.

1 0

Pre-release of 2.1.7
by Alan DeKok 08 Sep '09

08 Sep '09

It's been a while since 2.1.6, and it's getting close to time for 2.1.7. In order to ensure the stability of the software, we need your help. Please download the "pre" release of 2.1.7 from: http://git.freeradius.org/pre/ Build it, install it, and see if there are issues. The directory also includes Debian packages for Ubuntu 8.0.4. If there are no issues, we can release 2.1.7 this week. Alan DeKok.

12 30

mix user storage
by Rakotomandimby Mihamina 08 Sep '09

08 Sep '09

Hi all Using freeradius 2.x for AAA, is it possible to mix LDAP and xxxSQL? I mean one of those cases (the only difference is about the "credit"): case #1: LDAP: - username - password - MAC Address - NAS (the user is tied to that NAS) - credit (credit left) SQL - radacct case #2: LDAP: - username - password - MAC Address - NAS (the user is tied to that NAS) SQL - radacct - credit (credit left) Generally, written often data will be stored in SQL, what is left will be stored in the LDAP. Will it be very hard to setup? Any configuration hint? Thank you. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 1

Freeradius possible memory leak
by Szymon Roczniak 08 Sep '09

08 Sep '09

Hi, This could be related to a similar problem reported a couple of weeks ago. We have a FreeRADIUS 2.1.6 installation running on 64bit CentOS 5.3. The radiusd process is allocating more and more memory with time (around 0.5GB a day). There are only around 5-6 requests/s and other than chewing all memory the server doesn't seem to be doing much work. This radius instance has only one sql module (rlm_sql_mysql) in the authorize section and another one - sql_log (writing to a local file) in the post-auth section. The detail module is listed in accounting{} section but it's not used on this box (nothing is set to send accounting information to this server) All other sections in the default site are empty (the box only does auth) I've followed the advise from the previous thread and run radiusd under valgrind for around 10-15 minutes with some generated traffic and the output is: valgrind --tool=memcheck --leak-check=full /usr/sbin/radiusd -f [..] ==11730== LEAK SUMMARY: ==11730== definitely lost: 8,705,168 bytes in 27,890 blocks. ==11730== indirectly lost: 8,351,440 bytes in 26,598 blocks. ==11730== possibly lost: 17,072 bytes in 56 blocks. ==11730== still reachable: 118,598 bytes in 2,467 blocks. ==11730== suppressed: 0 bytes in 0 blocks. ==11730== Reachable blocks (those to which a pointer was found) are not shown. Is there anything else I can do to track it down and possibly fix the problem? Would setting up max_request_per_server to something else than 0 be a good workaround for it in the meantime? -- szymon roczniak simon(a)dischaos.com

2 7

Freeradius + MySQL At System Boot = Freeradius Failure
by James Duffy 08 Sep '09

08 Sep '09

Hi, Am having problems using freeradius and mysql. Basically they are both set to start at system boot but as MySQL takes longer to get going freeradius bombs out with Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysql/mysql.sock' (2)' type errors. I can 'fix' this by adding a time delay in rc.local between the mysql startup and radiusd startup but this does not seem like the right way to fix this. Anyone else with this problem? Malcolm

6 9

freeradius + monit
by Sokvantha Youk 08 Sep '09

08 Sep '09

Dear All, I am new to Freeradius server. I wish to get it restart automatically when its process is hang by using monit. I have no idea how to get monit restart freeradius server automatically. Please kindly advice me. --- Best Regards, sokvantha __________________________________________________________________________________ Get more done like never before with Yahoo!7 Mail. Learn more: http://au.overview.mail.yahoo.com/

4 3

MAC Address Validation for phones
by Matthieu Lazaro 08 Sep '09

08 Sep '09

Hello list, I need some help on some unlang portion (if this is the right solution). Here is context: I need to do 802.1x on Ethernet switch for dynamic VLAN assignment for PCs . The problem is I have some phones connected between the PC and the switch. I don't want the users to login 802.1X with the phones so I have set them up to do MAC address user name and password without annoying the user over CHAP. Using users files works perfectly for my phones, as the ldap back end is for PC users. However, I have 300 phones that can be replaced if they are broken and I don't want to store all the info by hand in the users file. I tried to put this in the users file: if ( "%{User-Name}" =~ "00030BCA[0-9A-F]+" ) { "%{Cleartext-Password}" == "%{User-Name}" } Put it doesn't work because CHAP cannot find the user and his clear text password. So I guess I have put it in the wrong section AND/OR have done something wrong with my if but I can't find a way of checking as radius seems not to bother about it. I also tried to put it in the authentication section without success. I have read this http://wiki.freeradius.org/Mac-Auth but it seems too advanced for what I want to do as I don't need to rewrite anything. This guided me to try and put the script somewhere else. Thanks for your precious help. Best Regards, Matt

4 4

noresetcounter + NULL radacct records (First Connection)
by Neville 08 Sep '09

08 Sep '09

Hi, On occasions sqlcounter does not seem to work correctly, especially for NEW User that have no radacct details. After doing some digging, I've identified the issue only to happen on the first ever connect of the user in a new account. As you will see from the sql below, if no integer is returned (NULL), then Max-All-Sessions and the correct setting of is ignored and Session-Timeout is skipped. How can I address the NULL response for newly created accounts? rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> 6cmy75HS [noresetcounter] sql_set_user escaped user --> '6cmy75HS' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' rlm_sql (sql): Reserving sql socket id: 3 [noresetcounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'} -> rlm_sqlcounter: No integer found in string "" The ABOVE line is the problem, due to the SELECT returning a NULL ++[noresetcounter] returns noop Sending Access-Accept of id 177 to XX.XX.XX.XX port 54355 Idle-Timeout := 1800 Framed-MTU = 1488 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 Session-Timeout = 603484 MS-CHAP2-Success = 0xd2533d31333338414131333436353632453637323542433941374634463245413639444346343943333938 MS-MPPE-Recv-Key = 0xaab9e0a9c6918c64dfa042b3d84e808e MS-MPPE-Send-Key = 0xd2411e9ea8653fd25e550e5cbdbfa3e3 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.0.27 Framed-IP-Netmask = 255.255.255.0 After connecting and disconnecting in order to create some entrys for this user in radacct table, success as session-timeout is set correctly. rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> 6cmy75HS [noresetcounter] sql_set_user escaped user --> '6cmy75HS' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' rlm_sql (sql): Reserving sql socket id: 2 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 2 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'} -> 23 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user 6cmy75HS, check_item=3600, counter=23 rlm_sqlcounter: Sent Reply-Item for user 6cmy75HS, Type=Session-Timeout, value=3577 ++[noresetcounter] returns ok Sending Access-Accept of id 180 to XX.XX.XX.XX port 60642 Idle-Timeout := 1800 Framed-MTU = 1488 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 Session-Timeout = 3577 MS-CHAP2-Success = 0x21533d37374337313930393839303834464630413633303846464535443634343243314435313930373942 MS-MPPE-Recv-Key = 0xd1fff368e638b09b9960d9dba58f08cc MS-MPPE-Send-Key = 0x2df743dda88067b995ffc736a5345f71 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.0.137 Framed-IP-Netmask = 255.255.255.0 Finished request 10. Best Regards Nev

2 1

Freeradius using binary perl module
by Leon 08 Sep '09

08 Sep '09

Hi, am new with freeradius. would like to know, if i use a binary perl module? ie, in raddb/modules/perl: perl { module = ${confdir}/some_binary.pl } i a currently using: ~# radiusd -v radiusd: FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Aug 6 2009 at 13:50:41 compiled from tar.gz thanks. Leon

2 1