- Freeradius-Users - lists.freeradius.org

Re: [RE]FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response?
by Cristina Miyata 06 Sep '09

06 Sep '09

Thanks a lot again, Alan !!! ---------[ Received Mail Content ]---------- Subject : Re: [RE]FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response? Date : Sat, 05 Sep 2009 01:17:37 +0200 >From : Alan DeKok <aland(a)deployingradius.com> To : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cristina Miyata wrote: > 1) If FreeRADIUS doesn't use Proxy-State for nothing, how it matches the requests with responses? Using only the Packet Identifier (AVP 92)? Very well, thank you. :) But really... packet src/dst ip/port, plus RADIUS code && Id. Proxy-State isn't needed. > 2) Since it is Packet Identifier has only 1 byte (0-254), it can only handle 255 requests (received by NAS and sent to remote hosts via Proxy) at a time? Or only handle 255 requests per NAS or remote host? No. It opens multiple source ports. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

[RE]FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response?
by Cristina Miyata 04 Sep '09

04 Sep '09

Thanks Alan for your answers! I still have more questions: 1) If FreeRADIUS doesn't use Proxy-State for nothing, how it matches the requests with responses? Using only the Packet Identifier (AVP 92)? 2) Since it is Packet Identifier has only 1 byte (0-254), it can only handle 255 requests (received by NAS and sent to remote hosts via Proxy) at a time? Or only handle 255 requests per NAS or remote host? Thanks for your attention! Cristina Miyata Cristina Miyata wrote: > I realized that this host doesn't responds the accounting request with the Proxy-State (AVP 33). I checked the RFC2865 and it seems that it is mandatory the remote server responds the accounting response with the Proxy-State (AVP 33). While the attribute is mandatory, FreeRADIUS doesn't use it for anything. > My questions are: > > 1) Is FreeRADIUS really correlating the accounting requests/response correctly for this remote host that doesn't add the AVP 33 in the response for a proxied request? Yes. > 2) What is the expected behavior of the FreeRADIUS and effects in the described situation (proxied requests being responded with no Proxy-State attribute). It will work. FreeRADIUS will work if it (a) proxies a request containing Proxy-State (b) receives a valid response (src/dst ip/port, etc.) with no Proxy-State. In your case, the home server is being marked dead because it isn't responding. Nothing else will cause it to me marked dead! . Alan DeKok. ---------[ Received Mail Content ]---------- Subject : FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response? Date : Fri, 04 Sep 2009 13:38:38 -0400 (EDT) >From : "Cristina Miyata" <cmiyata(a)lycos.com> To : <freeradius-users(a)lists.freeradius.org> p {margin-top:0px;margin-bottom:0px;} Dear FreeRADIUS Users, I have one FreeRADIUS server proxying accounting RADIUS to two different hosts. One of the remote hosts is receiving the requests and answering the responses, but processing the details file very slowly (keeps being marked as dead all the time). I realized that this host doesn't responds the accounting request with the Proxy-State (AVP 33). I checked the RFC2865 and it seems that it is mandatory the remote server responds the accounting response with the Proxy-State (AVP 33). My questions are: 1) Is FreeRADIUS really correlating the accounting requests/response correctly for this remote host that doesn't add the AVP 33 in the response for a proxied request? 2) What is the expected behavior of the FreeRADIUS and effects in the described situation (proxied requests being responded with no Proxy-State attribute). Appreciate any help and Thanks in advance! Cristina Miyata

2 1

sql.authorize
by leopold 04 Sep '09

04 Sep '09

Is it possible to call sql.authorize on a group of SQL modules? This is needed to reduce number of calls to SQL in EAP-TLS transaction There was a recommendation to cal sql.authorize in post-auth section instead of authorize section, this is fine, but we need the same behavior for SQL groups that handle failover. Do you have any recommendation how to achieve that? post-auth { sql1.authorize } group redundant_sql { sql1 { fail = 1 handled = 3 notfound = return ok = return reject = return } sql2 { fail = 1 handled = 3 notfound = return ok = return reject = return } # if we reach here then all databases are unreachable # do not respond to NAS so that NAS marks RADIUS server # as unavalable and retry another RADIUS server update control { Response-Packet-Type = 'Do-Not-Respond' } handled } -- View this message in context: http://www.nabble.com/sql.authorize-tp25300863p25300863.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

FreeRADIUS proxy - Is Proxy-State (AVP 33) mandatory in the Acct Response?
by Cristina Miyata 04 Sep '09

04 Sep '09

Dear FreeRADIUS Users, I have one FreeRADIUS server proxying accounting RADIUS to two different hosts. One of the remote hosts is receiving the requests and answering the responses, but processing the details file very slowly (keeps being marked as dead all the time). I realized that this host doesn't responds the accounting request with the Proxy-State (AVP 33). I checked the RFC2865 and it seems that it is mandatory the remote server responds the accounting response with the Proxy-State (AVP 33). My questions are: 1) Is FreeRADIUS really correlating the accounting requests/response correctly for this remote host that doesn't add the AVP 33 in the response for a proxied request? 2) What is the expected behavior of the FreeRADIUS and effects in the described situation (proxied requests being responded with no Proxy-State attribute). Appreciate any help and Thanks in advance! Cristina Miyata

2 1

Deployment
by tech.subscriptions＠shepherdhill.biz 04 Sep '09

04 Sep '09

Sir, I am trying to move to the production server after due tests. I installed version 2.1.6 on CentOS 5.2. Funnily I am getting Segmentation fault error when my hints file is to be loaded. The debug message is: server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Segmentation fault My Hints file gives error when this is inserted: DEFAULT User-Name =~ '^([^@]+)(@zmobile.com)?$', NAS-IP-Address == "10.76.100.69" User-Name := "%{1}" Kindly assist. Cheers, Chris.

2 1

1 question
by Tony P. 04 Sep '09

04 Sep '09

hi list,... i have set 2 numbers Called-Station-Id in my work and one of them is pay for my users as normal when their calling throught Telephony Enterprise, and the other one is pay revert and that users not pay the phone else my Work it is as feature... but in both case i set Max-Monthly-Session with 200 hrs and when theirs hit into 200 obviusly can't connect .. that's ok.. i want to need to for the free phone can hit and stop to 200 hrs and with the other phone number (thay pay) can connect and i can up their hours to 400hr. more specify in short history my work have 2 phone numbers to can connect number-free-for-users-not-pay number-to-users-pay both case by max-monthly-session -> 200hrs i want by some if condition if exist into radius.conf to make this number-free-for-users-not-pay -> 200hrs number-to-users-pay -> 400 hrs it-s possible that? by the way i'm using freeradius 1.1.3 i know to have to upgrade by that want to make it soon... really need solve my trouble as priority Thaxs for any suggest Regards Tony

2 1

How to proxy accounting requests to multiple destinations
by Dánial Olsen 04 Sep '09

04 Sep '09

Hi, I'm running FreeRADIUS 2.1.6 on FreeBSD 7.2 and I need to proxy incoming radius accounting requests to two different ports at the same destination ip. I'm quite inexperienced with freeradius and I'm not sure I've understood completely what I need to do. I've set up realms, home_servers and home_server_pools in proxy.conf. I've also made two instances of copy-acct-to-home-server in /sites-enabled and an extra detail file in a separate directory, which one copy-acct-to-home-server reads. With the configurations I've made accounting requests are being proxied to one port of the destination ip, and the debug output reports for the second instance: [suffix] Request already proxied. Ignoring. Am I correct in the assumption that I need to rewrite the accounting packet so it will be allowed to proxy again? How can I achieve this? Or is there another way to do things? I'm also puzzled by how I can send to two different home_servers when the packet will of course only match one realm? -- Dánial

4 7

ippool or sqlippool support for EAP/TLS or TTLS on Wimax
by Victor Tangendjaja 04 Sep '09

04 Sep '09

Hi, I read from a post back in 2007 that freeRADIUS ippool or sqlippool does not support assigning IP via EAP/TLS. I was wondering if this is still the case? Alan mentioned that there would be options that might be part of 2.0 release. Is there any solution for this with the current release? Thanks, Victor

3 2

Wimax AAA Session ID
by Victor Tangendjaja 04 Sep '09

04 Sep '09

Hi, Is there a way to generate WiMAX-AAA-Session-Id inside freeRADIUS? Thanks, Victor

2 1

SQL Huntgroup only work with user check, not group check
by Carlos Eduardo Tavares Terra 04 Sep '09

04 Sep '09

Hello, I am having trouble while trying to work with huntgroups. Maybe I misunderstand the way how huntgroups works. I read another post about this issue, but I don't really understand why force the huntgroup name in confs. I have inserted two NAS' into radhuntgroup, as follow: mysql> select * from radhuntgroup; +----+-----------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-----------+--------------+-----------+ | 5 | wireless | 192.168.2.5 | NULL | | 4 | adsl | 192.168.2.6 | NULL | +----+-----------+--------------+-----------+ And associate the user 'jack' in group wireless: mysql> select * from radusergroup; +----------+-----------+----------+----+ | username | groupname | priority | id | +----------+-----------+----------+----+ | jack | wireless | 1 | 1 | +----------+-----------+----------+----+ And created the rules to the user 'jack': mysql> select * from radcheck; +----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 5 | jack | Huntgroup-Name | == | wireless | | 4 | jack | Cleartext-Password | := | foo | +----+----------+--------------------+----+----------+ When I use 'Huntgroup-Name' into radcheck, everything works fine. But when I put the 'Huntgroup-Name' into radgroupcheck, the radius is just ignoring it. mysql> select * from radgroupcheck; +----+-----------+----------------+----+----------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+----------+ | 8 | wireless | Huntgroup-Name | == | wireless | +----+-----------+----------------+----+----------+ It only works in this way? Am I doing something wrong? Thanks -- Carlos Eduardo Tavares Terra GNU/Linux #413291 [http://counter.li.org]

3 6