- Freeradius-Users - lists.freeradius.org

Freeradius and memory usage
by Roy Kartadinata 05 Aug '09

05 Aug '09

Hello, Our radius server is currently having some memory issue where its memory usage would increase by 1% every 30-45 minutes. Eventually the server will crash and restart because of out of memory. We've been using freeradius for a couple of years and this just started on Thursday so I upgraded our radius to the latest 2.1.6 from 2.1.5 but the problem still there. Has anyone ever experiencing this issue before? Cheers, Roy Kartadinata

4 17

unable to connection freeradius with mysql
by shivashankar 05 Aug '09

05 Aug '09

hi i am useing freeradius2.1.6 and mysql5.0 on solaris10. when ever i start the server radiusd -X . i am getting below problem. i think it is not connected to mysql.plz help me how to connect Note: i changed sql.conf site-available/defaults radiusd.conf ....... ......... Error showing below =============== Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "welcome" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius rlm_sql_mysql: Mysql error 'Client does not support authentication protocol requested by server; consider upgrading MySQL client' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. -- View this message in context: http://www.nabble.com/unable-to-connection-freeradius-with-mysql-tp24820558… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

RE: Info regarding radius and tacacs
by Vamsi Krishna Valiveti 05 Aug '09

05 Aug '09

Hi, Can anyone let me know if there is a free downloadable Tacacs server with support for Ipv6 If yes then please provide the link or the freeware software itself Rgds, Vamsi ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 3

Fwd: Freeradius with Active_Directory
by Hari Novferdianto 05 Aug '09

05 Aug '09

Dear All... I was following http://deployingradius.com/documents/configuration/active_directory.html I was installed freeradius-1.1.7 and samba version 3 on my slackware 11 and also I was installed Windows Server 2003 for Active Directory. This is my smb.conf : [global] workgroup = RADIUS security = server password server = radius.satelite.net In this case I'm not using kerberos and I was successfully running my samba and join with my domain. This is about status from my server when I joined root@jadul: net join -U administrator Password: Joined domain RADIUS. And I was successfully to use ntlm_auth helper to authenticate user from my Active Directory. This is the message from my server. root@jadul:/# ntlm_auth --request-nt-key --domain=radius.satelite.net -- username=administrator password: NT_STATUS_OK: Success (0x0) and also I add in the module section on radiusd.conf exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } and also I add in the users file DEFAULT Auth-Type = ntlm_auth There is no problem when I check with radiusd -X and after I running radiusd. I was check account from my Active Directory using radtest <user_AD> <pass_AD> localhost 1812 testing123 And the result is.. radtest ferdi ferdi localhost 1812 testing123 Sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=86, length=20 Why Reject..? Please help me..

2 1

Client-IP-Address attribute in the request
by Adam Osuchowski 05 Aug '09

05 Aug '09

Hi, I can't obtain Client-IP-Address attribute in %RAD_REQUEST hash in rlm_perl. In default server config from version 2.1.6, I noticed such a fragment: # It also adds the %{Client-IP-Address} attribute to the request. preprocess I browse through the sources of FR version 2.1.6 and it seems that rlm_preprocess module set only NAS-IP-Address attribute (under some circumstances) but not Client-IP-Address. However, in FR 1.1.7 sources, in the same module I see that version do it: nas = paircreate(PW_CLIENT_IP_ADDRESS, PW_TYPE_IPADDR); if (!nas) { radlog(L_ERR, "No memory"); return -1; } nas->lvalue = request->packet->src_ipaddr; ip_hostname(nas->strvalue, sizeof(nas->strvalue), nas->lvalue); pairadd(&request->packet->vps, nas); Is it obsoleted or something like that? Is there any other method to add Client-IP-Address attribute to the request beside patching FR 2.1.6? Regards.

2 1

Freeradius with Active_Directory
by Hari Novferdianto 05 Aug '09

05 Aug '09

Dear All... I was following http://deployingradius.com/documents/configuration/active_directory.html I was installed freeradius-1.1.7 and samba version 3 on my slackware 11 and also I was installed Windows Server 2003 for Active Directory. This is my smb.conf : [global] workgroup = RADIUS security = server password server = radius.satelite.net In this case I'm not using kerberos and I was successfully running my samba and join with my domain. This is about status from my server when I joined root@jadul: net join -U administrator Password: Joined domain RADIUS. And I was successfully to use ntlm_auth helper to authenticate user from my Active Directory. This is the message from my server. root@jadul:/# ntlm_auth --request-nt-key --domain=radius.satelite.net -- username=administrator password: NT_STATUS_OK: Success (0x0) and also I add in the module section on radiusd.conf exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } and also I add in the users file DEFAULT Auth-Type = ntlm_auth There is no problem when I check with radiusd -X and after I running radiusd. I was check account from my Active Directory using radtest <user_AD> <pass_AD> localhost 1812 testing123 And the result is.. radtest ferdi ferdi localhost 1812 testing123 Sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 86 to 127.0.0.1 port 1812 User-Name = "ferdi" User-Password = "ferdi" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=86, length=20 Why Reject..? Please help me.. I'm so confused..

1 0

LDAP bind as user
by Mark Saner 05 Aug '09

05 Aug '09

I'm using freeradius 2.0.4 for eap-peap authentication with LDAP as my back end. Everything is working great (thanks to help from this mailing list). However I was wondering if there is a way to get RADIUS to bind to LDAP as the user that is trying to authenticate rather than the LDAP admin account. I recall reading somewhere that it is not recommended to do this but I can't remember where and I am not finding it as I search this morning. Is it possible to bind to the LDAP database as the user trying to authenticate? If so how? If not or if it isn't desirable what suggestions do you have for a more secure way of binding to the LDAP server? -- Mark Saner

3 2

Re: Freeradius-Users Digest, Vol 52, Issue 27
by Gilbert Lo 05 Aug '09

05 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

MySQL - support - radacct (sql counters not responding)
by Benjamin Klutse 05 Aug '09

05 Aug '09

Hi Having a problem with getting freeradius to kick users off when their time has expired. using mysql, all modules loaded and sqlcounter included in radiusd.conf but still not working. i've cross-checked the sql settings in authorize and accounting section and sql is # (commented) out. any ideas. Regards

1 0

How to send accouting without expecting a response
by Cristina Miyata 04 Aug '09

04 Aug '09

Dear FreeRADIUS users, I need to send a copy of all accounting RADIUS our FreeRADIUS receives to another FreeRADIUS that is configured to send no accounting response. How can I configure my proxy RADIUS to not expect for a response for the requests our FreeRADIUS send? Appreciate any help. Thanks, Cristina Miyata

1 0