- Freeradius-Users - lists.freeradius.org

Move from text to SQL(Postgresql)
by Tuc at T-B-O-H.NET 13 May '08

13 May '08

Hi, I've got a new install, and I have it working fine with plain text files. I'm trying to go this time to Postgresql (Don't ask....) and I'm just not having a good time of it. I don't get why its doing the following (2.0.4 with Postgresql 8.1.11) : Ready to process requests. User-Name = "tuc" User-Password = "ICANSEE" NAS-IP-Address = 192.168.3.128 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tuc", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop expand: %{User-Name} -> tuc rlm_sql (sql): sql_set_user escaped user --> 'tuc' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 rlm_sql (sql): User found in radcheck table expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'tuc' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='tuc' ORDER BY priority rlm_sql_postgresql: query: SELECT GroupName FROM radusergroup WHERE UserName='tuc' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "ICANSEE" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [tuc/ICANSEE] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> tuc attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Why does it head to crypt? I have in radcheck : Welcome to psql 8.1.11, the PostgreSQL interactive terminal. Type: \copyright for distribution terms \h for help with SQL commands \? for help with psql commands \g or terminate with semicolon to execute query \q to quit radius=> select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+--------- 2 | tuc | Cleartext-Password | := | ICANSEE (1 row) radius=> Thanks, Tuc

4 8

Re: Load testing tool recommendation
by Anders Holm 13 May '08

13 May '08

In my tests, radclient has been /slower/ the radtest processes forked from a Perl script. 100 requests using my forking Perl script takes 2.2 seconds to complete. 100 requests using radclient takes ~8x, i.e 16.7+ seconds to complete. I'm using the variants included with 2.0.3 .. Using both -c and -p for radclient does not appear to actually fire off requests in parallel, then again, I have no immutable evidence showing this, other then the time it takes to complete. My test consists of a very simple auth request, only containing user name and password. Nothing else. Still, at this stage, the client side hosts are closer to a nuclear meltdown, whereas the server side is barely flinching. I want to be able to generate enough traffic to shoot the server down, or at least start seeing it get close to a crawl. I may be doing something wrong with the radclient, that is a possibility as well ... //anders ----- Original Message ----- From: "Ivan Kalik" <tnt(a)kalik.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 9, 2008 4:26:37 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: Load testing tool recommendation http://wiki.freeradius.org/Radclient Ivan Kalik Kalik Informatika ISP Dana 9/5/2008, "Anders Holm" <anders.holm(a)sysadmin.ie> piše: >So, I'm building a complete solution, from scratch. > >As such, the business owners have some requirements on how many requests it should be handle today per second and "some point in the future" as well. > >Would there be any good load testing tools, or some handy way to figure out how many tps my current setup can handle? > >I've got a dirt simple Perl script that forks out x radtest processes and I'm just right now seeing how many a second I can ship. Problem being, the RADIUS server is happily letting me melt down to "client" systems, without breaking a sweat. I'd like to load the server, not the clients .. :) I want to see where it eventually breaks down, which seems a task in its own right. > >Any pointers would be much appreciated. I'd rather have something I can fire off from command line then a GUI solution, for obvious reasons. > >Cheers! > >//anders > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 6

Parser problem?
by Norbert Wegener 13 May '08

13 May '08

I don't want the module saneusername to be executed, when the username either contains "HOST" or ends with ".net" or contains "@". Therefore in 2.0.4 I have this code in sites-available/default: authorize { if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ )) { saneusername } ...... Starting radiusd -X ... rad_recv: Access-Request packet from host 149.246.185.169 port 60938, id=0, length=168^M User-Name = "HOST/02G1-67.us002.mycompany.net"^M NAS-IP-Address = 10.10.20.77^M Calling-Station-Id = "00-00-00-00-00-02"^M Framed-MTU = 1400^M NAS-Port-Type = Wireless-802.11^M Connect-Info = "CONNECT 11Mbps 802.11b"^M EAP-Message = 0x0200002301484f53542f303247312d36372e75733030322e7369656d656e732e6e6574^M Message-Authenticator = 0x1836592939950fab657ec0d5568883c4^M With that User-Name I would expect the module not be executed. +- entering group authorize^M ++? if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ ))^M expand: %{User-Name} -> HOST/02G1-67.us002.mycompany.net^M ?? Evaluating ("%{User-Name}" =~ /HOST/) -> TRUE^M ? Converting !TRUE -> FALSE^M expand: %{User-Name} -> HOST/02G1-67.us002.mycompany.net^M ? Evaluating ("%{User-Name}" =~ /.net/) -> TRUE^M Skipping ("%{User-Name}" =~ /@/)^M ++? if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ )) -> TRUE^M ++- entering if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ ))^M expand: [-] -> [-]^M saneusername: Changed value for attribute User-Name from 'HOST/02G1-67.us002.mycompany.net' to 'HOST/02G167.us002.mycompany.net'^M Now unfortunately the username has been changed. +++[saneusername] returns ok^M ++- if (!( "%{User-Name}" =~ /HOST/ || "%{User-Name}" =~ /.net/ || "%{User-Name}" =~ /@/ )) returns ok^M ++? if ("%{sqlnastype:SELECT UserName from usergroup where UserName = '%{User-Name}' }" == "" )^M What do I have to change to make it work as expected? Norbert Wegener

2 1

new CVS version is a little quiet....
by A.L.M.Buxey＠lboro.ac.uk 13 May '08

13 May '08

hi, recently upgraded a 2.0.4 CVS system to the 2.0.5 CVS and now the radius.log doesnt get populated with any OK or FAIL messages when users log in. config log{} section as per the standard distro and unchanged from the 2.0.4 - which logged these things auth = yes in the log{} section anyone else noted this? alan

3 6

radiusd process vanishes on higher load
by Christian Hofstädtler 13 May '08

13 May '08

Hello! I'm using a FreeRadius setup (V 1.1.3-3 from Debian etch) with the MySQL Backend for authorize and accounting. RADIUS packets are coming from another company, which /probably/ has a Proxy for their delivery front-end servers. This setup usually works fine, but on some days I see spikes in the log, and the radiusd process vanishes; needing a restart. I've set: max_request_time = 5 cleanup_delay = 5 max_requests = 4096 sql.conf: num_sql_socks = 256 nas: nastype = other Usually, there will be a few 'stop packet with zero session length' log lines, about 1 per second or fewer. At problem/spike time, I see a lot more of these 'stop packet with zero session length' stuff (about 30 per second); and this too: Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Additionally, one of these things happen: 1) radiusd process vanishes without a log entry. 2) Error: Dropping request (4097 is too many): from client nasname:57426 - ID: 174 Info: WARNING: Please check the radiusd.conf file. ?The value for 'max_requests' is probably set too low. 3) Error: Internal error processing module entry And radiusd usually vanishes after this. With Option 3 I usually also see MySQL DB connection problems, but not all the time, and they are not always fatal (?). So - am I missing something? Is this just a very long spike (can take 10 minutes to a few hours); Are there any counters in FR that I could track? (like packets per second, etc.) Thanks, Christian -- Christian Hofstädtler InQnet GmbH Praterstraße 31 A-1020 Wien Tel.: +43 1 212 7650 523 Fax.: +43 1 212 7650 610

2 1

Re: Freeraius in debug mode
by A.L.M.Buxey＠lboro.ac.uk 13 May '08

13 May '08

Hi, > Hi! > > Is it possible to run freeradius in debug mode to have all > debug (clients request) information in log file. It is not usable to have > open console with freeradius -Xf command. redirect the output to a log file instead then... eg radiusd -X >/var/log/radius-special.log 2>&1 alan

1 0

Thank you kalik
by johnson elangbam 13 May '08

13 May '08

hi kalik, After a long pause, I've successfully done my authorization of my radius server by using digest and perl authentication in mixed mode, as per your advice I put the digest entry first before the perl authentication in the default file, and after that I've put a line of perl code RAD_CHECK{'Cleartext-Password'} = $mypassword, where the password is fetch from the database. And finally the server starts reading the cleartext password and starts calculating the md5 encryption and sucessfully authorized a user. Lastly, I thank to all the members of this forum who are dedicated here to help solving the complex problem in a complicated environment, especially Evan Kalik who is much envolved, regarding my problems of not getting my digest attributes. Thanking you for your valuable time and consideration. With Regards, Johnson Elangbam

1 0

0 Session Length, radrelay or Freeradius causing issues
by Etienne Pretorius 13 May '08

13 May '08

Hello List, I have asked this before (http://readlist.com/lists/lists.freeradius.org/freeradius-users/1/7788.html) and Alan DeKok did say that I should place those accounting packets in a different Acct-Type, but that was when I did not wish to log the information but I now need to log the information and replicate to all radius servers. I need to know why the radrelay application stops replacation when it comes across a 0 session length packet. This morning I found a 40Mb backlog file for each server and realised that it was the 0 session-length packet again. I know FreeRadius does complain about it but it still logs this accounting packet into the sql database. So is it because FreeRadius indicates that an error (0 Session Length?). If so could I not just somehow tell FreeRadius to stop complaining and just accept the stupid packet. (As I am passing configurable triggers via 0 session length radius packets). -- Kind Regards Etienne Pretorius

3 3

Freeraius in debug mode
by Alexey Eronko 13 May '08

13 May '08

Hi! Is it possible to run freeradius in debug mode to have all debug (clients request) information in log file. It is not usable to have open console with freeradius -Xf command. Thanks Alexey

1 0

OT: java radius client libraries?
by Alex French 13 May '08

13 May '08

Hi guys, Sorry if this is slightly OT but I'm hoping someone can advise on an open-source radius client library in Java for integration with another project that will be talking to a freeradius server. I have found two, jradius and tinyradius, but jradius does not seem to be in active development. Has anyone used either of these or something else, preferably with a freeradius server? Thanks, Alex

3 3