- Freeradius-Users - lists.freeradius.org

rlm_sql
by Aurélio de Souza Ribeiro Neto 21 Apr '20

21 Apr '20

Hello, What I need to do to remove this warning? WARNING: Module rlm_sql became unblocked Thanks Aurélio

2 3

allocate_clear
by Aurélio de Souza Ribeiro Neto 20 Apr '20

20 Apr '20

Dear All, When allocate_clear query is executed? I'm using FreeRadius 3.19 and MySQL 5.7 In my sqlippool conf file It's set each 1s by default, but in which condition? Thanks a lot. Aurelio

2 2

accounting proxy via tcp
by belyj＠belyj.eu 20 Apr '20

20 Apr '20

Hi, Im trying to proxy NAS requests to freeradius via tcp. Authentication works, but accounting packets are still arriving via udp to radius. NAS < udp > FR proxy < tcp > FR, is it possible? or am i missing something radiusd: FreeRADIUS Version 3.0.21 (git #af428abda), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.21 proxy.conf home_server testsrv1 { type = auth+acct ipaddr = 192.168.1.10 port = 2083 proto = tcp secret = 01b6c42 } home_server testsrv2 { type = acct ipaddr = 192.168.1.100 port = 2084 secret = 887b2a8a proto = tcp } ... sites-enabled/default ... accounting { update control { Replicate-To-Realm += testsrv1 Replicate-To-Realm += testsrv2 } replicate ... 12:53:35.758094 IP (tos 0x0, ttl 57, id 53740, offset 0, flags [none], proto UDP (17), length 204) 192.168.1.1.62825 > 192.168.1.100.2084: [udp sum ok] UDP, length 176 12:53:36.760526 IP (tos 0x0, ttl 57, id 53771, offset 0, flags [none], proto UDP (17), length 178) 192.168.1.1.17830 > 192.168.1.100.2084: [udp sum ok] UDP, length 150

2 3

Route through post-proxy not working when no live home servers are available - (3.0.20)
by João Vitor Arruda 20 Apr '20

20 Apr '20

Hello there I would like to request your help to see why we are facing this issue that was supposedly fixed in https://github.com/FreeRADIUS/freeradius-server/pull/2072 We have a server configured to proxy to an upstream server and the "post-proxy" configured with "Post-Proxy-Type Fail-Authentication" (tested with "Post-Proxy-Type Fail" too) to not respond. When the upstream server does not reply (either before or after starting the zombie period) the post-proxy section is invoked and works as expected as you can see in the log bellow (some lines were suppressed): (1) Received Access-Request Id 4 from [IPv6_HERE]:1812 to [IPv6_HERE]:1812 length 371 (1) Starting proxy to home server 192.168.100.10 port 1812 (1) Proxying request to home server 192.168.100.10 port 1812 timeout 5.000000 (1) Sent Access-Request Id 188 from 0.0.0.0:41510 to 192.168.100.10:1812 length 398 (1) Expecting proxy response no later than 4.667684 seconds from now (1) No proxy response, giving up on request and marking it done Marking home server 192.168.100.10 port 1812 as zombie (it has not responded in 5.000000 seconds). (1) ERROR: Failing proxied request for user "deadbeefcafe", due to lack of any response from home server 192.168.100.10 port 1812 (1) Clearing existing &reply: attributes (1) Found Post-Proxy-Type Fail-Authentication (1) server default { (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Proxy-Type Fail-Authentication { (1) if ((NAS-Port-Type == Ethernet) || (Service-Type == Call-Check) || (Service-Type == Framed-User)) { (1) if ((NAS-Port-Type == Ethernet) || (Service-Type == Call-Check) || (Service-Type == Framed-User)) -> TRUE (1) if ((NAS-Port-Type == Ethernet) || (Service-Type == Call-Check) || (Service-Type == Framed-User)) { (1) update control { (1) &Response-Packet-Type := Do-Not-Respond (1) } # update control = noop (1) } # if ((NAS-Port-Type == Ethernet) || (Service-Type == Call-Check) || (Service-Type == Framed-User)) = noop (1) } # Post-Proxy-Type Fail-Authentication = noop (1) } (1) Login incorrect (Home Server failed to respond): [deadbeefcafe] (from client any_ipv6 port 111 cli de-ad-be-ef-ca-fe) (1) Not responding to request (1) # Executing section post-auth from file /etc/raddb/sites-enabled/default But when the upstream server is marked as DEAD the post-proxy section is never invoked as you can see in the log bellow (some lines were suppressed): (60) Received Access-Request Id 216 from [IPv6_HERE]:1812 to [IPv6_HERE]:1812 length 371 (60) ERROR: Failed to find live home server: Cancelling proxy (60) WARNING: No home server selected (60) There was no response configured: rejecting request (60) Using Post-Auth-Type Reject (60) # Executing group from file /etc/raddb/sites-enabled/default (60) Post-Auth-Type REJECT { (60) Login incorrect (Failed to find live home server: Cancelling proxy): [deadbeefcafe ] (from client any_ipv6 port 111 cli de-ad-be-ef-ca-fe) (60) Sent Access-Reject Id 216 from [ IPv6_HERE]:1812 to [ IPv6_HERE ]:1812 length 20 Thanks for your help. Regards, Joao Arruda

2 4

conflicting packet
by Bassem Mettichi 20 Apr '20

20 Apr '20

Hello, i receive this message on radius.log Error: Received conflicting packet from client GGSN1 port 61137 - ID: 96 due to unfinished request in module <queue>. Giving up on old request. i need to print the Calling-Station-Id and the Acct-Status-Type related to this packet I was able to do this when the packet is on module <detail> by modification done on the process.c file but when packet is on <queue> module it doen't print the Calling-Station-Id, could you give me an idea how to get Calling-Station-Id when packet is on <queue> module? Thanks Bassem

2 3

Freeradius 3.0.19 and 3.0.21 can not find proto_acc.so and proto_auth.so.
by CpServiceSPb . 19 Apr '20

19 Apr '20

I had 3.0.19 before and now have installed 3.0.21. But for both versions I got and get: Loading library using linker search path(s) Defaults : /lib:/usr/lib Failed with error: proto_auth.so: cannot open shared object file: No such file or directory listen { type = "auth" ipaddr = 192.168.0.254 port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Loading proto_acct with path: /usr/lib/freeradius/proto_acct.so Loading proto_acct failed: /usr/lib/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Loading library using linker search path(s) Defaults : /lib:/usr/lib Failed with error: proto_acct.so: cannot open shared object file: No such file or directory listen { type = "acct" ipaddr = 192.168.0.254 port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } As I saw at freeradius site there are only 2 proto_ modules - proto_ and proto_dhcp. Is it normal and does not it affect anythingor not ? Should I change my setting to avoid it or what is necessary to do ? Or it does not affect to anything and should be forgotten.

2 3

New sqlippool under accounting breaks (FreeRADIUS 3.0.21)
by Houman 19 Apr '20

19 Apr '20

Hello, I'm using the latest FreeRADIUS Version 3.0.21 that is released for Ubuntu LTS 18.04. And it seems there is a breaking change, that I haven't seen before. /etc/freeradius/sites-enabled/default[687]: Failed to find "sqlippool" as a module or policy. Apr 19 08:44:15 d-4 freeradius[2774]: /etc/freeradius/sites-enabled/default[687]: Please verify that the configuration exists in /etc/freeradius/mods-enabled/sqlippool. Apr 19 08:44:15 d-4 freeradius[2774]: /etc/freeradius/sites-enabled/default[661]: Errors parsing accounting section. There is no file at /etc/freeradius/mods-enabled/sqlippool But I can see a new module called sqlippool under accounting in /etc/freeradius/sites-enabled/default. May someone point me into the right direction what this is and how to configure it? Thank you, Houman

3 2

freeradius 3.0.21 rlm_sql_freetds problem
by Ali Arslan 17 Apr '20

17 Apr '20

Hello, I have installed freeradius 3.0.21 on ubuntu 18.04 server. I wanted to use mssql as radius database server, so i installed freetds as apt-get install freetds-dev freetds-bin tdsodbc and configured /etc/freetds/freetds.conf file as [RadiusSqlServer] host = sqlserver_ip_address port = 1433 tds version = 7.0 and configured /etc/freeradius/mods-available/sql file to use rlm_sql_freetds as deriver. But I got error: Could not link driver rlm_sql_freetds: : cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/freeradius/mods-enabled/sql[27]: Instantiation failed for module "sql" Installation of freeradius does not create file /usr/lib/freeradius/rlm_sql_freetds.so.To create this file i first install freeradius 3.0.16 (standard on ubuntu 18.04) then copy file to another location and uninstall freeradius 3.0.16 and install 3.0.21 and copy file back to/usr/lib/freeradius/ folder. Is this a bug in freeradius 3.0.21 package?

4 6

New ODBC Howto
by Alan DeKok 17 Apr '20

17 Apr '20

Thanks to Terry Burton, we now have a new ODBC Howto on the wiki: https://wiki.freeradius.org/modules/Rlm_sql_unixodbc The documentation has been tested to work on a number of different systems. Alan DeKok.

1 0

new error message spotted in FR logs
by Alex Sharaz 17 Apr '20

17 Apr '20

Just been browsing our FR log files having migrated a server to Ununtu 18.06 from 16.04 and noticed the following error message ERROR: Couldn't get issuer_cert for eapoltest2020(a)york.ac.uk epoltest2020(a)york.ac.uk is a test client cert generated using our local pki manually pused to FR via eapol_test. We've been using a version of that to perform health checks for TLS validation for years and I've only just noticed the above message ( running 3.0.22 from git) doesn't matter whether I use pem files or p.12 flles in the wpa_supplicant .conf file still get the message. On the server, in our /etc/freeradius/mods-enabled/eap file I have a ca_file set to a file with a list of all the root/ intermediate CAs that might issue a client certificate. ... again that hasn't changed for a long time. TBH these servers have been fit and forget for a long time, so the error message might have been there for a while. The client successfully auths via an OCSP validation so its not causing any problems ..... other than its there and I feel it shouldn't be, the ca_file specified has an extension of .chain ... but that shouldn't matter should it ? Rgds Alex

2 2