- Freeradius-Users - lists.freeradius.org

get statistics for sql connection pool
by Daniel Finger 18 Jun '19

18 Jun '19

Hi! If the radius server is running for about a month, I get messages like "No connections available and at max connection limit". Looking at the database, only very few connections are really connected (for example 2 out of 50), there are no slow queries, not much traffic (maybe one or two packets per second) and I really don't see a reason for this. Restarting freeRADIUS immediately fixes the problem. I suspect I am using a module (I have 2 own modules running) which does not return a connection to the connection pool under some circumstances. Is it possible to get statistics about the sql connection pool usage? This could help me size the number of connections I need and get a hint, if I am reaching the limit, before I hit it. Greetings, Daniel Finger

2 2

hourly auth logs -> change to daily
by Colleen Morrissey 18 Jun '19

18 Jun '19

Hopefully easy question - I recently rebuilt to v3.0.18 and the authentication logs in /usr/local/var/log/radius.log are being created hourly. I want to change this to daily - where is the config for this? I have my radacct detail files going daily via mods-enabled/detail but can't figure out config for the file = ${logdir}/radius.log Thank you in advance, Colleen

2 1

Debian buster packages from packages.freeradius.com?
by Mathieu Simon (Lists) 17 Jun '19

17 Jun '19

Hi I didn't want to hijack that other thread about Ubuntu bionic but was reminded about the question that I wanted to ask but then forgot to for some time: Are there plans to provide packags for Debian buster on that repository? I've been testing Debian buster, even though it is not yet officially released, however the stream of significant updates has slowed quite a bit (due to the version freeze in effect) and for many cases it already looks quite OK thus the Debian project looks like it might release make it a release in the next month or so. I've done a random package build from source and for what I can tell, it seems to be working for on my testing system, but I take these results with a grain of salt. ;-) Regards Mathieu

2 1

Rebuild of bionic package from packages.networkradius.com?
by Enno Gröper 17 Jun '19

17 Jun '19

Hi, last week Ubuntu pushed their libssl 1.1.0 -> 1.1.1 updates to the bionic-updates channel [1]. Since then the "upstream" package of freeradius from packages.networkradius.com stopped working: libssl version mismatch. built: 1010007f linked: 1010100f Are there any plans to publish an updated version? At the moment we need to put libssl on hold, which I'm not very comfortable with. Micha Ballmann asked a similar question last Friday, but didn't get an answer using this channel. Unfortunately I wasn't able to find the other channel(s) he seems to have used. Best regards, Enno [1] https://lists.ubuntu.com/archives/ubuntu-devel/2018-December/040567.html

3 2

Re: Need help on "ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject"
by Parth Gajjar (pagajjar) 17 Jun '19

17 Jun '19

Hi Team, I am facing below error, while using free radius. < radiusd.conf is attached> We are using dot1x, we have enabled pap & chap in the config. Added clients & users in both files. Ready to process requests (0) Received Access-Request Id 137 from 10.106.26.212:1645 to 10.105.41.247:1812 length 51 (0) User-Password = "hello" (0) User-Name = "parth" (0) NAS-IP-Address = 10.106.26.212 (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Received Access-Request Id 119 from 10.106.26.212:62566 to 10.105.41.247:1812 length 57 (1) User-Password = "hello" (1) User-Name = "parth" (1) NAS-IP-Address = 10.106.26.212 (1) Event-Timestamp = "Jan 1 1970 05:30:01 IST" (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) Post-Auth-Type sub-section not found. Ignoring. (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (1) Delaying response for 1.000000 seconds (0) Sending delayed response (0) Sent Access-Reject Id 137 from 10.105.41.247:1812 to 10.106.26.212:1645 length 20 Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 119 from 10.105.41.247:1812 to 10.106.26.212:62566 length 20 Waking up in 3.0 seconds. (0) Cleaning up request packet ID 137 with timestamp +8 Waking up in 0.9 seconds. (2) Received Access-Request Id 137 from 10.106.26.212:1645 to 10.105.41.247:1812 length 51 (2) User-Password = "hello" (2) User-Name = "parth" (2) NAS-IP-Address = 10.106.26.212 (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) Post-Auth-Type sub-section not found. Ignoring. (2) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (2) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Thanks & Regards, Parth Gajjar

2 4

Is there way to convert output octets and input octets to KB
by Mustafa Nassir 17 Jun '19

17 Jun '19

Hi there As I say from title is there any way to convert output and input octets to KB because I have small problem when I add to mysql value with 12 number in radtest I get small error it's give me the result just 10 number and note what I insert in SQL , I insert I SQL 10737418240 to limit my users 10 GB for total octets but in radtest I get other result but if I add 10 8 number I get same number in result any help for this ?

3 11

Retrieving the NAS-ID content
by Philemon Jaomalaza 15 Jun '19

15 Jun '19

Bonjour, How can I retrieve the NAS-ID content sent by a NAS during an Acces Request? the goal is to use it in a PHP query Thank's JMLZ --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

2 1

Freeradius SSL probelm
by Micha Ballmann 14 Jun '19

14 Jun '19

Hello, today i patched my freeradius server. The version of openssl has changed from 1.1.0g-2ubuntu4.3 to 1.1.1-1ubuntu2.1~18.04.2. Now freeradius wont start. When im trying to start with debug following message appears: # radiusd -X *libssl version mismatch. built: 1010007f linked: 1010100f* How can i fix this? Best regards Micha

2 1

DHCP metrics
by Damon Munhall 14 Jun '19

14 Jun '19

This is a high-level question, but my searching hasn't yielded anything similar, thus far. Are DHCP metrics generated and accessible, somehow? Specifically, the number of each type of DHCP packet sent/received, and any DHCP-related errors generated. The status module has similar functionality, but only appears to report-on RADIUS metrics. I'm interested in, and working with, different DHCP functionality in the latest 3.x and 4.x (primarily 4.x). My 'plan-B' would likely involve some logging/log-scraping, but that will certainly have more performance overhead. Thanks, Damon

2 1

Strange behaviour after AD password reset
by Richard Letuma 14 Jun '19

14 Jun '19

Hi, Could you please advise me what could be the issue here. These are the steps that I followed: 1) I have set "winbind offline logon = no" in /etc/samba/smb.conf under global 2) I have set /etc/raddb/mods-enabled/eap to "enable = no" in cache section. It is default behaviour. I just set it to be 100% sure that it is set. 3) Then I restarted smb and nmb with systemctl status smb nmb 4) Also I have restarted the radiusd 5) I then reset a password from AD and use radtest and wbinfo to test The problem is that after password reset OLD and NEW password works with radtest (also with eapol_test). After AD password reset if I type "radtest -t mschap myuserid PasswordOLD <IP Address> 0 testing123" and I type "radtest radtest -t mschap myuserid PasswordNEW <IP Address> 0 testing123" they both work. After approximately 5 minutes, the "radtest -t mschap myuserid PasswordOLD <IP Address> 0 testing123" will stop working and authentication fail. This is what I expect. The new password will remain working even. *Why is the old password works for approximately 5 minutes with radtest? I have also checked with eapol_test and the old password still works for 5 minutes before failing ( i.e Access-Reject ).* *The command "wbinfo -a <DOMAN USER and password>" immediately reflects that the password was changed. With "wbinfo -a", I do not have a problem where an old password work for 5 minutes.* In /etc/raddb/mods-enabled/ntlm_auth is there a possibility of using strictly wbinfo instead of ntlm_auth? I am on samba 4.8.3 and it is running on latest Centos 7. Please advise. Thank you.

2 1