- Freeradius-Users - lists.freeradius.org

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

HI Alan That makes a lot more sense - I have other servers here feeding from that SQL Database so I will proxy to them. Not sure why I didn't think of that option! Thanks again Richard On Saturday 11/11/2017 at 8:42 pm, Alan Buxey wrote: > Not that remote server, just spin up another server that this one > talks to, > replying back with such results. > > Run in full debug mode, you should see contents of packets, since this > isn't in the post-proxy or post-auth (as you are putting things in > during > Auth stage and checking/changing them there - which isn't how the real > server would behave or be configured) the check you make will be > different > too > > alan > > On 11 Nov 2017 8:17 pm, "Richard J Palmer" <richard(a)merula.net> wrote: > >> >> Hi >> >> I can almost certainly test this with the remote radius server - I am >> just >> waiting for the remote server to be configured to allow me access - >> and in >> the mean time was trying to test my config locally. >> >> From the log >> >> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >> >> ERROR: Failed retrieving values required to evaluate condition >> >> I assume that &Cisco-AVPair is not available here and I should be >> using >> something else (or I could have totally the wrong reason). >> >> Ultimately the aim was to check if what had written worked before I >> had >> access to the upstream server. If it's easier just to wait I shall. >> >> Thanks in advance >> >> Richard >> >> >> >> >> On Saturday 11/11/2017 at 7:39 pm, Alan Buxey wrote: >> >>> >>> Best test would be to have a remote radius server sending back replies >>> like >>> you will have as using some local stuff added via SQL isn't going to >>> be >>> the >>> same , goes through different sections, >>> >>> alan >>> >>> On 11 Nov 2017 7:33 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>> >>> >>>> >>>> HI Alan >>>> >>>> I will be using it for Proxy. However I was trying to test / use this >>>> locally as well while debugging the server / code. >>>> >>>> Ideally it would be nice to allow both options to work but I am >>>> flexible >>>> if it's easier just to use this for requests that are proxied >>>> >>>> Thanks >>>> >>>> Richard >>>> >>>> >>>> >>>> >>>> On Saturday 11/11/2017 at 7:14 pm, Alan Buxey wrote: >>>> >>>> >>>>> >>>>> You say you need to modify a reply from their radius server - this >>>>> will >>>>> be >>>>> in the post-proxy section? >>>>> >>>>> Also if (&reply:Cisco-AVPair ... ? >>>>> >>>>> alan >>>>> >>>>> >>>>> On 11 Nov 2017 6:37 pm, "Richard J Palmer" <richard(a)merula.net> wrote: >>>>> >>>>> Hi >>>>> >>>>> Sorry for the delay. I am getting close with this I think... BUT >>>>> something >>>>> seems to be slightly wrong. >>>>> >>>>> Happy to post a full log as needed - BUT I hope the bit I need is >>>>> here: >>>>> >>>>> (2) sql1: Framed-Route = "" >>>>> (2) sql1: Framed-IP-Address = 1.2.3.1 >>>>> (2) sql1: Framed-IP-Netmask = 255.255.255.248 >>>>> (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" >>>>> (2) sql1: Filter-Id = "P" >>>>> (2) sql1: Chargeable-User-Identity = "richard2" >>>>> >>>>> <group SQL statements> >>>>> >>>>> (2) sql1: Group "Hotspot": Merging reply items >>>>> (2) sql1: Acct-Interim-Interval = 600 >>>>> >>>>> (2) [sql1] = ok >>>>> (2) } # redundant = ok >>>>> (2) policy rewrite_routes { >>>>> (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>> (2) ERROR: Failed retrieving values required to evaluate >>>>> condition >>>>> (2) } # policy rewrite_routes = ok >>>>> >>>>> (2) Login OK: [richard2] (from client local port 1) >>>>> (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 >>>>> length 0 >>>>> (2) Framed-IP-Address = 1.2.3.1 >>>>> (2) Framed-IP-Netmask = 255.255.255.248 >>>>> (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" >>>>> (2) Filter-Id = "P" >>>>> (2) Chargeable-User-Identity = "richard2" >>>>> (2) Acct-Interim-Interval = 600 >>>>> (2) Finished request >>>>> >>>>> >>>>> In my authorise section I have placed: >>>>> >>>>> redundant { >>>>> sql1 >>>>> sql2 >>>>> handled >>>>> } >>>>> # -sql >>>>> rewrite_routes >>>>> >>>>> (The other sections are there - this is just to show where what I hope >>>>> is >>>>> relevant. The code itself is based on the code provided below >>>>> >>>>> rewrite_routes { >>>>> >>>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>> switch "%{2}" { >>>>> case "255.255.255.255" { >>>>> update reply { >>>>> Framed-Route = >>>>> "%{1}/32" >>>>> } >>>>> } >>>>> case "255.255.255.254" { >>>>> update reply { >>>>> Framed-Route = >>>>> "%{1}/31" >>>>> } >>>>> } >>>>> >>>>> >>>>> and so on (it is in the policy.d folder) >>>>> >>>>> I am aware the key to this is the error >>>>> >>>>> (2) ERROR: Failed retrieving values required to evaluate >>>>> condition >>>>> >>>>> What I am unclear about is why this is failing / and what I have done >>>>> wrong >>>>> here to cause this. If you can give me one more pointer here I'd >>>>> appreciate >>>>> it >>>>> >>>>> More than happy to send any of the extra config or log as needed >>>>> >>>>> Thanks in advance >>>>> >>>>> Richard >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: >>>>> >>>>> >>>>> >>>>>> >>>>>> On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> >>>>>> wrote: >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> >>>>>>> This is where my skills are not great (regex) most other areas I can >>>>>>> work >>>>>>> with. Ultimately I am happy to pay someone to help write the little >>>>>>> bit >>>>>>> of >>>>>>> code that does this. I do need to cope with Netmasks from /32 to /24 >>>>>>> so a >>>>>>> few switch cases. >>>>>>> >>>>>>> >>>>>>> It shouldn't be difficult. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> Alternatively if someone can provide a few pointers on that bit I can >>>>>>> probably build from there. >>>>>>> >>>>>>> >>>>>>> If you have: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Cisco-AVPair = "ip:route=1.2.3.1 >>>>>>>>> 255.255.255.240" >>>>>>>>> >>>>>>>>> >>>>>>>>> Step 1, split it into pieces: >>>>>>>> >>>>>>> >>>>>> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >>>>>> >>>>>> This matches the "ip:route" prefix. It >>>>>> then matches >>>>>> non-space >>>>>> data, >>>>>> then a space, and more non-space data. As per the FR documentation, >>>>>> the >>>>>> first match goes into %{1}, and the second into %{2}. >>>>>> >>>>>> As there are only a limited number of >>>>>> net masks, you >>>>>> can expand >>>>>> the net >>>>>> mask, and switch over it (inside of the "if" block from above) >>>>>> >>>>>> switch "%{2}" { >>>>>> case "255.255.255.255" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/32" >>>>>> } >>>>>> } >>>>>> >>>>>> case "255.255.255.254" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/31" >>>>>> } >>>>>> } >>>>>> >>>>>> case "255.255.255.252" { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/30" >>>>>> } >>>>>> } >>>>>> >>>>>> ... etc... >>>>>> >>>>>> # and the "catch all" case, just mash it to /28 >>>>>> case { >>>>>> update reply { >>>>>> Framed-Route = "%{1}/28" >>>>>> } >>>>>> } >>>>>> } >>>>>> >>>>>> A little verbose, but it should work. >>>>>> >>>>>> Alan DeKok. >>>>>> >>>>>> >>>>>> - >>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>>> /users.html >>>>>> >>>>>> >>>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>> /users.html >>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>>> /users.html >>>>> >>>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>>> /users.html >>>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

HI Alan I will be using it for Proxy. However I was trying to test / use this locally as well while debugging the server / code. Ideally it would be nice to allow both options to work but I am flexible if it's easier just to use this for requests that are proxied Thanks Richard On Saturday 11/11/2017 at 7:14 pm, Alan Buxey wrote: > You say you need to modify a reply from their radius server - this > will be > in the post-proxy section? > > Also if (&reply:Cisco-AVPair ... ? > > alan > > > On 11 Nov 2017 6:37 pm, "Richard J Palmer" <richard(a)merula.net> wrote: > > Hi > > Sorry for the delay. I am getting close with this I think... BUT > something > seems to be slightly wrong. > > Happy to post a full log as needed - BUT I hope the bit I need is > here: > > (2) sql1: Framed-Route = "" > (2) sql1: Framed-IP-Address = 1.2.3.1 > (2) sql1: Framed-IP-Netmask = 255.255.255.248 > (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" > (2) sql1: Filter-Id = "P" > (2) sql1: Chargeable-User-Identity = "richard2" > > <group SQL statements> > > (2) sql1: Group "Hotspot": Merging reply items > (2) sql1: Acct-Interim-Interval = 600 > > (2) [sql1] = ok > (2) } # redundant = ok > (2) policy rewrite_routes { > (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > (2) ERROR: Failed retrieving values required to evaluate > condition > (2) } # policy rewrite_routes = ok > > (2) Login OK: [richard2] (from client local port 1) > (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 > length 0 > (2) Framed-IP-Address = 1.2.3.1 > (2) Framed-IP-Netmask = 255.255.255.248 > (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" > (2) Filter-Id = "P" > (2) Chargeable-User-Identity = "richard2" > (2) Acct-Interim-Interval = 600 > (2) Finished request > > > In my authorise section I have placed: > > redundant { > sql1 > sql2 > handled > } > # -sql > rewrite_routes > > (The other sections are there - this is just to show where what I hope > is > relevant. The code itself is based on the code provided below > > rewrite_routes { > > if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > switch "%{2}" { > case "255.255.255.255" { > update reply { > Framed-Route = "%{1}/32" > } > } > case "255.255.255.254" { > update reply { > Framed-Route = "%{1}/31" > } > } > > > and so on (it is in the policy.d folder) > > I am aware the key to this is the error > > (2) ERROR: Failed retrieving values required to evaluate > condition > > What I am unclear about is why this is failing / and what I have done > wrong > here to cause this. If you can give me one more pointer here I'd > appreciate > it > > More than happy to send any of the extra config or log as needed > > Thanks in advance > > Richard > > > > > > On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: > >> >> On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> >> wrote: >> >>> >>> >>> This is where my skills are not great (regex) most other areas I can >>> work >>> with. Ultimately I am happy to pay someone to help write the little >>> bit of >>> code that does this. I do need to cope with Netmasks from /32 to /24 >>> so a >>> few switch cases. >>> >> >> It shouldn't be difficult. >> >> >>> >>> Alternatively if someone can provide a few pointers on that bit I can >>> probably build from there. >>> >> >> If you have: >> >> >>> >>> >>>> >>>> >>>>> >>>>> Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" >>>>> >>>> >> Step 1, split it into pieces: >> >> if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { >> >> This matches the "ip:route" prefix. It then matches non-space >> data, >> then a space, and more non-space data. As per the FR documentation, >> the >> first match goes into %{1}, and the second into %{2}. >> >> As there are only a limited number of net masks, you can expand >> the net >> mask, and switch over it (inside of the "if" block from above) >> >> switch "%{2}" { >> case "255.255.255.255" { >> update reply { >> Framed-Route = "%{1}/32" >> } >> } >> >> case "255.255.255.254" { >> update reply { >> Framed-Route = "%{1}/31" >> } >> } >> >> case "255.255.255.252" { >> update reply { >> Framed-Route = "%{1}/30" >> } >> } >> >> ... etc... >> >> # and the "catch all" case, just mash it to /28 >> case { >> update reply { >> Framed-Route = "%{1}/28" >> } >> } >> } >> >> A little verbose, but it should work. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html >> > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list > /users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Proxy / reply translation
by Richard J Palmer 11 Nov '17

11 Nov '17

Hi Sorry for the delay. I am getting close with this I think... BUT something seems to be slightly wrong. Happy to post a full log as needed - BUT I hope the bit I need is here: (2) sql1: Framed-Route = "" (2) sql1: Framed-IP-Address = 1.2.3.1 (2) sql1: Framed-IP-Netmask = 255.255.255.248 (2) sql1: Cisco-AVPair += "ip:route=1.2.3.0 255.255.255.248" (2) sql1: Filter-Id = "P" (2) sql1: Chargeable-User-Identity = "richard2" <group SQL statements> (2) sql1: Group "Hotspot": Merging reply items (2) sql1: Acct-Interim-Interval = 600 (2) [sql1] = ok (2) } # redundant = ok (2) policy rewrite_routes { (2) if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { (2) ERROR: Failed retrieving values required to evaluate condition (2) } # policy rewrite_routes = ok (2) Login OK: [richard2] (from client local port 1) (2) Sent Access-Accept Id 69 from 127.0.0.1:1645 to 127.0.0.1:48919 length 0 (2) Framed-IP-Address = 1.2.3.1 (2) Framed-IP-Netmask = 255.255.255.248 (2) Cisco-AVPair = "ip:route=1.2.3.0 255.255.255.248" (2) Filter-Id = "P" (2) Chargeable-User-Identity = "richard2" (2) Acct-Interim-Interval = 600 (2) Finished request In my authorise section I have placed: redundant { sql1 sql2 handled } # -sql rewrite_routes (The other sections are there - this is just to show where what I hope is relevant. The code itself is based on the code provided below rewrite_routes { if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { switch "%{2}" { case "255.255.255.255" { update reply { Framed-Route = "%{1}/32" } } case "255.255.255.254" { update reply { Framed-Route = "%{1}/31" } } and so on (it is in the policy.d folder) I am aware the key to this is the error (2) ERROR: Failed retrieving values required to evaluate condition What I am unclear about is why this is failing / and what I have done wrong here to cause this. If you can give me one more pointer here I'd appreciate it More than happy to send any of the extra config or log as needed Thanks in advance Richard On Thursday 09/11/2017 at 1:35 pm, Alan DeKok wrote: > On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> This is where my skills are not great (regex) most other areas I can >> work with. Ultimately I am happy to pay someone to help write the >> little bit of code that does this. I do need to cope with Netmasks >> from /32 to /24 so a few switch cases. > > It shouldn't be difficult. > >> >> Alternatively if someone can provide a few pointers on that bit I can >> probably build from there. > > If you have: > >> >>> >>>> >>>> Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" > > Step 1, split it into pieces: > > if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > > This matches the "ip:route" prefix. It then matches non-space > data, then a space, and more non-space data. As per the FR > documentation, the first match goes into %{1}, and the second into > %{2}. > > As there are only a limited number of net masks, you can expand the > net mask, and switch over it (inside of the "if" block from above) > > switch "%{2}" { > case "255.255.255.255" { > update reply { > Framed-Route = "%{1}/32" > } > } > > case "255.255.255.254" { > update reply { > Framed-Route = "%{1}/31" > } > } > > case "255.255.255.252" { > update reply { > Framed-Route = "%{1}/30" > } > } > > ... etc... > > # and the "catch all" case, just mash it to /28 > case { > update reply { > Framed-Route = "%{1}/28" > } > } > } > > A little verbose, but it should work. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Radtest with "Sent too many packets" error messages
by Claudio Carvalho 11 Nov '17

11 Nov '17

Hello, I am testing the radtest application with 1000 users in CSV file using the parameters below, after 30 or 40 minutes of testing the radtest interrupts with the following message: “Received response ID 152, code 5, lengthradperf: Sent too many packets (13104 > 13103)” This is my radperf execution command: radperf -A600,3600 -s -4 -T test.rad -f test.csv x.x.x.x auth xxxx test.rad file: NAS-IP-Address = 192.168.1.1 NAS-Port = "" NAS-Port-Type = "Virtual" Called-Station-Id = "test.domain" test.csv file: 0001,”0001” 0002,”0002” . . 1000,”1000” Has anyone had this problem? Thanks, Claudio.

2 1

Accounting on SQL - sleep time
by Andrés Gómez 10 Nov '17

10 Nov '17

Hi dear list. I have 3 freeradius servers using the same version and configuration. The first one is the primary radius server for many access points and the second and third one are the secundary radius server fo the same access points. The behavior should be the same (because I use the same version and configuration of freeradius) but in the MySQL server I see that accounting queries from the 1st (main) one are closed very fast (least of 1 second). In the mysql process usually appears with 0 or 1 second of duration time: | 3502 | user | FIRST:42048 | radius | Sleep | 1 | | NULL | 0 | 1 | | 3504 | user | FIRST:42050 | radius | Sleep | 1 | | NULL | 0 | 0 | | 3505 | user | FIRST:42052 | radius | Sleep | 1 | | NULL | 0 | 0 | But about the queries from 2nd or 3th server are not closed, so I can see process opened from a lot of time ago: | 1912220 | user | SECOND:36298 | radius | Sleep | 7471 | | NULL | 0 | 0 | | 1913262 | user | SECOND:37010 | radius | Sleep | 7077 | | NULL | 0 | 0 | | 1913816 | user | SECOND:37384 | radius | Sleep | 6871 | | NULL | 0 | 0 | | 1948365 | user | THIRD:39115 | radius | Sleep | 733 | | NULL | 0 | 0 | | 1948368 | user | THIRD:39117 | radius | Sleep | 733 | | NULL | 0 | 0 | | 1948369 | user | THIRD:39118 | radius | Sleep | 733 | | NULL | 0 | 0 | What can I check? Thanks in advance! Regards -- *C. Andrés Gómez R.*

2 1

is freeradius server support fail over ??
by Dipteshkumar Patel 10 Nov '17

10 Nov '17

hello sir I am using freeradius version 2.2.0 and freeradius client 1.1.7 I want to know that freeradius-server supports the fail over if yes then how can i setup it? *Diptesh Patel* Jr. Software Developer Ecosmob Technologies Ltd Ahmedabad Mo:*+919898962659*

2 1

EAP-PEAP MSCHAPv2 with Python Module
by Gary Gwin 09 Nov '17

09 Nov '17

I've configured and tested the EAP-PEAP MSCHAPv2 basic example as documented with FreeRADIUS 3.0.12 using a Windows 10 supplicant configured for WPA2 Enterprise. Instead of using the FreeRADIUS users file for authentication, I want to use a custom Python module in the inner-tunnel (I presume) to authenticate the user with a REST API. 1) How do I know in the Python module when to get in the middle of the multi-step eap authentication without causing problems? 2) How do I get the User-Password? I've seen posts that suggest the User-Password might be sent encrypted in the EAP-Message. If that's the case: 3) How do I know how to decrypt the EAP-Message? 4) Anything else I need to know? Thanks, Gary

3 6

PEAP request with EAP-MSCHAPv2 as Phase 2, how to store attribute data.
by work vlpl 09 Nov '17

09 Nov '17

Hello, I use configuration what can handle PEAP + EAP-MSCHAPv2 as Phase 2 and proxy inner tunnel request to another home server. I need log request with real username (inner identity) and other custom attribute available in inner tunnel phase. For other requests like EAP-TTLS/PAP it is trivial, in authorize section I save attributes of interest to me in control list, because proxy response override reply list. Proxy response set back to inner tunnel and In post-auth section I expand stored attributes and linelog directive do work. Then request type is PEAP + EAP-MSCHAPv2 as Phase 2, proxy save response to "some temporary storage" (Saving tunneled attributes for later) (101) eap: Doing post-proxy callback (101) eap: Passing reply from proxy back into the tunnel (101) eap: Got tunneled reply RADIUS code 2 (101) eap: EAP-Message = 0x03080004 (101) eap: Message-Authenticator = 0x21a9b5e96fc954c7cb0713477905fe5b (101) eap: User-Name = "testing_remote" (101) eap: Proxy-State = 0x38 (101) eap: Tunneled authentication was successful (101) eap: SUCCESS (101) eap: Saving tunneled attributes for later (101) eap: Reply was handled And after that supplicant sent final request. Freeradius clear the control list (checked it with debug_all directive, I am not asking freeradius to do it, it happens automaticly), so I lost my attributes saved in control list. Freeradius continue eap session and restore User-Name to reply list from temporary storage, (102) eap_peap: [eaptls process] = ok (102) eap_peap: Session established. Decoding tunneled attributes (102) eap_peap: PEAP state send tlv success (102) eap_peap: Received EAP-TLV response (102) eap_peap: Success (102) eap_peap: Using saved attributes from the original Access-Accept (102) eap_peap: User-Name = "testing_remote" (102) eap_peap: caching User-Name = "testing_remote" (102) eap_peap: Failed to find 'persist_dir' in TLS configuration. Session will not be cached on disk. (102) eap: Sending EAP Success (code 3) ID 9 length 4 (102) eap: Freeing handler tls: Freeing cached session VPs So in post-auth section I have real username, but los my custom attributes stored in control list. (102) EXPAND %{reply:User-Name} (102) --> testing_remote (102) EXPAND %{control:User-Name} (102) --> (102) EXPAND %{User-Name} (102) --> anonymous If is it possible, how I can store my custom attributes to "some temporary storage" to have access to them in the very last stage.

2 1

Re: max_requests variable in radiusd.conf
by Claudio Carvalho 09 Nov '17

09 Nov '17

Thank you Alan. Claudio. On Thu, Nov 9, 2017 at 12:18 PM -0200, "Alan DeKok" <aland(a)deployingradius.com <mailto:aland@deployingradius.com> > wrote: > On Nov 9, 2017, at 8:59 AM, Claudio Carvalho <claudio(a)nextdigitalservices.com.br> wrote: > > Using the phrase "The maximum number of requests which the server keeps track of", my first understanding is that somehow the freeradius daemon is doing let's say in memory a control of the opening and closing of sessions No. If I had meant too use the word "sessions", I would have used the word "sessions". The server receives *packets*. The "max_requests" refers to *packets*. It does not refer to *sessions*. I tried to make this clear in my previous message, when I said sessions go into the DB. Apparently not enough... Stop trying to force FreeRADIUS to fit your ideas. Your ideas about how it works are wrong. The documentation describes how FreeRADIUS works. > "track of", you are saying this does not happen, everything is done through the information of the database enabling the use of multiple servers, right? I have no idea what that means. FreeRADIUS stores accounting data (i.e. user sessions) in a database. You can configure two RADIUS servers to talk to the same database. This isn't complex. There's no magic involved. > "The maximum number of requests which the server keeps track of. This should be 256 multiplied by the number of clients. e.g. With 4 clients, this number should be 1024" Is there any reason you're quoting the config files? Do you think I haven't seen that before? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

max_requests variable in radiusd.conf
by Claudio Carvalho 09 Nov '17

09 Nov '17

Hello, I'm a new in freeradius and i have a question, what controls are made by the variable max_requests in radiusd.conf? all the established sessions of the various NASs are directly managed by the freeradius daemon or does this control reside in the database? I ask because if the session control is made entirely in the daemon without intervention of the database and it is necessary to work with load balance, the connections that arrive in this 2 freeradius servers must be tied "sticky" to the source IP, if you balance all connections without "sticky" feature this control would be broken , i'm correct? Thanks, Claudio

2 3