- Freeradius-Users - lists.freeradius.org

How to -> Accounting Monthly Update?
by Igor Karolesky 08 Nov '17

08 Nov '17

Hi there, May i ask for some help? I'm using freeradius 2.1.12 (can't upgrade it) My accounting is working finely but i don't know how to make it update monthly or weekly. Don't know here to configure it. Don't know where the fuck i put the Acct-Interim-Update. I have found a usefull book tho. But I can't reply what i learned on it to my actual network. --

2 1

Solved Freeradius calling station ID
by Marco Ramian 08 Nov '17

08 Nov '17

i addedd this : msg_goodpass = "%{Called-Station-Id}" msg_badpass = "%{Called-Station-Id}" in radius.conf and now can see AP Mac Address, thank u all guys

1 0

Troubleshooting apparent failed RADIUS challenges
by Turner, Ryan H 08 Nov '17

08 Nov '17

Hoping this does not invoke a beating from Alan... We are a LARGE EAP-TLS shop (one of the first), and authenticate 10s of thousands of clients every day. I am noticing (which doesn't mean it is necessarily our fault), that some percentage of our users that cannot connect appear to be breaking down in the Challenge phase. Initially it looks like they aren't even trying to authenticate on wireless (we don't log challenges), but a capture will tell me that a challenge is made, and then there are no responses... A few questions... I honestly find the Radius Challenge section difficult to understand. In our EAP-TLS environment, exactly what is happening during this challenge phase? Doing searching on this has so far returned nebulous answers. Exactly what is being checked of verified with an EAP-TLS client? Secondly, how do you even begin to troubleshoot why certain clients would not progress beyond the challenge? We have an android user that is onboarded with a certificate that will last a year. Periodically, it will just stop working. I will notice an incomplete challenge. If he reonboards with a new certificate, everything works again for some period (obviously looks like a client issue). We also notice that some users fail their challenge when traveling abroad with eduroam. We are running one of the most patched 2.X versions of FreeRadius (we are actively building for a deployment of 3 at this moment). Ryan Turner

2 2

Calling Station ID
by Marco Ramian 08 Nov '17

08 Nov '17

Hi guys, need your help please... have installed freeradius and send Wireless users authentications request through WLC to freeradius, in radius.log cant see Calling Station ID .... need to see Access Point Mac address in logs, Wed Nov 8 13:08:47 2017 : Auth: Login OK: [cc20e82a0636/cc20e82a0636] (from client BUS1 port 4 cli cc-20-e8-2a-06-36) i have defined a Client in Clients.conf and called BUS1 , it shows me the name of Client ... but how can i get Called staion id ( accesspoint mac address ) ? Thank you

2 1

rlm_rest module - authenticate
by philippe2.legoff＠orange.com 07 Nov '17

07 Nov '17

Hello, I’m using a Freeradius 4.0.x release with the rlm_rest module to store the accounting datas inside a key/value database. Storing accounting items works well, and also authorization, but I’m not able to perform authentication using the stored datas (as for MySQL). If anyone have an idea ? rlm_rest/accounting section accounting { uri = "${..connect_uri}/v2/keys/%{Framed-IP-Address}" method = 'put' body = 'post' data = "value=\"Cleartext-Password\": \"%{Framed-IP-Address}\",\"Calling-Station-Id\": \"%{Calling-Station-ID}\",\"3GPP-Location-Info\": \"%{3GPP-User-Location-Info}\",\"3GPP-SGSN-Address\": \"%{3GPP-SGSN-Address}\",\"3GPP-RAT-Type\": \"%{3GPP-RAT-Type}\"" } CLI command is : echo "Calling-Station-Id=237100000002,Framed-IP-Address=201.16.124.239,Service-Type=2,Framed-Protocol=ppp,Acct-Status-Type=Start,3GPP-SGSN-Address=70.70.70.70,3GPP-Location-Info=0x5c2730783030315c27,NAS-IP-Address=10.171.23.53,NAS-Port=1,3GPP-Rat-Type=0x01" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1813 acct testing123 Sent Accounting-Request Id 49 from 0.0.0.0:47843 to 10.104.145.4:1813 length 108 Calling-Station-Id = "237100000002" Framed-IP-Address = 201.16.124.239 Service-Type = Framed-User Framed-Protocol = PPP Acct-Status-Type = Start 3GPP-SGSN-Address = 70.70.70.70 3GPP-Location-Info = 0x5c2730783030315c27 NAS-IP-Address = 10.171.23.53 NAS-Port = 1 3GPP-RAT-Type = UTRAN Received Accounting-Response Id 49 from 10.104.145.4:1813 to 0.0.0.0:47843 via lo length 20 And the datas are correctly stored. Raddebug seems fine for accounting : Network received packet size 108 Ready to process requests Resetting worker cleanup timer to +30s (0) running request (0) Received Accounting-Request ID 49 (0) Calling-Station-Id = "237100000002" (0) Framed-IP-Address = 201.16.124.239 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Acct-Status-Type = Start (0) 3GPP-SGSN-Address = 70.70.70.70 (0) 3GPP-Location-Info = 0x5c2730783030315c27 (0) NAS-IP-Address = 10.171.23.53 (0) NAS-Port = 1 (0) 3GPP-RAT-Type = UTRAN (0) Running 'recv Accounting-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) recv Accounting-Request { (0) acct_unique { (0) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (0) EXPAND %{string:Class} (0) --> (0) ... (0) } (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> 6f0ca34d8adc2578048d2d1f4bb0f025 (0) &Acct-Unique-Session-Id := 6f0ca34d8adc2578048d2d1f4bb0f025 (0) } # update request (noop) (0) } # else (noop) (0) } # acct_unique (noop) (0) check_accounting_attributes { (0) if (Acct-Status-Type == Start) { (0) if ((!NAS-IP-Address) || (!Service-Type) || (!Framed-Protocol) || (!Framed-IP-Address) || (!3GPP-SGSN-Address) || (!3GPP-RAT-Type) || (!Calling-Station-Id)) { (0) ... (0) } (0) else { (0) ok (ok) (0) } # else (ok) (0) } # if (Acct-Status-Type == Start) (ok) (0) } # check_accounting_attributes (ok) (0) } # recv Accounting-Request (ok) (0) Running 'send Accounting-Response' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) send Accounting-Response { (0) detail - EXPAND /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (0) detail - --> /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - EXPAND %t (0) detail - --> Tue Nov 7 10:23:22 2017 (0) detail (ok) (0) unix (noop) (0) rest - Reserved connection (4) (0) rest - Expanding URI components (0) rest - EXPAND http://10.104.145.4:2379 (0) rest - --> http://10.104.145.4:2379 (0) rest - EXPAND /v2/keys/%{Framed-IP-Address} (0) rest - --> /v2/keys/201.16.124.239 (0) rest - Sending HTTP PUT to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (0) rest - EXPAND value="Cleartext-Password": "%{Framed-IP-Address}","Calling-Station-Id": "%{Calling-Station-ID}","3GPP-Location-Info": "%{3GPP-Location-Info}","3GPP-SGSN-Address": "%{3GPP-SGSN-Address}","3GPP-RAT-Type": "%{3GPP-RAT-Type}" (0) rest - --> value="Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - Content-Length will be 186 bytes (0) rest (yield) Waking up in 2.9 seconds. (0) Processing response header (0) Status : 200 (OK) (0) Type : json (application/json) (0) running request (0) rest - &REST-HTTP-Status-Code := 200 (0) rest - Parsing attribute "action" (0) rest - EXPAND set (0) rest - --> set (0) rest - &action := "set" (0) rest - Parsing attribute "node" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200088 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200088 (0) rest - Parsing attribute "prevNode" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200087 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200087 (0) rest - Released connection (4) (0) rest - Closing expired connection (3): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (2): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (1): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (0): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest (updated) (0) if (noop) { (0) ... (0) } (0) attr_filter.accounting_response - EXPAND %{User-Name} (0) attr_filter.accounting_response - --> (0) attr_filter.accounting_response - Matched entry DEFAULT at line 12 (0) attr_filter.accounting_response (updated) (0) } # send Accounting-Response (updated) (0) Sent Accounting-Response Id 49 from 10.104.145.4:1813 to 10.104.145.4:47843 via lo length 0 (0) done request (0) finished request. Ready to process requests Ready to process requests Ready to process requests For authorize and authenticate sections, I'm trying a GET using the URI on the User-name authorize { uri = "${..connect_uri}/v2/keys/%{User-Name}" method = 'get' body = ''' data = """ # tls = ${..tls} } (action, node, key and value words are declared in dictionary). echo "User-Name=201.16.124.239,NAS-Port=1812,Service-Type=8,NAS-Ip-Address=70.70.70.70,NAS-Identifier=1,Chap-Password=201.16.124.239,Chap-Challenge=1,Cleartext-Password=201.16.124.239" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1812 auth testing123 Sent Access-Request Id 128 from 0.0.0.0:50628 to 10.104.145.4:1812 length 79 User-Name = "201.16.124.239" NAS-Port = 1812 Service-Type = Authenticate-Only NAS-IP-Address = 70.70.70.70 NAS-Identifier = "1" CHAP-Password = 0x49c87256c50220fee804602c892c713d48 CHAP-Challenge = 0x31 Cleartext-Password = "201.16.124.239" Cleartext-Password = "201.16.124.239" Received Access-Reject Id 128 from 10.104.145.4:1812 to 0.0.0.0:50628 via lo length 20 (0) -: Expected Access-Accept got Access-Reject: Invalid character '' in attribute name I don’t see why the &value attribute isn’t parsed after Expanded : with raddebug : (1) running request (1) Received Access-Request ID 128 (1) User-Name = "201.16.124.239" (1) NAS-Port = 1812 (1) Service-Type = Authenticate-Only (1) NAS-IP-Address = 70.70.70.70 (1) NAS-Identifier = "1" (1) CHAP-Password = 0x49c87256c50220fee804602c892c713d48 (1) CHAP-Challenge = 0x31 (1) Running 'recv Access-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) recv Access-Request { (1) filter_user_password { (1) if (&User-Password) { (1) ... (1) } (1) } # filter_user_password (...) (1) rest - Closing connection (4): Hit idle_timeout, was idle for 1259 seconds (1) rest - You probably need to lower "min" (1) rest - 0 of 0 connections in use. You may need to increase "spare" (1) rest - Opening additional connection (5), 1 of 10 pending slots used (1) rest - Reserved connection (5) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (5) (1) rest - Need 4 more connections to reach min connections (5) (1) rest - Opening additional connection (6), 1 of 9 pending slots used (1) rest - Closing expired connection (5): Needs reconnecting (1) rest - You probably need to lower "min" (1) rest (updated) (1) check_authenticate_attributes { (1) if (!User-Password) { (1) update request { (1) &User-Password = &User-Name -> "201.16.124.239" (1) } # update request (noop) (1) update control { (1) &control:Auth-Type = rest (1) } # update control (noop) (1) } # if (!User-Password) (noop) (1) if ((!User-Name) || (!NAS-IP-Address) || (!Service-Type) || (!NAS-Identifier)) { (1) ... (1) } (1) else { (1) ok (ok) (1) } # else (ok) (1) } # check_authenticate_attributes (ok) (1) } # recv Access-Request (updated) (1) Running 'authenticate rest' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) authenticate rest { (1) rest - Reserved connection (6) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (6) (1) rest (updated) (1) } # authenticate rest (updated) (1) Failed to authenticate the user (1) Login incorrect: [201.16.124.239] (from client freeradius-cb-02 port 1812) (1) Running 'send Access-Reject' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) send Access-Reject { (1) attr_filter.access_reject - EXPAND %{User-Name} (1) attr_filter.access_reject - --> 201.16.124.239 (1) attr_filter.access_reject - Matched entry DEFAULT at line 11 (1) attr_filter.access_reject (updated) (1) } # send Access-Reject (updated) (1) Sent Access-Reject Id 128 from 10.104.145.4:1812 to 10.104.145.4:50628 via lo length 0 (1) done request (1) finished request. Ready to process requests Waking up in 29.9 seconds. Where is my error ? Best regards, Philippe _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

4 3

accounting and rlm_cache
by Dmitry Yashin 07 Nov '17

07 Nov '17

Hi, I have a bug in the network and sometimes the stop pack comes before updates. to fix this i write some like this accounting { if (Acct-Status-Type == Start) { rest } if (Acct-Status-Type == Interim-Update) { update control { Cache-Status-Only = 'yes' } cache if (notfound) { rest } else { ok } } if (Acct-Status-Type == Stop) { cache rest } #ok #rest } but this not work , in debug mode i see Tue Nov 7 21:51:00 2017 : Debug: (222) accounting { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Start) { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Start) -> FALSE Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) -> TRUE Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) { Tue Nov 7 21:51:00 2017 : Debug: (222) update control { Tue Nov 7 21:51:00 2017 : Debug: (222) Cache-Status-Only = yes Tue Nov 7 21:51:00 2017 : Debug: (222) } # update control = noop Tue Nov 7 21:51:00 2017 : Debug: (222) modsingle[accounting]: calling cache (rlm_cache) Tue Nov 7 21:51:00 2017 : Debug: %{Acct-Unique-Session-Id} Tue Nov 7 21:51:00 2017 : Debug: Parsed xlat tree: Tue Nov 7 21:51:00 2017 : Debug: attribute --> Acct-Unique-Session-Id Tue Nov 7 21:51:00 2017 : Debug: (222) cache: EXPAND %{Acct-Unique-Session-Id} Tue Nov 7 21:51:00 2017 : Debug: (222) cache: --> cc815c1b8cb89841330796a5f48bfa12 Tue Nov 7 21:51:00 2017 : Debug: (222) cache: Mutex acquired Tue Nov 7 21:51:00 2017 : Debug: (222) cache: No cache entry found for "cc815c1b8cb89841330796a5f48bfa12" Tue Nov 7 21:51:00 2017 : Debug: (222) cache: Mutex released Tue Nov 7 21:51:00 2017 : Debug: (222) modsingle[accounting]: returned from cache (rlm_cache) Tue Nov 7 21:51:00 2017 : Debug: (222) [cache] = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) } # if (Acct-Status-Type == Interim-Update) = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) } # accounting = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) Not sending reply to client. Tue Nov 7 21:51:00 2017 : Debug: (222) Finished request why not work if (notfound) in accounting ? thx

2 2

Deadlocks in Freeradius MySQL Database
by Claudio Carvalho 06 Nov '17

06 Nov '17

Hi, I am testing freeradius version 3 with RedHat Enterprise Server 7.4 and MySQL 5.6.35, even in a newly fresh/initialized database I get these messages in radius.log, has anyone else been through this situation yet? what would be the best choice of operating system, database and freeradius version that recommend as more stable? ############################################################################### ERROR: (1526654) sqlippool: ERROR: rlm_sql_mysql: ERROR 1213 (Deadlock found when trying to get lock; try restarting transaction): 40001 [root@rad-a-01 radius]# cat radius.log | wc -l 197357 [root@rad-a-01 radius]# cat radius.log | grep Deadlock | wc -l 2468 [root@rad-a-01 radius]# rpm -qa | grep freeradius freeradius-3.0.13-8.el7_4.x86_64 freeradius-mysql-3.0.13-8.el7_4.x86_64 freeradius-utils-3.0.13-8.el7_4.x86_64 freeradius-ldap-3.0.13-8.el7_4.x86_64 [root@rad-a-01 radius]# uname -a Linux rad-a-01 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 13 10:46:25 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux ############################################################################### Thanks, Claudio.

4 8

Building from source with postgres support
by Toby Walsh 06 Nov '17

06 Nov '17

Hi list, I am a reasonable long-time user of Freeradius on a single monolithic host but I'm setting up a new server and putting my services in containers. I have postgres in a Docker container running nicely, fully configured with my old user base migrated from MySQL. I am compiling Freeradius 3.0.15 on a separate container and hoping to use Postgres as the store. radtest with bob/hello works fine. However I realised when I tried to set up Postgres support that it fails with rlm_sql_postgresql.so not found. I'm guessing that the compile process detects database support and only builds in binding libraries if it finds that database on the same system? Can you tell me what the requirements are that Freeradius' build process builds rlm_sql_postgresql.so for me? One that is hopefully compatible with driving Freeradius on that end but independent of Postgres on the other container? Freeradius is on a Centos 7.4 container, Postgres 10 is on Debian container. Thanks

3 5

two questions about migration from FR 2.X to 3.X
by Anton Kiryushkin 03 Nov '17

03 Nov '17

Hello. I have two question about migration from oldest to newest version. 1. After migration, the process authorization by MSCHAP-V2 wrote that can't make NT-password: Fri Nov 3 10:27:52 2017 : WARNING: (4) mschap: No Cleartext-Password configured. Cannot create NT-Password Fri Nov 3 10:27:52 2017 : WARNING: (4) mschap: No Cleartext-Password configured. Cannot create LM-Password Fri Nov 3 10:27:52 2017 : Debug: (4) mschap: Client is using MS-CHAPv1 with NT-Password Fri Nov 3 10:27:52 2017 : ERROR: (4) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Fri Nov 3 10:27:52 2017 : ERROR: (4) mschap: MS-CHAP2-Response is incorrect This happened in inner-tunnel site with config: server inner-tunnel { authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } But I have the same config on FR 2.X in it worked. Could tell me why? The second question with another client. I've got the next error message: Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: Failed in __FUNCTION__ (SSL_read): s3_srvr.c[1240]:error:1408A0E3:SSL routines:ssl3_get_client_hello:parse tlsext Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: System call (I/O) error (-1) Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: TLS receive handshake failed during operation Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: [eaptls process] = fail Thu Nov 2 21:44:19 2017 : ERROR: (159) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed This is printer Canon 5240i and I can't change his software. As well as in the previous question, all work with FR 2.X. -- Best regards, Anton Kiryushkin

2 6

How Radperf increase values of "Acct-Input-Octets" and "Acct-Output-Octets" fields
by Claudio Carvalho 02 Nov '17

02 Nov '17

Hi, I'm testing radperf and i need manipulate the values of fields "Acct-Input-Octets" and "Acct-Output-Octets". Is it possible for each "Interim-Update" the software increase the values of these fields? Thanks, Claudio.

2 2