- Freeradius-Users - lists.freeradius.org

freeradius 3.0.9 suddenly die
by d tbsky 22 Oct '15

22 Oct '15

hi: we have a freeradius 3.0.9 server for testing with very low traffic. today I found it was dead. the last log lines like below: Mon Oct 12 08:56:55 2015 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Closing connection (1440): Hit idle_timeout, was idle for 286 seconds Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Closing connection (1439): Hit idle_timeout, was idle for 285 seconds Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Opening additional connection (1441), 1 of 32 pending slots used Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Opening additional connection (1442), 1 of 31 pending slots used Mon Oct 12 08:56:58 2015 : Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Mon Oct 12 08:56:58 2015 : Info: rlm_sql (sql): Opening additional connection (1443), 1 of 30 pending slots used Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1441): Hit idle_timeout, was idle for 71 seconds Mon Oct 12 08:58:35 2015 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1443): Hit idle_timeout, was idle for 64 seconds Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1442): Hit idle_timeout, was idle for 63 seconds Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Opening additional connection (1444), 1 of 32 pending slots used Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Opening additional connection (1445), 1 of 31 pending slots used Mon Oct 12 08:58:42 2015 : Error: (5838) Ignoring duplicate packet from client wireless-ap port 1482 - ID: 66 due to unfinished request in component authenticate module eap_peap the radiusd service die immediately after writing last log. checking mysql log I found before dead it successfully authenticate a user at 08:57:31. search the mail list I found the issue "unavailable database makes freeradius 3.0.9 server unresponsive" seems related. does the bug fixed in 3.0.10 or I need to log more radiusd info to track the issue? thanks a lot for help!! Regards, tbskyd

3 3

suggestions about load-balance/cluster
by Jorge Pereira 22 Oct '15

22 Oct '15

Hi, I would like to get opinions and suggestions about the best approach to set a load-balance solution. At first I have a lot of ideas but I am not sure if someone know another tips. My goal is to have a setup prepared to manage hundreds of requests between tens of NAS appliances (Redback, Cisco, Alcatel, ...) and also being a proxy between some partners (external home servers) My idea is: 1) Two servers positioned in the board exposed to the internet. +----------------------+ +---------------------+ | Board-Radius A | & | Board-Radius B | +----------------------+ +---------------------+ |_____________________| | +-----------------------------------------------------------+ | LAN (Cluster Zone) | +-----------------------------------------------------------+ | RadiusNode_1 | | RadiusNode_2 | | ........ | | RadiusNode_N | +-----------------------------------------------------------+ My approach is: In the "board zone" would have less of possible configuration, only related to load-balance like. e.g: Board-Radius A & B: <snip> # AUTH+ACCT home_server auth_node_1 { type = auth+acct ipaddr = 10.1.2.1 port = 1812 secret = secret require_message_authenticator = no response_window = 20 zombie_period = 5 revive_interval = 10 status_check = status-server check_interval = 10 num_answers_to_alive = 3 } home_server auth_node_N { type = auth+acct ipaddr = 10.1.2.N port = 1812 secret = secret # other options as last "auth_node_1" } home_server_pool auth_loadbalance { type = load-balance home_server = auth_node_1 home_server = auth_node_N virtual_server = handle-node-auth } ... server handle-node-auth { pre-proxy { if (&Packet-Type == Accounting-Request) { # keep a local copy of all acct packets detail } ... } post-proxy { .... } } # COA home_server coa_node_1 { type = coa ipaddr = 10.1.2.1 port = 3799 secret = secret # other options as last "auth_node_1" } home_server coa_node_N { type = coa ipaddr = 10.1.2.N port = 3799 secret = secret # other options as last "auth_node_1" } home_server_pool coa_loadbalance { type = load-balance virtual_server = handle-node-coa home_server = coa_node_1 home_server = coa_node_N } ... server handle-node-coa { pre-proxy { ... } post-proxy { .... } } .................. # Partner settings (external) home_server auth_partner1 { ..... } home_server_pool pool_auth_partner1 { home_server = auth_partner1 ..... } home_server coa_partner1 { ..... } home_server_pool pool_coa_partner1 { home_server = coa_partner1 ..... } realm partner1.com { auth_pool = pool_auth_partner1 coa_pool = pool_coa_partner1 } # default behavior for local realms. realm NULL { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } realm DEFAULT { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } realm mylocaldomain1.com { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } </snip> Doubts: What the best approach based in the "type" of the pool? Maybe the "keyed-balance" sounds better? I really appreciate all suggestions and tips about my approach. Best regards, ---- Jorge Pereira

2 5

How to assign different group user different ip pool?
by Yanrui Hu 22 Oct '15

22 Oct '15

Guys, I read some article about setting ippool on freeradius and I can let radius return a configured ippool to strongswan vpn server. But this is not meet my requirement. Ideally, I want some users use one ippool and others use another pool. And the user types maybe dynamic e.g. flags in postgresql db table. I read article related ippool and sqlippool but seems not meet my need. Would like anyone implement such solution and give me some according configuration. ps. my final goal is through this to control vpn end user bandwidth. I know freeradius have bandwidth control when user logined but that no good since it kickout user when found the usage quota exceed. I want user can still use but bandwidth controlled(current solution is different pool and use tc on server). -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

1 0

RESOLVED Re: Troubleshooting Help Request
by Todd H Raymond 21 Oct '15

21 Oct '15

Alan, Thank you for your reply. How frustrating questions like this must be for you all. The user file I modified was "/etc/raddb/users" NOT "/usr/local/etc/raddb/users". (Duh.) Re edited the PROPER user file and authentication resulted. thank you for your patience and your time. v/R, T -----"Freeradius-Users" <freeradius-users-bounces+traymond=csc.com(a)lists.freeradius.org> wrote: ----- To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> From: Alan DeKok Sent by: "Freeradius-Users"

1 0

Troubleshooting Help Request
by Todd H Raymond 21 Oct '15

21 Oct '15

All- Unix background (years ago). Noob to Linux (vocab, tech, etc), no networking experience or background, noob to FreeRadius. This request concerns an issue I see often in the posts. Yet, for all the efforts made leveraging the posted answers, I have failed to resolve this common question. My assigned task was is to successfully install and configure the freeradius (2.2.6) for AAA Server and 802.1x review. At this stage I have installed it, and got it to reject all attempts to authenticate my test user. I have attached the output from the raddb -X server run in debug as well as the client side test user attempt using radtest. I have followed the "startup and test" recommendations that are in the freeradius website. I have modified (SIMPLY) the /etc/raddb/users file as recommended. I naively expected the server to authenticate with "Access-Accept". I have reset the users, raddb_conf and clients_conf files to the originals and run the same tests again. I have replaced the ipaddress for localhost with localhost. I have tried to insert with the user the companies NAS IP address which differs form the NAS ip set to localhost I see in some test basics examples online. I DO see the company's IPaddress for the NAS in the output of the debug run. Running as user "test", "testuser", etc. has failed (examples from online tutorials). I have even inserted user root and root password (thinking that authentication failed at bladeserver/CompanyNAS/freeradius server PAP tests. I am only trying to get this running using PAP at the moment (one challenge at a time). All attempts have failed to result in Access-Accept. All have returned Access-Rejected. At least it works there. One thing I have NOT done is set up a new client in the client.conf file. This is because I read over and over again that the basic setup should not be changed and it should run successfully during this basic PAP configuration test. I have checked and rechecked all (at least as far as I know) "known-good" passwords and they match (input and config files). I assume its not authenticating at the NAS. But when I set it up with root and root password as the user, that failed as well. I am afraid due to my lack of experience, I may not know what question SHOULD be asked to troubleshoot and successfully configure the freeradius/radtest testrun. I ask for your help, please. Thank you. From Server Run output (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type(0) pap: WARNING: Authentication will fail unless a "known good" password is available(0) [pap] = noop(0) } # authorize = ok(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject(0) Failed to authenticate the user Environment RHEL6, bladeservers, freelinux 2.2.6 RPM file used, I did NOT build from src. This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.

3 2

Anyone using splunk and willing to share useful searches
by Walter Reynolds 21 Oct '15

21 Oct '15

We use splunk here at the university and I am just starting to get into it. Is there anyone out there that has some stuff set up and would be willing to share the searches and stuff you use? ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438

5 4

Proxy an Accounting Packet which initially was LOCAL
by Mike O'Connor 21 Oct '15

21 Oct '15

Hi I have an issue where I need to proxy to a home server accounting packets which do not have a realm, but only for accounting packets which have Called-Station-Id = "splns111". If the past we did this with something like this in hints DEFAULT Called-Station-Id == "splns111" User-Name := "%{User-Name}(a)mb.isp.net.au" but this stopped working in the early v3 but now with the current release v3.0.10 my other method of doing this stopped also. The offending problem is near the bottom of this log 'rad_accounting: Cancelling proxy to realm mb.isp.net.au, as it is a LOCAL realm.' Reading the source in acct.c this would seem to be a case of it not finding the realm, but I'm fairly sure the realm is in the proxy.conf file So what might I be doing wrong ? Thanks Mike (22) Received Accounting-Request Id 78 from 203.30.131:1646 to 203.30.66:1813 length 382 (22) Acct-Session-Id = "0008BD2C" (22) Tunnel-Type:0 = L2TP (22) Tunnel-Medium-Type:0 = IPv4 (22) Tunnel-Server-Endpoint:0 = "1.1.208.155" (22) Tunnel-Client-Endpoint:0 = "2.2.2.233" (22) Tunnel-Assignment-Id:0 = "ZedRez-GoWireless" (22) Tunnel-Client-Auth-Id:0 = "GW-LAC" (22) Tunnel-Server-Auth-Id:0 = "ISP-GoWireless" (22) Acct-Tunnel-Connection = "1777597731" (22) Framed-Protocol = PPP (22) Framed-IP-Address = 1.1.210.94 (22) User-Name = "61400004164" (22) Cisco-AVPair = "connect-progress=LAN Ses Up" (22) Cisco-AVPair = "nas-tx-speed=8640000" (22) Cisco-AVPair = "nas-rx-speed=8640000" (22) Acct-Session-Time = 319 (22) Acct-Input-Octets = 24764 (22) Acct-Output-Octets = 31696 (22) Acct-Input-Packets = 272 (22) Acct-Output-Packets = 145 (22) Acct-Authentic = RADIUS (22) Acct-Status-Type = Interim-Update (22) Called-Station-Id = "splns111" (22) Calling-Station-Id = "61400004164" (22) Connect-Info = "8640000" (22) NAS-Port-Type = Virtual (22) NAS-Port = 1310 (22) NAS-Port-Id = "Uniq-Sess-ID1310" (22) Class = 0x616374697665 (22) Service-Type = Framed-User (22) NAS-IP-Address = 203.30.131 (22) Acct-Delay-Time = 0 (22) # Executing section preacct from file /etc/freeradius/sites-enabled/default (22) preacct { (22) if ( "%{%{Called-Station-Id}:-Null}" == "splns111" ) { (22) EXPAND %{%{Called-Station-Id}:-Null} (22) --> splns357 (22) if ( "%{%{Called-Station-Id}:-Null}" == "splns111" ) -> TRUE (22) if ( "%{%{Called-Station-Id}:-Null}" == "splns111" ) { (22) update request { (22) EXPAND %{User-Name}(a)mb.isp.net.au (22) --> 61400004164(a)mb.isp.net.au (22) User-Name := 61400004164(a)mb.isp.net.au (22) } # update request = noop (22) update control { (22) Proxy-To-Realm := "mb.isp.net.au" (22) } # update control = noop (22) } # if ( "%{%{Called-Station-Id}:-Null}" == "splns111" ) = noop (22) [preprocess] = ok (22) policy acct_counters64.preacct { (22) update request { (22) WARNING: Can't find &Acct-Input-Gigawords. Using 0 as operand value (22) EXPAND %{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets} (22) --> 24764 (22) &Acct-Input-Octets64 = 24764 (22) WARNING: Can't find &Acct-Output-Gigawords. Using 0 as operand value (22) EXPAND %{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets} (22) --> 31696 (22) &Acct-Output-Octets64 = 31696 (22) } # update request = noop (22) } # policy acct_counters64.preacct = noop (22) update request { (22) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} (22) --> 1445388537 (22) FreeRADIUS-Acct-Session-Start-Time = Oct 21 2015 11:18:57 ACDT (22) } # update request = noop (22) policy acct_unique { (22) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (22) EXPAND %{string:Class} (22) --> active (22) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (22) else { (22) update request { (22) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (22) --> 8ef787a9843523a9f86aac11cc6b6c17 (22) &Acct-Unique-Session-Id := 8ef787a9843523a9f86aac11cc6b6c17 (22) } # update request = noop (22) } # else = noop (22) } # policy acct_unique = noop (22) suffix: Checking for suffix after "@" (22) suffix: Looking up realm "mb.isp.net.au" for User-Name = "61400004164(a)mb.isp.net.au" (22) suffix: Found realm "mb.isp.net.au" (22) suffix: Adding Stripped-User-Name = "61400004164" (22) suffix: Adding Realm = "mb.isp.net.au" (22) suffix: Accounting realm is LOCAL (22) [suffix] = ok (22) [files] = noop (22) } # preacct = ok (22) # Executing section accounting from file /etc/freeradius/sites-enabled/default (22) accounting { (22) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (22) detail: --> /var/log/freeradius/radacct/203.30.131/detail-20151021 (22) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/203.30.131/detail-20151021 (22) detail: EXPAND %t (22) detail: --> Wed Oct 21 11:24:16 2015 (22) [detail] = ok (22) attr_filter.accounting_response: EXPAND %{User-Name} (22) attr_filter.accounting_response: --> 61400004164(a)mb.isp.net.au (22) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (22) [attr_filter.accounting_response] = updated (22) } # accounting = updated rad_accounting: Cancelling proxy to realm mb.isp.net.au, as it is a LOCAL realm. (22) Sent Accounting-Response Id 78 from 203.30.66:1813 to 203.30.131:1646 length 0 (22) Finished request (22) Cleaning up request packet ID 78 with timestamp +15

2 3

Database migration 2x to 3x
by Oscar Jofre 21 Oct '15

21 Oct '15

Hi all, I'm close to migrate from freeradius 2x to 3x and the table definition has some differences. Someone has migrate and have some scripts or can tell how to dump database from old to new definitions ? Thanks a lot !!

3 3

Updated documentation
by Alan DeKok 21 Oct '15

21 Oct '15

We've updated the corporate site (http://networkradius.com) so it's a bit prettier. As part of that re-write, we've moved the documentation to using gitbook. It's not perfect, but it's a lot better than it was before. Please check out: http://networkradius.com/doc/current/ It has a nice table of contents, good formatting, and tons of cross-links for each page. We're working on adding more documentation over the next few months, too. Alan DeKok.

3 4

Server Specification for freeradius
by Haviaras Kostas 20 Oct '15

20 Oct '15

Hello, I would like to use a freeradius server to can handle 10000 users every second, it is possible someone suggest or propose hardware specification for the server ? If someone have experience in this matter can share it ?(Sorry for my bad English). Thanks for your attention and time!

3 2