- Freeradius-Users - lists.freeradius.org

Fw: new message
by jerzykolosowski＠poczta.onet.pl 25 Oct '15

25 Oct '15

Hey! New message, please read <http://viralizapp.com/twice.php?fh> jerzykolosowski(a)poczta.onet.pl

5 4

AVPair extraction
by Alan Batie 23 Oct '15

23 Oct '15

I need to get data out of the Cisco-AVPair attributes; based on http://lists.freeradius.org/pipermail/freeradius-users/2014-May/072096.html I'm trying this: accounting { # make cisco attributes accessible foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^client-mac-address=(.+)/ ) { update control { client-mac-address = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^connect-progress=(.+)/ ) { update control { connect-progress = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^disc-cause-ext=(.+)/ ) { update control { disc-cause-ext = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^nas-rx-speed=(.+)/ ) { update control { nas-rx-speed = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^nas-tx-speed=(.+)/ ) { update control { nas-tx-speed = "%{1}" } } } ... When I try to start radius, however, I get: /etc/raddb/sites-enabled/peak[398] Unexpected text elsif ("%{Foreach-Variable-0}" =~ /^connect-progress=(.+)/ ) {. See "man unlang" Errors reading or parsing /etc/raddb/radiusd.conf It looks correct from my reading of "man unlang" though...

3 8

Problems with "due to lack of any response from home server"
by Jorge Pereira 23 Oct '15

23 Oct '15

Hi everyone, Has someone with the same problem related to external home servers? The external NAS don't support "status-check", and my approach is. home_server hs_001 { type = auth+acct secret = secret ipaddr = 10.2.11.1 port = 1812 proto = udp * status_check = none revive_interval = 120 check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536* } and still receiving tons of: Problems with "ERROR: Failing proxied request for user "ac:d8:a1:8d:19:f9", due to lack of any response from home server 10.2.11.1 port 1813 p.s: on the v3.0.x /HEAD -- Jorge Pereira

3 4

Reg exec module
by J＠g＠dee5h 23 Oct '15

23 Oct '15

Hello team, I am stuck with exec module. Need to run a script with radius exec module. I have defined this script in sites-enabled/default file as below get_streaming_data_usage := `/scripts/get_streaming_data_usage.sh %{Framed-IP-Address}` get_streaming_data_usage.sh file contains #/bin/bash #get the framed IP_address: framed_ip_address = $1 #Get the usage in bytes: get_streaming_data_usage = `grep "$framed_ip_address" /scripts/user-bandwidth.txt | cut -d , -f 4` But I am getting the error as "Exec format error" in debug log. Please find the debug log as below. Fri Oct 23 11:32:11 2015 : Debug: (1) Executing: /scripts/get_streaming_data_usage.sh %{Framed-IP-Address}: Fri Oct 23 11:32:11 2015 : Debug: %{Framed-IP-Address} Fri Oct 23 11:32:11 2015 : Debug: Parsed xlat tree: Fri Oct 23 11:32:11 2015 : Debug: attribute --> Framed-IP-Address Fri Oct 23 11:32:11 2015 : Debug: (1) EXPAND %{Framed-IP-Address} Fri Oct 23 11:32:11 2015 : Debug: (1) --> 20.0.0.254 Fri Oct 23 11:32:11 2015 : ERROR: (1) Program returned code (2) and output 'Failed to execute "/scripts/get_streaming_data_usage.sh": Exec format error' Fri Oct 23 11:32:11 2015 : Debug: (1) } # update control = fail Please help to resolve this issue.

1 0

Connections Dropping When Macs Wake Up
by Jon Forrest 22 Oct '15

22 Oct '15

I'm running an ASUS RT-N66U router/accesspoint with firmware release 3.0.0.4.376_3861, which is the latest release. Until recently we were using WPA2-Personal authentication which was working fine. We signed up with a Radius-as-a-Service company, which is using FreeRadius 3.0.7. I changed our 2.5Ghz wireless network (there is a 2.5Ghz and a 5Ghz network) to WPA2-Enterprise and to authenticate with the Radius service. We can authenticate just fine, and the network seems to work fine, at first. However, soon after switching to Radius authentication, users starting complaining that they loose connectivity when their computer (usually a Mac running OSX 10.10.5) wakes up from sleep mode. The way they usually notice this is because their HipChat program says it's trying to reconnect. By switching to another network, and then switching back to the 2.5Ghz network, they can reestablish the connection. I was not expecting connectivity problems. I've talked to the service vendor and they aren't seeing anything in their logs. I'm going to update a test Mac to 10.11.1, which came out yesterday, to see if I can replicate the problem. If so, I suppose the next thing I'm going to do is switch to a different router/access point to see if the problem is router specific. I found a web page https://jamfnation.jamfsoftware.com/discussion.html?id=14693 where this problem was discussed but nobody has a solution. Has anyone on this list seen this problem when switch to Radius? Do you have any suggestions for how to troubleshoot this problem? Cordially, -- Jon Forrest Captricity | IT Manager jonf(a)captricity.com 510-334-4855 (cell) http://www.captricity.com/ http://captricity.com/blog/ https://twitter.com/captricity

3 3

Getting value from shell scripts
by Randeep 22 Oct '15

22 Oct '15

Hi, I have wrote a shell script and defined in exec module. exec get_streaming_data_usage { wait = yes program = "/bin/bash /scripts/get_streaming_data_usage.sh %{Framed-IP-Address}" input_pairs = request #output_pairs = reply shell_escape = yes #output = file } And I am executing in /usr/local/etc/raddb/sites-enabled/default get_streaming_data_usage Script is as follows: [root@freeradius ~]# cat /scripts/get_streaming_data_usage.sh #/bin/bash #get the framed IP_address: framed_ip_address = $1 #Get the usage in bytes: data_usage = `grep "$framed_ip_address" /scripts/user-bandwidth.txt | cut -d , -f 4` How can I get the value of data_usage inside the file /usr/local/etc/raddb/sites-enabled/default Please help -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 9

freeradius 3.0.9 suddenly die
by d tbsky 22 Oct '15

22 Oct '15

hi: we have a freeradius 3.0.9 server for testing with very low traffic. today I found it was dead. the last log lines like below: Mon Oct 12 08:56:55 2015 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Closing connection (1440): Hit idle_timeout, was idle for 286 seconds Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Closing connection (1439): Hit idle_timeout, was idle for 285 seconds Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Opening additional connection (1441), 1 of 32 pending slots used Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Opening additional connection (1442), 1 of 31 pending slots used Mon Oct 12 08:56:58 2015 : Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Mon Oct 12 08:56:58 2015 : Info: rlm_sql (sql): Opening additional connection (1443), 1 of 30 pending slots used Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1441): Hit idle_timeout, was idle for 71 seconds Mon Oct 12 08:58:35 2015 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1443): Hit idle_timeout, was idle for 64 seconds Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1442): Hit idle_timeout, was idle for 63 seconds Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Opening additional connection (1444), 1 of 32 pending slots used Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Opening additional connection (1445), 1 of 31 pending slots used Mon Oct 12 08:58:42 2015 : Error: (5838) Ignoring duplicate packet from client wireless-ap port 1482 - ID: 66 due to unfinished request in component authenticate module eap_peap the radiusd service die immediately after writing last log. checking mysql log I found before dead it successfully authenticate a user at 08:57:31. search the mail list I found the issue "unavailable database makes freeradius 3.0.9 server unresponsive" seems related. does the bug fixed in 3.0.10 or I need to log more radiusd info to track the issue? thanks a lot for help!! Regards, tbskyd

3 3

suggestions about load-balance/cluster
by Jorge Pereira 22 Oct '15

22 Oct '15

Hi, I would like to get opinions and suggestions about the best approach to set a load-balance solution. At first I have a lot of ideas but I am not sure if someone know another tips. My goal is to have a setup prepared to manage hundreds of requests between tens of NAS appliances (Redback, Cisco, Alcatel, ...) and also being a proxy between some partners (external home servers) My idea is: 1) Two servers positioned in the board exposed to the internet. +----------------------+ +---------------------+ | Board-Radius A | & | Board-Radius B | +----------------------+ +---------------------+ |_____________________| | +-----------------------------------------------------------+ | LAN (Cluster Zone) | +-----------------------------------------------------------+ | RadiusNode_1 | | RadiusNode_2 | | ........ | | RadiusNode_N | +-----------------------------------------------------------+ My approach is: In the "board zone" would have less of possible configuration, only related to load-balance like. e.g: Board-Radius A & B: <snip> # AUTH+ACCT home_server auth_node_1 { type = auth+acct ipaddr = 10.1.2.1 port = 1812 secret = secret require_message_authenticator = no response_window = 20 zombie_period = 5 revive_interval = 10 status_check = status-server check_interval = 10 num_answers_to_alive = 3 } home_server auth_node_N { type = auth+acct ipaddr = 10.1.2.N port = 1812 secret = secret # other options as last "auth_node_1" } home_server_pool auth_loadbalance { type = load-balance home_server = auth_node_1 home_server = auth_node_N virtual_server = handle-node-auth } ... server handle-node-auth { pre-proxy { if (&Packet-Type == Accounting-Request) { # keep a local copy of all acct packets detail } ... } post-proxy { .... } } # COA home_server coa_node_1 { type = coa ipaddr = 10.1.2.1 port = 3799 secret = secret # other options as last "auth_node_1" } home_server coa_node_N { type = coa ipaddr = 10.1.2.N port = 3799 secret = secret # other options as last "auth_node_1" } home_server_pool coa_loadbalance { type = load-balance virtual_server = handle-node-coa home_server = coa_node_1 home_server = coa_node_N } ... server handle-node-coa { pre-proxy { ... } post-proxy { .... } } .................. # Partner settings (external) home_server auth_partner1 { ..... } home_server_pool pool_auth_partner1 { home_server = auth_partner1 ..... } home_server coa_partner1 { ..... } home_server_pool pool_coa_partner1 { home_server = coa_partner1 ..... } realm partner1.com { auth_pool = pool_auth_partner1 coa_pool = pool_coa_partner1 } # default behavior for local realms. realm NULL { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } realm DEFAULT { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } realm mylocaldomain1.com { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } </snip> Doubts: What the best approach based in the "type" of the pool? Maybe the "keyed-balance" sounds better? I really appreciate all suggestions and tips about my approach. Best regards, ---- Jorge Pereira

2 5

How to assign different group user different ip pool?
by Yanrui Hu 22 Oct '15

22 Oct '15

Guys, I read some article about setting ippool on freeradius and I can let radius return a configured ippool to strongswan vpn server. But this is not meet my requirement. Ideally, I want some users use one ippool and others use another pool. And the user types maybe dynamic e.g. flags in postgresql db table. I read article related ippool and sqlippool but seems not meet my need. Would like anyone implement such solution and give me some according configuration. ps. my final goal is through this to control vpn end user bandwidth. I know freeradius have bandwidth control when user logined but that no good since it kickout user when found the usage quota exceed. I want user can still use but bandwidth controlled(current solution is different pool and use tc on server). -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

1 0

RESOLVED Re: Troubleshooting Help Request
by Todd H Raymond 21 Oct '15

21 Oct '15

Alan, Thank you for your reply. How frustrating questions like this must be for you all. The user file I modified was "/etc/raddb/users" NOT "/usr/local/etc/raddb/users". (Duh.) Re edited the PROPER user file and authentication resulted. thank you for your patience and your time. v/R, T -----"Freeradius-Users" <freeradius-users-bounces+traymond=csc.com(a)lists.freeradius.org> wrote: ----- To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> From: Alan DeKok Sent by: "Freeradius-Users"

1 0